pykd使用
1.加载
.load pykd
!pycmd
!py XXXX.py
2.打印
.dprintln
.dprint格式
<b></b>
<i></i>
<u></u>
dprintln("<link cmd=\".reload /f\">reload</link>", True)
3. WinDBG命令
s = dbgCommand("!analyze -v") dprint(s)
expr("@rax + 10")
4. 寄存器
import pykd
try:
i = 0
while True:
r = pykd.reg(i)
print "%s\t0x%x\t( %d )" % ( r.name(), r, r )
i += 1
except pykd.BaseException:
pass
或者
r = reg("eax")
print r / 10 * 234
5. 对于特定寄存器
>>> print findSymbol( rdmsr( 0x176 ) ) nt!KiFastCallEntry
6. 64位地址转换
addr64
print pykd.addr64( 0x80000000 ):
7. 读取字节，字，双字
ptrByte( va )
ptrWord( va )
ptrDWord( va )
ptrQWord( va )
有符号
ptrSignByte( va )
ptrSignWord( va )
ptrSignDWord( va )
ptrSignQWord( va )
读取到list
loadBytes( va, count )
loadWords( va, count )
loadDWords( va, count )
loadQWords( va, count )
loadSignBytes( va, count )
loadSignWords( va, count )
loadSignDWords( va, count )
loadSignQWords( va, count )
loadPtrs( va, count )
内存读取出错时，会raise MemoryException
8. 读取字符串
loadChars( va, count )
loadWChars( va, count )
from struct import unpack
shortField1, shortField2, longField = unpack('hhl', loadChars( addr, 8 ) )
loadСStr( va )
loadWStr( va )
loadAnsiString
loadUnicodeString
9. module
from pykd import *
try
ntdll = module( "ntdll" )
print ntdll.name(), hex(ntdll.begin()), hex(ntdll.size())
except BaseException:
print "module not found"
10. moudle的成员函数
name()
image()
pdb()
begin()
end()
checksum()
timestamp()
11. module的符号表
nt = module("nt")
print hex( nt.offset("PsLoadedModuleList") )
print hex( nt.__getattr__("PsLoadedModuleList") )
print hex( nt.PsLoadedModuleList )
12. 结构体
nt = module("nt")
print nt.type("_MDL")
13. 按结构体显示变量
nt = module("nt")
print nt.typedVar( "_LIST_ENTRY", nt.PsLoadedModuleList )
14.事件处理、 加载和卸载模块
onLoadModule
onUnloadModule
15. 读取到某个变量
from struct import unpack
shortField1, shortField2, longField = unpack('hhl', loadChars( addr, 8 ) )
16. 模块中的变量
t1 = typedVar( "MyModule!MyVar" ) t2 = typedVar( "MyModule!MyType", addr ) ti = typeInfo( "MyModule!MyType" ) t3 = typedVar( ti, addr )
17. 枚举变量中的每个字段(数组操作相同)
tv = typedVar( "structVar")
for fieldName, fieldValue in tv:
print fieldName, fieldValue
18. local 变量
# print local variable "argc"
print getLocals()["argc"]
# print all local vairables in the current frame
for varName, varValue in getLocals().items():
print varName, varValue
19. 调试事件
onBreakpoint
onException
onLoadModule
onUnloadModule
20.ptrPtr # GetPointer of this symbol
21. containingRecord
objHeader = containingRecord( dirEntry.Object, "nt!_OBJECT_HEADER", "Body" )
