Class _BreakpointContainer

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__

(inherited documentation)

Creates a disabled code breakpoint at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of the code instruction to break at.
• condition (function) - (Optional) Condition callback function.

  The callback signature is:

     def condition_callback(event):
         return True     # returns True or False
  

  Where event is an Event object, and the return value is a boolean (True to dispatch the event, False otherwise).

• action (function) - (Optional) Action callback function. If specified, the event is handled by this callback instead of being dispatched normally.

  The callback signature is:

     def action_callback(event):
         pass        # no return value
  

  Where event is an Event object, and the return value is a boolean (True to dispatch the event, False otherwise).

Returns: CodeBreakpoint

The code breakpoint object.

Creates a disabled page breakpoint at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of the first page to watch.
• pages (int) - Number of pages to watch.
• condition (function) - (Optional) Condition callback function.

  The callback signature is:

     def condition_callback(event):
         return True     # returns True or False
  

  Where event is an Event object, and the return value is a boolean (True to dispatch the event, False otherwise).

• action (function) - (Optional) Action callback function. If specified, the event is handled by this callback instead of being dispatched normally.

  The callback signature is:

     def action_callback(event):
         pass        # no return value
  

  Where event is an Event object, and the return value is a boolean (True to dispatch the event, False otherwise).

Returns: PageBreakpoint

The page breakpoint object.

Creates a disabled hardware breakpoint at the given address.

Parameters:

• dwThreadId (int) - Thread global ID.
• address (int) - Memory address to watch.
• triggerFlag (int) - Trigger of breakpoint. Must be one of the following:
  • BP_BREAK_ON_EXECUTION

    Break on code execution.

  • BP_BREAK_ON_WRITE

    Break on memory read or write.

  • BP_BREAK_ON_ACCESS

    Break on memory write.

• sizeFlag (int) - Size of breakpoint. Must be one of the following:
  • BP_WATCH_BYTE

    One (1) byte in size.

  • BP_WATCH_WORD

    Two (2) bytes in size.

  • BP_WATCH_DWORD

    Four (4) bytes in size.

  • BP_WATCH_QWORD

    Eight (8) bytes in size.

• condition (function) - (Optional) Condition callback function.

  The callback signature is:

     def condition_callback(event):
         return True     # returns True or False
  

  Where event is an Event object, and the return value is a boolean (True to dispatch the event, False otherwise).

• action (function) - (Optional) Action callback function. If specified, the event is handled by this callback instead of being dispatched normally.

  The callback signature is:

     def action_callback(event):
         pass        # no return value
  

  Where event is an Event object, and the return value is a boolean (True to dispatch the event, False otherwise).

Returns: HardwareBreakpoint

The hardware breakpoint object.

Checks if a code breakpoint is defined at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Returns: bool

True if the breakpoint is defined, False otherwise.

Checks if a page breakpoint is defined at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Returns: bool

True if the breakpoint is defined, False otherwise.

Checks if a hardware breakpoint is defined at the given address.

Parameters:

• dwThreadId (int) - Thread global ID.
• address (int) - Memory address of breakpoint.

Returns: bool

True if the breakpoint is defined, False otherwise.

Returns the internally used breakpoint object, for the code breakpoint defined at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address where the breakpoint is defined.

Returns: CodeBreakpoint

The code breakpoint object.

Returns the internally used breakpoint object, for the page breakpoint defined at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address where the breakpoint is defined.

Returns: PageBreakpoint

The page breakpoint object.

Returns the internally used breakpoint object, for the code breakpoint defined at the given address.

Parameters:

• dwThreadId (int) - Thread global ID.
• address (int) - Memory address where the breakpoint is defined.

Returns: HardwareBreakpoint

The hardware breakpoint object.

Enables the code breakpoint at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Enables the page breakpoint at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Enables the hardware breakpoint at the given address.

Parameters:

• dwThreadId (int) - Thread global ID.
• address (int) - Memory address of breakpoint.

Enables the code breakpoint at the given address for only one shot.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Enables the page breakpoint at the given address for only one shot.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Enables the hardware breakpoint at the given address for only one shot.

Parameters:

• dwThreadId (int) - Thread global ID.
• address (int) - Memory address of breakpoint.

Disables the code breakpoint at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Disables the page breakpoint at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Disables the hardware breakpoint at the given address.

