diff --git a/getProcessNotifyRoutines.txt b/getProcessNotifyRoutinesWithSyntheticTypes.txt similarity index 91% rename from getProcessNotifyRoutines.txt rename to getProcessNotifyRoutinesWithSyntheticTypes.txt index 4924769..b3d2b46 100644 --- a/getProcessNotifyRoutines.txt +++ b/getProcessNotifyRoutinesWithSyntheticTypes.txt @@ -10,4 +10,4 @@ typedef struct _EX_CALLBACK_ROUTINE_BLOCK dx Debugger.Utility.Analysis.SyntheticTypes.ReadHeader("c:\\temp\\header.h", "nt") dx @$getCallbackRoutine = (a => Debugger.Utility.Analysis.SyntheticTypes.CreateInstance("_EX_CALLBACK_ROUTINE_BLOCK", (__int64)(a & ~0xf))) dx -r0 @$getsym = (x => Debugger.Utility.Control.ExecuteCommand(".printf\"%y\", " + ((__int64)x).ToDisplayString("x")))[0] -dx ((void**[0x40])&nt!PspCreateProcessNotifyRoutine).Where(a => a != 0).Select(a => @$getsym(@$getCallbackRoutine(a).Function)) \ No newline at end of file +dx ((void**[0x40])&nt!PspCreateProcessNotifyRoutine).Where(a => a != 0).Select(a => @$getsym(@$getCallbackRoutine(a).Function))