def init(self, eprocessobj):
try:
if eprocessobj.ObjectTable<mmhighestuseraddress or eprocessobj.VadRoot<mmhighestuseraddress or eprocessobj.QuotaBlock<mmhighestuseraddress:
return False
self.eprocessaddr=int(eprocessobj)
self.pid=int(eprocessobj.UniqueProcessId)
self.parentpid=int(eprocessobj.InheritedFromUniqueProcessId)
self.peb=int(eprocessobj.Peb)
filepath=pykd.loadUnicodeString(eprocessobj.SeAuditProcessCreationInfo.ImageFileName.Name)
filepath=revise_filepath(filepath)
name=pykd.loadChars(eprocessobj.ImageFileName, 16)
if name.startswith('\x00'):
name=''
name=name.strip('\x00')
self.filepath, self.name=guess_filepath(filepath, name)
return True
except Exception, err:
print traceback.format_exc()
return False
def init(self, eprocessobj):
try:
if eprocessobj.ObjectTable < mmhighestuseraddress or eprocessobj.VadRoot < mmhighestuseraddress or eprocessobj.QuotaBlock < mmhighestuseraddress:
return False
self.eprocessaddr = int(eprocessobj)
self.pid = int(eprocessobj.UniqueProcessId)
self.parentpid = int(eprocessobj.InheritedFromUniqueProcessId)
self.peb = int(eprocessobj.Peb)
filepath = pykd.loadUnicodeString(
eprocessobj.SeAuditProcessCreationInfo.ImageFileName.Name)
filepath = revise_filepath(filepath)
name = pykd.loadChars(eprocessobj.ImageFileName, 16)
if name.startswith('\x00'):
name = ''
name = name.strip('\x00')
self.filepath, self.name = guess_filepath(filepath, name)
return True
except Exception, err:
print traceback.format_exc()
return False
def testLoadChars(self):
s = pykd.loadChars(target.module.helloStr, 5)
self.assertEqual("Hello", s)
def is_valid_address(self, addr):
try:
pykd.loadChars(addr,1,phyAddr=True)
return True
except pykd.MemoryException:
return False
def zread(self, offset, length):
try:
return pykd.loadChars(offset,length,phyAddr=True)
except pykd.MemoryException:
return '\x00'*length
def read(self, addr, size):
return pykd.loadChars(addr, size)
def is_valid_address(self, addr):
try:
pykd.loadChars(addr, 1, phyAddr=True)
return True
except pykd.MemoryException:
return False
def zread(self, offset, length):
try:
return pykd.loadChars(offset, length, phyAddr=True)
except pykd.MemoryException:
return '\x00' * length
def read(self, addr, size):
return pykd.loadChars(addr, size)
