In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler:

def handler_breakpoint(mdbg):
  print "[+]Hit breakpoint"
  mdbg.set_register("EIP", 0)

This code works, but if I call mdbg.set_register("EIP", 0) (Note, outside the handler it would be dbg.set_register("EIP", 0)) from outside a break point handler it returns pdx: [6] GetThreadContext(): The handle is invalid. How could I write this?

  • What do you call "outside a breakpoint"? Either your program is not running and you cannot modify anything, or you program is launched and you have to stop at a breakpoint before being able to modify anything.
    – Dillinur
    Feb 7 '16 at 19:50

changing the registers without an event is fundamentally not possible rethink and reformulate your query

if you do not want to do it in break-point handler of any debugger you must suspend the process , Get the Thread's context and Set the thread's context and Resume the process

pydbg can do all this iirc in the script body out of break-point handler

EDIT Added a Sample Script

from pydbg import *
from pydbg.defines import *
def handler_breakpoint (pydbg):
    if pydbg.first_breakpoint:
        return DBG_CONTINUE
def handler_access_violation (pydbg):
    if pydbg.dbg.u.Exception.dwFirstChance:
        print "crashed and land here on FirstChance"
        print "crashed and land here on SecondChancee"

dbg = pydbg()
dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)
dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, handler_access_violation)
print "pid of calc.exe is = %d" % dbg.pid
for thread_id in dbg.enumerate_threads():
    thread_handle  = dbg.open_thread(thread_id)
    thread_context = dbg.get_thread_context(thread_handle)
    print "eax = 0x%08x" % thread_context.Eax
    thread_context = dbg.get_thread_context(thread_handle)
    print "new eax = 0x%08x" % thread_context.Eax
    print "yay we are going to crash now accessing random crap in eax"  


:\>python changereg.py
pid of calc.exe is = 1940
eax = 0x00b52d6c
new eax = 0xdeadbeef
yay we are going to crash now accessing random crap in eax
crashed and land here on FirstChance
crashed and land here on SecondChancee

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.