zjgcjy/pykd
1
0
Fork 0
mirror of https://github.com/ivellioscolin/pykd.git synced 2025-04-17 01:13:24 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[0..3.x] added : print typedVar

Browse Source 
git-svn-id: https://pykd.svn.codeplex.com/svn@84986 9b283d60-5439-405e-af05-b73fd8c4d996
This commit is contained in:
SND\kernelnet_cp 2013-08-26 15:45:22 +00:00 committed by Mikhail I. Izmestev
parent ead4054ccc
commit e8720626b2
4 changed files with 75 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pykd/pymod.cpp
View File

@ -709,9 +709,9 @@ BOOST_PYTHON_MODULE( pykd )
// .def( "onModuleUnload", &EventHandlerWrap::OnModuleUnload,
// "Triggered module unload event. Parameter are long: module base, string: module name\n"
// "For ignore event method must return eventResult.noChange" )
// .def( "onException", &EventHandlerWrap::OnException,
// "Triggered exception event. Parameter - exceptionInfo\n"
// "For ignore event method must return eventResult.noChange" )
.def( "onException", &EventHandler::onException,
"Triggered exception event. Parameter - exceptionInfo\n"
"For ignore event method must return eventResult.noChange" )
.def( "onExecutionStatusChange", &EventHandler::onExecutionStatusChange,
"Triggered execution status changed. Parameter - execution status.\n"
"There is no return value" )

7
pykd/typedvar.h
View File

@ -17,12 +17,12 @@ struct TypedVarAdapter {
}
static kdlib::TypedVarPtr getTypedVarByTypeName( const std::wstring &name, kdlib::MEMOFFSET_64 addr ) {
return kdlib::loadTypedVar( name, addr, kdlib::SymbolPtr() );
return kdlib::loadTypedVar( name, addr );
}
static kdlib::TypedVarPtr getTypedVarByTypeInfo( const kdlib::TypeInfoPtr &typeInfo, kdlib::MEMOFFSET_64 addr )
{
return kdlib::loadTypedVar( typeInfo, addr, kdlib::SymbolPtr() );
return kdlib::loadTypedVar( typeInfo, addr );
}
static kdlib::MEMOFFSET_32 getFieldOffsetByName( kdlib::TypedVar& typedVar, const std::wstring &name ) {
@ -39,9 +39,10 @@ struct TypedVarAdapter {
}
static std::wstring print( kdlib::TypedVar& typedVar ) {
return L"TYPEDVAR STR";
return typedVar.str();
}
static kdlib::TypedVarPtr containingRecordByName( kdlib::MEMOFFSET_64 offset, const std::wstring &typeName, const std::wstring &fieldName ) {
return kdlib::containingRecord( offset, typeName, fieldName );
}

44
pykd/typeinfo.h
View File

@ -14,20 +14,44 @@ struct TypeInfoAdapter : public kdlib::TypeInfo {
static std::wstring findSymbol( kdlib::MEMOFFSET_64 offset, bool showDisplacement = true )
{
kdlib::MEMDISPLACEMENT displacement = 0;
std::wstring symbolName = kdlib::findSymbol( offset, displacement );
if ( !showDisplacement || displacement == 0 )
return symbolName;
std::wstring symbolName;
std::wstringstream wsstr;
try {
wsstr << symbolName;
kdlib::ModulePtr mod = kdlib::loadModule( offset );
if ( displacement > 0 )
wsstr << L'+' << std::hex << displacement;
else
wsstr << L'-' << std::hex << -displacement;
try {
symbolName = mod->findSymbol( offset, displacement );
std::wstringstream sstr;
sstr << mod->getName() << L'!' << symbolName;
if ( !showDisplacement || displacement == 0 )
return sstr.str();
if ( displacement > 0 )
sstr << L'+' << std::hex << displacement;
else
sstr << L'-' << std::hex << -displacement;
return sstr.str();
} catch( kdlib::DbgException& )
{
std::wstringstream sstr;
sstr << mod->getName() << '+' << std::hex << ( offset - mod->getBase() );
return sstr.str();
}
} catch( kdlib::DbgException& )
{
std::wstringstream sstr;
sstr << std::hex << offset;
return sstr.str();
}
return wsstr.str();
}
static kdlib::MEMOFFSET_32 getElementOffset( kdlib::TypeInfo &typeInfo, const std::wstring &name ) {

34
samples/um/critlist.py Normal file
View File

@ -0,0 +1,34 @@
from pykd import *
def main():
pass
def listCritSections():
ntdll = module("ntdll")
dbglst = ntdll.typedVarList( ntdll.RtlCriticalSectionList, "_RTL_CRITICAL_SECTION_DEBUG", "ProcessLocksList" )
crtlst = [ ntdll.typedVar( "_RTL_CRITICAL_SECTION", x.CriticalSection ) for x in dbglst ]
for crtsec in crtlst:
dprintln("")
dprintln( "CRITICAL SECTION address = %#x ( %s ) " % ( crtsec, findSymbol( crtsec ) ) )
dprintln( " Owning thread = %x" % crtsec.OwningThread )
dprintln( " Lock count = %d" % crtsec.LockCount )
def run():
while True:
if isKernelDebugging():
dprintln( "not a user debugging" )
break
listCritSections()
break
if __name__ == "__main__":
run()