Class Hierarchy

• winappdbg.win32.FILE_INFO_BY_HANDLE_CLASS
• winappdbg.win32.CONTEXT.__ContextIterator: Iterator of CONTEXT structures.
• object: The most base type
  • winappdbg.breakpoint.Breakpoint: Base class for breakpoints.
    • winappdbg.breakpoint.CodeBreakpoint: Code execution breakpoints (using an int3 opcode).
    • winappdbg.breakpoint.HardwareBreakpoint: Hardware breakpoint (using debug registers).
    • winappdbg.breakpoint.PageBreakpoint: Page access breakpoint (using guard pages).
  • winappdbg.breakpoint.BreakpointContainer: Encapsulates the capability to contain Breakpoint objects.
    • winappdbg.debug.Debug: The main debugger class.
  • winappdbg.breakpoint.BufferWatch: Used by Debug.watch_buffer.
  • winappdbg.crash.Crash: Represents a crash, bug, or another interesting event in the debugee.
  • winappdbg.crash.CrashContainer: Manages a database of persistent Crash objects, trying to avoid duplicates.
  • winappdbg.textio.CrashDump: Static functions for crash dumps.
  • winappdbg.textio.DebugLog: Static functions for debug logging.
  • winappdbg.breakpoint.DebugRegister: Class to manipulate debug registers.
  • winappdbg.event.Event: Event object.
    • winappdbg.event.CreateProcessEvent: Process creation event.
    • winappdbg.event.CreateThreadEvent: Thread creation event.
    • winappdbg.event.ExceptionEvent: Exception event.
    • winappdbg.event.ExitProcessEvent: Process termination event.
    • winappdbg.event.ExitThreadEvent: Thread termination event.
    • winappdbg.event.LoadDLLEvent: Module load event.
    • winappdbg.event.NoEvent: No event.
    • winappdbg.event.OutputDebugStringEvent: Debug string output event.
    • winappdbg.event.RIPEvent: RIP event.
    • winappdbg.event.UnloadDLLEvent: Module unload event.
  • winappdbg.event.EventDispatcher: Implements debug event dispatching capabilities.
    • winappdbg.debug.Debug: The main debugger class.
  • winappdbg.event.EventFactory: Factory of Event objects.
  • winappdbg.event.EventHandler: Base class for debug event handlers.
  • winappdbg.system.Thread.Flags: Commonly used processor flags
  • winappdbg.win32.Handle: Encapsulates win32 handles to avoid leaking them.
    • winappdbg.win32.FileHandle: Win32 file handle.
    • winappdbg.win32.ProcessHandle: Win32 process handle.
    • winappdbg.win32.ThreadHandle: Win32 thread handle.
  • winappdbg.textio.HexDump: Static functions for hexadecimal dumps.
  • winappdbg.textio.HexInput: Static functions for user input parsing.
  • winappdbg.textio.HexOutput: Static functions for user output parsing.
  • winappdbg.breakpoint.Hook: Used by Debug.hook_function.
    • winappdbg.breakpoint.ApiHook: Used by EventHandler.
  • winappdbg.system.MemoryAddresses: Class to manipulate memory addresses.
  • winappdbg.system.MemoryOperations: Encapsulates the capabilities to manipulate the memory of a process.
    • winappdbg.system.Process: Interface to a process.
  • winappdbg.system.ModuleContainer: Encapsulates the capability to contain Module objects.
    • winappdbg.system.Process: Interface to a process.
  • winappdbg.system.PathOperations: Static methods for filename and pathname manipulation.
  • winappdbg.system.ProcessContainer: Encapsulates the capability to contain Process objects.
    • winappdbg.system.System: Interface to a batch of processes, plus some system wide settings.
  • winappdbg.system.ProcessDebugOperations: Encapsulates several useful debugging routines for processes.
    • winappdbg.system.Process: Interface to a process.
  • winappdbg.win32.ProcessInformation: Process information object returned by CreateProcess.
  • winappdbg.system.SymbolContainer: Capability to contain symbols.
    • winappdbg.system.Module: Interface to a DLL library loaded in the context of another process.
  • winappdbg.system.SymbolEnumerator: Internally used by SymbolContainer to enumerate symbols in a module.
  • winappdbg.system.SymbolOperations: Encapsulates symbol operations capabilities.
    • winappdbg.system.Process: Interface to a process.
  • winappdbg.system.ThreadContainer: Encapsulates the capability to contain Thread objects.
    • winappdbg.system.Process: Interface to a process.
  • winappdbg.system.ThreadDebugOperations: Encapsulates several useful debugging routines for threads.
    • winappdbg.system.Thread: Interface to a thread in another process.
  • unreachable._CData: XXX to be provided
    • _ctypes.Structure: Structure base class
      • winappdbg.win32.BY_HANDLE_FILE_INFORMATION
      • winappdbg.win32.CLIENT_ID
      • winappdbg.win32.CONTEXT
      • winappdbg.win32.CREATE_PROCESS_DEBUG_INFO
      • winappdbg.win32.CREATE_THREAD_DEBUG_INFO
      • winappdbg.win32.CURDIR
      • winappdbg.win32.DEBUG_EVENT
      • winappdbg.win32.EXCEPTION_DEBUG_INFO
      • winappdbg.win32.EXCEPTION_RECORD
      • winappdbg.win32.EXCEPTION_REGISTRATION_RECORD
      • winappdbg.win32.EXIT_PROCESS_DEBUG_INFO
      • winappdbg.win32.EXIT_THREAD_DEBUG_INFO
      • winappdbg.win32.FILETIME
      • winappdbg.win32.FLOATING_SAVE_AREA
      • winappdbg.win32.GDI_TEB_BATCH
      • winappdbg.win32.GUID
      • winappdbg.win32.HEAPENTRY32
      • winappdbg.win32.HEAPLIST32
      • winappdbg.win32.IMAGEHLP_MODULE
      • winappdbg.win32.IMAGEHLP_MODULE64
      • winappdbg.win32.IMAGEHLP_MODULEW
      • winappdbg.win32.IMAGEHLP_MODULEW64
      • winappdbg.win32.IO_STATUS_BLOCK
      • winappdbg.win32.LDR_MODULE
      • winappdbg.win32.LDT_ENTRY
      • winappdbg.win32.LIST_ENTRY
      • winappdbg.win32.LOAD_DLL_DEBUG_INFO
      • winappdbg.win32.LUID
      • winappdbg.win32.LUID_AND_ATTRIBUTES
      • winappdbg.win32.MEMORY_BASIC_INFORMATION
      • winappdbg.win32.MODULEENTRY32
      • winappdbg.win32.MODULEINFO
      • winappdbg.win32.NT_TIB
      • winappdbg.win32.OUTPUT_DEBUG_STRING_INFO
      • winappdbg.win32.PEB
      • winappdbg.win32.PEB_FREE_BLOCK
      • winappdbg.win32.PEB_LDR_DATA
      • winappdbg.win32.PROCESSENTRY32
      • winappdbg.win32.PROCESS_BASIC_INFORMATION
      • winappdbg.win32.PROCESS_INFORMATION
      • winappdbg.win32.RIP_INFO
      • winappdbg.win32.RTL_CRITICAL_SECTION
      • winappdbg.win32.RTL_CRITICAL_SECTION_DEBUG
      • winappdbg.win32.RTL_DRIVE_LETTER_CURDIR
      • winappdbg.win32.RTL_USER_PROCESS_PARAMETERS
      • winappdbg.win32.SECURITY_ATTRIBUTES
      • winappdbg.win32.STARTUPINFO
      • winappdbg.win32.STARTUPINFOEX
      • winappdbg.win32.SYSDBG_MSR
      • winappdbg.win32.SYSTEM_INFO
      • winappdbg.win32.TEB
      • winappdbg.win32.THREADENTRY32
      • winappdbg.win32.THREADNAME_INFO
      • winappdbg.win32.THREAD_BASIC_INFORMATION
      • winappdbg.win32.TOKEN_PRIVILEGES
      • winappdbg.win32.UNICODE_STRING
      • winappdbg.win32.UNLOAD_DLL_DEBUG_INFO
      • winappdbg.win32._LDT_ENTRY_BITS_
      • winappdbg.win32._LDT_ENTRY_BYTES_
      • winappdbg.win32._SYSTEM_INFO_OEM_ID_STRUCT
    • _ctypes.Union: Union base class
      • winappdbg.win32._DEBUG_EVENT_UNION_
      • winappdbg.win32._LDT_ENTRY_HIGHWORD_
      • winappdbg.win32._NT_TIB_UNION
      • winappdbg.win32._SYSTEM_INFO_OEM_ID
  • winappdbg.crash.CrashContainer.__CrashContainerIterator: Iterator of Crash objects.
  • winappdbg.system.Process.__ThreadsAndModulesIterator: Iterator object for Process objects.