{"id":21861414,"url":"https://github.com/gmh5225/ida-find-.data-ptr","last_synced_at":"2026-05-17T08:39:23.087Z","repository":{"id":162026291,"uuid":"636639773","full_name":"gmh5225/ida-find-.data-ptr","owner":"gmh5225","description":"A simple ida python script to find .data ptr","archived":false,"fork":false,"pushed_at":"2023-05-06T21:39:50.000Z","size":30,"stargazers_count":50,"open_issues_count":0,"forks_count":7,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-03-19T21:21:01.571Z","etag":null,"topics":["anti","anti-cheat","cheat","data","data-ptr","driver","ida","idapython","plugin","ptr","windows"],"latest_commit_sha":null,"homepage":"https://git.back.engineering/gmh5225/ida-find-.data-ptr","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gmh5225.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-05-05T09:58:37.000Z","updated_at":"2025-02-22T18:37:30.000Z","dependencies_parsed_at":null,"dependency_job_id":"6602b14f-6d48-4abb-9df5-0a075297eabe","html_url":"https://github.com/gmh5225/ida-find-.data-ptr","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gmh5225%2Fida-find-.data-ptr","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gmh5225%2Fida-find-.data-ptr/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gmh5225%2Fida-find-.data-ptr/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gmh5225%2Fida-find-.data-ptr/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gmh5225","download_url":"https://codeload.github.com/gmh5225/ida-find-.data-ptr/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244860600,"owners_count":20522466,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["anti","anti-cheat","cheat","data","data-ptr","driver","ida","idapython","plugin","ptr","windows"],"created_at":"2024-11-28T03:11:31.691Z","updated_at":"2025-10-14T12:05:56.367Z","avatar_url":"https://github.com/gmh5225.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ida-find-.data-ptr\nA simple ida python script to find .data ptr \n\n## Run ``find_data_ptr.py``\n![image1](https://user-images.githubusercontent.com/13917777/236432757-892a014c-f5d4-4883-9b2c-42cea73d2d03.png)\n\n## Run ``find_data_ptr_guard_dispatch_icall.py``\n```asm\n.data ptr with _guard_dispatch_icall: off_140C00A00\n    Function HvlGetSharedPageVa (called at: 0x140236507)\n.data ptr with _guard_dispatch_icall: HalPerformEndOfInterruptAtController\n    Function HalPerformEndOfInterrupt (called at: 0x140274485)\n    Function HalpInterruptResetThisProcessor (called at: 0x1404b652c)\n.data ptr with _guard_dispatch_icall: off_140C009E0\n    Function EtwGetKernelTraceTimestamp (called at: 0x14043ddea)\n    Function KiExecuteAllDpcs (called at: 0x140472afd)\n    Function EtwpReserveTraceBuffer (called at: 0x140472fe5)\n    Function EtwGetKernelTraceTimestampSilo (called at: 0x140481ad3)\n    Function EtwpGetLoggerTimeStamp (called at: 0x140489670)\n    Function EtwpInitializeTimeStamp (called at: 0x1407f4d34)\n.data ptr with _guard_dispatch_icall: HalpProfileInterface\n    Function HalpProcessorPrepareForIdle (called at: 0x14043e59c)\n    Function HalpProcessorResumeFromIdle (called at: 0x14043e5e4)\n    Function HalpSetProfileSourceInterval (called at: 0x140369c5b)\n    Function HalpRestartProfiling (called at: 0x140383323)\n    Function HalpTimerInitializeProfiling (called at: 0x1403a52ad)\n    Function HalSetProfileInterval (called at: 0x1404b878a)\n    Function HalStartProfileInterrupt (called at: 0x1404b87c6)\n    Function HalStopProfileInterrupt (called at: 0x1404b87f1)\n    Function HalpAllocatePmcCounterSet (called at: 0x1404b894d)\n    Function HalpAllocatePmcCounterSet (called at: 0x1404b8983)\n    Function HalpAllocatePmcCounterSet (called at: 0x1404b89cd)\n    Function HalpFreePmcCounterSet (called at: 0x1404b8d07)\n    Function HalpPerfInterrupt (called at: 0x1404b8f61)\n    Function HalpPerfInterrupt (called at: 0x1404b8f87)\n    Function KiStopProfileTarget (called at: 0x140515f41)\n    Function HalpSetSystemInformation (called at: 0x14080f1e1)\n    Function HalpSetSystemInformation (called at: 0x14080f20d)\n    Function HalpQueryProfileInformation (called at: 0x140757447)\n    Function HalAllocateHardwareCounters (called at: 0x1408602d0)\n    Function HalFreeHardwareCounters (called at: 0x140860360)\n    Function HalFreeHardwareCounters (called at: 0x140860360)\n    Function HalpCompleteInitializeProfiling (called at: 0x140996c28)\n    Function HalpInitializeProfiling (called at: 0x140996c88)\n.data ptr with _guard_dispatch_icall: off_140C00890\n    Function KiSetClockTickRate (called at: 0x14027b1cd)\n    Function KePrepareClockTimerForIdle (called at: 0x14027b4a6)\n    Function KiRestoreClockTickRate (called at: 0x14027b7a4)\n    Function KeInitializeClock (called at: 0x140a86322)\n.data ptr with _guard_dispatch_icall: HalpPlatformFlags\n    Function HalpDpPostReplace (called at: 0x1409a4776)\n.data ptr with _guard_dispatch_icall: HalpSystemHardwareLock\n    Function HalpAcquireCmosSpinLock (called at: 0x140446b6a)\n.data ptr with _guard_dispatch_icall: PpmPerfCoreParkingMask\n    Function PpmParkReportMask (called at: 0x140446f65)\n.data ptr with _guard_dispatch_icall: off_140C00868\n    Function KiIntSteerSetDestination (called at: 0x14029f0c2)\n.data ptr with _guard_dispatch_icall: dword_140C020C0\n    Function CmSaveMergedKeys (called at: 0x140878f05)\n.data ptr with _guard_dispatch_icall: HalIommuDispatch\n    Function ExFreeSvmAsid (called at: 0x140450106)\n    Function HalpIommuInterruptRoutine (called at: 0x1404c5f1f)\n    Function IommuProcessPageRequestQueue (called at: 0x1404d32a2)\n    Function IommuProcessPageRequestQueue (called at: 0x1404d3440)\n    Function IommuProcessPageRequestQueue (called at: 0x1404d3554)\n    Function IommuProcessPageRequestQueue (called at: 0x1404d36aa)\n    Function IommupHvInterruptRoutine (called at: 0x1404d406c)\n    Function ExFlushTb (called at: 0x1405b0a36)\n    Function ExShareAddressSpaceWithDevice (called at: 0x1405b0e48)\n    Function ExShareAddressSpaceWithDevice (called at: 0x1405b0f51)\n    Function ExShareAddressSpaceWithDevice (called at: 0x1405b1487)\n    Function ExShareAddressSpaceWithDevice (called at: 0x1405b14b4)\n    Function ExSvmBeginDeviceReset (called at: 0x1405b18b0)\n    Function ExSvmDevicePowerCallback (called at: 0x1405b1ae6)\n    Function ExSvmFinalizeDeviceReset (called at: 0x1405b1cd2)\n    Function ExpPrepareNewSvmDevice (called at: 0x1405b2488)\n    Function ExpPrepareNewSvmDevice (called at: 0x1405b251e)\n    Function ExpSvmDereferenceDevice (called at: 0x1405b283e)\n    Function ExpSvmWorkerThread (called at: 0x1405b2dbc)\n    Function HalpIommuInitSystem (called at: 0x14099705e)\n    Function HalpIommuInitSystem (called at: 0x140997076)\n    Function InitBootProcessor (called at: 0x140a37c95)\n    Function ExpInitializeSvm (called at: 0x140a6da40)\n.data ptr with _guard_dispatch_icall: off_140C007D8\n    Function HalpTimerClockIpiRoutine (called at: 0x140326389)\n    Function HalpTimerClockInterrupt (called at: 0x14032f0a7)\n    Function HalpTimerAlwaysOnClockInterrupt (called at: 0x1404ce7a4)\n    Function EtwpReserveWithPmcCounters (called at: 0x1405a2ef3)\n.data ptr with _guard_dispatch_icall: off_140C008C0\n    Function HalpTimerClockIpiRoutine (called at: 0x1403263ce)\n    Function KeClockInterruptNotify (called at: 0x140326517)\n    Function HalpTimerClockInterrupt (called at: 0x14032f0f1)\n    Function HalpTimerAlwaysOnClockInterrupt (called at: 0x1404ce757)\n    Function NtSetSystemInformation (called at: 0x14069ace1)\n    Function PopWriteHiberPages (called at: 0x14098d894)\n    Function PopRequestWrite (called at: 0x1409902ed)\n.data ptr with _guard_dispatch_icall: off_140C00740\n    Function PpmIdleExecuteTransition (called at: 0x1403279d3)\n.data ptr with _guard_dispatch_icall: off_140C00888\n    Function PpmIdleExecuteTransition (called at: 0x140327b4a)\n    Function KeResumeClockTimerFromIdle (called at: 0x140329bf2)\n    Function KeSuspendClockTimer (called at: 0x14038154b)\n    Function KeSuspendClockTimerSafe (called at: 0x14050d8d5)\n    Function KeSuspendClockTimerSafe (called at: 0x14050d971)\n    Function KeInitializeClock (called at: 0x140a862e9)\n.data ptr with _guard_dispatch_icall: off_140C00750\n    Function PpmIdleExecuteTransition (called at: 0x1403288dd)\n.data ptr with _guard_dispatch_icall: off_140C009A8\n    Function