2

I'm using python 2.5(x86) in Windows7 x64. I wrote the code following this book.

http://nostarch.com/ghpython.htm

But it doesn't work in my environment.

PDBG_ERR> -- IGNORING ERROR --
PDBG_ERR> process_restore: [87] WriteProcessMemory

I suppose the problem comes from Windows version because somebody mentioned it in the below url page and I heard it works in Windows XP.

http://bbs.csdn.net/topics/380255167

PyDBG process snapshots not working

from pydbg import *
from pydbg.defines import *
import threading
import time
import sys

class snapshotter(object):
    def __init__(self,exe_path):
        self.exe_path = exe_path
        self.pid = None
        self.dbg = None
        self.running = True

        pydbg_thread = threading.Thread(target=self.start_debugger)
        pydbg_thread.setDaemon(0)
        pydbg_thread.start()

        while self.pid == None:
            time.sleep(1)

        monitor_thread = threading.Thread(target=self.monitor_debugger)
        monitor_thread.setDaemon(0)
        monitor_thread.start()

    def monitor_debugger(self):
        while self.running == True:
            input = raw_input("Enter: 'snap','restore' or 'quit'")
            input = input.lower().strip()
            if input == "quit":
                print "[*] Exiting the snapshotter."
                self.running = False
                self.dbg.terminate_process()
            elif input == "snap":
                print "[*] Suspending all threads."
                self.dbg.suspend_all_threads()
                print "[*] Obtaining snapshot."
                self.dbg.process_snapshot()
                print "[*] Resuming operation."
                self.dbg.resume_all_threads()
            elif input == "restore":
                print "[*] Suspending all threads."
                self.dbg.suspend_all_threads()
                print "[*] Restoring snapshot."
                self.dbg.process_restore()
                print "[*] Resuming operation."
                self.dbg.resume_all_threads()

    def start_debugger(self):
        self.dbg = pydbg()
        pid = self.dbg.load(self.exe_path)
        self.pid = self.dbg.pid
        self.dbg.run()

exe_path = "C:\\WINDOWS\\System32\\calc.exe"
snapshotter(exe_path)

How can I avoid this error and make it work?

Community
  • 1
  • 1
fx-kirin
  • 1,906
  • 1
  • 20
  • 33
  • When I checked how the process worked, the other addresses was successfully written. Only the address "000f0000" was fault. So the process addresses of calc.exe works mostly correctly except the display of calc. I don't know why but I think this is not a big problem. – fx-kirin Dec 17 '13 at 09:26
  • Calc.exe is a 64 bit process on 64 bit windows 7. Everything in grey hat python only works on 32 bit executables. However, I am testing on a 32 bit version of 7z on my computer and it still encounters the same problem. – trevorKirkby Feb 28 '14 at 19:18
  • By the way windows 7 does come with a 32 bit windows XP, so you can successfully run it in that. – trevorKirkby Mar 11 '14 at 20:57

0 Answers0