Skip to content

Commit 292fff0

Browse files
pedramaminipedramamini
committed
initial import from googlecode-svn.
0 parents  commit 292fff0

15 files changed

+5121
-0
lines changed

‎README.md

Whitespace-only changes.

‎__init__.py

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#
2+
# PyDBG
3+
# Copyright (C) 2006 Pedram Amini <[email protected]>
4+
#
5+
# $Id: __init__.py 194 2007-04-05 15:31:53Z cameron $
6+
#
7+
# This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public
8+
# License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later
9+
# version.
10+
#
11+
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
12+
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
13+
#
14+
# You should have received a copy of the GNU General Public License along with this program; if not, write to the Free
15+
# Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
16+
#
17+
18+
'''
19+
@author: Pedram Amini
20+
@license: GNU General Public License 2.0 or later
21+
@contact: [email protected]
22+
@organization: www.openrce.org
23+
'''
24+
25+
__all__ = \
26+
[
27+
"breakpoint",
28+
"defines",
29+
"hardware_breakpoint",
30+
"memory_breakpoint",
31+
"memory_snapshot_block",
32+
"memory_snapshot_context",
33+
"pdx",
34+
"pydbg",
35+
"pydbg_client",
36+
"system_dll",
37+
"windows_h",
38+
]
39+
40+
from breakpoint import *
41+
from defines import *
42+
from hardware_breakpoint import *
43+
from memory_breakpoint import *
44+
from memory_snapshot_block import *
45+
from memory_snapshot_context import *
46+
from pdx import *
47+
from pydbg import *
48+
from pydbg_client import *
49+
from system_dll import *
50+
from windows_h import *

‎breakpoint.py

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
#
2+
# PyDBG
3+
# Copyright (C) 2006 Pedram Amini <[email protected]>
4+
#
5+
# $Id: breakpoint.py 194 2007-04-05 15:31:53Z cameron $
6+
#
7+
# This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public
8+
# License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later
9+
# version.
10+
#
11+
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
12+
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
13+
#
14+
# You should have received a copy of the GNU General Public License along with this program; if not, write to the Free
15+
# Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
16+
#
17+
18+
'''
19+
@author: Pedram Amini
20+
@license: GNU General Public License 2.0 or later
21+
@contact: [email protected]
22+
@organization: www.openrce.org
23+
'''
24+
25+
class breakpoint:
26+
'''
27+
Soft breakpoint object.
28+
'''
29+
30+
address = None
31+
original_byte = None
32+
description = None
33+
restore = None
34+
handler = None
35+
36+
####################################################################################################################
37+
def __init__ (self, address=None, original_byte=None, description="", restore=True, handler=None):
38+
'''
39+
@type address: DWORD
40+
@param address: Address of breakpoint
41+
@type original_byte: Byte
42+
@param original_byte: Original byte stored at breakpoint address
43+
@type description: String
44+
@param description: (Optional) Description of breakpoint
45+
@type restore: Boolean
46+
@param restore: (Optional, def=True) Flag controlling whether or not to restore the breakpoint
47+
@type handler: Function Pointer
48+
@param handler: (Optional, def=None) Optional handler to call for this bp instead of the default handler
49+
'''
50+
51+
self.address = address
52+
self.original_byte = original_byte
53+
self.description = description
54+
self.restore = restore
55+
self.handler = handler

