title: Using Windbg PyKD Python Extension to Print/Break at Only Call Instructions
body: <p>Using WinDBG's python extension I want to print only call instructions in console. [A kind of one step debugging ] </p>
  
  <p><strong>My Code:</strong></p>
  
  <pre><code>from pykd import *
  pid = raw_input ('pid &gt;&gt;&gt; ')
  id=attachProcess(int(pid))
  print id
  while 1:
      trace()
      r_o = dbgCommand('r')
      line = r_o.split('\n')[-2]
      sp_line = line.split()
      addr = int(sp_line[0],16)
      ins = sp_line[2]
      if ins == "call":
          print line
  </code></pre>
  
  <p>I tried above code and got below result. </p>
  
  <p><strong>Output :</strong></p>
  
  <pre><code>C:\Program Files (x86)\Debugging Tools for Windows (x86)\winext&gt;db.py
  [+] Starting...
  pid &gt;&gt;&gt; 3516
  0
  76ec000d c3              ret
  76f4f926 eb07            jmp     ntdll!DbgUiRemoteBreakin+0x45 (76f4f92f)
  76f4f92f c745fcfeffffff  mov     dword ptr [ebp-4],0FFFFFFFEh ss:002b:0029ff84=00000000
  76f4f936 6a00            push    0
  76f4f938 e8df86fbff      call    ntdll!RtlExitUserThread (76f0801c)
  76ed0096 83c404          add     esp,4
  </code></pre>
  
  <p>Here the problem seems to be, after the debugger breaks into the process, the debug thread gets initiated and the debug thread is getting terminated after sometime, because its the current thread [We can see last call is made to ntdll!RtlExitUserThread]. Hence even if the debugee app runs I don't see any thing in command line. </p>
  
  <p>I've seen a script which uses winappdbg and does the similar operation. Here is the script :</p>
  
  <p><a href="https://github.com/MarioVilas/winappdbg/blob/master/tools/ptrace.py" rel="nofollow">https://github.com/MarioVilas/winappdbg/blob/master/tools/ptrace.py</a></p>
  
  <p>And I want to build something similar.</p>