From 7e5d195ec9b6f3184139fe9b9d5240785c31763c Mon Sep 17 00:00:00 2001
From: "SND\\EreTIk_cp" <SND\EreTIk_cp@9b283d60-5439-405e-af05-b73fd8c4d996>
Date: Wed, 23 May 2012 09:28:50 +0000
Subject: [PATCH] [0.1.x] ~refactoring (use one module object)

git-svn-id: https://pykd.svn.codeplex.com/svn@76559 9b283d60-5439-405e-af05-b73fd8c4d996
---
 snippets/ntobj.py | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/snippets/ntobj.py b/snippets/ntobj.py
index aeb0999..98d0e49 100644
--- a/snippets/ntobj.py
+++ b/snippets/ntobj.py
@@ -26,14 +26,14 @@ Work with NT Object tree manager
 
 from pykd import *
 
-
+nt = loadModule("nt")
 
 def getTypeWin7(p):
   """
   Get object header by object pointer
   Implementation for Win7+
   """
-  objHeader = containingRecord(p, "nt", "_OBJECT_HEADER", "Body")
+  objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body")
   tableTypeIndex = getOffset("nt", "ObTypeIndexTable")
   return ptrPtr(tableTypeIndex + (ptrSize() * objHeader.TypeIndex))
 
@@ -42,7 +42,7 @@ def getTypeLegacy(p):
   Get object header by object pointer
   Implementation for before Win7
   """
-  objHeader = containingRecord(p, "nt", "_OBJECT_HEADER", "Body")
+  objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body")
   return objHeader.Type
 
 # Select platform-specific function for getting object header
@@ -59,28 +59,28 @@ def getObjectNameInfoFromHeader(p):
   """
   Get object name information from field NameInfoOffset of object header
   """
-  objHeader = containingRecord(p, "nt", "_OBJECT_HEADER", "Body")
+  objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body")
   if (0 == objHeader.NameInfoOffset):
     return None
-  return typedVar("nt!_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - objHeader.NameInfoOffset)
+  return nt.typedVar("_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - objHeader.NameInfoOffset)
 
 def getObjectNameInfoFromInfoMask(p):
   """
   Get object name information from field NameInfoOffset of object header
   """
-  objHeader = containingRecord(p, "nt", "_OBJECT_HEADER", "Body")
+  objHeader = nt.containingRecord(p, "_OBJECT_HEADER", "Body")
   if (0 == (objHeader.InfoMask & 2)):
     return None
   offsetNameInfo = ptrByte( getOffset("nt", "ObpInfoMaskToOffset") + (objHeader.InfoMask & 3) )
   if (0 == offsetNameInfo):
     return None
-  return typedVar("nt!_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - offsetNameInfo)
+  return nt.typedVar("_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - offsetNameInfo)
 
 
 # Select platform-specific function for getting name of object
 getObjectNameInfo = None
 try:
-  typeInfo("nt!_OBJECT_HEADER").NameInfoOffset
+  nt.type("_OBJECT_HEADER").NameInfoOffset
   getObjectNameInfo = getObjectNameInfoFromHeader
 except TypeException:
   getObjectNameInfo = getObjectNameInfoFromInfoMask
@@ -150,7 +150,7 @@ def getListByHandleTable(tableHandles=None, objTypeAddr=0, containHeaders=True):
     if (0 == entryHandle):
       return 0
   
-    HandleEntry = typedVar("nt!_HANDLE_TABLE_ENTRY", entryHandle)
+    HandleEntry = nt.typedVar("_HANDLE_TABLE_ENTRY", entryHandle)
     if (0xFFFFFFFE == HandleEntry.NextFreeTableEntry):
       return 0
 
@@ -159,7 +159,7 @@ def getListByHandleTable(tableHandles=None, objTypeAddr=0, containHeaders=True):
       return 0
 
     if (containHeader):
-      objHeader = typedVar("nt!_OBJECT_HEADER", p)
+      objHeader = nt.typedVar("_OBJECT_HEADER", p)
       p = objHeader.Body.getAddress()
     return p
 
@@ -210,13 +210,13 @@ def getListByHandleTable(tableHandles=None, objTypeAddr=0, containHeaders=True):
     return lstObjects
 
   if (None == tableHandles):
-    currProcess = typedVar("nt!_EPROCESS", getCurrentProcess())
+    currProcess = nt.typedVar("_EPROCESS", getCurrentProcess())
     if (None == currProcess):
       dprintln("Get current process failed")
       return
     tableHandles = currProcess.ObjectTable
 
-  tableHandles = typedVar("nt!_HANDLE_TABLE", tableHandles)
+  tableHandles = nt.typedVar("_HANDLE_TABLE", tableHandles)
   nMaxHandleIndex = tableHandles.NextHandleNeedingPool & 0xFFFFFFFF
   nTableLevel = (tableHandles.TableCode & 3)
   pTableContent = tableHandles.TableCode - nTableLevel
@@ -249,7 +249,7 @@ def getListByDirectoryObject(p, objTypeAddr=0):
   for i in range(0, NUMBER_HASH_BUCKETS):
     bucket = ptrPtr( p + (i * ptrSize()) )
     while bucket:
-      bucketVar = typedVar("nt!_OBJECT_DIRECTORY_ENTRY", bucket)
+      bucketVar = nt.typedVar("_OBJECT_DIRECTORY_ENTRY", bucket)
       if objTypeAddr and (getType(bucketVar.Object) ==  objTypeAddr):
         result.append(bucketVar.Object)
       elif (not objTypeAddr):
@@ -410,7 +410,7 @@ def main():
     objectName = buildObjectName(object)
     if len(objectName):
       dprintln( ", name=`" + objectName + "'" )
-    elif typedVar("nt!_OBJECT_TYPE", getType(object)).TypeInfo.QueryNameProcedure:
+    elif nt.typedVar("_OBJECT_TYPE", getType(object)).TypeInfo.QueryNameProcedure:
       dprintln(", <i>custom</i> name", True)
     else:
       dprintln(" , <_unnamed_>")