pykd

1
from pykd import *
2
import sys
3

4
def checkSSDT():
5

6
   nt = module( "nt" )
7

8
   if is64bitSystem():   
9

10
        def getServiceAddrWlh(Start, Offset):
11
            return Start + (Offset >> 4)
12

13
        def getServiceAddr2k3(Start, Offset):
14
            return Start + (Offset & ~0xf)
15

16
        if (ptrWord(nt.NtBuildNumber) == 3790):
17
            getServiceAddr = getServiceAddr2k3
18
        else:
19
            getServiceAddr = getServiceAddrWlh
20

21
        serviceTableHeader = loadQWords( nt.KeServiceDescriptorTable, 4 )       
22
        serviceTableStart = serviceTableHeader[0]
23
        serviceCount = serviceTableHeader[2]
24

25
        dprintln( "ServiceTable  start: %(1)x  count: %(2)x" % { "1" : serviceTableStart, "2" : serviceCount } )
26

27
        serviceTable = loadSignDWords( serviceTableStart, serviceCount ) 
28

29
        for i in range( serviceCount ):
30
            routineAddress = getServiceAddr(serviceTableStart, serviceTable[i]);
31
            dprintln( "[%u] %s (%x)" % (i, findSymbol( routineAddress ), routineAddress) )
32

33
   else:
34

35
       serviceTableHeader = loadDWords( nt.KeServiceDescriptorTable, 4 )
36
       serviceTableStart = serviceTableHeader[0]
37
       serviceCount = serviceTableHeader[2]
38

39
       dprintln( "ServiceTable  start: %(1)x  count: %(2)x" % { "1" : serviceTableStart, "2" : serviceCount } )
40

41
       serviceTable = loadPtrs( serviceTableStart, serviceCount ) 
42

43
       for i in range( 0, serviceCount ):
44
          dprintln( "[%u] " % i + findSymbol( serviceTable[i] ) )       
45

46
def run():
47

48
    while True:
49

50
        if not isWindbgExt():
51
            if not loadDump( sys.argv[1] ):
52
                dprintln( sys.argv[1] + " - load failed" )
53
                break
54

55
        if not isKernelDebugging():
56
            dprintln( "not a kernel debugging" )
57
            break 
58
        
59
        checkSSDT()        
60

61
        break
62
    
63
        
64

65
if __name__ == "__main__":
66
    
67
        run()         
68