pydbg使用笔记

设有

dbg = pydbg()

1.如果要调试的是console类型的程序，则create_new_console=True

dbg.load(target, create_new_console=True)

 

2.关于bp_set的参数restore

如果restore=True,则每次中断后会再次设置断点，这样下次还会再被中断。

如果restore=False,则每次中断后不会再次设置断点，这样就只中断一次。

可以这么理解，因为调试器在中断以后会在设置断点的地址上设置回原来的执行代码，如果restore为True，则会在断点处理以后，把这个位置再restore int 3指令。

不能把restore参数理解成，是否把断点还原成原来代码的意思，这样就和实际意思相反。

heap_free_count = 0

def heap_free_handler(dbg):
    global printf_count
    heap_free_count += 1
    print "enter heap free handler ", heap_free_count
    
    return DBG_CONTINUE


def entry_point_handler(dbg):
    print "enter the entry point"

    #resolve the function address
    func_addr = dbg.func_resolve("KERNEL32.dll",  "HeapFree")
    
    #test the different between set restore=True to set restore=False
    if func_addr:
        dbg.bp_set(func_addr, restore=True, handler=heap_free_handler)
    else:
        print "resolve printf failed"
    
    return DBG_CONTINUE

def main():
    target = r"F:\MYPROJECTS\Ex15\Debug\Ex15.exe"
    
    pe = pefile.PE(target)
    dbg = pydbg()
    
    #if it's a console program, so set create_new_console = True
    dbg.load(target, create_new_console=True)
    
    #set a break point at the entry point
    entry_point = pe.OPTIONAL_HEADER.AddressOfEntryPoint + pe.OPTIONAL_HEADER.ImageBase
    dbg.bp_set(entry_point, handler=entry_point_handler)
        
    dbg.run()

当restore=True,则输出

enter the entry point
enter heap free handler  1
enter heap free handler  2
enter heap free handler  3

当restore=False,则输出

 

enter the entry pointenter heap free handler  1