able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/com/rpc/runtime/exts/rpcdbg.cxx

6971 lines
232 KiB
C++
Raw Permalink Normal View History

Add source files
2020-09-26 03:20:57 -05:00
//+-------------------------------------------------------------------------
//
// Microsoft Windows
//
// Copyright (C) Microsoft Corporation, 1994 - 2001
//
// File: rpcdbg.cxx
//
//--------------------------------------------------------------------------
/*++
Module Name:
rpcdbg.cxx
Abstract:
Author:
Jeff Roberts (jroberts) 13-May-1996
Revision History:
13-May-1996 jroberts Created this module.
Mazhar Mohammed (mazharm) 3-20-97 - changed it all for async RPC,
added some cool stuff
single dll for ntsd and kd
KamenM Dec 99 Added debugging support and multiple
ntsd-through-kd sessions support
GrigoriK Mar 2001 Added support for type info.
--*/
#define KDEXT_64BIT
#include <stddef.h>
#include <limits.h>
#define DG_LOGGING
#define private public
#define protected public
#include <sysinc.h>
#include <wincrypt.h>
#include <rpc.h>
#include <rpcndr.h>
#include <ndrp.h>
#include <wdbgexts.h>
#include <rpcdcep.h>
#include <rpcerrp.h>
#define SECURITY_WIN32
#include <rpcssp.h>
#include <authz.h>
#include <align.h>
#include <util.hxx>
#include <rpcuuid.hxx>
#include <interlck.hxx>
#include <mutex.hxx>
#include <CompFlag.hxx>
#include <sdict.hxx>
#include <sdict2.hxx>
#include <rpctrans.hxx>
#include <CellDef.hxx>
#include <CellHeap.hxx>
#include <EEInfo.h>
#include <EEInfo.hxx>
#include <SWMR.hxx>
#include <bcache.hxx>
#include <threads.hxx>
#include <queue.hxx>
#include <gc.hxx>
#include <handle.hxx>
#include <binding.hxx>
#include <osfpcket.hxx>
#include <bitset.hxx>
#include <secclnt.hxx>
#include <CompFlag.hxx>
#include <ProtBind.hxx>
#include <osfclnt.hxx>
#include <secsvr.hxx>
#include <hndlsvr.hxx>
#include <osfsvr.hxx>
#include <rpccfg.h>
#include <epmap.h>
#include <delaytab.hxx>
#include <memory.hxx>
#include <dgpkt.hxx>
#include <locks.hxx>
#include <dgclnt.hxx>
#include <delaytab.hxx>
#include <hashtabl.hxx>
#include <dgsvr.hxx>
#include <lpcpack.hxx>
#include <lpcsvr.hxx>
#include <lpcclnt.hxx>
#include <ntverp.h>
#include "rpcexts.hxx"
HANDLE ProcessHandle = 0;
BOOL fKD = 0;
// is debuggee a CHK build?
BOOL ChkTarget;
EXT_API_VERSION ApiVersion = { VER_PRODUCTVERSION_W >> 8,
VER_PRODUCTVERSION_W & 0xff,
EXT_API_VERSION_NUMBER64, 0 };
WINDBG_EXTENSION_APIS ExtensionApis;
USHORT SavedMajorVersion;
USHORT SavedMinorVersion;
BOOL bDebuggingChecked;
VOID
WinDbgExtensionDllInit(
PWINDBG_EXTENSION_APIS64 lpExtensionApis,
USHORT MajorVersion,
USHORT MinorVersion
)
{
KDDEBUGGER_DATA64 KdDebuggerData;
ExtensionApis = *lpExtensionApis ;
SavedMajorVersion = MajorVersion;
SavedMinorVersion = MinorVersion;
ChkTarget = SavedMajorVersion == 0x0c ? TRUE : FALSE;
KdDebuggerData.Header.OwnerTag = KDBG_TAG;
KdDebuggerData.Header.Size = sizeof( KdDebuggerData );
if (Ioctl( IG_GET_DEBUGGER_DATA, &KdDebuggerData, sizeof( KdDebuggerData ) ))
{
fKD = 1;
}
INIT_ADDRESS_SIZE;
}
// By default we use the type information in extensins.
// This flag can be reset with !rpcexts.typeinfo off which will
// disable the use of type information. !typeinfo on will
// enable it.
BOOL fUseTypeInfo = TRUE;
int AddressSize = 0;
// If not set, the _NOSPEW macros will not print debugger spew.
// It is set to FALSE after the spew is printed by one of thise macros.
BOOL fSpew = TRUE;
char *
BoolString(
BOOL Value
)
{
switch (Value)
{
case TRUE: return "True";
case FALSE: return "False";
default: return "?????";
}
}
ULONG GetTypeSize(PUCHAR TypeName)
{
SYM_DUMP_PARAM Sym = {
sizeof (SYM_DUMP_PARAM),
TypeName,
DBG_DUMP_NO_PRINT, 0,
NULL,
NULL,
NULL,
NULL
};
return Ioctl(IG_GET_TYPE_SIZE, &Sym, Sym.size);
}
ULONG64 GetVar(PCSTR VarName)
{
ULONG64 Var = 0;
ULONG64 VarAddr = GetExpression(VarName);
if (!VarAddr)
{
dprintf("Failure to get address of %s\n", VarName);
return NULL;
}
ReadPtr(VarAddr, &Var);
return Var;
}
void do_dcebinding (ULONG64 qwAddr);
void do_dgep (ULONG64 qwAddr);
void do_dgsc (ULONG64 qwAddr);
void do_dgsn (ULONG64 qwAddr);
void do_osfbh (ULONG64 qwAddr);
void do_osfca (ULONG64 qwAddr);
void do_osfcconn (ULONG64 qwAddr);
void do_osfccall (ULONG64 qwAddr);
void do_osfaddr (ULONG64 qwAddr);
void do_osfsconn (ULONG64 qwAddr);
void do_osfscall (ULONG64 qwAddr);
void do_osfsa (ULONG64 qwAddr);
void do_rpcsvr (ULONG64 qwAddr);
void do_lpcaddr (ULONG64 qwAddr);
void do_lpcsa (ULONG64 qwAddr);
void do_lpcscall (ULONG64 qwAddr);
void do_lpcccall (ULONG64 qwAddr);
void do_lpcbh (ULONG64 qwAddr);
void do_lpcca (ULONG64 qwAddr);
void do_rpcmem (ULONG64 qwAddr, long lDisplay, long lVerbose);
void do_rpcmsg (ULONG64 qwAddr);
void do_pasync (ULONG64 qwAddr);
void do_authinfo (ULONG64 qwAddr);
void do_error (ULONG64 qwAddr);
void do_dict (ULONG64 qwAddr);
void do_dict2 (ULONG64 qwAddr);
void do_queue (ULONG64 qwAddr);
void do_stubmsg (ULONG64 qwAddr);
void do_thread (ULONG64 qwAddr);
void do_copacket (ULONG64 qwAddr);
void do_obj (ULONG64 qwAddr);
void do_transinfo (ULONG64 qwAddr);
void do_lpcpacket (ULONG64 qwAddr);
void do_IF (ULONG64 qwAddr);
void do_assoctable (ULONG64 qwAddr);
void do_eerecord (ULONG64 qwAddr);
void do_eeinfo (ULONG64 qwAddr);
void do_dgaddr (ULONG64 qwAddr);
void do_dgca (ULONG64 qwAddr);
void do_dgbh (ULONG64 qwAddr);
void do_dgag (ULONG64 qwAddr);
void do_dgcn (ULONG64 qwAddr);
void do_typeinfo (ULONG64 qwAddr);
void do_pipestate (ULONG64 qwAddr);
void do_pipedesc (ULONG64 qwAddr);
void do_pipearg (ULONG64 qwAddr);
void do_pipemsg (ULONG64 qwAddr);
void do_dgpe (ULONG64 qwAddr);
void do_dgcc (ULONG64 qwAddr);
void do_packet (ULONG64 qwAddr);
void do_packet_header (ULONG64 qwAddr);
void do_trans (ULONG64 qwAddr);
void do_dgpkt (ULONG64 qwAddr);
void do_dgpkthdr (ULONG64 qwAddr);
void do_asyncdcom (ULONG64 qwAddr);
void do_asyncmsg (ULONG64 qwAddr);
void do_asyncrpc (ULONG64 qwAddr);
void do_listcalls (ULONG64 qwAddr);
MY_DECLARE_API( assoctable )
MY_DECLARE_API( dgep )
MY_DECLARE_API( dgca )
MY_DECLARE_API( dgcn )
MY_DECLARE_API( dgsn )
MY_DECLARE_API( dgsc )
MY_DECLARE_API( osfbh )
MY_DECLARE_API( osfca )
MY_DECLARE_API( osfaddr )
MY_DECLARE_API( osfscall )
MY_DECLARE_API( osfsconn )
MY_DECLARE_API( dcebinding )
MY_DECLARE_API( osfccall )
MY_DECLARE_API( osfcconn )
MY_DECLARE_API( osfsa )
MY_DECLARE_API( rpcmsg )
MY_DECLARE_API( lpcaddr )
MY_DECLARE_API( lpcsa );
MY_DECLARE_API( lpcscall );
MY_DECLARE_API( lpcccall );
MY_DECLARE_API( lpcbh );
MY_DECLARE_API( lpcca );
MY_DECLARE_API( pasync);
MY_DECLARE_API( authinfo );
MY_DECLARE_API( error );
MY_DECLARE_API( dict );
MY_DECLARE_API( dict2 );
MY_DECLARE_API( queue );
MY_DECLARE_API( stubmsg );
MY_DECLARE_API( thread );
MY_DECLARE_API( copacket );
MY_DECLARE_API( obj );
MY_DECLARE_API( transinfo );
MY_DECLARE_API( lpcpacket );
MY_DECLARE_API( IF );
MY_DECLARE_API( eerecord );
MY_DECLARE_API( eeinfo );
MY_DECLARE_API( dgcc );
MY_DECLARE_API( dgpe );
MY_DECLARE_API( pipestate );
MY_DECLARE_API( pipedesc );
MY_DECLARE_API( pipearg );
MY_DECLARE_API( pipemsg );
MY_DECLARE_API( dgpkt );
MY_DECLARE_API( dgpkthdr );
MY_DECLARE_API( asyncdcom );
MY_DECLARE_API( asyncmsg );
MY_DECLARE_API( asyncrpc );
// define our own operators new and delete, so that we do not have to include the crt
void * __cdecl
::operator new(size_t dwBytes)
{
void *p;
p = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwBytes);
return (p);
}
void __cdecl
::operator delete (void *p)
{
HeapFree(GetProcessHeap(), 0, p);
}
BOOL
GetData(IN ULONG64 qwAddress, IN LPVOID ptr, IN ULONG size)
{
BOOL b;
ULONG BytesRead = 0;
b = ReadMemory(qwAddress, ptr, size, &BytesRead );
if (!b || BytesRead != size )
{
return FALSE;
}
return TRUE;
}
#define MAX_MESSAGE_BLOCK_SIZE 1024
#define BLOCK_SIZE 16
RPC_CHAR *
ReadProcessRpcChar(
ULONG64 qwAddr
)
{
char block[BLOCK_SIZE];
RPC_CHAR *RpcBlock = (RPC_CHAR *)&block;
char *string_block = new char[MAX_MESSAGE_BLOCK_SIZE];
RPC_CHAR *RpcString = (RPC_CHAR *)string_block;
int length = 0;
int i = 0;
BOOL b;
BOOL end = FALSE;
if (qwAddr == NULL) {
return (NULL);
}
if (string_block == NULL)
{
dprintf("couldn't allocate %d memory\n", MAX_MESSAGE_BLOCK_SIZE);
return (NULL);
}
for (length = 0; length < MAX_MESSAGE_BLOCK_SIZE/2; ) {
b = GetData(qwAddr, &block, BLOCK_SIZE);
if (b == FALSE) {
dprintf("couldn't read address %I64xx\n", qwAddr);
return (NULL);
}
for (i = 0; i < BLOCK_SIZE/2; i++) {
if (RpcBlock[i] == L'\0') {
end = TRUE;
}
RpcString[length] = RpcBlock[i];
length++;
}
if (end == TRUE) {
break;
}
qwAddr += BLOCK_SIZE;
}
return (RpcString);
}
long
myatol(char *string)
{
int i = 0;
BOOL minus = FALSE;
long number = 0;
long tmpnumber = 0 ;
long chknum = LONG_MAX;
if (string[0] == '-') {
minus = TRUE;
i++;
}
else
if (string[0] == '+') {
i++;
}
for (; string[i] != '\0'; i++) {
if ((string[i] >= '0')&&(string[i] <= '9')) {
tmpnumber = string[i] - '0';
if (number != 0)
{
chknum = LONG_MAX/number;
}
if (chknum > 11) {
number = number*10 + tmpnumber;
}
}
else
return 0;
}
if (minus == TRUE) {
number = 0 - number;
}
return number;
}
PCHAR
MapSymbol(ULONG64 qwAddr)
{
static CHAR Name[256];
ULONG64 Displacement;
GetSymbol(qwAddr, Name, &Displacement);
if (strcmp(Name, "") != 0) {
if (Displacement)
strcat(Name, "+");
PCHAR p = strchr(Name, '\0');
if (Displacement)
_ui64toa(Displacement, p, 16);
return(Name);
}
else {
return NULL;
}
}
// checks if the uuid is null, prints the uuid
void
PrintUuidLocal(UUID *Uuid)
{
unsigned long PAPI * Vector;
Vector = (unsigned long PAPI *) Uuid;
if ( (Vector[0] == 0)
&& (Vector[1] == 0)
&& (Vector[2] == 0)
&& (Vector[3] == 0))
{
dprintf("(Null Uuid)");
}
else
{
dprintf("%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
Uuid->Data1, Uuid->Data2, Uuid->Data3, Uuid->Data4[0], Uuid->Data4[1],
Uuid->Data4[2], Uuid->Data4[3], Uuid->Data4[4], Uuid->Data4[5],
Uuid->Data4[6], Uuid->Data4[7] );
}
return;
}
// prints the uuid at a given address within the process
void
PrintUuid(ULONG64 Uuid)
{
UUID UuidStore;
GetData(Uuid, &UuidStore, sizeof(UUID));
PrintUuidLocal(&UuidStore);
}
// Returns a string for the symbol that matches the value at
// address dwAddr, or "".
PCHAR SymbolAtAddress(ULONG64 Addr)
{
CHAR Symbol[128];
ULONG64 Displacement = 0;
static CHAR Name[256];
ULONG64 Val;
ReadPtr(Addr, &Val);
GetSymbol(Val, Symbol, &Displacement);
if (strcmp(Symbol, "") != 0) {
sprintf(Name, "%s+%x", Symbol, Displacement);
return Name;
}
else
return "";
}
// Returns a string for the symbol that matches the value at
// address dwAddr, without the offset, or "".
PCHAR SymbolAtAddressNoOffset(ULONG64 Addr)
{
CHAR Symbol[128];
ULONG64 Displacement = 0;
static CHAR Name[256];
ULONG64 Val;
ReadPtr(Addr, &Val);
GetSymbol(Val, Symbol, &Displacement);
if (strcmp(Symbol, "") != 0) {
sprintf(Name, "%s", Symbol);
return Name;
}
else
return "";
}
void
do_securitycontext (
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
if (qwAddr == 0)
{
return;
}
do_authinfo(qwAddr);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, AuthContextId,
" AuthContextId ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, Flags,
" Flags ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, ContextAttributes,
" ContextAttributes ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, fFullyConstructed,
" fFullyConstructed ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, DontForgetToDelete,
" DontForgetToDelete ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, fDatagram,
" fDatagram ", tmp1);
ULONG64 SecurityContext;
GET_ADDRESS_OF(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, SecurityContext, SecurityContext, tmp2);
ULONG64 dwUpper, dwLower;
GET_MEMBER(SecurityContext, _SecHandle, RPCRT4!_SecHandle, dwUpper, dwUpper);
GET_MEMBER(SecurityContext, _SecHandle, RPCRT4!_SecHandle, dwLower, dwLower);
dprintf(
" SecurityContext(0x%I64x, 0x%I64x) - 0x%I64x\n", dwUpper, dwLower, SecurityContext);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, MaxHeaderLength,
" MaxHeaderLength ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, MaxSignatureLength,
" MaxSignatureLength ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, cbBlockSize,
" cbBlockSize ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, RpcSecurityInterface,
" RpcSecurityInterface ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, FailedContext,
" FailedContext ", tmp1);
}
VOID
do_sizes(
)
{
PRINT_RPC_TYPE_SIZE(ASSOCIATION_HANDLE);
dprintf("BIND_NAK_PICKLE_BUFFER_OFFSET - 0x%x\n", BIND_NAK_PICKLE_BUFFER_OFFSET);
PRINT_RPC_TYPE_SIZE(BINDING_HANDLE);
PRINT_RPC_TYPE_SIZE(BITSET);
PRINT_RPC_TYPE_SIZE(CALL);
PRINT_RPC_TYPE_SIZE(CCALL);
PRINT_RPC_TYPE_SIZE(CLIENT_AUTH_INFO);
PRINT_RPC_TYPE_SIZE(CLIENT_ID);
PRINT_RPC_TYPE_SIZE(DCE_BINDING);
PRINT_RPC_TYPE_SIZE(DCE_SECURITY_INFO);
PRINT_RPC_TYPE_SIZE(EVENT);
PRINT_RPC_TYPE_SIZE(GENERIC_OBJECT);
PRINT_RPC_TYPE_SIZE(INTERLOCKED_INTEGER);
PRINT_RPC_TYPE_SIZE(LOADABLE_TRANSPORT);
PRINT_RPC_TYPE_SIZE(LRPC_ADDRESS);
PRINT_RPC_TYPE_SIZE(LRPC_BIND_EXCHANGE);
PRINT_RPC_TYPE_SIZE(LRPC_BINDING_HANDLE);
PRINT_RPC_TYPE_SIZE(LRPC_CASSOCIATION);
PRINT_RPC_TYPE_SIZE(LRPC_CCALL);
PRINT_RPC_TYPE_SIZE(LRPC_MESSAGE);
PRINT_RPC_TYPE_SIZE(LRPC_FAULT_MESSAGE);
PRINT_RPC_TYPE_SIZE(LRPC_FAULT2_MESSAGE);
PRINT_RPC_TYPE_SIZE(LRPC_RPC_HEADER);
PRINT_RPC_TYPE_SIZE(LRPC_SASSOCIATION);
PRINT_RPC_TYPE_SIZE(LRPC_SCALL);
PRINT_RPC_TYPE_SIZE(LRPC_SERVER);
dprintf("MAX_BIND_NAK - 0x%x\n", MAX_BIND_NAK);
dprintf("MAXIMUM_FAULT_MESSAGE - 0x%x\n", MAXIMUM_FAULT_MESSAGE);
dprintf("MAXIMUM_MESSAGE_BUFFER - 0x%x\n", MAXIMUM_MESSAGE_BUFFER);
PRINT_RPC_TYPE_SIZE(MESSAGE_OBJECT);
PRINT_RPC_TYPE_SIZE(MUTEX);
PRINT_RPC_TYPE_SIZE(OSF_ADDRESS);
PRINT_RPC_TYPE_SIZE(OSF_ASSOCIATION);
PRINT_RPC_TYPE_SIZE(OSF_BINDING);
PRINT_RPC_TYPE_SIZE(OSF_BINDING_HANDLE);
PRINT_RPC_TYPE_SIZE(OSF_CASSOCIATION);
PRINT_RPC_TYPE_SIZE(OSF_CCALL);
PRINT_RPC_TYPE_SIZE(OSF_CCONNECTION);
PRINT_RPC_TYPE_SIZE(OSF_SBINDING);
PRINT_RPC_TYPE_SIZE(OSF_SCALL);
PRINT_RPC_TYPE_SIZE(OSF_SCONNECTION);
dprintf("PORT_MAXIMUM_MESSAGE_LENGTH - 0x%x\n", PORT_MAXIMUM_MESSAGE_LENGTH);
PRINT_RPC_TYPE_SIZE(PORT_MESSAGE);
PRINT_RPC_TYPE_SIZE(QUEUE);
PRINT_RPC_TYPE_SIZE(RPC_ADDRESS);
PRINT_RPC_TYPE_SIZE(RPC_APC_INFO);
PRINT_RPC_TYPE_SIZE(RPC_CLIENT_INTERFACE);
PRINT_RPC_TYPE_SIZE(RPC_CLIENT_PROCESS_IDENTIFIER);
PRINT_RPC_TYPE_SIZE(rpcconn_alter_context);
PRINT_RPC_TYPE_SIZE(rpcconn_alter_context_resp);
PRINT_RPC_TYPE_SIZE(rpcconn_bind);
PRINT_RPC_TYPE_SIZE(rpcconn_bind_ack);
PRINT_RPC_TYPE_SIZE(rpcconn_common);
PRINT_RPC_TYPE_SIZE(rpcconn_fault);
PRINT_RPC_TYPE_SIZE(rpcconn_request);
PRINT_RPC_TYPE_SIZE(rpcconn_response);
PRINT_RPC_TYPE_SIZE(RPC_INTERFACE);
PRINT_RPC_TYPE_SIZE(RPC_INTERFACE_MANAGER);
#if DBG
PRINT_RPC_TYPE_SIZE(RPC_MEMORY_BLOCK);
#endif
PRINT_RPC_TYPE_SIZE(RPC_MESSAGE);
PRINT_RPC_TYPE_SIZE(RPC_SERVER);
PRINT_RPC_TYPE_SIZE(RPC_SERVER_INTERFACE);
PRINT_RPC_TYPE_SIZE(RPC_SYNTAX_IDENTIFIER);
PRINT_RPC_TYPE_SIZE(RPC_UUID);
PRINT_RPC_TYPE_SIZE(SCALL);
PRINT_RPC_TYPE_SIZE(SECURITY_CONTEXT);
PRINT_RPC_TYPE_SIZE(sec_trailer);
PRINT_RPC_TYPE_SIZE(SIMPLE_DICT);
PRINT_RPC_TYPE_SIZE(SIMPLE_DICT2);
PRINT_RPC_TYPE_SIZE(THREAD);
PRINT_RPC_TYPE_SIZE(TRANS_INFO);
}
DECLARE_API( sizes )
{
do_sizes();
}
char *
GetError (DWORD dwError)
{
DWORD dwFlag = FORMAT_MESSAGE_FROM_SYSTEM;
static CHAR szErrorMessage[1024];
static HANDLE hSource = NULL;
if ((dwError >= 2100) && (dwError < 6000))
{
if (hSource == NULL)
{
hSource = LoadLibrary("netmsg.dll");
}
if (hSource == NULL)
{
sprintf (szErrorMessage,
"Unable to load netmsg.dll. Error %d occured.\n",
dwError);
return(szErrorMessage);
}
dwFlag = FORMAT_MESSAGE_FROM_HMODULE;
}
if (!FormatMessage (dwFlag,
hSource,
dwError,
0,
szErrorMessage,
1024,
NULL))
{
sprintf (szErrorMessage,
"An unknown error occured: 0x%x \n",
dwError);
}
return(szErrorMessage);
}
VOID
do_error (
ULONG64 Error
)
{
dprintf("%x: %s\n", (unsigned long)Error, GetError((unsigned long) Error));
}
VOID
do_IF (
ULONG64 rpcif
)
{
ULONG64 tmp0;
ULONG64 tmp1;
ULONG tmp2;
dprintf("RPC_INTERFACE at 0x%I64x\n\n", rpcif);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, Server, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, NullManagerEpv, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, NullManagerFlag, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, ManagerCount, tmp0);
GET_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, NullManagerActiveCallCount, tmp0, tmp2);
PRINT_MEMBER_WITH_LABEL(tmp0, INTERLOCKED_INTEGER, RPCRT4!INTERLOCKED_INTEGER, Integer, "NullManagerActiveCallCount", tmp1);
GET_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, AutoListenCallCount, tmp0, tmp2);
PRINT_MEMBER_WITH_LABEL(tmp0, INTERLOCKED_INTEGER, RPCRT4!INTERLOCKED_INTEGER, Integer, "AutoListenCallCount", tmp1);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, Flags, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, MaxCalls, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, CallbackFn, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, PipeInterfaceFlag, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, fReplace, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, fBindingsExported, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, UuidVector, tmp0);
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, SequenceNumber, tmp0);
#if DBG
PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, Strict, tmp0);
#endif
PRINT_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, RpcInterfaceInformation, tmp2);
PRINT_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, InterfaceManagerDictionary, tmp2);
PRINT_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, Annotation, tmp2);
PRINT_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, NsEntries, tmp2);
}
VOID
do_obj (
ULONG64 qwAddr
)
{
BOOL b;
ULONG64 MagicValue;
ULONG64 ObjectType;
ReadPtr(qwAddr+AddressSize, &MagicValue);
ReadPtr(qwAddr+AddressSize+4, &ObjectType);
if ((ULONG)MagicValue != MAGICLONG)
{
dprintf("Bad or deleted object at %p\n", qwAddr);
}
switch (((ULONG)ObjectType) & (~OBJECT_DELETED))
{
case DG_CALLBACK_TYPE:
dprintf("this is a DG_CLIENT_CALLBACK object\n");
break;
case DG_CCALL_TYPE:
{
dprintf("Dumping DG_CCALL...\n");
do_dgcc(qwAddr);
break;
}
case DG_SCALL_TYPE:
{
dprintf("Dumping DG_SCALL...\n");
do_dgsc(qwAddr);
break;
}
case DG_BINDING_HANDLE_TYPE:
{
dprintf("dumping DG_BINDING_HANDLE...\n");
do_dgbh(qwAddr);
break;
}
case DG_CCONNECTION_TYPE:
{
dprintf("Dumping DG_CCONNECTION...\n");
do_dgcn(qwAddr);
break;
}
case DG_SCONNECTION_TYPE:
{
dprintf("Dumping DG_SCONNECTION...\n");
do_dgsn(qwAddr);
break;
}
case DG_ADDRESS_TYPE:
{
dprintf("dumping DG_ADDRESS\n");
do_dgaddr(qwAddr);
break;
}
case DG_CASSOCIATION_TYPE:
{
dprintf("a DG_CASSOCIATION\n");
do_dgca(qwAddr);
break;
}
case DG_SASSOCIATION_TYPE:
{
dprintf("a datagram ASSOCIATION_GROUP\n");
do_dgag(qwAddr);
break;
}
case OSF_BINDING_HANDLE_TYPE:
dprintf("Dumping OSF_BINDING_HANDLE...\n");
do_osfbh(qwAddr);
break;
case OSF_CCALL_TYPE:
dprintf("Dumping OSF_CCALL...\n");
do_osfccall(qwAddr);
break;
case OSF_SCALL_TYPE:
dprintf("Dumping OSF_SCALL...\n");
do_osfscall(qwAddr);
break;
case OSF_CCONNECTION_TYPE:
dprintf("Dumping OSF_CCONNECTION...\n");
do_osfcconn(qwAddr);
break;
case OSF_SCONNECTION_TYPE:
dprintf("Dumping OSF_SCONNECTION...\n");
do_osfsconn(qwAddr);
break;
case OSF_CASSOCIATION_TYPE:
dprintf("Dumping OSF_CASSOCIATION...\n");
do_osfca(qwAddr);
break;
case OSF_ASSOCIATION_TYPE:
dprintf("Dumping OSF_ASSOCIATION...\n");
do_osfsa(qwAddr);
break;
case OSF_ADDRESS_TYPE:
dprintf("Dumping OSF_ADDRESS...\n");
do_osfaddr(qwAddr);
break;
case LRPC_CCALL_TYPE:
