Class CrashDump

Dump the x86 processor flags. The output mimics that of the WinDBG debugger. Used by dump_registers.

Parameters:

• efl (int) - Value of the eFlags register.

Returns: str

Text suitable for logging.

Dump the x86/x64 processor register values. The output mimics that of the WinDBG debugger.

Parameters:

• registers (dict( str → int )) - Dictionary mapping register names to their values.
• arch (str) - Architecture of the machine whose registers were dumped. Defaults to the current architecture. Currently only the following architectures are supported:
  • win32.ARCH_I386
  • win32.ARCH_AMD64

Returns: str

Text suitable for logging.

Dump data pointed to by the given registers, if any.

Parameters:

• registers (dict( str → int )) - Dictionary mapping register names to their values. This value is returned by Thread.get_context.
• data (dict( str → str )) - Dictionary mapping register names to the data they point to. This value is returned by Thread.peek_pointers_in_registers.

Returns: str

Text suitable for logging.

Dump data from pointers guessed within the given binary data.

Parameters:

• data (str) - Dictionary mapping offsets to the data they point to.
• base (int) - Base offset.
• bits (int) - (Optional) Number of bits of the target architecture. The default is platform dependent. See: HexDump.address_size

Returns: str

Text suitable for logging.

Dump data from pointers guessed within the given stack dump.

Parameters:

• data (str) - Dictionary mapping stack offsets to the data they point to.
• separator (str) - Separator between the hexadecimal representation of each character.
• width (int) - (Optional) Maximum number of characters to convert per text line. This value is also used for padding.
• arch (str) - Architecture of the machine whose registers were dumped. Defaults to the current architecture.

Returns: str

Text suitable for logging.

Dump a stack trace, as returned by Thread.get_stack_trace with the bUseLabels parameter set to False.

Parameters:

• stack_trace (list( int, int, str )) - Stack trace as a list of tuples of ( return address, frame pointer, module filename )
• bits (int) - (Optional) Number of bits of the target architecture. The default is platform dependent. See: HexDump.address_size

Returns: str

Text suitable for logging.

Dump a stack trace, as returned by Thread.get_stack_trace_with_labels.

Parameters:

• stack_trace (list( int, int, str )) - Stack trace as a list of tuples of ( return address, frame pointer, module filename )
• bits (int) - (Optional) Number of bits of the target architecture. The default is platform dependent. See: HexDump.address_size

Returns: str

Text suitable for logging.

Dump a disassembly. Optionally mark where the program counter is.

Parameters:

• disassembly (list of tuple( int, int, str, str )) - Disassembly dump as returned by Process.disassemble or Thread.disassemble_around_pc.
• pc (int) - (Optional) Program counter.
• bLowercase (bool) - (Optional) If True convert the code to lowercase.
• bits (int) - (Optional) Number of bits of the target architecture. The default is platform dependent. See: HexDump.address_size

Returns: str

Text suitable for logging.

Dump a single line of code. To dump a block of code use dump_code.

Parameters:

• disassembly_line (tuple( int, int, str, str )) - Single item of the list returned by Process.disassemble or Thread.disassemble_around_pc.
• bShowAddress (bool) - (Optional) If True show the memory address.
• bShowDump (bool) - (Optional) If True show the hexadecimal dump.
• bLowercase (bool) - (Optional) If True convert the code to lowercase.
• dwDumpWidth (int or None) - (Optional) Width in characters of the hex dump.
• dwCodeWidth (int or None) - (Optional) Width in characters of the code.
• bits (int) - (Optional) Number of bits of the target architecture. The default is platform dependent. See: HexDump.address_size

Returns: str

Text suitable for logging.

Dump the memory map of a process. Optionally show the filenames for memory mapped files as well.

Parameters:

• memoryMap (list( win32.MemoryBasicInformation )) - Memory map returned by Process.get_memory_map.
• mappedFilenames (dict( int → str )) - (Optional) Memory mapped filenames returned by Process.get_mapped_filenames.
• bits (int) - (Optional) Number of bits of the target architecture. The default is platform dependent. See: HexDump.address_size

Returns: str

Text suitable for logging.

reg_template

Type:

str

Value:

{'amd64': '''rax=%(Rax).16x rbx=%(Rbx).16x rcx=%(Rcx).16x rdx=%(Rdx).16x rsi=%(Rsi).16x rdi=%(Rdi).16x rip=%(Rip).16x rsp=%(Rsp).16x rbp=%(Rbp).16x r8=%(R8).16x r9=%(R9).16x r10=%(R10).16x r11=%(R11).16x r12=%(R12).16x r13=%(R13).16x r14=%(R14).16x r15=%(R15).16x %(efl_dump)s cs=%(SegCs).4x ss=%(SegSs).4x ds=%(SegDs).4x es=%(SegEs).4x fs=%(S ...