码迷,mamicode.com
首页 > 其他好文 > 详细

pydebugger

时间:2016-06-26 16:34:19      阅读:173      评论:0      收藏:0      [点我收藏+]

标签:

定义结构体
from ctypes import *

WORD = c_ushort
DWORD = c_ulong
LPBYTE =  POINTER(c_ubyte)
LPTSTR = POINTER(c_char)
HANDLE = c_void_p

DEBUG_PROCESS = 0x00000001
CREATE_NEW_CONSOLE = 0x00000010

class STARTUPINFO(Structure):
    _fields_ = [
        ("cb", DWORD),
        ("lpReserved", LPTSTR),
        ("lpDesktop", LPTSTR),
        ("lpTitle", LPTSTR),
        ("dwX", DWORD),
        ("dwY", DWORD),
        ("dwXSize", DWORD),
        ("dwYSize", DWORD),
        ("dwXCountChars", DWORD),
        ("dwYCountChars", DWORD),
        ("dwFillAttribute", DWORD),
        ("dwFlags", DWORD),
        ("wShowWindow", WORD),
        (cbReserved2, WORD),
        (lpReserved2, LPBYTE),
        (hStdInput, HANDLE),
        (hStdOutput, HANDLE),
        (hStdError, HANDLE),
    ]

class PROCESS_INFORMATION(Structure):
    _fields_ = [
        ("hProcess", HANDLE),
        (hThread, HANDLE),
        (dwProcessId, DWORD),
        (dwThreadId, DWORD),
    ]
debugger对象
from ctypes import *
from my_debugger_defines import *

kernel32 = windll.kernel32

class debugger():
    def __init__(self):
        pass

    def load(self, path_to_exe):
        creation_flags = DEBUG_PROCESS

        startupinfo = STARTUPINFO()
        process_information = PROCESS_INFORMATION()

        startupinfo.dwFlags = 0x1
        startupinfo.wShowWindow = 0x0
        startupinfo.cb = sizeof(startupinfo)

        if kernel32.CreateProcessA(path_to_exe,
            None,
            None,
            None,
            None,
            creation_flags,
            None,
            None,
            byref(startupinfo),
            byref(process_information)):
            print "[*]we have successfully launched the process!"
            print "[*]PID:%d" % process_information.dwProcessId
        else:
            print "[*]Error: 0x%08x." % kernel32.GetLastError()
测试代码
import my_debugger

debugger = my_debugger.debugger()
debugger.load("C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.10586.0_none_409843e5f973ed29\calc.exe")

 

pydebugger

标签:

原文地址:http://www.cnblogs.com/hq2005001/p/5618003.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!