Win 64位GetThreadContext返回零输出寄存器，或0x57 errocd

Question

我在Windows7 64位计算机上工作（我有管理员权限）。在

我使用python2.7（64位）和PyDev cypes for Eclipse来尝试读取与特定PID相关联的所有线程中的寄存器值（尝试了在64位和32位模式下运行的进程的PID），但是当我这样做时，寄存器的值都是零。当我使用Wow64GetThreadContext时，调用失败，GetLastError返回0x00000057（'根据MSDN，'无效参数'）

我成功地附加到进程，枚举线程（通过CreateToolhelp32Snapshot），找到进程拥有的线程，并尝试获取线程上下文。下面是我打开线程并获取线程上下文的代码：

打开线程：

def open_thread(self, thread_id):
    h_thread = kernel32.OpenThread(THREAD_ALL_ACCESS, None, thread_id)

获取上下文：

^{pr2}$

我将此代码称为：

debugger.attach(int(pid))

#debugger.run()

list = debugger.enumerate_threads()

for thread in list:
thread_context = debugger.get_thread_context(thread)

    if thread_context == False:
        print "[*] Thread context is false..."
    else:
        print "[*] Dumping registers for thread ID: 0x%08x" % thread
        print "[**] Eip: 0x%016x" % thread_context.Eip
        print "[**] Esp: 0x%016x" % thread_context.Esp
        print "[**] Ebp: 0x%016x" % thread_context.Ebp
        print "[**] Eax: 0x%016x" % thread_context.Eax
        print "[**] Ebx: 0x%016x" % thread_context.Ebx
        print "[**] Ecx: 0x%016x" % thread_context.Ecx
        print "[**] Edx: 0x%016x" % thread_context.Edx
        print "[*] End DUMP"

debugger.detach()

当我使用GetThreadContext和上下文结构运行这段代码时，我会为每个线程返回上下文对象，但是寄存器值都是零。在

我尝试过将GetThreadContext替换为Wow64GetThreadContext（并且分别将SuspendThread替换为Wow64SuspendThread），但是当我这样做时，调用失败，并出现错误“invalid parameters”。我给Wow64GetThreadContext的参数与我给GetThreadContext的参数相同，而不是我提供的代码中变量的名称（这是因为当我在WinNT.h中查看它们的定义时，它们是等价的（除非我遗漏了什么）。我用以下方式定义了这些结构：

class WOW64_CONTEXT(Structure):
_fields_ = [

    ("ContextFlags", DWORD),
    ("Dr0", DWORD),
    ("Dr1", DWORD),
    ("Dr2", DWORD),
    ("Dr3", DWORD),
    ("Dr6", DWORD),
    ("Dr7", DWORD),
    ("FloatSave", WOW64_FLOATING_SAVE_AREA),
    ("SegGs", DWORD),
    ("SegFs", DWORD),
    ("SegEs", DWORD),
    ("SegDs", DWORD),
    ("Edi", DWORD),
    ("Esi", DWORD),
    ("Ebx", DWORD),
    ("Edx", DWORD),
    ("Ecx", DWORD),
    ("Eax", DWORD),
    ("Ebp", DWORD),
    ("Eip", DWORD),
    ("SegCs", DWORD),
    ("EFlags", DWORD),
    ("Esp", DWORD),
    ("SegSs", DWORD),
    ("ExtendedRegisters", BYTE * 512),
]

class WOW64_FLOATING_SAVE_AREA(Structure):
_fields_ = [

    ("ControlWord", DWORD),
    ("StatusWord", DWORD),
    ("TagWord", DWORD),
    ("ErrorOffset", DWORD),
    ("ErrorSelector", DWORD),
    ("DataOffset", DWORD),
    ("DataSelector", DWORD),
    ("RegisterArea", BYTE * 80),
    ("Cr0NpxState", DWORD),
]

class CONTEXT(Structure):
_fields_ = [

    ("ContextFlags", DWORD),
    ("Dr0", DWORD),
    ("Dr1", DWORD),
    ("Dr2", DWORD),
    ("Dr3", DWORD),
    ("Dr6", DWORD),
    ("Dr7", DWORD),
    ("FloatSave", FLOATING_SAVE_AREA),
    ("SegGs", DWORD),
    ("SegFs", DWORD),
    ("SegEs", DWORD),
    ("SegDs", DWORD),
    ("Edi", DWORD),
    ("Esi", DWORD),
    ("Ebx", DWORD),
    ("Edx", DWORD),
    ("Ecx", DWORD),
    ("Eax", DWORD),
    ("Ebp", DWORD),
    ("Eip", DWORD),
    ("SegCs", DWORD),
    ("EFlags", DWORD),
    ("Esp", DWORD),
    ("SegSs", DWORD),
    ("ExtendedRegisters", BYTE * 512),
]

class FLOATING_SAVE_AREA(Structure):
_fields_ = [

    ("ControlWord", DWORD),
    ("StatusWord", DWORD),
    ("TagWord", DWORD),
    ("ErrorOffset", DWORD),
    ("ErrorSelector", DWORD),
    ("DataOffset", DWORD),
    ("DataSelector", DWORD),
    ("RegisterArea", BYTE * 80),
    ("Cr0NpxState", DWORD),
]

