pykd

1
#
2
#
3
#
4

5
import sys
6
from pykd import *
7

8

9
def printGdtEntry( addr ):
10

11
    dprintln( "GDT Entry: %x" % addr )
12
 
13
    attr = ptrByte( addr + 5 ) + ( ( ptrByte( addr + 6 ) & 0xF0 ) << 4 )
14
  
15
    limit = ptrWord( addr ) + ( ( ptrByte( addr + 6  ) & 0xF ) << 16 )
16
   
17
    base = ptrWord( addr + 2 ) + ( ptrByte( addr + 4) << 16 ) + ( ptrByte( addr + 7 ) << 24 )
18

19

20
    if attr & 0x10:
21
        pass
22
    else:
23
        if is64bitSystem():
24
            base = ( ptrDWord( addr + 8 ) << 32 ) + base   
25

26
    if attr & 0x800:
27
        limit = ( limit << 12 ) | 0xFFF
28

29

30
    dprint( "attr: %x ( " % attr  + "".join( [ ( attr & ( 1 << ( 11 - i ) ) ) and "1" or "0" for i in range(0,12) ] ) + " )" )
31
    dprint( "  base: %x" % base )        
32
    dprintln( "  limit: %x" % limit )
33

34

35
def printGdt( gdtr ):
36
    for s in ( "cs", "es", "ds", "ss", "gs", "fs", "tr" ):
37
        dprintln( s + " (%x):" % reg(s) )
38
        printGdtEntry( gdtr + ( reg( s ) & 0xFFF8 ) )
39
        dprintln("")              
40

41
    
42

43
def printGdtHelp():
44
 
45
    dprintln( "Usage:" )
46
    dprintln( "!py gdt help - Print out this message" )
47
    dprintln( "!py gdt x - Print out gdt entry. The gdt entry's base is got from gdtr" )
48
    dprintln( "!py gdt x y - Print out gdt entry. The gdt entry's base is x, y - offset" )
49

50

51
if __name__ == "__main__":
52

53
    if not isWindbgExt():
54
        print "script is launch out of windbg"
55
        quit( 0 )
56

57
    gdtr = reg("gdtr")
58

59
    if len( sys.argv)==1:
60
        printGdt( gdtr )
61

62
    elif sys.argv[1] == "help":
63
        printGdtHelp()      
64

65
    elif len( sys.argv )==2:
66
        printGdtEntry( gdtr + ( int( sys.argv[1], 16 ) & 0xFFF8 ) )
67

68
    else:
69
        printGdtEntry( int( sys.argv[1], 16 ) + ( int( sys.argv[2], 16 ) & 0xFFF8 ) )
70