Parameters:

• dwThreadId (int) - Thread global ID.
• address (int) - Memory address of breakpoint.

Erases the code breakpoint at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Erases the page breakpoint at the given address.

Parameters:

• dwProcessId (int) - Process global ID.
• address (int) - Memory address of breakpoint.

Erases the hardware breakpoint at the given address.

Parameters:

• dwThreadId (int) - Thread global ID.
• address (int) - Memory address of breakpoint.

Returns all breakpoint objects as a list of tuples.

Each tuple contains:

• Process global ID to which the breakpoint applies.
• Thread global ID to which the breakpoint applies, or None.
• The Breakpoint object itself.

Returns: list of tuple( pid, tid, bp )

List of all breakpoints.

Returns: list of tuple( int, CodeBreakpoint )

All code breakpoints as a list of tuples (pid, bp).

Returns: list of tuple( int, PageBreakpoint )

All page breakpoints as a list of tuples (pid, bp).

Returns: list of tuple( int, HardwareBreakpoint )

All hardware breakpoints as a list of tuples (tid, bp).

Returns all breakpoint objects for the given process as a list of tuples.

Each tuple contains:

• Process global ID to which the breakpoint applies.
• Thread global ID to which the breakpoint applies, or None.
• The Breakpoint object itself.

Parameters:

• dwProcessId (int) - Process global ID.

Returns: list of tuple( pid, tid, bp )

List of all breakpoints for the given process.

Parameters:

• dwProcessId (int) - Process global ID.

Returns: list of CodeBreakpoint

All code breakpoints for the given process.

Parameters:

• dwProcessId (int) - Process global ID.

Returns: list of PageBreakpoint

All page breakpoints for the given process.

Parameters:

• dwThreadId (int) - Thread global ID.

Returns: list of HardwareBreakpoint

All hardware breakpoints for the given thread.

Parameters:

• dwProcessId (int) - Process global ID.

Returns: list of tuple( int, HardwareBreakpoint )

All hardware breakpoints for each thread in the given process as a list of tuples (tid, bp).

Enables all disabled breakpoints in all processes.

Enables for one shot all disabled breakpoints in all processes.

Disables all breakpoints in all processes.

Erases all breakpoints in all processes.

Enables all disabled breakpoints for the given process.

Parameters:

• dwProcessId (int) - Process global ID.

Enables for one shot all disabled breakpoints for the given process.

Parameters:

• dwProcessId (int) - Process global ID.

Disables all breakpoints for the given process.

Parameters:

• dwProcessId (int) - Process global ID.

Erases all breakpoints for the given process.

Parameters:

• dwProcessId (int) - Process global ID.

Returns a list of deferred code breakpoints.

Returns: tuple of (int, str, callable, bool)

Tuple containing the following elements:

• Process ID where to set the breakpoint.
• Label pointing to the address where to set the breakpoint.
• Action callback for the breakpoint.
• True of the breakpoint is one-shot, False otherwise.

Returns a list of deferred code breakpoints.

Parameters:

• dwProcessId (int) - Process ID.

Returns: tuple of (int, str, callable, bool)

Tuple containing the following elements:

• Label pointing to the address where to set the breakpoint.
• Action callback for the breakpoint.
• True of the breakpoint is one-shot, False otherwise.

Sets a one shot code breakpoint at the given process and address.

If instead of an address you pass a label, the breakpoint may be deferred until the DLL it points to is loaded.

Parameters:

• pid (int) - Process global ID.
• address (int or str) - Memory address of code instruction to break at. It can be an integer value for the actual address or a string with a label to be resolved.
• action (function) - (Optional) Action callback function.

  See define_code_breakpoint for more details.

Returns: bool

True if the breakpoint was set immediately, or False if it was deferred.

Sets a code breakpoint at the given process and address.

If instead of an address you pass a label, the breakpoint may be deferred until the DLL it points to is loaded.

Parameters:

• pid (int) - Process global ID.
• address (int or str) - Memory address of code instruction to break at. It can be an integer value for the actual address or a string with a label to be resolved.
• action (function) - (Optional) Action callback function.

  See define_code_breakpoint for more details.

Returns: bool

True if the breakpoint was set immediately, or False if it was deferred.

Clears a code breakpoint set by break_at.

