2.5. Exception and Context related structures¶
This module regroups all the Exception/Context related structures and functions.
Most of the structures are the Windows structure with a prefix E
(For enhanced)
Those structure have the same fields that the normal windows ones but their types might vary for a simpler use.
This module also define the decorator VectoredException()
which allows to play with Vectored Exception Handler
in Python
Note
See sample VectoredException() samples
2.5.1. Exception Records¶
-
class
windows.winobject.exception.
EEXCEPTION_RECORD
[source]¶ Enhanced exception record
-
fields
= ['ExceptionCode', 'ExceptionFlags', 'ExceptionRecord', 'ExceptionAddress', 'NumberParameters', 'ExceptionInformation']¶ The fields of the structure
-
-
class
windows.winobject.exception.
EEXCEPTION_RECORD32
[source]¶ Enhanced exception record (32bits)
-
fields
= ['ExceptionCode', 'ExceptionFlags', 'ExceptionRecord', 'ExceptionAddress', 'NumberParameters', 'ExceptionInformation']¶ The fields of the structure
-
2.5.2. EXCEPTION DEBUG INFO¶
-
class
windows.winobject.exception.
EEXCEPTION_DEBUG_INFO32
[source]¶ Enhanced Debug info
-
ExceptionRecord
¶ Type: EEXCEPTION_RECORD32
-
fields
= ['ExceptionRecord', 'dwFirstChance']¶ The fields of the structure
-
-
class
windows.winobject.exception.
EEXCEPTION_DEBUG_INFO64
[source]¶ Enhanced Debug info
-
ExceptionRecord
¶ Type: EEXCEPTION_RECORD64
-
fields
= ['ExceptionRecord', 'dwFirstChance']¶ The fields of the structure
-
2.5.3. Context¶
-
class
windows.winobject.exception.
ECONTEXT32
[source]¶ -
-
dump
(to_dump=None)¶ Dump (print) the current context
-
fields
= ['ContextFlags', 'Dr0', 'Dr1', 'Dr2', 'Dr3', 'Dr6', 'Dr7', 'FloatSave', 'SegGs', 'SegFs', 'SegEs', 'SegDs', 'Edi', 'Esi', 'Ebx', 'Edx', 'Ecx', 'Eax', 'Ebp', 'Eip', 'SegCs', 'EFlags', 'Esp', 'SegSs', 'ExtendedRegisters']¶ The fields of the structure
-
func_result
¶ Function Resultat register (EAX or RAX)
-
pc
¶ Program Counter register (EIP or RIP)
-
regs
(to_dump=None)¶ Return the name and values of the registers
Returns: [(reg_name, value)] – A list
oftuple
-
sp
¶ Stack Pointer register (ESP or RSP)
-
-
class
windows.winobject.exception.
ECONTEXTWOW64
[source]¶ -
-
dump
(to_dump=None)¶ Dump (print) the current context
-
fields
= ['ContextFlags', 'Dr0', 'Dr1', 'Dr2', 'Dr3', 'Dr6', 'Dr7', 'FloatSave', 'SegGs', 'SegFs', 'SegEs', 'SegDs', 'Edi', 'Esi', 'Ebx', 'Edx', 'Ecx', 'Eax', 'Ebp', 'Eip', 'SegCs', 'EFlags', 'Esp', 'SegSs', 'ExtendedRegisters']¶ The fields of the structure
-
func_result
¶ Function Resultat register (EAX or RAX)
-
pc
¶ Program Counter register (EIP or RIP)
-
regs
(to_dump=None)¶ Return the name and values of the registers
Returns: [(reg_name, value)] – A list
oftuple
-
sp
¶ Stack Pointer register (ESP or RSP)
-
-
class
windows.winobject.exception.
ECONTEXT64
[source]¶ -
-
dump
(to_dump=None)¶ Dump (print) the current context
-
fields
= ['P1Home', 'P2Home', 'P3Home', 'P4Home', 'P5Home', 'P6Home', 'ContextFlags', 'MxCsr', 'SegCs', 'SegDs', 'SegEs', 'SegFs', 'SegGs', 'SegSs', 'EFlags', 'Dr0', 'Dr1', 'Dr2', 'Dr3', 'Dr6', 'Dr7', 'Rax', 'Rcx', 'Rdx', 'Rbx', 'Rsp', 'Rbp', 'Rsi', 'Rdi', 'R8', 'R9', 'R10', 'R11', 'R12', 'R13', 'R14', 'R15', 'Rip', 'DUMMYUNIONNAME', 'VectorRegister', 'VectorControl', 'DebugControl', 'LastBranchToRip', 'LastBranchFromRip', 'LastExceptionToRip', 'LastExceptionFromRip']¶ The fields of the structure
-
func_result
¶ Function Resultat register (EAX or RAX)
-
classmethod
new_aligned
()[source]¶ Return a new
ECONTEXT64
aligned on 16 bitstemporary workaround or horrible hack ? choose your side
-
pc
¶ Program Counter register (EIP or RIP)
-
regs
(to_dump=None)¶ Return the name and values of the registers
Returns: [(reg_name, value)] – A list
oftuple
-
sp
¶ Stack Pointer register (ESP or RSP)
-
2.5.4. EXCEPTION POINTERS¶
-
class
windows.winobject.exception.
EEXCEPTION_POINTERS
[source]¶ -
ExceptionRecord
¶ Type: POINTER to EEXCEPTION_RECORD
-
ContextRecord
¶ Type: POINTER to ECONTEXT32
orECONTEXT64
-
2.5.5. Vectored Exception¶
Note
See sample VectoredException()