Skip to content

Instantly share code, notes, and snippets.

@ntddk

ntddk/windbg_detect_doublepulsar_smb.py

Created May 31, 2017 15:03
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save ntddk/ed4d4d10842dac40110aa8b6b62a3391 to your computer and use it in GitHub Desktop.
Save ntddk/ed4d4d10842dac40110aa8b6b62a3391 to your computer and use it in GitHub Desktop.
Download ZIP
windbg-doublepulsar-detection-script
Raw
windbg_detect_doublepulsar_smb.py
#!/usr/bin/env python
# coding: utf-8
import pykd
for i in pykd.dbgCommand('dps srv!SrvTransaction2DispatchTable').split('\n'):
if len(i) > 0 and '00000000' not in i and 'srv!' not in i: # addr addr symbol
print 'Doublepulsar hook detected: ' + i
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment