Cheat Engine :: View topic - Getting list of driverroutines that watch process creation

Cheat Engine
The Official Site of Cheat Engine

FAQ

Memberlist

Usergroups

Profile

Getting list of driverroutines that watch process creation

Cheat Engine Forum Index -> Cheat Engine Lua Scripting

View previous topic :: View next topic

Author

Message

Dark Byte
Site Admin

Reputation: 470

Joined: 09 May 2003
Posts: 25807
Location: The netherlands

Posted: Wed Feb 05, 2020 5:01 pm Post subject: Getting list of driverroutines that watch process creation

This code will return a list of driver addresses that get a callback whenever a process is created

Just some handy thing to have I guess

(It will freeze for a while if it's your first time loading the windows symbols)

Code:

function getProcessNotifyRoutines()
if getAddressSafe('ntoskrnl.PspCreateProcessNotifyRoutine')==nil then
enableKernelSymbols()
enableWindowsSymbols()

while (getAddressSafe('ntoskrnl.PspCreateProcessNotifyRoutine')==nil) do
checkSynchronize()
sleep(10);
end

end

local cpr=getAddressSafe('ntoskrnl.PspCreateProcessNotifyRoutine')

local countA=getAddressSafe('ntoskrnl.PspCreateProcessNotifyRoutineExCount')
local countExA=getAddressSafe('ntoskrnl.PspCreateProcessNotifyRoutineCount')

local totalcount=readInteger(countA)+readInteger(countExA)

local i
result={}
for i=1,totalcount do
result[i]=readPointer(readPointer(cpr+i*8)-7)
end
return result
end

dbk_initialize()
dbk_useKernelmodeOpenProcess()
dbk_useKernelmodeProcessMemoryAccess()

openProcess(getCheatEngineProcessID())
l=getProcessNotifyRoutines()

for i=1,#l do
print(getNameFromAddress(l[i]))
end

_________________

Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping

Display posts from previous:

	Cheat Engine Forum Index -> Cheat Engine Lua Scripting	All times are GMT - 6 Hours
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum