Re: [WinAppDbg-users] Process Created Callback Bug

[Jan N. <jan...@ne...>]

on top of that, the code also fails if i obtain the module from the 
event object itself, i.e.,:


def create_process(self, event):
   main_module = event.get_module()
   module_start = main_module.get_base()
   module_end = main_module.get_base() + main_module.get_size()
   print "Process started: [%X, %X)" % (main_module_start, main_module_end)

Above code produces the same error.

On 11/14/2014 12:48 PM, Jan Newger wrote:
> Hi there,
>
> I'm using the latest version of WinAppDbg on Win7 32bit with python
> 2.7.5 with the following simple script:
>
>
> === script start ===
>
> import sys
>
> from winappdbg import Debug
> from winappdbg import EventHandler
>
> class DebugEventHandler(EventHandler):
>
>    def create_process(self, event):
>      main_module = event.get_process().get_main_module()
>      main_module_start = main_module.get_base()
>      main_module_end = main_module.get_base() + main_module.get_size()
>      print "Process started: [%X, %X)" % (main_module_start,
> main_module_end)
>
> def start_debugger(cmd_line):
>    with Debug(DebugEventHandler(), bKillOnExit=True) as debug:
>      debug.execv(cmd_line)
>      debug.loop()
>
> def main():
>    start_debugger(sys.argv[1:])
>
> === script end ===
>
>
> Invoking the script like this:
>
> python test.py C:\windows\system32\notepad.exe
>
> gives me an error saying:
>
> "C:\Python27\lib\site-packages\winappdbg\module.py:291: RuntimeWarning:
> Cannot get size and entry point of module notepad, reason: The handle is
> invalid"
>
>
> Btw, is there a publicly available issue tracker somewhere? It seems
> none is listed on the sourceforge page.
>
> Thanks and best regards
> Jan