admin/yardenshafir-WinDbg_Scripts
1
0
Fork 0
mirror of https://github.com/yardenshafir/WinDbg_Scripts synced 2026-06-08 18:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create EtwRegisteredProvidersForProcess

Browse Source
This commit is contained in:
yardenshafir
2023-04-09 11:57:56 -04:00
committed by GitHub
parent 1e1c74cb3c
commit a1d7b3a738
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EtwRegisteredProvidersForProcess
+2
View File
@@ -0,0 +1,2 @@
dx @$pid = 0xABCD
dx @$cursession.Processes[@$pid].Io.Handles.Where(h => h.Type == "EtwRegistration").Select(h => ((nt!_ETW_REG_ENTRY*)(&h.Object.Body))->GuidEntry->Guid)