From a95075cb6fe2bac07ee9362e4faa6ddff3bbb8b5 Mon Sep 17 00:00:00 2001
From: "SND\\kernelnet_cp"
 <SND\kernelnet_cp@9b283d60-5439-405e-af05-b73fd8c4d996>
Date: Tue, 27 Jul 2010 10:24:50 +0000
Subject: [PATCH] [+] routines for loading array ( loadBytes, loadWords ... )
 added [+] sample added

git-svn-id: https://pykd.svn.codeplex.com/svn@53051 9b283d60-5439-405e-af05-b73fd8c4d996
---
 pykd/dbgext.cpp  |  4 ++++
 pykd/dbgmem.cpp  |  3 +--
 pykd/dbgmem.h    | 27 +++++++++++++++++++++++++++
 pykd/pykd.vcproj |  2 +-
 samples/ssdt.py  | 32 ++++++++++++++++++++++++++++++++
 5 files changed, 65 insertions(+), 3 deletions(-)
 create mode 100644 samples/ssdt.py

diff --git a/pykd/dbgext.cpp b/pykd/dbgext.cpp
index a5c0dc8..feb555c 100644
--- a/pykd/dbgext.cpp
+++ b/pykd/dbgext.cpp
@@ -44,6 +44,10 @@ BOOST_PYTHON_MODULE( pykd )
     boost::python::def( "getOffset", &findAddressForSymbol );
     boost::python::def( "findModule", &findModule );
     boost::python::def( "addr64", &addr64 );
+    boost::python::def( "loadBytes", &loadArray<unsigned char> );
+    boost::python::def( "loadWords", &loadArray<unsigned short> );
+    boost::python::def( "loadDWords", &loadArray<unsigned long> );
+    boost::python::def( "loadQWords", &loadArray<__int64> );
     boost::python::def( "compareMemory", &compareMemory );
     boost::python::class_<typedVarClass>( "typedVarClass" )
         .def("getAddress", &typedVarClass::getAddress );
diff --git a/pykd/dbgmem.cpp b/pykd/dbgmem.cpp
index 375f925..39ba08b 100644
--- a/pykd/dbgmem.cpp
+++ b/pykd/dbgmem.cpp
@@ -87,5 +87,4 @@ compareMemory( ULONG64 addr1, ULONG64 addr2, ULONG length )
     return result;
 }
 
-///////////////////////////////////////////////////////////////////////////////////
-
+///////////////////////////////////////////////////////////////////////////////////
\ No newline at end of file
diff --git a/pykd/dbgmem.h b/pykd/dbgmem.h
index be5b270..78a30bb 100644
--- a/pykd/dbgmem.h
+++ b/pykd/dbgmem.h
@@ -1,10 +1,37 @@
 #pragma once
 
+#include <boost/python.hpp>
+#include <boost/python/object.hpp>
+
+
 /////////////////////////////////////////////////////////////////////////////////
 
 bool
 loadMemory( ULONG64 address, PVOID dest, ULONG length );
 
+template<typename T>
+boost::python::object
+loadArray( ULONG64 address, ULONG  number )
+{
+    T   *buffer = new T[ number ];
+    
+    if ( loadMemory( address, buffer, number*sizeof(T) ) )
+    {
+        boost::python::dict    arr;
+    
+        for ( ULONG  i = 0; i < number; ++i )
+            arr[i] = buffer[i];
+            
+        delete[]  buffer;            
+        
+        return   arr;
+    }
+   
+    delete[]  buffer;
+    
+ 	return boost::python::object();
+}
+
 bool
 compareMemory( ULONG64 addr1, ULONG64 addr2, ULONG length );
 
diff --git a/pykd/pykd.vcproj b/pykd/pykd.vcproj
index 3193534..831316d 100644
--- a/pykd/pykd.vcproj
+++ b/pykd/pykd.vcproj
@@ -149,7 +149,7 @@
 			/>
 			<Tool
 				Name="VCLinkerTool"
-				AdditionalDependencies="dbgeng.lib engextcpp.lib"
+				AdditionalDependencies="dbgeng.lib"
 				OutputFile="$(OutDir)\$(ProjectName).pyd"
 				LinkIncremental="2"
 				AdditionalLibraryDirectories="&quot;$(DBG_SDK_ROOT)\lib\amd64&quot;;&quot;$(PYTHON_ROOT)\x64\libs&quot;;&quot;$(BOOST_ROOT)\stage64\lib&quot;"
diff --git a/samples/ssdt.py b/samples/ssdt.py
new file mode 100644
index 0000000..596d644
--- /dev/null
+++ b/samples/ssdt.py
@@ -0,0 +1,32 @@
+from pykd import *
+import sys
+
+
+def checkSSDT():
+
+   nt = loadModule( "nt" )
+   nt.KeServiceDescriptorTable = getOffset( "nt", "KeServiceDescriptorTable" )
+
+   serviceTableHeader = loadDWords( nt.KeServiceDescriptorTable, 4 )
+   serviceTableStart = serviceTableHeader[0]
+   serviceCount = serviceTableHeader[2]
+
+
+   dprintln( "ServiceTable  start: %(1)x  count: %(2)x" % { "1" : serviceTableStart, "2" : serviceCount } )
+
+
+   serviceTable = loadDWords( serviceTableStart, serviceCount ) 
+
+ 
+   for i in range( 0, serviceCount ):
+      dprintln( findSymbol( serviceTable[i] ) )       
+         
+
+if __name__ == "__main__":
+
+   if not isSessionStart():
+      createSession()
+      loadDump( sys.argv[1] )
+
+   checkSSDT()
+	
\ No newline at end of file