Python PyFlxInstrument类代码示例

	def __init__(self, fromaddr, toaddr, nextaddr, process):
		self.fromaddr = fromaddr
		self.toaddr   = toaddr
		self.nextaddr = nextaddr
		self.process = process

		self.entrystate = PyFlxInstrument.registers()
		self.exitstate = None
		self.return_callbacks = []

		self.dllname = None
		self.name = None

	def handle_syscall(self, syscall):
		# NtCreateThread
		syscall_name = syscalls.getSyscallByNumber(syscall.number)
		if syscall_name is not None:
			if syscall_name == "NtTerminateProcess":
				self.os.terminating_processes.append((self,PyFlxInstrument.registers()["cr3"]))
				self.log(syscall_name)
				self.thread.terminate()
				self.logger.shutdown(self)
			if syscall_name == "NtCreateThread":
				self.logger.info("Creating Thread")
				self.log(syscall_name)
			if syscall_name == "NtTerminateThread":
				self.logger.info("Thread %d terminated"%self.cur_tid)
				self.log(syscall_name)
				self.thread.terminate()
			if syscall_name == "NtCreateProcess" or syscall_name == "NtCreateProcessEx":
				self.logger.info("New Process has been created by %s"%self.name)
				self.log(syscall_name)

	def breakpoint_insert(self, addr):
		PyFlxInstrument.breakpoint_insert(addr)

	def activate(self, pid, tid, procname):
		PyFlxInstrument.set_instrumentation_active(1)
		PyFlxInstrument.set_context(pid,tid, str(procname))

	def constsearch_pattern(self, pattern):
		PyFlxInstrument.constsearch_pattern(pattern)

	def functionentropy_disable(self):
		PyFlxInstrument.functionentropy_disable()

	def set_context(self, pid, tid):
		PyFlxInstrument.set_context(pid, tid)

	def arithwindow_disable(self):
		PyFlxInstrument.arithwindow_disable()

	def memtrace_disable(self):
		PyFlxInstrument.memtrace_disable()

	def read_process(self, process, address, len):
		try:
			return PyFlxInstrument.vmem_read_process(process.cr3, address, len)
		except RuntimeError:
			return None

	def vmem_read(self, n):
		return PyFlxInstrument.vmem_read(n, 4096)

	def dump_disable(self):
		PyFlxInstrument.dump_disable()

	def dump_enable(self, path):
		PyFlxInstrument.dump_enable(path)

	def deactivate(self):
		PyFlxInstrument.set_instrumentation_active(0)

	def syscall_hook(self, number):
		PyFlxInstrument.syscall_hook(number)