mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
hakril
1370 lines
118 KiB
HTML
1370 lines
118 KiB
HTML
|
||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||
|
||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||
<head>
|
||
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
|
||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||
<title>9. windows.debug – Debugging — PythonForWindows 0.6 documentation</title>
|
||
<link rel="stylesheet" href="_static/classic.css" type="text/css" />
|
||
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
|
||
<link rel="stylesheet" type="text/css" href="_static/css/mbasic.css" />
|
||
|
||
<script type="text/javascript" id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
|
||
<script type="text/javascript" src="_static/jquery.js"></script>
|
||
<script type="text/javascript" src="_static/underscore.js"></script>
|
||
<script type="text/javascript" src="_static/doctools.js"></script>
|
||
<script type="text/javascript" src="_static/language_data.js"></script>
|
||
|
||
<link rel="index" title="Index" href="genindex.html" />
|
||
<link rel="search" title="Search" href="search.html" />
|
||
<link rel="next" title="10. windows.com - Component Object Model" href="com.html" />
|
||
<link rel="prev" title="8. windows.wintrust – Checking signature" href="wintrust.html" />
|
||
</head><body>
|
||
<div class="related" role="navigation" aria-label="related navigation">
|
||
<h3>Navigation</h3>
|
||
<ul>
|
||
<li class="right" style="margin-right: 10px">
|
||
<a href="genindex.html" title="General Index"
|
||
accesskey="I">index</a></li>
|
||
<li class="right" >
|
||
<a href="py-modindex.html" title="Python Module Index"
|
||
>modules</a> |</li>
|
||
<li class="right" >
|
||
<a href="com.html" title="10. windows.com - Component Object Model"
|
||
accesskey="N">next</a> |</li>
|
||
<li class="right" >
|
||
<a href="wintrust.html" title="8. windows.wintrust – Checking signature"
|
||
accesskey="P">previous</a> |</li>
|
||
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.6 documentation</a> »</li>
|
||
</ul>
|
||
</div>
|
||
|
||
<div class="document">
|
||
<div class="documentwrapper">
|
||
<div class="bodywrapper">
|
||
<div class="body" role="main">
|
||
|
||
<div class="section" id="module-windows.debug">
|
||
<span id="windows-debug-debugging"></span><h1>9. <a class="reference internal" href="#module-windows.debug" title="windows.debug"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug</span></code></a> – Debugging<a class="headerlink" href="#module-windows.debug" title="Permalink to this headline">¶</a></h1>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">See sample <a class="reference internal" href="sample.html#sample-debugger"><span class="std std-ref">Debugging</span></a></p>
|
||
</div>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p>If you are interrested by symbols (PDB) handling, go to subsection <a class="reference internal" href="#debug-symbols-module"><span class="std std-ref">windows.debug.symbols – Using symbols</span></a>.</p>
|
||
<p class="last">You can also look at the symbols-related samples: <a class="reference internal" href="sample.html#sample-symbols"><span class="std std-ref">Symbols</span></a></p>
|
||
</div>
|
||
<div class="section" id="debugger">
|
||
<h2>9.1. <a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a><a class="headerlink" href="#debugger" title="Permalink to this headline">¶</a></h2>
|
||
<p>The <a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a> is the base class to perform the debugging of a remote process.
|
||
The <a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a> have some functions called on given event that can be implemented by subclasses.</p>
|
||
<p>All Memory-breakpoint are disabled when callind a public callback or a breakpoint <code class="docutils literal notranslate"><span class="pre">trigger()</span></code> function.</p>
|
||
<p>This means that those methods see the original <code class="docutils literal notranslate"><span class="pre">current_process</span></code> memory access rights.</p>
|
||
<dl class="class">
|
||
<dt id="windows.debug.Debugger">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.</code><code class="descname">Debugger</code><span class="sig-paren">(</span><em>target</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>A debugger based on standard Win32 API. Handle :</p>
|
||
<ul class="simple">
|
||
<li>Standard BP (int3)</li>
|
||
<li>Hardware-Exec BP (DrX)</li>
|
||
<li>Memory BP (virtual_protect)</li>
|
||
</ul>
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.__init__">
|
||
<code class="descname">__init__</code><span class="sig-paren">(</span><em>target</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.__init__"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.__init__" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p><code class="docutils literal notranslate"><span class="pre">target</span></code> must be a debuggable <code class="xref py py-class docutils literal notranslate"><span class="pre">WinProcess</span></code>.</p>
|
||
</dd></dl>
|
||
|
||
<dl class="classmethod">
|
||
<dt id="windows.debug.Debugger.attach">
|
||
<em class="property">classmethod </em><code class="descname">attach</code><span class="sig-paren">(</span><em>target</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.attach"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.attach" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>attach to <code class="docutils literal notranslate"><span class="pre">target</span></code> (must be a <code class="xref py py-class docutils literal notranslate"><span class="pre">WinProcess</span></code>)</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">see <a class="reference internal" href="sample.html#sample-debugger-attach"><span class="std std-ref">Debugger.attach sample</span></a></p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.detach">
|
||
<code class="descname">detach</code><span class="sig-paren">(</span><em>target=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.detach"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.detach" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Detach from all debugged processes or process <code class="docutils literal notranslate"><span class="pre">target</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="classmethod">
|
||
<dt id="windows.debug.Debugger.debug">
|
||
<em class="property">classmethod </em><code class="descname">debug</code><span class="sig-paren">(</span><em>path</em>, <em>args=None</em>, <em>dwCreationFlags=0</em>, <em>show_windows=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.debug"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.debug" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Create a process and debug it.</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.loop">
|
||
<code class="descname">loop</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.loop"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.loop" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Debugging loop: handle event / dispatch to breakpoint. Returns when all targets are dead/detached</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.add_bp">
|
||
<code class="descname">add_bp</code><span class="sig-paren">(</span><em>bp</em>, <em>addr=None</em>, <em>type=None</em>, <em>target=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.add_bp"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.add_bp" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Add a breakpoint, bp can be:</p>
|
||
<ul class="simple">
|
||
<li>a <a class="reference internal" href="#windows.debug.Breakpoint" title="windows.debug.Breakpoint"><code class="xref py py-class docutils literal notranslate"><span class="pre">Breakpoint</span></code></a> (addr and type must be <code class="docutils literal notranslate"><span class="pre">None</span></code>)</li>
|
||
<li>any callable (addr and type must NOT be <code class="docutils literal notranslate"><span class="pre">None</span></code>) (NON-TESTED)</li>
|
||
</ul>
|
||
<p>If the <code class="docutils literal notranslate"><span class="pre">bp</span></code> type is <code class="docutils literal notranslate"><span class="pre">STANDARD_BP</span></code> or <code class="docutils literal notranslate"><span class="pre">MEMORY_BREAKPOINT</span></code>, target can be <code class="docutils literal notranslate"><span class="pre">None</span></code> (all targets) or a process.</p>
|
||
<p>If the <code class="docutils literal notranslate"><span class="pre">bp</span></code> type is <code class="docutils literal notranslate"><span class="pre">HARDWARE_EXEC_BP</span></code>, target can be <code class="docutils literal notranslate"><span class="pre">None</span></code> (all targets), a process or a thread.</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.del_bp">
|
||
<code class="descname">del_bp</code><span class="sig-paren">(</span><em>bp</em>, <em>targets=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.del_bp"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.del_bp" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Delete a breakpoint, if targets is <code class="docutils literal notranslate"><span class="pre">None</span></code>: delete it from all targets</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.single_step">
|
||
<code class="descname">single_step</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.single_step"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.single_step" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Make the <code class="docutils literal notranslate"><span class="pre">current_thread</span></code> <code class="docutils literal notranslate"><span class="pre">single_step</span></code>. <code class="docutils literal notranslate"><span class="pre">Debugger.on_single_step</span></code> will be called after that</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.get_memory_breakpoint_at">
|
||
<code class="descname">get_memory_breakpoint_at</code><span class="sig-paren">(</span><em>addr</em>, <em>process=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.get_memory_breakpoint_at"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.get_memory_breakpoint_at" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Get the memory breakpoint that handle <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
<p>Return values are:</p>
|
||
<blockquote>
|
||
<div><ul class="simple">
|
||
<li><code class="docutils literal notranslate"><span class="pre">False</span></code> if the page has no memory breakpoint (real fault)</li>
|
||
<li><code class="docutils literal notranslate"><span class="pre">None</span></code> if the page as memBP but None handle <code class="docutils literal notranslate"><span class="pre">addr</span></code></li>
|
||
<li><code class="docutils literal notranslate"><span class="pre">bp</span></code> the MemBP that handle <code class="docutils literal notranslate"><span class="pre">addr</span></code></li>
|
||
</ul>
|
||
</div></blockquote>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.disable_all_memory_breakpoints">
|
||
<code class="descname">disable_all_memory_breakpoints</code><span class="sig-paren">(</span><em>target=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.disable_all_memory_breakpoints"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.disable_all_memory_breakpoints" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Restore all pages to their original access rights.
