Enables the code breakpoint at the given address for only one shot. @see: L{define_code_breakpoint}, L{has_c

:return: True if it should be excluded, False if it should be included and None if no rule matched the given file.

@rtype: bool, function @return: Returns the condition callback for conditional breakpoints. Returns C{True} for uncondit

@rtype: int @return: Number of processes being debugged.

@rtype: int @return: Value of the frame pointer register.

returns internal command queue for a given thread. if new queue is created, notify the RDB about it

@type lpBaseOfDll: int @param lpBaseOfDll: Base address of the DLL to look for. @rtype: L{Module} @return: Module

@rtype: int @return: Base address for the newly loaded DLL.

Returns a copy of the PEB. To dereference pointers in it call L{Process.read_structure}. @rtype: L{win32.PEB} @retu

@rtype: int @return: Parent process global ID. @raise WindowsError: An error occured when calling a Win32 API function.

@rtype: int @return: Global ID of the process that owns this window.

@rtype: L{Process} @return: Parent Process object. Returns C{None} if unknown.

@rtype: int @return: Global ID of the thread that owns this window.

@type key: L{Crash} key. @param key: Key to find. @rtype: bool @return: C{True} if the key is present in the set o

@type dwThreadId: int @param dwThreadId: Global ID of the thread to look for. @rtype: bool @return: C{True} if the

Dump a block of hexadecimal numbers from binary data. Also show a printable text version of the data. @type data: str

Dump a line of hexadecimal numbers from binary data. @type data: str @param data: Binary data. @type separator: s

Notify a breakpoint that it's been hit. This triggers the corresponding state transition and sets the C{breakpoint} property

Determine if we're in hostile mode (anti-anti-debug). @rtype: bool @return: C{True} if this C{Debug} instance was started i

@rtype: bool @return: C{True} if the process is currently running.

@rtype: bool @return: C{True} if all pages in this region are executable. @note: Executable pages are always readable.

@rtype: bool @return: C{True} if the memory in this region is reserved.

Alias of L{signature}. Deprecated since WinAppDbg 1.5.

Terminates the execution of the process. @raise WindowsError: On error an exception is raised.

Return which API is loaded, if any If this returns anything besides None, importing any other Qt binding is unsafe. Returns -------

The columns internally are actually based on bytes. Also, the position isn't always the ideal one as the start may not be wh

@rtype: bool @return: C{True} if the given name could refer to this module. It may not be exactly the same r

Set memory protection in the address space of the process. @see: U{http://msdn.microsoft.com/en-us/library/aa366899.aspx} @

Creates a label from a module and a function name, plus an offset. @warning: This method only creates the label, it doesn't make sur

Reads a pointer value from the memory of the process. @see: L{read_pointer} @type lpBaseAddress: int @param lpBase

Removes all the breakpoints from a given file or from all files if received_filename == '*'. :param str received_filename:

Transition to L{RUNNING} state. - When hit: Enabled S{->} Running @type aProcess: L{Process} @param aProcess: Pro

Called to run a new tasklet: rebind the creation so that we can trace it.

Convert a structure into a Python dictionary.

GetBuiltinName */