[Autogenerated] To show some details about an executive resource,
I'd like to introduce you.
To an extension you can download that is by Microsoft
called mac mac is the debugger extension,
four win debug it, was used internally by Microsoft for many years.
But now it's available.
To everyone.
At least most of it.
And here,
is the link to download the mac extension at the time of this recording.
Even if that link becomes stale, in the future,
just search for mac extension, download and then you'll be able to download it.
Once you do that you need to copy, that to summary on your system,
and then we can load that dynamically in win debugs So let's do that
Here's my win debug local debugging session here.
I've in fact copied the mac DLL, the X,
64 version into a directory on my local system,
and then I can Go ahead.
And load that explicitly by using the dot load command.
So I've placed that into ee It's called mac dot DLL.
So I'm just going to load it, and you, can see it, says that It has been loaded.
I'm going to use the help command here.
That's going to show me some brief introduction.
To mac In fact, mac has lots of interesting commands,
not just for kernel but also for user mode Even for
.NET it's really a powerful extension,
and There's no official documentation for that but all the internal documents,
is provided as part of the extension.
For example, I can click kernel here, and See all the commands,
that have something, to do with kernel objects.
One of them is called es source which is about executive resources Exactly.
So here, is the command.
That's the shortcut for that called res we can Use this command,
to show the entire set of executive resources that exist,
in the system.
By the way, you can always use the question marks.
To get an information here related to the command for any one of the commands
provided by mac and then you can see the various options.
That's the official documentation.
So, to speak, and then you can go ahead.
And use the command in a particular way such as using the da a switch here,
which should list all the, the resources currently existing on the system.
And their state.
Obviously, we are using local kernel debugging here.
So the system is a moving target.
So things are changing.
So it's unlikely.
That we'll find any executive resources being held,
but still you might find that interesting to Look at and of course,
in the real scenario might be debugging,
an executive resources If you are writing some kind of driver,
you can provide the address of an es resources data structure,
and You get all the details about that executive resource,
that you can use for debugging purposes.
So you can see here, a list of es resources started,
to appeal, and Just break here.
You can go ahead.
And and click one of those to see specific information about that
particular executive resource where it is how many threats,
are waiting on it.
If there are any and all that stuff, is right here.
So you can go ahead and explore that In fact,
I recommend you explore other commands from the mac extension.
They error very useful.
Even replacing some of the common commands we're familiar with such as process,
and thread, and provide a nicer view of some of the information,
that is normally provided by building in.
So to speak commands coming from the debugging tools for Windows package itself.