|
||
If target is <code class="docutils literal notranslate"><span class="pre">None</span></code>, use <code class="docutils literal notranslate"><span class="pre">current_process</span></code></p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">a mapping of all disabled breakpoints that must be passed to <a class="reference internal" href="#windows.debug.Debugger.restore_all_memory_breakpoints" title="windows.debug.Debugger.restore_all_memory_breakpoints"><code class="xref py py-func docutils literal notranslate"><span class="pre">restore_all_memory_breakpoints()</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.restore_all_memory_breakpoints">
|
||
<code class="descname">restore_all_memory_breakpoints</code><span class="sig-paren">(</span><em>data</em>, <em>target=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.restore_all_memory_breakpoints"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.restore_all_memory_breakpoints" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Re-setup all memory breakpoints, affecting pages access rights.
|
||
If target is <code class="docutils literal notranslate"><span class="pre">None</span></code>, use <code class="docutils literal notranslate"><span class="pre">current_process</span></code></p>
|
||
<p><code class="docutils literal notranslate"><span class="pre">data</span></code> is the result of the corresponding call to <a class="reference internal" href="#windows.debug.Debugger.disable_all_memory_breakpoints" title="windows.debug.Debugger.disable_all_memory_breakpoints"><code class="xref py py-func docutils literal notranslate"><span class="pre">disable_all_memory_breakpoints()</span></code></a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.DisabledMemoryBreakpoint">
|
||
<code class="descname">DisabledMemoryBreakpoint</code><span class="sig-paren">(</span><em>**kwds</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.DisabledMemoryBreakpoint"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.DisabledMemoryBreakpoint" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>A context-manager that disable all memory breakpoints and restore them on exit</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.get_exception_bitness">
|
||
<code class="descname">get_exception_bitness</code><span class="sig-paren">(</span><em>exc</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.get_exception_bitness"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.get_exception_bitness" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Return the bitness in which the exception occured.
|
||
Useful when debugingg a 32b process from a 64bits one</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> – 32 or 64</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="staticmethod">
|
||
<dt id="windows.debug.Debugger.kill_on_exit">
|
||
<em class="property">static </em><code class="descname">kill_on_exit</code><span class="sig-paren">(</span><em>choice</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.kill_on_exit"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.kill_on_exit" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>If set to True(default in Windows) will kill all attached process on thread exit.
|
||
Otherwise, the thread detaches from all processes being debugged on exit.</p>
|
||
<p>See: <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-debugsetprocesskillonexit">https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-debugsetprocesskillonexit</a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_setup">
|
||
<code class="descname">on_setup</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_setup"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_setup" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on the first breakpoint event occuring in the debugger.
|
||
This callback allow to setup hook / interact with the debugee when ready:</p>
|
||
<ul class="simple">
|
||
<li>If <a class="reference internal" href="#windows.debug.Debugger.on_setup" title="windows.debug.Debugger.on_setup"><code class="xref py py-func docutils literal notranslate"><span class="pre">on_setup()</span></code></a> is overriden by a subclass it will be called and <a class="reference internal" href="#windows.debug.Debugger.on_exception" title="windows.debug.Debugger.on_exception"><code class="xref py py-func docutils literal notranslate"><span class="pre">on_exception()</span></code></a> will NOT be called for this event (first BP).</li>
|
||
<li>If <a class="reference internal" href="#windows.debug.Debugger.on_setup" title="windows.debug.Debugger.on_setup"><code class="xref py py-func docutils literal notranslate"><span class="pre">on_setup()</span></code></a> is not defined the first BP will trigger an <a class="reference internal" href="#windows.debug.Debugger.on_exception" title="windows.debug.Debugger.on_exception"><code class="xref py py-func docutils literal notranslate"><span class="pre">on_exception()</span></code></a>.</li>
|
||
</ul>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">see sample <a class="reference internal" href="sample.html#sample-debugger-on-setup"><span class="std std-ref">on_setup</span></a></p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_exception">
|
||
<code class="descname">on_exception</code><span class="sig-paren">(</span><em>exception</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_exception"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_exception" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on exception event other that known breakpoint or requested single step. <code class="docutils literal notranslate"><span class="pre">exception</span></code> is one of the following type:</p>
|
||
<blockquote>
|
||
<div><ul class="simple">
|
||
<li><a class="reference internal" href="exception.html#windows.winobject.exception.EEXCEPTION_DEBUG_INFO32" title="windows.winobject.exception.EEXCEPTION_DEBUG_INFO32"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.exception.EEXCEPTION_DEBUG_INFO32</span></code></a></li>
|
||
<li><a class="reference internal" href="exception.html#windows.winobject.exception.EEXCEPTION_DEBUG_INFO64" title="windows.winobject.exception.EEXCEPTION_DEBUG_INFO64"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.exception.EEXCEPTION_DEBUG_INFO64</span></code></a></li>
|
||
</ul>
|
||
</div></blockquote>
|
||
<p>The default behaviour is to return <code class="docutils literal notranslate"><span class="pre">DBG_CONTINUE</span></code> for the known exception code
|
||
and <code class="docutils literal notranslate"><span class="pre">DBG_EXCEPTION_NOT_HANDLED</span></code> else</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_single_step">
|
||
<code class="descname">on_single_step</code><span class="sig-paren">(</span><em>exception</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_single_step"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_single_step" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on requested single step <code class="docutils literal notranslate"><span class="pre">exception</span></code> is one of the following type:</p>
|
||
<blockquote>
|
||
<div><ul class="simple">
|
||
<li><a class="reference internal" href="exception.html#windows.winobject.exception.EEXCEPTION_DEBUG_INFO32" title="windows.winobject.exception.EEXCEPTION_DEBUG_INFO32"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.exception.EEXCEPTION_DEBUG_INFO32</span></code></a></li>
|
||
<li><a class="reference internal" href="exception.html#windows.winobject.exception.EEXCEPTION_DEBUG_INFO64" title="windows.winobject.exception.EEXCEPTION_DEBUG_INFO64"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.exception.EEXCEPTION_DEBUG_INFO64</span></code></a></li>
|
||
</ul>
|
||
</div></blockquote>
|
||
<p>There is no default implementation, if you use <code class="docutils literal notranslate"><span class="pre">Debugger.single_step()</span></code> you should implement <code class="docutils literal notranslate"><span class="pre">on_single_step</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_create_process">
|
||
<code class="descname">on_create_process</code><span class="sig-paren">(</span><em>create_process</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_create_process"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_create_process" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on create_process event</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>create_process</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.CREATE_PROCESS_DEBUG_INFO" title="windows.generated_def.winstructs.CREATE_PROCESS_DEBUG_INFO"><em>CREATE_PROCESS_DEBUG_INFO</em></a>) – </td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_exit_process">
|
||
<code class="descname">on_exit_process</code><span class="sig-paren">(</span><em>exit_process</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_exit_process"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_exit_process" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on exit_process event</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>exit_process</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.EXIT_PROCESS_DEBUG_INFO" title="windows.generated_def.winstructs.EXIT_PROCESS_DEBUG_INFO"><em>EXIT_PROCESS_DEBUG_INFO</em></a>) – </td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_create_thread">
|
||
<code class="descname">on_create_thread</code><span class="sig-paren">(</span><em>create_thread</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_create_thread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_create_thread" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on create_thread event</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>create_thread</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.CREATE_THREAD_DEBUG_INFO" title="windows.generated_def.winstructs.CREATE_THREAD_DEBUG_INFO"><em>CREATE_THREAD_DEBUG_INFO</em></a>) – </td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_exit_thread">
|
||
<code class="descname">on_exit_thread</code><span class="sig-paren">(</span><em>exit_thread</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_exit_thread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_exit_thread" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on exit_thread event</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>exit_thread</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.EXIT_THREAD_DEBUG_INFO" title="windows.generated_def.winstructs.EXIT_THREAD_DEBUG_INFO"><em>EXIT_THREAD_DEBUG_INFO</em></a>) – </td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_load_dll">
|
||
<code class="descname">on_load_dll</code><span class="sig-paren">(</span><em>load_dll</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_load_dll"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_load_dll" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on load_dll event</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>load_dll</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.LOAD_DLL_DEBUG_INFO" title="windows.generated_def.winstructs.LOAD_DLL_DEBUG_INFO"><em>LOAD_DLL_DEBUG_INFO</em></a>) – </td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_unload_dll">
|
||
<code class="descname">on_unload_dll</code><span class="sig-paren">(</span><em>unload_dll</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_unload_dll"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_unload_dll" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on unload_dll event</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>unload_dll</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.UNLOAD_DLL_DEBUG_INFO" title="windows.generated_def.winstructs.UNLOAD_DLL_DEBUG_INFO"><em>UNLOAD_DLL_DEBUG_INFO</em></a>) – </td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_output_debug_string">
|
||
<code class="descname">on_output_debug_string</code><span class="sig-paren">(</span><em>debug_string</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_output_debug_string"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_output_debug_string" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on debug_string event</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>debug_string</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.OUTPUT_DEBUG_STRING_INFO" title="windows.generated_def.winstructs.OUTPUT_DEBUG_STRING_INFO"><em>OUTPUT_DEBUG_STRING_INFO</em></a>) – </td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.Debugger.on_rip">
|
||
<code class="descname">on_rip</code><span class="sig-paren">(</span><em>rip_info</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_rip"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Debugger.on_rip" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on rip_info event</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>rip_info</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.RIP_INFO" title="windows.generated_def.winstructs.RIP_INFO"><em>RIP_INFO</em></a>) – </td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</div>
|
||
<div class="section" id="symboldebugger">
|
||
<h2>9.2. <a class="reference internal" href="#windows.debug.SymbolDebugger" title="windows.debug.SymbolDebugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolDebugger</span></code></a><a class="headerlink" href="#symboldebugger" title="Permalink to this headline">¶</a></h2>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">See sample <a class="reference internal" href="sample.html#sample-symbol-debugger"><span class="std std-ref">SymbolDebugger</span></a></p>
|
||
</div>
|
||
<dl class="class">
|
||
<dt id="windows.debug.SymbolDebugger">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.</code><code class="descname">SymbolDebugger</code><span class="sig-paren">(</span><em>*args</em>, <em>**kwargs</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symboldbg.html#SymbolDebugger"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.SymbolDebugger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.debug.debugger.Debugger</span></code></p>
|
||
<p>A debugger using the symbol API (hence PDB) for name resolution.
