def p1_attached(process):
print "attached to %d" % process.id
print _ptrace.processes()
process.detach()
def p2_attached(process):
print "attached to %d" % process.id
print _ptrace.processes()
def exited(process):
print "%d exited" % process.id
print _ptrace.processes()
parser = argparse.ArgumentParser(description='Processes demonstration script.')
parser.add_argument('--debug', '-d', action='store_true')
parser.add_argument('--second-chance', '-s', action='store_true')
args = parser.parse_args(sys.argv[1:])
if args.debug:
_ptrace.log_hook_add(_ptrace.log_hook(logger))
handlers = _ptrace.event_handlers()
handlers.attached = p1_attached
handlers.process_exit = exited
_ptrace.execv(r'c:\windows\notepad.exe', [], handlers, 0)
handlers.attached = p2_attached
_ptrace.execv(r'c:\windows\notepad.exe', [], handlers, 0)
_ptrace.main()
inject.inject(process)
parser = argparse.ArgumentParser(description='Heap activity tracer.')
parser.add_argument('file',
nargs='?',
metavar='filename',
help='executable to trace.')
parser.add_argument('args', nargs='*', metavar='args', help='arguments.')
parser.add_argument('--debug', '-d', action='store_true')
parser.add_argument('--pid', '-p', type=int)
args = parser.parse_args(sys.argv[1:])
if (not args.file and not args.pid) or (args.file and args.pid):
parser.print_help()
sys.exit(1)
if args.debug:
_ptrace.log_hook_add(_ptrace.log_hook(logger))
handlers = _ptrace.event_handlers()
handlers.attached = attached
if args.pid:
_ptrace.process_attach(args.pid, handlers, 0)
if args.file:
_ptrace.execv(args.file, args.args, handlers, 0)
_ptrace.main()
sys.exit(1)
if args.debug:
_ptrace.log_hook_add(_ptrace.log_hook(logger))
handlers = _ptrace.event_handlers()
handlers.attached = attached
handlers.process_exit = process_exit
handlers.thread_create = thread_create
handlers.thread_exit = thread_exit
handlers.module_load = module_load
handlers.module_unload = module_unload
handlers.breakpoint = breakpoint
handlers.single_step = single_step
handlers.segfault = segfault
handlers.illegal_instruction = illegal_instruction
handlers.divide_by_zero = divide_by_zero
handlers.priv_instruction = priv_instruction
options = 0
if args.second_chance:
options = _ptrace.PROCESS_OPTION_EVENT_SECOND_CHANCE
if args.pid:
_ptrace.process_attach(args.pid, handlers, options)
if args.file:
_ptrace.execv(args.file, args.args, handlers, options)
_ptrace.main()
