@@ -14,7 +14,6 @@ detailed explanation of the underlying protocol, which takes as input the
1414executed. This information supports independent reimplementation of the
1515protocol, regardless of programming language.
1616
17-
1817.. warning ::
1918
2019 The execution of the injected script depends on the interpreter reaching a
@@ -149,10 +148,11 @@ To find the ``PyRuntime`` structure on Windows:
149148 <https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-module32next> `_.
1501492. Identify the module corresponding to :file: `python.exe ` or
151150 :file: `python{ XY } .dll `, where ``X `` and ``Y `` are the major and minor
152- version numbers of the Python version (for example, ``python311.dll ``), and
153- record its base address.
154- 3. Locate the ``PyRuntim `` section. Section names in the PE format are limited
155- to 8 characters.
151+ version numbers of the Python version, and record its base address.
152+ 3. Locate the ``PyRuntim `` section. Due to the PE format's 8-character limit
153+ on section names (defined as ``IMAGE_SIZEOF_SHORT_NAME ``), the original
154+ name ``PyRuntime `` is truncated. This section contains the ``PyRuntime ``
155+ structure.
1561564. Retrieve the section’s relative virtual address (RVA) and add it to the base
157157 address of the module.
158158
@@ -171,16 +171,18 @@ The following is an example implementation::
171171 pid, name_contains="python3"
172172 )
173173
174- # Step 3: Parse PE section headers to get PyRuntim RVA
174+ # Step 3: Parse PE section headers to get the RVA of the PyRuntime
175+ # section. The section name appears as "PyRuntim" due to the
176+ # 8-character limit defined by the PE format (IMAGE_SIZEOF_SHORT_NAME).
175177 section_rva = parse_pe_section_offset(binary_path, "PyRuntim")
176178
177179 # Step 4: Compute PyRuntime address in memory
178180 return base_address + section_rva
179181
180182
181183
182- RReading _Py_DebugOffsets
183- =========================
184+ Reading _Py_DebugOffsets
185+ ========================
184186
185187Once the address of the ``PyRuntime `` structure has been determined, the next
186188step is to read the ``_Py_DebugOffsets `` structure located at the beginning of
0 commit comments