关于这个问题，我在谷歌上做了大量的搜索，但没有成功：

• 根据MSDN上的一条评论：CONTEXT_FULL应该是 CONTEXT_AMD64 | CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_FLOATING_POINT与Win64一起正确使用。

• 我试着在我的上下文和WOW_64CONTEXT中重命名寄存器 结构，将寄存器名中的“E”替换为“R”（Eax ->；Rax等）

有没有人用Python和cypes成功地获取了Windows上64位线程的上下文？在

Answer 1

主要问题是WOW64实际上是32位上下文，而不是64位上下文。您需要实现一个64位结构，类似于：

class CONTEXT64(Structure):
_pack_ = 16
_fields_ = [
    ("P1Home", DWORD64),
    ("P2Home", DWORD64),
    ("P3Home", DWORD64),
    ("P4Home", DWORD64),
    ("P5Home", DWORD64),
    ("P6Home", DWORD64),

    ("ContextFlags", DWORD),
    ("MxCsr", DWORD),

    ("SegCs", WORD),
    ("SegDs", WORD),
    ("SegEs", WORD),
    ("SegFs", WORD),
    ("SegGs", WORD),
    ("SegSs", WORD),
    ("EFlags", DWORD),

    ("Dr0", DWORD64),
    ("Dr1", DWORD64),
    ("Dr2", DWORD64),
    ("Dr3", DWORD64),
    ("Dr6", DWORD64),
    ("Dr7", DWORD64),

    ("Rax", DWORD64),
    ("Rcx", DWORD64),
    ("Rdx", DWORD64),
    ("Rbx", DWORD64),
    ("Rsp", DWORD64),
    ("Rbp", DWORD64),
    ("Rsi", DWORD64),
    ("Rdi", DWORD64),
    ("R8", DWORD64),
    ("R9", DWORD64),
    ("R10", DWORD64),
    ("R11", DWORD64),
    ("R12", DWORD64),
    ("R13", DWORD64),
    ("R14", DWORD64),
    ("R15", DWORD64),
    ("Rip", DWORD64),

    ("DebugControl", DWORD64),
    ("LastBranchToRip", DWORD64),
    ("LastBranchFromRip", DWORD64),
    ("LastExceptionToRip", DWORD64),
    ("LastExceptionFromRip", DWORD64),

    ("DUMMYUNIONNAME", DUMMYUNIONNAME),

    ("VectorRegister", M128A * 26),
    ("VectorControl", DWORD64)
]

注意：这个定义位于WinNT.h中，如果您安装了VC++，它将位于安装它的/include目录中。在

一旦构建了这个结构，您就可以使用它来代替您构建的CONTEXT/WOW64上下文。你还得把寄存器改成RAX等等

（注意：在Python ctypes中还需要实现4个其他功能：DWORD64、M128A、DUMMYUNIONNAME、DUMMYSTRUCTNAME和XMM_SAVE_AREA32。为了简洁起见，我排除了它们，但是您可以在以下位置找到它们的定义，以便自己构建它们：

德沃德64：只是一个乌龙龙龙

DUMMYUNIONNAME，DUMMYSTRUCTNAME:在\u CONTEXT结构的WinNT.h中

M128A:http://winappdbg.sourceforge.net/doc/v1.3/winappdbg.win32.defines.M128A-class.html

XMM_SAVE_区域32:http://winappdbg.sourceforge.net/doc/v1.3/winappdbg.win32.context_amd64.XMM_SAVE_AREA32-class.html

Answer 2

检查ContextFlags常量的值。我从python模块win32con得到的值缺少依赖于体系结构的位。这是从my WinNT.h（来自Windows SDK Server2003SP1）的摘录：

#define CONTEXT_AMD64   0x100000

// end_wx86

#define CONTEXT_CONTROL (CONTEXT_AMD64 | 0x1L)
#define CONTEXT_INTEGER (CONTEXT_AMD64 | 0x2L)
#define CONTEXT_SEGMENTS (CONTEXT_AMD64 | 0x4L)
#define CONTEXT_FLOATING_POINT  (CONTEXT_AMD64 | 0x8L)
#define CONTEXT_DEBUG_REGISTERS (CONTEXT_AMD64 | 0x10L)

#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_FLOATING_POINT)

#define CONTEXT_ALL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS)

[...]

