VAD Tools Code

#!/usr/bin/env python

from struct import unpack

POOL_SIZE_MASK = 0x01FF
POOL_TYPE_MASK = 0xFE00

# info based on _POOL_HEADER info from XPSP2
# Some details differ on Win2K SP4--don't trust this entirely.

class PoolHeader:
    types = {
        "NonPagedPool": 0,
        "PagedPool": 1,
        "NonPagedPoolMustSucceed": 2,
        "DontUseThisType": 3,
        "NonPagedPoolCacheAligned": 4,
        "PagedPoolCacheAligned": 5,
        "NonPagedPoolCacheAlignedMustS": 6,
        "MaxPoolType": 7,
        "NonPagedPoolSession": 32,
        "PagedPoolSession": 33,
        "NonPagedPoolMustSucceedSession": 34,
        "DontUseThisTypeSession": 35,
        "NonPagedPoolCacheAlignedSession": 36,
        "PagedPoolCacheAlignedSession": 37,
        "NonPagedPoolCacheAlignedMustSSession": 38
    }
    names = {
        0: "NonPagedPool",
        1: "PagedPool",
        2: "NonPagedPoolMustSucceed",
        3: "DontUseThisType",
        4: "NonPagedPoolCacheAligned",
        5: "PagedPoolCacheAligned",
        6: "NonPagedPoolCacheAlignedMustS",
        7: "MaxPoolType",
        32: "NonPagedPool",
        33: "PagedPoolSession",
        34: "NonPagedPoolMustSucceedSession",
        35: "DontUseThisTypeSession",
        36: "NonPagedPoolCacheAlignedSession",
        37: "PagedPoolCacheAlignedSession",
        38: "NonPagedPoolCacheAlignedMustSSession",
    }

    def __init__(self, str):
        (prev, cur, tag) = unpack("<HH4s", str)
        self.tag = tag
        self.prev_size = (prev & POOL_SIZE_MASK) * 8 # Should be 32 on Win2k
        self.cur_size = (cur & POOL_SIZE_MASK) * 8 # Should be 32 on Win2k
        self.index = (prev & POOL_TYPE_MASK) >> 9
        self.type = (cur & POOL_TYPE_MASK) >> 9
    def getType(self):
        return self.type
    def getTypeStr(self):
        try: return self.names[self.type]
        except KeyError: return "UnknownType"