mirror of
https://github.com/ivellioscolin/pykd.git
synced 2025-04-21 12:53:23 +08:00
48 lines
1.3 KiB
Python
48 lines
1.3 KiB
Python
from pykd import *
|
|
import sys
|
|
|
|
|
|
def checkSSDT():
|
|
|
|
nt = loadModule( "nt" )
|
|
|
|
|
|
if is64bitSystem():
|
|
|
|
serviceTableHeader = loadQWords( nt.KeServiceDescriptorTable, 4 )
|
|
serviceTableStart = serviceTableHeader[0]
|
|
serviceCount = serviceTableHeader[2]
|
|
|
|
dprintln( "ServiceTable start: %(1)x count: %(2)x" % { "1" : serviceTableStart, "2" : serviceCount } )
|
|
|
|
serviceTable = loadSignDWords( serviceTableStart, serviceCount )
|
|
|
|
for i in range( 0, serviceCount ):
|
|
|
|
routineAddress = serviceTableStart + ( serviceTable[i] / 16 );
|
|
dprintln( findSymbol( routineAddress ) )
|
|
|
|
|
|
else:
|
|
|
|
serviceTableHeader = loadDWords( nt.KeServiceDescriptorTable, 4 )
|
|
serviceTableStart = serviceTableHeader[0]
|
|
serviceCount = serviceTableHeader[2]
|
|
|
|
dprintln( "ServiceTable start: %(1)x count: %(2)x" % { "1" : serviceTableStart, "2" : serviceCount } )
|
|
|
|
serviceTable = loadPtrs( serviceTableStart, serviceCount )
|
|
|
|
for i in range( 0, serviceCount ):
|
|
dprintln( findSymbol( serviceTable[i] ) )
|
|
|
|
|
|
|
|
if __name__ == "__main__":
|
|
|
|
if not isSessionStart():
|
|
createSession()
|
|
loadDump( sys.argv[1] )
|
|
|
|
checkSSDT()
|
|
|