parameters: (self, event)
return_statement: return retval
docstring: Notify the creation of a new process.
  
          @warning: This method is meant to be used internally by the debugger.
  
          @type  event: L{CreateProcessEvent}
          @param event: Create process event.
  
          @rtype:  bool
          @return: C{True} to call the user-defined handle, C{False} otherwise.
docstring_summary: Notify the creation of a new process.
docstring_tokens: Notify the creation of a new process .
function: def _notify_create_process(self, event):
          """
          Notify the creation of a new process.
  
          @warning: This method is meant to be used internally by the debugger.
  
          @type  event: L{CreateProcessEvent}
          @param event: Create process event.
  
          @rtype:  bool
          @return: C{True} to call the user-defined handle, C{False} otherwise.
          """
          dwProcessId = event.get_pid()
          if dwProcessId not in self.__attachedDebugees:
              if dwProcessId not in self.__startedDebugees:
                  self.__startedDebugees.add(dwProcessId)
  
          retval = self.system._notify_create_process(event)
  
          # Set a breakpoint on the program's entry point if requested.
          # Try not to use the Event object's entry point value, as in some cases
          # it may be wrong. See: http://pferrie.host22.com/misc/lowlevel3.htm
          if dwProcessId in self.__breakOnEP:
              try:
                  lpEntryPoint = event.get_process().get_entry_point()
              except Exception:
                  lpEntryPoint = event.get_start_address()
  
              # It'd be best to use a hardware breakpoint instead, at least in
              # hostile mode. But since the main thread's context gets smashed
              # by the loader, I haven't found a way to make it work yet.
              self.break_at(dwProcessId, lpEntryPoint)
  
          # Defeat isDebuggerPresent by patching PEB->BeingDebugged.
          # When we do this, some debugging APIs cease to work as expected.
          # For example, the system breakpoint isn't hit when we attach.
          # For that reason we need to define a code breakpoint at the
          # code location where a new thread is spawned by the debugging
          # APIs, ntdll!DbgUiRemoteBreakin.
          if self.__bHostileCode:
              aProcess = event.get_process()
              try:
                  hProcess = aProcess.get_handle(win32.PROCESS_QUERY_INFORMATION)
                  pbi = win32.NtQueryInformationProcess(
                                         hProcess, win32.ProcessBasicInformation)
                  ptr = pbi.PebBaseAddress + 2
                  if aProcess.peek(ptr, 1) == '\x01':
                      aProcess.poke(ptr, '\x00')
              except WindowsError:
                  e = sys.exc_info()[1]
                  warnings.warn(
                      "Cannot patch PEB->BeingDebugged, reason: %s" % e.strerror)
  
          return retval
function_tokens: def _notify_create_process ( self , event ) : dwProcessId = event . get_pid ( ) if dwProcessId not in self . __attachedDebugees : if dwProcessId not in self . __startedDebugees : self . __startedDebugees . add ( dwProcessId ) retval = self . system . _notify_create_process ( event ) # Set a breakpoint on the program's entry point if requested. # Try not to use the Event object's entry point value, as in some cases # it may be wrong. See: http://pferrie.host22.com/misc/lowlevel3.htm if dwProcessId in self . __breakOnEP : try : lpEntryPoint = event . get_process ( ) . get_entry_point ( ) except Exception : lpEntryPoint = event . get_start_address ( ) # It'd be best to use a hardware breakpoint instead, at least in # hostile mode. But since the main thread's context gets smashed # by the loader, I haven't found a way to make it work yet. self . break_at ( dwProcessId , lpEntryPoint ) # Defeat isDebuggerPresent by patching PEB->BeingDebugged. # When we do this, some debugging APIs cease to work as expected. # For example, the system breakpoint isn't hit when we attach. # For that reason we need to define a code breakpoint at the # code location where a new thread is spawned by the debugging # APIs, ntdll!DbgUiRemoteBreakin. if self . __bHostileCode : aProcess = event . get_process ( ) try : hProcess = aProcess . get_handle ( win32 . PROCESS_QUERY_INFORMATION ) pbi = win32 . NtQueryInformationProcess ( hProcess , win32 . ProcessBasicInformation ) ptr = pbi . PebBaseAddress + 2 if aProcess . peek ( ptr , 1 ) == '\x01' : aProcess . poke ( ptr , '\x00' ) except WindowsError : e = sys . exc_info ( ) [ 1 ] warnings . warn ( "Cannot patch PEB->BeingDebugged, reason: %s" % e . strerror ) return retval