I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious.
Basically, I want to suspend all threads, then start single stepping in one thread. In my case, there are two threds.
First, I suspend all threads. Then, I set a breakpoint on the location where EIP will be when thread 2 is resumed. (This location is confirmed by using IDA). Then, I enable single-stepping as I would in any other context, and resume Thread 2.
However, pydbg doesn't seem to catch the breakpoint exception! Thread 2 seems to resume and even though it MUST hit that address, there is no indication that pydbg is catching the breakpoint exception. I included a "print "HIT BREAKPOINT" inside pydbg's internal breakpoint handler, and that never seems to be called after resuming Thread 2.
I'm not too sure about where to go next, so any suggestions are appreciated!
dbg.suspend_all_threads() print dbg.enumerate_threads() oldcontext = dbg.get_thread_context(thread_id=dbg.enumerate_threads()) if (dbg.disasm(oldcontext.Eip) == "ret"): print disasm_at(dbg,oldcontext.Eip) print "Thread EIP at a ret" addrstr = int("0x"+(dbg.read(oldcontext.Esp + 4,4))[::-1].encode("hex"),16) print hex(addrstr) dbg.bp_set(0x7C90D21A,handler=Thread_Start_bp_Handler) print dbg.read(0x7C90D21A,1).encode("hex") dbg.bp_set(oldcontext.Eip + dbg.instruction.length,handler=Thread_Start_bp_Handler) dbg.set_thread_context(oldcontext,thread_id=dbg.enumerate_threads()) dbg.context = oldcontext dbg.resume_thread(dbg.enumerate_threads()) dbg.single_step(enable=True) return DBG_CONTINUE
Sorry about the "magic numbers", but they are correct as far as I can tell.