|
||
To use PDB, a correct version of dbghelp should be configured as well as <code class="docutils literal notranslate"><span class="pre">_NT_SYMBOL_PATH</span></code>.
|
||
(See <a class="reference internal" href="#debug-symbols-module"><span class="std std-ref">windows.debug.symbols – Using symbols</span></a>)</p>
|
||
<p>This debugger add a <code class="docutils literal notranslate"><span class="pre">current_resolver</span></code> variable (A <a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler" title="windows.debug.symbols.ProcessSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">ProcessSymbolHandler</span></code></a>) for the <code class="docutils literal notranslate"><span class="pre">current_process</span></code>.</p>
|
||
</dd></dl>
|
||
|
||
</div>
|
||
<div class="section" id="localdebugger">
|
||
<h2>9.3. <a class="reference internal" href="#windows.debug.LocalDebugger" title="windows.debug.LocalDebugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">LocalDebugger</span></code></a><a class="headerlink" href="#localdebugger" title="Permalink to this headline">¶</a></h2>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">See sample <a class="reference internal" href="sample.html#sample-local-debugger"><span class="std std-ref">LocalDebugger</span></a></p>
|
||
</div>
|
||
<p>The <a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a> is the base class to perform the debugging the current process.
|
||
It is based on <code class="xref py py-func docutils literal notranslate"><span class="pre">VectoredException()</span></code> (see <a class="reference internal" href="sample.html#sample-vectoredexception"><span class="std std-ref">VectoredException()</span></a>)</p>
|
||
<p>There is not much documentation for now as the code might change soon.</p>
|
||
<dl class="class">
|
||
<dt id="windows.debug.LocalDebugger">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.</code><code class="descname">LocalDebugger</code><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.LocalDebugger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>A debugger interface around <code class="xref py py-func docutils literal notranslate"><span class="pre">AddVectoredExceptionHandler()</span></code>.</p>
|
||
<p>Handle:</p>
|
||
<blockquote>
|
||
<div><ul class="simple">
|
||
<li>Standard BP (int3)</li>
|
||
<li>Hardware-Exec BP (DrX)</li>
|
||
</ul>
|
||
</div></blockquote>
|
||
<dl class="method">
|
||
<dt id="windows.debug.LocalDebugger.add_bp">
|
||
<code class="descname">add_bp</code><span class="sig-paren">(</span><em>bp</em>, <em>target=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.add_bp"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.LocalDebugger.add_bp" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Add a breakpoint, bp is a “class:<cite>Breakpoint</cite></p>
|
||
<p>If the <code class="docutils literal notranslate"><span class="pre">bp</span></code> type is <code class="docutils literal notranslate"><span class="pre">STANDARD_BP</span></code>, target must be None.</p>
|
||
<p>If the <code class="docutils literal notranslate"><span class="pre">bp</span></code> type is <code class="docutils literal notranslate"><span class="pre">HARDWARE_EXEC_BP</span></code>, target can be None (all threads), or some threads of the process</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.LocalDebugger.del_bp">
|
||
<code class="descname">del_bp</code><span class="sig-paren">(</span><em>bp</em>, <em>targets=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.del_bp"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.LocalDebugger.del_bp" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Delete a breakpoint</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.LocalDebugger.get_exception_code">
|
||
<code class="descname">get_exception_code</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.get_exception_code"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.LocalDebugger.get_exception_code" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Return ExceptionCode of current exception</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.LocalDebugger.get_exception_context">
|
||
<code class="descname">get_exception_context</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.get_exception_context"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.LocalDebugger.get_exception_context" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Return context of current exception</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.LocalDebugger.on_exception">
|
||
<code class="descname">on_exception</code><span class="sig-paren">(</span><em>exc</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.on_exception"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.LocalDebugger.on_exception" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called on exception</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.LocalDebugger.single_step">
|
||
<code class="descname">single_step</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.single_step"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.LocalDebugger.single_step" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Make the current thread to single step</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</div>
|
||
<div class="section" id="breakpoint">
|
||
<h2>9.4. <a class="reference internal" href="#windows.debug.Breakpoint" title="windows.debug.Breakpoint"><code class="xref py py-class docutils literal notranslate"><span class="pre">Breakpoint</span></code></a><a class="headerlink" href="#breakpoint" title="Permalink to this headline">¶</a></h2>
|
||
<p>Standard breakpoints types expect an address as argument.</p>
|
||
<p>An address can be:</p>
|
||
<blockquote>
|
||
<div><ul>
|
||
<li><p class="first">An <a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></p>
|
||
</li>
|
||
<li><p class="first">A <a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a> of form (breakpoint will be put when <code class="docutils literal notranslate"><span class="pre">DLL</span></code> is loaded):</p>
|
||
<blockquote>
|
||
<div><ul class="simple">
|
||
<li><code class="docutils literal notranslate"><span class="pre">"DLL!ApiName"</span></code></li>
|
||
<li><code class="docutils literal notranslate"><span class="pre">"DLL!Offset"</span></code> where offset is a int (“16”, “0x10”, ..)</li>
|
||
</ul>
|
||
</div></blockquote>
|
||
</li>
|
||
</ul>
|
||
</div></blockquote>
|
||
<p>When a breakpoint is hit, its <code class="docutils literal notranslate"><span class="pre">trigger</span></code> function is called with the debugger and a
|
||
<code class="docutils literal notranslate"><span class="pre">DEBUG_EXECEPTION_EVENT</span></code> structure as argument.</p>
|
||
<dl class="class">
|
||
<dt id="windows.debug.Breakpoint">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.</code><code class="descname">Breakpoint</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#Breakpoint"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Breakpoint" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>An standard (Int3) breakpoint (type == <code class="docutils literal notranslate"><span class="pre">STANDARD_BP</span></code>)</p>
|
||
<dl class="method">
|
||
<dt id="windows.debug.Breakpoint.trigger">
|
||
<code class="descname">trigger</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#Breakpoint.trigger"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.Breakpoint.trigger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called when breakpoint is hit</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
<dl class="class">
|
||
<dt id="windows.debug.HXBreakpoint">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.</code><code class="descname">HXBreakpoint</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#HXBreakpoint"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.HXBreakpoint" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>An hardware-execution breakpoint (type == <code class="docutils literal notranslate"><span class="pre">HARDWARE_EXEC_BP</span></code>)</p>
|
||
<dl class="method">
|
||
<dt id="windows.debug.HXBreakpoint.trigger">
|
||
<code class="descname">trigger</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.HXBreakpoint.trigger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called when breakpoint is hit</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
<dl class="class">
|
||
<dt id="windows.debug.MemoryBreakpoint">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.</code><code class="descname">MemoryBreakpoint</code><span class="sig-paren">(</span><em>addr</em>, <em>size=None</em>, <em>events=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#MemoryBreakpoint"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.MemoryBreakpoint" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>A memory breakpoint (type == <code class="docutils literal notranslate"><span class="pre">MEMORY_BREAKPOINT</span></code>)</p>
|
||
<dl class="method">
|
||
<dt id="windows.debug.MemoryBreakpoint.__init__">
|
||
<code class="descname">__init__</code><span class="sig-paren">(</span><em>addr</em>, <em>size=None</em>, <em>events=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#MemoryBreakpoint.__init__"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.MemoryBreakpoint.__init__" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p><code class="docutils literal notranslate"><span class="pre">size</span></code>: the size of the memory breakpoint.</p>
|
||
<p><code class="docutils literal notranslate"><span class="pre">events</span></code>: a string representing the events that interest the BP (any of “RWX”)</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.MemoryBreakpoint.trigger">
|
||
<code class="descname">trigger</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#MemoryBreakpoint.trigger"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.MemoryBreakpoint.trigger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called when breakpoint is hit</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p>MemoryBreakpoint are triggered based on the fault address only (as I don’t know a way to get the size of the read/write causing the fault without embedding a disassembler).</p>
|
||
<p class="last">This means that a MEMBP at address <code class="docutils literal notranslate"><span class="pre">X</span></code> won’t be triggered by a write of size 4 at address <code class="docutils literal notranslate"><span class="pre">X</span> <span class="pre">-</span> <span class="pre">1</span></code>. it’s sad I know.</p>
|
||
</div>
|
||
<dl class="class">
|
||
<dt id="windows.debug.FunctionCallBP">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.</code><code class="descname">FunctionCallBP</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionCallBP"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.FunctionCallBP" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>A Breakpoint that allow to trigger at the return of a function</p>
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionCallBP.__init__">
|
||
<code class="descname">__init__</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionCallBP.__init__" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>x.__init__(…) initializes x; see help(type(x)) for signature</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionCallBP.break_on_ret">
|
||
<code class="descname">break_on_ret</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionCallBP.break_on_ret"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.FunctionCallBP.break_on_ret" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Setup a breakpoint at the return address of the function, this breakpoint will call <a class="reference internal" href="#windows.debug.FunctionCallBP.ret_trigger" title="windows.debug.FunctionCallBP.ret_trigger"><code class="xref py py-func docutils literal notranslate"><span class="pre">ret_trigger()</span></code></a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionCallBP.get_ret_addr">
|
||
<code class="descname">get_ret_addr</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionCallBP.get_ret_addr"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.FunctionCallBP.get_ret_addr" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Get the return address of the current target, only valid in the trigger() function.</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionCallBP.ret_trigger">
|
||
<code class="descname">ret_trigger</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionCallBP.ret_trigger"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.FunctionCallBP.ret_trigger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called at the return of the function if <a class="reference internal" href="#windows.debug.FunctionCallBP.break_on_ret" title="windows.debug.FunctionCallBP.break_on_ret"><code class="xref py py-func docutils literal notranslate"><span class="pre">break_on_ret()</span></code></a> was called</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionCallBP.trigger">
|
||
<code class="descname">trigger</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionCallBP.trigger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called when breakpoint is hit</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">See sample <a class="reference internal" href="sample.html#sample-debugger-bp-functioncallbp"><span class="std std-ref">windows.debug.FunctionCallBP</span></a></p>
|
||
</div>
|
||
<dl class="class">
|
||
<dt id="windows.debug.FunctionBP">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.</code><code class="descname">FunctionBP</code><span class="sig-paren">(</span><em>addr=None</em>, <em>target=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionBP"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.FunctionBP" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>A breakpoint that accepts a function from <a class="reference internal" href="winproxy.html#module-windows.winproxy" title="windows.winproxy"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.winproxy</span></code></a> and able to:</p>
|
||
<ul class="simple">
|
||
<li>Extract the arguments of the functions</li>
|
||
<li>Break at the return of the function</li>
|
||
</ul>
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionBP.__init__">
|
||
<code class="descname">__init__</code><span class="sig-paren">(</span><em>addr=None</em>, <em>target=None</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.__init__" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>x.__init__(…) initializes x; see help(type(x)) for signature</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionBP.arguments">
|
||
<code class="descname">arguments</code><span class="sig-paren">(</span><em>dbg</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.arguments" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>TEST PARAM DICT</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionBP.break_on_ret">
|
||
<code class="descname">break_on_ret</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.break_on_ret" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Setup a breakpoint at the return address of the function, this breakpoint will call <a class="reference internal" href="#windows.debug.FunctionBP.ret_trigger" title="windows.debug.FunctionBP.ret_trigger"><code class="xref py py-func docutils literal notranslate"><span class="pre">ret_trigger()</span></code></a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionBP.extract_arguments">
|
||
<code class="descname">extract_arguments</code><span class="sig-paren">(</span><em>cproc</em>, <em>cthread</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.extract_arguments" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Extracts the functions parameters in an <code class="xref py py-class docutils literal notranslate"><span class="pre">OrderedDict</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionBP.get_ret_addr">
|
||
<code class="descname">get_ret_addr</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.get_ret_addr" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Get the return address of the current target, only valid in the trigger() function.</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionBP.ret_trigger">
|
||
<code class="descname">ret_trigger</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.ret_trigger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called at the return of the function if <a class="reference internal" href="#windows.debug.FunctionBP.break_on_ret" title="windows.debug.FunctionBP.break_on_ret"><code class="xref py py-func docutils literal notranslate"><span class="pre">break_on_ret()</span></code></a> was called</p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.FunctionBP.trigger">
|
||
<code class="descname">trigger</code><span class="sig-paren">(</span><em>dbg</em>, <em>exception</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.trigger" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Called when breakpoint is hit</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">See sample <a class="reference internal" href="sample.html#sample-debugger-bp-functionbp"><span class="std std-ref">windows.debug.FunctionBP</span></a></p>
|
||
</div>
|
||
</div>
|
||
<div class="section" id="module-windows.debug.symbols">
|
||
<span id="windows-debug-symbols-using-symbols"></span><span id="debug-symbols-module"></span><h2>9.5. <a class="reference internal" href="#module-windows.debug.symbols" title="windows.debug.symbols"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug.symbols</span></code></a> – Using symbols<a class="headerlink" href="#module-windows.debug.symbols" title="Permalink to this headline">¶</a></h2>
|
||
<p>The <a class="reference internal" href="#module-windows.debug.symbols" title="windows.debug.symbols"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug.symbols</span></code></a> module provide classes to load PDB and resolve name/address.
|
||
In its current state, this module does not handle types.</p>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">See samples <a class="reference internal" href="sample.html#sample-symbols"><span class="std std-ref">Symbols</span></a></p>
|
||
</div>
|
||
<div class="section" id="configuration">
|
||
<h3>9.5.1. Configuration<a class="headerlink" href="#configuration" title="Permalink to this headline">¶</a></h3>
|
||
<p>In order to be able to automatically download PDB and parse remote <code class="docutils literal notranslate"><span class="pre">_NT_SYMBOL_PATH</span></code>, a debug version of the DLL <cite>dbghelp.dll</cite> must be used.
|
||
(See <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/debug/dbghelp-versions">MSDN: DbgHelp Versions</a>)</p>
|
||
<p>As it is NOT recommended to replace <code class="docutils literal notranslate"><span class="pre">system32/dbghelp.dll</span></code>, its path must be provided to PythonForWindows.
|
||
This path must be provided before any call to the <code class="docutils literal notranslate"><span class="pre">dbghelp.dll</span></code> APIs.
|
||
Also, the <code class="docutils literal notranslate"><span class="pre">symsrv.dll</span></code> DLL should be present in the same directory as <code class="docutils literal notranslate"><span class="pre">dbghelp.dll</span></code> (See <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/debug/using-symsrv#installation">SymSrv Installation</a>)</p>
|
||
<p>There is 2 ways to pass this information to <code class="docutils literal notranslate"><span class="pre">PythonForWindows</span></code>:</p>
|
||
<blockquote>
|
||
<div><ul class="simple">
|
||
<li>Using the function <a class="reference internal" href="#windows.debug.symbols.set_dbghelp_path" title="windows.debug.symbols.set_dbghelp_path"><code class="xref py py-func docutils literal notranslate"><span class="pre">set_dbghelp_path()</span></code></a></li>
|
||
<li><dl class="first docutils">
|
||
<dt>Using the environment variable <code class="docutils literal notranslate"><span class="pre">PFW_DBGHELP_PATH</span></code></dt>
|
||
<dd><ul class="first last">
|
||
<li>If this variable exists it will simply trigger a call to <code class="docutils literal notranslate"><span class="pre">set_dbghelp_path(PFW_DBGHELP_PATH)</span></code></li>
|
||
</ul>
|
||
</dd>
|
||
</dl>
|
||
</li>
|
||
</ul>
|
||
</div></blockquote>
|
||
<p>If the given path is a directory, the final path will be computer as <code class="docutils literal notranslate"><span class="pre">path\<current_process_bitness>\dbghelp.dll</span></code>.
|
||
This allow to use the same script (or environment variable) transparently in bot 32b & 64b python interpreters.</p>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p>For example, on my computer my setup is done through the environment variable: <code class="docutils literal notranslate"><span class="pre">PFW_DBGHELP_PATH=D:\pysym\bin</span></code></p>
|
||
<p>This directory have the following layout:</p>
|
||
<blockquote class="last">
|
||
<div><div class="line-block">
|
||
<div class="line">$ tree /A /F %PFW_DBGHELP_PATH%</div>
|
||
<div class="line-block">
|
||
<div class="line">D:\PYSYM\BIN</div>
|
||
<div class="line">| symsrv.yes</div>
|
||
<div class="line">|</div>
|
||
<div class="line">+---32</div>
|
||
<div class="line">| dbghelp.dll</div>
|
||
<div class="line">| symsrv.dll</div>
|
||
<div class="line">|</div>
|
||
<div class="line">\---64</div>
|
||
<div class="line-block">
|
||
<div class="line">dbghelp.dll</div>
|
||
<div class="line">symsrv.dll</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div></blockquote>
|
||
</div>
|
||
</div>
|
||
<div class="section" id="helpers">
|
||
<h3>9.5.2. Helpers<a class="headerlink" href="#helpers" title="Permalink to this headline">¶</a></h3>
|
||
<dl class="function">
|
||
<dt id="windows.debug.symbols.set_dbghelp_path">
|
||
<code class="descclassname">windows.debug.symbols.</code><code class="descname">set_dbghelp_path</code><span class="sig-paren">(</span><em>path</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#set_dbghelp_path"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.symbols.set_dbghelp_path" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Set the path of the <code class="docutils literal notranslate"><span class="pre">dbghelp.dll</span></code> file to use. It allow to configure a different version of the DLL handling PDB downloading.</p>
|
||
<p>If <code class="docutils literal notranslate"><span class="pre">path</span></code> is a directory, the final <code class="docutils literal notranslate"><span class="pre">dbghelp.dll</span></code> will be computed as
|
||
<code class="docutils literal notranslate"><span class="pre">path\<current_process_bitness>\dbghelp.dll</span></code>.</p>
|
||
<p>This allow to use the same script transparently in both 32b & 64b python interpreters.</p>
|
||
</dd></dl>
|
||
|
||
<dl class="class">
|
||
<dt id="windows.debug.symbols.SymbolEngine">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.symbols.</code><code class="descname">SymbolEngine</code><a class="reference internal" href="_modules/windows/debug/symbols.html#SymbolEngine"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.symbols.SymbolEngine" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Represent the global symbol engine. Just a proxy to get/set global engine options</p>
|
||
<p>Its instance can be accessed using <code class="docutils literal notranslate"><span class="pre">windows.debug.symbols.engine</span></code></p>
|
||
<p>Exemple:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">engine</span><span class="o">.</span><span class="n">options</span>
|
||
<span class="go">6L</span>
|
||
<span class="gp">>>> </span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">engine</span><span class="o">.</span><span class="n">options</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SYMOPT_UNDNAME</span>
|
||
<span class="gp">>>> </span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">engine</span><span class="o">.</span><span class="n">options</span>
|
||
<span class="go">2L</span>
|
||
</pre></div>
|
||
</div>
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolEngine.options">
|
||
<code class="descname">options</code><a class="headerlink" href="#windows.debug.symbols.SymbolEngine.options" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The options of the Symbol engine
|
||
(<a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/nf-dbghelp-symsetoptions#parameters">see options</a>)</p>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">Default options are: <code class="docutils literal notranslate"><span class="pre">gdef.SYMOPT_DEFERRED_LOADS</span> <span class="pre">+</span> <span class="pre">gdef.SYMOPT_UNDNAME</span></code></p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</div>
|
||
<div class="section" id="virtualsymbolhandler">
|
||
<h3>9.5.3. <a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler" title="windows.debug.symbols.VirtualSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">VirtualSymbolHandler</span></code></a><a class="headerlink" href="#virtualsymbolhandler" title="Permalink to this headline">¶</a></h3>
|
||
<dl class="class">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.symbols.</code><code class="descname">VirtualSymbolHandler</code><span class="sig-paren">(</span><em>search_path=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#VirtualSymbolHandler"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.debug.symbols.SymbolHandler</span></code></p>
|
||
<p>A SymbolHandler where its handle is not a valid process handle
|
||
Allow to create/resolve symbol in a ‘virtual’ process
|
||
But all API needing a real process handle will fail</p>
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler.__getitem__">
|
||
<code class="descname">__getitem__</code><span class="sig-paren">(</span><em>name_or_addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.__getitem__" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Resolve <code class="docutils literal notranslate"><span class="pre">name_or_addr</span></code>.</p>
|
||
<p>If its an int -> Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> at the address.
|
||
If its a string -> Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> corresponding to the symbol name</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last"><code class="docutils literal notranslate"><span class="pre">__getitem__</span></code> is an alias for <code class="docutils literal notranslate"><span class="pre">resolve()</span></code></p>
|
||
</div>
|
||
<p>Exemple:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\kernelbase.dll"</span><span class="p">)</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span>
|
||
<span class="go"><SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x10000000></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s2">"kernelbase!CreateFileInternal"</span><span class="p">)</span>
|
||
<span class="go"><SymbolInfoA name="CreateFileInternal" addr=0x100f2120 tag=SymTagFunction></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">]</span>
|
||
<span class="go"><SymbolInfoA name="ReadFile" addr=0x100f1ee0 displacement=0x162 tag=SymTagFunction></span>
|
||
<span class="gp">>>> </span><span class="nb">str</span><span class="p">(</span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">])</span>
|
||
<span class="go">'kernelbase!ReadFile+0x162'</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler.load">
|
||
<code class="descname">load</code><span class="sig-paren">(</span><em>path</em>, <em>name=None</em>, <em>addr=0</em>, <em>size=0</em>, <em>data=None</em>, <em>flags=0</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.load" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>An alias for <a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.load_file" title="windows.debug.symbols.VirtualSymbolHandler.load_file"><code class="xref py py-func docutils literal notranslate"><span class="pre">VirtualSymbolHandler.load_file()</span></code></a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler.load_file">
|
||
<code class="descname">load_file</code><span class="sig-paren">(</span><em>path</em>, <em>name=None</em>, <em>addr=0</em>, <em>size=0</em>, <em>data=None</em>, <em>flags=0</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.load_file" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Load the module <code class="docutils literal notranslate"><span class="pre">path</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> – The loaded module</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler.load_module">
|
||
<code class="descname">load_module</code><span class="sig-paren">(</span><em>file_handle=None</em>, <em>path=None</em>, <em>name=None</em>, <em>addr=0</em>, <em>size=0</em>, <em>data=None</em>, <em>flags=0</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.load_module" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Load a module at a given <code class="docutils literal notranslate"><span class="pre">addr</span></code>. The module to load can be pass via a <code class="docutils literal notranslate"><span class="pre">file_handle</span></code>
|
||
or the direct <code class="docutils literal notranslate"><span class="pre">path</span></code> of the file to load.</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> – The loaded module</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">The logic of <code class="docutils literal notranslate"><span class="pre">SymLoadModuleEx</span></code> seems somewhat strange about the naming of the loaded module.
|
||
A custom module <code class="docutils literal notranslate"><span class="pre">name</span></code> is only taken into account if the file is passed via a File handle.
