mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Clement Rouault
31 lines
894 B
Python
31 lines
894 B
Python
import sys
|
|
import os.path
|
|
import pprint
|
|
sys.path.append(os.path.abspath(__file__ + "\..\.."))
|
|
|
|
import windows
|
|
import windows.test
|
|
import windows.debug
|
|
|
|
from windows.generated_def.winstructs import *
|
|
|
|
# Just a debugger that follow NtCreateFile and print filename & handler
|
|
from debug_functionbp import FollowNtCreateFile
|
|
|
|
|
|
def follow_create_file(pid):
|
|
print("Finding process with pid <{0}>".format(pid))
|
|
target = [p for p in windows.system.processes if p.pid == pid][0]
|
|
print("Target is {0}".format(target))
|
|
dbg = windows.debug.Debugger.attach(target)
|
|
print("Debugger attached: {0}".format(dbg))
|
|
print("")
|
|
dbg.add_bp(FollowNtCreateFile())
|
|
dbg.loop()
|
|
|
|
if __name__ == "__main__":
|
|
# Create a non-debugged process safe to debug
|
|
calc = windows.test.pop_calc_32(dwCreationFlags=0)
|
|
# Give ovnly the PID to follow_create_file
|
|
follow_create_file(calc.pid)
|