Class CrashDump

Dump the x86 processor flags. The output mimics that of the WinDBG debugger.

Parameters:

• efl (int) - Value of the eFlags register.

Returns: str

Text suitable for logging.

Dump the x86 processor register values. The output mimics that of the WinDBG debugger.

Parameters:

• registers (dict( str → int )) - Dictionary mapping register names to their values.

Returns: str

Text suitable for logging.

Dump data pointed to by the given registers, if any.

Parameters:

• registers (dict( str → int )) - Dictionary mapping register names to their values.
• data (dict( str → str )) - Dictionary mapping register names to the data they point to.

Returns: str

Text suitable for logging.

Dump data from pointers guessed within the given binary data.

Parameters:

• data (str) - Dictionary mapping offsets to the data they point to.
• base (int) - Base offset.

Returns: str

Text suitable for logging.

Dump data from pointers guessed within the given stack dump.

Parameters:

• data (str) - Dictionary mapping stack offsets to the data they point to.

Returns: str

Text suitable for logging.

Dump a stack trace, as returned by Thread.get_stack_trace with the bUseLabels parameter set to False.

Parameters:

• stack_trace (list( int, int, str )) - Stack trace as a list of tuples of ( return address, frame pointer, module filename )

Returns: str

Text suitable for logging.

Dump a stack trace, as returned by Thread.get_stack_trace with the bUseLabels parameter set to True.

Parameters:

• stack_trace (list( int, int, str )) - Stack trace as a list of tuples of ( return address, frame pointer, module filename )

Returns: str

Text suitable for logging.

Dump a disassembly. Optionally mark where the program counter is.

Parameters:

• disassembly (list of tuple( int, int, str, str )) - Disassembly dump as returned by Process.disassemble or Thread.disassemble_around_pc.
• pc (int) - (Optional) Program counter.
• bLowercase (bool) - (Optional) If True convert the code to lowercase.

Returns: str

Text suitable for logging.

Dump a single line of code. To dump a block of code use dump_code.

Parameters:

• disassembly_line (tuple( int, int, str, str )) - Single item of the list returned by Process.disassemble or Thread.disassemble_around_pc.
• bShowAddress (int) - (Optional) If True show the memory address.
• bLowercase (bool) - (Optional) If True convert the code to lowercase.

Returns: str

Text suitable for logging.

Dump the memory map of a process.

Parameters:

• memoryMap (list( MEMORY_BASIC_INFORMATION )) - Memory map returned by Process.get_memory_map.

Returns: str

Text suitable for logging.

reg_template

Type:

str

Value:

'''eax=%(Eax).8x ebx=%(Ebx).8x ecx=%(Ecx).8x edx=%(Edx).8x esi=%(Esi). 8x edi=%(Edi).8x eip=%(Eip).8x esp=%(Esp).8x ebp=%(Ebp).8x %(efl_dump)s cs=%(SegCs).4x ss=%(SegSs).4x ds=%(SegDs).4x es=%(SegEs).4x fs=%(S egFs).4x gs=%(SegGs).4x efl=%(EFlags).8x '''