pykd

1
from pykd import *
2
import sys
3

4

5
nt = module( "nt" )
6

7
def getServiceAddrWlh(Start, Offset):
8
    return Start + (Offset / 16)
9

10
def getServiceAddr2k3(Start, Offset):
11
    return Start + (Offset & ~0xf)
12

13
if ptrWord( nt.offset("NtBuildNumber")) == 3790:
14
    getServiceAddr = getServiceAddr2k3
15
else:
16
    getServiceAddr = getServiceAddrWlh
17

18
def getSymbolString(addr):
19
  try:
20
    return findSymbol(addr)
21
  except BaseException:
22
    pass
23
  return " !!! 0x%x" % addr
24

25
def checkSSDT():
26

27
    if is64bitSystem():
28

29
       serviceTableHeader = loadQWords( nt.offset("KeServiceDescriptorTable"), 4 )
30
       serviceTableStart = serviceTableHeader[0]
31
       serviceCount = serviceTableHeader[2]
32

33
       dprintln( "ServiceTable  start: %(1)x  count: %(2)x" % { "1" : serviceTableStart, "2" : serviceCount } )
34

35
       serviceTable = loadSignDWords( serviceTableStart, serviceCount ) 
36

37
       for i in range( 0, serviceCount ):
38

39
         routineAddress = getServiceAddr(serviceTableStart, serviceTable[i]);
40
         dprintln( "[%u] " % i + getSymbolString( routineAddress ) )
41

42

43
    else:
44

45
       serviceTableHeader = loadDWords( nt.offset("KeServiceDescriptorTable"), 4 )
46
       serviceTableStart = serviceTableHeader[0]
47
       serviceCount = serviceTableHeader[2]
48

49
       dprintln( "ServiceTable  start: %(1)x  count: %(2)x" % { "1" : serviceTableStart, "2" : serviceCount } )
50

51
       serviceTable = loadPtrs( serviceTableStart, serviceCount ) 
52

53
       for i in range( 0, serviceCount ):
54
          dprintln( "[%u] " % i + getSymbolString( serviceTable[i] ) )
55

56
if __name__ == "__main__":
57

58

59
    while True:
60

61
        if not isWindbgExt():
62
            if not loadDump( sys.argv[1] ):
63
                dprintln( sys.argv[1] + " - load failed" )
64
                break
65

66
        if not isKernelDebugging():
67
            dprintln( "not a kernel debugging" )
68
            break 
69
                 
70
        checkSSDT()
71
        break      
72

73