diff --git a/processNotifyRoutinesSymbols b/processNotifyRoutinesSymbols index 39915ef..937606c 100644 --- a/processNotifyRoutinesSymbols +++ b/processNotifyRoutinesSymbols @@ -1,5 +1,6 @@ # This works on newer debugger builds to print the symbols for each registered routine with the syntax: (void(*)()). # The structure is not documenting so I'm hardcoding the offset of the routine pointer inside the callback block (offset 8). # Notice that the pointers need to be alined since they encode a reference number. +# Replace PspCreateProcessNotifyRoutine with PspCreateThreadNotifyRoutine or PspLoadImageNotifyRoutine to print the registered routines for those. dx ((__int64(*)[64])&nt!PspCreateProcessNotifyRoutine)->Where(p => p)->Select(p => (void(*)())(*(((__int64*)(p & ~0xf)) + 1)))