From 43440551ccff3fa5bdf04f9a7eab6df0f5d961b4 Mon Sep 17 00:00:00 2001 From: yardenshafir Date: Mon, 16 Jan 2023 14:37:55 -0500 Subject: [PATCH] Update FilterCommsHelpers.txt Move command from another file to this one --- FilterCommsHelpers.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/FilterCommsHelpers.txt b/FilterCommsHelpers.txt index c059762..5c3512d 100644 --- a/FilterCommsHelpers.txt +++ b/FilterCommsHelpers.txt @@ -10,3 +10,6 @@ dx @$getHandlesToDevice = ((proc, dev) => proc.Io.Handles.Where(h => h.Type == " # helper method to get all the IRPs waiting on a communication port. # port - address of a port, such as the ones returned from @$enumPortsForFilter dx @$getIrpList = (port => Debugger.Utility.Collections.FromListEntry(((fltmgr!_FLT_PORT_OBJECT*)port)->MsgQ.WaiterQ.mList, "nt!_IRP", "Tail.Overlay.ListEntry")) + +# print all registered connection ports by iterating over the kernel handle table. Print the name and number of connections for each one. +dx -g @$cursession.Processes[4].Io.Handles.Where(h => !__iserror(h.Type == "FilterConnectionPort") && h.Type == "FilterConnectionPort").Select(h => new {Name = h.ObjectName, Object = (fltmgr!_FLT_SERVER_PORT_OBJECT*)(&h.Object.Body), NumberOfConnections = ((fltmgr!_FLT_SERVER_PORT_OBJECT*)(&h.Object.Body))->NumberOfConnections})