Home       Trees       Indices       Help   
WinAppDbg - Programming Reference
Package winappdbg :: Module system :: Class ProcessDebugOperations
[hide private]
[frames] | no frames]

Class ProcessDebugOperations

source code

object --+
         |
        ProcessDebugOperations
Known Subclasses:

Encapsulates several useful debugging routines for processes.

Instance Methods [hide private]
 
__fixup_labels(self, disasm)
Private method used when disassembling from process memory.		 source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __init__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

    Properties
bool
is_wow64(self)
Determines if the process is running under WOW64.		 source code
win32.PEB
get_peb(self)
Returns a copy of the PEB.		 source code
int
get_peb_address(self)
Returns a remote pointer to the PEB.		 source code
Module
get_main_module(self)
Returns: Module object for the process main module.		 source code
int
get_image_base(self)
Returns: Image base address for the process main module.		 source code
int
get_image_name(self)
Returns: Filename of the process main module.		 source code
tuple(int, int)
get_command_line_block(self)
Retrieves the command line block memory address and size.		 source code
tuple(int, int)
get_environment_block(self)
Retrieves the environment block memory address for the process.		 source code
str
get_command_line(self)
Retrieves the command line with wich the program was started.		 source code
list of str
get_environment_data(self)
Retrieves the environment block data with wich the program is running.		 source code
dict(str → str)
get_environment(self)
Retrieves the environment with wich the program is running.		 source code
    Disassembly
list of tuple( long, int, str, str )
disassemble_string(self, lpAddress, code)
Disassemble instructions from a block of binary code.		 source code
list of tuple( long, int, str, str )
disassemble(self, lpAddress, dwSize)
Disassemble instructions from the address space of the process.		 source code
list of tuple( long, int, str, str )
disassemble_around(self, lpAddress, dwSize=64)
Disassemble around the given address.		 source code
list of tuple( long, int, str, str )
disassemble_around_pc(self, dwThreadId, dwSize=64)
Disassemble around the program counter of the given thread.		 source code
tuple( long, int, str, str )
disassemble_instruction(self, lpAddress)
Disassemble the instruction at the given memory address.		 source code
tuple( long, int, str, str )
disassemble_current(self, dwThreadId)
Disassemble the instruction at the program counter of the given thread.		 source code
    Debugging
 
flush_instruction_cache(self)
Flush the instruction cache.		 source code
 
debug_break(self)
Triggers the system breakpoint in the process.		 source code
dict( str → str )
peek_pointers_in_data(self, data, peekSize=16, peekStep=1)
Tries to guess which values in the given data are valid pointers, and reads some data from them.		 source code
Static Methods [hide private]
    Properties
dict(str → str)
parse_environment_data(block)
Parse the environment block into a Python dictionary.		 source code
Class Variables [hide private]
  __hexa_parameter = re.compile(r'0x[0-9A-Za-z]+')
Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__fixup_labels(self, disasm)

source code 

Private method used when disassembling from process memory.

It has no return value because the list is modified in place. On return all raw memory addresses are replaced by labels when possible.

Parameters:
  • disasm (list of tuple(int, int, str, str)) - Output of one of the dissassembly functions.

disassemble_string(self, lpAddress, code)

source code 

Disassemble instructions from a block of binary code.

Parameters:
  • lpAddress (int) - Memory address where the code was read from.
  • code (str) - Binary code to disassemble.
Returns: list of tuple( long, int, str, str )
List of tuples. Each tuple represents an assembly instruction and contains:
  • Memory address of instruction.
  • Size of instruction in bytes.
  • Disassembly line of instruction.
  • Hexadecimal dump of instruction.
Raises:
  • NotImplementedError - No compatible disassembler was found for the current platform.

disassemble(self, lpAddress, dwSize)

source code 

Disassemble instructions from the address space of the process.

Parameters:
  • lpAddress (int) - Memory address where to read the code from.
  • dwSize (int) - Size of binary code to disassemble.
Returns: list of tuple( long, int, str, str )
List of tuples. Each tuple represents an assembly instruction and contains:
  • Memory address of instruction.
  • Size of instruction in bytes.
  • Disassembly line of instruction.
  • Hexadecimal dump of instruction.

disassemble_around(self, lpAddress, dwSize=64)

source code 

Disassemble around the given address.

Parameters:
  • lpAddress (int) - Memory address where to read the code from.
  • dwSize (int) - Delta offset. Code will be read from lpAddress - dwSize to lpAddress + dwSize.
Returns: list of tuple( long, int, str, str )
List of tuples. Each tuple represents an assembly instruction and contains:
  • Memory address of instruction.
  • Size of instruction in bytes.
  • Disassembly line of instruction.
  • Hexadecimal dump of instruction.

disassemble_around_pc(self, dwThreadId, dwSize=64)

source code 

Disassemble around the program counter of the given thread.

