PyDBG process snapshots not working
Question: I'm following Gray Hat Python book and have copied their code for the process
snapshots using PyDBG. When I run the script I get no errors and expected
output however my program is not actually reverting to the snapshot. When I go
in debug it seems like values are in the snapshot variables as if it is
storing snapshot info but I don't really know enough to say for sure.

Here is code:

    
    
    from pydbg import *
    from pydbg.defines import *
    import threading
    import time
    import sys
    
    class snapshotter(object):
        def __init__(self,exe_path):
            self.exe_path = exe_path
            self.pid = None
            self.dbg = None
            self.running = True
    
            pydbg_thread = threading.Thread(target=self.start_debugger)
            pydbg_thread.setDaemon(0)
            pydbg_thread.start()
    
            while self.pid == None:
                time.sleep(1)
    
            monitor_thread = threading.Thread(target=self.monitor_debugger)
            monitor_thread.setDaemon(0)
            monitor_thread.start()
    
        def monitor_debugger(self):
            while self.running == True:
                input = raw_input("Enter: 'snap','restore' or 'quit'")
                input = input.lower().strip()
                if input == "quit":
                    print "[*] Exiting the snapshotter."
                    self.running = False
                    self.dbg.terminate_process()
                elif input == "snap":
                    print "[*] Suspending all threads."
                    self.dbg.suspend_all_threads()
                    print "[*] Obtaining snapshot."
                    self.dbg.process_snapshot()
                    print "[*] Resuming operation."
                    self.dbg.resume_all_threads()
                elif input == "restore":
                    print "[*] Suspending all threads."
                    self.dbg.suspend_all_threads()
                    print "[*] Restoring snapshot."
                    self.dbg.process_restore()
                    print "[*] Resuming operation."
                    self.dbg.resume_all_threads()
    
        def start_debugger(self):
            self.dbg = pydbg()
            pid = self.dbg.load(self.exe_path)
            self.pid = self.dbg.pid
            self.dbg.run()
    
    exe_path = "C:\\WINDOWS\\System32\\calc.exe"
    snapshotter(exe_path)
    


Answer: Your code worked for me on Python 2.7 on XP SP1 (Virtual machine). Which
version of Windows are you running? Also, could it be your pydbg install? I'm
using a binary I found at:

<http://www.lfd.uci.edu/~gohlke/pythonlibs/#pydbg>

