阅读笔记&&实现代码_of_Python灰帽子(一)-CSDN博客

2019独角兽企业重金招聘Python工程师标准>>>

用python构建自己的Windows调试器初探
my_debugger_defines.py和my_debugger.py用于创建一个核心基类和一些常值与结构体，my_test.py用于简单测试

my_debugger_defines.py

from ctypes import *

#为符合汇编变量名风格
WORD    = c_ushort
DWORD   = c_ulong
LPBYTE  = POINTER(c_ubyte)
LPTSTR  = POINTER(c_char)
HANDLE  = c_void_p

DEBUG_PROCESS       = 0x00000001
CREATE_NEW_CONSOLE  = 0x00000010

class STARTUPINFO(Structure):
    _fields_ = [
        ("cb",              DWORD),
        ("lpReserved",      LPTSTR),
        ("lpDesktop",       LPTSTR),
        ("lpTitle",         LPTSTR),
        ("dwX",             DWORD),
        ("dwY",             DWORD),
        ("dwXCountChars",   DWORD),
        ("dwYCountChars",   DWORD),
        ("dwFillAttribute", DWORD),
        ("dwFlags",         DWORD),
        ("wShowWindow",     WORD),
        ("cbReserved2",     WORD),
        ("lpReserved2",     LPTSTR),
        ("hStdInput",       HANDLE),
        ("hStdOutput",      HANDLE),
        ("hStdError",       HANDLE),
    ]

class PROCESS_INFORMATION(Structure):
    _fields_ = [
        ("hProcess",        HANDLE),
        ("hThread",         HANDLE),
        ("dwProcessId",     DWORD),
        ("dwThreadId",      DWORD),
    ]

my_debugger.py

from ctypes import *
from my_debugger_defines import *

kernel32 = windll.kernel32

class debugger():
    def __init__(self):
        pass

    def load(self, path_to_exe):

        creation_flags = DEBUG_PROCESS #该标志位控制着进程的创建方式

        #实例化结构体
        startupinfo = STARTUPINFO()
        process_information = PROCESS_INFORMATION()

        #在以下两个成员变量的共同作用下，新进程将在一个单独的窗体被显示
        startupinfo.dwFlags = 0x1
        startupinfo.wShowWindow = 0x0

        startupinfo.cb = sizeof(startupinfo)

        #CreateProcessA应有10个参数，书中的代码只写了七个，会运行报错
        #参考了https://msdn.microsoft.com/library/ms682425.aspx，
        #大体了解了各个参数的意思，用了三个None以补全
        if kernel32.CreateProcessA(path_to_exe, None, None, None,None,creation_flags, 
                           None, None, byref(startupinfo), byref(process_information)):

            #byref用以传递变量对应的指针，比pointer()更快

            print 'We have successfully launched the process!'
            print 'PID:%d' % process_information.dwProcessId

        else:
            print 'Error: 0x%08x' %kernel32.GetLastError()

my_test.py

# -*- coding: utf-8 -*-
import my_debugger

debugger = my_debugger.debugger()
debugger.load('C:\\WINDOWS\\SYSTEM32\\calc.exe')

转载于:https://my.oschina.net/yup1612/blog/803359