libdebug.architectures package

Subpackages

• libdebug.architectures.amd64 package
  • Submodules
  • libdebug.architectures.amd64.amd64_ptrace_hw_bp_helper module
    • Amd64PtraceHardwareBreakpointManager
      • Amd64PtraceHardwareBreakpointManager.thread
      • Amd64PtraceHardwareBreakpointManager.peek_user
      • Amd64PtraceHardwareBreakpointManager.poke_user
      • Amd64PtraceHardwareBreakpointManager.breakpoint_count
      • Amd64PtraceHardwareBreakpointManager.install_breakpoint()
      • Amd64PtraceHardwareBreakpointManager.remove_breakpoint()
      • Amd64PtraceHardwareBreakpointManager.available_breakpoints()
      • Amd64PtraceHardwareBreakpointManager.is_watchpoint_hit()
  • libdebug.architectures.amd64.amd64_ptrace_register_holder module
    • Amd64PtraceRegisterHolder
      • Amd64PtraceRegisterHolder.provide_regs_class()
      • Amd64PtraceRegisterHolder.apply_on_regs()
      • Amd64PtraceRegisterHolder.apply_on_thread()
  • libdebug.architectures.amd64.amd64_registers module
    • Amd64Registers
  • libdebug.architectures.amd64.amd64_stack_unwinder module
    • Amd64StackUnwinder
      • Amd64StackUnwinder.unwind()
      • Amd64StackUnwinder.get_return_address()
  • libdebug.architectures.amd64.amd64_syscall_hijacker module
    • Amd64SyscallHijacker
      • Amd64SyscallHijacker.allowed_args
      • Amd64SyscallHijacker.create_hijacker()
  • Module contents

Submodules

libdebug.architectures.ptrace_hardware_breakpoint_manager module

class libdebug.architectures.ptrace_hardware_breakpoint_manager.PtraceHardwareBreakpointManager(thread: ThreadContext, peek_user: Callable[[int, int], int], poke_user: Callable[[int, int, int], None])

Bases: ABC

An architecture-independent interface for managing hardware breakpoints.

thread

The target thread.

Type:

ThreadContext

peek_user

A function that reads a number of bytes from the target thread registers.

Type:

callable

poke_user

A function that writes a number of bytes to the target thread registers.

Type:

callable

breakpoint_count

The number of hardware breakpoints set.

Type:

int

abstract install_breakpoint(bp: Breakpoint) → None

Installs a hardware breakpoint at the provided location.

abstract remove_breakpoint(bp: Breakpoint) → None

Removes a hardware breakpoint at the provided location.

abstract available_breakpoints() → int

Returns the number of available hardware breakpoint registers.

abstract is_watchpoint_hit() → Breakpoint | None

Checks if a watchpoint has been hit.

Returns:

The watchpoint that has been hit, or None if no watchpoint has been hit.

Return type:

Breakpoint | None

libdebug.architectures.ptrace_hardware_breakpoint_provider module

libdebug.architectures.ptrace_hardware_breakpoint_provider.ptrace_hardware_breakpoint_manager_provider(thread: ThreadContext, peek_user: Callable[[int, int], int], poke_user: Callable[[int, int, int], None]) → PtraceHardwareBreakpointManager

Returns an instance of the hardware breakpoint manager to be used by the _InternalDebugger class.

libdebug.architectures.ptrace_software_breakpoint_patcher module

libdebug.architectures.ptrace_software_breakpoint_patcher.software_breakpoint_byte_size() → int

Return the size of a software breakpoint instruction.

libdebug.architectures.register_helper module

libdebug.architectures.register_helper.register_holder_provider(register_file: object, _: Callable[[], object] | None = None, __: Callable[[object], None] | None = None) → RegisterHolder

Returns an instance of the register holder to be used by the _InternalDebugger class.

libdebug.architectures.stack_unwinding_manager module

class libdebug.architectures.stack_unwinding_manager.StackUnwindingManager

Bases: ABC

An architecture-independent interface for stack unwinding.

abstract unwind(target: ThreadContext) → list

Unwind the stack of the target process.

abstract get_return_address(target: ThreadContext) → int

Get the return address of the current function.

libdebug.architectures.stack_unwinding_provider module

libdebug.architectures.stack_unwinding_provider.stack_unwinding_provider() → StackUnwindingManager

Returns an instance of the stack unwinding provider to be used by the _InternalDebugger class.

libdebug.architectures.syscall_hijacking_manager module

class libdebug.architectures.syscall_hijacking_manager.SyscallHijackingManager

Bases: ABC

An architecture-independent interface for syscall hijacking.

abstract create_hijacker(new_syscall: int, **kwargs: int) → Callable[[ThreadContext, int], None]

Create a new hijacker for the given syscall.

libdebug.architectures.syscall_hijacking_provider module

libdebug.architectures.syscall_hijacking_provider.syscall_hijacking_provider() → SyscallHijackingManager

Returns an instance of the syscall hijacking provider to be used by the _InternalDebugger class.

Module contents