Home       Trees       Indices       Help   
WinAppDbg - Windows application debugging engine
Package winappdbg :: Module system :: Class System
[hide private]
[frames] | no frames]

Class System

Interface to a batch of processes, plus some system wide settings. Contains a snapshot of processes.

Instance Methods [hide private]
bool
__contains__(self, anObject)
Returns: True if the snapshot contains a Process or Thread object with the same ID. (Inherited from winappdbg.system.ProcessContainer)
 
__init__(self)
x.__init__(...) initializes x; see x.__class__.__doc__ for signature (Inherited from winappdbg.system.ProcessContainer)
dictionary-valueiterator
__iter__(self)
Returns: Iterator of Process objects in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
int
__len__(self)
Returns: Count of Process objects in this snapshot. (Inherited from winappdbg.system.ProcessContainer)

Inherited from object: __delattr__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __str__

    Instrumentation
str
argv_to_cmdline(self, argv)
Convert a list of arguments to a single command line string. (Inherited from winappdbg.system.ProcessContainer)
list( str )
cmdline_to_argv(self, lpCmdLine)
Convert a single command line string to a list of arguments. (Inherited from winappdbg.system.ProcessContainer)
Process
start_process(self, lpCmdLine, bConsole=False, bDebug=False, bFollow=False, bSuspended=False)
Starts a new process for debugging. (Inherited from winappdbg.system.ProcessContainer)
    Processes snapshot
 
clear(self)
Clears this snapshot. (Inherited from winappdbg.system.ProcessContainer)
 
clear_dead_processes(self)
Removes Process objects from the snapshot referring to processes no longer running. (Inherited from winappdbg.system.ProcessContainer)
 
clear_processes(self)
Removes all Process, Thread and Module objects in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
 
clear_unattached_processes(self)
Removes Process objects from the snapshot referring to processes not being debugged. (Inherited from winappdbg.system.ProcessContainer)
 
close_process_and_thread_handles(self)
Closes all open handles to processes and threads in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
 
close_process_handles(self)
Closes all open handles to processes in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
list of tuple( Process, str )
find_processes_by_filename(self, filename)
Returns: List of processes matching the given main module filename. (Inherited from winappdbg.system.ProcessContainer)
Process
get_process(self, dwProcessId)
Returns: Process object with the given global ID. (Inherited from winappdbg.system.ProcessContainer)
int
get_process_count(self)
Returns: Count of Process objects in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
list( int )
get_process_ids(self)
Returns: List of global process IDs in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
bool
has_process(self, dwProcessId)
Returns: True if the snapshot contains a Process object with the given global ID. (Inherited from winappdbg.system.ProcessContainer)
dictionary-keyiterator
iter_process_ids(self)
Returns: Iterator of global process IDs in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
dictionary-valueiterator
iter_processes(self)
Returns: Iterator of Process objects in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
 
scan(self)
Populates the snapshot with running processes and threads, and loaded modules. (Inherited from winappdbg.system.ProcessContainer)
 
scan_processes(self)
Populates the snapshot with running processes. (Inherited from winappdbg.system.ProcessContainer)
 
scan_processes_fast(self)
Populates the snapshot with running processes. (Inherited from winappdbg.system.ProcessContainer)
    Threads snapshots
Thread
get_thread(self, dwThreadId)
Returns: Thread object with the given global ID. (Inherited from winappdbg.system.ProcessContainer)
int
get_thread_count(self)
Returns: Count of Thread objects in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
list( int )
get_thread_ids(self)
Returns: List of global thread IDs in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
bool
has_thread(self, dwThreadId)
Returns: True if the snapshot contains a Thread object with the given global ID. (Inherited from winappdbg.system.ProcessContainer)
 
scan_processes_and_threads(self)
Populates the snapshot with running processes and threads. (Inherited from winappdbg.system.ProcessContainer)
    Modules snapshots
list( Module... )
find_modules_by_address(self, address)
Returns: List of Module objects that best match the given address. (Inherited from winappdbg.system.ProcessContainer)
list( Module... )
find_modules_by_base(self, lpBaseOfDll)
Returns: List of Module objects with the given base address. (Inherited from winappdbg.system.ProcessContainer)
list( Module... )
find_modules_by_name(self, fileName)
Returns: List of Module objects that best match the given filename. (Inherited from winappdbg.system.ProcessContainer)
int
get_module_count(self)
Returns: Count of Module objects in this snapshot. (Inherited from winappdbg.system.ProcessContainer)
 
scan_modules(self)
Populates the snapshot with loaded modules. (Inherited from winappdbg.system.ProcessContainer)
    Event notifications (private)
 
notify_create_process(self, event)
Notify the creation of a new process. (Inherited from winappdbg.system.ProcessContainer)
 
notify_exit_process(self, event)
Notify the termination of a process. (Inherited from winappdbg.system.ProcessContainer)
Static Methods [hide private]
    Global settings
 
request_debug_privileges(bIgnoreExceptions=False)
Requests debug privileges.
bool
set_kill_on_exit_mode(bKillOnExit=False)
Automatically detach from processes when the current thread dies.
 
enable_step_on_branch_mode()
When tracing, call this on every single step event for step on branch mode.
 
set_symbol_options(options=None)
Set the options for the symbol support (dbghelp.dll).
Class Variables [hide private]
    Global settings
int pageSize = 4096
Page size in bytes.
Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

request_debug_privileges(bIgnoreExceptions=False)
Static Method

 

Requests debug privileges.

This may be needed to debug processes running as SYSTEM (such as services) since Windows XP.

set_kill_on_exit_mode(bKillOnExit=False)
Static Method

 

Automatically detach from processes when the current thread dies.

Works on the following platforms:

  • Microsoft Windows XP and above.
  • Wine (Windows Emulator).

Fails on the following platforms:

  • Microsoft Windows 2000 and below.
  • ReactOS.
Parameters:
  • bKillOnExit (bool) - True to automatically kill processes when the debugger thread dies. False to automatically detach from processes when the debugger thread dies.
Returns: bool
True on success, False on error.

enable_step_on_branch_mode()
Static Method

 

When tracing, call this on every single step event for step on branch mode.

Warning: This has a HARDCODED value for a machine specific register (MSR). It could potentially brick your machine. It works on my machine, but your mileage may vary.

set_symbol_options(options=None)
Static Method

 

Set the options for the symbol support (dbghelp.dll).

Parameters:
  • options (int) - Option flags. Use None for the default options in WinAppDbg.

Class Variable Details [hide private]

pageSize

Page size in bytes. Defaults to 0x1000 but it's automatically updated on runtime when importing the module.
Type:
int
Value:
4096

   Home       Trees       Indices       Help   
WinAppDbg - Windows application debugging engine
Generated by Epydoc 3.0.1 on Fri May 15 21:56:40 2009 http://epydoc.sourceforge.net