|
||
To make it more intuitive, if this function is call with a <code class="docutils literal notranslate"><span class="pre">path</span></code> and <code class="docutils literal notranslate"><span class="pre">name</span></code> and no <code class="docutils literal notranslate"><span class="pre">file_handle</span></code>,
|
||
it will open the path and directly call <code class="docutils literal notranslate"><span class="pre">SymLoadModuleEx</span></code> with a file handle and a name.</p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler.modules">
|
||
<code class="descname">modules</code><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.modules" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The list of loaded modules</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">[<a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a>] – A list of modules</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler.refresh">
|
||
<code class="descname">refresh</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#VirtualSymbolHandler.refresh"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.refresh" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Do nothing for a <a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler" title="windows.debug.symbols.VirtualSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">VirtualSymbolHandler</span></code></a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler.resolve">
|
||
<code class="descname">resolve</code><span class="sig-paren">(</span><em>name_or_addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.resolve" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Resolve <code class="docutils literal notranslate"><span class="pre">name_or_addr</span></code>.</p>
|
||
<p>If its an int -> Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> at the address.
|
||
If its a string -> Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> corresponding to the symbol name</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last"><code class="docutils literal notranslate"><span class="pre">__getitem__</span></code> is an alias for <code class="docutils literal notranslate"><span class="pre">resolve()</span></code></p>
|
||
</div>
|
||
<p>Exemple:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\kernelbase.dll"</span><span class="p">)</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span>
|
||
<span class="go"><SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x10000000></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s2">"kernelbase!CreateFileInternal"</span><span class="p">)</span>
|
||
<span class="go"><SymbolInfoA name="CreateFileInternal" addr=0x100f2120 tag=SymTagFunction></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">]</span>
|
||
<span class="go"><SymbolInfoA name="ReadFile" addr=0x100f1ee0 displacement=0x162 tag=SymTagFunction></span>
|
||
<span class="gp">>>> </span><span class="nb">str</span><span class="p">(</span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">])</span>
|
||
<span class="go">'kernelbase!ReadFile+0x162'</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler.search">
|
||
<code class="descname">search</code><span class="sig-paren">(</span><em>mask</em>, <em>mod=0</em>, <em>tag=0</em>, <em>options=SYMSEARCH_ALLITEMS(0x8)</em>, <em>callback=None</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.search" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Search the symbols matching <code class="docutils literal notranslate"><span class="pre">mask</span></code> (<code class="docutils literal notranslate"><span class="pre">Windbg</span></code> like).</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">[<a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a>] – A list of <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\kernelbase.dll"</span><span class="p">)</span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">search</span><span class="p">(</span><span class="s2">"kernelbase!CreateFile*"</span><span class="p">)</span>
|
||
<span class="go">[<SymbolInfoA name="CreateFileInternal" addr=0x100f2120 tag=SymTagFunction>,</span>
|
||
<span class="go"> <SymbolInfoA name="CreateFileMoniker" addr=0x10117d80 tag=SymTagFunction>,</span>
|
||
<span class="go"> <SymbolInfoA name="CreateFile2" addr=0x1011e690 tag=SymTagFunction>,</span>
|
||
<span class="go"> ...]</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.VirtualSymbolHandler.unload">
|
||
<code class="descname">unload</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.unload" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Unload the module at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</div>
|
||
<div class="section" id="processsymbolhandler">
|
||
<h3>9.5.4. <a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler" title="windows.debug.symbols.ProcessSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">ProcessSymbolHandler</span></code></a><a class="headerlink" href="#processsymbolhandler" title="Permalink to this headline">¶</a></h3>
|
||
<dl class="class">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.symbols.</code><code class="descname">ProcessSymbolHandler</code><span class="sig-paren">(</span><em>process</em>, <em>search_path=None</em>, <em>invade_process=False</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#ProcessSymbolHandler"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.debug.symbols.SymbolHandler</span></code></p>
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler.__getitem__">
|
||
<code class="descname">__getitem__</code><span class="sig-paren">(</span><em>name_or_addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.__getitem__" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Resolve <code class="docutils literal notranslate"><span class="pre">name_or_addr</span></code>.</p>
|
||
<p>If its an int -> Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> at the address.
|
||
If its a string -> Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> corresponding to the symbol name</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last"><code class="docutils literal notranslate"><span class="pre">__getitem__</span></code> is an alias for <code class="docutils literal notranslate"><span class="pre">resolve()</span></code></p>
|
||
</div>
|
||
<p>Exemple:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\kernelbase.dll"</span><span class="p">)</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span>
|
||
<span class="go"><SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x10000000></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s2">"kernelbase!CreateFileInternal"</span><span class="p">)</span>
|
||
<span class="go"><SymbolInfoA name="CreateFileInternal" addr=0x100f2120 tag=SymTagFunction></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">]</span>
|
||
<span class="go"><SymbolInfoA name="ReadFile" addr=0x100f1ee0 displacement=0x162 tag=SymTagFunction></span>
|
||
<span class="gp">>>> </span><span class="nb">str</span><span class="p">(</span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">])</span>
|
||
<span class="go">'kernelbase!ReadFile+0x162'</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler.load">
|
||
<code class="descname">load</code><span class="sig-paren">(</span><em>name</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#ProcessSymbolHandler.load"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.load" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Load the <a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> associated with the loaded module <code class="docutils literal notranslate"><span class="pre">name</span></code> (as found in the PEB)</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<p>Exemple:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">ProcessSymbolHandler</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_64</span><span class="p">())</span>
|
||
<span class="go"><windows.debug.symbols.ProcessSymbolHandler object at 0x033A2C30></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span>
|
||
<span class="go"><windows.debug.symbols.ProcessSymbolHandler object at 0x033A2C30></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">load</span><span class="p">(</span><span class="s2">"kernelbase.dll"</span><span class="p">)</span>
|
||
<span class="go"><SymbolModule name="kernelbase" type=SymDeferred pdb="" addr=0x7ffb5b090000></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="p">[</span><span class="s2">"kernelbase!CreateProcessA"</span><span class="p">]</span>
|
||
<span class="go"><SymbolInfoA name="CreateProcessA" start=0x7ffb5b2371f0 tag=SymTagPublicSymbol></span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler.load_file">
|
||
<code class="descname">load_file</code><span class="sig-paren">(</span><em>path</em>, <em>name=None</em>, <em>addr=0</em>, <em>size=0</em>, <em>data=None</em>, <em>flags=0</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.load_file" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Load the module <code class="docutils literal notranslate"><span class="pre">path</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> – The loaded module</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler.load_module">
|
||
<code class="descname">load_module</code><span class="sig-paren">(</span><em>file_handle=None</em>, <em>path=None</em>, <em>name=None</em>, <em>addr=0</em>, <em>size=0</em>, <em>data=None</em>, <em>flags=0</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.load_module" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Load a module at a given <code class="docutils literal notranslate"><span class="pre">addr</span></code>. The module to load can be pass via a <code class="docutils literal notranslate"><span class="pre">file_handle</span></code>
|
||
or the direct <code class="docutils literal notranslate"><span class="pre">path</span></code> of the file to load.</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> – The loaded module</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">The logic of <code class="docutils literal notranslate"><span class="pre">SymLoadModuleEx</span></code> seems somewhat strange about the naming of the loaded module.
|
||
A custom module <code class="docutils literal notranslate"><span class="pre">name</span></code> is only taken into account if the file is passed via a File handle.
|
||
To make it more intuitive, if this function is call with a <code class="docutils literal notranslate"><span class="pre">path</span></code> and <code class="docutils literal notranslate"><span class="pre">name</span></code> and no <code class="docutils literal notranslate"><span class="pre">file_handle</span></code>,
|
||
it will open the path and directly call <code class="docutils literal notranslate"><span class="pre">SymLoadModuleEx</span></code> with a file handle and a name.</p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler.modules">
|
||
<code class="descname">modules</code><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.modules" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The list of loaded modules</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">[<a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a>] – A list of modules</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler.refresh">
|
||
<code class="descname">refresh</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#ProcessSymbolHandler.refresh"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.refresh" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Update the list of loaded modules to match the modules present in the target process</p>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p>This function only call <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/nf-dbghelp-symrefreshmodulelist">SymRefreshModuleList</a> for now.
|
||
It seems that this function do not handle refreshing a 64b target from a 32b python</p>
|
||
<p class="last">Also, on a 32b target from a 64b python it seems to only load symbols for the 64b modules (ntdll + syswow dll)</p>
|
||
</div>
|
||
<p>Exemple:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">ProcessSymbolHandler</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_64</span><span class="p">())</span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">modules</span>
|
||
<span class="go">[]</span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">refresh</span><span class="p">()</span>
|
||
<span class="go">44</span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">modules</span>
|
||
<span class="go">[<SymbolModule name="notepad" type=SymDeferred pdb="" addr=0x7ff772b80000>,</span>
|
||
<span class="go"> <SymbolModule name="ntdll" type=SymDeferred pdb="" addr=0x7ffb5d860000>,</span>
|
||
<span class="go"> <SymbolModule name="KERNEL32" type=SymDeferred pdb="" addr=0x7ffb5bb90000>,</span>
|
||
<span class="go"> <SymbolModule name="KERNELBASE" type=SymDeferred pdb="" addr=0x7ffb5b090000>,</span>
|
||
<span class="go"> ...]</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler.resolve">
|
||
<code class="descname">resolve</code><span class="sig-paren">(</span><em>name_or_addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.resolve" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Resolve <code class="docutils literal notranslate"><span class="pre">name_or_addr</span></code>.</p>
|
||
<p>If its an int -> Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> at the address.
|
||
If its a string -> Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> corresponding to the symbol name</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last"><code class="docutils literal notranslate"><span class="pre">__getitem__</span></code> is an alias for <code class="docutils literal notranslate"><span class="pre">resolve()</span></code></p>
|
||
</div>
|
||
<p>Exemple:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\kernelbase.dll"</span><span class="p">)</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span>
|
||
<span class="go"><SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x10000000></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s2">"kernelbase!CreateFileInternal"</span><span class="p">)</span>
|
||
<span class="go"><SymbolInfoA name="CreateFileInternal" addr=0x100f2120 tag=SymTagFunction></span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">]</span>
|
||
<span class="go"><SymbolInfoA name="ReadFile" addr=0x100f1ee0 displacement=0x162 tag=SymTagFunction></span>
|
||
<span class="gp">>>> </span><span class="nb">str</span><span class="p">(</span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">])</span>
|
||
<span class="go">'kernelbase!ReadFile+0x162'</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler.search">
|
||
<code class="descname">search</code><span class="sig-paren">(</span><em>mask</em>, <em>mod=0</em>, <em>tag=0</em>, <em>options=SYMSEARCH_ALLITEMS(0x8)</em>, <em>callback=None</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.search" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Search the symbols matching <code class="docutils literal notranslate"><span class="pre">mask</span></code> (<code class="docutils literal notranslate"><span class="pre">Windbg</span></code> like).</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">[<a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a>] – A list of <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\kernelbase.dll"</span><span class="p">)</span>
|
||
<span class="gp">>>> </span><span class="n">sh</span><span class="o">.</span><span class="n">search</span><span class="p">(</span><span class="s2">"kernelbase!CreateFile*"</span><span class="p">)</span>
|
||
<span class="go">[<SymbolInfoA name="CreateFileInternal" addr=0x100f2120 tag=SymTagFunction>,</span>
|
||
<span class="go"> <SymbolInfoA name="CreateFileMoniker" addr=0x10117d80 tag=SymTagFunction>,</span>
|
||
<span class="go"> <SymbolInfoA name="CreateFile2" addr=0x1011e690 tag=SymTagFunction>,</span>
|
||
<span class="go"> ...]</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.ProcessSymbolHandler.unload">
|
||
<code class="descname">unload</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.unload" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Unload the module at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</div>
|
||
<div class="section" id="symbolmodule">
|
||
<h3>9.5.5. <a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a><a class="headerlink" href="#symbolmodule" title="Permalink to this headline">¶</a></h3>
|
||
<dl class="class">
|
||
<dt id="windows.debug.symbols.SymbolModule">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.symbols.</code><code class="descname">SymbolModule</code><span class="sig-paren">(</span><em>resolver</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#SymbolModule"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.symbols.SymbolModule" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Bases: <a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs._IMAGEHLP_MODULE64" title="windows.generated_def.winstructs._IMAGEHLP_MODULE64"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.generated_def.winstructs._IMAGEHLP_MODULE64</span></code></a></p>
|
||
<p>Represent a loaded symbol module
|
||
(see <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_module64">MSDN IMAGEHLP_MODULE64</a>)</p>
|
||
<div class="admonition note">
|
||
<p class="first admonition-title">Note</p>
|
||
<p class="last">This represent a module in the <code class="docutils literal notranslate"><span class="pre">symbol</span> <span class="pre">space</span></code> for symbol resolution.
|
||
This can be completly virtual (particularly in the case of <a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler" title="windows.debug.symbols.VirtualSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">VirtualSymbolHandler</span></code></a></p>
|
||
</div>
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolModule.addr">
|
||
<code class="descname">addr</code><a class="headerlink" href="#windows.debug.symbols.SymbolModule.addr" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The load address of the module</p>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolModule.name">
|
||
<code class="descname">name</code><a class="headerlink" href="#windows.debug.symbols.SymbolModule.name" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The name of the module</p>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolModule.path">
|
||
<code class="descname">path</code><a class="headerlink" href="#windows.debug.symbols.SymbolModule.path" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The full path and file name of the file from which symbols were loaded.</p>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolModule.pdb">
|
||
<code class="descname">pdb</code><a class="headerlink" href="#windows.debug.symbols.SymbolModule.pdb" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The local path of the loaded PDB if present</p>
|
||
<dl class="docutils">
|
||
<dt>Exemple:</dt>
|
||
<dd><div class="first last highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\kernelbase.dll"</span><span class="p">)</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span><span class="o">.</span><span class="n">pdb</span>
|
||
<span class="go">'d:\symbols\wkernelbase.pdb\017FA9C5278235B7E6BFBA74A9A5AAD91\wkernelbase.pdb'</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolModule.type">
|
||
<code class="descname">type</code><a class="headerlink" href="#windows.debug.symbols.SymbolModule.type" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The type of module (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.SYM_TYPE" title="windows.generated_def.winstructs.SYM_TYPE"><code class="xref py py-class docutils literal notranslate"><span class="pre">SYM_TYPE</span></code></a>),
|
||
which can be one of:</p>
|
||
<blockquote>
|
||
<div><table border="1" class="docutils">
|
||
<colgroup>
|
||
<col width="14%" />
|
||
<col width="86%" />
|
||
</colgroup>
|
||
<tbody valign="top">
|
||
<tr class="row-odd"><td>SymCoff</td>
|
||
<td>COFF symbols.</td>
|
||
</tr>
|
||
<tr class="row-even"><td>SymCv</td>
|
||
<td>CodeView symbols.</td>
|
||
</tr>
|
||
<tr class="row-odd"><td>SymDeferred</td>
|
||
<td>Symbol loading deferred.</td>
|
||
</tr>
|
||
<tr class="row-even"><td>SymDia</td>
|
||
<td>DIA symbols.</td>
|
||
</tr>
|
||
<tr class="row-odd"><td>SymExport</td>
|
||
<td>Symbols generated from a DLL export table.</td>
|
||
</tr>
|
||
<tr class="row-even"><td>SymNone</td>
|
||
<td>No symbols are loaded.</td>
|
||
</tr>
|
||
<tr class="row-odd"><td>SymPdb</td>
|
||
<td>PDB symbols.</td>
|
||
</tr>
|
||
<tr class="row-even"><td>SymSym</td>
|
||
<td>.sym file.</td>
|
||
</tr>
|
||
<tr class="row-odd"><td>SymVirtual</td>
|
||
<td>The virtual module created by SymLoadModuleEx with SLMFLAG_VIRTUAL.</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div></blockquote>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</div>
|
||
<div class="section" id="symbolinfo">
|
||
<h3>9.5.6. <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a><a class="headerlink" href="#symbolinfo" title="Permalink to this headline">¶</a></h3>
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolInfo">
|
||
<code class="descclassname">windows.debug.symbols.</code><code class="descname">SymbolInfo</code><a class="headerlink" href="#windows.debug.symbols.SymbolInfo" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>alias of <a class="reference internal" href="#windows.debug.symbols.SymbolInfoA" title="windows.debug.symbols.SymbolInfoA"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.debug.symbols.SymbolInfoA</span></code></a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="class">
|
||
<dt id="windows.debug.symbols.SymbolInfoA">
|
||
<em class="property">class </em><code class="descclassname">windows.debug.symbols.</code><code class="descname">SymbolInfoA</code><a class="reference internal" href="_modules/windows/debug/symbols.html#SymbolInfoA"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>Bases: <a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs._SYMBOL_INFO" title="windows.generated_def.winstructs._SYMBOL_INFO"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.generated_def.winstructs._SYMBOL_INFO</span></code></a>, <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.debug.symbols.SymbolInfoBase</span></code></p>
|
||
<p>Represent a Symbol.
