Package vtrace :: Package tools :: Module iathook :: Class IatHook

Class IatHook

breakpoints.Breakpoint --+    
                         |    
    watchpoints.Watchpoint --+
                             |
                            IatHook

Abuse the PageWatch subsystem to allow function pointers to be frob'd to create breakpoint like behavior.

Instance Methods

[hide private]

__init__(self, ptraddr, iatname)

source code

getName(self)

source code

resolveAddr(self, trace, addr)

source code

activate(self, trace)
Actually store off and replace memory for this process.

source code

deactivate(self, trace)
Repair the process for continued execution.

source code

notify(self, event, trace)
Breakpoints may also extend and implement "notify" which will be called whenever they are hit.

source code

Inherited from watchpoints.Watchpoint: inittrace, resolvedaddr

Inherited from breakpoints.Breakpoint: __repr__, getAddress, getBreakpointCode, getId, isEnabled, resolveAddress, setBreakpointCode, setEnabled

Class Variables

[hide private]

newptr = 4227592192

Inherited from breakpoints.Breakpoint: bpcodeobj

Method Details

[hide private]

Actually store off and replace memory for this process. This is caried out by the trace object itself when it begins running or stops. You probably never need to call this (see isEnabled() setEnabled() for boolean enable/disablle)

Overrides: breakpoints.Breakpoint.activate: (inherited documentation)

deactivate(self, trace)

source code

Repair the process for continued execution. this does NOT make a breakpoint *inactive*, but removes it's "0xcc" from mem (see isEnabled() setEnabled() for boolean enable/dissable)

Overrides: breakpoints.Breakpoint.deactivate: (inherited documentation)

notify(self, event, trace)

source code

Breakpoints may also extend and implement "notify" which will be called whenever they are hit. If you want to continue the ability for this breakpoint to have bpcode, you must call this method from your override.

Overrides: breakpoints.Breakpoint.notify: (inherited documentation)

Class IatHook

__init__(self, ptraddr, iatname) (Constructor)

getName(self)

activate(self, trace)

deactivate(self, trace)

notify(self, event, trace)

init(self, ptraddr, iatname)
(Constructor)