From ed9ff49c92e8ed73966e62f165f5991a480a0405 Mon Sep 17 00:00:00 2001
From: yardenshafir <yardenshafir2@gmail.com>
Date: Thu, 8 Apr 2021 18:20:46 +0300
Subject: [PATCH] Create FindNonSystem32Modules.txt

---
 FindNonSystem32Modules.txt | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 FindNonSystem32Modules.txt

diff --git a/FindNonSystem32Modules.txt b/FindNonSystem32Modules.txt
new file mode 100644
index 0000000..4cc5014
--- /dev/null
+++ b/FindNonSystem32Modules.txt
@@ -0,0 +1,9 @@
+# Prints a table of all processes, total number of modules loaded in them and number of modules whose path contains "System32"
+# Run in a kernel debugger session (first run .reload to get all paths) - 
+# having a small gap isn normal: ntkrnlmp.exe, hal.dll, kdnet.dll only contain a basename
+# Other processes might have their own DLLs loaded from "Program Files" or have DLLs injected by AVs such as Windows Defender
+dx -g @$cursession.Processes.Select(p => new {Name = p.Name, PID = p.Id, System32Modules = p.Modules.Where(m => m.Name.ToLower().Contains("system32")).Count(), TotalModules = p.Modules.Count()})
+
+# To print all the non-system32 modules in a specific process:
+dx @$pid = 0
+dx @$cursession.Processes[0].Modules.Where(m => m.Name.ToLower().Contains("system32") == false)