diff --git a/snippets/ntobj.py b/snippets/ntobj.py index aeb0999..98d0e49 100644 --- a/snippets/ntobj.py +++ b/snippets/ntobj.py @@ -26,14 +26,14 @@ Work with NT Object tree manager from pykd import * - +nt = loadModule("nt") def getTypeWin7(p): """ Get object header by object pointer Implementation for Win7+ """ - objHeader = containingRecord(p, "nt", "_OBJECT_HEADER", "Body") + objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body") tableTypeIndex = getOffset("nt", "ObTypeIndexTable") return ptrPtr(tableTypeIndex + (ptrSize() * objHeader.TypeIndex)) @@ -42,7 +42,7 @@ def getTypeLegacy(p): Get object header by object pointer Implementation for before Win7 """ - objHeader = containingRecord(p, "nt", "_OBJECT_HEADER", "Body") + objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body") return objHeader.Type # Select platform-specific function for getting object header @@ -59,28 +59,28 @@ def getObjectNameInfoFromHeader(p): """ Get object name information from field NameInfoOffset of object header """ - objHeader = containingRecord(p, "nt", "_OBJECT_HEADER", "Body") + objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body") if (0 == objHeader.NameInfoOffset): return None - return typedVar("nt!_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - objHeader.NameInfoOffset) + return nt.typedVar("_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - objHeader.NameInfoOffset) def getObjectNameInfoFromInfoMask(p): """ Get object name information from field NameInfoOffset of object header """ - objHeader = containingRecord(p, "nt", "_OBJECT_HEADER", "Body") + objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body") if (0 == (objHeader.InfoMask & 2)): return None offsetNameInfo = ptrByte( getOffset("nt", "ObpInfoMaskToOffset") + (objHeader.InfoMask & 3) ) if (0 == offsetNameInfo): return None - return typedVar("nt!_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - offsetNameInfo) + return nt.typedVar("_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - offsetNameInfo) # Select platform-specific function for getting name of object getObjectNameInfo = None try: - typeInfo("nt!_OBJECT_HEADER").NameInfoOffset + nt.type("_OBJECT_HEADER").NameInfoOffset getObjectNameInfo = getObjectNameInfoFromHeader except TypeException: getObjectNameInfo = getObjectNameInfoFromInfoMask @@ -150,7 +150,7 @@ def getListByHandleTable(tableHandles=None, objTypeAddr=0, containHeaders=True): if (0 == entryHandle): return 0 - HandleEntry = typedVar("nt!_HANDLE_TABLE_ENTRY", entryHandle) + HandleEntry = nt.typedVar("_HANDLE_TABLE_ENTRY", entryHandle) if (0xFFFFFFFE == HandleEntry.NextFreeTableEntry): return 0 @@ -159,7 +159,7 @@ def getListByHandleTable(tableHandles=None, objTypeAddr=0, containHeaders=True): return 0 if (containHeader): - objHeader = typedVar("nt!_OBJECT_HEADER", p) + objHeader = nt.typedVar("_OBJECT_HEADER", p) p = objHeader.Body.getAddress() return p @@ -210,13 +210,13 @@ def getListByHandleTable(tableHandles=None, objTypeAddr=0, containHeaders=True): return lstObjects if (None == tableHandles): - currProcess = typedVar("nt!_EPROCESS", getCurrentProcess()) + currProcess = nt.typedVar("_EPROCESS", getCurrentProcess()) if (None == currProcess): dprintln("Get current process failed") return tableHandles = currProcess.ObjectTable - tableHandles = typedVar("nt!_HANDLE_TABLE", tableHandles) + tableHandles = nt.typedVar("_HANDLE_TABLE", tableHandles) nMaxHandleIndex = tableHandles.NextHandleNeedingPool & 0xFFFFFFFF nTableLevel = (tableHandles.TableCode & 3) pTableContent = tableHandles.TableCode - nTableLevel @@ -249,7 +249,7 @@ def getListByDirectoryObject(p, objTypeAddr=0): for i in range(0, NUMBER_HASH_BUCKETS): bucket = ptrPtr( p + (i * ptrSize()) ) while bucket: - bucketVar = typedVar("nt!_OBJECT_DIRECTORY_ENTRY", bucket) + bucketVar = nt.typedVar("_OBJECT_DIRECTORY_ENTRY", bucket) if objTypeAddr and (getType(bucketVar.Object) == objTypeAddr): result.append(bucketVar.Object) elif (not objTypeAddr): @@ -410,7 +410,7 @@ def main(): objectName = buildObjectName(object) if len(objectName): dprintln( ", name=`" + objectName + "'" ) - elif typedVar("nt!_OBJECT_TYPE", getType(object)).TypeInfo.QueryNameProcedure: + elif nt.typedVar("_OBJECT_TYPE", getType(object)).TypeInfo.QueryNameProcedure: dprintln(", custom name", True) else: dprintln(" , <_unnamed_>")