‎defines.py

+204
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
#
2+
# PyDBG
3+
# Copyright (C) 2006 Pedram Amini <[email protected]>
4+
#
5+
# $Id: defines.py 224 2007-10-12 19:51:45Z aportnoy $
6+
#
7+
# This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public
8+
# License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later
9+
# version.
10+
#
11+
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
12+
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
13+
#
14+
# You should have received a copy of the GNU General Public License along with this program; if not, write to the Free
15+
# Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
16+
#
17+
#
18+
# windows_h.py was generated with:
19+
#
20+
# c:\Python\Lib\site-packages\ctypes\wrap
21+
# c:\python\python h2xml.py windows.h -o windows.xml -q -c
22+
# c:\python\python xml2py.py windows.xml -s DEBUG_EVENT -s CONTEXT -s MEMORY_BASIC_INFORMATION -s LDT_ENTRY \
23+
# -s PROCESS_INFORMATION -s STARTUPINFO -s SYSTEM_INFO -o windows_h.py
24+
#
25+
# Then the import of ctypes was changed at the top of the file to utilize my_ctypes, which adds the necessary changes
26+
# to support the pickle-ing of our defined data structures and ctype primitives.
27+
#
28+
29+
'''
30+
@author: Pedram Amini
31+
@license: GNU General Public License 2.0 or later
32+
@contact: [email protected]
33+
@organization: www.openrce.org
34+
'''
35+
36+
from my_ctypes import *
37+
from windows_h import *
38+
39+
###
40+
### manually declare entities from Tlhelp32.h since i was unable to import using h2xml.py.
41+
###
42+
43+
TH32CS_SNAPHEAPLIST = 0x00000001
44+
TH32CS_SNAPPROCESS = 0x00000002
45+
TH32CS_SNAPTHREAD = 0x00000004
46+
TH32CS_SNAPMODULE = 0x00000008
47+
TH32CS_INHERIT = 0x80000000
48+
TH32CS_SNAPALL = (TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE)
49+
50+
class THREADENTRY32(Structure):
51+
_fields_ = [
52+
('dwSize', DWORD),
53+
('cntUsage', DWORD),
54+
('th32ThreadID', DWORD),
55+
('th32OwnerProcessID', DWORD),
56+
('tpBasePri', DWORD),
57+
('tpDeltaPri', DWORD),
58+
('dwFlags', DWORD),
59+
]
60+
61+
class PROCESSENTRY32(Structure):
62+
_fields_ = [
63+
('dwSize', DWORD),
64+
('cntUsage', DWORD),
65+
('th32ProcessID', DWORD),
66+
('th32DefaultHeapID', DWORD),
67+
('th32ModuleID', DWORD),
68+
('cntThreads', DWORD),
69+
('th32ParentProcessID', DWORD),
70+
('pcPriClassBase', DWORD),
71+
('dwFlags', DWORD),
72+
('szExeFile', CHAR * 260),
73+
]
74+
75+
class MODULEENTRY32(Structure):
76+
_fields_ = [
77+
("dwSize", DWORD),
78+
("th32ModuleID", DWORD),
79+
("th32ProcessID", DWORD),
80+
("GlblcntUsage", DWORD),
81+
("ProccntUsage", DWORD),
82+
("modBaseAddr", DWORD),
83+
("modBaseSize", DWORD),
84+
("hModule", DWORD),
85+
("szModule", CHAR * 256),
86+
("szExePath", CHAR * 260),
87+
]
88+
89+
class _MIB_TCPROW_OWNER_PID(Structure):
90+
_fields_ = [
91+
("dwState", DWORD),
92+
("dwLocalAddr", DWORD),
93+
("dwLocalPort", DWORD),
94+
("dwRemoteAddr", DWORD),
95+
("dwRemotePort", DWORD),
96+
("dwOwningPid", DWORD),
97+
]
98+
99+
class MIB_TCPTABLE_OWNER_PID(Structure):
100+
_fields_ = [
101+
("dwNumEntries", DWORD),
102+
("table", _MIB_TCPROW_OWNER_PID * 512)
103+
]
104+
105+
106+
class _MIB_UDPROW_OWNER_PID(Structure):
107+
_fields_ = [
108+
("dwLocalAddr", DWORD),
109+
("dwLocalPort", DWORD),
110+
("dwOwningPid", DWORD)
111+
]
112+
113+
class MIB_UDPTABLE_OWNER_PID(Structure):
114+
_fields_ = [
115+
("dwNumEntries", DWORD),
116+
("table", _MIB_UDPROW_OWNER_PID * 512)
117+
]
118+
119+
120+
###
121+
### manually declare various structures as needed.
122+
###
123+
124+
class SYSDBG_MSR(Structure):
125+
_fields_ = [
126+
("Address", c_ulong),
127+
("Data", c_ulonglong),
128+
]
129+
130+
###
131+
### manually declare various #define's as needed.
132+
###
133+
134+
# debug event codes.
135+
EXCEPTION_DEBUG_EVENT = 0x00000001
136+
CREATE_THREAD_DEBUG_EVENT = 0x00000002
137+
CREATE_PROCESS_DEBUG_EVENT = 0x00000003
138+
EXIT_THREAD_DEBUG_EVENT = 0x00000004
139+
EXIT_PROCESS_DEBUG_EVENT = 0x00000005
140+
LOAD_DLL_DEBUG_EVENT = 0x00000006
141+
UNLOAD_DLL_DEBUG_EVENT = 0x00000007
142+
OUTPUT_DEBUG_STRING_EVENT = 0x00000008
143+
RIP_EVENT = 0x00000009
144+
USER_CALLBACK_DEBUG_EVENT = 0xDEADBEEF # added for callback support in debug event loop.
145+
146+
# debug exception codes.
147+
EXCEPTION_ACCESS_VIOLATION = 0xC0000005
148+
EXCEPTION_BREAKPOINT = 0x80000003
149+
EXCEPTION_GUARD_PAGE = 0x80000001
150+
EXCEPTION_SINGLE_STEP = 0x80000004
151+
152+
# hw breakpoint conditions
153+
HW_ACCESS = 0x00000003
154+
HW_EXECUTE = 0x00000000
155+
HW_WRITE = 0x00000001
156+
157+
CONTEXT_CONTROL = 0x00010001
158+
CONTEXT_FULL = 0x00010007
159+
CONTEXT_DEBUG_REGISTERS = 0x00010010
160+
CREATE_NEW_CONSOLE = 0x00000010
161+
DBG_CONTINUE = 0x00010002
162+
DBG_EXCEPTION_NOT_HANDLED = 0x80010001
163+
DBG_EXCEPTION_HANDLED = 0x00010001
164+
DEBUG_PROCESS = 0x00000001
165+
DEBUG_ONLY_THIS_PROCESS = 0x00000002
166+
EFLAGS_RF = 0x00010000
167+
EFLAGS_TRAP = 0x00000100
168+
ERROR_NO_MORE_FILES = 0x00000012
169+
FILE_MAP_READ = 0x00000004
170+
FORMAT_MESSAGE_ALLOCATE_BUFFER = 0x00000100
171+
FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000
172+
INVALID_HANDLE_VALUE = 0xFFFFFFFF
173+
MEM_COMMIT = 0x00001000
174+
MEM_DECOMMIT = 0x00004000
175+
MEM_IMAGE = 0x01000000
176+
MEM_RELEASE = 0x00008000
177+
PAGE_NOACCESS = 0x00000001
178+
PAGE_READONLY = 0x00000002
179+
PAGE_READWRITE = 0x00000004
180+
PAGE_WRITECOPY = 0x00000008
181+
PAGE_EXECUTE = 0x00000010
182+
PAGE_EXECUTE_READ = 0x00000020
183+
PAGE_EXECUTE_READWRITE = 0x00000040
184+
PAGE_EXECUTE_WRITECOPY = 0x00000080
185+
PAGE_GUARD = 0x00000100
186+
PAGE_NOCACHE = 0x00000200
187+
PAGE_WRITECOMBINE = 0x00000400
188+
PROCESS_ALL_ACCESS = 0x001F0FFF
189+
SE_PRIVILEGE_ENABLED = 0x00000002
190+
SW_SHOW = 0x00000005
191+
THREAD_ALL_ACCESS = 0x001F03FF
192+
TOKEN_ADJUST_PRIVILEGES = 0x00000020
193+
UDP_TABLE_OWNER_PID = 0x00000001
194+
VIRTUAL_MEM = 0x00003000
195+
196+
# for NtSystemDebugControl()
197+
SysDbgReadMsr = 16
198+
SysDbgWriteMsr = 17
199+
200+
# for mapping TCP ports and PIDs
201+
AF_INET = 0x00000002
202+
AF_INET6 = 0x00000017
203+
MIB_TCP_STATE_LISTEN = 0x00000002
204+
TCP_TABLE_OWNER_PID_ALL = 0x00000005

