[WinAppDbg-users] Windows Error 299 in CreateToolhelp32Snapshot?

[Michael A H. <mah...@ra...>]

Hello,

I'm attempting use WinAppDbg to capture exceptions using a script that 
fuzzes offline client files.  Sulley is the fuzzing framework and I'm 
debugging 32-bit applications on Windows 7 Professional, 64-bit. 

My script mutates a file with a Sulley-generated test string, calls the 
target application using subprocess.Popen, then kicks off a child thread 
that attaches the debugger to the process.  The primary thread runs 
time.sleep(user_selected_timeout) and then calls process.terminate() 
followed by process.wait().

After waiting for the debug thread to join, the mutated file is 
overwritten with a "clean" copy and the cycle starts again with a new 
mutation.  Here is the function that the debug thread calls:

def debug_app(pid):

        with Debug(my_event_handler, bKillOnExit = True) as debug:

                try:
                        debug.attach(pid)
                        debug.loop()
                finally:
                        debug.stop()

This will work for up to a few hundred cycles.  Then I get the following 
error:

Exception in thread Thread-XX:

Traceback (most recent call last):
        File "C:\python27\lib\threading.py", line 808, in 
__bootstrap_inner
                self.run()
        File "C:\python27\lib\threading.py", line 761, in run 
                self.__target(*self.__args, **self.__kwargs)
        File "fuzz_something.py", line 109, in debug_Acrobat
                debug.attach(pid)
        File "C:\python27\lib\site-packages\winappdbg\debug.py", line 260, 
in attach
                aProcess.scan_modules()
        File "C:\python27\lib\site-packages\winappdbg\module.py", line 
1056, in scan_modules 
                dwProcessId) as hSnapshot:
        File "C:\python27\lib\site-packages\winappdbg\win32\kernel32.py", 
line 4207, in CreateToolhelp32Snapshot
                raise ctypes.WinError()
        WindowsError: [Error 299] Only part of a ReadProcessMemory or 
WriteProcessMemory request was completed

Has anyone seen this and know how to deal with it?

M Horkan