Skip to content

Python module for Windbg's dbgeng plus additional wrappers.

License

Notifications You must be signed in to change notification settings

dshikashio/Pybag

Repository files navigation

Pybag

Python bindings for Microsoft DbgEng

Pybag provides helper functions on top of Python bindings for Microsoft Debug Engine to facilitate Windows native debugging.

Build Master

Installation

Windows:

python setup.py install

Usage example

Use Python's repl as a command shell if desired. Ctrl-c will break-in to the debugger if you are in a wait() call.

Local user debugging

from pybag import *

def handler(bp, dbg):
    print("*********** BREAK")
    return DbgEng.DEBUG_STATUS_GO

dbg = UserDbg()
dbg.create("notepad.exe")
dbg.bp("Kernel32!WriteFile", handler)
dbg.go()

Remote user debugging

from pybag import *

def handler(bp, dbg):
    print("*********** BREAK")
    return DbgEng.DEBUG_STATUS_GO

dbg = UserDbg()
d.connect("tcp:server=192.168.1.10,port=5555")
dbg.create("notepad.exe")
dbg.bp("Kernel32!WriteFile", handler)
dbg.go()

Remote kernel debugging

from pybag import *

k = KernelDbg()
k.attach("net:port=50000,key=1.2.3.4")

Release History

  • 2.2.12
    • Fix #22 - comtypes issue
  • 2.2.11
    • Fix #18 - Fix SetImplicitProcessDataOffset
    • Fix #19 - Implement CreateProcess2
  • 2.2.10
    • Better search for Windbg DLLs using registry and allowing user override
  • 2.2.9
    • Add implementations of GetCurrentThreadSystemId and GetProcessIdsByIndex
  • 2.2.8
    • Fixed missing files install issue
  • 2.2.7
    • Fixed access violation when using oneshot breakpoints
    • Added 'count' option to breakpoints
  • 2.2.6
    • Added support for more dbgeng calls
      • Symbol handling
      • Set / get thread contexts
    • Fixed ds command
  • 2.2.5
    • Fixed be command
    • Better search for Windbg install (and DLLs)
  • 2.2.4
    • Fixed lint issues
  • 2.2.3
    • Bug fix in WriteVirtual
  • 2.2.2
    • Python bindings rewritten to use comtypes
    • Moved to Python 3
    • Support multiple debugging uses
      • Local user debugging
      • Remote kernel debugging
      • Remote user debugging using dbgsrv

Meta

Distributed under the MIT license. See LICENSE for more information.

https://github.com/dshikashio