commit 0bc67f8ac7532230e6bf9f91588a3e9cc2a56bd1
Author: Yarden Shafir <yarden.shafir@crowdstrike.com>
Date:   Fri May 22 18:17:52 2020 +0300

    Scripts

diff --git a/FindLookasideLists.txt b/FindLookasideLists.txt
new file mode 100644
index 0000000..4cb92a1
--- /dev/null
+++ b/FindLookasideLists.txt
@@ -0,0 +1,5 @@
+dx -r0 @$GeneralLookaside = Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&nt!ExPagedLookasideListHead, "nt!_GENERAL_LOOKASIDE", "ListEntry")
+dx -r0 @$lookasideAddr = @$GeneralLookaside.Select(l => ((__int64)&l).ToDisplayString("x"))
+dx -r0 @$extractBetween = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, x.IndexOf(z) - x.IndexOf(y) - y.Length))
+dx -r0 @$extractWithSize = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, z))
+dx -r0 @$poolData = @$lookasideAddr.Select(l => Debugger.Utility.Control.ExecuteCommand("!pool "+l+" 2")).Where(l => l[1].Length != 0x55 && l[1].Length != 0).Select(l => new {address = "0x" + @$extractBetween(l[1], "*", "size:"), tag = @$extractWithSize(l[1], "(Allocated) *", 4), tagDesc = l[2].Contains(",") ? @$extractBetween(l[2], ": ", ",") : l[2].Substring(l[2].IndexOf(":")+2), binary = l[2].Contains("Binary") ? l[2].Substring(l[2].IndexOf("Binary :")+9) : "unknown", size = "0x" + @$extractBetween(l[1], "size:", "previous size:").Replace(" ", "")})
diff --git a/FindResourcesInPool.txt b/FindResourcesInPool.txt
new file mode 100644
index 0000000..22449de
--- /dev/null
+++ b/FindResourcesInPool.txt
@@ -0,0 +1,6 @@
+dx -r0 @$eresource = Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&nt!ExpSystemResourcesList, "nt!_ERESOURCE", "SystemResourcesList")
+dx -r0 @$eresourceAddr = @$eresource.Select(l => ((__int64)&l).ToDisplayString("x"))
+dx -r0 @$extractBetween = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, x.IndexOf(z) - x.IndexOf(y) - y.Length))
+dx -r0 @$extractWithSize = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, z))
+dx -r0 @$poolData = @$eresourceAddr.Select(l => Debugger.Utility.Control.ExecuteCommand("!pool "+l+" 2")).Where(l => l[1].Length != 0x55 && l[1].Length != 0).Select(l => new {address = "0x" + @$extractBetween(l[1], "*", "size:"), tag = @$extractWithSize(l[1], "(Allocated) *", 4), tagDesc = l[2].Contains(",") ? @$extractBetween(l[2], ": ", ",") : l[2].Substring(l[2].IndexOf(":")+2), binary = l[2].Contains("Binary") ? l[2].Substring(l[2].IndexOf("Binary :")+9) : "unknown", size = "0x" + @$extractBetween(l[1], "size:", "previous size:").Replace(" ", "")})
+dx -r1 @$poolData.Where(l => l.size != "0x80")
diff --git a/FindSymbolForNPagedLookasideList.txt b/FindSymbolForNPagedLookasideList.txt
new file mode 100644
index 0000000..af10cda
--- /dev/null
+++ b/FindSymbolForNPagedLookasideList.txt
@@ -0,0 +1,4 @@
+dx -r0 @$GeneralLookaside = Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&nt!ExNPagedLookasideListHead, "nt!_GENERAL_LOOKASIDE", "ListEntry")
+dx -r0 @$lookasideAddr = @$GeneralLookaside.Select(l => ((__int64)&l).ToDisplayString("x"))
+dx -r0 @$extractBetween = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, x.IndexOf(z) - x.IndexOf(y) - y.Length))
+dx -r2 @$symData = @$lookasideAddr.Select(l => new {addr = l, sym = Debugger.Utility.Control.ExecuteCommand("ln "+l)}).Where(l => l.sym.Count() > 3).Select(l => new {addr = l.addr, sym = @$extractBetween(l.sym[3], "   ", "|")})
\ No newline at end of file
diff --git a/enumerateProcessesFromHandleTable.txt b/enumerateProcessesFromHandleTable.txt
new file mode 100644
index 0000000..1f34ecc
--- /dev/null
+++ b/enumerateProcessesFromHandleTable.txt
@@ -0,0 +1 @@
+dx -r2 (Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&nt!HandleTableListHead, "nt!_HANDLE_TABLE", "HandleTableList")).Where(h => h.QuotaProcess != 0).Select(h => new { Object = h.QuotaProcess, Name = (char*)h.QuotaProcess->ImageFileName, PID = h.QuotaProcess->UniqueProcessId})
\ No newline at end of file
diff --git a/getMemWritesInFunction.txt b/getMemWritesInFunction.txt
new file mode 100644
index 0000000..2efcc16
--- /dev/null
+++ b/getMemWritesInFunction.txt
@@ -0,0 +1,5 @@
+dx -r0 @$rspId = 0x14
+dx -r0 @$rbpId = 0x15
+dx -r0 @$isMemWrite = (b => b.Instructions.Where(i => i.Operands.Count() > 1 && i.Operands[0].Attributes.IsOutput && i.Operands[0].Registers[0].Id != @$rspId && i.Operands[0].Registers[0].Id != @$rbpId && i.Operands[0].Attributes.IsMemoryReference))
