Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

problem in accessing callback_args in callback function. #9

Open
saurabhsha opened this issue Dec 13, 2016 · 4 comments
Open

problem in accessing callback_args in callback function. #9

saurabhsha opened this issue Dec 13, 2016 · 4 comments

Comments

@saurabhsha
Copy link

from x64dbgpy.__breakpoints import *
bp = Breakpoint()
bp.add(address,func_callback,bp_type=NORMAL,hw_type=EXECUTE,callback_args=(param1,param2,param3))

def func_callback(*callback_args):
print callback_args

getting empty tuple.callback_args = ()

@saurabhsha
Copy link
Author

saurabhsha commented Dec 14, 2016

def __breakpoint_function(self, **kwargs):
print 'kwargs:',kwargs
address = kwargs['addr']
if address in self.__breakpoints:
if not (kwargs['enabled'] and kwargs['active']):
return
arg_keys = self.__breakpoints[address]['callback_args']
self.__breakpoints[address]['callback'](
**{key: value for key, value in kwargs.iteritems() if key in arg_keys}
)

kwargs does not have callback_args key -

kwargs: {'slot': 0, 'addr': 5355082858L, 'enabled': True, 'singleshoot': False, 'active': True, 'mod': 'jugsofbeer.exe', 'type': 1, 'name': ''}

__breakpoint dict has callback_args entry for added breakpoint -
{5355082858L: {'callback': <bound method ApiDump.breakPointcallbackRet of <main.ApiDump instance at 0x0000000009D98EC8>>, 'type': 1, 'callback_args': ('GetDlgItemTextW', {}, {2: [u'lpString', u'LPSTR', 0]})}

Breakpoint added at return address 5355082858.
INT3 breakpoint at jugsofbeer.000000013F30146A (000000013F30146A)!
defaultdict(<type 'dict'>, {5355082858L: {'callback': <bound method ApiDump.breakPointcallbackRet of <main.ApiDump instance at 0x0000000009D98EC8>>, 'type': 1, 'callback_args': ('GetDlgItemTextW', {}, {2: [u'lpString', u'LPSTR', 0]})}, 2001397788L: {'callback': <bound method ApiDump.breakPointcallback of <main.ApiDump instance at 0x0000000009D98EC8>>, 'type': 1, 'callback_args': ()}, 8791760783408L: {'callback': <bound method ApiDump.breakPointcallback of <main.ApiDump instance at 0x0000000009D98EC8>>, 'type': 1, 'callback_args': ()}})

@realgam3
Copy link
Collaborator

Please Look At the following example of implementation:
https://raw.githubusercontent.com/realgam3/ReversingAutomation/master/X64dbgPy/Ollydbg2-Playtime%20-%20Digital%20Whisper%20Example/AntiDebugging.py

Breakpoint should be used only as a global array (It's a Singleton).

Little information about Breapoint object:

filter(lambda x: '__' not in x, dir(Breakpoint)):
['BP_HARDWARE', 'BP_MEMORY', 'BP_NONE', 'BP_NORMAL', 'HW_ACCESS', 'HW_EXECUTE', 'HW_WRITE', 'add', 'disable', 'enable', 'list', 'remove']

help(Breakpoint.add):
Breakpoint.add(self, address, callback, bp_type=Breakpoint.BP_NORMAL, hw_type=Breakpoint.HW_EXECUTE, callback_args=())

@saurabhsha
Copy link
Author

can you help me with example where callback_args = (arg1,arg2,arg3) is passed?
i am not able to access the passed callback_args in callback function set while adding breakpoint.
All i am getting is empty tuple.

@realgam3
Copy link
Collaborator

def is_debugger_present_callback(addr, name):
print addr, name

Breakpoint.add(
pluginsdk.RemoteGetProcAddress('kernel32', 'IsDebuggerPresent'),
is_debugger_present_callback,
callback_args=['addr', 'name']
)

  • Its experimental (It's purpose is to get only the arguments that you need and not all the arguments):
    pyCallback("breakpoint", Py_BuildValue(
    "{s:i, s:N, s:N, s:N, s:N, s:s, s:s, s:i}",
    "type", breakpoint->type,
    "addr", PyInt_FromSize_t(breakpoint->addr),
    "enabled", PyBool_FromLong(breakpoint->enabled),
    "singleshoot", PyBool_FromLong(breakpoint->singleshoot),
    "active", PyBool_FromLong(breakpoint->active),
    "mod", breakpoint->mod,
    "name", breakpoint->name,
    "slot", breakpoint->slot
    ));

instead of creating a callback that get **kwargs or all those keys (type, addr, enabled, singleshoot, active, mod, name, slot), you can choose what args you will get.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants