pykd

1
from pykd import *
2

3
def main():
4
    pass
5

6
def listModuleFromLdr64():
7

8
    dprintln( "<u>64 bit modules:</u>", True )
9
 
10
    peb = typedVar( "ntdll!PEB", getProcessOffset(getCurrentProcess()) )
11

12
    moduleLst = typedVarList( peb.Ldr.deref().InMemoryOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" )
13

14
    for mod in moduleLst:
15
        name = typedVar( "ntdll!_UNICODE_STRING", mod.BaseDllName )  
16
        dprintln(loadWChars(name.Buffer, name.Length/2))
17

18
    try:
19
    
20
        peb32 = typedVar( "ntdll32!_PEB", getProcessOffset(getCurrentProcess()) - pageSize() )
21

22
        dprintln( "\n<u>32 bit modules:</u>", True)
23

24
        moduleLst = typedVarList( peb32.Ldr.deref().InMemoryOrderModuleList, "ntdll32!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" )
25

26
        for mod in moduleLst:
27
            name = typedVar( "ntdll32!_UNICODE_STRING", mod.BaseDllName )  
28
            dprintln(loadWChars(name.Buffer, name.Length/2))
29

30
    except BaseException:
31
        pass
32

33
def listModuleFromLdr():
34

35
    peb = typedVar( "ntdll!PEB", getProcessOffset(getCurrentProcess()) )
36
    
37
    moduleLst = typedVarList( peb.Ldr.deref().InMemoryOrderModuleList, "ntdll!_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks" )
38

39
    for mod in moduleLst:
40
        dprintln(loadUnicodeString(mod.BaseDllName))
41

42

43
def run():
44

45
    while True:
46

47
        if isKernelDebugging():
48
            dprintln( "not a user debugging" )
49
            break 
50
        
51
        if is64bitSystem():
52
            listModuleFromLdr64()
53
        else:
54
            listModuleFromLdr()
55

56
        break
57

58
if __name__ == "__main__":
59
    run()