Class Process

x.__init__(...) initializes x; see help(type(x)) for signature

Parameters:

• dwProcessId (int) - Global process ID.
• hProcess (ProcessHandle) - Handle to the process.
• fileName (str) - (Optional) Filename of the main module.

Overrides: object.__init__

Returns: int

Process global ID.

Returns: str

Filename of the main module of the process.

Opens a new handle to the process.

The new handle is stored in the hProcess property.

Parameters:

• dwDesiredAccess (int) - Desired access rights. Defaults to win32.PROCESS_ALL_ACCESS. See: http://msdn.microsoft.com/en-us/library/windows/desktop/ms684880(v=vs.85).aspx

Raises:

• WindowsError - It's not possible to open a handle to the process with the requested access rights. This tipically happens because the target process is a system process and the debugger is not runnning with administrative rights.

Closes the handle to the process.

Returns a handle to the process with at least the access rights requested.

Parameters:

• dwDesiredAccess (int) - Desired access rights. Defaults to win32.PROCESS_ALL_ACCESS. See: http://msdn.microsoft.com/en-us/library/windows/desktop/ms684880(v=vs.85).aspx

Returns: ProcessHandle

Handle to the process.

Raises:

• WindowsError - It's not possible to open a handle to the process with the requested access rights. This tipically happens because the target process is a system process and the debugger is not runnning with administrative rights.

The same as: self.has_thread(anObject) or self.has_module(anObject)

Parameters:

• anObject (Thread, Module or int) - Object to look for. Can be a Thread, Module, thread global ID or module base address.

Returns: bool

True if the requested object was found in the snapshot.

Overrides: module._ModuleContainer.__contains__

Returns: int

Count of Thread and Module objects in this snapshot.

Overrides: module._ModuleContainer.__len__

Returns: iterator

Iterator of Thread and Module objects in this snapshot. All threads are iterated first, then all modules.

Overrides: module._ModuleContainer.__iter__

Waits for the process to finish executing.

Raises:

• WindowsError - On error an exception is raised.

Terminates the execution of the process.

Raises:

• WindowsError - On error an exception is raised.

Suspends execution on all threads of the process.

Raises:

• WindowsError - On error an exception is raised.

Resumes execution on all threads of the process.

Raises:

• WindowsError - On error an exception is raised.

Tries to determine if the process is being debugged by another process. It may detect other debuggers besides WinAppDbg.

Returns: bool

True if the process has a debugger attached.

Returns: bool

True if the process is currently running.

Returns: int

Process exit code, or STILL_ACTIVE if it's still alive.

Disassemble instructions from a block of binary code.

Parameters:

• lpAddress (int) - Memory address where the code was read from.
• code (str) - Binary code to disassemble.

Returns: list of tuple( long, int, str, str )

List of tuples. Each tuple represents an assembly instruction and contains:

• Memory address of instruction.
• Size of instruction in bytes.
• Disassembly line of instruction.
• Hexadecimal dump of instruction.

Raises:

• NotImplementedError - No compatible disassembler was found for the current platform.

Disassemble instructions from the address space of the process.

Parameters:

• lpAddress (int) - Memory address where to read the code from.
• dwSize (int) - Size of binary code to disassemble.

Returns: list of tuple( long, int, str, str )

List of tuples. Each tuple represents an assembly instruction and contains:

• Memory address of instruction.
• Size of instruction in bytes.
• Disassembly line of instruction.
• Hexadecimal dump of instruction.

Disassemble around the given address.

Parameters:

• lpAddress (int) - Memory address where to read the code from.
• dwSize (int) - Delta offset. Code will be read from lpAddress - dwSize to lpAddress + dwSize.

Returns: list of tuple( long, int, str, str )

List of tuples. Each tuple represents an assembly instruction and contains:

• Memory address of instruction.
• Size of instruction in bytes.
• Disassembly line of instruction.
• Hexadecimal dump of instruction.

Disassemble around the program counter of the given thread.

Parameters:

• dwThreadId (int) - Global thread ID. The program counter for this thread will be used as the disassembly address.
• dwSize (int) - Delta offset. Code will be read from pc - dwSize to pc + dwSize.

