pydbg测试实例（三）进程快照的获取和恢复

转自《python灰帽子》第4章

目标：获取进程快照和恢复进程

思路：开启两个线程，第一线程创建一个pydbg调试器对象，并用它加载一个可执行程序；第二线程通过pydbg的方法process_snapshot()和process_restore()来获取进程快照和恢复，在获取快照或恢复的时候都要暂停进程的所有线程

snapshot.py

from pydbg  import *
from pydbg.defines import *
import threading
import time
import sys
class snapshotter(object):
    def __init__(self,exe_path):

        self.exe_path     = exe_path
        self.pid          = None
        self.dbg          = None
        self.running      = True
	
        # open debugger thread waiting for pid to be set
        pydbg_thread = threading.Thread(target=self.start_debugger)
        pydbg_thread.setDaemon(0)
        pydbg_thread.start()
            
        while self.pid == None:
            time.sleep(1)
        
        # open second thread to snapshot the process
        monitor_thread = threading.Thread(target=self.monitor_debugger)
        monitor_thread.setDaemon(0)
        monitor_thread.start()
                 
    def monitor_debugger(self): 
        
        while self.running == True:
            
            input = raw_input("Enter: 'snap','restore' or 'quit'")
            input = input.lower().strip()
            
            if input == "quit":
                print "[*] Exiting the snapshotter."
                self.running = False
                self.dbg.terminate_process()
                
            elif input == "snap":
                
                print "[*] Suspending all threads."
                self.dbg.suspend_all_threads()
                
                print "[*] Obtaining snapshot."
                self.dbg.process_snapshot()
                
                print "[*] Resuming operation."
                self.dbg.resume_all_threads()
            
            elif input == "restore":
                
                print "[*] Suspending all threads."
                self.dbg.suspend_all_threads()
                
                print "[*] Restoring snapshot."
                self.dbg.process_restore()
                
                print "[*] Resuming operation."
                self.dbg.resume_all_threads()
                
    def start_debugger(self):
        self.dbg = pydbg()
        pid = self.dbg.load(self.exe_path)
        self.pid = self.dbg.pid
        self.dbg.run()


exe_path = "C:/Windows/system32/calc.exe"
snap = snapshotter(exe_path)

测试：

只在xp下可以成功，输入restore后，计算器窗口并没变化，要最小化后再打开就可以看到效果

另外，对计算器记忆功能如MS的恢复不起作用