admin/yardenshafir-WinDbg_Scripts
1
0
Fork 0
mirror of https://github.com/yardenshafir/WinDbg_Scripts synced 2026-06-08 18:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create WnfKernelRegistrations

Browse Source
This commit is contained in:
yardenshafir
2023-06-28 11:20:17 -07:00
committed by GitHub
parent 648f33c740
commit 5c60588bb2
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
WnfKernelRegistrations
+5
View File
@@ -0,0 +1,5 @@
# Dump the WNF state names that each process in the system is registered to.
# Notice that the "Callback" field will be 0 for all user-mode registrations.
dx @$getStateNameWnfSubsForProcess = (p => Debugger.Utility.Collections.FromListEntry(((nt!_WNF_PROCESS_CONTEXT*)p.KernelObject.WnfContext)->ProcessSubscriptionListHead, "nt!_WNF_SUBSCRIPTION", "ProcessSubscriptionListEntry"))
dx -r4 @$cursession.Processes.Select(p => new {Name = p.Name, Subscriptions = @$getStateNameWnfSubsForProcess(p).Select(s => new {StateName = 0x41C64E6DA3BC0074 ^ (*(__int64*)&s.StateName), Callback = (void(*)())s.CallbackRoutine})}), x