rendered paste bodyfrom ctypes import *# Let's map the Microsoft types to ctypes for clarityBYTE = c_ubyteWORD = c_ushortDWORD = c_ulongLPBYTE = POINTER(c_ubyte)LPTSTR = POINTER(c_char) HANDLE = c_void_pPVOID = c_void_pLPVOID = c_void_pUINT_PTR = c_ulongSIZE_T = c_ulong# ConstantsDEBUG_PROCESS = 0x00000001CREATE_NEW_CONSOLE = 0x00000010PROCESS_ALL_ACCESS = 0x001F0FFFINFINITE = 0xFFFFFFFFDBG_CONTINUE = 0x00010002# Debug event constantsEXCEPTION_DEBUG_EVENT = 0x1CREATE_THREAD_DEBUG_EVENT = 0x2CREATE_PROCESS_DEBUG_EVENT = 0x3EXIT_THREAD_DEBUG_EVENT = 0x4EXIT_PROCESS_DEBUG_EVENT = 0x5LOAD_DLL_DEBUG_EVENT = 0x6UNLOAD_DLL_DEBUG_EVENT = 0x7OUTPUT_DEBUG_STRING_EVENT = 0x8RIP_EVENT = 0x9# debug exception codes.EXCEPTION_ACCESS_VIOLATION = 0xC0000005EXCEPTION_BREAKPOINT = 0x80000003EXCEPTION_GUARD_PAGE = 0x80000001EXCEPTION_SINGLE_STEP = 0x80000004# Thread constants for CreateToolhelp32Snapshot()TH32CS_SNAPHEAPLIST = 0x00000001TH32CS_SNAPPROCESS = 0x00000002TH32CS_SNAPTHREAD = 0x00000004TH32CS_SNAPMODULE = 0x00000008TH32CS_INHERIT = 0x80000000TH32CS_SNAPALL = (TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE)THREAD_ALL_ACCESS = 0x001F03FF# Context flags for GetThreadContext()CONTEXT_FULL = 0x00010007CONTEXT_DEBUG_REGISTERS = 0x00010010# Memory permissionsPAGE_EXECUTE_READWRITE = 0x00000040# Hardware breakpoint conditionsHW_ACCESS = 0x00000003HW_EXECUTE = 0x00000000HW_WRITE = 0x00000001# Memory page permissions, used by VirtualProtect()PAGE_NOACCESS = 0x00000001PAGE_READONLY = 0x00000002PAGE_READWRITE = 0x00000004PAGE_WRITECOPY = 0x00000008PAGE_EXECUTE = 0x00000010PAGE_EXECUTE_READ = 0x00000020PAGE_EXECUTE_READWRITE = 0x00000040PAGE_EXECUTE_WRITECOPY = 0x00000080PAGE_GUARD = 0x00000100PAGE_NOCACHE = 0x00000200PAGE_WRITECOMBINE = 0x00000400# Structures for CreateProcessA() function# STARTUPINFO describes how to spawn the processclass STARTUPINFO(Structure): _fields_ = [ ("cb", DWORD), ("lpReserved", LPTSTR), ("lpDesktop", LPTSTR), ("lpTitle", LPTSTR), ("dwX", DWORD), ("dwY", DWORD), ("dwXSize", DWORD), ("dwYSize", DWORD), ("dwXCountChars", DWORD), ("dwYCountChars", DWORD), ("dwFillAttribute",DWORD), ("dwFlags", DWORD), ("wShowWindow", WORD), ("cbReserved2", WORD), ("lpReserved2", LPBYTE), ("hStdInput", HANDLE), ("hStdOutput", HANDLE), ("hStdError", HANDLE), ]# PROCESS_INFORMATION receives its information# after the target process has been successfully# started.class PROCESS_INFORMATION(Structure): _fields_ = [ ("hProcess", HANDLE), ("hThread", HANDLE), ("dwProcessId", DWORD), ("dwThreadId", DWORD), ]# When the dwDebugEventCode is evaluatedclass EXCEPTION_RECORD(Structure): pass EXCEPTION_RECORD._fields_ = [ ("ExceptionCode", DWORD), ("ExceptionFlags", DWORD), ("ExceptionRecord", POINTER(EXCEPTION_RECORD)), ("ExceptionAddress", PVOID), ("NumberParameters", DWORD), ("ExceptionInformation", UINT_PTR * 15), ]class _EXCEPTION_RECORD(Structure): _fields_ = [ ("ExceptionCode", DWORD), ("ExceptionFlags", DWORD), ("ExceptionRecord", POINTER(EXCEPTION_RECORD)), ("ExceptionAddress", PVOID), ("NumberParameters", DWORD), ("ExceptionInformation", UINT_PTR * 15), ]# Exceptionsclass EXCEPTION_DEBUG_INFO(Structure): _fields_ = [ ("ExceptionRecord", EXCEPTION_RECORD), ("dwFirstChance", DWORD), ]# it populates this union appropriatelyclass DEBUG_EVENT_UNION(Union): _fields_ = [ ("Exception", EXCEPTION_DEBUG_INFO),# ("CreateThread", CREATE_THREAD_DEBUG_INFO),# ("CreateProcessInfo", CREATE_PROCESS_DEBUG_INFO),# ("ExitThread", EXIT_THREAD_DEBUG_INFO),# ("ExitProcess", EXIT_PROCESS_DEBUG_INFO),# ("LoadDll", LOAD_DLL_DEBUG_INFO),# ("UnloadDll", UNLOAD_DLL_DEBUG_INFO),# ("DebugString", OUTPUT_DEBUG_STRING_INFO),# ("RipInfo", RIP_INFO), ] # DEBUG_EVENT describes a debugging event# that the debugger has trappedclass DEBUG_EVENT(Structure): _fields_ = [ ("dwDebugEventCode", DWORD), ("dwProcessId", DWORD), ("dwThreadId", DWORD), ("u", DEBUG_EVENT_UNION), ]# Used by the CONTEXT structureclass FLOATING_SAVE_AREA(Structure): _fields_ = [ ("ControlWord", DWORD), ("StatusWord", DWORD), ("TagWord", DWORD), ("ErrorOffset", DWORD), ("ErrorSelector", DWORD), ("DataOffset", DWORD), ("DataSelector", DWORD), ("RegisterArea", BYTE * 80), ("Cr0NpxState", DWORD),]# The CONTEXT structure which holds all of the # register values after a GetThreadContext() callclass CONTEXT(Structure): _fields_ = [ ("ContextFlags", DWORD), ("Dr0", DWORD), ("Dr1", DWORD), ("Dr2", DWORD), ("Dr3", DWORD), ("Dr6", DWORD), ("Dr7", DWORD), ("FloatSave", FLOATING_SAVE_AREA), ("SegGs", DWORD), ("SegFs", DWORD), ("SegEs", DWORD), ("SegDs", DWORD), ("Edi", DWORD), ("Esi", DWORD), ("Ebx", DWORD), ("Edx", DWORD), ("Ecx", DWORD), ("Eax", DWORD), ("Ebp", DWORD), ("Eip", DWORD), ("SegCs", DWORD), ("EFlags", DWORD), ("Esp", DWORD), ("SegSs", DWORD), ("ExtendedRegisters", BYTE * 512),]# THREADENTRY32 contains information about a thread# we use this for enumerating all of the system threadsclass THREADENTRY32(Structure): _fields_ = [ ("dwSize", DWORD), ("cntUsage", DWORD), ("th32ThreadID", DWORD), ("th32OwnerProcessID", DWORD), ("tpBasePri", DWORD), ("tpDeltaPri", DWORD), ("dwFlags", DWORD), ]# Supporting struct for the SYSTEM_INFO_UNION unionclass PROC_STRUCT(Structure): _fields_ = [ ("wProcessorArchitecture", WORD), ("wReserved", WORD),]# Supporting union for the SYSTEM_INFO structclass SYSTEM_INFO_UNION(Union): _fields_ = [ ("dwOemId", DWORD), ("sProcStruc", PROC_STRUCT),]# SYSTEM_INFO structure is populated when a call to # kernel32.GetSystemInfo() is made. We use the dwPageSize# member for size calculations when setting memory breakpointsclass SYSTEM_INFO(Structure): _fields_ = [ ("uSysInfo", SYSTEM_INFO_UNION), ("dwPageSize", DWORD), ("lpMinimumApplicationAddress", LPVOID), ("lpMaximumApplicationAddress", LPVOID), ("dwActiveProcessorMask", DWORD), ("dwNumberOfProcessors", DWORD), ("dwProcessorType", DWORD), ("dwAllocationGranularity", DWORD), ("wProcessorLevel", WORD), ("wProcessorRevision", WORD),]# MEMORY_BASIC_INFORMATION contains information about a # particular region of memory. A call to kernel32.VirtualQuery()# populates this structure.class MEMORY_BASIC_INFORMATION(Structure): _fields_ = [ ("BaseAddress", PVOID), ("AllocationBase", PVOID), ("AllocationProtect", DWORD), ("RegionSize", SIZE_T), ("State", DWORD), ("Protect", DWORD), ("Type", DWORD),]