Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Python 3, 64 bits, added "utils" directory and pytext unit testing. #6

Open
wants to merge 15 commits into
base: master
Choose a base branch
from
Open
19 changes: 19 additions & 0 deletions .travis.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# Big Thank You to https://github.com/cclauss/Travis-CI-Python-on-three-OSes/blob/master/.travis.yml
language: python # this works for Linux but is an error on macOS or Windows
matrix:
include:
- name: "Python 3.7.5 on Windows"
os: windows # Windows 10.0.17134 N/A Build 17134
language: shell # 'language: python' is an error on Travis CI Windows
before_install:
# https://travis-ci.community/t/windows-python-pip-module-not-found/5480/4
- choco install python --version 3.7.5
- python -m pip install --upgrade pip
- python -m pip install pytest
env:
- PATH=/c/Python37:/c/Python37/Scripts:$PATH
install:
script:
- pwd
- pytest -v --durations=30 tests

16 changes: 16 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
PyDbg for Python 3 and 64 bits
==============================

This is a fork of Pedram Amini's [PyDbg](http://pedramamini.com/PaiMei/docs/) ([archived copy at OpenRCE](https://github.com/OpenRCE/pydbg)) which changes to make it run with Python 3 and on 64 machines.

Some files from [v-p-b/PyDbg](https://github.com/v-p-b/pydbg) are also used.

This is not entirely finished but most of Python 3 changes are done.
For 64 bits, and the general ideas of the changes are exposed:
- Print pointers with %016x instead of %08x.
- Do not really on default argtypes functions specifications used by ctypes.
- Different registers.

What works is the hooking of functions, and it is tested in the project [Survol](https://github.com/rchateauneu/survol).

An excellent introduction to PyDbg can be found in the book [Gray Hat Python](https://www.nostarch.com/ghpython.htm).
22 changes: 11 additions & 11 deletions __init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -37,14 +37,14 @@
"windows_h",
]

from breakpoint import *
from defines import *
from hardware_breakpoint import *
from memory_breakpoint import *
from memory_snapshot_block import *
from memory_snapshot_context import *
from pdx import *
from pydbg import *
from pydbg_client import *
from system_dll import *
from windows_h import *
from .breakpoint import *
from .defines import *
from .hardware_breakpoint import *
from .memory_breakpoint import *
from .memory_snapshot_block import *
from .memory_snapshot_context import *
from .pdx import *
from .pydbg import *
from .pydbg_client import *
from .system_dll import *
from .windows_h import *
11 changes: 5 additions & 6 deletions defines.py
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,7 @@
@organization: www.openrce.org
'''

from my_ctypes import *
from windows_h import *
from .windows_h import *

###
### manually declare entities from Tlhelp32.h since i was unable to import using h2xml.py.
Expand Down Expand Up @@ -79,11 +78,11 @@ class MODULEENTRY32(Structure):
("th32ProcessID", DWORD),
("GlblcntUsage", DWORD),
("ProccntUsage", DWORD),
("modBaseAddr", DWORD),
("modBaseAddr", POINTER(CHAR)),
("modBaseSize", DWORD),
("hModule", DWORD),
("szModule", CHAR * 256),
("szExePath", CHAR * 260),
("hModule", HANDLE),
("szModule", CHAR * 256), # MAX_MODULE_NAME32 + 1
("szExePath", CHAR * 260), # MAX_PATH
]

class _MIB_TCPROW_OWNER_PID(Structure):
Expand Down
3 changes: 1 addition & 2 deletions pdx.py
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,7 @@

import os.path

from my_ctypes import *
from defines import *
from .defines import *

# macos compatability.
try:
Expand Down
Loading