Returns: list of tuple( long, int, str, str )

List of tuples. Each tuple represents an assembly instruction and contains:

• Memory address of instruction.
• Size of instruction in bytes.
• Disassembly line of instruction.
• Hexadecimal dump of instruction.

Disassemble the instruction at the given memory address.

Parameters:

• lpAddress (int) - Memory address where to read the code from.

Returns: tuple( long, int, str, str )

The tuple represents an assembly instruction and contains:

• Memory address of instruction.
• Size of instruction in bytes.
• Disassembly line of instruction.
• Hexadecimal dump of instruction.

Disassemble the instruction at the program counter of the given thread.

Parameters:

• dwThreadId (int) - Global thread ID. The program counter for this thread will be used as the disassembly address.

Returns: tuple( long, int, str, str )

The tuple represents an assembly instruction and contains:

• Memory address of instruction.
• Size of instruction in bytes.
• Disassembly line of instruction.
• Hexadecimal dump of instruction.

Flush the instruction cache. This is required if the process memory is modified and one or more threads are executing nearby the modified memory region.

Raises:

• WindowsError - Raises exception on error.

Triggers the system breakpoint in the process.

Raises:

• WindowsError - On error an exception is raised.

Determines if the process is running under WOW64.

Returns: bool

True if the process is running under WOW64. That is, a 32-bit application running in a 64-bit Windows.

False if the process is either a 32-bit application running in a 32-bit Windows, or a 64-bit application running in a 64-bit Windows.

Raises:

• WindowsError - On error an exception is raised.

Returns: str

The architecture in which this process believes to be running. For example, if running a 32 bit binary in a 64 bit machine, the architecture returned by this method will be win32.ARCH_I386, but the value of System.arch will be win32.ARCH_AMD64.

Returns: str

The number of bits in which this process believes to be running. For example, if running a 32 bit binary in a 64 bit machine, the number of bits returned by this method will be 32, but the value of System.arch will be 64.

Determines when has this process started running.

Returns: win32.SYSTEMTIME

Process start time.

Determines when has this process finished running. If the process is still alive, the current time is returned instead.

Returns: win32.SYSTEMTIME

Process exit time.

Determines how long has this process been running.

Returns: long

Process running time in milliseconds.

Retrieves the list of system services that are currently running in this process.

Returns: list( win32.ServiceStatusProcessEntry )

List of service status descriptors.

Retrieves the DEP (Data Execution Prevention) policy for this process.

Returns: tuple(int, int)

The first member of the tuple is the DEP flags. It can be a combination of the following values:

• 0: DEP is disabled for this process.
• 1: DEP is enabled for this process. (PROCESS_DEP_ENABLE)
• 2: DEP-ATL thunk emulation is disabled for this process. (PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION)

The second member of the tuple is the permanent flag. If TRUE the DEP settings cannot be changed in runtime for this process.

Raises:

• WindowsError - On error an exception is raised.

Returns a copy of the PEB. To dereference pointers in it call Process.read_structure.

Returns: win32.PEB

PEB structure.

Raises:

• WindowsError - An exception is raised on error.

Returns a remote pointer to the PEB.

Returns: int

Remote pointer to the win32.PEB structure. Returns None on error.

Alias to process.get_main_module().get_entry_point().

Returns: int

Address of the entry point of the main module.

Returns: Module

Module object for the process main module.

Returns: int

Image base address for the process main module.

Returns: int

Filename of the process main module.

This method does it's best to retrieve the filename. However sometimes this is not possible, so None may be returned instead.

Retrieves the command line block memory address and size.

Returns: tuple(int, int)

Tuple with the memory address of the command line block and it's maximum size in Unicode characters.

Raises:

• WindowsError - On error an exception is raised.

Retrieves the environment block memory address for the process.

Returns: tuple(int, int)

Tuple with the memory address of the environment block and it's size.

Raises:

• WindowsError - On error an exception is raised.

Retrieves the command line with wich the program was started.

Returns: str

Command line string.

Raises:

• WindowsError - On error an exception is raised.

Retrieves the environment variables with wich the program is running.

Returns: list of tuple(unicode, unicode)

Environment keys and values as found in the process memory.

