Updated Release: PYKD 0.3.2.7 (июн 20, 2017)

Supported Python Version

• Python 2.7 x86/x64
• Python 3.5 x86/x64
• Python 3.6 x86/x64

Installation as a WinDBG extension with pykd bootstrapper

If you are going to run pykd in the windbg it is easiest way. Follow this link pykd bootstrapper 2.0 to install pykd bootstrapper and get started.

Python 3.0 support

Pykd bootstrapper 2.0 fully supports python 3.x. You can use 2.x and 3.x python both inside the same windbg session. You can install pykd from PyPi for python 3.5 and 3.6. For another 3.x pythons you need to build pykd manually.

Installation as a Python package with pip:

You can install pykd as a common python package with pip:

pip install pykd

Or upgrade existing version:

pip install pykd --upgrade

Pip documentation: https://pip.pypa.io
Pykd page on the PyPI: https://pypi.python.org/pypi/pykd

If pip can not install pykd from PyPI

Sometimes pip can not install packages from PyPi, for example due proxy with NTLM authorization. In this situation you can download a python wheel ( file with wlh extension ) and install it with pip locally:

pip install pykd-0.3.1.1-cp27-none-win32.whl

Manual Installation guide:

0. choose x86 or x64 and download it
1. unpack archive to any catalog
2. run windbg and load pykd:
.load path-to-pykd
3. to use pykd within python program add a path to pykd to the PYTHONPATH or via registry ( \SOFTWARE\Python\PythonCore\version\PythonPath )

Attention!!! Do not attempt to copy pykd.pyd of the 0.3.x version over 0.2.x . It will not work properly!

What's new

Automatic string conversion for function call

   fileHandle = CreateFileW(
       "C:\\temp\\testfile.txt",   # <-- python string will be conerted to wide char array automatically
       GENERIC_READ | GENERIC_WRITE,
       0,
       NULL,
       CREATE_ALWAYS,
       FILE_ATTRIBUTE_NORMAL,
       NULL )

Calling function without prototype

For simple cases you can call function without getting prototype:

kernelbase = module("kernelbase")
callFunctionRaw(kernelbase.Beep, 200, 440) # <-- function prototype will be defined automatically