Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  Attach to program using 'DebugActiveProcess(pid)'

Topic created on: May 13, 2013 11:56 CDT by bhf .

I am working with Greyhat Python and I can't get the book code or my own to properly attach to an existing program (calc.exe).

I am doing this within Visual Studio and have figured out that it is giving me error code 50 when I do this in Windows 8 64 bit. Looked up to mean 'not supported.'

Things I have tried:
Run VS in elevated and rerun
Looked up and added changes from book
Used book example source from website
used IDLE with/without elevation to run book and my code each.

All of which give errors when attaching. I discovered the error code by stepping through in Visual Studio.

Is there something special in Windows 8 preventing this from working?

Here is my code, it has a defines file (checked, that is fine) and another file to test this code with (just getting input, not the problem either).
Makes a call to 'attach' and 'detach' which is where the issues are.

My code (my_debugger.py)
from ctypes import *
from my_debugger_defines import *

kernel32 = windll.kernel32

class debugger():
    def __init__(self):
        self.h_process = None
        self.pid = None
        self.debugger_active = False
    
    def load(self, path_to_exe):
        # dwCreation flag determines how process is created
        creation_flags = DEBUG_PROCESS

        # instantiate structs
        startupinfo = STARTUPINFO()
        process_information = PROCESS_INFORMATION()

        # Following: Allow process to be shown in seperate window
        startupinfo.dwflags = 0x1
        startupinfo.wShowWindow = 0x0

        # initialize cb variable to size of struct
        startupinfo.cb = sizeof(startupinfo)

        if kernel32.CreateProcessA(path_to_exe,
                                   None,
                                   None,
                                   None,
                                   None,
                                   creation_flags,
                                   None,
                                   None,
                                   byref(startupinfo),
                                   byref(process_information)):
            print "[*] We have successfull launched the process!"
            print "[*] PID: %d" % process_information.dwProcessId

            self.h_process = self.open_process(process_information.dwProcessId)
        else:
            print "[*] Error: 0x%08x." % kernel32.GetLastError()
    def open_process(self, pid):
        h_process = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
        return h_process

    def attach(self, pid):
        self.h_process = self.open_process(pid)

        # Try to attach to process. if it fails we exit
        resultAttach = kernel32.DebugActiveProcess(pid)
        error = kernel32.GetLastError()
        if resultAttach:
            self.debugger_active = True
            self.pid = int(pid)
            #self.run()
        else:
            self.error = kernel32.GetLastError()
            print "[*] Unable to attach to the process."
            print "[*] Error: 0x%08x." % kernel32.GetLastError()
    
    def run(self):
        # poll for debug events

        while self.debugger_active == True:
            self.get_debug_event()
    
    def get_debug_event(self):
        debug_event = DEBUG_EVENT()
        continue_status = DBG_CONTINUE

        if kernel32.WaitForDebugEvent(byref(debug_event), INFINATE):
            # No handlers yet
            # let process resume
            raw_input("Press a key to continue....")
            kernel32.ContinueDebugEvent(\
                debugEvent.dwProccessId,\
                debugEvent.dwThreadId,\
                continue_status)
    
    def detach(self):
        if kernel32.DebugActiveProcessStop(self.pid):
            print "[*] Finished debugging. Exitig..."
            return True
        else:
            print "There was an error"
            return False

  SteveIRQL   June 5, 2013 11:08.00 CDT
Given this is primarily Python, when you say that you are "stepping through it with VS", do you mean that you are debugging an application with the VS debugger while simultaneously trying to attach your own Python debugger?

Note: Registration is required to post to the forums.

There are 31,039 total registered users.


Recently Created Topics
Ultimate Hacking Cha...
Jun/21
CreateMutex
May/31
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Immunity Debugger Re...
Aug/03


Recent Forum Posts
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack


Recent Blog Entries
crystalwade
Jul/20
test

nieo
Mar/22
Android Application Reversing

halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit