mirror of
https://github.com/ivellioscolin/pykd.git
synced 2025-04-22 13:23:23 +08:00
49 lines
1.2 KiB
Python
49 lines
1.2 KiB
Python
from pykd import *
|
|
import ntobj
|
|
import sys
|
|
|
|
nt = module("nt")
|
|
|
|
|
|
def findHanle(objaddr):
|
|
|
|
processList = typedVarList( nt.PsActiveProcessHead, "nt!_EPROCESS", "ActiveProcessLinks" )
|
|
|
|
for process in processList:
|
|
|
|
dprintln( "search in process %x " % process.UniqueProcessId + "".join( [chr(i) for i in process.ImageFileName if i != 0] ) )
|
|
|
|
if process.ObjectTable == 0:
|
|
continue
|
|
|
|
objects = ntobj.getListByHandleTable( process.ObjectTable )
|
|
for obj in objects:
|
|
if obj[0] == objaddr:
|
|
dprintln("\tHandle: %x" % ( obj[1],) )
|
|
|
|
|
|
def usage():
|
|
dprintln("!py findhandle object_address")
|
|
|
|
def main():
|
|
|
|
if not isKernelDebugging():
|
|
dprintln("This script for kernel debugging only")
|
|
return
|
|
|
|
if len(sys.argv) < 2:
|
|
usage();
|
|
return;
|
|
|
|
objaddr = expr(sys.argv[1])
|
|
|
|
objectType = ntobj.getType(objaddr)
|
|
|
|
dprintln("Object Type: " + ntobj.getObjectName(objectType) )
|
|
dprintln("Object Name: "+ ntobj.getObjectName(objaddr) )
|
|
dprintln("")
|
|
|
|
findHanle( objaddr )
|
|
|
|
if __name__ == "__main__":
|
|
main() |