From 0bb41bc95faae236e3743cfa17286f963ac41ec3 Mon Sep 17 00:00:00 2001 From: yardenshafir Date: Tue, 12 Apr 2022 13:24:57 -0400 Subject: [PATCH] Update processNotifyRoutinesSymbols --- processNotifyRoutinesSymbols | 1 + 1 file changed, 1 insertion(+) diff --git a/processNotifyRoutinesSymbols b/processNotifyRoutinesSymbols index 39915ef..937606c 100644 --- a/processNotifyRoutinesSymbols +++ b/processNotifyRoutinesSymbols @@ -1,5 +1,6 @@ # This works on newer debugger builds to print the symbols for each registered routine with the syntax: (void(*)()). # The structure is not documenting so I'm hardcoding the offset of the routine pointer inside the callback block (offset 8). # Notice that the pointers need to be alined since they encode a reference number. +# Replace PspCreateProcessNotifyRoutine with PspCreateThreadNotifyRoutine or PspLoadImageNotifyRoutine to print the registered routines for those. dx ((__int64(*)[64])&nt!PspCreateProcessNotifyRoutine)->Where(p => p)->Select(p => (void(*)())(*(((__int64*)(p & ~0xf)) + 1)))