Class Hook

x.__init__(...) initializes x; see x.__class__.__doc__ for signature

Parameters:

• preCB (function) - (Optional) Callback triggered on function entry.

  The signature for the callback can be something like this:

     def pre_LoadLibraryEx(event, *params):
         ra   = params[0]        # return address
         argv = params[1:]       # function parameters
  
         # (...)
  

  But if you passed the right number of arguments, you can also use a signature like this:

     def pre_LoadLibraryEx(event, ra, lpFilename, hFile, dwFlags):
         szFilename = event.get_process().peek_string(lpFilename)
  
         # (...)
  

  In the above example, the value for paramCount would be 3.

• postCB (function) - (Optional) Callback triggered on function exit.

  The signature for the callback would be something like this:

     def post_LoadLibraryEx(event, return_value):
  
         # (...)
  

• paramCount (int) - (Optional) Number of parameters for the preCB callback, not counting the return address. Parameters are read from the stack and assumed to be DWORDs.

Overrides: object.__init__

Handles the breakpoint event on entry of the function.

Parameters:

• event (ExceptionEvent) - Breakpoint hit event.

Raises:

• WindowsError - An error occured.

Installs the function hook at a given process and address.

Parameters:

• debug (Debug) - Debug object.
• pid (int) - Process ID.
• address (int) - Function address.

Removes the function hook at a given process and address.

Parameters:

• debug (Debug) - Debug object.
• pid (int) - Process ID.
• address (int) - Function address.