Class EventHandler

Base class for debug event handlers.

Your program should subclass it to implement it's own event handling.

The signature for event handlers is the following:

   def event_handler(self, event):

Where event is an Event object.

Each event handler is named after the event they handle. This is the list of all valid event handler names:

• event

  Receives an Event object or an object of any of it's subclasses, and handles any event for which no handler was defined.

• unknown_event

  Receives an Event object or an object of any of it's subclasses, and handles any event unknown to the debugging engine. (This is not likely to happen unless the Win32 debugging API is changed in future versions of Windows).

• exception

  Receives an ExceptionEvent object and handles any exception for which no handler was defined. See above for exception handlers.

• unknown_exception

  Receives an ExceptionEvent object and handles any exception unknown to the debugging engine. This usually happens for C++ exceptions, which are not standardized and may change from one compiler to the next.

  Currently we have partial support for C++ exceptions thrown by Microsoft compilers.

  Also see: RaiseException()

• create_thread

  Receives a CreateThreadEvent object.

• create_process

  Receives a CreateProcessEvent object.

• exit_thread

  Receives a ExitThreadEvent object.

• exit_process

  Receives a ExitProcessEvent object.

• load_dll

  Receives a LoadDLLEvent object.

• unload_dll

  Receives an UnloadDLLEvent object.

• output_string

  Receives an OutputDebugStringEvent object.

• rip

  Receives a RIPEvent object.

This is the list of all valid exception handler names (they all receive an ExceptionEvent object):

• access_violation
• array_bounds_exceeded
• breakpoint
• control_c_exit
• datatype_misalignment
• debug_control_c
• float_denormal_operand
• float_divide_by_zero
• float_inexact_result
• float_invalid_operation
• float_overflow
• float_stack_check
• float_underflow
• guard_page
• illegal_instruction
• in_page_error
• integer_divide_by_zero
• integer_overflow
• invalid_disposition
• invalid_handle
• ms_vc_exception
• noncontinuable_exception
• possible_deadlock
• privileged_instruction
• single_step
• stack_overflow

   def pre_LoadLibraryEx(event, *params):
       ra   = params[0]        # return address
       argv = params[1:]       # function parameters

       # (...)

   def post_LoadLibrary(event, return_value):

       # (...)

   def pre_LoadLibraryEx(event, ra, lpFilename, hFile, dwFlags):
       szFilename = event.get_process().peek_string(lpFilename)

       # (...)

   apiHook = {

       "kernel32.dll" : (

           #   Procedure name      Parameter count
           (   "LoadLibraryEx",    4 ),

           # (more procedures can go here...)
       ),

       # (more libraries can go here...)
   }