# Path: dbginterface.py
# def LocalKernelDebugger(quiet=True):
#     """| Check that all conditions to Local Kernel Debugging are met
#        | and return a LKD (subclass of :class:`LocalKernelDebuggerBase`
#     """
#     if not windows.utils.check_debug():
#         raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging on kernel not in DEBUG mode")
#     if not windows.utils.check_is_elevated():
#         raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging from non-Admin process")
#     windows.utils.enable_privilege(SE_DEBUG_NAME, True)
#     if windows.system.bitness == 64:
#         if windows.current_process.is_wow_64:
#             raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging from SysWow64 process (please launch from 64bits python)")
#         return LocalKernelDebugger64(quiet)
#     return LocalKernelDebugger32(quiet)


import sys
import ctypes
import os
import windows
from windows.generated_def.winstructs import *
from dbginterface import LocalKernelDebugger
        pcrbdata_offset = kdbg.get_field_offset("nt", KPCR, "PrcbData.VectorToInterruptObject")
    except WindowsError:
        pcrbdata_offset = 0
    addr_nt_KiStartUnexpectedRange = kdbg.get_symbol_offset("nt!KiStartUnexpectedRange")
    addr_nt_KiEndUnexpectedRange = kdbg.get_symbol_offset("nt!KiEndUnexpectedRange")
    if pcrbdata_offset == 0:
        get_kinterrupt = lambda kdbg, addr, kpcr, i: get_kinterrupt_64(kdbg, addr)
    else:
        get_kinterrupt = lambda kdbg, addr, kpcr, i: get_kinterrupt_32(kdbg, kpcr, i)

    kpcr_addr = kdbg.read_processor_system_data(num_proc, DEBUG_DATA_KPCR_OFFSET)
    idt_base = kdbg.read_ptr(kpcr_addr + idt_base_offset)
    for i in xrange(0, 0xFF):
        idt32 = IDT32()
        kdbg.read_virtual_memory_into(idt_base + i * sizeof(IDT32), idt32)
        if (idt32.ExtendedOffset == 0 or idt32.Offset == 0):
            l_idt.append((None, None))
            continue
        addr = (idt32.ExtendedOffset << 16) | idt32.Offset
        if (addr < addr_nt_KiStartUnexpectedRange or addr > addr_nt_KiEndUnexpectedRange):
            l_idt.append((addr, get_kinterrupt(kdbg, addr, kpcr_addr, i)))
        else:
            addr_kinterrupt = get_kinterrupt(kdbg, addr, kpcr_addr, i)
            if addr_kinterrupt is None:
                addr = None
            l_idt.append((addr, addr_kinterrupt))
    return l_idt


if __name__ == '__main__':

# Path: dbginterface.py
# def LocalKernelDebugger(quiet=True):
#     """| Check that all conditions to Local Kernel Debugging are met
#        | and return a LKD (subclass of :class:`LocalKernelDebuggerBase`
#     """
#     if not windows.utils.check_debug():
#         raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging on kernel not in DEBUG mode")
#     if not windows.utils.check_is_elevated():
#         raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging from non-Admin process")
#     windows.utils.enable_privilege(SE_DEBUG_NAME, True)
#     if windows.system.bitness == 64:
#         if windows.current_process.is_wow_64:
#             raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging from SysWow64 process (please launch from 64bits python)")
#         return LocalKernelDebugger64(quiet)
#     return LocalKernelDebugger32(quiet)


# Path: example/idt.py
import sys
import ctypes
import os
import windows
from windows.generated_def.winstructs import *
from dbginterface import LocalKernelDebugger

        pcrbdata_offset = kdbg.get_field_offset("nt", KPCR, "PrcbData.VectorToInterruptObject")
    except WindowsError:
        pcrbdata_offset = 0
    addr_nt_KiStartUnexpectedRange = kdbg.get_symbol_offset("nt!KiStartUnexpectedRange")
    addr_nt_KiEndUnexpectedRange = kdbg.get_symbol_offset("nt!KiEndUnexpectedRange")
    if pcrbdata_offset == 0:
        get_kinterrupt = lambda kdbg, addr, kpcr, i: get_kinterrupt_64(kdbg, addr)
    else:
        get_kinterrupt = lambda kdbg, addr, kpcr, i: get_kinterrupt_32(kdbg, kpcr, i)

    kpcr_addr = kdbg.read_processor_system_data(num_proc, DEBUG_DATA_KPCR_OFFSET)
    idt_base = kdbg.read_ptr(kpcr_addr + idt_base_offset)
    for i in xrange(0, 0xFF):
        idt32 = IDT32()
        kdbg.read_virtual_memory_into(idt_base + i * sizeof(IDT32), idt32)
        if (idt32.ExtendedOffset == 0 or idt32.Offset == 0):
            l_idt.append((None, None))
            continue
        addr = (idt32.ExtendedOffset << 16) | idt32.Offset
        if (addr < addr_nt_KiStartUnexpectedRange or addr > addr_nt_KiEndUnexpectedRange):
            l_idt.append((addr, get_kinterrupt(kdbg, addr, kpcr_addr, i)))
        else:
            addr_kinterrupt = get_kinterrupt(kdbg, addr, kpcr_addr, i)
            if addr_kinterrupt is None:
                addr = None
            l_idt.append((addr, addr_kinterrupt))
    return l_idt


if __name__ == '__main__':

    kdbg = LocalKernelDebugger()