@rtype: list of tuple( int, int ) @return: List of structured exception handlers. Each SEH is represented as a tuple of two addresses: - Address of this SEH block - Address of the SEH callback function Do not confuse this with
(self)
| 1021 | process.write_pointer(address, value) |
| 1022 | |
| 1023 | def get_seh_chain(self): |
| 1024 | """ |
| 1025 | @rtype: list of tuple( int, int ) |
| 1026 | @return: List of structured exception handlers. |
| 1027 | Each SEH is represented as a tuple of two addresses: |
| 1028 | - Address of this SEH block |
| 1029 | - Address of the SEH callback function |
| 1030 | Do not confuse this with the contents of the SEH block itself, |
| 1031 | where the first member is a pointer to the B{next} block instead. |
| 1032 | |
| 1033 | @raise NotImplementedError: |
| 1034 | This method is only supported in 32 bits versions of Windows. |
| 1035 | """ |
| 1036 | seh_chain = list() |
| 1037 | try: |
| 1038 | process = self.get_process() |
| 1039 | seh = self.get_seh_chain_pointer() |
| 1040 | while seh != 0xFFFFFFFF: |
| 1041 | seh_func = process.read_pointer(seh + 4) |
| 1042 | seh_chain.append((seh, seh_func)) |
| 1043 | seh = process.read_pointer(seh) |
| 1044 | except WindowsError: |
| 1045 | seh_chain.append((seh, None)) |
| 1046 | return seh_chain |
| 1047 | |
| 1048 | def get_wait_chain(self): |
| 1049 | """ |
nothing calls this directly
no test coverage detected