pykd

1
#
2
#
3
#
4

5
import sys
6
import fnmatch
7
from pykd import *
8

9

10
def export( moduleName, mask = "*" ):
11

12
    modObj = module( moduleName )
13
    dprintln( "Module: " + moduleName + " base: %x" % modObj.begin() + " end: %x" % modObj.end() )
14

15
    if isKernelDebugging():
16
        systemModule = module( "nt" )
17
    else:
18
        systemModule = module( "ntdll" )
19
   
20

21
    if is64bitSystem():
22
        ntHeader = systemModule.typedVar( "_IMAGE_NT_HEADERS64", modObj.begin() + ptrDWord( modObj.begin() + 0x3c ) )
23
        if ntHeader.OptionalHeader.Magic == 0x10b:
24
            systemModule = loadModule( "ntdll32" ) 
25
            ntHeader = systemModule.typedVar( "_IMAGE_NT_HEADERS", modObj.begin() + ptrDWord( modObj.begin() + 0x3c ) )
26
    else:
27
        ntHeader = systemModule.typedVar("_IMAGE_NT_HEADERS", modObj.begin() + ptrDWord( modObj.begin() + 0x3c ) )
28

29

30
    dprintln( "Export RVA: %x  Size: %x" % ( ntHeader.OptionalHeader.DataDirectory[0].VirtualAddress, ntHeader.OptionalHeader.DataDirectory[0].Size  ) )
31
    dprintln( "========================" )
32

33
    if ntHeader.OptionalHeader.DataDirectory[0].Size == 0:
34
        return
35
    
36
    exportDirAddr = modObj.begin() + ntHeader.OptionalHeader.DataDirectory[0].VirtualAddress;
37

38
    namesCount = ptrDWord( exportDirAddr + 0x18 )
39
   
40
    namesRva = modObj.begin() + ptrDWord( exportDirAddr + 0x20 ) 
41

42
    for i in range( 0, namesCount ):
43
        exportName = loadCStr( modObj.begin() + ptrDWord( namesRva + 4 * i ) )
44
        if fnmatch.fnmatch( exportName, mask ): 
45
            dprintln( exportName )
46

47

48
if __name__ == "__main__":
49

50
    if not isWindbgExt():
51
        print "script is launch out of windbg"
52
        quit( 0 )
53

54
    if len (sys.argv)<=1:
55
        dprintln( "usage: !py export module_name ( export mask )" )
56
    elif len( sys.argv ) == 2:
57
        export( sys.argv[1] )
58
    else:
59
        export( sys.argv[1], sys.argv[2] )
60

61
       
62