Package Libs :: Module libevent
[hide private]
[frames] | no frames]

Source Code for Module Libs.libevent

  1  #!/usr/bin/env python
 
  2  
 
  3  """
 
  4  (c) Immunity, Inc. 2004-2007
 
  5  
 
  6  
 
  7  U{Immunity Inc.<http://www.immunityinc.com>}
 
  8  
 
  9  
 
 10  
 
 11  """ 
 12  
 
 13  __VERSION__ = '1.0' 
 14  import debugger 
 15  
 
16 -class Event:
17 - def __init__( self, event ):
18 self.dwDebugEventCode = event[0][0] 19 self.dwProcessId = event[0][1] 20 self.dwThreadId = event[0][2] 21 self._GetValues(event)
22
23 - def isCreateProcess(self):
24 return self.dwDebugEventCode == debugger.CREATE_PROCESS_DEBUG_EVENT
25
26 - def isCreateThread(self):
27 return self.dwDebugEventCode == debugger.CREATE_THREAD_DEBUG_EVENT
28
29 - def isException(self):
30 return self.dwDebugEventCode == debugger.EXCEPTION_DEBUG_EVENT
31
32 - def isExitProcess(self):
33 return self.dwDebugEventCode == debugger.EXIT_PROCESS_DEBUG_EVENT
34
35 - def isExitThread(self):
36 return self.dwDebugEventCode == debugger.EXIT_THREAD_DEBUG_EVENT
37
38 - def isLoadDll(self):
39 return self.dwDebugEventCode == debugger.LOAD_DLL_DEBUG_EVENT
40
41 - def isOutputDebugString(self):
42 return self.dwDebugEventCode == debugger.OUTPUT_DEBUG_STRING_EVENT
43
44 - def isUnloadDll(self):
45 return self.dwDebugEventCode == debugger.UNLOAD_DLL_DEBUG_EVENT
46
47 - def isRipEvent(self):
48 return self.dwDebugEventCode == debugger.RIP_EVENT
49
50 - def _GetValues(self, event):
51 return
52
53 -class CreateProcessEvent(Event):
54 - def __init__(self, event):
55 Event.__init__(self, event)
56
57 - def _GetValues(self, event):
58 self.hFile = event[1][0] 59 self.hProcess = event[1][1] 60 self.hThread = event[1][2] 61 self.lpBaseOfImage = event[1][3] 62 self.dwDebugInfoFileOffset = event[1][4] 63 self.nDebugInfoSize = event[1][5] 64 self.lpThreadLocalBase = event[1][6] 65 self.lpStartAddress = event[1][7] 66 self.lpImageName = event[1][8] 67 self.fUnicode = event[1][9]
68
69 -class CreateThreadEvent(Event):
70 - def __init__(self, event):
71 Event.__init__(self, event)
72
73 - def _GetValues(self, event):
74 self.hThread = [1][0] 75 self.lpStartAddress = event[1][1] 76 self.lpThreadLocalBase = event[1][2]
77 78 EXCEPTION_CODE = {debugger.EXCEPTION_BREAKPOINT: "Breakpoint", 79 debugger.EXCEPTION_SINGLE_STEP:"SingleStep", 80 debugger.EXCEPTION_ACCESS_VIOLATION:"AccessViolation", 81 debugger.EXCEPTION_GUARD_PAGE: "GuardPage", 82 debugger.EXCEPTION_ARRAY_BOUNDS_EXCEEDED: "ArrayBoundsExceeded", 83 debugger.EXCEPTION_FLT_DENORMAL_OPERAND: "FltDenormalOperand", 84 debugger.EXCEPTION_FLT_DIVIDE_BY_ZERO: "FltDivideByZero", 85 debugger.EXCEPTION_FLT_INEXACT_RESULT: "FltInexactResult", 86 debugger.EXCEPTION_FLT_INVALID_OPERATION: "FltInvalidOperation", 87 debugger.EXCEPTION_FLT_OVERFLOW: "FltOverflow", 88 debugger.EXCEPTION_FLT_STACK_CHECK: "FltStackCheck", 89 debugger.EXCEPTION_FLT_UNDERFLOW: "FltUnderflow", 90 debugger.EXCEPTION_INT_DIVIDE_BY_ZERO: "IntDivideByZero", 91 debugger.EXCEPTION_INT_OVERFLOW: "IntOverflow", 92 debugger.EXCEPTION_PRIV_INSTRUCTION: "PrivInstruction", 93 debugger.EXCEPTION_ILLEGAL_INSTRUCTION: "IllegalInstruction", 94 debugger.EXCEPTION_NONCONTINUABLE_EXCEPTION: "NonContinuableException", 95 debugger.EXCEPTION_STACK_OVERFLOW: "StackOverflow" 96 } 97
98 -class ExceptionRecord:
99 - def __init__(self, er):
100 self.ExceptionCode = er [0] 101 self.ExceptionFlags = er [1] 102 self.ExceptionAddress = er [2] 103 self.NumberParameters = er [3] 104 self.ExceptionInformation = er [4] 105 self.ExceptionRecord = er [5]
106
108 return self.isAccessViolation() and self.ExceptionInformation[0] != 1 and self.ExceptionInformation[0] == self.ExceptionAddress
109
110 - def isAccessViolationOnWrite(self):
111 return self.isAccessViolation() and self.ExceptionInformation[0] == 1
112
113 - def isAccessViolationOnRead(self):
