mirror of
https://github.com/yardenshafir/WinDbg_Scripts
synced 2026-06-08 18:28:57 +00:00
yardenshafir
6 lines
620 B
Plaintext
6 lines
620 B
Plaintext
# Dump the WNF state names that each process in the system is registered to.
|
|
# Notice that the "Callback" field will be 0 for all user-mode registrations.
|
|
|
|
dx @$getStateNameWnfSubsForProcess = (p => Debugger.Utility.Collections.FromListEntry(((nt!_WNF_PROCESS_CONTEXT*)p.KernelObject.WnfContext)->ProcessSubscriptionListHead, "nt!_WNF_SUBSCRIPTION", "ProcessSubscriptionListEntry"))
|
|
dx -r4 @$cursession.Processes.Select(p => new {Name = p.Name, Subscriptions = @$getStateNameWnfSubsForProcess(p).Select(s => new {StateName = 0x41C64E6DA3BC0074 ^ (*(__int64*)&s.StateName), Callback = (void(*)())s.CallbackRoutine})}), x
|