Raises:

• WindowsError - On error an exception is raised.

Retrieves the environment block data with wich the program is running.

Parameters:

• fUnicode (bool or None) - True to return a list of Unicode strings, False to return a list of ANSI strings, or None to return whatever the default is for string types.

Returns: list of str

Environment keys and values separated by a (=) character, as found in the process memory.

Raises:

• WindowsError - On error an exception is raised.

Parse the environment block into a Python dictionary.

Parameters:

• block (list of str) - List of strings as returned by get_environment_data.

Returns: dict(str → str)

Dictionary of environment keys and values.

Retrieves the environment with wich the program is running.

Parameters:

• fUnicode (bool or None) - True to return a list of Unicode strings, False to return a list of ANSI strings, or None to return whatever the default is for string types.

Returns: dict(str → str)

Dictionary of environment keys and values.

Raises:

• WindowsError - On error an exception is raised.

Search for the given pattern within the process memory.

Parameters:

• pattern (str, unicode or Pattern) - Pattern to search for. It may be a byte string, a Unicode string, or an instance of Pattern.

  The following Pattern subclasses are provided by WinAppDbg:

  • BytePattern
  • TextPattern
  • RegExpPattern
  • HexPattern

  You can also write your own subclass of Pattern for customized searches.

• minAddr (int) - (Optional) Start the search at this memory address.
• maxAddr (int) - (Optional) Stop the search at this memory address.

Returns: iterator of tuple( int, int, str )

An iterator of tuples. Each tuple contains the following:

• The memory address where the pattern was found.
• The size of the data that matches the pattern.
• The data that matches the pattern.

Raises:

• WindowsError - An error occurred when querying or reading the process memory.

Search for the given byte pattern within the process memory.

Parameters:

• bytes (str) - Bytes to search for.
• minAddr (int) - (Optional) Start the search at this memory address.
• maxAddr (int) - (Optional) Stop the search at this memory address.

Returns: iterator of int

An iterator of memory addresses where the pattern was found.

Raises:

• WindowsError - An error occurred when querying or reading the process memory.

Search for the given text within the process memory.

Parameters:

• text (str or unicode) - Text to search for.
• encoding (str) - (Optional) Encoding for the text parameter. Only used when the text to search for is a Unicode string. Don't change unless you know what you're doing!
• caseSensitive (bool) - True of the search is case sensitive, False otherwise.
• minAddr (int) - (Optional) Start the search at this memory address.
• maxAddr (int) - (Optional) Stop the search at this memory address.

Returns: iterator of tuple( int, str )

An iterator of tuples. Each tuple contains the following:

• The memory address where the pattern was found.
• The text that matches the pattern.

Raises:

• WindowsError - An error occurred when querying or reading the process memory.

Search for the given regular expression within the process memory.

Parameters:

• regexp (str) - Regular expression string.
• flags (int) - Regular expression flags.
• minAddr (int) - (Optional) Start the search at this memory address.
• maxAddr (int) - (Optional) Stop the search at this memory address.
• bufferPages (int) - (Optional) Number of memory pages to buffer when performing the search. Valid values are:
  • 0 or None: Automatically determine the required buffer size. May not give complete results for regular expressions that match variable sized strings.
  • > 0: Set the buffer size, in memory pages.
  • < 0: Disable buffering entirely. This may give you a little speed gain at the cost of an increased memory usage. If the target process has very large contiguous memory regions it may actually be slower or even fail. It's also the only way to guarantee complete results for regular expressions that match variable sized strings.

Returns: iterator of tuple( int, int, str )

An iterator of tuples. Each tuple contains the following:

• The memory address where the pattern was found.
• The size of the data that matches the pattern.
• The data that matches the pattern.

Raises:

• WindowsError - An error occurred when querying or reading the process memory.

Search for the given hexadecimal pattern within the process memory.

Hex patterns must be in this form:

   "68 65 6c 6c 6f 20 77 6f 72 6c 64"  # "hello world"

Spaces are optional. Capitalization of hex digits doesn't matter. This is exactly equivalent to the previous example:

   "68656C6C6F20776F726C64"            # "hello world"

Wildcards are allowed, in the form of a ? sign in any hex digit:

   "5? 5? c3"          # pop register / pop register / ret
   "b8 ?? ?? ?? ??"    # mov eax, immediate value

Parameters:

• hexa (str) - Pattern to search for.
• minAddr (int) - (Optional) Start the search at this memory address.
• maxAddr (int) - (Optional) Stop the search at this memory address.

Returns: iterator of tuple( int, str )

An iterator of tuples. Each tuple contains the following:

• The memory address where the pattern was found.
• The bytes that match the pattern.

Raises:

• WindowsError - An error occurred when querying or reading the process memory.

Extract ASCII strings from the process memory.

Parameters:

• minSize (int) - (Optional) Minimum size of the strings to search for.
• maxSize (int) - (Optional) Maximum size of the strings to search for.

Returns: iterator of tuple(int, int, str)

Iterator of strings extracted from the process memory. Each tuple contains the following:

• The memory address where the string was found.
• The size of the string.
• The string.

Reads from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• nSize (int) - Number of bytes to read.

Returns: str

Bytes read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• lpBuffer (str) - Bytes to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a single character to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.

Returns: int

Character value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a single character to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• char (int) - Character to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a signed integer from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a signed integer to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Raises:

• WindowsError - On error an exception is raised.

Reads an unsigned integer from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes an unsigned integer to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a float from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Floating point value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a float to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Floating point value to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a double from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Floating point value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a double to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Floating point value to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a pointer value from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Pointer value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a pointer value to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a DWORD from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a DWORD to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a QWORD from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a QWORD to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a ctypes structure from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• stype (class ctypes.Structure or a subclass.) - Structure definition.

Returns: int

Structure instance filled in with data read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Reads an ASCII or Unicode string from the address space of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• nChars (int) - String length to read, in characters. Remember that Unicode strings have two byte characters.
• fUnicode (bool) - True is the string is expected to be Unicode, False if it's expected to be ANSI.

Returns: str, unicode

String read from the process memory space.

Raises:

• WindowsError - On error an exception is raised.

Reads the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• nSize (int) - Number of bytes to read.

Returns: str

Bytes read from the process memory. Returns an empty string on error.

Writes to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• lpBuffer (str) - Bytes to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a single character from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Character read from the process memory. Returns zero on error.

Writes a single character to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• char (str) - Character to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a signed integer from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory. Returns zero on error.

Writes a signed integer to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads an unsigned integer from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory. Returns zero on error.

Writes an unsigned integer to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a float from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory. Returns zero on error.

Writes a float to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a double from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory. Returns zero on error.

Writes a double to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a DWORD from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory. Returns zero on error.

Writes a DWORD to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a QWORD from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory. Returns zero on error.

Writes a QWORD to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a pointer value from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Pointer value read from the process memory. Returns zero on error.

Writes a pointer value to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Tries to read an ASCII or Unicode string from the address space of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• fUnicode (bool) - True is the string is expected to be Unicode, False if it's expected to be ANSI.
• dwMaxSize (int) - Maximum allowed string length to read, in bytes.

Returns: str, unicode

String read from the process memory space. It doesn't include the terminating null character. Returns an empty string on failure.

Tries to guess which values in the given data are valid pointers, and reads some data from them.

Parameters:

• data (str) - Binary data to find pointers in.
• peekSize (int) - Number of bytes to read from each pointer found.
• peekStep (int) - Expected data alignment. Tipically you specify 1 when data alignment is unknown, or 4 when you expect data to be DWORD aligned. Any other value may be specified.

Returns: dict( str → str )

Dictionary mapping stack offsets to the data they point to.

Allocates memory into the address space of the process.

Parameters:

• dwSize (int) - Number of bytes to allocate.
• lpAddress (int) - (Optional) Desired address for the newly allocated memory. This is only a hint, the memory could still be allocated somewhere else.

Returns: int

Address of the newly allocated memory.

Raises:

• WindowsError - On error an exception is raised.

Set memory protection in the address space of the process.

Parameters:

• lpAddress (int) - Address of memory to protect.
• dwSize (int) - Number of bytes to protect.
• flNewProtect (int) - New protect flags.