Parameters:

• pid (int) - Process global ID.
• address (int or str) - Memory address of code instruction to break at. It can be an integer value for the actual address or a string with a label to be resolved.

Clears a code breakpoint set by stalk_at.

Parameters:

• pid (int) - Process global ID.
• address (int or str) - Memory address of code instruction to break at. It can be an integer value for the actual address or a string with a label to be resolved.

Sets a function hook at the given address.

If instead of an address you pass a label, the hook may be deferred until the DLL it points to is loaded.

Parameters:

• pid (int) - Process global ID.
• address (int or str) - Memory address of code instruction to break at. It can be an integer value for the actual address or a string with a label to be resolved.
• preCB (function) - (Optional) Callback triggered on function entry.

  The signature for the callback should be something like this:

     def pre_LoadLibraryEx(event, ra, lpFilename, hFile, dwFlags):
  
         # return address
         ra = params[0]
  
         # function arguments start from here...
         szFilename = event.get_process().peek_string(lpFilename)
  
         # (...)
  

  Note that all pointer types are treated like void pointers, so your callback won't get the string or structure pointed to by it, but the remote memory address instead. This is so to prevent the ctypes library from being "too helpful" and trying to dereference the pointer. To get the actual data being pointed to, use one of the Process.read methods.

• postCB (function) - (Optional) Callback triggered on function exit.

  The signature for the callback should be something like this:

     def post_LoadLibraryEx(event, return_value):
  
         # (...)
  

• paramCount (int) - (Optional) Number of parameters for the preCB callback, not counting the return address. Parameters are read from the stack and assumed to be DWORDs in 32 bits and QWORDs in 64.

  This is a faster way to pull stack parameters in 32 bits, but in 64 bits (or with some odd APIs in 32 bits) it won't be useful, since not all arguments to the hooked function will be of the same size.

  For a more reliable and cross-platform way of hooking use the signature argument instead.

• signature (tuple) - (Optional) Tuple of ctypes data types that constitute the hooked function signature. When the function is called, this will be used to parse the arguments from the stack. Overrides the paramCount argument.

Returns: bool

True if the hook was set immediately, or False if it was deferred.

Sets a one-shot function hook at the given address.

If instead of an address you pass a label, the hook may be deferred until the DLL it points to is loaded.

Parameters:

• pid (int) - Process global ID.
• address (int or str) - Memory address of code instruction to break at. It can be an integer value for the actual address or a string with a label to be resolved.
• preCB (function) - (Optional) Callback triggered on function entry.

  The signature for the callback should be something like this:

     def pre_LoadLibraryEx(event, ra, lpFilename, hFile, dwFlags):
  
         # return address
         ra = params[0]
  
         # function arguments start from here...
         szFilename = event.get_process().peek_string(lpFilename)
  
         # (...)
  

  Note that all pointer types are treated like void pointers, so your callback won't get the string or structure pointed to by it, but the remote memory address instead. This is so to prevent the ctypes library from being "too helpful" and trying to dereference the pointer. To get the actual data being pointed to, use one of the Process.read methods.

• postCB (function) - (Optional) Callback triggered on function exit.

  The signature for the callback should be something like this:

     def post_LoadLibraryEx(event, return_value):
  
         # (...)
  

• paramCount (int) - (Optional) Number of parameters for the preCB callback, not counting the return address. Parameters are read from the stack and assumed to be DWORDs in 32 bits and QWORDs in 64.

  This is a faster way to pull stack parameters in 32 bits, but in 64 bits (or with some odd APIs in 32 bits) it won't be useful, since not all arguments to the hooked function will be of the same size.

  For a more reliable and cross-platform way of hooking use the signature argument instead.

• signature (tuple) - (Optional) Tuple of ctypes data types that constitute the hooked function signature. When the function is called, this will be used to parse the arguments from the stack. Overrides the paramCount argument.

Returns: bool

True if the breakpoint was set immediately, or False if it was deferred.

Removes a function hook set by hook_function.

Parameters:

• pid (int) - Process global ID.
• address (int or str) - Memory address of code instruction to break at. It can be an integer value for the actual address or a string with a label to be resolved.

Removes a function hook set by hook_function.

Parameters:

• pid (int) - Process global ID.
• address (int or str) - Memory address of code instruction to break at. It can be an integer value for the actual address or a string with a label to be resolved.

Removes a function hook set by stalk_function.

Parameters:

• pid (int) - Process global ID.
• address (int or str) - Memory address of code instruction to break at. It can be an integer value for the actual address or a string with a label to be resolved.

Sets a hardware breakpoint at the given thread, address and size.

Parameters:

• tid (int) - Thread global ID.
• address (int) - Memory address of variable to watch.
• size (int) - Size of variable to watch. The only supported sizes are: byte (1), word (2), dword (4) and qword (8).
• action (function) - (Optional) Action callback function.

  See define_hardware_breakpoint for more details.

Sets a one-shot hardware breakpoint at the given thread, address and size.

Parameters:

• tid (int) - Thread global ID.
• address (int) - Memory address of variable to watch.
• size (int) - Size of variable to watch. The only supported sizes are: byte (1), word (2), dword (4) and qword (8).
• action (function) - (Optional) Action callback function.

  See define_hardware_breakpoint for more details.

Clears a hardware breakpoint set by watch_variable.

Parameters:

• tid (int) - Thread global ID.
• address (int) - Memory address of variable to stop watching.

Clears a hardware breakpoint set by stalk_variable.

Parameters:

• tid (int) - Thread global ID.
• address (int) - Memory address of variable to stop watching.

Sets a page breakpoint and notifies when the given buffer is accessed.

Parameters:

• pid (int) - Process global ID.
• address (int) - Memory address of buffer to watch.
• size (int) - Size in bytes of buffer to watch.
• action (function) - (Optional) Action callback function.

  See define_page_breakpoint for more details.

Returns: BufferWatch

Buffer watch identifier.

Sets a one-shot page breakpoint and notifies when the given buffer is accessed.

Parameters:

• pid (int) - Process global ID.
• address (int) - Memory address of buffer to watch.
• size (int) - Size in bytes of buffer to watch.
• action (function) - (Optional) Action callback function.

  See define_page_breakpoint for more details.

Returns: BufferWatch

Buffer watch identifier.

Clears a page breakpoint set by watch_buffer.

Parameters:

• bw (BufferWatch) - Buffer watch identifier returned by watch_buffer.

Clears a page breakpoint set by stalk_buffer.

Parameters:

• bw (BufferWatch) - Buffer watch identifier returned by stalk_buffer.

Parameters:

• tid (int) - Thread global ID.

Returns: bool

True if the thread is being traced, False otherwise.

Retrieves the list of global IDs of all threads being traced.

Returns: list( int... )

List of thread global IDs.

Start tracing mode in the given thread.

Parameters:

• tid (int) - Global ID of thread to start tracing.

Stop tracing mode in the given thread.

Parameters:

• tid (int) - Global ID of thread to stop tracing.

Start tracing mode for all threads in the given process.

Parameters:

• pid (int) - Global ID of process to start tracing.

Stop tracing mode for all threads in the given process.

Parameters:

• pid (int) - Global ID of process to stop tracing.

Sets or clears the system breakpoint for a given Win32 error code.

Use Process.is_system_defined_breakpoint to tell if a breakpoint exception was caused by a system breakpoint or by the application itself (for example because of a failed assertion in the code).

Parameters:

• pid (int) - Process ID.
• errorCode (int) - Win32 error code to stop on. Set to 0 or ERROR_SUCCESS to clear the breakpoint instead.

Raises:

• NotImplementedError - The functionality is not supported in this system.
• WindowsError - An error occurred while processing this request.

Alias to break_on_error(pid, ERROR_SUCCESS).

Parameters:

• pid (int) - Process ID.

Raises:

• NotImplementedError - The functionality is not supported in this system.
• WindowsError - An error occurred while processing this request.

Resolves the exported DLL function for the given process.

Parameters:

• pid (int) - Process global ID.
• modName (str) - Name of the module that exports the function.
• procName (str) - Name of the exported function to resolve.

Returns: int, None

On success, the address of the exported function. On failure, returns None.

Resolves a label for the given process.

Parameters:

• pid (int) - Process global ID.
• label (str) - Label to resolve.

Returns: int

Memory address pointed to by the label.

Raises:

• ValueError - The label is malformed or impossible to resolve.
• RuntimeError - Cannot resolve the module or function.