114 return self.isAccessViolation() and self.ExceptionInformation[0] != 1 and self.ExceptionInformation[0] != self.ExceptionAddress
115
116 - def isBreakpoint(self):
117 return self.ExceptionCode == debugger.EXCEPTION_BREAKPOINT
118
119 - def isSingleStep(self):
120 return self.ExceptionCode == debugger.EXCEPTION_SINGLE_STEP
121
122 - def isAccessViolation(self):
123 return self.ExceptionCode == debugger.EXCEPTION_ACCESS_VIOLATION
124
125 - def isGuardPage(self):
126 return self.ExceptionCode == debugger.EXCEPTION_GUARD_PAGE
127
128 - def isArrayBoundsExceeded(self):
129 return self.ExceptionCode == debugger.EXCEPTION_ARRAY_BOUNDS_EXCEEDED
130
131 - def isFltDenormalOperand(self):
132 return self.ExceptionCode == debugger.EXCEPTION_FLT_DENORMAL_OPERAND
133
134 - def isFltDivideByZero(self):
135 return self.ExceptionCode == debugger.EXCEPTION_FLT_DIVIDE_BY_ZERO
136
137 - def isFltInexactResult(self):
138 return self.ExceptionCode == debugger.EXCEPTION_FLT_INEXACT_RESULT
139
140 - def isFltInvalidOperation(self):
141 return self.ExceptionCode == debugger.EXCEPTION_FLT_INVALID_OPERATION
142
143 - def isFltOverflow(self):
144 return self.ExceptionCode == debugger.EXCEPTION_FLT_OVERFLOW
145
146 - def isFltStackCheck(self):
147 return self.ExceptionCode == debugger.EXCEPTION_FLT_STACK_CHECK
148
149 - def isFltUnderflow(self):
150 return self.ExceptionCode == debugger.EXCEPTION_FLT_UNDERFLOW
151
152 - def isIntDivideByZero(self):
153 return self.ExceptionCode == debugger.EXCEPTION_INT_DIVIDE_BY_ZERO
154
155 - def isIntOverflow(self):
156 return self.ExceptionCode == debugger.EXCEPTION_INT_OVERFLOW
157
158 - def isPrivInstruction(self):
159 return self.ExceptionCode == debugger.EXCEPTION_PRIV_INSTRUCTION
160
161 - def isIllegalInstruction(self):
162 return self.ExceptionCode == debugger.EXCEPTION_ILLEGAL_INSTRUCTION
163
165 return self.ExceptionCode == debugger.EXCEPTION_NONCONTINUABLE_EXCEPTION
166
167 - def isExceptionStackOverflow(self):
168 return self.ExceptionCode == debugger.EXCEPTION_STACK_OVERFLOW
169
170 - def getType(self):
171 try: 172 return EXCEPTION_CODE[self.ExceptionCode] 173 except KeyError: 174 return "UknownException"
175
176 - def __str__(self):
177 return self.getType()
178 179
180 -class ExceptionEvent(Event):
181 - def __init__(self, event):
182 Event.__init__(self, event)
183
184 - def _GetValues(self, event):
185 self.dwFirstChance = event[1][0] 186 self.Exception = [] 187 for er in range(1, len(event[1])): 188 self.Exception.append( ExceptionRecord(event[1][er]) )
189
190 -class ExitProcessEvent(Event):
191 - def __init__(self, event):
192 Event.__init__(self, event)
193
194 - def _GetValues(self, event):
195 self.dwExitCode = event[1][0]
196
197 -class ExitThreadEvent(Event):
198 - def __init__(self, event):
199 Event.__init__(self, event)
200
201 - def _GetValues(self, event):
202 self.dwExitCode = event[1][0]
203
204 -class LoadDLLEvent(Event):
205 - def __init__(self, event):
206 Event.__init__(self, event)
207
208 - def _GetValues(self, event):
209 self.hFile = event[1][0] 210 self.lpBaseOfDll = event[1][1] 211 self.dwDebugInfoFileOffset = event[1][2] 212 self.nDebugInfoSize = event[1][3] 213 self.lpImageName = event[1][4] 214 self.fUnicode = event[1][5]
215
216 -class OutputDebugEvent(Event):
217 - def __init__(self, event):
218 Event.__init__(self, event)
219
220 - def _GetValues(self, event):
221 self.lpDebugStringData = event[1][0] 222 self.fUnicode = event[1][1] 223 self.nDebugStringLength = event[1][2]
224
225 -class RIPEvent(Event):
226 - def __init__(self, event):
227 Event.__init__(self, event)
228
229 - def _GetValues(self, event):
230 self.dwError = event[1][0] 231 self.dwType = event[1][1]
232
233 -class UnloadDLLEvent(Event):
234 - def __init__(self, event):
235 Event.__init__(event)
236
237 - def _GetValues(self, event):
238 self.lpBaseOfDll = event[1][0]
239