pykd

1
from pykd import *
2
from sys import argv
3

4
nt = module("nt")
5
LDR_DATA_TABLE_ENTRY = nt.type("_LDR_DATA_TABLE_ENTRY")
6
    
7

8
def getModuleList():
9
    ldrLst = typedVarList( nt.PsLoadedModuleList, LDR_DATA_TABLE_ENTRY, "InLoadOrderLinks.Flink")
10
    return [ module(m.DllBase) for m in ldrLst ]  
11
    
12
def findTagInModule(mod, tag):
13
    
14
    matchLst = []
15
    begin = mod.begin()
16
    end = mod.end()
17
    offset = begin
18
    size = mod.size()
19
    while True:
20
        match = searchMemory( offset, size, tag )
21
        if not match:
22
            break;
23
        matchLst.append(match)
24
        offset = match + 1
25
        size = end - offset
26
    return matchLst
27
    
28
    
29
def main():
30

31
    if len(argv) < 2:
32
        print "You should note tag's value"
33
        return
34

35
    if len(argv[1])!=4:
36
        print "Tag must have 4 symbols length"
37
        return
38

39
    tag = str(argv[1])
40

41
    modLst = getModuleList()
42
    for m in modLst:
43
        matchLst = findTagInModule( m, tag )
44
        if len(matchLst) == 0:
45
            #print m.name(), "tag not found"
46
            pass
47
        else:
48
            print m.name(), "found", len(matchLst), "entries"
49
            for offset in matchLst:
50
                print "\t", hex(offset)
51
   
52
   
53
if __name__=="__main__":
54
    main()
55

56

57