├── .gitignore ├── ETWListicle.sln ├── ETWListicle ├── ETWListicle.vcxproj ├── ETWListicle.vcxproj.filters ├── ETWListicle.vcxproj.user ├── lister.h ├── main.c └── utils.h ├── README.md └── imgs ├── EtwEventRegister_Ghidra.png ├── EtwNotificationRegister_IDA.png ├── EtwNotificationRegistration_IDA_2.png ├── EtwpAllocateRegistration_IDA.png ├── etwp_reg_table_debug.png └── output.png /.gitignore: -------------------------------------------------------------------------------- 1 | .vs/ 2 | x64/ -------------------------------------------------------------------------------- /ETWListicle.sln: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/ETWListicle.sln -------------------------------------------------------------------------------- /ETWListicle/ETWListicle.vcxproj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/ETWListicle/ETWListicle.vcxproj -------------------------------------------------------------------------------- /ETWListicle/ETWListicle.vcxproj.filters: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/ETWListicle/ETWListicle.vcxproj.filters -------------------------------------------------------------------------------- /ETWListicle/ETWListicle.vcxproj.user: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/ETWListicle/ETWListicle.vcxproj.user -------------------------------------------------------------------------------- /ETWListicle/lister.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/ETWListicle/lister.h -------------------------------------------------------------------------------- /ETWListicle/main.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/ETWListicle/main.c -------------------------------------------------------------------------------- /ETWListicle/utils.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/ETWListicle/utils.h -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/README.md -------------------------------------------------------------------------------- /imgs/EtwEventRegister_Ghidra.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/imgs/EtwEventRegister_Ghidra.png -------------------------------------------------------------------------------- /imgs/EtwNotificationRegister_IDA.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/imgs/EtwNotificationRegister_IDA.png -------------------------------------------------------------------------------- /imgs/EtwNotificationRegistration_IDA_2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/imgs/EtwNotificationRegistration_IDA_2.png -------------------------------------------------------------------------------- /imgs/EtwpAllocateRegistration_IDA.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/imgs/EtwpAllocateRegistration_IDA.png -------------------------------------------------------------------------------- /imgs/etwp_reg_table_debug.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/imgs/etwp_reg_table_debug.png -------------------------------------------------------------------------------- /imgs/output.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/whokilleddb/ETWListicle/HEAD/imgs/output.png --------------------------------------------------------------------------------