Created
December 20, 2018 15:23
-
-
Save M1suzu/6e4a65c235da7e3982b2000b46f806cc to your computer and use it in GitHub Desktop.
Useful windbg commands | break into debugger when the process opens or creates a file with a .txt file extension. | https://shellbombs.github.io/windbg/
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| bp kernel32!CreateFileW "r $t0 = poi(@esp + 4); as /mu ${/v:filename} @$t0; .block {.if ($spat(\"${filename} \", \"*.txt \")) {kb;} .else {gc;}}" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment