2

I'm writing a script for an array of LIST_ENTRY. Each LIST_ENTRY is a header of linkedlist. From reference, I can use !list to perform the same operation for each element in the linkedlist.

0:000> !list -t MYTYPE.links.Flink -x "dd" -a "L2" 0x6bc00

However, this command only serves one header. How to do it with the whole array. The start value stores at rcx

$$ bp kernel!Func_name "$><d:\\script\\Func_name_x64.txt"

.catch
{

}

To be more specific, I can execute a list of LIST_ENTRY like @blabb did but what I have right now is a table of them and I want to do it repeatedly by script. The data structure looks like this. There is an array of LIST_ENTRY and each one of them is the header of its own list. The element in the list is a structure(file!typename) that contains LIST_ENTRY.

        file!typename
       __________   
____   |  ____  |  ____  ____
|_0_|--|->|__|--|->|__|->|__|
  |    |________| 
____   ___ 
|_1_|->|__|

I want to print one of the elements(A) in the structure and output in external file. Like this

____    
|_0_|->A1-->A2
  |
____   
|_1_|->A3

This operation is complicated so I think it can't be realized in one command. But I haven't used windbg script before. The windbg script resource I found doesn't have something like 'specify which element in the struct,output them to external file, and walk through the whole array'

1
  • what you have posted here is a verbatim copy of the document that describes this function have you actually tried it do you have a proof of what you are describing i would suggest you to try and post the actual failure or result instead of presumptions
    – blabb
    Oct 6, 2022 at 5:45

1 Answer 1

1

it seems to work as documented

dumping the _LIST_ENTRY entries to a maxCount of 100 and size of 1 (only Flinks)

0:000> dl @@c++(&@$peb->Ldr->InLoadOrderModuleList) 100 1
00007ff8`5177c4d0  000001bc`43082b70
000001bc`43082b70  000001bc`430829a0
000001bc`430829a0  000001bc`430830c0
000001bc`430830c0  000001bc`430837a0
000001bc`430837a0  000001bc`43084f20
000001bc`43084f20  000001bc`430857c0
000001bc`430857c0  000001bc`430868e0
000001bc`430868e0  000001bc`43086d10
000001bc`43086d10  000001bc`43087500
000001bc`43087500  000001bc`430871d0
000001bc`430871d0  000001bc`430880a0
000001bc`430880a0  000001bc`43087a40
000001bc`43087a40  000001bc`43088bd0
000001bc`43088bd0  000001bc`43087dc0
000001bc`43087dc0  000001bc`430892c0
000001bc`430892c0  00007ff8`5177c4d0

executing a command for each entries of _LIST_ENTRY

0:000> !list  -t  ntdll!_PEB_LDR_DATA.InLoadOrderModuleList.Flink -x "?@$extret; dt ntdll!_LDR_DATA_TABLE_ENTRY BaseDllName @$extret"  @@c++(&@$peb->Ldr->InLoadOrderModuleList)

result as follows

Evaluate expression: 140704495420624 = 00007ff8`5177c4d0
   +0x058 BaseDllName : _UNICODE_STRING ""

Evaluate expression: 1908090088304 = 000001bc`43082b70
   +0x058 BaseDllName : _UNICODE_STRING "cdb.exe"

Evaluate expression: 1908090087840 = 000001bc`430829a0
   +0x058 BaseDllName : _UNICODE_STRING "ntdll.dll"

Evaluate expression: 1908090089664 = 000001bc`430830c0
   +0x058 BaseDllName : _UNICODE_STRING "KERNEL32.DLL"

Evaluate expression: 1908090091424 = 000001bc`430837a0
   +0x058 BaseDllName : _UNICODE_STRING "KERNELBASE.dll"

Evaluate expression: 1908090097440 = 000001bc`43084f20
   +0x058 BaseDllName : _UNICODE_STRING "msvcrt.dll"

Evaluate expression: 1908090099648 = 000001bc`430857c0
   +0x058 BaseDllName : _UNICODE_STRING "dbgeng.dll"

Evaluate expression: 1908090104032 = 000001bc`430868e0
   +0x058 BaseDllName : _UNICODE_STRING "ucrtbase.dll"

Evaluate expression: 1908090105104 = 000001bc`43086d10
   +0x058 BaseDllName : _UNICODE_STRING "RPCRT4.dll"

Evaluate expression: 1908090107136 = 000001bc`43087500
   +0x058 BaseDllName : _UNICODE_STRING "bcrypt.dll"

Evaluate expression: 1908090106320 = 000001bc`430871d0
   +0x058 BaseDllName : _UNICODE_STRING "dbgmodel.dll"

Evaluate expression: 1908090110112 = 000001bc`430880a0
   +0x058 BaseDllName : _UNICODE_STRING "OLEAUT32.dll"

Evaluate expression: 1908090108480 = 000001bc`43087a40
   +0x058 BaseDllName : _UNICODE_STRING "dbghelp.dll"

Evaluate expression: 1908090112976 = 000001bc`43088bd0
   +0x058 BaseDllName : _UNICODE_STRING "msvcp_win.dll"

Evaluate expression: 1908090109376 = 000001bc`43087dc0
   +0x058 BaseDllName : _UNICODE_STRING "XmlLite.dll"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.