Package winappdbg :: Module system :: Class ModuleContainer

[frames] | no frames]

Class ModuleContainer

Encapsulates the capability to contain Module objects.

Instance Methods

[hide private]

__init__(self)
x.__init__(...) initializes x; see x.__class__.__doc__ for signature

bool

__contains__(self, anObject)
Returns: True if the snapshot contains a Module object with the same base address.

dictionary-valueiterator

__iter__(self)
Returns: Iterator of Module objects in this snapshot.

int

__len__(self)
Returns: Count of Module objects in this snapshot.

__add_module(self, aModule)

__del_module(self, lpBaseOfDll)

__add_loaded_module(self, event)

Inherited from object: __delattr__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __str__

Modules snapshot

bool

has_module(self, lpBaseOfDll)
Returns: True if the snapshot contains a Module object with the given base address.

Module

get_module(self, lpBaseOfDll)
Returns: Module object with the given base address.

dictionary-keyiterator

iter_module_addresses(self)
Returns: Iterator of DLL base addresses in this snapshot.

dictionary-valueiterator

iter_modules(self)
Returns: Iterator of Module objects in this snapshot.

list( int... )

get_module_bases(self)
Returns: List of DLL base addresses in this snapshot.

int

get_module_count(self)
Returns: Count of Module objects in this snapshot.

Module

get_module_by_name(self, modName)
Returns: Module object that best matches the given name.

Module

get_module_at_address(self, address)
Returns: Module object that best matches the given address.

scan_modules(self)
Populates the snapshot with loaded modules.

clear_modules(self)
Clears the modules snapshot.

Event notifications (private)

notify_create_process(self, event)
Notify the load of the main module.

notify_load_dll(self, event)
Notify the load of a new module.

notify_unload_dll(self, event)
Notify the release of a loaded module.

Properties

[hide private]

Inherited from object: __class__

Method Details

[hide private]

init(self)
(Constructor)

x.__init__(...) initializes x; see x.__class__.__doc__ for signature

Overrides: object.__init__: (inherited documentation)

contains(self, anObject)
(In operator)

Parameters:

anObject (Module, int) -
- Module: Module object to look for.
- int: Base address of the DLL to look for.

Returns: bool

True if the snapshot contains a Module object with the same base address.

iter(self)

Returns: dictionary-valueiterator: Iterator of Module objects in this snapshot.

See Also: iter_modules

len(self)
(Length operator)

Returns: int: Count of Module objects in this snapshot.

See Also: get_module_count

has_module(self, lpBaseOfDll)

Parameters:

lpBaseOfDll (int) - Base address of the DLL to look for.

Returns: bool

True if the snapshot contains a Module object with the given base address.

Decorators:

@dllbaseparam

get_module(self, lpBaseOfDll)

Parameters:

lpBaseOfDll (int) - Base address of the DLL to look for.

Returns: Module

Module object with the given base address.

Decorators:

@dllbaseparam

iter_module_addresses(self)

Returns: dictionary-keyiterator: Iterator of DLL base addresses in this snapshot.

See Also: iter_modules

iter_modules(self)

Returns: dictionary-valueiterator: Iterator of Module objects in this snapshot.

See Also: iter_module_addresses

get_module_bases(self)

Returns: list( int... ): List of DLL base addresses in this snapshot.

See Also: iter_module_addresses

get_module_count(self)

Returns: int: Count of Module objects in this snapshot.

get_module_by_name(self, modName)

Parameters:

modName (int) - Name of the module to look for, as returned by Module.get_name. If two or more modules with the same name are loaded, only one of the matching modules is returned.
You can also pass a full pathname to the DLL file. This works correctly even if two modules with the same name are loaded from different paths.

Returns: Module

Module object that best matches the given name. Returns None if no Module can be found.

get_module_at_address(self, address)

Parameters:

address (int) - Memory address to query.

Returns: Module

Module object that best matches the given address. Returns None if no Module can be found.

notify_create_process(self, event)

Notify the load of the main module.

Parameters:

event (CreateProcessEvent) - Create process event.

notify_load_dll(self, event)

Notify the load of a new module.

Parameters:

event (LoadDLLEvent) - Load DLL event.

notify_unload_dll(self, event)

Notify the release of a loaded module.

Parameters:

event (UnloadDLLEvent) - Unload DLL event.

Class ModuleContainer

__init__(self) (Constructor)

__contains__(self, anObject) (In operator)

__iter__(self)

__len__(self) (Length operator)

has_module(self, lpBaseOfDll)

get_module(self, lpBaseOfDll)

iter_module_addresses(self)

iter_modules(self)

get_module_bases(self)

get_module_count(self)

get_module_by_name(self, modName)

get_module_at_address(self, address)

notify_create_process(self, event)

notify_load_dll(self, event)

notify_unload_dll(self, event)

init(self)
(Constructor)

contains(self, anObject)
(In operator)

iter(self)

len(self)
(Length operator)