pykd

1
from pykd import *
2
import ntobj
3
import sys
4

5
nt = module("nt")
6

7

8
def findHanle(objaddr):
9

10
    processList = typedVarList( nt.PsActiveProcessHead, "nt!_EPROCESS", "ActiveProcessLinks"  )
11

12
    for process in processList:
13

14
        dprintln( "search in process %x " % process.UniqueProcessId +  "".join( [chr(i) for i in process.ImageFileName if i != 0] ) )
15
        
16
        if process.ObjectTable == 0:
17
            continue
18

19
        objects = ntobj.getListByHandleTable( process.ObjectTable )
20
        for obj in objects:
21
            if obj[0] == objaddr:
22
                dprintln("\tHandle: %x" % ( obj[1],) )
23
               
24

25
def usage():
26
    dprintln("!py findhandle object_address")
27

28
def main():
29

30
    if not isKernelDebugging():
31
        dprintln("This script for kernel debugging only")
32
        return
33

34
    if len(sys.argv) < 2:
35
        usage();
36
        return;
37

38
    objaddr = expr(sys.argv[1])
39
    
40
    objectType = ntobj.getType(objaddr)
41
    
42
    dprintln("Object Type: " + ntobj.getObjectName(objectType) )
43
    dprintln("Object Name: "+ ntobj.getObjectName(objaddr) )
44
    dprintln("")
45

46
    findHanle( objaddr )
47

48
if __name__ == "__main__":
49
    main()