获取系统热键链表windbg脚本 GetHotkeys windbg script

$$ $$ ========================================================= $$ GET_HOTKEYS.TXT $$ $$ Displays all register hotkeys $$ $$ Compatibility: Win32 XP SP3. $$ $$ Example: $$>0 ) { .printf "|%2d",@$t0; .printf "|%08X|",@$t1; $$ ETHREAD .printf "%08X|",dwo( @$t1+0n4 ); $$ PWND r $t2=low( dwo( @$t1+0n8 ) ); $$ Modif .if( @$t2&8 ){.printf "Win."} .else{.printf "...."} .if( @$t2&2 ){.printf "Ctrl."} .else{.printf "....."} .if( @$t2&1 ){.printf "Alt."} .else{.printf "...."} .if( @$t2&4 ){.printf "Shift."} .else{.printf "......"} .if( dwo( @$t1+0n12 )>=0n33 and dwo( @$t1+0n12 )<=0n122 ) {.if(dwo( @$t1+0n12 )==0n46){.printf "Del|"} .else{.printf "%-3c|",dwo( @$t1+0n12 )}} .else{ $$ VK; .if( dwo( @$t1+0n12 )==0n09 ) {.printf "Tab|"} .else{ .if( dwo( @$t1+0n12 )==0n27 ) {.printf "Esc|"} .else{ .if( dwo( @$t1+0n12 )==0n19 ) {.printf "Brk|"} .else{ .if( dwo( @$t1+0n12 )==0n123 ) {.printf "F12|"} .else{ .if( dwo( @$t1+0n12 )>=0n189 ) {.printf " |"} .else{ .if( dwo( @$t1+0n12 )==0n0 ) {.printf " |"} .else{ .printf " %3d|",dwo( @$t1+0n12 )}}}}}}} .printf "%8X|%8d|",dwo ( @$t1+0n16 ),dwo( @$t1+0n16 ); $$ HOTKEY_ID .printf "%08X|",dwo( @$t1+0n20 ); $$ phkNext .printf "%08X|",dwo( dwo( @$t1 ) )+0x220; $$ EPROCESS .printf "%8d|",poi( poi( dwo ( dwo( @$t1 ) )+0x220 )+0x84 ); $$ PID .printf "%16ma|\n",poi( dwo( dwo( @$t1 ) )+0x220 )+0x174; $$ ImageFileName r $t1=dwo( @$t1+0n20 ); r $t0=@$t0+1; } .printf "+--+--------+--------+----------------------+--------+--------+--------+--------+--------+----------------+\n" 运行结果 lkd> $$>
下载脚本   GET_HOTKEYS_SCRIPT.rar

转载于:https://www.cnblogs.com/nlsoft/archive/2013/04/05/3001157.html