zjgcjy/pykd
1
0
Fork 0
mirror of https://github.com/ivellioscolin/pykd.git synced 2025-04-21 21:03:23 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[0.2.x] fixed : ldr.py sample

Browse Source 
git-svn-id: https://pykd.svn.codeplex.com/svn@81856 9b283d60-5439-405e-af05-b73fd8c4d996
This commit is contained in:
SND\kernelnet_cp 2012-12-17 14:30:17 +00:00 committed by Mikhail I. Izmestev
parent 5b245b9b97
commit 2e54670f05
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
samples/um/ldr.py
View File

@ -9,7 +9,7 @@ def listModuleFromLdr64():
peb = typedVar( "ntdll!PEB", getCurrentProcess() ) peb = typedVar( "ntdll!PEB", getCurrentProcess() )
moduleLst = typedVarList( peb.Ldr.deref().InLoadOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) moduleLst = typedVarList( peb.Ldr.deref().InMemoryOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" )
for mod in moduleLst: for mod in moduleLst:
name = typedVar( "ntdll!_UNICODE_STRING", mod.BaseDllName ) name = typedVar( "ntdll!_UNICODE_STRING", mod.BaseDllName )
@ -21,7 +21,7 @@ def listModuleFromLdr64():
dprintln( "\n<u>32 bit modules:</u>", True) dprintln( "\n<u>32 bit modules:</u>", True)
moduleLst = typedVarList( peb32.Ldr.deref().InLoadOrderModuleList, "ntdll32!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) moduleLst = typedVarList( peb32.Ldr.deref().InMemoryOrderModuleList, "ntdll32!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" )
for mod in moduleLst: for mod in moduleLst:
name = typedVar( "ntdll32!_UNICODE_STRING", mod.BaseDllName ) name = typedVar( "ntdll32!_UNICODE_STRING", mod.BaseDllName )
@ -34,7 +34,7 @@ def listModuleFromLdr():
peb = typedVar( "ntdll!PEB", getCurrentProcess() ) peb = typedVar( "ntdll!PEB", getCurrentProcess() )
moduleLst = typedVarList( peb.Ldr.deref().InLoadOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" ) moduleLst = typedVarList( peb.Ldr.deref().InMemoryOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" )
for mod in moduleLst: for mod in moduleLst:
dprintln(loadUnicodeString(mod.BaseDllName)) dprintln(loadUnicodeString(mod.BaseDllName))