@@ -14,7 +14,6 @@ detailed explanation of the underlying protocol, which takes as input the
14
14
executed. This information supports independent reimplementation of the
15
15
protocol, regardless of programming language.
16
16
17
-
18
17
.. warning ::
19
18
20
19
The execution of the injected script depends on the interpreter reaching a
@@ -149,10 +148,11 @@ To find the ``PyRuntime`` structure on Windows:
149
148
<https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-module32next> `_.
150
149
2. Identify the module corresponding to :file: `python.exe ` or
151
150
:file: `python{ XY } .dll `, where ``X `` and ``Y `` are the major and minor
152
- version numbers of the Python version (for example, ``python311.dll ``), and
153
- record its base address.
154
- 3. Locate the ``PyRuntim `` section. Section names in the PE format are limited
155
- to 8 characters.
151
+ version numbers of the Python version, and record its base address.
152
+ 3. Locate the ``PyRuntim `` section. Due to the PE format's 8-character limit
153
+ on section names (defined as ``IMAGE_SIZEOF_SHORT_NAME ``), the original
154
+ name ``PyRuntime `` is truncated. This section contains the ``PyRuntime ``
155
+ structure.
156
156
4. Retrieve the section’s relative virtual address (RVA) and add it to the base
157
157
address of the module.
158
158
@@ -171,16 +171,18 @@ The following is an example implementation::
171
171
pid, name_contains="python3"
172
172
)
173
173
174
- # Step 3: Parse PE section headers to get PyRuntim RVA
174
+ # Step 3: Parse PE section headers to get the RVA of the PyRuntime
175
+ # section. The section name appears as "PyRuntim" due to the
176
+ # 8-character limit defined by the PE format (IMAGE_SIZEOF_SHORT_NAME).
175
177
section_rva = parse_pe_section_offset(binary_path, "PyRuntim")
176
178
177
179
# Step 4: Compute PyRuntime address in memory
178
180
return base_address + section_rva
179
181
180
182
181
183
182
- RReading _Py_DebugOffsets
183
- =========================
184
+ Reading _Py_DebugOffsets
185
+ ========================
184
186
185
187
Once the address of the ``PyRuntime `` structure has been determined, the next
186
188
step is to read the ``_Py_DebugOffsets `` structure located at the beginning of
0 commit comments