dprintf("Dumping LRPC_CCALL ...\n");
do_lpcccall(qwAddr);
break;
case LRPC_SCALL_TYPE:
dprintf("Dumping LRPC_SCALL ...\n");
do_lpcscall(qwAddr);
break;
case LRPC_CASSOCIATION_TYPE:
dprintf("Dumping LRPC_CASSOCIATION...\n");
do_lpcca(qwAddr);
break;
case LRPC_SASSOCIATION_TYPE:
dprintf("Dumping LRPC_SASSOCIATION...\n");
do_lpcsa(qwAddr);
break;
case LRPC_BINDING_HANDLE_TYPE:
dprintf("Dumping LRPC_BINDING_HANDLE...\n");
do_lpcbh(qwAddr);
break;
case LRPC_ADDRESS_TYPE:
dprintf("Dumping LRPC_ADDRESS...\n");
do_lpcaddr(qwAddr);
break;
default:
dprintf("The RPC object type is 0x%lx and I don't recognize it.\n", (ObjectType) & ~(OBJECT_DELETED));
}
}
void
do_secinfo (
)
{
ULONG64 SecurityPackages;
ULONG64 List;
ULONG64 ProviderList;
int NumberOfPackages;
int LoadedProviders;
int AvailableProviders;
int i, Index;
BOOL b;
ULONG64 qwAddr;
ULONG tmp;
LoadedProviders = (int) GetVar("RPCRT4!LoadedProviders");
dprintf("LoadedProviders = %d\n", LoadedProviders);
AvailableProviders = (int) GetVar("RPCRT4!AvailableProviders");
dprintf("AvailableProviders = %d\n", AvailableProviders);
ProviderList = GetVar("RPCRT4!ProviderList");
dprintf("ProviderList = 0x%I64x\n", ProviderList);
List = ProviderList;
for (i = 0; i < LoadedProviders; i ++)
{
ULONG64 Count;
ULONG64 SecurityPackages;
GET_MEMBER(List, SECURITY_PROVIDER_INFO, RPCRT4!SECURITY_PROVIDER_INFO, Count, Count);
NumberOfPackages = (int)Count;
GET_MEMBER(List, SECURITY_PROVIDER_INFO, RPCRT4!SECURITY_PROVIDER_INFO, SecurityPackages, SecurityPackages);
dprintf("Provider: %d\n", i);
for (Index = 0;Index < NumberOfPackages;Index++)
{
ULONG64 SecurityPackageInfo = SecurityPackages + Index * AddressSize;
ULONG64 wRPCID;
ULONG64 PackageInfoAddr;
GET_ADDRESS_OF(SecurityPackageInfo, SECURITY_PACKAGE_INFO, RPCRT4!SECURITY_PACKAGE_INFO, PackageInfo, PackageInfoAddr, tmp);
GET_MEMBER(PackageInfoAddr, _SecPkgInfoA, RPCRT4!_SecPkgInfoA, wRPCID, wRPCID);
dprintf("PackageId :%d\n", (ULONG) wRPCID);
}
dprintf("\n");
List+=GET_TYPE_SIZE(SECURITY_PROVIDER_INFO, RPCRT4!SECURITY_PROVIDER_INFO);
} //For over all packages in one provider(dll)
}
DECLARE_API( secinfo )
{
do_secinfo();
}
VOID
do_authinfo(
ULONG64 authInfo
)
{
RPC_CHAR *ServerPrincipalName;
ULONG64 tmp1;
ULONG tmp2;
if (authInfo == 0)
{
return;
}
ULONG64 ServerPrincipalNameAddr;
GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, ServerPrincipalName, ServerPrincipalNameAddr);
ServerPrincipalName = ReadProcessRpcChar(ServerPrincipalNameAddr);
dprintf(" ServerPrincipalName - %ws (Address: 0x%I64x)\n", ServerPrincipalName, ServerPrincipalNameAddr);
ULONG64 AuthenticationLevel;
GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, AuthenticationLevel, AuthenticationLevel);
switch ((ULONG)AuthenticationLevel) {
case RPC_C_AUTHN_LEVEL_DEFAULT:
dprintf(" AuthenticationLevel - default\n");
break;
case RPC_C_AUTHN_LEVEL_NONE:
dprintf(" AuthenticationLevel - none\n");
break;
case RPC_C_AUTHN_LEVEL_CONNECT:
dprintf(" AuthenticationLevel - connect\n");
break;
case RPC_C_AUTHN_LEVEL_CALL:
dprintf(" AuthenticationLevel - call\n");
break;
case RPC_C_AUTHN_LEVEL_PKT:
dprintf(" AuthenticationLevel - pkt\n");
break;
case RPC_C_AUTHN_LEVEL_PKT_INTEGRITY:
dprintf(" AuthenticationLevel - pkt integrity\n");
break;
case RPC_C_AUTHN_LEVEL_PKT_PRIVACY:
dprintf(" AuthenticationLevel - pkt privacy\n");
break;
default:
dprintf(" AuthenticationLevel - %ul\n", (ULONG)AuthenticationLevel);
break;
}
ULONG64 AuthenticationService;
GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, AuthenticationService, AuthenticationService);
switch ((ULONG)AuthenticationService) {
case RPC_C_AUTHN_NONE:
dprintf(" AuthenticationService - none\n");
break;
case RPC_C_AUTHN_DCE_PRIVATE:
dprintf(" AuthenticationService - DCE private\n");
break;
case RPC_C_AUTHN_DCE_PUBLIC:
dprintf(" AuthenticationService - DCE public\n");
break;
case RPC_C_AUTHN_DEC_PUBLIC:
dprintf(" AuthenticationService - DEC public\n");
break;
case RPC_C_AUTHN_WINNT:
dprintf(" AuthenticationService - WINNT\n");
break;
case RPC_C_AUTHN_DEFAULT:
dprintf(" AuthenticationService - default\n");
break;
default:
dprintf(" AuthenticationService - %ul\n", (ULONG)AuthenticationService);
break;
}
ULONG64 AuthIdentity;
GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, AuthIdentity, AuthIdentity);
dprintf(" AuthIdentity - %08x\n", (ULONG)AuthIdentity);
ULONG64 AuthorizationService;
GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, AuthorizationService, AuthorizationService);
switch ((ULONG)AuthorizationService) {
case RPC_C_AUTHZ_NONE:
dprintf(" AuthorizationService - none\n");
break;
case RPC_C_AUTHZ_NAME:
dprintf(" AuthorizationService - name\n");
break;
case RPC_C_AUTHZ_DCE:
dprintf(" AuthorizationService - DCE\n");
break;
default:
dprintf(" AuthorizationService - %ul\n", (ULONG)AuthorizationService);
break;
}
ULONG64 IdentityTracking;
GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, IdentityTracking, IdentityTracking);
switch ((ULONG)IdentityTracking)
{
case RPC_C_QOS_IDENTITY_STATIC:
dprintf(" IdentityTracking - Static\n");
break;
case RPC_C_QOS_IDENTITY_DYNAMIC:
dprintf(" IdentityTracking - Dynamic\n");
break;
default:
dprintf(" IdentityTracking - %08x\n", (ULONG)IdentityTracking);
break;
}
ULONG64 ImpersonationType;
GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, ImpersonationType, ImpersonationType);
switch ((ULONG)ImpersonationType)
{
case RPC_C_IMP_LEVEL_ANONYMOUS:
dprintf(" ImpersonationType - Anonymous\n");
break;
case RPC_C_IMP_LEVEL_IDENTIFY:
dprintf(" ImpersonationType - Identify\n");
break;
case RPC_C_IMP_LEVEL_IMPERSONATE:
dprintf(" ImpersonationType - Impersonate\n");
break;
case RPC_C_IMP_LEVEL_DELEGATE:
dprintf(" ImpersonationType - Delegate\n");
break;
default:
dprintf(" ImpersonationType - %08x\n", (ULONG)ImpersonationType);
break;
}
ULONG64 Capabilities;
GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, Capabilities, Capabilities);
switch ((ULONG)Capabilities)
{
case RPC_C_QOS_CAPABILITIES_DEFAULT:
dprintf(" Capabilities - Default\n");
break;
case RPC_C_QOS_CAPABILITIES_MUTUAL_AUTH:
dprintf(" Capabilities - Mutual Auth\n");
break;
default:
dprintf(" Capabilities - %08x\n", (ULONG)Capabilities);
break;
}
ULONG64 ModifiedId, LowPart, HighPart;
GET_ADDRESS_OF(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, ModifiedId, ModifiedId, tmp2);
GET_MEMBER(ModifiedId, _LUID, RPCRT4!_LUID, LowPart, LowPart);
GET_MEMBER(ModifiedId, _LUID, RPCRT4!_LUID, HighPart, HighPart);
dprintf(" ModifiedId - %08x, %08x\n", (ULONG)LowPart, (ULONG)HighPart);
PRINT_MEMBER_WITH_LABEL(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, DefaultLogonId, " DefaultLogonId ", tmp1);
PRINT_MEMBER_WITH_LABEL(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, Credentials, " Credentials ", tmp1);
if (ServerPrincipalName) {
delete[] ServerPrincipalName;
}
}
void do_dict (
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
ULONG64 cDictSize;
ULONG64 cDictSlots;
GET_MEMBER(qwAddr, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, cDictSize, cDictSize);
GET_MEMBER(qwAddr, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, cDictSlots, cDictSlots);
if ((ULONG)cDictSize > (ULONG)cDictSlots)
{
dprintf("Bad dictionary\t\t- %I64p\n", qwAddr);
return;
}
ULONG64 DictSlots;
GET_MEMBER(qwAddr, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, DictSlots, DictSlots);
dprintf("\n");
dprintf("Printing %d items in dictionary: %I64p with %d slots\n\n", (ULONG)cDictSize, qwAddr, (ULONG)cDictSlots);
int i;
for (i = 0; i < MIN((int)cDictSize, MAX_ITEMS_IN_DICTIONARY); i++)
{
ULONG64 DictSlot;
ReadPtr(DictSlots + i * AddressSize, &DictSlot);
dprintf ("(%d): 0x%I64x\n", i, DictSlot);
dprintf("\n");
}
}
void do_dict2 (
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
ULONG64 DictKeys;
ULONG64 DictItems;
GET_MEMBER(qwAddr, SIMPLE_DICT2, RPCRT4!SIMPLE_DICT2, DictKeys, DictKeys);
GET_MEMBER(qwAddr, SIMPLE_DICT2, RPCRT4!SIMPLE_DICT2, DictItems, DictItems);
ULONG64 cDictSlots;
GET_MEMBER(qwAddr, SIMPLE_DICT2, RPCRT4!SIMPLE_DICT2, cDictSlots, cDictSlots);
dprintf("\n");
dprintf("Printing dictionary at %I64p with %d slots\n\n", qwAddr, (ULONG) cDictSlots);
int i;
for (i = 0; i < MIN((int)cDictSlots, MAX_ITEMS_IN_DICTIONARY); i++)
{
ULONG64 DictKey;
ReadPtr(DictKeys + i * AddressSize, &DictKey);
if (DictKey != 0)
{
ULONG64 DictItem;
ReadPtr(DictItems + i * AddressSize, &DictItem);
dprintf ("(Key: 0x%I64p): 0x%I64p\n", DictKey, DictItem);
dprintf("\n");
}
}
}
void
do_queue (
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
int i;
ULONG64 EndOfQueue;
ULONG64 QueueSlots;
GET_MEMBER(qwAddr, QUEUE, RPCRT4!QUEUE, EndOfQueue, EndOfQueue);
GET_MEMBER(qwAddr, QUEUE, RPCRT4!QUEUE, QueueSlots, QueueSlots);
dprintf("\n");
dprintf("Printing %d items in queue at %I64p\n", (ULONG)EndOfQueue, qwAddr);
dprintf("TAIL:\n");
for (i = 0; i < (int)EndOfQueue; i++)
{
ULONG64 QueueSlot;
ReadPtr(QueueSlots + i * AddressSize, &QueueSlot);
ULONG64 Buffer;
GET_MEMBER(QueueSlot, QUEUE_ITEM, RPCRT4!QUEUE_ITEM, Buffer, Buffer);
dprintf ("(%d): %I64p\n", i, Buffer);
dprintf("\n");
}
dprintf("HEAD:\n");
}
void do_thread (
ULONG64 Addr
)
{
ULONG64 RpcThread;
ULONG64 tmp;
ULONG offset;
GET_MEMBER(Addr, TEB, TEB, ReservedForNtRpc, RpcThread);
dprintf("RPC TLS at 0x%I64x\n\n", RpcThread);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, HandleToThread, tmp);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, SavedProcedure, tmp);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, SavedParameter, tmp);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, ActiveCall, tmp);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, Context, tmp);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, CancelTimeout, tmp);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, SecurityContext, tmp);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, ExtendedStatus, tmp);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, ThreadEEInfo, tmp);
