2

How can I find the register value of another process at a specific address using python pydbg or any other module that can do that?

Lets say that:

Address               opcode
006122CB              mov eax, [ecx+08]

So, I want to find the value of the ecx register at this address.

Windows 7 x64 bit

Program x32 bit

  • 1
    The other question is about how to trace a function, but this one is about how to find the register value at a specific address. I dont think its a duplicate. – A.Sherif Apr 3 '14 at 10:43
  • I was to soon to act. Sorry – Stolas Apr 3 '14 at 13:15
  • Note that the function in which this instruction lives might be called many times in different contexts. So the value in ecx might be different every time this code is executed. – Jonathon Reinhart Apr 4 '14 at 14:04
4
:\>cat memaccess.py
from pydbg import *
from pydbg.defines import *

def handler_breakpoint (pydbg):
   if pydbg.first_breakpoint:
      return DBG_CONTINUE

   context = dbg.get_thread_context(dbg.h_thread)
   print "eip = %08x" % context.Eip
   print "edi = %08x" % context.Edi
   return DBG_CONTINUE

dbg = pydbg()
dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)
dbg.load("c:\\windows\\system32\\calc.exe")
dbg.bp_set(0x101248a)
dbg.resume_all_threads()
pydbg.debug_event_loop(dbg)

:\>python memaccess.py
eip = 0101248a
edi = 7c80b741

confirming with windbg

:>cdb -c "bp 0x101248a;g;r Edi;q" calc

0:000> cdb: Reading initial command 'bp 0x101248a;g;r Edi;q'

Breakpoint 0 hit
edi=7c80b741
quit:

:\>
| improve this answer | |
  • This worked really well, thanks alot!! can you tell me where can I learn more about pydbg so that I dont have to ask anymore questions? Thanks again. – A.Sherif Apr 3 '14 at 15:07
  • @Boody, I recommend 'Gray Hat Python'. It shows you how debuggers work by building a simple debugger in python and also has a dedicated chapter on pydbg. – shebaw Apr 9 '14 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.