From a30ae416cc0e6f4a57a9365546af853abefba8c9 Mon Sep 17 00:00:00 2001 From: Mihail Ivanchev Date: Tue, 11 Feb 2020 15:42:51 +0100 Subject: [PATCH] Thread.get_linear_address accepts descriptor index as well as segment register name; extended docs. --- winappdbg/thread.py | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/winappdbg/thread.py b/winappdbg/thread.py index b93825cb..a645fa2d 100644 --- a/winappdbg/thread.py +++ b/winappdbg/thread.py @@ -960,8 +960,8 @@ def get_linear_address(self, segment, address): Linear addresses can be used to access a process memory, calling L{Process.read} and L{Process.write}. - @type segment: str - @param segment: Segment register name. + @type segment: str or long + @param segment: Segment register name or DWORD descriptor table index. @type address: int @param address: Segment relative memory address. @@ -975,8 +975,22 @@ def get_linear_address(self, segment, address): The current architecture does not support selectors. Selectors only exist in x86-based systems. """ + + selector = None + + if isinstance(segment, str): + selector = self.get_register(segment) + elif isinstance(segment, long): + if segment < 0 or segment > 0xFFFFFFFF: + msg = "Descriptor table index %d is an invalid DWORD." + msg = msg % segment + raise ValueError(msg) + + selector = segment + else: + raise ValueError("Argument 'segment' must be a string or a DWORD.") + hThread = self.get_handle(win32.THREAD_QUERY_INFORMATION) - selector = self.get_register(segment) ldt = win32.GetThreadSelectorEntry(hThread, selector) BaseLow = ldt.BaseLow BaseMid = ldt.HighWord.Bytes.BaseMid << 16