Re: [WinAppDbg-users] Process Created Callback Bug

[Mario V. <mv...@gm...>]

Ah, then it's my fault alright xD

I'll try to reproduce the bug, I'll send you a private email if I can't and
need your input :)

Thanks!

On Tue, Nov 25, 2014 at 5:41 PM, Jan Newger <jan...@ne...> wrote:

> Hey Mario,
>
> Yes, the same behaviour seems to trigger for load_dll events as well.
>
> If there's anything you want me to do / test in order to track down the
> issue I'd be happy to help!
>
> Thanks!
> Jan
>
> On 11/25/2014 05:31 PM, Mario Vilas wrote:
> > Hi, sorry for the late reply, I've quite a backlog :(
> >
> > The error message seems to be coming from the Win32 API, so I'm not sure
> > if it's a bug in winappdbg itself or just that some operations can't be
> > performed while the process is still being initialized when the
> > create_process event is triggered. Does the bug still occur with other
> > events?
> >
> > On Fri, Nov 14, 2014 at 2:39 PM, Jan Newger <jan...@ne...
> > <mailto:jan...@ne...>> wrote:
> >
> >     on top of that, the code also fails if i obtain the module from the
> >     event object itself, i.e.,:
> >
> >
> >     def create_process(self, event):
> >         main_module = event.get_module()
> >         module_start = main_module.get_base()
> >         module_end = main_module.get_base() + main_module.get_size()
> >         print "Process started: [%X, %X)" % (main_module_start,
> >     main_module_end)
> >
> >     Above code produces the same error.
> >
> >     On 11/14/2014 12:48 PM, Jan Newger wrote:
> >      > Hi there,
> >      >
> >      > I'm using the latest version of WinAppDbg on Win7 32bit with
> python
> >      > 2.7.5 with the following simple script:
> >      >
> >      >
> >      > === script start ===
> >      >
> >      > import sys
> >      >
> >      > from winappdbg import Debug
> >      > from winappdbg import EventHandler
> >      >
> >      > class DebugEventHandler(EventHandler):
> >      >
> >      >    def create_process(self, event):
> >      >      main_module = event.get_process().get_main_module()
> >      >      main_module_start = main_module.get_base()
> >      >      main_module_end = main_module.get_base() +
> >     main_module.get_size()
> >      >      print "Process started: [%X, %X)" % (main_module_start,
> >      > main_module_end)
> >      >
> >      > def start_debugger(cmd_line):
> >      >    with Debug(DebugEventHandler(), bKillOnExit=True) as debug:
> >      >      debug.execv(cmd_line)
> >      >      debug.loop()
> >      >
> >      > def main():
> >      >    start_debugger(sys.argv[1:])
> >      >
> >      > === script end ===
> >      >
> >      >
> >      > Invoking the script like this:
> >      >
> >      > python test.py C:\windows\system32\notepad.exe
> >      >
> >      > gives me an error saying:
> >      >
> >      > "C:\Python27\lib\site-packages\winappdbg\module.py:291:
> >     RuntimeWarning:
> >      > Cannot get size and entry point of module notepad, reason: The
> >     handle is
> >      > invalid"
> >      >
> >      >
> >      > Btw, is there a publicly available issue tracker somewhere? It
> seems
> >      > none is listed on the sourceforge page.
> >      >
> >      > Thanks and best regards
> >      > Jan
> >
> >
> >
>  ------------------------------------------------------------------------------
> >     Comprehensive Server Monitoring with Site24x7.
> >     Monitor 10 servers for $9/Month.
> >     Get alerted through email, SMS, voice calls or mobile push
> >     notifications.
> >     Take corrective actions from your mobile device.
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> >     _______________________________________________
> >     WinAppDbg-users mailing list
> >     Win...@li...
> >     <mailto:Win...@li...>
> >     https://lists.sourceforge.net/lists/listinfo/winappdbg-users
> >
> >
> >
> >
> > --
> > “There's a reason we separate military and the police: one fights
> > the enemy of the state, the other serves and protects the people. When
> > the military becomes both, then the enemies of the state tend to
> > become the people.”
> >
> >
> >
> ------------------------------------------------------------------------------
> > Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> > from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> > with Interactivity, Sharing, Native Excel Exports, App Integration & more
> > Get technology previously reserved for billion-dollar corporations, FREE
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> >
> >
> >
> > _______________________________________________
> > WinAppDbg-users mailing list
> > Win...@li...
> > https://lists.sourceforge.net/lists/listinfo/winappdbg-users
> >
>
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> WinAppDbg-users mailing list
> Win...@li...
> https://lists.sourceforge.net/lists/listinfo/winappdbg-users
>



-- 
“There's a reason we separate military and the police: one fights the enemy
of the state, the other serves and protects the people. When the military
becomes both, then the enemies of the state tend to become the people.”