mirror of
https://github.com/ivellioscolin/pykd.git
synced 2025-04-20 03:23:23 +08:00
cbbc29523e
[+] ntobj: get object address by full name [+] drivers.py - demonstration of the new ntobj.py: print list of all driver objects git-svn-id: https://pykd.svn.codeplex.com/svn@66437 9b283d60-5439-405e-af05-b73fd8c4d996
27 lines
634 B
Python
27 lines
634 B
Python
"""
|
|
Print list of all drivers
|
|
"""
|
|
|
|
from pykd import *
|
|
import ntobj
|
|
|
|
|
|
if __name__ == "__main__":
|
|
|
|
def printDriverFromDir(dirName):
|
|
lstDrvs = ntobj.getListByDirectoryObject(
|
|
ntobj.getObjectByName(dirName), ptrPtr( getOffset("nt", "IoDriverObjectType") )
|
|
)
|
|
for drv in lstDrvs:
|
|
cmdDriver = "\t<link cmd=\"!drvobj 0x%x 7\">0x%x</link>" % (drv, drv)
|
|
dprintln(dirName + "\\" + ntobj.getObjectName(drv) + cmdDriver, True )
|
|
|
|
|
|
if not isKernelDebugging:
|
|
dprintln( "Script for kernel mode only" )
|
|
else:
|
|
printDriverFromDir("\\Driver")
|
|
printDriverFromDir("\\FileSystem")
|
|
|
|
|