mirror of
https://github.com/yardenshafir/WinDbg_Scripts
synced 2026-06-08 18:28:57 +00:00
yardenshafir
b4bdbf9c1a
Add 2 options to print all ALPC ports that all processes have open handles to
10 lines
745 B
Plaintext
10 lines
745 B
Plaintext
# Get all open ALPC ports for all processes. Pretty much like !alpc /lpp but for all processes, with much uglier output
|
|
|
|
dx -r4 @$ports = @$cursession.Processes.Select(p => new {Name = p.Name, AlpcPorts = p.Io.Handles.Where(h => h.Type == "ALPC Port").Select(a => new {PortName = a.ObjectName, Port = (nt!_ALPC_PORT*)&a.Object.Body})}).Select(p => new {Name = p.Name, AlpcPortsCount = p.AlpcPorts.Count(), AlpcPorts = p.AlpcPorts})
|
|
|
|
|
|
# Alternatively, run !alpc /lpp on all processes (slower but nicer output):
|
|
|
|
dx @$getPortsForProcess = (p => Debugger.Utility.Control.ExecuteCommand("!alpc /lpp " + ((__int64)p).ToDisplayString("x")))
|
|
dx -r3 @$cursession.Processes.Select(p => new {Name = p.Name, Ports = @$getPortsForProcess(&p.KernelObject)})
|