Skip to content

Commit

Permalink
Merge remote-tracking branch 'origin/master' into dev
Browse files Browse the repository at this point in the history
  • Loading branch information
ndrewh committed Dec 26, 2024
2 parents d14e2de + 23847b2 commit 17a825a
Showing 1 changed file with 29 additions and 6 deletions.
35 changes: 29 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,9 @@ pyda examples/ltrace.py -- ls
```
### API

You can view all of the available APIs in [process.py](https://github.com/ndrewh/dynamorio-tool/blob/master/lib/pyda/process.py), but in summary:
You can view all of the available APIs in [process.py](https://github.com/ndrewh/pyda/blob/master/lib/pyda/process.py), but in summary:

Read/Modify Memory and Registers:

```py
# Read memory
Expand All @@ -138,13 +140,11 @@ p.regs.rax # (int)

# Write registers
p.regs.rax = 0x1337133713371337
```

# Get process base
p.maps["libc.so.6"].base # (int)

# Get current thread id (valid in hooks and thread entrypoint)
p.tid # (int), starts from 1
Hooks:

```py
# Hooks (functions called before executing the instruction at the specified PC)
p.hook(0x100000, lambda p: print(f"rsp={hex(p.regs.rsp)}"))

Expand All @@ -162,6 +162,29 @@ p.syscall_pre(1, lambda p, syscall_num: print(f"write about to be called with {p
p.syscall_post(1, lambda p, syscall_num: print(f"write called with {p.regs.rdx} bytes"))
```

Debugger-style "blocking" APIs:
```py
# Resumes the process until completion
p.run()

# Resumes the process until `pc` is reached
p.run_until(pc)

# pwntools tube APIs are overloaded:
# recvuntil(x) resumes the process until it reaches a "write" syscall
# that writes matching data
p.recvuntil(bstr)
```

Misc
```py
# Get process base
p.maps["libc.so.6"].base # (int)

# Get current thread id (valid in hooks and thread entrypoint)
p.tid # (int), starts from 1
```

### FAQ

**Why should I use this over GDB or other ptrace-based debuggers?**
Expand Down

0 comments on commit 17a825a

Please sign in to comment.