NtQuerySystemInformation

$$ WinDbg script to hook NtQuerySystemInformation
$$
$$ This script pull the trigger When {caller_process_name} calls nt!NtQuerySystemInformation with SystemInformationClass 5.
$$
$$ Usage: $$>a< {caller_process_name}
$$ ex)
$$    kd> bp nt!NtQuerySystemInformation "$$>a< d:\work.windbg\NtQuerySystemInformation.txt procexp64.exe"
$$
$$ by somma (fixbrain@gmail.com)

$$ Do not use semicolon within $$ (line comment), if you don't want meet hell. shit!
$$ semicolon escapes line comment.?!@#!

.if (@rcx == 5)
{
   $$ kd> dt _eprocess @$proc
   $$ ...
   $$    +0x2e0 ImageFileName    : [15]  "System"
   $$ $t0 = _eprocess.ImageFileName
   $$

   r $t0 = @$proc + 0x2e0;
   as /ma ${/v:ProcName} @$t0;


   $$ '@' specifies that the string represented by ProcName is interpreted literally - that is '\' is treated as a backslash.
   .if ($spat(@"${ProcName}", "$arg1") == 0)
   {
      gc;
   }
   .else
   {
      .printf "[condition matched] process = %ma, info class = %u \n", @$t0, @rcx
   }
}
.else
{
   gc;
}