GET_OFFSET_OF(THREAD, RPCRT4!THREAD, ThreadEvent, &offset);
dprintf("ThreadEvent at - 0x%I64x\n", RpcThread + offset);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, Flags, tmp);
GET_OFFSET_OF(THREAD, RPCRT4!THREAD, BufferCache, &offset);
dprintf("buffer cache array at - 0x%I64x\n", RpcThread + offset);
PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, fAsync, tmp);
dprintf("\n");
}
char *osf_ptype[] =
{
"rpc_request",
"bad packet",
"rpc_response",
"rpc_fault",
"bad packet",
"bad packet",
"bad packet",
"bad packet",
"bad packet",
"bad packet",
"bad packet",
"rpc_bind",
"rpc_bind_ack",
"rpc_bind_nak",
"rpc_alter_context",
"rpc_alter_context_resp",
"rpc_auth_3",
"rpc_shutdown",
"rpc_cancel",
"rpc_orphaned"
};
void do_copacket (
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
ULONG64 StubData;
//
// Dump the common header first
//
dprintf("\n");
PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, rpc_vers, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, rpc_vers_minor, tmp1);
ULONG64 PTYPE;
GET_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, PTYPE, PTYPE);
dprintf ("PTYPE - 0x%x, %s\n",
(ULONG)PTYPE, osf_ptype[(ULONG)PTYPE]);
PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, pfc_flags, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, drep, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, frag_length, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, auth_length, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, call_id, tmp1);
//
// Dump the packet specific stuff
//
switch ((ULONG)PTYPE)
{
case rpc_request:
PRINT_MEMBER(qwAddr, rpcconn_request, RPCRT4!rpcconn_request, alloc_hint, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_request, RPCRT4!rpcconn_request, p_cont_id, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_request, RPCRT4!rpcconn_request, opnum, tmp1);
ULONG64 pfc_flags;
GET_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, pfc_flags, pfc_flags);
if ((ULONG)pfc_flags & PFC_OBJECT_UUID)
{
dprintf("UUID -\n");
ULONG64 UUID = qwAddr;
UUID += GET_TYPE_SIZE(rpcconn_common, RPCRT4!rpcconn_common);
PrintUuid(UUID);
dprintf("\n");
StubData = qwAddr;
StubData += GET_TYPE_SIZE(rpcconn_request, RPCRT4!rpcconn_request);
StubData += GET_TYPE_SIZE(UUID, RPCRT4!UUID);
dprintf ("Stub Data - 0x%I64x\n", StubData);
}
else
{
StubData = qwAddr;
StubData += GET_TYPE_SIZE(rpcconn_request, RPCRT4!rpcconn_request);
dprintf ("Stub Data - 0x%I64x\n", StubData);
}
break;
case rpc_response:
PRINT_MEMBER(qwAddr, rpcconn_response, RPCRT4!rpcconn_response, alloc_hint, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_response, RPCRT4!rpcconn_response, p_cont_id, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_response, RPCRT4!rpcconn_response, alert_count, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_response, RPCRT4!rpcconn_response, reserved, tmp1);
StubData = qwAddr;
StubData += GET_TYPE_SIZE(rpcconn_response, RPCRT4!rpcconn_response);
dprintf ("Stub Data - 0x%I64x\n", StubData);
break;
case rpc_fault:
PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, alloc_hint, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, p_cont_id, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, alert_count, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, reserved, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, status, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, reserved2, tmp1);
break;
case rpc_bind:
case rpc_alter_context:
PRINT_MEMBER(qwAddr, rpcconn_bind, RPCRT4!rpcconn_bind, max_xmit_frag, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_bind, RPCRT4!rpcconn_bind, max_recv_frag, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_bind, RPCRT4!rpcconn_bind, assoc_group_id, tmp1);
break;
case rpc_bind_ack:
PRINT_MEMBER(qwAddr, rpcconn_bind_ack, RPCRT4!rpcconn_bind_ack, max_xmit_frag, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_bind_ack, RPCRT4!rpcconn_bind_ack, max_recv_frag, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_bind_ack, RPCRT4!rpcconn_bind_ack, assoc_group_id, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_bind_ack, RPCRT4!rpcconn_bind_ack, sec_addr_length, tmp1);
break;
case rpc_bind_nak:
PRINT_MEMBER(qwAddr, rpcconn_bind_nak, RPCRT4!rpcconn_bind_nak, provider_reject_reason, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_bind_nak, RPCRT4!rpcconn_bind_nak, versions, tmp1);
break;
case rpc_alter_context_resp:
PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, max_xmit_frag, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, max_recv_frag, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, assoc_group_id, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, sec_addr_length, tmp1);
PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, pad, tmp1);
break;
case rpc_auth_3:
case rpc_shutdown:
case rpc_cancel:
case rpc_orphaned:
break;
default:
dprintf ("Bad Packet\n");
break;
}
//
// Dump the security trailer
//
ULONG64 auth_length;
ULONG64 frag_length;
GET_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, auth_length, auth_length);
GET_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, frag_length, frag_length);
if ((ULONG)auth_length)
{
ULONG64 SecurityTrailer = qwAddr;
SecurityTrailer += frag_length-auth_length-GET_TYPE_SIZE(sec_trailer, RPCRT4!sec_trailer);
dprintf("\nSecurity trailer: 0x%I64x\n", SecurityTrailer);
PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_type, tmp1);
PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_level, tmp1);
PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_pad_length, tmp1);
PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_reserved, tmp1);
PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_context_id, tmp1);
dprintf ("trailer - 0x%I64x\n", SecurityTrailer+1);
}
}
char *lpc_ptype[] =
{
"LRPC_MSG_BIND",
"LRPC_MSG_REQUEST",
"LRPC_MSG_RESPONSE",
"LRPC_MSG_CALLBACK",
"LRPC_MSG_FAULT",
"LRPC_MSG_CLOSE",
"LRPC_MSG_ACK",
"LRPC_BIND_ACK",
"LRPC_MSG_COPY",
"LRPC_MSG_PUSH",
"LRPC_MSG_CANCEL",
"LRPC_MSG_BIND_BACK",
"LRPC_ASYNC_REQUEST",
"LRPC_PARTIAL_REQUEST",
"LRPC_CLIENT_SEND_MORE",
"LRPC_SERVER_SEND_MORE",
"LRPC_MSG_FAULT2"
};
VOID
do_lpcpacket(
ULONG64 qwAddr
)
{
if (fUseTypeInfo) {
ULONG64 LpcHeader;
ULONG64 RpcHeader;
ULONG64 Buffer;
ULONG64 tmp1;
ULONG tmp2;
GET_ADDRESS_OF(qwAddr, LRPC_RPC_MESSAGE, RPCRT4!LRPC_RPC_MESSAGE, LpcHeader, LpcHeader, tmp2);
GET_ADDRESS_OF(qwAddr, LRPC_RPC_MESSAGE, RPCRT4!LRPC_RPC_MESSAGE, RpcHeader, RpcHeader, tmp2);
dprintf("\n");
//
// dump the LPC header
//
PRINT_ADDRESS_OF_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, u1, "&u1\t\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, u2, "&u2\t\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, ClientId, "&CLIENT_ID\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, MessageId, "MessageId\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, CallbackId, "CallbackId\t\t", tmp1);
//
// dump the LRPC header
//
ULONG64 MessageType;
GET_MEMBER(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, MessageType, MessageType);
dprintf("MessageType\t\t - %s\n", lpc_ptype[(long)MessageType]);
PRINT_MEMBER_WITH_LABEL(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, PresentContext, "PresentationContext\t", tmp1);
PRINT_MEMBER_WITH_LABEL(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, Flags, "Flags\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, ProcedureNumber, "ProcedureNumber\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, CallId, "CallId\t\t\t", tmp1);
ULONG64 ObjectUuid;
GET_ADDRESS_OF(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, ObjectUuid, ObjectUuid, tmp2);
dprintf("ObjectUuid\t\t - ");
PrintUuid(ObjectUuid);
dprintf("\n\n");
}
else {
BOOL b;
char block[sizeof(LRPC_RPC_MESSAGE)];
LRPC_RPC_MESSAGE *m = (LRPC_RPC_MESSAGE *)&block;
b = GetData(qwAddr, &block, sizeof(LRPC_RPC_MESSAGE));
if ( !b ) {
dprintf("couldn't read address %p\n", qwAddr);
return;
}
dprintf("\n");
//
// dump the LPC header
//
dprintf("DataLength\t\t- 0x%x\n", (long) m->LpcHeader.u1.s1.DataLength);
dprintf("TotalLength\t\t- 0x%x\n", (long) m->LpcHeader.u1.s1.TotalLength);
dprintf("Type\t\t\t- 0x%x\n", (long) m->LpcHeader.u2.s2.Type);
dprintf("DataInfoOffset\t\t- 0x%x\n", (long) m->LpcHeader.u2.s2.DataInfoOffset);
dprintf("CLIENT_ID: \t\t- Process(0x%x), Thread(0x%x)\n",
m->LpcHeader.ClientId.UniqueProcess, m->LpcHeader.ClientId.UniqueThread);
dprintf("MessageId\t\t- 0x%x\n", m->LpcHeader.MessageId);
dprintf("CallbackId\t\t- 0x%x\n", m->LpcHeader.CallbackId);
//
// dump the LRPC header
//
dprintf("MessageType\t\t- %s\n", lpc_ptype[(long) m->RpcHeader.MessageType]);
dprintf("PresentationContext\t- 0x%x\n", (long) m->RpcHeader.PresentContext);
dprintf("Flags\t\t\t- 0x%x\n", (unsigned long) m->RpcHeader.Flags);
dprintf("ProcedureNumber\t\t- 0x%x\n", (long) m->RpcHeader.ProcedureNumber);
dprintf("CallId\t\t\t- 0x%x\n", (long) m->RpcHeader.CallId);
dprintf("ObjectUuid\t\t- ");
PrintUuidLocal((UUID *) &(m->RpcHeader.ObjectUuid));
dprintf("\nStubData\t\t- 0x%x\n", m+1);
dprintf("\n");
}
}
VOID
do_bh(
ULONG64 qwAddr
)
{
RPC_CHAR *EntryName;
ULONG64 tmp1;
ULONG tmp2;
ULONG64 EntryNameAddr;
ULONG64 ObjectUuidAddr;
GET_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, EntryName, EntryNameAddr);
GET_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, ObjectUuid, ObjectUuidAddr);
EntryName = ReadProcessRpcChar(EntryNameAddr);
dprintf("\n");
PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, Timeout, tmp1);
dprintf("ObjectUuid\t\t- ");
PrintUuid(ObjectUuidAddr); dprintf("\n");
PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, NullObjectUuidFlag, tmp1);
PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, EntryNameSyntax, tmp1);
dprintf("EntryName\t\t- %ws (Address: 0x%x)\n", EntryName ? EntryName : L"(null)", EntryNameAddr);
PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, EpLookupHandle, tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, BindingMutex, "&BindingMutex(MUTEX)", tmp2);
PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, pvTransportOptions, tmp1);
PRINT_ADDRESS_OF(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, ClientAuthInfo, tmp2);
do_authinfo(qwAddr+tmp2);
}
VOID
do_osfbh(
ULONG64 qwAddr
)
{
BOOL b;
ULONG64 tmp1;
ULONG tmp2;
do_bh(qwAddr);
PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, Association, tmp1);
PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, DceBinding, tmp1);
do_dcebinding(tmp1);
PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, TransInfo, tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, RecursiveCalls, "&RecursiveCalls(OSF_ACTIVE_ENTRY_DICT)", tmp2);
PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, ReferenceCount, tmp1);
PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, pToken, tmp1);
dprintf("\n");
}
VOID
do_osfca(
ULONG64 qwAddr
)
{
BOOL b;
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, DceBinding, "DceBinding(DCE_BINDING)", tmp1);
do_dcebinding(tmp1);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, BindHandleCount, tmp1);
PRINT_ADDRESS_OF(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, Bindings, tmp2);
PRINT_ADDRESS_OF(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, ActiveConnections, tmp2);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, AssocGroupId, tmp1);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, TransInfo, tmp1);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, SecondaryEndpoint, tmp1);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, Key, tmp1);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, OpenConnectionCount, tmp1);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, CallIdCounter, tmp1);
PRINT_ADDRESS_OF(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, AssociationMutex, tmp2);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, AssociationValid, tmp1);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, FailureCount, tmp1);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, fMultiplex, tmp1);
PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, SavedDrep, tmp1);
dprintf("\n");
}
VOID
do_dcebinding(
ULONG64 qwAddr
)
{
RPC_STATUS RpcStatus;
BOOL b;
ULONG tmp2;
ULONG64 RpcProtocolSequenceAddr;
ULONG64 NetworkAddressAddr;
ULONG64 EndpointAddr;
ULONG64 OptionsAddr;
ULONG64 ObjectUuidAddr;
RPC_CHAR *RpcProtocolSequence;
RPC_CHAR *NetworkAddress;
RPC_CHAR *Endpoint;
RPC_CHAR *Options;
GET_MEMBER(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, RpcProtocolSequence, RpcProtocolSequenceAddr);
GET_MEMBER(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, NetworkAddress, NetworkAddressAddr);
GET_MEMBER(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, Endpoint, EndpointAddr);
GET_MEMBER(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, Options, OptionsAddr);
GET_ADDRESS_OF(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, ObjectUuid, ObjectUuidAddr, tmp2);
RpcProtocolSequence = ReadProcessRpcChar( RpcProtocolSequenceAddr);
NetworkAddress = ReadProcessRpcChar( NetworkAddressAddr);
Endpoint = ReadProcessRpcChar( EndpointAddr);
Options = ReadProcessRpcChar( OptionsAddr);
dprintf("\tObjectUuid:\t");
PrintUuid(ObjectUuidAddr); dprintf("\n");
dprintf("\tprotseq: \t\"%ws\"\t(Address: %p)\n", RpcProtocolSequence, RpcProtocolSequenceAddr);
dprintf("\tNetworkAddress:\t\"%ws\"\t(Address: %p)\n", NetworkAddress, NetworkAddressAddr);
dprintf("\tEndpoint:\t\"%ws\" \t(Address: %p)\n", Endpoint, EndpointAddr);
dprintf("\tOptions:\t\"%ws\" \t(Address: %p)\n", Options, OptionsAddr);
dprintf("\n");
}
VOID
do_osfcconn(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, Association, "pAssociation(OSF_CASSOCIATION)\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, CurrentCall, "CurrentCall (OSF_CCALL)\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ConnectionKey, "ConnectionKey\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, State, "State\t\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, MaxFrag, "MaxFrag\t\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ThreadId, "ThreadId\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, CachedCCall, "CachedCCall\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, CachedCCallAvailable, "CachedCCallAvailable\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, MaxSavedHeaderSize, "MaxSavedHeaderSize\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, SavedHeaderSize, "SavedHeaderSize\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, SavedHeader, "SavedHeader\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, AdditionalLegNeeded, "AdditionalLegNeeded\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, LastTimeUsed, "LastTimeUsed\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, TokenLength, "TokenLength\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, AdditionalSpaceForSecurity, "AdditionalSpaceForSecurity\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, fIdle, "fIdle\t\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, fExclusive, "fExclusive\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, fConnectionAborted, "fConnectionAborted\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, RefCount, "RefCount\t\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, Bindings, "&Bindings(BITSET)\t\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, CallQueue, "&CallQueue\t\t\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ConnMutex, "&ConnMutex\t\t\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ActiveCalls, "&ActiveCalls\t\t\t\t", tmp2);
ULONG64 ClientSecurityContext;
GET_ADDRESS_OF(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ClientSecurityContext, ClientSecurityContext, tmp2);
dprintf("&ClientSecurityContext(CSECURITY_CONTEXT)- 0x%I64x\n", ClientSecurityContext);
do_securitycontext(ClientSecurityContext);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ClientInfo, "ClientInfo (RPC_CONNECTION_TRANSPORT)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ComTimeout, "ComTimeout\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, u, "ConnSendContext\t\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, DceSecurityInfo, "&DceSecurityInfo(DCE_SECURITY_INFO)\t", tmp2);
ULONG64 DceSecurityInfo;
GET_ADDRESS_OF(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, DceSecurityInfo, DceSecurityInfo, tmp2);
PRINT_MEMBER_WITH_LABEL(DceSecurityInfo, _DCE_SECURITY_INFO, RPCRT4!_DCE_SECURITY_INFO, SendSequenceNumber, " SendSequenceNumber\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(DceSecurityInfo, _DCE_SECURITY_INFO, RPCRT4!_DCE_SECURITY_INFO, ReceiveSequenceNumber, " ReceiveSequenceNumber\t", tmp1);
ULONG64 AssociationUuid;
GET_ADDRESS_OF(DceSecurityInfo, _DCE_SECURITY_INFO, RPCRT4!_DCE_SECURITY_INFO, AssociationUuid, AssociationUuid, tmp2);
dprintf(" AssociationUuid\t\t - ");
PrintUuid(AssociationUuid);
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, BufferToFree, "BufferToFree\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ConnectionReady, "ConnectionReady\t\t\t", tmp1);
dprintf("\n");
ULONG64 TransConnection = qwAddr;
TransConnection += GET_TYPE_SIZE(OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION);
dprintf("TransConnection\t\t\t - 0x%I64x\n", TransConnection);
do_trans(TransConnection);
}
struct CallStateMap {
OSF_CCALL_STATE State;
char *StateString;
};
struct CallStateMap CCall_States[] =
{
NeedOpenAndBind, "NeedOpenAndBind",
NeedAlterContext, "NeedAlterContext",
WaitingForAlterContext, "WaitingForAlterContext",
SendingFirstBuffer, "SendingFirstBuffer",
SendingMoreData, "SendingMoreData",
WaitingForReply, "WaitingForReply",
InCallbackRequest, "InCallbackRequest",
InCallbackReply, "InCallbackReply",
Receiving, "Receiving",
Aborted, "Aborted",
Complete, "Complete",
};
char *
GetCallState (
OSF_CCALL_STATE State
)
{
int i;
for (i = 0; i < sizeof(CCall_States)/sizeof(CallStateMap); i++)
{
if (State == CCall_States[i].State)
{
return CCall_States[i].StateString;
}
}
return "Unknown State";
}
VOID
do_osfccall(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, AsyncStatus, "AsyncStatus\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CachedAPCInfo, "pCachedAPCInfo\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CachedAPCInfoAvailable, "CachedAPCInfoAvailable\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, pAsync, "pAsync\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallingThread, "CallingThread\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, NotificationIssued, "NotificationIssued\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, Connection, "Connection\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, BindingHandle, "BindingHandle\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, Bindings, "Binding\t\t\t", tmp1);
ULONG64 CurrentState;
GET_MEMBER(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CurrentState, CurrentState);
dprintf("CurrentState\t\t - 0x%x, %s\n",
(ULONG)CurrentState, GetCallState((OSF_CCALL_STATE)CurrentState));
