zjgcjy/pykd
1
0
Fork 0
mirror of https://github.com/ivellioscolin/pykd.git synced 2025-04-21 04:13:22 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[0.1.x] fixed : snippet ntobj.py

Browse Source 
git-svn-id: https://pykd.svn.codeplex.com/svn@76848 9b283d60-5439-405e-af05-b73fd8c4d996
This commit is contained in:
SND\kernelnet_cp 2012-05-31 13:11:27 +00:00 committed by Mikhail I. Izmestev
parent d15638c1a0
commit 0243cc7cd2
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
snippets/ntobj.py
View File

@ -34,8 +34,7 @@ def getTypeWin7(p):
Implementation for Win7+ Implementation for Win7+
""" """
objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body") objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body")
tableTypeIndex = getOffset("nt", "ObTypeIndexTable") return ptrPtr( nt.ObTypeIndexTable + (ptrSize() * objHeader.TypeIndex))
return ptrPtr(tableTypeIndex + (ptrSize() * objHeader.TypeIndex))
def getTypeLegacy(p): def getTypeLegacy(p):
""" """
@ -71,7 +70,7 @@ def getObjectNameInfoFromInfoMask(p):
objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body") objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body")
if (0 == (objHeader.InfoMask & 2)): if (0 == (objHeader.InfoMask & 2)):
return None return None
offsetNameInfo = ptrByte( getOffset("nt", "ObpInfoMaskToOffset") + (objHeader.InfoMask & 3) ) offsetNameInfo = ptrByte( nt.ObpInfoMaskToOffset + (objHeader.InfoMask & 3) )
if (0 == offsetNameInfo): if (0 == offsetNameInfo):
return None return None
return nt.typedVar("_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - offsetNameInfo) return nt.typedVar("_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - offsetNameInfo)