DbgScript Module

The dbgscript module provides a set of top-level APIs that serve as an entry point in obtaining other classes.

DbgScript.get_global(symbol) → TypedObject

Create a TypedObject from a global variable in the process identified by symbol. Symbol should be module-qualified for best results. E.g. foo!bar.

DbgScript.current_thread()

Get the current thread in the process.

DbgScript.create_typed_object(type, addr) → TypedObject

Create a TypedObject from an address and type.

Note

Prefer using the fully-qualfied type name (i.e. including the module prefix) as it will accelerate symbol lookup dramatically. I.e. module!Foo, not Foo.

DbgScript.create_typed_pointer(type, addr) → TypedObject

Create a pointer to a TypedObject from an address and type. Specify the base type for type. E.g. for an int*, pass int. This works for arbitrary buffers; arrays included.

Note

Prefer using the fully-qualfied type name (i.e. including the module prefix) as it will accelerate symbol lookup dramatically. I.e. module!Foo, not Foo.

New in version 1.0.5.

DbgScript.get_threads() → array of Thread

Get the collection of threads in the process.

DbgScript.read_ptr(addr) → Integer

Read a pointer value from the virtual address space of the target process. addr must be a valid (accessible) address. This will be 8 bytes on an x64 target.

DbgScript.read_string(addr[, count]) → String

Read an ANSI string from the target process starting at addr. count (optional) specifies the maximum number of characters to read.

New in version 1.0.4.

DbgScript.read_wide_string(addr[, count]) → String

Read a wide string from the target process starting at addr. count (optional) specifies the maximum number of characters to read.

New in version 1.0.4.

DbgScript.read_bytes(addr, count) → String

Read count bytes from addr.

New in version 1.0.3.

DbgScript.get_nearest_sym(addr) → String

Lookup the nearest symbol to address addr. Operates similar to the debugger ln command.

New in version 1.0.1.

DbgScript.get_peb() → Integer

Get the address of the current process’ PEB.

New in version 1.0.3.

DbgScript.field_offset(type, field) → Integer

Obtain the offset of field in type. Behaves like offsetof macro in C.

New in version 1.0.2.

DbgScript.get_type_size(type) → Integer

Obtain the size of type in bytes. Behaves like sizeof operator in C.

New in version 1.0.4.

DbgScript.search_memory(start, size, pattern, pattern_granularity) → Integer

Search the address space from [start, start + size) for pattern.

Parameters:
  • start (Integer) – Start of address space to search.
  • size (Integer) – Amount of bytes to search.
  • pattern (String) – Pattern to search for. pattern.size must be a multiple of pattern_granularity.
  • pattern_granularity (Integer) – Only consider matches at this granularity.
Returns:

location of match.
Return type:

Integer
Raises KeyError:
 

if no match found.

New in version 1.0.6.

DbgScript.start_buffering()

Start an output buffering session. All output from this point will be buffered in 8K chunks. This can help improve performance when writing a lot of content in a loop, as the WinDbg command window will not be redrawn after every line of output.

DbgScript.stop_buffering()

Stop an output buffering session. The buffer will also automatically be flushed on script terminaton, for any reason (unhandled exception or otherwise).

DbgScript.execute_command(cmd)

Executes a debugger command cmd and prints the output.

DbgScript.resolve_enum(enum, val) → String

Obtains the textual name of the enumerant given an enum enum and a value val.