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CurrentBuffer, "CurrentBuffer\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CurrentOffset, "CurrentOffset\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CurrentBufferLength, "CurrentBufferLength\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallId, "CallId\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, RcvBufferLength, "RcvBufferLength\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, FirstSend, "FirstSend\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, DispatchTableCallback, "DispatchTableCallback\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, MaximumFragmentLength, "MaximumFragmentLength\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, MaxSecuritySize, "MaxSecuritySize\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, MaxDataLength, "MaxDataLength\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, ReservedForSecurity, "ReservedForSecurity\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, SecBufferLength, "SecBufferLength\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, HeaderSize, "HeaderSize\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, SavedHeaderSize, "SavedHeaderSize\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, SavedHeader, "SavedHeader\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, LastBuffer, "LastBuffer\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, ProcNum, "ProcNum\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, SyncEvent, "SyncEvent\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, ActualBufferLength, "ActualBufferLength\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, NeededLength, "NeededLength\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallSendContext, "CallSendContext\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, RefCount, "RefCount\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, RecursiveCallsKey, "RecursiveCallsKeyF\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallStack, "CallStack\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, fCallCancelled, "fCallCancelled\t\t", tmp1);
ULONG64 CancelState;
GET_MEMBER(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CancelState, CancelState);
switch ((ULONG)CancelState)
{
case CANCEL_NOTREGISTERED:
dprintf("fEnableCancels\t\t - CANCEL_NOTREGISTERED\n");
break;
case CANCEL_INFINITE:
dprintf("fEnableCancels\t\t - CANCEL_INFINITE\n");
break;
case CANCEL_NOTINFINITE:
dprintf("fEnableCancels\t\t - CANCEL_NOTINFINITE\n");
break;
}
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallMutex, "&CallMutex\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, BufferQueue, "&BufferQueue\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, InReply, "InReply\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, fChoked, "fChoked\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, fPeerChoked, "fPeerChoked\t\t", tmp1);
dprintf("\n");
}
VOID
do_rpcaddr(
ULONG64 qwAddr
)
{
RPC_CHAR *Endpoint;
RPC_CHAR *RpcProtocolSequence;
ULONG64 EndpointAddr;
ULONG64 RpcProtocolSequenceAddr;
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
GET_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, Endpoint, EndpointAddr);
GET_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, RpcProtocolSequence, RpcProtocolSequenceAddr);
Endpoint = ReadProcessRpcChar(EndpointAddr);
RpcProtocolSequence = ReadProcessRpcChar(RpcProtocolSequenceAddr);
if ((Endpoint == NULL) || (RpcProtocolSequence == NULL))
return;
dprintf("Endpoint - \"%ws\"\n", Endpoint);
dprintf("RpcProtocolSequence - \"%ws\"\n", RpcProtocolSequence);
PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, StaticEndpointFlag, tmp1);
PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, pNetworkAddressVector, tmp1);
PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, ActiveCallCount, tmp1);
PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, EndpointFlags, tmp1);
PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, NICFlags, tmp1);
PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, Server, tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, AddressMutex, "AddressMutex at", tmp2);
PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, DictKey, tmp1);
delete Endpoint;
delete RpcProtocolSequence;
}
VOID
do_osfaddr(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
ULONG64 TransAddr = qwAddr;
do_rpcaddr(qwAddr);
dprintf("\n");
PRINT_ADDRESS_OF(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, Associations, tmp2);
PRINT_MEMBER(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, SetupAddressOccurred, tmp1);
PRINT_MEMBER(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, TransInfo, tmp1);
PRINT_MEMBER(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, ServerInfo, tmp1);
PRINT_MEMBER(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, ServerListeningFlag, tmp1);
TransAddr += GET_TYPE_SIZE(OSF_ADDRESS, RPCRT4!OSF_ADDRESS);
dprintf("\n");
dprintf("TransAddr 0x%I64x\n", TransAddr);
do_trans(TransAddr);
}
VOID
do_osfsconn(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
ULONG64 AuthInfo;
GET_ADDRESS_OF(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, AuthInfo, AuthInfo, tmp2);
dprintf("&AuthInfo(CLIENT_AUTH_INFO)\t - 0x%p\n", AuthInfo);
do_authinfo(AuthInfo );
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, Association, "Association(OSF_ASSOCIATION)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, Address, "Address(OSF_ADDRESS)\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, MaxFrag, "MaxFrag\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, DataRep, "DataRep\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, AuthContextId, "AuthContextId\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, SecurityContextAltered, "SecurityContextAltered\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, RpcSecurityBeingUsed, "RpcSecurityBeingUsed\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CurrentSecurityContext, "pCurrentSecurityContext(SSECURITY_CONTEXT)", tmp1);
do_authinfo(tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, SecurityContextDict, "&SecurityContextDict(SSECURITY_CONTEXT_DICT)", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, AdditionalSpaceForSecurity, "AdditionalSpaceForSecurity\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, SavedHeaderSize, "SavedHeaderSize\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, SavedHeader, "pSavedHeader(VOID)\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CurrentCallId, "CurrentCallId\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CachedSCallAvailable, "CachedSCallAvailable\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, AuthContinueNeeded, "AuthContinueNeeded\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, InitSecurityInfo, "&InitSecurityInfo\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CallDict, "&CallDict\t\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, Bindings, "&Bindings(OSF_SBINDING_DICT)\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, ConnMutex, "&ConnMutex\t\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CachedSCall, "CachedSCall\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, ServerInfo, "ServerInfo\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, ConnectionClosedFlag, "ConnectionClosedFlag\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, DceSecurityInfo, "&DceSecurityInfo\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, fExclusive, "fExclusive\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, fDontFlush, "fDontFlush\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, fFirstCall, "fFirstCall\t\t\t", tmp1);
dprintf("\n");
ULONG64 TransConnection = qwAddr;
TransConnection += GET_TYPE_SIZE(OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION);
dprintf("TransConnection\t\t\t - 0x%I64x\n", TransConnection);
do_trans(TransConnection);
}
char *SCall_States[] =
{
"NewRequest",
"CallCancelled",
"CallAborted",
"CallCompleted",
"ReceivedCallback",
"ReceivedCallbackReply",
"ReceivedFault"
};
VOID
do_osfscall(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, AsyncStatus, "AsyncStatus\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CachedAPCInfo, "pCachedAPCInfo\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CachedAPCInfoAvailable, "CachedAPCInfoAvailable\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, pAsync, "pAsync\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallingThread, "CallingThread\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, NotificationIssued, "NotificationIssued\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentBinding, "CurrentBinding\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, Connection, "Connection\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, Address, "Address\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallId, "CallId\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallStack, "CallStack\t\t", tmp1);
ULONG64 ObjectUuid;
GET_ADDRESS_OF(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, ObjectUuid, ObjectUuid, tmp2);
dprintf("ObjectUuid\t\t - ");
PrintUuid(ObjectUuid); dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, ObjectUuidSpecified, "ObjectUuidSpecified\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentBuffer, "CurrentBuffer\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentBufferLength, "CurrentBufferLength\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentOffset, "CurrentOffset\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, FirstFrag, "FirstFrag\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, FirstSend, "FirstSend\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fPipeCall, "fPipeCall\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fCallDispatched, "fCallDispatched\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, DispatchBuffer, "DispatchBuffer\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, LastBuffer, "LastBuffer\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, SendContext, "SendContext\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, DispatchBufferOffset, "DispatchBufferOffset\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, ProcNum, "ProcNum\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, AllocHint, "AllocHint\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, SavedHeaderSize, "SavedHeaderSize\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, SavedHeader, "SavedHeader\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, RcvBufferLength, "RcvBufferLength\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, NeededLength, "NeededLength\t\t", tmp1);