|
||
This class in based on the class <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symbol_info">SYMBOL_INFO</a>
|
||
with the handling on displacement embeded into it.s</p>
|
||
<p>Exemple:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
||
<span class="gp">>>> </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\kernelbase.dll"</span><span class="p">)</span>
|
||
<span class="gp">>>> </span><span class="n">sym1</span> <span class="o">=</span> <span class="n">sh</span><span class="p">[</span><span class="s2">"kernelbase!CreateFileW"</span><span class="p">]</span>
|
||
<span class="gp">>>> </span><span class="n">sym2</span> <span class="o">=</span> <span class="n">sh</span><span class="p">[</span><span class="nb">int</span><span class="p">(</span><span class="n">sym1</span><span class="p">)</span> <span class="o">+</span> <span class="mi">3</span><span class="p">]</span>
|
||
<span class="gp">>>> </span><span class="n">sym2</span>
|
||
<span class="go"><SymbolInfoA name="CreateFileW" start=0x100f20b0 displacement=0x3 tag=SymTagPublicSymbol></span>
|
||
<span class="gp">>>> </span><span class="nb">hex</span><span class="p">(</span><span class="n">sym2</span><span class="o">.</span><span class="n">start</span><span class="p">)</span>
|
||
<span class="go">'0x100f20b0L'</span>
|
||
<span class="gp">>>> </span><span class="nb">hex</span><span class="p">(</span><span class="n">sym2</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span>
|
||
<span class="go">'0x100f20b3L'</span>
|
||
<span class="gp">>>> </span><span class="nb">hex</span><span class="p">(</span><span class="n">sym2</span><span class="o">.</span><span class="n">displacement</span><span class="p">)</span>
|
||
<span class="go">'0x3L'</span>
|
||
<span class="gp">>>> </span><span class="nb">str</span><span class="p">(</span><span class="n">sym2</span><span class="p">)</span>
|
||
<span class="go">'kernelbase!CreateFileW+0x3'</span>
|
||
</pre></div>
|
||
</div>
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.displacement">
|
||
<code class="descname">displacement</code><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.displacement" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The displacement between the addresse and the start of the symbol (name)</p>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.CHAR_TYPE">
|
||
<code class="descname">CHAR_TYPE</code><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.CHAR_TYPE" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>alias of <a class="reference external" href="https://docs.python.org/2.7/library/ctypes.html#ctypes.c_char" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">ctypes.c_char</span></code></a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.__int__">
|
||
<code class="descname">__int__</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.__int__" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>An alias for <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="method">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.__str__">
|
||
<code class="descname">__str__</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.__str__" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The fullname of the symbol in the windbg format <code class="docutils literal notranslate"><span class="pre">mod!sym+displacement</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.addr">
|
||
<code class="descname">addr</code><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.addr" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The address of the symbol</p>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.fullname">
|
||
<code class="descname">fullname</code><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.fullname" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The fullname of the symbol in the windbg format <code class="docutils literal notranslate"><span class="pre">mod!sym+displacement</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.module">
|
||
<code class="descname">module</code><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.module" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The module containing the symbol</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.name">
|
||
<code class="descname">name</code><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.name" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The name of the symbol</p>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.start">
|
||
<code class="descname">start</code><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.start" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The address of the start of the symbol
|
||
If the symbol include a displacement, it is not taken into account</p>
|
||
</dd></dl>
|
||
|
||
<dl class="attribute">
|
||
<dt id="windows.debug.symbols.SymbolInfoA.tag">
|
||
<code class="descname">tag</code><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.tag" title="Permalink to this definition">¶</a></dt>
|
||
<dd><p>The Tag of the module</p>
|
||
<table class="docutils field-list" frame="void" rules="none">
|
||
<col class="field-name" />
|
||
<col class="field-body" />
|
||
<tbody valign="top">
|
||
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.SymTagEnum" title="windows.generated_def.winstructs.SymTagEnum"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymTagEnum</span></code></a></td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
|
||
<div class="sphinxsidebarwrapper">
|
||
<h3><a href="index.html">Table of Contents</a></h3>
|
||
<ul>
|
||
<li><a class="reference internal" href="#">9. <code class="docutils literal notranslate"><span class="pre">windows.debug</span></code> – Debugging</a><ul>
|
||
<li><a class="reference internal" href="#debugger">9.1. <code class="docutils literal notranslate"><span class="pre">Debugger</span></code></a></li>
|
||
<li><a class="reference internal" href="#symboldebugger">9.2. <code class="docutils literal notranslate"><span class="pre">SymbolDebugger</span></code></a></li>
|
||
<li><a class="reference internal" href="#localdebugger">9.3. <code class="docutils literal notranslate"><span class="pre">LocalDebugger</span></code></a></li>
|
||
<li><a class="reference internal" href="#breakpoint">9.4. <code class="docutils literal notranslate"><span class="pre">Breakpoint</span></code></a></li>
|
||
<li><a class="reference internal" href="#module-windows.debug.symbols">9.5. <code class="docutils literal notranslate"><span class="pre">windows.debug.symbols</span></code> – Using symbols</a><ul>
|
||
<li><a class="reference internal" href="#configuration">9.5.1. Configuration</a></li>
|
||
<li><a class="reference internal" href="#helpers">9.5.2. Helpers</a></li>
|
||
<li><a class="reference internal" href="#virtualsymbolhandler">9.5.3. <code class="docutils literal notranslate"><span class="pre">VirtualSymbolHandler</span></code></a></li>
|
||
<li><a class="reference internal" href="#processsymbolhandler">9.5.4. <code class="docutils literal notranslate"><span class="pre">ProcessSymbolHandler</span></code></a></li>
|
||
<li><a class="reference internal" href="#symbolmodule">9.5.5. <code class="docutils literal notranslate"><span class="pre">SymbolModule</span></code></a></li>
|
||
<li><a class="reference internal" href="#symbolinfo">9.5.6. <code class="docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
|
||
<h4>Previous topic</h4>
|
||
<p class="topless"><a href="wintrust.html"
|
||
title="previous chapter">8. <code class="docutils literal notranslate"><span class="pre">windows.wintrust</span></code> – Checking signature</a></p>
|
||
<h4>Next topic</h4>
|
||
<p class="topless"><a href="com.html"
|
||
title="next chapter">10. <code class="docutils literal notranslate"><span class="pre">windows.com</span></code> - Component Object Model</a></p>
|
||
<div role="note" aria-label="source link">
|
||
<h3>This Page</h3>
|
||
<ul class="this-page-menu">
|
||
<li><a href="_sources/debug.rst.txt"
|
||
rel="nofollow">Show Source</a></li>
|
||
</ul>
|
||
</div>
|
||
<div id="searchbox" style="display: none" role="search">
|
||
<h3>Quick search</h3>
|
||
<div class="searchformwrapper">
|
||
<form class="search" action="search.html" method="get">
|
||
<input type="text" name="q" />
|
||
<input type="submit" value="Go" />
|
||
<input type="hidden" name="check_keywords" value="yes" />
|
||
<input type="hidden" name="area" value="default" />
|
||
</form>
|
||
</div>
|
||
</div>
|
||
<script type="text/javascript">$('#searchbox').show(0);</script>
|
||
</div>
|
||
</div>
|
||
<div class="clearer"></div>
|
||
</div>
|
||
<div class="related" role="navigation" aria-label="related navigation">
|
||
<h3>Navigation</h3>
|
||
<ul>
|
||
<li class="right" style="margin-right: 10px">
|
||
<a href="genindex.html" title="General Index"
|
||
>index</a></li>
|
||
<li class="right" >
|
||
<a href="py-modindex.html" title="Python Module Index"
|
||
>modules</a> |</li>
|
||
<li class="right" >
|
||
<a href="com.html" title="10. windows.com - Component Object Model"
|
||
>next</a> |</li>
|
||
<li class="right" >
|
||
<a href="wintrust.html" title="8. windows.wintrust – Checking signature"
|
||
>previous</a> |</li>
|
||
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.6 documentation</a> »</li>
|
||
</ul>
|
||
</div>
|
||
<div class="footer" role="contentinfo">
|
||
© Copyright 2015-2020, Clement Rouault.
|
||
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.8.5.
|
||
</div>
|
||
</body>
|
||
</html> |