From ce0ccfc1b6b60121fe916af1215b5b331ad089df Mon Sep 17 00:00:00 2001
From: yardenshafir <yardenshafir2@gmail.com>
Date: Tue, 12 Apr 2022 13:22:41 -0400
Subject: [PATCH] Create processNotifyRoutinesSymbols

---
 processNotifyRoutinesSymbols | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 processNotifyRoutinesSymbols

diff --git a/processNotifyRoutinesSymbols b/processNotifyRoutinesSymbols
new file mode 100644
index 0000000..39915ef
--- /dev/null
+++ b/processNotifyRoutinesSymbols
@@ -0,0 +1,5 @@
+# This works on newer debugger builds to print the symbols for each registered routine with the syntax: (void(*)()).
+# The structure is not documenting so I'm hardcoding the offset of the routine pointer inside the callback block (offset 8).
+# Notice that the pointers need to be alined since they encode a reference number.
+
+dx ((__int64(*)[64])&nt!PspCreateProcessNotifyRoutine)->Where(p => p)->Select(p => (void(*)())(*(((__int64*)(p & ~0xf)) + 1)))