| $$ ********************************************************** |
| $$ Copyright (c) 2006 VMware, Inc. All rights reserved. |
| $$ ********************************************************** |
| |
| $$ Redistribution and use in source and binary forms, with or without |
| $$ modification, are permitted provided that the following conditions are met: |
| $$ |
| $$ * Redistributions of source code must retain the above copyright notice, |
| $$ this list of conditions and the following disclaimer. |
| $$ |
| $$ * Redistributions in binary form must reproduce the above copyright notice, |
| $$ this list of conditions and the following disclaimer in the documentation |
| $$ and/or other materials provided with the distribution. |
| $$ |
| $$ * Neither the name of VMware, Inc. nor the names of its contributors may be |
| $$ used to endorse or promote products derived from this software without |
| $$ specific prior written permission. |
| $$ |
| $$ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" |
| $$ AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| $$ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| $$ ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE |
| $$ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| $$ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR |
| $$ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
| $$ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| $$ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| $$ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH |
| $$ DAMAGE. |
| |
| * XXX: currently both are to be used as commands, |
| * e.g. finddr_slow or finddr_fast, preferrably should be arguments to .reload |
| |
| * use for analyzing processes too early or too late for following drmarker with finddr_fast |
| as finddr_slow .foreach ( base {s -[1]a 0 L?80000000 ", build" } ) { !vprot base } |
| |
| * follow drmarker from ntdll!KiUserCallbackDispatcher |
| * 0:000> dt theDrMarker dr_base_addr |
| * +0x020 dr_base_addr : Ptr32 Void |
| * follow jmp to hook func, |
| as ? finddr_fast poi((( poi(ntdll!KiUserCallbackDispatcher+1) + ntdll!KiUserCallbackDispatcher+5) & fffff000) + 0x20) |