PpmIdleExecuteTransition (called at: 0x140328926)\n    Function HalpRestartProfiling (called at: 0x140383354)\n    Function HalpPerfInterrupt (called at: 0x1404b8f95)\n.data ptr with _guard_dispatch_icall: off_140C00898\n    Function KeResumeClockTimerFromIdle (called at: 0x140329a42)\n    Function KeResumeClockTimerFromIdle (called at: 0x1404875e2)\n    Function KeResumeClockTimerFromIdle (called at: 0x140487689)\n.data ptr with _guard_dispatch_icall: off_140C00880\n    Function KeResumeClockTimerFromIdle (called at: 0x140329be1)\n    Function KeResumeClockTimerFromIdle (called at: 0x140487720)\n    Function KiResumeClockTimer (called at: 0x140380c8b)\n    Function KeInitializeClock (called at: 0x140a862fc)\n.data ptr with _guard_dispatch_icall: off_140C00968\n    Function KiGetNextTimerExpirationDueTime (called at: 0x14032a481)\n.data ptr with _guard_dispatch_icall: off_140C00A70\n    Function KiSetIntervalWorker (called at: 0x14036a1a5)\n    Function EtwSetPerformanceTraceInformation (called at: 0x140934a38)\n    Function EtwSetPerformanceTraceInformation (called at: 0x140934b66)\n    Function EtwpLoadMicroarchitecturalProfileSource (called at: 0x14093687e)\n    Function VslpIumPhase0Initialize (called at: 0x140a8d5d7)\n    Function VslpIumPhase0Initialize (called at: 0x140a8d5ee)\n.data ptr with _guard_dispatch_icall: off_140C00780\n    Function HalDisableInterrupt (called at: 0x14045a851)\n    Function HalEnableInterrupt (called at: 0x14045ac6b)\n    Function KiIntSteerConnect (called at: 0x140375165)\n    Function KiIsInterruptTypeSecondary (called at: 0x14045af1e)\n    Function HalpUnmaskInterrupt (called at: 0x14049748b)\n    Function HalpMaskInterrupt (called at: 0x1404a3845)\n    Function HalpInterruptRequestInterrupt (called at: 0x1404b6736)\n    Function HalpInterruptRequestSecondaryInterrupt (called at: 0x1404cb068)\n    Function IopConnectInterrupt (called at: 0x1407444b6)\n    Function IopConnectInterruptFullySpecified (called at: 0x1407adc0d)\n    Function IopAllocatePassiveInterruptBlock (called at: 0x14089d91a)\n.data ptr with _guard_dispatch_icall: off_140C008E0\n    Function KeConnectInterrupt (called at: 0x14045aa49)\n.data ptr with _guard_dispatch_icall: off_140C00778\n    Function KeConnectInterrupt (called at: 0x14045aa75)\n    Function KeUnmaskInterrupt (called at: 0x1403890d1)\n    Function IopPassiveInterruptWorker (called at: 0x140506efe)\n    Function KiUnmaskSecondaryInterruptInternal (called at: 0x14051343d)\n.data ptr with _guard_dispatch_icall: off_140C00768\n    Function KiIntSteerConnect (called at: 0x14045acfd)\n.data ptr with _guard_dispatch_icall: off_140C00878\n    Function KiResumeClockTimer (called at: 0x140380c9a)\n    Function KeInitializeClock (called at: 0x140a8630a)\n.data ptr with _guard_dispatch_icall: off_140C007F0\n    Function HalpSetResumeTime (called at: 0x1404944df)\n    Function AnFwDisplayBackgroundUpdate (called at: 0x1409f313d)\n    Function AnFwpBackgroundUpdateTimer (called at: 0x1409f41d1)\n    Function GetBootSystemTime (called at: 0x140a6d6fa)\n.data ptr with _guard_dispatch_icall: off_140C005C8\n    Function HalTranslateBusAddress (called at: 0x1403a207f)\n.data ptr with _guard_dispatch_icall: off_140C00948\n    Function HalpPowerStateCallback (called at: 0x1403a351e)\n    Function PopTransitionSystemPowerStateEx (called at: 0x14098e330)\n.data ptr with _guard_dispatch_icall: off_140C00618\n    Function KiMaskInterruptInternal (called at: 0x1403a38eb)\n.data ptr with _guard_dispatch_icall: off_140C00770\n    Function KiMaskInterruptInternal (called at: 0x1403a392d)\n    Function IoProcessPassiveInterrupts (called at: 0x140506825)\n    Function KiMaskSecondaryInterruptInternal (called at: 0x1405130d3)\n.data ptr with _guard_dispatch_icall: qword_140C00720\n    Function HvlEnlightenProcessor (called at: 0x1404a3ed5)\n    Function HvlEnlightenProcessor (called at: 0x1404a3f69)\n    Function HvlpTryConfigureInterface (called at: 0x140457659)\n    Function HvlpInitializeBootProcessor (called at: 0x1404ec9ca)\n    Function HvlpPhase0Enlightenments (called at: 0x1404f4167)\n.data ptr with _guard_dispatch_icall: qword_140C00718\n    Function HvlpTryConfigureInterface (called at: 0x1404575dd)\n    Function HvlpInitializeBootProcessor (called at: 0x1404ec936)\n    Function HvlpInitializeBootProcessor (called at: 0x1404ec97a)\n    Function HvlpSetupBootProcessorEarlyHypercallPages (called at: 0x1404ed7d7)\n    Function HvlpPhase0Enlightenments (called at: 0x1404f4129)\n.data ptr with _guard_dispatch_icall: off_140C00A68\n    Function HvlStartBootLogicalProcessors (called at: 0x14045770f)\n    Function MiInitializeLargePageColorSizes (called at: 0x1403aedb5)\n    Function EtwpAddLogHeader (called at: 0x140638015)\n    Function ExpQuerySystemInformation (called at: 0x1406f2ed0)\n    Function ExpQuerySystemInformation (called at: 0x1406f2f2a)\n    Function ExpQuerySystemInformation (called at: 0x14083ba7a)\n    Function ExpQuerySystemInformation (called at: 0x14083c2cd)\n    Function ExpQuerySystemInformation (called at: 0x14083c357)\n    Function ExpQuerySystemInformation (called at: 0x14083c3f6)\n    Function KeQueryIntervalProfile (called at: 0x14071826d)\n    Function EtwQueryPerformanceTraceInformation (called at: 0x140933ef7)\n    Function EtwSetPerformanceTraceInformation (called at: 0x1409349a4)\n    Function EtwpLogPmcCounterRundown (called at: 0x140939ac7)\n    Function EtwpSampledProfileRunDown (called at: 0x14093ab05)\n    Function EtwpCoverageSamplerStart (called at: 0x140942ff5)\n    Function ExpProfileCreate (called at: 0x140955f30)\n    Function BapdRecordFirmwareBootStats (called at: 0x14099683b)\n    Function BapdRecordFirmwareBootStats (called at: 0x140996888)\n    Function PopDiagTraceFirmwareS3Stats (called at: 0x1409ae54c)\n    Function KiIntSteerInit (called at: 0x140a3e5f1)\n    Function MiInitNucleus (called at: 0x140a42559)\n    Function PipDmgInitPhaseZero (called at: 0x140a48eef)\n    Function EtwpInitialize (called at: 0x140a6027d)\n    Function KeNumaInitialize (called at: 0x140a6f6f6)\n    Function PoFxRegisterDebugger (called at: 0x140a6fac9)\n    Function PoFxRegisterDebugger (called at: 0x140a8915d)\n    Function MiInitializeChannelRangesTemporary (called at: 0x140a898c2)\n    Function VslpIumPhase0Initialize (called at: 0x140a8d486)\n    Function BgkInitialize (called at: 0x140a94c3e)\n.data ptr with _guard_dispatch_icall: qword_140C00630\n    Function HalpUsbLegacyScanBusForHandoff (called at: 0x1403b5eee)\n    Function HalpUsbLegacyScanBusForHandoff (called at: 0x1403b5f78)\n    Function x86BiosGetPciBusData (called at: 0x1403ca4d5)\n    Function HalpUsbLegacyStopOhciInterrupt (called at: 0x1404d126b)\n    Function HalpUsbLegacyStopUhciInterrupt (called at: 0x1404d13c7)\n    Function HalpUsbLegacyStopUhciInterrupt (called at: 0x1404d140d)\n    Function HalpStopLegacyUsbInterruptsInternal (called at: 0x1409a561f)\n    Function KdpSysReadBusData (called at: 0x1409b5ec3)\n.data ptr with _guard_dispatch_icall: PcDmaDispatch\n    Function HalpDmaInitializeControllers (called at: 0x1403b7813)\n    Function HalpDmaInitializeControllers (called at: 0x1403b7813)\n.data ptr with _guard_dispatch_icall: off_140C006A8\n    Function PpmInstallNewIdleStates (called at: 0x1403c04b6)\n    Function PpmRemoveIdleStates (called at: 0x140560fb0)\n.data ptr with _guard_dispatch_icall: off_140C00648\n    Function HalGetVectorInput (called at: 0x1403c6245)\n.data ptr with _guard_dispatch_icall: off_140C00700\n    Function HvlDebuggerSupportInitialize (called at: 0x1404afb6f)\n.data ptr with _guard_dispatch_icall: off_140C005F8\n    Function HvlDebuggerSupportInitialize (called at: 0x1404afd4c)\n    Function HeadlessInit (called at: 0x140a89da9)\n.data ptr with _guard_dispatch_icall: off_140C006B8\n    Function HalpCreateMcaMemoryErrorRecord (called at: 0x1404b3d3e)\n    Function HalpCreateMcaProcessorErrorRecord (called at: 0x1404b3f41)\n    Function HalpCreateNMIErrorRecord (called at: 0x1404b78f6)\n.data ptr with _guard_dispatch_icall: off_140C007C8\n    Function HalpGetMcaExtendedLogStatusBlock (called at: 0x1404b40ff)\n    Function HalpMcaInitializeErrorSection (called at: 0x1404b4614)\n    Function HvlpQueryApicIdAndNumaNode (called at: 0x1404ecb8e)\n.data ptr with _guard_dispatch_icall: off_140C00640\n    Function HalGetInterruptVector (called at: 0x1404b51ef)\n.data ptr with _guard_dispatch_icall: HalpMcaEnabled\n    Function HalpMcaSetProcessorConfig (called at: 0x140995158)\n.data ptr with _guard_dispatch_icall: off_140C00950\n    Function HalReturnToFirmware (called at: 0x1404b81a1)\n.data ptr with _guard_dispatch_icall: qword_140C00638\n    Function x86BiosSetPciBusData (called at: 0x1404b9365)\n    Function HalpUsbLegacyStopUhciInterrupt (called at: 0x1404d13a8)\n    Function HalpUsbLegacyStopUhciInterrupt (called at: 0x1404d1432)\n    Function KdpSysWriteBusData (called at: 0x1409b5f2b)\n.data ptr with _guard_dispatch_icall: HalpMoveMemory\n    Function HalpDmaSyncMapBuffers (called at: 0x1404c23b2)\n    Function HalpDmaSyncMapBuffersWithEmergencyResources (called at: 0x1404c2655)\n.data ptr with _guard_dispatch_icall: off_140C00810\n    Function HalpInterruptRequestSecondaryInterrupt (called at: 0x1404cb0d9)\n.data ptr with _guard_dispatch_icall: off_140C007A0\n    Function HvlPrepareForRootCrashdump (called at: 0x1404ef7d9)\n    Function HvlSkCrashdumpCallbackRoutine (called at: 0x1404f27ca)\n    Function PopSaveHiberContext (called at: 0x14099ff29)\n.data ptr with _guard_dispatch_icall: off_140C00698\n    Function HvlPrepareForRootCrashdump (called at: 0x1404ef7ea)\n    Function HvlCrashdumpCallbackRoutine (called at: 0x1404f25f5)\n    Function HvlSkCrashdumpCallbackRoutine (called at: 0x1404f27db)\n    Function KeBugCheck2 (called at: 0x140510ccd)\n.data ptr with _guard_dispatch_icall: qword_140C00A30\n    Function HvlpHandleIommuFaultMessage (called at: 0x1404f2e67)\n.data ptr with _guard_dispatch_icall: off_140C00940\n    Function IoInitializeBugCheckProgress (called at: 0x1404fbd04)\n    Function PopCheckpointSystemSleep (called at: 0x14099fc4c)\n.data ptr with _guard_dispatch_icall: off_140C008D8\n    Function IoWriteCrashDump (called at: 0x1404fcb75)\n    Function NtSetSystemInformation (called at: 0x14069acbe)\n.data ptr with _guard_dispatch_icall: off_140C00848\n    Function IopWriteTriageDumpToFirmware (called at: 0x1404fe7c0)\n.data ptr with _guard_dispatch_icall: off_140C00738\n    Function KdPowerTransitionEx (called at: 0x14050a88a)\n    Function KdPowerTransitionEx (called at: 0x14050a8b9)\n    Function KeFreezeExecution (called at: 0x14051727a)\n    Function KeThawExecution (called at: 0x140517624)\n    Function KiFreezeTargetExecution (called at: 0x140517986)\n    Function KiFreezeTargetExecution (called at: 0x140517a79)\n.data ptr with _guard_dispatch_icall: off_140C00990\n    Function KiClearLastBranchRecordStack (called at: 0x14050c15b)\n.data ptr with _guard_dispatch_icall: off_140C00978\n    Function KiProcessNMI (called at: 0x14050c4eb)\n    Function KiProcessNMI (called at: 0x14050c584)\n.data ptr with _guard_dispatch_icall: off_140C00928\n    Function KeConvertAuxiliaryCounterToPerformanceCounter (called at: 0x14050db4b)\n    Function NtConvertBetweenAuxiliaryCounterAndPerformanceCounter (called at: 0x14095641b)\n    Function NtConvertBetweenAuxiliaryCounterAndPerformanceCounter (called at: 0x14095645f)\n.data ptr with _guard_dispatch_icall: off_140C00920\n    Function KeConvertPerformanceCounterToAuxiliaryCounter (called at: 0x14050db6b)\n    Function NtConvertBetweenAuxiliaryCounterAndPerformanceCounter (called at: 0x14095641b)\n    Function NtConvertBetweenAuxiliaryCounterAndPerformanceCounter (called at: 0x14095645f)\n.data ptr with _guard_dispatch_icall: off_140C00930\n    Function KeQueryAuxiliaryCounterFrequency (called at: 0x14050defb)\n    Function NtQueryAuxiliaryCounterFrequency (called at: 0x14095661c)\n    Function NtQueryAuxiliaryCounterFrequency (called at: 0x14095663a)\n.data ptr with _guard_dispatch_icall: off_140C008E8\n    Function KeQueryWakeSource (called at: 0x14050e145)\n.data ptr with _guard_dispatch_icall: off_140C008A8\n    Function KeBugCheck2 (called at: 0x14051088b)\n    Function KeBugCheck2 (called at: 0x1405112b6)\n    Function KdpSendWaitContinue (called at: 0x1409b5a55)\n.data ptr with _guard_dispatch_icall: off_140C008C8\n    Function KeBugCheck2 (called at: 0x140510c9a)\n    Function NtSetSystemInformation (called at: 0x14069ace1)\n    Function PopInvokeSystemStateHandler (called at: 0x14099f8b2)\n    