Directly on the code:
1.
my_debugger_defines.py
Define related structures (parameters are available when creating processes and returning information later)
1 fromcTYPESImport*2 #Let's map the Microsoft types to ctypes for clarity3word=C_ushort4dword=C_ulong5Lpbyte=POINTER (c_ubyte)6Lptstr=POINTER (C_char)7handle=c_void_p8 #Constants9debug_process=0x00000001TenCreate_new_console = 0x00000010 One #structures for CreateProcessA () function A classStartupinfo (Structure): -_fields_=[ -("CB", DWORD), the("lpreserved", LPTSTR), -("LpDesktop", LPTSTR), -("Lptitle", LPTSTR), -("DwX", DWORD), +("DwY", DWORD), -("dwxsize", DWORD), +("dwysize", DWORD), A("Dwxcountchars", DWORD), at("Dwycountchars", DWORD), -("DwFlags", DWORD), -("Wshowwindow", WORD), -("BcReserved2", WORD), -("LpReserved2", Lpbyte), -("hStdInput", HANDLE), in("Hstdoutput", HANDLE), -("Hstderror", HANDLE), to ] + - classprocess_information (Structure): the_fields_=[ *("hprocess", HANDLE), $("Hthread", HANDLE),Panax Notoginseng("Dwprocessid", DWORD), -("dwThreadID", DWORD), the]View Code
2, my_debugger.py
Defines a function that creates and tracks a process:
1 fromcTYPESImport*2 fromMy_debugger_definesImport*3 4Kernel32=Windll.kernel325 6 classDebugger ():7 def_init_ (self):8 Pass9 defLoad (self,path_to_exe):Ten #dwcreation flag determines how to create the process One #Set creation_flags = Create_new_console if you want A #To see the calculator GUI -Creation_flags =debug_process - thestartupinfo=Startupinfo () -process_information=process_information () - -startupinfo.dwflags=0x1 + Startupinfo.wshowwindow -startupinfo.cb=sizeof (STARTUPINFO) + A #The Win32API function creatprocess is used to create a new process and his main thread, at #This new process runs the specified executable file, specified by the first parameter - ifKernel32. CREATEPROCESSW (Path_to_exe,#should be CREATEPROCESSW, isn't CreateProcessA, it is UNICODE API - None, - None, - None, - None, in #Specifies the additional flags that are used to control the creation of priority classes and processes. - Creation_flags, to None, + None, - #This parameter points to a STARTUPINFO structure that determines how the main form of a new process is displayed. theByRef (Startupinfo),#ByRef () passed by address * #This parameter points to a process_information structure that is used to receive identifying information for the new process. $ByRef (Process_information)#Here's a question:Panax Notoginseng #How is the assignment between the structures? - #because the process_information defined here the #the number of parameters in Process_information is consistent in creatprocess + #and Startupinfo is inconsistent. A ): the Print("We have sucessfully lunched the process") + Print("pid:%d"%process_information.dwprocessid) - $ Else: $ Print("error:0x%08x."%KERNEL32. GetLastError ()) - View Code
To try, call the function:
1 Import My_debugger 2 3 debugger=my_debugger.debugger ()45 debugger.load ("C:\Windows\ System32\calc.exe")
View Code
Problem:
#结构体之间的赋值是如何进行的? By order?
#这里自己定义的process_information结构体跟
Do #win32函数中creatprocess中process_information的成员数量 and locations have to be the same?
#好像也不是这样, because I process_information is consistent, the success of the communication, and I startupinfo inconsistent, also succeeded.
About creatprocess in the Win32 function Process_information, startupinfo see http://baike.baidu.com/view/2421585.htm
Beginner ctypes: Open process and return related information