ULONG64 CurrentState;
GET_MEMBER(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentState, CurrentState);
dprintf("CurrentState\t\t - 0x%x, %s\n", (ULONG)CurrentState, SCall_States[(ULONG)CurrentState]);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallMutex, "&CallMutex\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, SyncEvent, "&SyncEvent\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, BufferQueue, "&BufferQueue\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, Thread, "Thread\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallOrphaned, "CallOrphaned\t\t", tmp1);
ULONG64 RefCount;
GET_MEMBER(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, RefCount, RefCount);
dprintf("RefCount\t\t - 0x%x\n", (ULONG)RefCount);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, MaxSecuritySize, "MaxSecuritySize\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, FirstCallRpcMessage, "&FirstCallRpcMessage\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, FirstCallRuntimeInfo, "&FirstCallRuntimeInfo\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, MaximumFragmentLength, "MaximumFragmentLength\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, ActualBufferLength, "ActualBufferLength\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fChoked, "fChoked\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fPeerChoked, "fPeerChoked\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, DispatchFlags, "DispatchFlags\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fSecurityFailure, "fSecurityFailure\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CancelPending, "CancelPending\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fChoked, "fChoked\t\t\t", tmp1);
dprintf("\n");
}
VOID
do_osfsa(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, CtxCollection, tmp1);
PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, AssociationID, tmp1);
PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, ConnectionCount, tmp1);
PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, AssociationGroupId, tmp1);
PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, AssociationDictKey, tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, Address, "pAddress(OSF_ADDRESS)", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, ClientProcess, "&ClientProcess(RPC_CLIENT_PROCESS_IDENTIFIER)", tmp2);
dprintf("\n");
}
DECLARE_API( rpcsvr )
{
ULONG64 qwAddr;
BOOL fArgSpecified = FALSE;
ULONG64 ServerAddress;
LPSTR lpArgumentString = (LPSTR)args;
if (0 == strtok(lpArgumentString))
{
lpArgumentString = "rpcrt4!GlobalRpcServer";
fArgSpecified = TRUE;
}
qwAddr = GetExpression(lpArgumentString);
if ( !qwAddr )
{
dprintf("Error: can't evaluate '%s'\n", lpArgumentString);
return;
}
if (fArgSpecified)
{
if (ReadPtr(qwAddr, &ServerAddress))
{
dprintf("couldn't read memory at address 0x%I64x\n", qwAddr);
return;
}
}
else
ServerAddress = qwAddr;
do_rpcsvr(ServerAddress);
}
VOID
do_rpcsvr(
ULONG64 qwAddr
)
{
ULONG64 tmp0;
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, pRpcForwardFunction, "pRpcForwardFunction(RPC_FORWARD_FUNCTION)", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, RpcInterfaceDictionary, "&RpcInterfaceDictionary(RPC_SIMPLE_DICT)", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ServerMutex, "&ServerMutex(MUTEX)", tmp2);
GET_ADDRESS_OF(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, AvailableCallCount, tmp1, tmp2);
PRINT_MEMBER_WITH_LABEL(tmp1, INTERLOCKED_INTEGER, RPCRT4!INTERLOCKED_INTEGER, Integer, "AvailableCallCount", tmp0);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ServerListeningFlag, tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, RpcAddressDictionary, "&RpcAddressDictionary(RPC_SIMPLE_DICT)", tmp2);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ListeningThreadFlag, tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, StopListeningEvent, "&StopListeningEvent(EVENT)", tmp2);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, MaximumConcurrentCalls, tmp1);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, MinimumCallThreads, tmp1);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, IncomingRpcCount, tmp1);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, OutgoingRpcCount, tmp1);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ReceivedPacketCount, tmp1);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, SentPacketCount, tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, AuthenticationDictionary, "&AuthenticationDictionary(RPC_SIMPLE_DICT)", tmp2);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, WaitingThreadFlag, tmp1);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ThreadCache, tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ThreadCacheMutex, "&ThreadCacheMutex(MUTEX)", tmp2);
PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, fAccountForMaxCalls, tmp1);
dprintf("\n");
}
struct SizeTable {
int Size;
int Count;
};
struct SizeTable *Stats = NULL;
int MaxSize = 1048*10;
int CurrentSize = 0;
void
AddToStats (
int Size
)
{
int i;
for (i = 0; i < CurrentSize; i++)
{
if (Stats[i].Size == Size)
{
Stats[i].Count++;
return;
}
}
Stats[CurrentSize].Size = Size;
Stats[CurrentSize].Count = 1;
CurrentSize++;
}
int __cdecl compare( const void *arg1, const void *arg2 )
{
return ((struct SizeTable *) arg2)->Count - ((struct SizeTable *) arg1)->Count;
}
void
PrintStats (
)
{
int i;
int Total = 0;
qsort(&Stats[0], CurrentSize, sizeof(SizeTable), compare);
dprintf("\n\nSummary:\n");
for (i = 0; i < CurrentSize; i++)
{
dprintf("Size: %08x Count: %d\n",
Stats[i].Size,
Stats[i].Count
);
Total += Stats[i].Count;
}
dprintf("Total Count: %d\n", Total);
}
VOID
do_rpcmem(
ULONG64 qwAddr,
long Count,
long Verbose,
BOOL Summary,
long Size
)
{
BOOL b;
BOOL forwards = TRUE;
BOOL doAll = FALSE;
DWORD t;
ULONG64 tmp1;
ULONG tmp2;
unsigned Data[16];
unsigned char RearGuardBlock[4];
#if DBG
if (Count < 0) {
forwards = FALSE;
}
else
if (Count == 0) {
doAll = TRUE;
}
if (Stats == NULL)
{
Stats = (struct SizeTable *) RpcpFarAllocate(MaxSize * sizeof(struct SizeTable));
if (Stats == NULL)
{
return;
}
}
RpcpMemorySet(Stats, 0, MaxSize);
dprintf("\n");
do
{
if ((CheckControlC)())
{
return;
}
ULONG64 size;
GET_MEMBER(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, size, size);
AddToStats((int)size);
if ((Size == 0 || Size == (long) size) && !Summary)
{
ULONG64 rearguard;
GET_ADDRESS_OF(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, rearguard, rearguard, tmp2);
dprintf("-------- size (%08x) block: 0x%I64x contains: %s",
(ULONG)size,
qwAddr,
SymbolAtAddressNoOffset(rearguard)
);
if (Verbose)
{
b = GetData(rearguard,
Data,
min((ULONG)size, sizeof(Data)));
if ( !b )
{
dprintf("can't read block data at 0x%I64x\n", rearguard);
return;
}
for (t = 0; t < min(((ULONG)size)/4, sizeof(Data)/4); t++)
{
if (t % 4 == 0)
{
dprintf("\n%I64p ",
rearguard + t*4);
}
dprintf("%I64p ", Data[t]);
}
}
dprintf("\n");
}
ULONG64 frontguardAddr;
ULONG64 rearguardAddr;
GET_ADDRESS_OF(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, frontguard, frontguardAddr, tmp2);
GET_ADDRESS_OF(qwAddr+size, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, rearguard, rearguardAddr, tmp2);
unsigned char frontguardVal[4];
unsigned char rearguardVal[4];
GetData(frontguardAddr, frontguardVal, sizeof(frontguardVal));
GetData(rearguardAddr, rearguardVal, sizeof(rearguardVal));
if ( (frontguardVal[0] != RPC_GUARD) ||
(frontguardVal[1] != RPC_GUARD) ||
(frontguardVal[2] != RPC_GUARD) ||
(frontguardVal[3] != RPC_GUARD) )
{
dprintf(" RPC: BAD FRONTGUARD %x-%x-%x-%x\n", frontguardVal[0], frontguardVal[1], frontguardVal[2], frontguardVal[3]);
}
if ( (rearguardVal[0] != RPC_GUARD) ||
(rearguardVal[1] != RPC_GUARD) ||
(rearguardVal[2] != RPC_GUARD) ||
(rearguardVal[3] != RPC_GUARD) )
{
dprintf(" RPC: BAD REARGUARD %x-%x-%x-%x\n", rearguardVal[0], rearguardVal[1], rearguardVal[2], rearguardVal[3]);
}
ULONG64 next;
ULONG64 previous;
GET_MEMBER(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, next, next);
GET_MEMBER(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, previous, previous);
if (forwards == TRUE)
{
qwAddr = next;
Count--;
}
else
{
qwAddr = previous;
Count++;
}
}
while (qwAddr && (Count || doAll) );
PrintStats();
#endif
dprintf("\n");
}
VOID
do_rpcmsg(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, Handle, "Handle(RPC_BINDING_HANDLE) ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, DataRepresentation, "DataRepresentation ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, Buffer, "pBuffer(void) ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, BufferLength, "BufferLength ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, ProcNum, "ProcNum ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, TransferSyntax, "TransferSyntax(RPC_SYNTAX_IDENTIFIER) ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, RpcInterfaceInformation, "pRpcInterfaceInformation(void) ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, ReservedForRuntime, "pReservedForRuntime(void) ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, ManagerEpv, "pManagerEpv(RPC_MGR_EPV) ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, ImportContext, "pImportContext(void) ", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, RpcFlags, "RpcFlags ", tmp1);
