Updated Release: PYKD 0.3.2.4 (апр 11, 2017)

Supported Python Version

• Python 2.7 x86/x64
• Python 3.5 x86/x64
• Python 3.6 x86/x64

Installation as a WinDBG extension with pykd bootstrapper

If you are going to run pykd in the windbg it is easiest way. Follow this link pykd bootstrapper 2.0 to install pykd bootstrapper and get started.

Python 3.0 support

Pykd bootstrapper 2.0 fully supports python 3.x. You can use 2.x and 3.x python both inside the same windbg session. You can install pykd from PyPi for python 3.5 and 3.6. For another 3.x pythons you need to build pykd manually.

Installation as a Python package with pip:

You can install pykd as a common python package with pip:

pip install pykd

Or upgrade existing version:

pip install pykd --upgrade

Pip documentation: https://pip.pypa.io
Pykd page on the PyPI: https://pypi.python.org/pypi/pykd

If pip can not install pykd from PyPI

Sometimes pip can not install packages from PyPi, for example due proxy with NTLM authorization. In this situation you can download a python wheel ( file with wlh extension ) and install it with pip locally:

pip install pykd-0.3.1.1-cp27-none-win32.whl

Manual Installation guide:

0. choose x86 or x64 and download it
1. unpack archive to any catalog
2. run windbg and load pykd:
.load path-to-pykd
3. to use pykd within python program add a path to pykd to the PYTHONPATH or via registry ( \SOFTWARE\Python\PythonCore\version\PythonPath )

Attention!!! Do not attempt to copy pykd.pyd of the 0.3.x version over 0.2.x . It will not work properly!

Where is an automatic installer?

We still have a problem with the installer (see https://pykd.codeplex.com/workitem/13172 ) and can not upload fixed version now.

What's new

Typed access to byte sequance

Try this code:

from pykd import *

source_code =  '''
struct Struct
{
    int    field1;
    char   field2;
    };
'''
Struct = getTypeFromSource(source_code, "Struct")

var = typedVar(Struct, [0x11, 0x22, 0x33, 0x44, 0x55])

print(var)

It is a suspected output:

struct/class: Struct at cached data
   +0000 field1                  : Int4B   0x44332211 (1144201745)
   +0004 field2                  : Char   0x55 (85)

Getting typedVar as ray bytes sequance

Add a string to the previous script:

print(var.rawBytes())

and we are getting:

[17, 34, 51, 68, 85, 0, 0, 0]

Bug fixed:

• issue #14079 ( getTypeFromSouce crashes on invalid struct definitions )
• issue #14087 ( printing Long var raises exception )