WinDbg script Practice 3----monitor specific process creation

$$*****************************************************************$$ Script by KMS_HHL to monitor process create and show call stack$$ Create Time 2014_11$$ nt5 ntcreateprocess->ntcreateprocessex->pspcreateprocess$$ nt6 ntcreateuserprocess$$ Execute by $$><D:\BaiduYunTongBu\ Baidu Cloud Sync disk \windbg_sc\2sc_process_monitor_x32.txt$$ We traverse the tail of the linked list activeprocesslinks In the Imagefilename, the process name match on the $$, it breaks down.$$*****************************************************************BP NT!pspcreateprocess"gur @ $t 0=0r @ $t 1=0r @ $t 2=0r @ $t 0=nt! Psactiveprocesshead+4r @ $t 1=poi (@ $t 0) r? @ $t 2= #CONTAINING_RECORD (@ $t 1, nt!_eprocess, Activeprocesslinks) as/x ${/V: $Procc} @ $t 2 as/ma $ImageName @@c++ (&@ $t 2->imagefilename[0]). block{ .if($SICMP (\"${$ImageName} \ ", \" calc.exe \ ") = = 0){. Echo found the pattern. Echo ${$ImageName} ad*        }.Else{. Echo not found the pattern. Echo'${$ImageName}'AD*GC}}"

Work often have such demand, obviously disabled a boot start item, but the boot when the startup item quietly started, using this script, can be very convenient to correct the boot is disabled off the startup item is by what way and pull themselves up again.

WinDbg script Practice 3----monitor specific process creation