Junch / Pybag

Python module for Windbg's dbgeng plus additional wrappers.

Pybag

Python bindings for Microsoft DbgEng

Pybag provides helper functions on top of Python bindings for Microsoft Debug Engine to facilitate Windows native debugging.

Installation

Windows:

python setup.py install

Usage example

Use Python's repl as a command shell if desired. Ctrl-c will break-in to the debugger if you are in a wait() call.

Local user debugging

from pybag import *

def handler(bp, dbg):
    print("*********** BREAK")
    return DbgEng.DEBUG_STATUS_GO

dbg = UserDbg()
dbg.create("notepad.exe")
dbg.bp("Kernel32!WriteFile", handler)
dbg.go()

Remote user debugging

from pybag import *

def handler(bp, dbg):
    print("*********** BREAK")
    return DbgEng.DEBUG_STATUS_GO

dbg = UserDbg()
d.connect("tcp:server=192.168.1.10,port=5555")
dbg.create("notepad.exe")
dbg.bp("Kernel32!WriteFile", handler)
dbg.go()

Remote kernel debugging

from pybag import *

k = KernelDbg()
k.attach("net:port=50000,key=1.2.3.4")

Release History

• 2.2.8
  • Fixed missing files install issue
• 2.2.7
  • Fixed access violation when using oneshot breakpoints
  • Added 'count' option to breakpoints
• 2.2.6
  • Added support for more dbgeng calls
    • Symbol handling
    • Set / get thread contexts
  • Fixed ds command
• 2.2.5
  • Fixed be command
  • Better search for Windbg install (and DLLs)
• 2.2.4
  • Fixed lint issues
• 2.2.3
  • Bug fix in WriteVirtual
• 2.2.2
  • Python bindings rewritten to use comtypes
  • Moved to Python 3
  • Support multiple debugging uses
    • Local user debugging
    • Remote kernel debugging
    • Remote user debugging using dbgsrv

Meta

Distributed under the MIT license. See LICENSE for more information.

https://github.com/dshikashio