Skip to content

Latest commit

 

History

History
37 lines (29 loc) · 973 Bytes

README.md

File metadata and controls

37 lines (29 loc) · 973 Bytes

drakpdb

Helper library to generate DRAKVUF profiles.

Installation

pip3 install -r requirements.txt

Example

Generating profile from kernel (with LibVMI)

  1. Get PDB name and GUID/Age using vmi-win-guid

    # vmi-win-guid name windows7-sp1
Windows Kernel found @ 0x2610000
        Version: 64-bit Windows 7
        PE GUID: 4ce7951a5ea000
        PDB GUID: 3844dbb920174967be7aa4a2c20430fa2
        Kernel filename: ntkrnlmp.pdb
        ...

  2. Download PDB and parse it to a json profile

    python3 drakpdb.py fetch_pdb ntkrnlmp.pdb 3844dbb920174967be7aa4a2c20430fa2
python3 drakpdb.py parse_pdb ntkrnlmp.pdb > ntkrnlmp.json

Generating profile from DLL

  1. Use symchk.py from moyix/pdbparse to obtain PDB
  2. Use: 
    python3 drakpdb.py parse_pdb dllname.pdb > dllname.json