Windbg查看Object Hook的脚本

Tips

学好Windbg,基本上可以代替很多工具,这次分享一个查看Object Hook的脚本:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
r @$t0 = 2;
r? @$t1 = ((nt!_OBJECT_TYPE**)@@(nt!ObTypeIndexTable))[@$t0];

.while ((@$t1 & 0xffffffff) != 0) {
.printf "Type Name:%-20msu\t", @@C++(&@$t1->Name);
.printf /D "detail\n", @$t1;
.printf "DumpProcedure : %y\n", @@C++(@$t1->TypeInfo.DumpProcedure);
.printf "OpenProcedure : %y\n", @@C++(@$t1->TypeInfo.OpenProcedure);
.printf "CloseProcedure : %y\n", @@C++(@$t1->TypeInfo.CloseProcedure);
.printf "DeleteProcedure : %y\n", @@C++(@$t1->TypeInfo.DeleteProcedure);
.printf "ParseProcedure : %y\n", @@C++(@$t1->TypeInfo.ParseProcedure);
.printf "SecurityProcedure : %y\n", @@C++(@$t1->TypeInfo.SecurityProcedure);
.printf "QueryNameProcedure : %y\n", @@C++(@$t1->TypeInfo.QueryNameProcedure);
.printf "OkayToCloseProcedure : %y\n\n", @@C++(@$t1->TypeInfo.OkayToCloseProcedure);

r @$t0 = @$t0 + 1;
r? @$t1 = ((nt!_OBJECT_TYPE**)@@(nt!ObTypeIndexTable))[@$t0];
};

20150324095806

Post Directory

Article directory