Page 31:
In function attach(): remove the self.run()
Page 31:
In function "open_process" the parameters need to be flipped
so that it reads like this: "kernel32.OpenProcess( PROCESS_ALL_ACCESS,
False, pid)
Page 37:
In function enumerate_threads(): the following two lines need
to be indented BACK to be in line with the "while success:" line
kernel32.CloseHandle(snapshot)
return thread_list
Page 37:
The declaration "def get_thread_context( self, thread_id ):"
needs to be changed to "def get_thread_context( self,thread_id=None,
h_thread=None)"
Page 37:
The get_thread_context function should include a check if the h_thread
parameter isn't passed to it:
def get_thread_context(self, thread_id=None, h_thread=None):
context = CONTEXT()
context.ContextFlags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS
if not h_thread:
self.open_thread(thread_id)
Page 42:
In function get_debug_event() the line that reads:
"self.context = self.get_thread_context(self.h_thread)" needs to be
changed to "self.context = self.get_thread_context(h_thread=self.h_thread)"
Page 42:
In function get_debug_event(): all the lines from "if
exception == EXCEPTION_ACCESS_VIOLATION:" to "print "Single Stepping""
need to be indented IN so they are inside the "if
debug_event.dwDebugEventCode == EXCEPTION_DEBUG_EVENT:"
Page 42:
In function get_debug_event(): all instances of "ec" variable
should be changed to "exception"
Page 42:
The function declaration "def exception_handler_breakpoint()"
needs to include the "self" parameter, like so: "def
exception_handler_breakpoint(self)"
Page 44:
The function bp_set(), the line "self.breakpoints[address] =
(address,original_byte) needs to be changed to
"self.breakpoints[address] = (original_byte)
Page 48:
In function bp_set_hw() the lines starting at "if available ==
0:" and ending at "kernel32.SetThreadContext( h_thread, byref(context))"
need to be indented IN so that they are inside the preceding "for
thread_id in self.enumerate_threads():" loop
