Module iathook

source code

Code for hooking import address tables by making them invalid pointers and catching the exceptions...

Classes

[hide private]

IatHook
Abuse the PageWatch subsystem to allow function pointers to be frob'd to create breakpoint like behavior.

Functions

[hide private]

hookIat(trace, libname, implib='*', impfunc='*', fast=False)
Hook the IAT with special "breakpoint" like objects which handle the memory access errors and document the calls... source code

Variables

[hide private]

__package__ = 'vtrace.tools'

Function Details

[hide private]

hookIat(trace, libname, implib=`''`, impfunc=`''`, fast=False)

source code


Hook the IAT with special "breakpoint" like objects which
handle the memory access errors and document the calls...
Set fast=True for them to be "Fastbreak" breakpoints.

This returns a list of (name, bpid) tuples...

Example:
    for impname, bpid in hookIat(t, 'ws2_32')
        t.setBreakpointCode(bpid, codestr)
        ...

Module iathook

hookIat(trace, libname, implib='*', impfunc='*', fast=False)

hookIat(trace, libname, implib=`''`, impfunc=`''`, fast=False)