crimsoncore
/ unmanaged_dotnet_unhook_etw.c
Created
June 19, 2025 13:15
— forked from xpn/unmanaged_dotnet_unhook_etw.c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <stdio.h> | |
| #include <Windows.h> | |
| #include <MSCorEE.h> | |
| #include <MetaHost.h> | |
| #include <evntprov.h> | |
| int main() | |
| { | |
| ICLRMetaHost* metaHost = NULL; | |
| IEnumUnknown* runtime = NULL; |
crimsoncore
/ Get-CSharp.ps1
Created
December 5, 2020 14:18
— forked from mubix/Get-CSharp.ps1
Powershell Get-CSharp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| function Get-CSharpProcess { | |
| $proclist = Get-Process | |
| foreach($proc in $proclist) { | |
| foreach($mod in $proc.Modules) | |
| { | |
| if($mod.ModuleName -imatch "mscoree") | |
| { | |
| Write-Output(".NET Found in:`t" + $proc.Name) | |
| } | |
| } |