0

我正在尝试使用 windbg 和 pykd 编写堆跟踪器，但是在尝试设置回调时出现 TypeError。

这是代码的一部分：


def enter_call_back(bp):
    print "RtlAllocateHeap called"
    return False

def return_call_back(bp):
    print "RtlAllocateHeap returned"
    return False



add = get_address("ntdll!RtlAllocateHeap")
bp_init = pykd.setBp(int(add, 16), enter_call_back)
bp_end = None

当我尝试运行它时，我收到以下错误：

0:000> !py C:\Users\tobbe\Documents\Projects\HeapTrace\heap_trace.py
hej


TypeError: enter_call_back() takes exactly 1 argument (0 given)

我正在使用python 2.7版；

0:000> !py
Python 2.7.14 (v2.7.14:84471935ed, Sep 16 2017, 20:19:30) [MSC v.1500 32 bit (Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)

和 pykd 版本 2.0.0.22

0:000> !pykd.info

pykd bootstrapper version: 2.0.0.22

Installed python:

Version:        Status:     Image:
------------------------------------------------------------------------------
* 2.7 x86-32    Unloaded    C:\WINDOWS\SYSTEM32\python27.dll
  3.7 x86-32    Unloaded    C:\Users\Tobias.Lorek\AppData\Local\Programs\Python\Python37-32\python37.dll

我最初尝试遵循以下教程，但遇到了类似的错误，https://labs.f-secure.com/archive/heap-tracing-with-windbg-and-python/

任何帮助，将不胜感激。

问候，

4

1 回答 1

1

enter_call_back 不应该没有参数。

请参阅 pykd 测试中的示例： https ://githomelab.ru/pykd/pykd/blob/0.3.2/test/scripts/breakpoint.py#L67

 def stopOnBreak():
     return pykd.eventResult.Break

 def testBreakCallback(self):
      breakCount = callCounter(stopOnBreak)
      bp = pykd.setBp( self.targetModule.CdeclFunc, breakCount )
      self.assertEqual( pykd.executionStatus.Break, pykd.go() )
      self.assertEqual( 1, breakCount.count )
于 2019-10-07T20:56:26.353 回答