zjgcjy/pykd
1
0
Fork 0
mirror of https://github.com/ivellioscolin/pykd.git synced 2025-04-21 12:24:52 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[0.1.x] ~fix script

Browse Source 
git-svn-id: https://pykd.svn.codeplex.com/svn@76850 9b283d60-5439-405e-af05-b73fd8c4d996
This commit is contained in:
SND\EreTIk_cp 2012-05-31 13:13:54 +00:00 committed by Mikhail I. Izmestev
parent 0243cc7cd2
commit 0fca2e7aa3
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
snippets/ntobj.py
View File

@ -34,7 +34,8 @@ def getTypeWin7(p):
Implementation for Win7+ Implementation for Win7+
""" """
objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body") objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body")
return ptrPtr( nt.ObTypeIndexTable + (ptrSize() * objHeader.TypeIndex)) tableTypeIndex = nt.ObTypeIndexTable
return ptrPtr(tableTypeIndex + (ptrSize() * objHeader.TypeIndex))
def getTypeLegacy(p): def getTypeLegacy(p):
""" """
@ -46,7 +47,7 @@ def getTypeLegacy(p):
# Select platform-specific function for getting object header # Select platform-specific function for getting object header
# Select key body type: nt!CmpKeyObjectType or nt!CmKeyObjectType # Select key body type: nt!CmpKeyObjectType or nt!CmKeyObjectType
if (ptrWord(getOffset("nt!NtBuildNumber")) >= 7600): if (ptrWord( nt.NtBuildNumber ) >= 7600):
getType = getTypeWin7 getType = getTypeWin7
# _kcbObjectType = expr("poi(nt!CmKeyObjectType)") # _kcbObjectType = expr("poi(nt!CmKeyObjectType)")
else: else:
@ -240,7 +241,7 @@ def getListByDirectoryObject(p, objTypeAddr=0):
otherwise get object of all types otherwise get object of all types
""" """
if getType(p) != ptrPtr( getOffset("nt", "ObpDirectoryObjectType") ): if getType(p) != ptrPtr( nt.ObpDirectoryObjectType ):
return None return None
result = list() result = list()
@ -271,7 +272,7 @@ def getObjectByName(name, caseSensitive=False):
if name[0] != '\\': if name[0] != '\\':
return None return None
object = ptrPtr( getOffset("nt", "ObpRootDirectoryObject") ) object = ptrPtr( nt.ObpRootDirectoryObject )
cmpFunc = cmpNoCase cmpFunc = cmpNoCase
if caseSensitive: if caseSensitive: