Package winappdbg :: Module util :: Class DebugRegister
[hide private]
[frames] | no frames]

Class DebugRegister

source code


Class to manipulate debug registers. Used by HardwareBreakpoint.

Instance Methods [hide private]

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __init__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Methods [hide private]
 
clear_bp(cls, ctx, register)
Clears a hardware breakpoint.
source code
 
set_bp(cls, ctx, register, address, trigger, watch)
Sets a hardware breakpoint.
source code
int
find_slot(cls, ctx)
Finds an empty slot to set a hardware breakpoint.
source code
Static Methods [hide private]
a new object with type S, a subtype of T
__new__(cls, *argv, **argd)
Don't try to instance this class, just use the static methods. (Inherited from winappdbg.util.StaticClass)
Class Variables [hide private]
  registerMask = 4294967295
    Trigger flags used by HardwareBreakpoint
int BREAK_ON_EXECUTION = 0
Break on execution.
int BREAK_ON_WRITE = 1
Break on write.
int BREAK_ON_ACCESS = 3
Break on read or write.
int BREAK_ON_IO_ACCESS = 2
Break on I/O port access.
    Size flags used by HardwareBreakpoint
int WATCH_BYTE = 0
Watch a byte.
int WATCH_WORD = 1
Watch a word.
int WATCH_DWORD = 3
Watch a double word.
int WATCH_QWORD = 2
Watch one quad word.
    Bitwise masks for Dr7
4-tuple of integers enableMask = (1, 4, 16, 64)
Enable bit on Dr7 for each slot.
4-tuple of integers disableMask = (4294967294, 4294967291, 4294967279, 4294967231)
Mask of the enable bit on Dr7 for each slot.
4-tuple of 2-tuples of integers triggerMask = (((0, 4294770687), (65536, 4294770687), (131072,...
Trigger bits on Dr7 for each trigger flag value.
4-tuple of 2-tuples of integers watchMask = (((0, 4294180863), (262144, 4294180863), (524288, ...
Watch bits on Dr7 for each watch flag value.
4-tuple of integers clearMask = (4293984254, 4279238651, 4043309039, 268435391)
Mask of all important bits on Dr7 for each slot.
integer generalDetectMask = 8192
General detect mode bit.
    Bitwise masks for Dr6
4-tuple of integers hitMask = (1, 2, 4, 8)
Hit bit on Dr6 for each slot.
integer hitMaskAll = 15
Bitmask for all hit bits in Dr6.
integer clearHitMask = 4294967280
Bitmask to clear all the hit bits in Dr6.
integer debugAccessMask = 8192
The debugee tried to access a debug register.
integer singleStepMask = 16384
A single step exception was raised.
integer taskSwitchMask = 32768
A task switch has occurred.
integer clearDr6Mask = 4294909936
Bitmask to clear all meaningful bits in Dr6.
    Debug control MSR definitions
  DebugCtlMSR = 473
  LastBranchRecord = 1
  BranchTrapFlag = 2
  PinControl = (4, 8, 16, 32)
  LastBranchToIP = 476
  LastBranchFromIP = 475
  LastExceptionToIP = 478
  LastExceptionFromIP = 477
Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

clear_bp(cls, ctx, register)
Class Method

source code 

Clears a hardware breakpoint.

Parameters:
  • ctx (dict( str → int )) - Thread context dictionary.
  • register (int) - Slot (debug register) for hardware breakpoint.

See Also: find_slot, set_bp

set_bp(cls, ctx, register, address, trigger, watch)
Class Method

source code 

Sets a hardware breakpoint.

Parameters:

See Also: clear_bp, find_slot

find_slot(cls, ctx)
Class Method

source code 

Finds an empty slot to set a hardware breakpoint.

Parameters:
  • ctx (dict( str → int )) - Thread context dictionary.
Returns: int
Slot (debug register) for hardware breakpoint.

See Also: clear_bp, set_bp


Class Variable Details [hide private]

BREAK_ON_IO_ACCESS

Break on I/O port access. Not supported by any hardware.
Type:
int
Value:
2

enableMask

Enable bit on Dr7 for each slot. Works as a bitwise-OR mask.
Type:
4-tuple of integers
Value:
(1, 4, 16, 64)

disableMask

Mask of the enable bit on Dr7 for each slot. Works as a bitwise-AND mask.
Type:
4-tuple of integers
Value:
(4294967294, 4294967291, 4294967279, 4294967231)

triggerMask

Trigger bits on Dr7 for each trigger flag value. Each 2-tuple has the bitwise-OR mask and the bitwise-AND mask.
Type:
4-tuple of 2-tuples of integers
Value:
(((0, 4294770687),
  (65536, 4294770687),
  (131072, 4294770687),
  (196608, 4294770687)),
 ((0, 4291821567),
  (1048576, 4291821567),
  (2097152, 4291821567),
  (3145728, 4291821567)),
...

watchMask

Watch bits on Dr7 for each watch flag value. Each 2-tuple has the bitwise-OR mask and the bitwise-AND mask.
Type:
4-tuple of 2-tuples of integers
Value:
(((0, 4294180863),
  (262144, 4294180863),
  (524288, 4294180863),
  (786432, 4294180863)),
 ((0, 4269801471),
  (8388608, 4269801471),
  (16777216, 4269801471),
  (25165824, 4269801471)),
...

clearMask

Mask of all important bits on Dr7 for each slot. Works as a bitwise-AND mask.
Type:
4-tuple of integers
Value:
(4293984254, 4279238651, 4043309039, 268435391)

generalDetectMask

General detect mode bit. It enables the processor to notify the debugger when the debugee is trying to access one of the debug registers.
Type:
integer
Value:
8192

hitMask

Hit bit on Dr6 for each slot. Works as a bitwise-AND mask.
Type:
4-tuple of integers
Value:
(1, 2, 4, 8)

hitMaskAll

Bitmask for all hit bits in Dr6. Useful to know if at least one hardware breakpoint was hit, or to clear the hit bits only.
Type:
integer
Value:
15

debugAccessMask

The debugee tried to access a debug register. Needs bit generalDetectMask enabled in Dr7.
Type:
integer
Value:
8192

singleStepMask

A single step exception was raised. Needs the trap flag enabled.
Type:
integer
Value:
16384

taskSwitchMask

A task switch has occurred. Needs the TSS T-bit set to 1.
Type:
integer
Value:
32768