1

I am using pykd to debug an application which loads a dll only when some condition is met. How do I set a breakpoint in the dll which has not loaded yet in pykd such that my handler gets the callback? Currently my code looks something like this

class ExceptionHandler(pykd.eventHandler):
    def __init__(self):
        pykd.eventHandler.__init__(self)

    def onException(self, exceptionInfo):
        return pykd.eventResult.NoChange

    def onBreakpoint(self, id):
        return pykd.eventResult.NoChange

    def onThreadStart(self):
        return pykd.eventResult.NoChange

    def onThreadStop(self):
        return pykd.eventResult.NoChange

    def onLoadModule(self, base, name):
        print "onLoadModule " + name
        # sys.stdout.flush()
        # if name == "test_module":
        #     # test_module = pykd.module("test_module")
        #     # test_module.reload()
        #     # pykd.setBp(test_module.offset('test_function'), breakCount)
        #     # print pykd.dbgCommand("bl")
        #     print pykd.dbgCommand('bp test_module!test_function "r;gc"')
        #     # print pykd.dbgCommand("bl")
        #     # print "Breakpoint Set %x" % (test_module.offset('test_function'))
        #     print "Breakpoint Set"
        return pykd.eventResult.NoChange

    def onUnloadModule(self, base, name):
        return pykd.eventResult.NoChange

pykd.initialize()
pykd.handler = ExceptionHandler()
pykd.startProcess("testmydelayedload.exe %s\\%s" % (os.getcwd(), sys.argv[1].strip()))
alloc_module = pykd.module("ntdll")
alloc_module.reload()
b0 = pykd.setBp(alloc_module.offset('RtlAllocateHeap')+0xe6, breakCount)
b1 = pykd.setBp(alloc_module.offset('RtlFreeHeap'), breakCount)
pykd.loadExt("C:\\Program Files\\Windows Kits\\10\\Debuggers\\x86\\winext\\ext.dll")
pykd.go()
pykd.killAllProcesses()

I have tried to manually set the breakpoint using pykd.dbgCommand but the callback is not triggered in that case. I tried to change the return value of onLoadModule to other than pykd.eventResult.NoChange while setting a bp. What am I missing?

  • Change bp to bu – Lieven Keersmaekers Dec 28 '17 at 8:43
  • @LievenKeersmaekers setting a bp with pykd.dbgCommand won't trigger the callback as I said. I want something which uses the pykd's api. – sudhackar Dec 28 '17 at 9:38
  • 1
    I just figured it out, the variable storing the bp should be global otherwise it won't work. – sudhackar Dec 28 '17 at 9:55
1

I just figured it out, the variable storing the bp should be global otherwise it won't work. It should be alive out of the class's context.

def onLoadModule(self, base, name):
        global test_function, test_module
        print "onLoadModule " + name
        if name == "jscript":
            test_module = pykd.module("jscript")
            test_module.reload()
            test_function = pykd.setBp(test_module.offset('test_function'), breakCount)
            print "Breakpoint Set %x" % (test_module.offset('test_function'))
        return pykd.eventResult.NoChange

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.