pykd

1

2
import sys
3
from pykd import *
4

5
def processInfo():
6

7
    nt = module( "nt" )
8

9
    processList = typedVarList( nt.PsActiveProcessHead, "nt!_EPROCESS", "ActiveProcessLinks"  )
10

11
    for process in processList:
12
        print "".join( [chr(i) for i in process.ImageFileName if i != 0] )
13

14
def run():
15

16
    if not isWindbgExt():
17
        if not loadDump( sys.argv[1] ):
18
             dprintln( sys.argv[1] + " - load failed" )
19
             return
20

21
    if not isKernelDebugging():
22
        dprintln( "not a kernel debugging" )
23
        return   
24
                 
25
    processInfo()
26

27
if __name__ == "__main__":
28
    run()
29

30

31