From 7ab7d64a077817acb70eaa3098e2d2888d381ec9 Mon Sep 17 00:00:00 2001
From: yardenshafir <yardenshafir2@gmail.com>
Date: Sun, 9 Apr 2023 12:41:29 -0400
Subject: [PATCH] Create EtwConsumersForProcesses

---
 EtwConsumersForProcesses | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 EtwConsumersForProcesses

diff --git a/EtwConsumersForProcesses b/EtwConsumersForProcesses
new file mode 100644
index 0000000..2b12ca3
--- /dev/null
+++ b/EtwConsumersForProcesses
@@ -0,0 +1,2 @@
+dx -s @$etwConsumersForProcess = (p => p.Io.Handles.Where(h => h.Type == "EtwConsumer").Select(h => Debugger.Utility.Collections.FromListEntry(((nt!_ETW_REALTIME_CONSUMER*)&h.Object.Body)->Links, "nt!_WMI_LOGGER_CONTEXT", "Consumers").Select(l => new {Name = l->LoggerName, InstanceGuid = l->InstanceGuid, RealtimeLogfileName = l->RealtimeLogfileName})))
+dx -r5 @$cursession.Processes.Select(p => new {Name = p.Name, EtwConsumers = @$etwConsumersForProcess(p)})