Main guide is here: http://winappdbg.readthedocs.io/en/latest/ProgrammingGuide.html
Generally you want to debug 32-bit applications in 32-bit Python. You can have both of them together on one machine. When installing the 2nd Python, uncheck
register extensions in the installer. On a VM it does not really matter because you can install/uninstall Python 32 and 64 bit versions at will.
Pip installed version 1.5.
To get 1.6, we use the github repo at https://github.com/MarioVilas/winappdbg. Clone and run
According to the installation documentation we may benefit from additional software.
python -m pip install capstone-windows
- distorm3: Download binaries from release page https://github.com/gdabah/distorm/releases
Has installers for the rest.
This is what I want:
from winappdbg.win32 import * # Create a snapshot of the process, only take the heap list. hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPHEAPLIST, pid )
- All memory read stuff are at:
- Use built-in Table:
table = Table("|")we can add separator here.
- Logger class: