admin/yardenshafir-WinDbg_Scripts
1
0
Fork 0
mirror of https://github.com/yardenshafir/WinDbg_Scripts synced 2026-06-08 18:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update processNotifyRoutinesSymbols

Browse Source
This commit is contained in:
yardenshafir
2022-04-12 13:24:57 -04:00
committed by GitHub
parent ce0ccfc1b6
commit 0bb41bc95f
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
processNotifyRoutinesSymbols
+1
View File
@@ -1,5 +1,6 @@
# This works on newer debugger builds to print the symbols for each registered routine with the syntax: (void(*)()).
# The structure is not documenting so I'm hardcoding the offset of the routine pointer inside the callback block (offset 8).
# Notice that the pointers need to be alined since they encode a reference number.
# Replace PspCreateProcessNotifyRoutine with PspCreateThreadNotifyRoutine or PspLoadImageNotifyRoutine to print the registered routines for those.
dx ((__int64(*)[64])&nt!PspCreateProcessNotifyRoutine)->Where(p => p)->Select(p => (void(*)())(*(((__int64*)(p & ~0xf)) + 1)))