Toolkits for KPH Dynamic Data

August 5, 2026 · View on GitHub

简体中文

Several scripts are included to generate offsets for SystemInformer's kphdyn.xml, adding your own struct_offset or func_offset entries. The symbol inventory and analysis workflow can be customized through config.yaml.

Quick start

Install the requirements, then run the main symbol pipeline:

curl -O https://raw.githubusercontent.com/winsiderss/systeminformer/refs/heads/master/kphlib/kphdyn.xml
uv run download_symbols.py -fast
uv run dump_symbols.py
uv run update_symbols.py

The first download may take hours. Later runs can reuse the PE, PDB, and YAML artifacts already stored under symbols/.

Workflow

  1. download_symbols.py downloads PE files and matching PDB symbols from Microsoft Symbol Server.
  2. dump_symbols.py analyzes each binary and writes per-symbol YAML artifacts plus an artifacts.yaml manifest next to it.
  3. update_symbols.py exports those YAML artifacts back into kphdyn.xml.

The default symbol layout is:

symbols/<arch>/<file>.<version>/<sha256>/

All four scripts use symbols under the current working directory by default. Set KPHTOOLS_SYMBOLDIR to override that directory; the environment variable takes precedence over -symboldir.

Documentation