-
-
[原创]支持最新win11预览版24h2的windbg的!pool命令代替工具
-
发表于: 2024-9-25 15:12
-
正确解析 HEAP_VS***符号 ,支持在最新win11 24h2 运行,替换windbg自带的!pool命令
test on win11 24h2 support lastest preview version
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 | 9: kd> .load PoolViewerExt.dll9: kd> rrax=ffff848a8685f850 rbx=ffff9101027fe5a0 rcx=ffff910ffe6922c0rdx=fffff8012a592270 rsi=fffff8012a592270 rdi=ffff9101027fe4d0rip=fffff8012a6159f4 rsp=ffff848a8685f798 rbp=ffff848a8685f8a0 r8=ffff9101027fe5a0 r9=ffff910ffecae040 r10=0000000000000001r11=ffff910fed9fd1c0 r12=ffff910ffe6922c0 r13=0000000000000000r14=0000000000000000 r15=ffff910ffecae040iopl=0 nv up ei pl nz na pe nccs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00040202fffff801`2a6159f4 488bc4 mov rax,rsp9: kd> !poolview ffff910ffe6922c0 Address Size (Status) Tag Type ---------------------------------------------------------[GetDataForDescriptor::1431] Unit size is 0 ffff910ffe600000 ffff910ffe601240 0000000000000092 ffff910ffe6922c0[GetDataForDescriptor::1495] Start heapctx ffff910fed100140 VsContext ffff910fed1002c0 [GetDataForDescriptor::1514] fetch SubsegmentList ffff910ffe613000 0000000000011000 000000000009d000[GetDataForDescriptor::1514] fetch SubsegmentList ffff910ffe68e000 000000000009d000 0000000000042000[GetDataForDescriptor::1545] FindPoolBlocksInVsSubsegment ffff910ffe68e000 ffff910ffe6cc000 ffff910ffe6922c0 0xffff910ffe692010 0x270 (Allocated) CcSc Vs* 0xffff910ffe6922a0 0x210 (Allocated) VHDc Vs 0xffff910ffe6924d0 0x240 (Allocated) ALPC Vs 0xffff910ffe692730 0x240 (Allocated) ALPC Vs 0xffff910ffe692990 0x240 (Allocated) ALPC Vs 0xffff910ffe692bf0 0x240 (Allocated) ALPC Vs 0xffff910ffe692e50 0x190 (Free) Vs[GetDataForDescriptor::1561] fetchidx ffff910ffe6922c0 1 |
开源项目地址https://github.com/cbwang505/Win11PoolView
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
最后于 2024-11-30 18:04
被王cb编辑
，原因： fix lfh
