admin/yardenshafir-WinDbg_Scripts
1
0
Fork 0
mirror of https://github.com/yardenshafir/WinDbg_Scripts synced 2026-06-08 18:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create processNotifyRoutinesSymbols

Browse Source
This commit is contained in:
yardenshafir
2022-04-12 13:22:41 -04:00
committed by GitHub
parent 1ebd8efcae
commit ce0ccfc1b6
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
processNotifyRoutinesSymbols
+5
View File
@@ -0,0 +1,5 @@
# This works on newer debugger builds to print the symbols for each registered routine with the syntax: (void(*)()).
# The structure is not documenting so I'm hardcoding the offset of the routine pointer inside the callback block (offset 8).
# Notice that the pointers need to be alined since they encode a reference number.
dx ((__int64(*)[64])&nt!PspCreateProcessNotifyRoutine)->Where(p => p)->Select(p => (void(*)())(*(((__int64*)(p & ~0xf)) + 1)))