Access the kernel space with PyDbgEng
One year ago, I wrote a Chinese article , now I port the implementation to the PyDbgExt project, so we can directly access the kernel space in python. >>> from PyDbgEng import *>>> c = DebugClient()>>> c.AttachKernel()>>> c.Control.WaitForEvent()True>>> c.Symbols.LoadedModules{‘nt’: (Module nt @ ffffffff80800000)}>>> c.Symbols.GetSymbols(“nt!KiServiceTable”){‘KiServiceTable’: ((Symbol nt!KiServiceTable), 0)}>>> offset = c.Symbols.GetSymbols(“nt!KiServiceTable”).popitem()[1][0].Offset>>> c.Symbols.GetSymbols(c.DataSpaces.Virtual.ReadPointers(offset)[0]){‘NtAcceptConnectPort’: ((Symbol nt!NtAcceptConnectPort), 18446744071571636794L)} To [...]