From 1ebd8efcae41b2b2ed2865aa7e83750098718f0b Mon Sep 17 00:00:00 2001 From: yardenshafir Date: Tue, 12 Apr 2022 13:19:39 -0400 Subject: [PATCH] Rename getProcessNotifyRoutines.txt to getProcessNotifyRoutinesWithSyntheticTypes.txt --- ...utines.txt => getProcessNotifyRoutinesWithSyntheticTypes.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename getProcessNotifyRoutines.txt => getProcessNotifyRoutinesWithSyntheticTypes.txt (91%) diff --git a/getProcessNotifyRoutines.txt b/getProcessNotifyRoutinesWithSyntheticTypes.txt similarity index 91% rename from getProcessNotifyRoutines.txt rename to getProcessNotifyRoutinesWithSyntheticTypes.txt index 4924769..b3d2b46 100644 --- a/getProcessNotifyRoutines.txt +++ b/getProcessNotifyRoutinesWithSyntheticTypes.txt @@ -10,4 +10,4 @@ typedef struct _EX_CALLBACK_ROUTINE_BLOCK dx Debugger.Utility.Analysis.SyntheticTypes.ReadHeader("c:\\temp\\header.h", "nt") dx @$getCallbackRoutine = (a => Debugger.Utility.Analysis.SyntheticTypes.CreateInstance("_EX_CALLBACK_ROUTINE_BLOCK", (__int64)(a & ~0xf))) dx -r0 @$getsym = (x => Debugger.Utility.Control.ExecuteCommand(".printf\"%y\", " + ((__int64)x).ToDisplayString("x")))[0] -dx ((void**[0x40])&nt!PspCreateProcessNotifyRoutine).Where(a => a != 0).Select(a => @$getsym(@$getCallbackRoutine(a).Function)) \ No newline at end of file +dx ((void**[0x40])&nt!PspCreateProcessNotifyRoutine).Where(a => a != 0).Select(a => @$getsym(@$getCallbackRoutine(a).Function))