mirror of
https://github.com/yardenshafir/WinDbg_Scripts
synced 2026-06-08 18:28:57 +00:00
yardenshafir
3 lines
171 B
Plaintext
3 lines
171 B
Plaintext
dx @$pid = 0xABCD
|
|
dx @$cursession.Processes[@$pid].Io.Handles.Where(h => h.Type == "EtwRegistration").Select(h => ((nt!_ETW_REG_ENTRY*)(&h.Object.Body))->GuidEntry->Guid)
|