admin/yardenshafir-WinDbg_Scripts
1
0
Fork 0
mirror of https://github.com/yardenshafir/WinDbg_Scripts synced 2026-06-08 18:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Rename getProcessNotifyRoutines.txt to getProcessNotifyRoutinesWithSyntheticTypes.txt

Browse Source
This commit is contained in:
yardenshafir
2022-04-12 13:19:39 -04:00
committed by GitHub
parent ed9ff49c92
commit 1ebd8efcae
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
getProcessNotifyRoutines.txt → getProcessNotifyRoutinesWithSyntheticTypes.txt
+1 -1
View File
@@ -10,4 +10,4 @@ typedef struct _EX_CALLBACK_ROUTINE_BLOCK
dx Debugger.Utility.Analysis.SyntheticTypes.ReadHeader("c:\\temp\\header.h", "nt")
dx @$getCallbackRoutine = (a => Debugger.Utility.Analysis.SyntheticTypes.CreateInstance("_EX_CALLBACK_ROUTINE_BLOCK", (__int64)(a & ~0xf)))
dx -r0 @$getsym = (x => Debugger.Utility.Control.ExecuteCommand(".printf\"%y\", " + ((__int64)x).ToDisplayString("x")))[0]
dx ((void**[0x40])&nt!PspCreateProcessNotifyRoutine).Where(a => a != 0).Select(a => @$getsym(@$getCallbackRoutine(a).Function))
dx ((void**[0x40])&nt!PspCreateProcessNotifyRoutine).Where(a => a != 0).Select(a => @$getsym(@$getCallbackRoutine(a).Function))