1

In pydbg, is it possible to set a register without having it hit a break point first? Consider the following example break point handler:

def handler_breakpoint(mdbg):
  print "[+]Hit breakpoint"
  mdbg.set_register("EIP", 0)
  return DBG_CONTINUE

This code works, but if I call mdbg.set_register("EIP", 0) (Note, outside the handler it would be dbg.set_register("EIP", 0)) from outside a break point handler it returns pdx: [6] GetThreadContext(): The handle is invalid. How could I write this?

  • What do you call "outside a breakpoint"? Either your program is not running and you cannot modify anything, or you program is launched and you have to stop at a breakpoint before being able to modify anything. – Dillinur Feb 7 '16 at 19:50
0

changing the registers without an event is fundamentally not possible rethink and reformulate your query

if you do not want to do it in break-point handler of any debugger you must suspend the process , Get the Thread's context and Set the thread's context and Resume the process

pydbg can do all this iirc in the script body out of break-point handler

EDIT Added a Sample Script

from pydbg import *
from pydbg.defines import *
def handler_breakpoint (pydbg):
    if pydbg.first_breakpoint:
        return DBG_CONTINUE
def handler_access_violation (pydbg):
    if pydbg.dbg.u.Exception.dwFirstChance:
        print "crashed and land here on FirstChance"
    else:
        print "crashed and land here on SecondChancee"
    return DBG_EXCEPTION_NOT_HANDLED

dbg = pydbg()
dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)
dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, handler_access_violation)
dbg.load("c:\windows\system32\calc.exe")
print "pid of calc.exe is = %d" % dbg.pid
dbg.suspend_all_threads()
for thread_id in dbg.enumerate_threads():
    thread_handle  = dbg.open_thread(thread_id)
    thread_context = dbg.get_thread_context(thread_handle)
    print "eax = 0x%08x" % thread_context.Eax
    thread_context.Eax=0xdeadbeef
    dbg.set_thread_context(thread_context,0,thread_id)
    thread_context = dbg.get_thread_context(thread_handle)
    print "new eax = 0x%08x" % thread_context.Eax
    print "yay we are going to crash now accessing random crap in eax"  
dbg.resume_all_threads()
pydbg.debug_event_loop(dbg)

executed

:\>python changereg.py
pid of calc.exe is = 1940
eax = 0x00b52d6c
new eax = 0xdeadbeef
yay we are going to crash now accessing random crap in eax
crashed and land here on FirstChance
crashed and land here on SecondChancee

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.