#--*-- coding:UTF-8 --*--

from pydbg import *
from pydbg.defines import *
import threading
import time
import sys

class snapshotter(object):
      def __init__(self,exe_path):
          self.exe_path=exe_path
          self.pid=None
          self.dbg=None
          self.running=True
          pydbg_thread=threading.Thread(target=self.start_debugger)
          pydbg_thread.start()
          while self.pid==None:
                time.sleep(1)
          monitor_thread=threading.Thread(target=self.monitor_debugger)
          monitor_thread.setDaemon(0)
          monitor_thread.start()

      def monitor_debugger(self):
          while self.running==True:
                input1=raw_input("entrar: 'snap', 'restore' o 'quit'")
                input1=input1.lower().strip()
                if input1=="quit":
                   print "[*] Salimos de snapshotter"
                   self.running=False
                   self.dbg.terminate_process()
                elif input1 == "snap":
                     print "[*] todos los threads suspendidos"
                     self.dbg.suspend_all_threads()
                     print u"[*] obtención del snapshot"
                     self.dbg.process_snapshot()
                     print "[*] reinicio de los threads"
                     self.dbg.resume_all_threads()
                elif input1== "restore":
                     print "[*] todos los threads suspendidos"
                     self.dbg.suspend_all_threads()
                     print u"[*] restauración del snapshot"
                     self.dbg.process_restore()
                     print "[*] reinicio de los threads"
                     self.dbg.resume_all_threads()
                     
      def start_debugger(self):
          self.dbg=pydbg()
          pid=self.dbg.load(self.exe_path)
          self.pid=self.dbg.pid
          
exe_path="C:\\WINDOWS\\System32\\calc.exe"
snapshotter(exe_path)


    