Parameters:
  • dwThreadId (int) - Global thread ID. The program counter for this thread will be used as the disassembly address.
  • dwSize (int) - Delta offset. Code will be read from pc - dwSize to pc + dwSize.
Returns: list of tuple( long, int, str, str )
List of tuples. Each tuple represents an assembly instruction and contains:
  • Memory address of instruction.
  • Size of instruction in bytes.
  • Disassembly line of instruction.
  • Hexadecimal dump of instruction.

disassemble_instruction(self, lpAddress)

source code 

Disassemble the instruction at the given memory address.

Parameters:
  • lpAddress (int) - Memory address where to read the code from.
Returns: tuple( long, int, str, str )
The tuple represents an assembly instruction and contains:
  • Memory address of instruction.
  • Size of instruction in bytes.
  • Disassembly line of instruction.
  • Hexadecimal dump of instruction.

disassemble_current(self, dwThreadId)

source code 

Disassemble the instruction at the program counter of the given thread.

Parameters:
  • dwThreadId (int) - Global thread ID. The program counter for this thread will be used as the disassembly address.
Returns: tuple( long, int, str, str )
The tuple represents an assembly instruction and contains:
  • Memory address of instruction.
  • Size of instruction in bytes.
  • Disassembly line of instruction.
  • Hexadecimal dump of instruction.

flush_instruction_cache(self)

source code 

Flush the instruction cache. This is required if the process memory is modified and one or more threads are executing nearby the modified memory region.

Raises:
  • WindowsError - Raises exception on error.

See Also: http://blogs.msdn.com/oldnewthing/archive/2003/12/08/55954.aspx#55958

debug_break(self)

source code 

Triggers the system breakpoint in the process.

Raises:
  • WindowsError - On error an exception is raised.

is_wow64(self)

source code 

Determines if the process is running under WOW64.

Returns: bool
True if the process is running under WOW64. That is, a 32-bit application running in a 64-bit Windows.

False if the process is either a 32-bit application running in a 32-bit Windows, or a 64-bit application running in a 64-bit Windows.

Raises:
  • WindowsError - On error an exception is raised.

See Also: http://msdn.microsoft.com/en-us/library/aa384249(VS.85).aspx

get_peb(self)

source code 

Returns a copy of the PEB. To dereference pointers in it call Process.read_structure.

Returns: win32.PEB
PEB structure.
Raises:
  • WindowsError - An exception is raised on error.

get_peb_address(self)

source code 

Returns a remote pointer to the PEB.

Returns: int
Remote pointer to the win32.PEB structure. Returns None on error.

get_main_module(self)

source code 
Returns: Module
Module object for the process main module.

get_image_base(self)

source code 
Returns: int
Image base address for the process main module.

get_image_name(self)

source code 
Returns: int
Filename of the process main module.

This method does it's best to retrieve the filename. However sometimes this is not possible, so None may be returned instead.

get_command_line_block(self)

source code 

Retrieves the command line block memory address and size.

Returns: tuple(int, int)
Tuple with the memory address of the command line block and it's maximum size in Unicode characters.
Raises:
  • WindowsError - On error an exception is raised.

get_environment_block(self)

source code 

Retrieves the environment block memory address for the process.

Returns: tuple(int, int)
Tuple with the memory address of the environment block and it's size.
Raises:
  • WindowsError - On error an exception is raised.

Note: The size is always None on Windows XP and below.

get_command_line(self)

source code 

Retrieves the command line with wich the program was started.

Returns: str
Command line string.
Raises:
  • WindowsError - On error an exception is raised.

get_environment_data(self)

source code 

Retrieves the environment block data with wich the program is running.

Returns: list of str
Environment keys and values separated by a = character, as found in the process memory.
Raises:
  • WindowsError - On error an exception is raised.

parse_environment_data(block)
Static Method

source code 

Parse the environment block into a Python dictionary.

Parameters:
Returns: dict(str → str)
Dictionary of environment keys and values.

Note: Duplicated keys are joined using null characters.

get_environment(self)

source code 

Retrieves the environment with wich the program is running.

Returns: dict(str → str)
Dictionary of environment keys and values.
Raises:
  • WindowsError - On error an exception is raised.

Note: Duplicated keys are joined using null characters.

peek_pointers_in_data(self, data, peekSize=16, peekStep=1)

source code 

Tries to guess which values in the given data are valid pointers, and reads some data from them.

Parameters:
  • data (str) - Binary data to find pointers in.
  • peekSize (int) - Number of bytes to read from each pointer found.
  • peekStep (int) - Expected data alignment. Tipically you specify 1 when data alignment is unknown, or 4 when you expect data to be DWORD aligned. Any other value may be specified.
Returns: dict( str → str )
Dictionary mapping stack offsets to the data they point to.

   Home       Trees       Indices       Help   
WinAppDbg - Programming Reference
Generated by Epydoc 3.0.1 on Tue Jul 20 14:32:16 2010 http://epydoc.sourceforge.net