mirror of
https://github.com/yardenshafir/WinDbg_Scripts
synced 2026-06-08 18:28:57 +00:00
yardenshafir
10 lines
786 B
Plaintext
10 lines
786 B
Plaintext
# Prints a table of all processes, total number of modules loaded in them and number of modules whose path contains "System32"
|
|
# Run in a kernel debugger session (first run .reload to get all paths) -
|
|
# having a small gap isn normal: ntkrnlmp.exe, hal.dll, kdnet.dll only contain a basename
|
|
# Other processes might have their own DLLs loaded from "Program Files" or have DLLs injected by AVs such as Windows Defender
|
|
dx -g @$cursession.Processes.Select(p => new {Name = p.Name, PID = p.Id, System32Modules = p.Modules.Where(m => m.Name.ToLower().Contains("system32")).Count(), TotalModules = p.Modules.Count()})
|
|
|
|
# To print all the non-system32 modules in a specific process:
|
|
dx @$pid = 0
|
|
dx @$cursession.Processes[0].Modules.Where(m => m.Name.ToLower().Contains("system32") == false)
|