kphtools

What the scripts do

The README explains that several scripts generate offsets for System Informer's kphdyn.xml, letting users add their own struct_offset or func_offset entries. The symbol inventory and the analysis workflow can be customized through a config.yaml file. This targets the KPH layer that System Informer uses to talk to the Windows kernel, so the tooling is squarely about maintaining that kernel data file.

Running the pipeline

The quick start downloads the upstream kphdyn.xml, then runs uv run download_symbols.py with the fast flag, followed by dump_symbols.py and update_symbols.py. The first download can take hours because it pulls PE files and matching PDB symbols, but later runs reuse the PE, PDB, and YAML artifacts already stored. The three analysis steps write per-symbol YAML and then export everything back into kphdyn.xml.

Storage layout

Downloaded symbols are kept in a layout of symbols slash architecture slash file dot version slash sha256. All four scripts use a symbols directory under the current working directory by default. That location can be overridden with the KPHTOOLS_SYMBOLDIR environment variable, which takes precedence over the command line symboldir option when both are set.

Editorial conclusion

The tooling works against the upstream System Informer project and stores downloaded artifacts under a symbols directory that can be redirected with the KPHTOOLS_SYMBOLDIR variable.