zjgcjy/pykd
1
0
Fork 0
mirror of https://github.com/ivellioscolin/pykd.git synced 2025-04-20 03:23:23 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[0.1.x] fixed : sample km/drvobj.py fixed for win7

Browse Source 
git-svn-id: https://pykd.svn.codeplex.com/svn@76653 9b283d60-5439-405e-af05-b73fd8c4d996
This commit is contained in:
SND\kernelnet_cp 2012-05-25 08:35:31 +00:00 committed by Mikhail I. Izmestev
parent 3f42d04cff
commit 9ad5767580
1 changed files with 32 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
samples/km/drvobj.py
View File

@ -6,6 +6,29 @@ def loadSymbols():
global nt
nt = loadModule( "nt" )
def getObjNameFromObjHeader( objHeader ):
if hasattr( objHeader, "NameInfoOffset"):
objName = typedVar( "nt!_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - objHeader.NameInfoOffset )
else:
if (0 == (objHeader.InfoMask & 2)):
return ""
offsetNameInfo = ptrByte( nt.ObpInfoMaskToOffset + (objHeader.InfoMask & 3) )
if (0 == offsetNameInfo):
return ""
objName = nt.typedVar("_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - offsetNameInfo)
return loadUnicodeString( objName.Name.getAddress() )
def getObjTypeFromObjHeader( objHeader ):
if hasattr( objHeader, "Type"):
return objHeader.Type
return ptrPtr( nt.ObTypeIndexTable + ptrSize() * objHeader.TypeIndex )
def getObjectInDir( dirObj, objName ):
@ -21,22 +44,21 @@ def getObjectInDir( dirObj, objName ):
while dirEntry != 0:
objHeader = containingRecord( dirEntry.Object, "nt!_OBJECT_HEADER", "Body" )
objHeader = containingRecord( dirEntry.Object, "nt!_OBJECT_HEADER", "Body" )
objName = typedVar( "nt!_OBJECT_HEADER_NAME_INFO", objHeader.getAddress() - objHeader.NameInfoOffset )
name = loadUnicodeString( objName.Name.getAddress() )
objName = getObjNameFromObjHeader( objHeader )
if name.lower() == dirSubName.lower():
if objName.lower() == dirSubName.lower():
if objHeader.Type == ptrPtr( nt.ObpDirectoryObjectType ):
if getObjTypeFromObjHeader( objHeader ) == ptrPtr( nt.ObpDirectoryObjectType ):
return getObjectInDir( typedVar( "nt!_OBJECT_DIRECTORY", dirEntry.Object), objSubName )
else:
return dirEntry.Object
return dirEntry.Object
if dirEntry.ChainLink != 0:
dirEntry = typedVar( "nt!_OBJECT_DIRECTORY_ENTRY", dirEntry.ChainLink )
else:
dirEntry = 0
if dirEntry.ChainLink != 0:
dirEntry = typedVar( "nt!_OBJECT_DIRECTORY_ENTRY", dirEntry.ChainLink )
else:
dirEntry = 0
def getObjectByName( objName ):