mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
hakril
52 lines
1.7 KiB
Python
52 lines
1.7 KiB
Python
import sys
|
|
import os.path
|
|
import pprint
|
|
import threading
|
|
sys.path.append(os.path.abspath(__file__ + "\..\.."))
|
|
|
|
import windows
|
|
import windows.test
|
|
import windows.debug
|
|
import windows.generated_def as gdef
|
|
|
|
# The debugge python will just print the result of
|
|
# 3 call to IsDebuggerPresent
|
|
TARGET_PYTHON_CODE = '"\
|
|
import ctypes;\
|
|
import time;\
|
|
IsDebuggerPresent = ctypes.windll.kernel32.IsDebuggerPresent;\
|
|
print(\'[DEBUGGE] IsDebuggerPresent={0}\'.format(IsDebuggerPresent()));\
|
|
time.sleep(1);\
|
|
print(\'[DEBUGGE] IsDebuggerPresent={0}\'.format(IsDebuggerPresent()));\
|
|
time.sleep(1);\
|
|
print(\'[DEBUGGE] IsDebuggerPresent={0}\'.format(IsDebuggerPresent()));\
|
|
"'
|
|
|
|
# This breakpoint now nothing about its target argument
|
|
# It only now how to break at the return of the function
|
|
# This allow us to change the return value of any function
|
|
class IncrementReturnValue(windows.debug.FunctionCallBP):
|
|
def __init__(self, addr, initialvalue):
|
|
super(IncrementReturnValue, self).__init__(addr)
|
|
self.initialvalue = initialvalue
|
|
|
|
def trigger(self, dbg, exc):
|
|
# Ask to break a the return of the function
|
|
# callback is ret_trigger
|
|
self.break_on_ret(dbg, exc)
|
|
|
|
def ret_trigger(self, dbg, exc):
|
|
ctx = dbg.current_thread.context
|
|
# Func result is an alias to EAX/RAX
|
|
ctx.func_result = self.initialvalue
|
|
# Set the new context for the target thread
|
|
dbg.current_thread.set_context(ctx)
|
|
self.initialvalue += 1
|
|
|
|
d = windows.debug.Debugger.debug(sys.executable, [sys.executable, "-c", TARGET_PYTHON_CODE])
|
|
# We could also give the direct address of the function
|
|
# But it would require to wait for the module to be loaded
|
|
d.add_bp(IncrementReturnValue("kernelbase!IsDebuggerPresent", 42))
|
|
d.loop()
|
|
|