예제 #1
0
def pools(db, line):
    '''
    Display various information about the kernel allocation
    pools. ( Default lists the non-paged pools )

    Usage: pools [options]
    '''
    t = db.getTrace()

    dbgdata64va = t.getVariable('kddebuggerdata64')
    dbgdata64 = vt_winkern.KDDEBUGGER_DATA64()
    dbgdata64.vsParse(t.readMemory(dbgdata64va, len(dbgdata64)))

    s = dbgdata64.MmNonPagedPoolStart
    e = dbgdata64.MmNonPagedPoolEnd
    db.vprint('Non-Paged Pool: 0x%.8x - 0x%.8x (%d bytes)' % (s, e, (e - s)))
    nppool = dbgdata64.NonPagedPoolDescriptor
    pooldesc = t.getStruct('nt.POOL_DESCRIPTOR', va=nppool)
예제 #2
0
def _ctor_KDDEBUGGER_DATA64(db):
    t = db.getTrace()
    dbgdata64va = t.getVariable('kddebuggerdata64')
    dbgdata64 = vt_winkern.KDDEBUGGER_DATA64()
    dbgdata64.vsParse(t.readMemory(dbgdata64va, len(dbgdata64)))
    return dbgdata64