Returns: int

Old protect flags.

Raises:

• WindowsError - On error an exception is raised.

Query memory information from the address space of the process. Returns a win32.MemoryBasicInformation object.

Parameters:

• lpAddress (int) - Address of memory to query.

Returns: win32.MemoryBasicInformation

Memory region information.

Raises:

• WindowsError - On error an exception is raised.

Frees memory from the address space of the process.

Parameters:

• lpAddress (int) - Address of memory to free. Must be the base address returned by malloc.

Raises:

• WindowsError - On error an exception is raised.

Determines if an address is a valid code or data pointer.

That is, the address must be valid and must point to code or data in the target process.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address is a valid code or data pointer.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address is a valid user mode address.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address is a valid user mode address.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a free page.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a free page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a reserved page.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a reserved page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited page.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a guard page.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a guard page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited and readable page. The page may or may not have additional permissions.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited and readable page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited and writeable page. The page may or may not have additional permissions.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited and writeable page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited, copy-on-write page. The page may or may not have additional permissions.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited, copy-on-write page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited and executable page. The page may or may not have additional permissions.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited and executable page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited, writeable and executable page. The page may or may not have additional permissions.

Looking for writeable and executable pages is important when exploiting a software vulnerability.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited, writeable and executable page.

Raises:

• WindowsError - An exception is raised on error.

Determines if the given memory area is a valid code or data buffer.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is a valid code or data buffer, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is readable.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is readable, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is writeable.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is writeable, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is marked as copy-on-write.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is marked as copy-on-write, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is executable.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is executable, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is writeable and executable.

Looking for writeable and executable pages is important when exploiting a software vulnerability.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is writeable and executable, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Produces a memory map to the process address space.

Optionally restrict the map to the given address range.

Parameters:

• minAddr (int) - (Optional) Starting address in address range to query.
• maxAddr (int) - (Optional) Ending address in address range to query.

Returns: list( win32.MemoryBasicInformation )

List of memory region information objects.

Returns a Regenerator that can iterate indefinitely over the memory map to the process address space.

Optionally restrict the map to the given address range.

Parameters:

• minAddr (int) - (Optional) Starting address in address range to query.
• maxAddr (int) - (Optional) Ending address in address range to query.

Returns: Regenerator of win32.MemoryBasicInformation

List of memory region information objects.

Produces an iterator over the memory map to the process address space.

Optionally restrict the map to the given address range.

Parameters:

• minAddr (int) - (Optional) Starting address in address range to query.
• maxAddr (int) - (Optional) Ending address in address range to query.

Returns: iterator of win32.MemoryBasicInformation

List of memory region information objects.

Retrieves the filenames for memory mapped files in the debugee.

Parameters:

• memoryMap (list( win32.MemoryBasicInformation )) - (Optional) Memory map returned by get_memory_map. If not given, the current memory map is used.

Returns: dict( int → str )

Dictionary mapping memory addresses to file names. Native filenames are converted to Win32 filenames when possible.

Returns a Regenerator that allows you to iterate through the memory contents of a process indefinitely.

It's basically the same as the take_memory_snapshot method, but it takes the snapshot of each memory region as it goes, as opposed to taking the whole snapshot at once. This allows you to work with very large snapshots without a significant performance penalty.

Example:

   # Print the memory contents of a process.
   process.suspend()
   try:
       snapshot = process.generate_memory_snapshot()
       for mbi in snapshot:
           print HexDump.hexblock(mbi.content, mbi.BaseAddress)
   finally:
       process.resume()

The downside of this is the process must remain suspended while iterating the snapshot, otherwise strange things may happen.

The snapshot can be iterated more than once. Each time it's iterated the memory contents of the process will be fetched again.

You can also iterate the memory of a dead process, just as long as the last open handle to it hasn't been closed.

Parameters:

• minAddr (int) - (Optional) Starting address in address range to query.
• maxAddr (int) - (Optional) Ending address in address range to query.

Returns: Regenerator of win32.MemoryBasicInformation

Generator that when iterated returns memory region information objects. Two extra properties are added to these objects:

• filename: Mapped filename, or None.
• content: Memory contents, or None.