pykd
1
2
3import pykd4
5
6win_src = '''7
8typedef void* LPVOID;
9typedef size_t SIZE_T;
10typedef unsigned long DWORD;
11typedef bool BOOL;
12
13LPVOID
14__stdcall
15VirtualAlloc(
16LPVOID lpAddress,
17SIZE_T dwSize,
18DWORD flAllocationType,
19DWORD flProtect
20);
21
22BOOL
23__stdcall
24VirtualFree(
25LPVOID lpAddress,
26SIZE_T dwSize,
27DWORD dwFreeType
28);
29
30
31DWORD
32__stdcall
33GetLastError(void);l
34
35'''
36
37MEM_COMMIT = 0x100038MEM_RELEASE = 0x800039PAGE_READWRITE = 0x440
41winTypeProvider = pykd.getTypeInfoProviderFromSource(win_src, "-w")42
43kernel = pykd.module('KERNELBASE')44
45VirtualAlloc = pykd.typedVar(winTypeProvider.getTypeByName('VirtualAlloc'), kernel.VirtualAlloc )46VirtualFree = pykd.typedVar(winTypeProvider.getTypeByName('VirtualFree'), kernel.VirtualFree )47GetLastError = pykd.typedVar(winTypeProvider.getTypeByName('GetLastError'), kernel.GetLastError )48
49addr = VirtualAlloc(0, 0x1000, MEM_COMMIT, PAGE_READWRITE)50
51if addr:52print("Allocated memory: %x" % addr )53
54if VirtualFree(addr, 0, MEM_RELEASE):55print("Successfully free memory")56else:57print("Failed VirtualFree with error %x" % GetLastError() )58else:59print("Failed VirtualAlloc with error %x" % GetLastError() )60