How can I find the register value of another process at a specific address using python pydbg or any other module that can do that?

Lets say that:

Address               opcode
006122CB              mov eax, [ecx+08]

So, I want to find the value of the ecx register at this address.

Windows 7 x64 bit

Program x32 bit

  • 1
    The other question is about how to trace a function, but this one is about how to find the register value at a specific address. I dont think its a duplicate.
    – A.Sherif
    Commented Apr 3, 2014 at 10:43
  • I was to soon to act. Sorry
    – Stolas
    Commented Apr 3, 2014 at 13:15
  • Note that the function in which this instruction lives might be called many times in different contexts. So the value in ecx might be different every time this code is executed. Commented Apr 4, 2014 at 14:04

1 Answer 1

:\>cat memaccess.py
from pydbg import *
from pydbg.defines import *

def handler_breakpoint (pydbg):
   if pydbg.first_breakpoint:
      return DBG_CONTINUE

   context = dbg.get_thread_context(dbg.h_thread)
   print "eip = %08x" % context.Eip
   print "edi = %08x" % context.Edi
   return DBG_CONTINUE

dbg = pydbg()
dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)

:\>python memaccess.py
eip = 0101248a
edi = 7c80b741

confirming with windbg

:>cdb -c "bp 0x101248a;g;r Edi;q" calc

0:000> cdb: Reading initial command 'bp 0x101248a;g;r Edi;q'

Breakpoint 0 hit

  • This worked really well, thanks alot!! can you tell me where can I learn more about pydbg so that I dont have to ask anymore questions? Thanks again.
    – A.Sherif
    Commented Apr 3, 2014 at 15:07
  • @Boody, I recommend 'Gray Hat Python'. It shows you how debuggers work by building a simple debugger in python and also has a dedicated chapter on pydbg.
    – shebaw
    Commented Apr 9, 2014 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.