def pools(db, line): ''' Display various information about the kernel allocation pools. ( Default lists the non-paged pools ) Usage: pools [options] ''' t = db.getTrace() dbgdata64va = t.getVariable('kddebuggerdata64') dbgdata64 = vt_winkern.KDDEBUGGER_DATA64() dbgdata64.vsParse(t.readMemory(dbgdata64va, len(dbgdata64))) s = dbgdata64.MmNonPagedPoolStart e = dbgdata64.MmNonPagedPoolEnd db.vprint('Non-Paged Pool: 0x%.8x - 0x%.8x (%d bytes)' % (s, e, (e - s))) nppool = dbgdata64.NonPagedPoolDescriptor pooldesc = t.getStruct('nt.POOL_DESCRIPTOR', va=nppool)
def _ctor_KDDEBUGGER_DATA64(db): t = db.getTrace() dbgdata64va = t.getVariable('kddebuggerdata64') dbgdata64 = vt_winkern.KDDEBUGGER_DATA64() dbgdata64.vsParse(t.readMemory(dbgdata64va, len(dbgdata64))) return dbgdata64