pykd

1
#
2
#
3
#
4

5
import sys
6
import fnmatch
7
from pykd import *
8

9

10
def iat( moduleName, mask = "*" ):
11

12
    mod = module( moduleName )
13
    dprintln( "Module: " + moduleName + " base: %x" % mod.begin() + " end: %x" % mod.end() )
14

15
    if isKernelDebugging():
16
        systemModule = module( "nt" )
17
    else:
18
        systemModule = module( "ntdll" )
19
    
20

21
    if is64bitSystem():
22
        ntHeader = systemModule.typedVar( "_IMAGE_NT_HEADERS64", mod.begin() + ptrDWord( mod.begin() + 0x3c ) )
23
        if ntHeader.OptionalHeader.Magic == 0x10b:
24
            systemModule = loadModule( "ntdll32" ) 
25
            ntHeader = systemModule.typedVar( "_IMAGE_NT_HEADERS", mod.begin() + ptrDWord( mod.begin() + 0x3c ) )
26
            pSize = 4
27
        else:
28
            pSize = 8     
29
    else:
30
        ntHeader = systemModule.typedVar(  "_IMAGE_NT_HEADERS", mod.begin() + ptrDWord( mod.begin() + 0x3c ) )
31
        pSize = 4
32

33

34
    dprintln( "IAT RVA: %x  Size: %x" % ( ntHeader.OptionalHeader.DataDirectory[12].VirtualAddress, ntHeader.OptionalHeader.DataDirectory[12].Size  ) )
35
    dprintln( "========================" )
36

37
    if ntHeader.OptionalHeader.DataDirectory[12].Size == 0:
38
        return
39
    
40
    iatAddr = mod.begin() + ntHeader.OptionalHeader.DataDirectory[12].VirtualAddress;
41

42
    for i in range( 0, ntHeader.OptionalHeader.DataDirectory[12].Size / pSize ):
43

44
        if ( pSize == 4 ):
45
            iatEntry = addr64(ptrDWord( iatAddr + i*pSize ))
46
        else:
47
            iatEntry = addr64(ptrQWord( iatAddr + i*pSize ))
48

49
        if  iatEntry != None and iatEntry != 0:
50
            symbolName = findSymbol( iatEntry ) 
51
            if fnmatch.fnmatch( symbolName, mask ): 
52
                dprintln( symbolName ) 
53

54

55
if __name__ == "__main__":
56

57
    if not isWindbgExt():
58
        print "script is launch out of windbg"
59
        quit( 0 )
60

61
    if len (sys.argv)<=1:
62
        dprintln( "usage: !py import module_name ( symbol name mask )" )
63
    elif len( sys.argv ) == 2:
64
        iat( sys.argv[1] )
65
    else:
66
        iat( sys.argv[1], sys.argv[2] )
67

68