$$ **********************************************************
$$ Copyright (c) 2006 VMware, Inc.  All rights reserved.
$$ **********************************************************

$$ Redistribution and use in source and binary forms, with or without
$$ modification, are permitted provided that the following conditions are met:
$$
$$ * Redistributions of source code must retain the above copyright notice,
$$   this list of conditions and the following disclaimer.
$$
$$ * Redistributions in binary form must reproduce the above copyright notice,
$$   this list of conditions and the following disclaimer in the documentation
$$   and/or other materials provided with the distribution.
$$
$$ * Neither the name of VMware, Inc. nor the names of its contributors may be
$$   used to endorse or promote products derived from this software without
$$   specific prior written permission.
$$
$$ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
$$ AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
$$ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
$$ ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE
$$ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
$$ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
$$ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
$$ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
$$ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
$$ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
$$ DAMAGE.

* FIXME: currently both are to be used as commands,
* e.g. finddr_slow or finddr_fast, preferrably should be arguments to .reload

* use for analyzing processes too early or too late for following drmarker with finddr_fast
as finddr_slow .foreach ( base {s -[1]a 0 L?80000000 ", build" } ) { !vprot base }

* follow drmarker from ntdll!KiUserCallbackDispatcher
* 0:000> dt theDrMarker dr_base_addr
*   +0x020 dr_base_addr : Ptr32 Void
* follow jmp to hook func,
as ? finddr_fast poi((( poi(ntdll!KiUserCallbackDispatcher+1) + ntdll!KiUserCallbackDispatcher+5) & fffff000) + 0x20)
