1

I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to:

[*] Dumping registers for thread ID: 0x00000550
[**] EIP: 0x7c90eb94
[**] ESP: 0x0007fde0 
[**] EBP: 0x0007fdfc 
[**] EAX: 0x006ee208
[**] EBX: 0x00000000
[**] ECX: 0x0007fdd8 
[**] EDX: 0x7c90eb94 
[*] END DUMP
[*] Dumping registers for thread ID: 0x000005c0 
[**] EIP: 0x7c95077b
[**] ESP: 0x0094fff8 
[**] EBP: 0x00000000
[**] EAX: 0x00000000
[**] EBX: 0x00000001
[**] ECX: 0x00000002
[**] EDX: 0x00000003
[*] END DUMP

I need the register state of every thread running. There are several thread_context functions in PyDBG but I'm not sure how to use them to get that result. Thanks for any help!

0

:>wmic process get Name,ThreadCount,ProcessId | grep fire

firefox.exe                3944       49

:>cat dtregs.py

from pydbg import *
from pydbg.defines import *
def handler_breakpoint (pydbg):
  if pydbg.first_breakpoint:
    print "hello did i dump tid and eax for each thread ?"
    return DBG_CONTINUE
dbg = pydbg()
dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)
dbg.attach(3944)
i = 0;
for thread_id in dbg.enumerate_threads():
  thread_handle  = dbg.open_thread(thread_id)
  context = dbg.get_thread_context(thread_handle)
  print "%03d TID: %08x EAX: %08x" % (i,thread_handle,context.Eax)
  i = i+1
pydbg.debug_event_loop(dbg)
dbg.detach()

:>python dtregs.py

000 TID: 00000690 EAX: 00000000
001 TID: 0000068c EAX: 0158c385
002 TID: 00000688 EAX: 001b4008
003 TID: 00000684 EAX: 000000e5
004 TID: 00000680 EAX: 00000000
005 TID: 0000067c EAX: 001800a3
006 TID: 00000678 EAX: 00000000
007 TID: 00000674 EAX: 000000e5
...............................
048 TID: 000005d0 EAX: 77e76c7d
049 TID: 000005cc EAX: 00000000
hello did i dump tid and eax for each thread ?

just to confirm if it is right to a certain degree lets attach windbg to pid
:>cdb -p 3944
0:049> ~* e r eax

eax=09b6a201
eax=0158c385
eax=001b4008
eax=000000e5
eax=0036ee80
eax=00000171
eax=00000000
--------------
eax=098f3ec0
eax=000000e5
eax=150ff530
eax=11d5ff00
eax=111fff00
eax=77e76c7d
eax=7ffdd000
0:049> .detach
Detached
NoTarget> q
  • For anyone who wants to view additional registers, just add:print "%03d TID: %08x EAX: %08x" % (i,thread_handle,context.Ebx) Notice the Ebx. Replace that with the appropriate register. You can print multiple registers this way. – Starwarsfan2099 Jan 6 '16 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.