‎hardware_breakpoint.py

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#
2+
# PyDBG
3+
# Copyright (C) 2006 Pedram Amini <[email protected]>
4+
#
5+
# $Id: hardware_breakpoint.py 194 2007-04-05 15:31:53Z cameron $
6+
#
7+
# This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public
8+
# License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later
9+
# version.
10+
#
11+
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
12+
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
13+
#
14+
# You should have received a copy of the GNU General Public License along with this program; if not, write to the Free
15+
# Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
16+
#
17+
18+
'''
19+
@author: Pedram Amini
20+
@license: GNU General Public License 2.0 or later
21+
@contact: [email protected]
22+
@organization: www.openrce.org
23+
'''
24+
25+
class hardware_breakpoint:
26+
'''
27+
Hardware breakpoint object.
28+
'''
29+
30+
address = None
31+
length = None
32+
condition = None
33+
description = None
34+
restore = None
35+
slot = None
36+
handler = None
37+
38+
####################################################################################################################
39+
def __init__ (self, address=None, length=0, condition="", description="", restore=True, slot=None, handler=None):
40+
'''
41+
42+
@type address: DWORD
43+
@param address: Address to set hardware breakpoint at
44+
@type length: Integer (1, 2 or 4)
45+
@param length: Size of hardware breakpoint (byte, word or dword)
46+
@type condition: Integer (HW_ACCESS, HW_WRITE, HW_EXECUTE)
47+
@param condition: Condition to set the hardware breakpoint to activate on
48+
@type description: String
49+
@param description: (Optional) Description of breakpoint
50+
@type restore: Boolean
51+
@param restore: (Optional, def=True) Flag controlling whether or not to restore the breakpoint
52+
@type slot: Integer (0-3)
53+
@param slot: (Optional, Def=None) Debug register slot this hardware breakpoint sits in.
54+
@type handler: Function Pointer
55+
@param handler: (Optional, def=None) Optional handler to call for this bp instead of the default handler
56+
'''
57+
58+
self.address = address
59+
self.length = length
60+
self.condition = condition
61+
self.description = description
62+
self.restore = restore
63+
self.slot = slot
64+
self.handler = handler

0 commit comments

Comments
 (0)