Handle CREATE_PROCESS_DEBUG_EVENT
(self, debug_event)
| 741 | return self.current_process.read_string(addr) + name_sufix |
| 742 | |
| 743 | def _handle_create_process(self, debug_event): |
| 744 | """Handle CREATE_PROCESS_DEBUG_EVENT""" |
| 745 | create_process = debug_event.u.CreateProcessInfo |
| 746 | # Duplicate handle, so garbage collection of the process/thread does not |
| 747 | # break the debug API invariant (those x_event handle are close by the debug API itself) |
| 748 | proc_handle = HANDLE() |
| 749 | thread_handle = HANDLE() |
| 750 | cp_handle = windows.current_process.handle |
| 751 | |
| 752 | winproxy.DuplicateHandle(cp_handle, create_process.hProcess, cp_handle, ctypes.byref(proc_handle), dwOptions=DUPLICATE_SAME_ACCESS) |
| 753 | winproxy.DuplicateHandle(cp_handle, create_process.hThread, cp_handle, ctypes.byref(thread_handle), dwOptions=DUPLICATE_SAME_ACCESS) |
| 754 | |
| 755 | dbgprint(" Got PROC handle {0:#x}".format(create_process.hProcess, self), "HANDLE") |
| 756 | dbgprint(" PROC handle duplicated: {0:#x}".format(proc_handle.value), "HANDLE") |
| 757 | |
| 758 | dbgprint(" Got THREAD handle {0:#x}".format(create_process.hThread, self), "HANDLE") |
| 759 | dbgprint(" THREAD handle duplicated: {0:#x}".format(thread_handle.value), "HANDLE") |
| 760 | |
| 761 | self.current_process = WinProcess._from_handle(proc_handle.value) |
| 762 | self.current_thread = WinThread._from_handle(thread_handle.value) |
| 763 | dbgprint("New process: {0}".format(self.current_process), "DBG") |
| 764 | |
| 765 | self.threads[self.current_thread.tid] = self.current_thread |
| 766 | self._explicit_single_step[self.current_thread.tid] = False |
| 767 | self._hardware_breakpoint[self.current_thread.tid] = {} |
| 768 | self._breakpoint_to_reput[self.current_thread.tid] = [] |
| 769 | self.processes[self.current_process.pid] = self.current_process |
| 770 | self._watched_pages[self.current_process.pid] = {} #defaultdict(list) |
| 771 | self.breakpoints[self.current_process.pid] = {} |
| 772 | self._memory_save[self.current_process.pid] = {} |
| 773 | self._module_by_process[self.current_process.pid] = {} |
| 774 | self._internal_on_create_process(create_process) # Allow hook for symbol-debugger |
| 775 | self._update_debugger_state(debug_event) |
| 776 | self._add_exe_to_module_list(create_process) |
| 777 | self._setup_pending_breakpoints_new_process(self.current_process) |
| 778 | self._setup_pending_breakpoints_new_thread(self.current_thread) |
| 779 | with self.DisabledMemoryBreakpoint(): |
| 780 | try: |
| 781 | return self.on_create_process(create_process) |
| 782 | finally: |
| 783 | if create_process.hFile: |
| 784 | winproxy.CloseHandle(create_process.hFile) |
| 785 | |
| 786 | def _handle_exit_process(self, debug_event): |
| 787 | """Handle EXIT_PROCESS_DEBUG_EVENT""" |
nothing calls this directly
no test coverage detected