+dx -r0 @$findMemWrite = (a => Debugger.Utility.Code.CreateDisassembler().DisassembleBlocks(a).Select(b => @$isMemWrite(b)))
+dx -r2 @$findMemWrite(&nt!ZwSetInformationProcess).Where(b => b.Count() != 0)
\ No newline at end of file
diff --git a/getProcessNotifyRoutines.txt b/getProcessNotifyRoutines.txt
new file mode 100644
index 0000000..4924769
--- /dev/null
+++ b/getProcessNotifyRoutines.txt
@@ -0,0 +1,13 @@
+# define this structure in header file (c:\temp\header.h):
+typedef struct _EX_CALLBACK_ROUTINE_BLOCK
+{
+    _EX_RUNDOWN_REF RundownProtect;
+    void* Function;
+    void* Context;
+} EX_CALLBACK_ROUTINE_BLOCK, *PEX_CALLBACK_ROUTINE_BLOCK;
+
+
+dx Debugger.Utility.Analysis.SyntheticTypes.ReadHeader("c:\\temp\\header.h", "nt")
+dx @$getCallbackRoutine = (a => Debugger.Utility.Analysis.SyntheticTypes.CreateInstance("_EX_CALLBACK_ROUTINE_BLOCK", (__int64)(a & ~0xf)))
+dx -r0 @$getsym = (x => Debugger.Utility.Control.ExecuteCommand(".printf\"%y\", " + ((__int64)x).ToDisplayString("x")))[0]
+dx ((void**[0x40])&nt!PspCreateProcessNotifyRoutine).Where(a => a != 0).Select(a => @$getsym(@$getCallbackRoutine(a).Function))
\ No newline at end of file
diff --git a/printApcs.txt b/printApcs.txt
new file mode 100644
index 0000000..4d79128
--- /dev/null
+++ b/printApcs.txt
@@ -0,0 +1,6 @@
+dx -r0 @$printLn = (a => Debugger.Utility.Control.ExecuteCommand("ln "+((__int64)a).ToDisplayString("x")))
+dx -r0 @$extractBetween = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, x.IndexOf(z) - x.IndexOf(y) - y.Length))
+dx -r0 @$printSymbol = (a => @$extractBetween(@$printLn(a)[3], " ", "|"))
+dx -r0 @$apcsForThread = (t => new {TID = t.Id, Object = (void*)&t.KernelObject, Apcs = Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&t.KernelObject.Tcb.ApcState.ApcListHead[0], "nt!_KAPC", "ApcListEntry").Select(a => new { Kernel = @$printSymbol(a.KernelRoutine), Rundown = @$printSymbol(a.RundownRoutine)})})
+dx -r0 @$procWithKernelApc = @$cursession.Processes.Select(p => new {Name = p.Name, PID = p.Id, Object = (void*)&p.KernelObject, ApcThreads = p.Threads.Where(t => t.KernelObject.Tcb.ApcState.KernelApcPending != 0)}).Where(p => p.ApcThreads.Count() != 0)
+dx -r6 @$procWithKernelApc.Select(p => new { Name = p.Name, PID = p.PID, Object = p.Object, ApcThreads = p.ApcThreads.Select(t => @$apcsForThread(t))})
\ No newline at end of file
diff --git a/printIrpsForLsass.txt b/printIrpsForLsass.txt
new file mode 100644
index 0000000..7cb34e5
--- /dev/null
+++ b/printIrpsForLsass.txt
@@ -0,0 +1,3 @@
+dx @$lsass = @$cursession.Processes.Where(p => p.Name == "lsass.exe").First()
+dx -r4 @$irpThreads = @$lsass.Threads.Select(t => new {irp = Debugger.Utility.Collections.FromListEntry(t.KernelObject.IrpList, "nt!_IRP", "ThreadListEntry")}).Where(t => t.irp.Count() != 0)
+dx -r3 @$irpThreads.Select(t => t.irp.Select(i => Debugger.Utility.Control.ExecuteCommand("!irp " + ((__int64)&i).ToDisplayString("x"))))
\ No newline at end of file
diff --git a/printKernelInvertedFunctionTable.txt b/printKernelInvertedFunctionTable.txt
new file mode 100644
index 0000000..98d89df
--- /dev/null
+++ b/printKernelInvertedFunctionTable.txt
@@ -0,0 +1,2 @@
+dx @$inverted = (nt!_INVERTED_FUNCTION_TABLE*)&nt!PsInvertedFunctionTable
+dx -g @$tableEntry = *(nt!_INVERTED_FUNCTION_TABLE_ENTRY(*)[0xbe])@$inverted->TableEntry
\ No newline at end of file
diff --git a/printUserInvertedFunctionTable.txt b/printUserInvertedFunctionTable.txt
new file mode 100644
index 0000000..312737a
--- /dev/null
+++ b/printUserInvertedFunctionTable.txt
@@ -0,0 +1,2 @@
+dx @$inverted = *(nt!_INVERTED_FUNCTION_TABLE**)&nt!KeUserInvertedFunctionTable
+dx -g @$inverted->TableEntry->Take(@$inverted->CurrentSize)
\ No newline at end of file
diff --git a/writeVerAccessInFile.txt b/writeVerAccessInFile.txt
new file mode 100644
index 0000000..89a5a94
--- /dev/null
+++ b/writeVerAccessInFile.txt
@@ -0,0 +1,4 @@
+dx @$tmpFile = Debugger.Utility.FileSystem.TempDirectory.OpenFile("log.txt")
+dx @$txtWriter = Debugger.Utility.FileSystem.CreateTextWriter(@$tmpFile)
+ba r4 nt!PsInitialSystemProcess "dx @$txtWriter.WriteLine(@$getsym(@$curstack.Frames[0].Attributes.InstructionOffset)); g"
+dx @$tmpFile.Close()
\ No newline at end of file