MCPcopy Create free account
hub / github.com/ELMERIKH/PyinMemoryPE / _resolve

Method _resolve

windows/debug/debugger.py:236–266  ·  view source on GitHub ↗
(self, addr, target)

Source from the content-addressed store, hash-verified

234 return x
235
236 def _resolve(self, addr, target):
237 dbgprint("Resolving <{0}> in <{1}>".format(addr, target), "DBG")
238 if not isinstance(addr, basestring):
239 return addr
240 dll, api = addr.split("!")
241 dll = dll.lower()
242 modules = self._module_by_process[target.pid]
243 mod = None
244 if dll in modules:
245 mod = [modules[dll]]
246 if not mod:
247 return None
248 # TODO: optim exports are the same for whole system (32 vs 64 bits)
249 # I don't have to reparse the exports each time..
250 # Try to interpret api as an int
251 try:
252 api_int = int(api, 0)
253 return mod[0].baseaddr + api_int
254 except ValueError:
255 pass
256 exports = mod[0].exports
257 if api not in exports:
258 dbgprint("Error resolving <{0}> in <{1}>".format(addr, target), "DBG")
259 raise ValueError("Unknown API <{0}> in DLL {1}".format(api, dll))
260 target_addr = exports[api]
261 if isinstance(target_addr, basestring):
262 target_string = target_addr.replace(".", "!")
263 dbgprint("<{0}> is export proxy to <{1}>".format(addr, target_string), "DBG")
264 # Possible infinite loop ?
265 return self._resolve(target_string, target)
266 return target_addr
267
268 def add_pending_breakpoint(self, bp, target):
269 self._pending_breakpoints_new[target].append(bp)

Callers 5

_setup_breakpoint_BPMethod · 0.95
_remove_breakpoint_BPMethod · 0.95

Calls

no outgoing calls

Tested by

no test coverage detected