Skip to content

Proc

EventHandler

The event types that make sense for us to track in the process driver aren't the same as the ones in the rest of Pwndbg, so we just expose the native events in process driver, and let the rest of the REPL deal with any complexities that might arise from the translation.

This is mostly intended to keep the complexity of generating the START and NEW_THREAD events correctly out of the process driver.

created()

This function is called when a process is created or attached to.

exited()

This function is called when a process terminates or is detached from.

modules_loaded()

This function is called when a new modules have been loaded.

resumed()

This function is called when the execution of a process is resumed.

suspended()

This function is called when the execution of a process is suspended.

ProcessDriver

Drives the execution of a process, responding to its events and handling its I/O, and exposes a simple synchronous interface to the REPL interface.

debug: bool = debug instance-attribute

eh: EventHandler = event_handler instance-attribute

io: IODriver = None instance-attribute

listener: lldb.SBListener = None instance-attribute

process: lldb.SBProcess = None instance-attribute

__init__(event_handler, debug=False)

connect(target, io, url, plugin)

Connects to a remote proces with the given URL using the plugin with the given name, and attaches to the process until LLDB issues a start event to us.

Potentially fires all types of events, as it is not known when LLDB will return control of the process to us.

cont()

Continues execution of the process this object is driving, and returns whenever the process stops.

has_process()

Whether there's an active process in this driver.

interrupt()

launch(target, io, env, args, working_dir)

Launches the process and handles startup events. Always stops on first opportunity, and returns immediately after the process has stopped.

Fires the created() event.

run_coroutine(coroutine)

Runs the given coroutine and allows it to control the execution of the process in this driver. Returns True if the coroutine ran to completion, and False if it was cancelled.

run_lldb_command(command)

Runs the given LLDB command and ataches I/O if necessary.