Package Libs ::
Module libevent
|
|
1
2
3 """
4 (c) Immunity, Inc. 2004-2007
5
6
7 U{Immunity Inc.<http://www.immunityinc.com>}
8
9
10
11 """
12
13 __VERSION__ = '1.0'
14 import debugger
15
18 self.dwDebugEventCode = event[0][0]
19 self.dwProcessId = event[0][1]
20 self.dwThreadId = event[0][2]
21 self._GetValues(event)
22
24 return self.dwDebugEventCode == debugger.CREATE_PROCESS_DEBUG_EVENT
25
27 return self.dwDebugEventCode == debugger.CREATE_THREAD_DEBUG_EVENT
28
30 return self.dwDebugEventCode == debugger.EXCEPTION_DEBUG_EVENT
31
33 return self.dwDebugEventCode == debugger.EXIT_PROCESS_DEBUG_EVENT
34
36 return self.dwDebugEventCode == debugger.EXIT_THREAD_DEBUG_EVENT
37
39 return self.dwDebugEventCode == debugger.LOAD_DLL_DEBUG_EVENT
40
42 return self.dwDebugEventCode == debugger.OUTPUT_DEBUG_STRING_EVENT
43
45 return self.dwDebugEventCode == debugger.UNLOAD_DLL_DEBUG_EVENT
46
48 return self.dwDebugEventCode == debugger.RIP_EVENT
49
52
56
58 self.hFile = event[1][0]
59 self.hProcess = event[1][1]
60 self.hThread = event[1][2]
61 self.lpBaseOfImage = event[1][3]
62 self.dwDebugInfoFileOffset = event[1][4]
63 self.nDebugInfoSize = event[1][5]
64 self.lpThreadLocalBase = event[1][6]
65 self.lpStartAddress = event[1][7]
66 self.lpImageName = event[1][8]
67 self.fUnicode = event[1][9]
68
72
74 self.hThread = [1][0]
75 self.lpStartAddress = event[1][1]
76 self.lpThreadLocalBase = event[1][2]
77
78 EXCEPTION_CODE = {debugger.EXCEPTION_BREAKPOINT: "Breakpoint",
79 debugger.EXCEPTION_SINGLE_STEP:"SingleStep",
80 debugger.EXCEPTION_ACCESS_VIOLATION:"AccessViolation",
81 debugger.EXCEPTION_GUARD_PAGE: "GuardPage",
82 debugger.EXCEPTION_ARRAY_BOUNDS_EXCEEDED: "ArrayBoundsExceeded",
83 debugger.EXCEPTION_FLT_DENORMAL_OPERAND: "FltDenormalOperand",
84 debugger.EXCEPTION_FLT_DIVIDE_BY_ZERO: "FltDivideByZero",
85 debugger.EXCEPTION_FLT_INEXACT_RESULT: "FltInexactResult",
86 debugger.EXCEPTION_FLT_INVALID_OPERATION: "FltInvalidOperation",
87 debugger.EXCEPTION_FLT_OVERFLOW: "FltOverflow",
88 debugger.EXCEPTION_FLT_STACK_CHECK: "FltStackCheck",
89 debugger.EXCEPTION_FLT_UNDERFLOW: "FltUnderflow",
90 debugger.EXCEPTION_INT_DIVIDE_BY_ZERO: "IntDivideByZero",
91 debugger.EXCEPTION_INT_OVERFLOW: "IntOverflow",
92 debugger.EXCEPTION_PRIV_INSTRUCTION: "PrivInstruction",
93 debugger.EXCEPTION_ILLEGAL_INSTRUCTION: "IllegalInstruction",
94 debugger.EXCEPTION_NONCONTINUABLE_EXCEPTION: "NonContinuableException",
95 debugger.EXCEPTION_STACK_OVERFLOW: "StackOverflow"
96 }
97
100 self.ExceptionCode = er [0]
101 self.ExceptionFlags = er [1]
102 self.ExceptionAddress = er [2]
103 self.NumberParameters = er [3]
104 self.ExceptionInformation = er [4]
105 self.ExceptionRecord = er [5]
106
108 return self.isAccessViolation() and self.ExceptionInformation[0] != 1 and self.ExceptionInformation[0] == self.ExceptionAddress
109
112
114 return self.isAccessViolation() and self.ExceptionInformation[0] != 1 and self.ExceptionInformation[0] != self.ExceptionAddress
115
117 return self.ExceptionCode == debugger.EXCEPTION_BREAKPOINT
118
120 return self.ExceptionCode == debugger.EXCEPTION_SINGLE_STEP
121
123 return self.ExceptionCode == debugger.EXCEPTION_ACCESS_VIOLATION
124
125 - def isGuardPage(self):
126 return self.ExceptionCode == debugger.EXCEPTION_GUARD_PAGE
127
129 return self.ExceptionCode == debugger.EXCEPTION_ARRAY_BOUNDS_EXCEEDED
130
132 return self.ExceptionCode == debugger.EXCEPTION_FLT_DENORMAL_OPERAND
133
135 return self.ExceptionCode == debugger.EXCEPTION_FLT_DIVIDE_BY_ZERO
136
138 return self.ExceptionCode == debugger.EXCEPTION_FLT_INEXACT_RESULT
139
141 return self.ExceptionCode == debugger.EXCEPTION_FLT_INVALID_OPERATION
142
144 return self.ExceptionCode == debugger.EXCEPTION_FLT_OVERFLOW
145
147 return self.ExceptionCode == debugger.EXCEPTION_FLT_STACK_CHECK
148
150 return self.ExceptionCode == debugger.EXCEPTION_FLT_UNDERFLOW
151
153 return self.ExceptionCode == debugger.EXCEPTION_INT_DIVIDE_BY_ZERO
154
156 return self.ExceptionCode == debugger.EXCEPTION_INT_OVERFLOW
157
159 return self.ExceptionCode == debugger.EXCEPTION_PRIV_INSTRUCTION
160
162 return self.ExceptionCode == debugger.EXCEPTION_ILLEGAL_INSTRUCTION
163
165 return self.ExceptionCode == debugger.EXCEPTION_NONCONTINUABLE_EXCEPTION
166
168 return self.ExceptionCode == debugger.EXCEPTION_STACK_OVERFLOW
169
171 try:
172 return EXCEPTION_CODE[self.ExceptionCode]
173 except KeyError:
174 return "UknownException"
175
178
179
183
185 self.dwFirstChance = event[1][0]
186 self.Exception = []
187 for er in range(1, len(event[1])):
188 self.Exception.append( ExceptionRecord(event[1][er]) )
189
193
195 self.dwExitCode = event[1][0]
196
200
202 self.dwExitCode = event[1][0]
203
207
209 self.hFile = event[1][0]
210 self.lpBaseOfDll = event[1][1]
211 self.dwDebugInfoFileOffset = event[1][2]
212 self.nDebugInfoSize = event[1][3]
213 self.lpImageName = event[1][4]
214 self.fUnicode = event[1][5]
215
219
221 self.lpDebugStringData = event[1][0]
222 self.fUnicode = event[1][1]
223 self.nDebugStringLength = event[1][2]
224
228
230 self.dwError = event[1][0]
231 self.dwType = event[1][1]
232
236
238 self.lpBaseOfDll = event[1][0]
239