#define CONTEXT_i386    0x00010000    // this assumes that i386 and
#define CONTEXT_i486    0x00010000    // i486 have identical context records

// end_wx86

#define CONTEXT_CONTROL         (CONTEXT_i386 | 0x00000001L) // SS:SP, CS:IP, FLAGS, BP
#define CONTEXT_INTEGER         (CONTEXT_i386 | 0x00000002L) // AX, BX, CX, DX, SI, DI
#define CONTEXT_SEGMENTS        (CONTEXT_i386 | 0x00000004L) // DS, ES, FS, GS
#define CONTEXT_FLOATING_POINT  (CONTEXT_i386 | 0x00000008L) // 387 state
#define CONTEXT_DEBUG_REGISTERS (CONTEXT_i386 | 0x00000010L) // DB 0-3,6,7
#define CONTEXT_EXTENDED_REGISTERS  (CONTEXT_i386 | 0x00000020L) // cpu specific extensions

#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER |\
                      CONTEXT_SEGMENTS)

#define CONTEXT_ALL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS)

如果不适合您，请检查windows版本的WinNT.h。在

Answer 3

我也有这个问题，我现在有了这个问题，我假设这是从格雷帽子的python书，经过大量的google搜索，发现Wow64GetThreadContext用于检索64位系统上的32位线程上下文，我使用了原始的GetThreadContext函数，但我传递给它的是一个定义如下的Wow64Context结构：

class M128A(Structure):
    _fields_ = [
            ("Low", DWORD64),
            ("High", DWORD64)
            ] 

class XMM_SAVE_AREA32(Structure):
    _pack_ = 1 
    _fields_ = [  
                ('ControlWord', WORD), 
                ('StatusWord', WORD), 
                ('TagWord', BYTE), 
                ('Reserved1', BYTE), 
                ('ErrorOpcode', WORD), 
                ('ErrorOffset', DWORD), 
                ('ErrorSelector', WORD), 
                ('Reserved2', WORD), 
                ('DataOffset', DWORD), 
                ('DataSelector', WORD), 
                ('Reserved3', WORD), 
                ('MxCsr', DWORD), 
                ('MxCsr_Mask', DWORD), 
                ('FloatRegisters', M128A * 8), 
                ('XmmRegisters', M128A * 16), 
                ('Reserved4', BYTE * 96)
                ] 

class DUMMYSTRUCTNAME(Structure):
    _fields_=[
              ("Header", M128A * 2),
              ("Legacy", M128A * 8),
              ("Xmm0", M128A),
              ("Xmm1", M128A),
              ("Xmm2", M128A),
              ("Xmm3", M128A),
              ("Xmm4", M128A),
              ("Xmm5", M128A),
              ("Xmm6", M128A),
              ("Xmm7", M128A),
              ("Xmm8", M128A),
              ("Xmm9", M128A),
              ("Xmm10", M128A),
              ("Xmm11", M128A),
              ("Xmm12", M128A),
              ("Xmm13", M128A),
              ("Xmm14", M128A),
              ("Xmm15", M128A)
              ]


class DUMMYUNIONNAME(Union):
    _fields_=[
              ("FltSave", XMM_SAVE_AREA32),
              ("DummyStruct", DUMMYSTRUCTNAME)
              ]

class CONTEXT64(Structure):
    _pack_ = 16
    _fields_ = [
                ("P1Home", DWORD64),
                ("P2Home", DWORD64),
                ("P3Home", DWORD64),
                ("P4Home", DWORD64),
                ("P5Home", DWORD64),
                ("P6Home", DWORD64),
                ("ContextFlags", DWORD),
                ("MxCsr", DWORD),
                ("SegCs", WORD),
                ("SegDs", WORD),
                ("SegEs", WORD),
                ("SegFs", WORD),
                ("SegGs", WORD),
                ("SegSs", WORD),
                ("EFlags", DWORD),
                ("Dr0", DWORD64),
                ("Dr1", DWORD64),
                ("Dr2", DWORD64),
                ("Dr3", DWORD64),
                ("Dr6", DWORD64),
                ("Dr7", DWORD64),
                ("Rax", DWORD64),
                ("Rcx", DWORD64),
                ("Rdx", DWORD64),
                ("Rbx", DWORD64),
                ("Rsp", DWORD64),
                ("Rbp", DWORD64),
                ("Rsi", DWORD64),
                ("Rdi", DWORD64),
                ("R8", DWORD64),
                ("R9", DWORD64),
                ("R10", DWORD64),
                ("R11", DWORD64),
                ("R12", DWORD64),
                ("R13", DWORD64),
                ("R14", DWORD64),
                ("R15", DWORD64),
                ("Rip", DWORD64),
                ("DebugControl", DWORD64),
                ("LastBranchToRip", DWORD64),
                ("LastBranchFromRip", DWORD64),
                ("LastExceptionToRip", DWORD64),
                ("LastExceptionFromRip", DWORD64),
                ("DUMMYUNIONNAME", DUMMYUNIONNAME),
                ("VectorRegister", M128A * 26),
                ("VectorControl", DWORD64)
]

当然，我还没有检查寄存器中返回的值是正确的还是只是垃圾，但是值存在而不是0x00000000或错误0x57这一事实令人放心。在

访问寄存器仍然是通过线程完成的_上下文。Rip等等，不是eip