Dark Byte
Site Admin
 Reputation: 471
Joined: 09 May 2003
Posts: 25858
Location: The netherlands
|
 Posted: Tue Feb 11, 2020 2:05 am Post subject: Getting a list of ObRegisterCallbacks addresses |
 |
|
This code will give you a list of the registered routines by ObRegisterCallbacks
| Code: |
function getCallbacks(a)
local infloopprotection=0
local CallbackListHead=a+0xc8
local entry=readPointer(CallbackListHead)
while (entry) and (entry~=0) and (entry~=CallbackListHead) and (infloopprotection<100) do
local preop=readPointer(entry+0x28)
local postop=readPointer(entry+0x30)
if preop~=0 then
print(' Pre operation: '..getNameFromAddress(preop))
end
if postop~=0 then
print(' Post operation:'..getNameFromAddress(postop))
end
infloopprotection=infloopprotection+1
entry=readPointer(entry)
end
end
dbk_initialize()
dbk_useKernelmodeOpenProcess()
dbk_useKernelmodeProcessMemoryAccess()
enableKernelSymbols()
if getOpenedProcessID()==0 then
openProcess(getCheatEngineProcessID())
else
openProcess(getOpenedProcessID())
end
waitForExports()
local PsProcessTypeA=getAddressSafe("kernel_PsProcessType")
local PsThreadTypeA=getAddressSafe("kernel_PsThreadType")
if PsProcessTypeA then
print("Process handle callbacks:")
getCallbacks(readPointer(PsProcessTypeA))
else
print("Failure getting PsProcessTypeA");
end
print("")
if PsThreadTypeA then
print("Thread handle callbacks:");
getCallbacks(readPointer(PsThreadTypeA))
else
print("Failure getting PsProcessTypeA");
end
|
example output:
| Code: |
Process handle callbacks:
Pre operation: WdFilter.sys+3AC20
Pre operation: dbk64.sys+9920
Post operation:dbk64.sys+9910
Thread handle callbacks:
Pre operation: dbk64.sys+9C70
Post operation:dbk64.sys+9910
|
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
