Re: [WinAppDbg-users] Process Created Callback Bug

[Mario V. <mv...@gm...>]

Hi, sorry for the late reply, I've quite a backlog :(

The error message seems to be coming from the Win32 API, so I'm not sure if
it's a bug in winappdbg itself or just that some operations can't be
performed while the process is still being initialized when the
create_process event is triggered. Does the bug still occur with other
events?

On Fri, Nov 14, 2014 at 2:39 PM, Jan Newger <jan...@ne...> wrote:

> on top of that, the code also fails if i obtain the module from the
> event object itself, i.e.,:
>
>
> def create_process(self, event):
>    main_module = event.get_module()
>    module_start = main_module.get_base()
>    module_end = main_module.get_base() + main_module.get_size()
>    print "Process started: [%X, %X)" % (main_module_start, main_module_end)
>
> Above code produces the same error.
>
> On 11/14/2014 12:48 PM, Jan Newger wrote:
> > Hi there,
> >
> > I'm using the latest version of WinAppDbg on Win7 32bit with python
> > 2.7.5 with the following simple script:
> >
> >
> > === script start ===
> >
> > import sys
> >
> > from winappdbg import Debug
> > from winappdbg import EventHandler
> >
> > class DebugEventHandler(EventHandler):
> >
> >    def create_process(self, event):
> >      main_module = event.get_process().get_main_module()
> >      main_module_start = main_module.get_base()
> >      main_module_end = main_module.get_base() + main_module.get_size()
> >      print "Process started: [%X, %X)" % (main_module_start,
> > main_module_end)
> >
> > def start_debugger(cmd_line):
> >    with Debug(DebugEventHandler(), bKillOnExit=True) as debug:
> >      debug.execv(cmd_line)
> >      debug.loop()
> >
> > def main():
> >    start_debugger(sys.argv[1:])
> >
> > === script end ===
> >
> >
> > Invoking the script like this:
> >
> > python test.py C:\windows\system32\notepad.exe
> >
> > gives me an error saying:
> >
> > "C:\Python27\lib\site-packages\winappdbg\module.py:291: RuntimeWarning:
> > Cannot get size and entry point of module notepad, reason: The handle is
> > invalid"
> >
> >
> > Btw, is there a publicly available issue tracker somewhere? It seems
> > none is listed on the sourceforge page.
> >
> > Thanks and best regards
> > Jan
>
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> _______________________________________________
> WinAppDbg-users mailing list
> Win...@li...
> https://lists.sourceforge.net/lists/listinfo/winappdbg-users
>



-- 
“There's a reason we separate military and the police: one fights the enemy
of the state, the other serves and protects the people. When the military
becomes both, then the enemies of the state tend to become the people.”