Function PopSaveHiberContext (called at: 0x1409a037c)\n    Function KdEnterDebugger (called at: 0x1409b409f)\n.data ptr with _guard_dispatch_icall: KiNmiInProgress\n    Function KeBugCheck2 (called at: 0x140510ccd)\n.data ptr with _guard_dispatch_icall: off_140C007A8\n    Function KeBugCheck2 (called at: 0x140511262)\n    Function PopHiberCheckResume (called at: 0x1409a1cdc)\n.data ptr with _guard_dispatch_icall: off_140C008B8\n    Function KeBugCheck2 (called at: 0x140511284)\n    Function NtSetSystemInformation (called at: 0x14069ace1)\n    Function PopInvokeSystemStateHandler (called at: 0x14098f01a)\n    Function KdExitDebugger (called at: 0x1409b4211)\n.data ptr with _guard_dispatch_icall: off_140C005D8\n    Function KeBugCheck2 (called at: 0x140511315)\n    Function KiBugCheckDebugBreak (called at: 0x140511917)\n    Function PopShutdownHandler (called at: 0x1409ae985)\n.data ptr with _guard_dispatch_icall: qword_140C049A8\n    Function KseHookExAllocatePoolWithTag (called at: 0x140520c44)\n.data ptr with _guard_dispatch_icall: qword_140C03158\n    Function KseDsCallbackHookAddDevice (called at: 0x140520cc1)\n    Function KseDsCallbackHookDriverStartIo (called at: 0x140520d8e)\n    Function KseDsCallbackHookDriverUnload (called at: 0x140520de3)\n    Function KseDsCallbackHookIrpDeviceControlFunction (called at: 0x140520e42)\n    Function KseDsCallbackHookIrpFunction (called at: 0x140520ec2)\n    Function KseDsCallbackHookIrpPnpFunction (called at: 0x140520f6f)\n    Function KseDsCallbackHookIrpPnpFunction (called at: 0x140520f82)\n    Function KseDsCallbackHookIrpPowerFunction (called at: 0x14052102e)\n    Function KseDsCallbackHookIrpPowerFunction (called at: 0x140521041)\n.data ptr with _guard_dispatch_icall: qword_140C04CE8\n    Function KseDsHookExAllocatePool (called at: 0x1405211bb)\n.data ptr with _guard_dispatch_icall: qword_140C04CA8\n    Function KseDsHookExAllocatePoolWithTag (called at: 0x140521223)\n.data ptr with _guard_dispatch_icall: qword_140C04D08\n    Function KseDsHookExFreePool (called at: 0x140521280)\n.data ptr with _guard_dispatch_icall: qword_140C04CC8\n    Function KseDsHookExFreePoolWithTag (called at: 0x1405212c6)\n.data ptr with _guard_dispatch_icall: qword_140C04C68\n    Function KseDsHookIoCreateDevice (called at: 0x140521339)\n.data ptr with _guard_dispatch_icall: qword_140C04D48\n    Function KseHookMmGetVirtualForPhysical (called at: 0x1405222d2)\n.data ptr with _guard_dispatch_icall: qword_140C04D68\n    Function KseHookMmMapIoSpace (called at: 0x140522312)\n.data ptr with _guard_dispatch_icall: qword_140C009F8\n    Function PopPowerButtonWorkCallback (called at: 0x140572429)\n.data ptr with _guard_dispatch_icall: dword_140C0523C\n    Function VfQueryDispatchTable (called at: 0x14059a4cd)\n.data ptr with _guard_dispatch_icall: VfXdvDispatchTable\n    Function VfQueryDispatchTable (called at: 0x14059a4cd)\n.data ptr with _guard_dispatch_icall: off_140C00988\n    Function EtwpTraceLastBranchRecord (called at: 0x1405a9c16)\n.data ptr with _guard_dispatch_icall: off_140C009D8\n    Function WheapGenericErrSrcRecover (called at: 0x1405b67eb)\n.data ptr with _guard_dispatch_icall: off_140C05300\n    Function SpiInit (called at: 0x1405c49e1)\n    Function SpiInit (called at: 0x1405c49f9)\n    Function SpiInit (called at: 0x1405c4a08)\n    Function SpiInit (called at: 0x1405c4a82)\n    Function SpiInit (called at: 0x1405c4a93)\n    Function SpiSend16 (called at: 0x1405c4ec3)\n    Function SpiSend16 (called at: 0x1405c4eda)\n    Function UsifGetByte (called at: 0x1405c4f28)\n    Function UsifGetByte (called at: 0x1405c4f42)\n    Function UsifPutByte (called at: 0x1405c4fc0)\n    Function UsifPutByte (called at: 0x1405c4fd9)\n    Function UsifRxReady (called at: 0x1405c503c)\n    Function ReadRegisterWithIndex32 (called at: 0x1405c515b)\n.data ptr with _guard_dispatch_icall: off_140C05308\n    Function SpiInit (called at: 0x1405c4a1e)\n    Function SpiInit (called at: 0x1405c4a33)\n    Function SpiInit (called at: 0x1405c4a47)\n    Function SpiInit (called at: 0x1405c4a59)\n    Function SpiInit (called at: 0x1405c4a6b)\n    Function SpiInit (called at: 0x1405c4ab1)\n    Function SpiSend16 (called at: 0x1405c4ea1)\n    Function SpiSend16 (called at: 0x1405c4eb3)\n    Function UsifPutByte (called at: 0x1405c4ff8)\n    Function WriteRegisterWithIndex32 (called at: 0x1405c53af)\n.data ptr with _guard_dispatch_icall: off_140C052C0\n    Function ReadPortWithIndex16 (called at: 0x1405c509b)\n.data ptr with _guard_dispatch_icall: off_140C052D0\n    Function ReadPortWithIndex32 (called at: 0x1405c50cb)\n.data ptr with _guard_dispatch_icall: UartHardwareAccess\n    Function ReadPortWithIndex8 (called at: 0x1405c50fb)\n.data ptr with _guard_dispatch_icall: off_140C052F0\n    Function ReadRegisterWithIndex16 (called at: 0x1405c512b)\n.data ptr with _guard_dispatch_icall: off_140C05310\n    Function ReadRegisterWithIndex64 (called at: 0x1405c518b)\n.data ptr with _guard_dispatch_icall: off_140C052E0\n    Function ReadRegisterWithIndex8 (called at: 0x1405c51bb)\n.data ptr with _guard_dispatch_icall: off_140C052C8\n    Function WritePortWithIndex16 (called at: 0x1405c52ef)\n.data ptr with _guard_dispatch_icall: off_140C052D8\n    Function WritePortWithIndex32 (called at: 0x1405c531f)\n.data ptr with _guard_dispatch_icall: off_140C052B8\n    Function WritePortWithIndex8 (called at: 0x1405c534e)\n.data ptr with _guard_dispatch_icall: off_140C052F8\n    Function WriteRegisterWithIndex16 (called at: 0x1405c537f)\n.data ptr with _guard_dispatch_icall: off_140C05318\n    Function WriteRegisterWithIndex64 (called at: 0x1405c53df)\n.data ptr with _guard_dispatch_icall: off_140C052E8\n    Function WriteRegisterWithIndex8 (called at: 0x1405c540e)\n.data ptr with _guard_dispatch_icall: off_140C007E0\n    Function EtwpFreeLoggerContext (called at: 0x1407d072a)\n    Function EtwpUpdatePmcCounters (called at: 0x140936d28)\n.data ptr with _guard_dispatch_icall: off_140C009B8\n    Function EtwpFreeLoggerContext (called at: 0x1407d078a)\n.data ptr with _guard_dispatch_icall: off_140C008D0\n    Function ExpQuerySystemInformation (called at: 0x14083b727)\n    Function PoInitSystem (called at: 0x140a3c905)\n.data ptr with _guard_dispatch_icall: off_140C009C0\n    Function PiDmaGuardProcessPostRemove (called at: 0x1408165b5)\n.data ptr with _guard_dispatch_icall: off_140C009C8\n    Function PipProcessStartPhase1 (called at: 0x14081690a)\n.data ptr with _guard_dispatch_icall: off_140C00908\n    Function IoGetDmaAdapter (called at: 0x140747f65)\n    Function IoGetDmaAdapter (called at: 0x140747fa2)\n.data ptr with _guard_dispatch_icall: off_140C00A38\n    Function PipDmgSaveDeviceDmarPolicy (called at: 0x140750886)\n    Function HalpDmaAllocateChildAdapterV3 (called at: 0x1407a50f3)\n.data ptr with _guard_dispatch_icall: off_140C005A8\n    Function PopAllocateHiberContext (called at: 0x14075b687)\n    Function PopMarkComponentsBootPhase (called at: 0x1409a20f1)\n.data ptr with _guard_dispatch_icall: off_140C00AF8\n    Function CmpAcceptBoot (called at: 0x140770f4e)\n    Function PopGracefulShutdown (called at: 0x1409ad331)\n.data ptr with _guard_dispatch_icall: off_140C00860\n    Function KeInitializeTimerTable (called at: 0x140819391)\n    Function PopInitPlatformSettings (called at: 0x140a6d346)\n.data ptr with _guard_dispatch_icall: off_140C009A0\n    Function EtwpInitializeLastBranchTracing (called at: 0x1407b63e2)\n.data ptr with _guard_dispatch_icall: off_140C009D0\n    Function IoGetIommuInterface (called at: 0x1407b6907)\n.data ptr with _guard_dispatch_icall: off_140C005D0\n    Function HalAssignSlotResources (called at: 0x14086017a)\n.data ptr with _guard_dispatch_icall: off_140C00980\n    Function IopEnumerateEnvironmentVariablesHal (called at: 0x14089629b)\n.data ptr with _guard_dispatch_icall: off_140C00678\n    Function PnprReplaceStart (called at: 0x1408aaabe)\n.data ptr with _guard_dispatch_icall: qword_140C04DE8\n    Function KseHookQueryValueKey (called at: 0x1408bda16)\n.data ptr with _guard_dispatch_icall: AlpcpLogCallbackListHead\n    Function AlpcpInvokeLogCallbacks (called at: 0x1408bf97d)\n    Function AlpcpInvokeLogCallbacks (called at: 0x1408bf97d)\n.data ptr with _guard_dispatch_icall: unk_140C031C8\n    Function PopPolicyDeviceRemove (called at: 0x1408ed50d)\n.data ptr with _guard_dispatch_icall: off_140C007D0\n    Function EtwpUpdatePmcCounters (called at: 0x140936ce8)\n.data ptr with _guard_dispatch_icall: off_140C00870\n    Function EtwpClockSourceRunDown (called at: 0x1409396c7)\n    Function KeInitializeClock (called at: 0x140a6984f)\n.data ptr with _guard_dispatch_icall: off_140C009B0\n    Function EtwpUpdateLastBranchTracingConfiguration (called at: 0x140943f5f)\n.data ptr with _guard_dispatch_icall: off_140C005C0\n    Function PopTransitionSystemPowerStateEx (called at: 0x14098e1c3)\n    Function PopTransitionSystemPowerStateEx (called at: 0x14098e40d)\n.data ptr with _guard_dispatch_icall: off_140C006A0\n    Function PopInvokeSystemStateHandler (called at: 0x14098f224)\n    Function PopInvokeSystemStateHandler (called at: 0x14099f971)\n.data ptr with _guard_dispatch_icall: off_140C00858\n    Function PopRestoreHiberContext (called at: 0x14098f82f)\n    Function PopRestoreHiberContext (called at: 0x14099fcb6)\n.data ptr with _guard_dispatch_icall: off_140C00850\n    Function PopSaveHiberContext (called at: 0x14098fb00)\n.data ptr with _guard_dispatch_icall: off_140C007C0\n    Function HalpAcpiPostSleep (called at: 0x1409a0bdd)\n    Function HaliLocateHiberRanges (called at: 0x1409a1244)\n    Function PopHiberCheckResume (called at: 0x140993fb6)\n.data ptr with _guard_dispatch_icall: off_140C006C0\n    Function HalpAcpiPostSleep (called at: 0x1409a0c97)\n    Function PopHiberCheckResume (called at: 0x140993f8d)\n.data ptr with _guard_dispatch_icall: off_140C00800\n    Function HaliLocateHiberRanges (called at: 0x1409a1244)\n.data ptr with _guard_dispatch_icall: off_140C00838\n    Function PopHiberCheckResume (called at: 0x140993f69)\n    Function PopHiberCheckResume (called at: 0x140993f9c)\n.data ptr with _guard_dispatch_icall: off_140C00688\n    Function PnprEndMirroring (called at: 0x1409a9ae1)\n    Function PnprInitiateReplaceOperation (called at: 0x1409a9dc2)\n    Function PnprQuiesceProcessors (called at: 0x1409aad77)\n    Function PnprQuiesceProcessors (called at: 0x1409aaee3)\n    Function PnprWakeProcessors (called at: 0x1409ab205)\n.data ptr with _guard_dispatch_icall: off_140C00690\n    Function PnprInitiateReplaceOperation (called at: 0x1409a9ef5)\n.data ptr with _guard_dispatch_icall: off_140C006E8\n    Function PnprQuiesceProcessorDpc (called at: 0x1409aa8d2)\n.data ptr with _guard_dispatch_icall: off_140C00680\n    Function PnprQuiesceProcessorDpc (called at: 0x1409aa8ec)\n.data ptr with _guard_dispatch_icall: off_140C006F0\n    Function PnprQuiesceProcessorDpc (called at: 0x1409aaa94)\n.data ptr with _guard_dispatch_icall: off_140C006D8\n    Function PnprQuiesceProcessors (called at: 0x1409aacbf)\n.data ptr with _guard_dispatch_icall: off_140C006B0\n    Function PnprWakeProcessors (called at: 0x1409ab1e1)\n    Function KiInitializeDynamicProcessorDpc (called at: 0x1409ab8b5)\n    Function KeStartAllProcessors (called at: 0x140a3ef05)\n.data ptr with _guard_dispatch_icall: off_140C006E0\n    Function PnprWakeProcessors (called at: 0x1409ab256)\n.data ptr with _guard_dispatch_icall: off_140C00910\n    Function VfGetDmaAdapter (called at: 0x1409c8f03)\n.data ptr with _guard_dispatch_icall: off_140C008B0\n    Function InitBootProcessor (called at: 0x140a37c95)\n.data ptr with _guard_dispatch_icall: off_140C00AC0\n    Function IoInitSystemPreDrivers (called at: 0x140a3b901)\n.data ptr with _guard_dispatch_icall: KiNumaQueryNodeCapacity\n    Function KiPerformGroupConfiguration (called at: 0x140a3f1c7)\n.data ptr with _guard_dispatch_icall: KiNumaQueryNodeDistance\n    Function KiPerformGroupConfiguration (called at: 0x140a3f2aa)\n.data ptr with _guard_dispatch_icall: HalpExtensionImports\n    Function HalpExtInitExtensions (called at: 0x140a86c5f)\n```\n\n## Some discussions on UnknownCheats\nhttps://www.unknowncheats.me/forum/general-programming-and-reversing/582086-simple-ida-python-script-data-ptr.html\n\n## TODO\n- Add additional pattern matching\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgmh5225%2Fida-find-.data-ptr","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgmh5225%2Fida-find-.data-ptr","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgmh5225%2Fida-find-.data-ptr/lists"}