# Path: dbginterface.py
# def LocalKernelDebugger(quiet=True):
#     """| Check that all conditions to Local Kernel Debugging are met
#        | and return a LKD (subclass of :class:`LocalKernelDebuggerBase`
#     """
#     if not windows.utils.check_debug():
#         raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging on kernel not in DEBUG mode")
#     if not windows.utils.check_is_elevated():
#         raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging from non-Admin process")
#     windows.utils.enable_privilege(SE_DEBUG_NAME, True)
#     if windows.system.bitness == 64:
#         if windows.current_process.is_wow_64:
#             raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging from SysWow64 process (please launch from 64bits python)")
#         return LocalKernelDebugger64(quiet)
#     return LocalKernelDebugger32(quiet)


import sys
import os
import windows
from dbginterface import LocalKernelDebugger

name = kdbg.get_type_name("nt", type_id)
print("The type name is {0}".format(name))
# proof that you can either use the type_id or the type name in our API
size = kdbg.get_type_size("nt", type_id)
print("The size retrieved using type_id is {0}".format(hex(size)))

size = kdbg.get_type_size("nt", "_KPCR")
print('The size retrieved using "_KPCR" is {0}'.format(hex(size)))

offset = kdbg.get_field_offset("nt", "_KPCR", "IDT")
print('Field "IDT" is at offset {0} in "nt!_KPCR"'.format(hex(offset)))

# Get the type_id and offset of the field PrcbData
prcbdata_type_id, offset = kdbg.get_field_type_and_offset("nt", "_KPCR", "PrcbData")
# Get the name of the type of PrcbData
prcbdata_type_name = kdbg.get_type_name("nt", prcbdata_type_id)
# Get the size of the type of PrcbData
prcbdata_size = kdbg.get_type_size("nt", prcbdata_type_id)
print('PrcbData is a field of type "{0}" (size {1}) at offset {2} in "nt!_KPCR"'.format(prcbdata_type_name, hex(prcbdata_size), hex(offset)))

print("")
print("Listing the 5 firsts fields of {0}".format(prcbdata_type_name))
print("{0}:".format(prcbdata_type_name))
for i in range(5):
    # I don't know a better way of getting the type and offset if field number X than
    # getting the name if field number X
    # getting the type and offset of the field with this name
    name = kdbg.get_field_name("nt", prcbdata_type_id, i)
    type, offset = kdbg.get_field_type_and_offset("nt", prcbdata_type_id, name)

# Path: dbginterface.py
# def LocalKernelDebugger(quiet=True):
#     """| Check that all conditions to Local Kernel Debugging are met
#        | and return a LKD (subclass of :class:`LocalKernelDebuggerBase`
#     """
#     if not windows.utils.check_debug():
#         raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging on kernel not in DEBUG mode")
#     if not windows.utils.check_is_elevated():
#         raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging from non-Admin process")
#     windows.utils.enable_privilege(SE_DEBUG_NAME, True)
#     if windows.system.bitness == 64:
#         if windows.current_process.is_wow_64:
#             raise LocalKernelDebuggerError("Cannot perform LocalKernelDebugging from SysWow64 process (please launch from 64bits python)")
#         return LocalKernelDebugger64(quiet)
#     return LocalKernelDebugger32(quiet)


# Path: example/type_demo.py
import sys
import os
import windows
from dbginterface import LocalKernelDebugger


name = kdbg.get_type_name("nt", type_id)
print("The type name is {0}".format(name))
# proof that you can either use the type_id or the type name in our API
size = kdbg.get_type_size("nt", type_id)
print("The size retrieved using type_id is {0}".format(hex(size)))

size = kdbg.get_type_size("nt", "_KPCR")
print('The size retrieved using "_KPCR" is {0}'.format(hex(size)))

offset = kdbg.get_field_offset("nt", "_KPCR", "IDT")
print('Field "IDT" is at offset {0} in "nt!_KPCR"'.format(hex(offset)))

# Get the type_id and offset of the field PrcbData
prcbdata_type_id, offset = kdbg.get_field_type_and_offset("nt", "_KPCR", "PrcbData")
# Get the name of the type of PrcbData
prcbdata_type_name = kdbg.get_type_name("nt", prcbdata_type_id)
# Get the size of the type of PrcbData
prcbdata_size = kdbg.get_type_size("nt", prcbdata_type_id)
print('PrcbData is a field of type "{0}" (size {1}) at offset {2} in "nt!_KPCR"'.format(prcbdata_type_name, hex(prcbdata_size), hex(offset)))

print("")
print("Listing the 5 firsts fields of {0}".format(prcbdata_type_name))
print("{0}:".format(prcbdata_type_name))
for i in range(5):
    # I don't know a better way of getting the type and offset if field number X than
    # getting the name if field number X
    # getting the type and offset of the field with this name
    name = kdbg.get_field_name("nt", prcbdata_type_id, i)
    type, offset = kdbg.get_field_type_and_offset("nt", prcbdata_type_id, name)

    type_name = kdbg.get_type_name("nt", type)