dprintf("\n");
}
VOID
do_transinfo(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
ULONG64 LoadableTrans;
GET_MEMBER(qwAddr, TRANS_INFO, RPCRT4!TRANS_INFO, LoadableTrans, LoadableTrans);
dprintf("\n");
PRINT_MEMBER(qwAddr, TRANS_INFO, RPCRT4!TRANS_INFO, pTransportInterface, tmp1);
PRINT_MEMBER(qwAddr, TRANS_INFO, RPCRT4!TRANS_INFO, LoadableTrans, tmp1);
PRINT_MEMBER(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, ThreadsStarted, tmp1);
PRINT_MEMBER(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, NumThreads, tmp1);
PRINT_MEMBER(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, ProcessCallsFunc, tmp1);
PRINT_MEMBER(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, LoadedDll, tmp1);
PRINT_ADDRESS_OF(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, ProtseqDict, tmp2);
PRINT_ADDRESS_OF(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, DllName, tmp2);
PRINT_MEMBER(qwAddr, TRANS_INFO, RPCRT4!TRANS_INFO, RpcProtocolSequence, tmp1);
dprintf("\n");
}
DECLARE_API( help )
{
LPSTR lpArgumentString = (LPSTR)args;
if (lpArgumentString[0] == '\0') {
dprintf( "\n");
dprintf( "rpcdbg help:\n\n");
dprintf( "\n");
dprintf( "!obj <address> - Dumps an RPC object \n");
dprintf( "\n");
dprintf( "!sizes - Prints sizes of the data structures\n");
dprintf( "!error - Translates and error value into the error message\n");
dprintf( "!symbol (<address>|<symbol name>) - Returns symbol name/address\n");
dprintf( "!rpcheap [-a <address>][-d <num display>] - Dumps RPC_MEMORY_BLOCK linked list\n");
dprintf( "\n");
dprintf( "!pasync <address> - Dumps RPC_ASYNC_STATE\n");
dprintf( "!rpcmsg <address> - Dumps RPC_MESSAGE\n");
dprintf( "!stubmsg <address> - Dumps MIDL_STUB_MESSAGE\n");
dprintf( "!authinfo <address> - Dumps CLIENT_AUTH_INFO\n");
dprintf( "!rpcsvr <address> - Dumps RPC_SERVER \n");
dprintf( "!secinfo - Dumps security provider/package info\n");
dprintf( "!dict <address> - Dumps SDICT \n");
dprintf( "!dict2 <address> - Dumps SDICT2 \n");
dprintf( "!queue <address> - Dumps QUEUE \n");
dprintf( "!thread <teb> - Dumps THREAD \n");
dprintf( "!copacket <address> - Dumps CO packet \n");
dprintf( "!lpcpacket <address> - Dumps LRPC packet \n");
dprintf( "!transinfo <address> - Dumps TRANS_INFO \n");
dprintf( "\n");
dprintf( "!scan [options] - Dumps the event log, add '-?' for help\n");
dprintf( "!dgcc <address> - Dumps DG_CCALL \n");
dprintf( "!dgsc <address> - Dumps DG_SCALL \n");
dprintf( "!dgpe <address> - Dumps DG_PACKET_ENGINE\n");
dprintf( "!dgpkt <address> - Dumps DG_PACKET \n");
dprintf( "!dgpkthdr <address> - Dumps dg packet header (NCA_PACKET_HEADER)\n");
dprintf( "!dgep <address> - Dumps DG_ENDPOINT \n");
dprintf( "\n");
dprintf( "!asyncmsg <address> - Dumps NDR_ASYNC_MESSAGE\n");
dprintf( "!asyncrpc <address> - Dumps RPC_ASYNC_STATE\n");
dprintf( "!asyncdcom <address> - Dumps CAsyncManager\n");
dprintf( "\n");
dprintf( "!pipemsg <address> - Dumps NDR_PIPE_MESSAGE\n");
dprintf( "!pipedesc <address> - Dumps NDR_PIPE_DESC\n");
dprintf( "!pipestate <address> - Dumps NDR_PIPE_STATE\n");
dprintf( "\n");
dprintf( "!trans <address> - Dumps most NT RPC transport objects\n");
dprintf( "!overlap <address> - Dumps object associated with OVERLAPPED pointer\n");
dprintf( "!wsaddr <address> - Dumps sockaddr structure\n");
dprintf( "!protocols <address> - Dumps PnP protocols map & related objects\n");
dprintf( "\n");
dprintf( "!rpcsleep <interval> - Pauses the extension\n");
dprintf( "!rpctime - Displays current system time\n");
dprintf( "!getcallinfo [options] - Searches the system for call info, add '-?' for help\n");
dprintf( "!getendpointinfo [options] - Searches the system for endpoint info, add '-?' for help\n");
dprintf( "!getdbgcell <processID> <cellID1>.<cellID2> - Gets info for the specified cell\n");
dprintf( "!getthreadinfo [options] - Searches the system for thread info, add '-?' for help\n");
dprintf( "!getclientcallinfo [options] - Searches the system for client call info, add '-?' for help\n");
dprintf( "!checkrpcsym - Checks whether RPC symbols are correct\n");
dprintf( "!rpcreadstack - Reads an RPC client side stack and retrieves the call info\n");
dprintf( "!rpcverbosestack - toggles the state of the verbose spew when reading the stack\n");
dprintf( "!eerecord - prints an extended error info record\n");
dprintf( "!eeinfo - prints the extended error info chain\n");
dprintf( "!typeinfo - turns on/off the use of type information\n");
dprintf( "!stackmatch start_addr [depth] matches stack symbols and target addresses\n");
dprintf( "!listcalls <address> - Dumps addresses, associations, and calls active within the RPC_SERVER at address\n\n");
}
}
void do_symbol(ULONG64 qwAddr)
{
CHAR Symbol[128];
ULONG64 Displacement = 0;
GetSymbol(qwAddr, Symbol, &Displacement);
dprintf("%I64x %s+%I64x\n", qwAddr, Symbol, Displacement);
}
DECLARE_API( symbol )
{
ULONG64 qwAddr;
LPSTR lpArgumentString = (LPSTR)args;
qwAddr = GetExpression(lpArgumentString);
if ( !qwAddr )
{
return;
}
do_symbol(qwAddr);
}
#define MAX_ARGS 4
DECLARE_API( rpcheap )
{
ULONG64 qwAddr = 0;
ULONG64 dwTmpAddr = 0;
long lDisplay = 0;
long lVerbose = 1;
BOOL Summary = 0;
char **argv = new char*[MAX_ARGS];
int argc = 0;
int i;
long lSize = 0;
CurrentSize = 0;
LPSTR lpArgumentString = (LPSTR)args;
//#ifdef DEBUGRPC
for (i = 0; ; ) {
while (lpArgumentString[i] == ' ') {
lpArgumentString[i] = '\0';
i++;
}
if (lpArgumentString[i] == '\0') {
break;
}
argv[argc] = &(lpArgumentString[i]);
argc++;
if (argc > MAX_ARGS) {
dprintf("\nToo many arguments. Extra args ignored.\n\n");
break;
}
while ((lpArgumentString[i] != ' ')&&
(lpArgumentString[i] != '\0')) {
i++;
}
}
for (i = 0; i < argc; i++) {
if ((*argv[i] == '-') || (*argv[i] == '/') || (*argv[i] == '+')) {
switch (*(argv[i]+1)) {
case 'A':
case 'a':
qwAddr = GetExpression(argv[++i]);
if (!qwAddr) {
dprintf("Error: Failure to get address of RPC memory list\n");
return;
}
break;
case 'D':
case 'd':
lDisplay = (long)myatol(argv[++i]);
break;
case 's':
Summary = 1;
break;
case 'z':
lSize = (long) GetExpression(argv[++i]);
break;
case 'q':
case 'Q':
lVerbose = FALSE;
break;
case '?':
default:
dprintf("rpcheap \n");
dprintf(" -a <address> (default:starts at head of linked list)\n");
dprintf(" -d <number of mem blks to display> (default: to end)\n");
break;
}
}
else {
dprintf("rpcheap \n");
dprintf(" -a <address> (default:starts at head of linked list)\n");
dprintf(" -d <number of mem blks to display> (default: to end)\n");
}
}
if (!qwAddr) {
dwTmpAddr = GetExpression("rpcrt4!AllocatedBlocks");
ReadPtr(dwTmpAddr, &qwAddr);
dprintf("Address of AllocatedBlocks - 0x%I64x\n", dwTmpAddr);
dprintf("Contents of AllocatedBlocks - 0x%I64x\n", qwAddr);
}
do_rpcmem(qwAddr, lDisplay, lVerbose, Summary, lSize);
//#else // DEBUGRPC
//dprintf("This extension command is not supported on a free build!\n");
//#endif // DEBUGRPC
if (argv) {
delete[] argv;
}
return;
}
VOID
do_lpcaddr(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
do_rpcaddr( qwAddr );
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, LpcAddressPort, "LpcAddressPort(HANDLE)\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, CallThreadCount, "CallThreadCount\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, MinimumCallThreads, "MinimumCallThreads\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, AssociationDictionary, "&Associations(LRPC_ASSOCIATION_DICT)", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, AssociationCount, "AssociationCount\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, ServerListeningFlag, "ServerListeningFlag\t\t", tmp1);
dprintf("\n");
}
VOID
do_lpcsa(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, AssociationReferenceCount, "AssociationReferenceCount\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, DictionaryKey, "DictionaryKey\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, LpcServerPort, "LpcServerPort(HANDLE)\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, LpcReplyPort, "LpcReplyPort\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Address, "Address\t\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Bindings, "&Bindings(LRPC_SBINDING_DICT)\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Aborted, "Aborted\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Deleted, "Deleted\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, SequenceNumber, "SequenceNumber\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, CachedSCall, "CachedSCall\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, CachedSCallAvailable, "CachedSCallAvailable\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Buffers, "&Buffers(LRPC_CLIENT_BUFFER_DICT)", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, AssociationMutex, "&AssociationMutex\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, FreeSCallQueue, "&FreeSCallQueue\t\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, ClientThreadDict, "&ClientThreadDict\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, SContextDict, "&SContextDict\t\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, SCallDict, "&SCallDict\t\t\t", tmp2);
dprintf("\n");
}
VOID
do_lpcscall(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, AsyncStatus, "AsyncStatus\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CachedAPCInfo, "pCachedAPCInfo\t\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CachedAPCInfoAvailable, "CachedAPCInfoAvailable\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, pAsync, "pAsync\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CallingThread, "CallingThread\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, NotificationIssued, "NotificationIssued\t\t", tmp1);
ULONG64 AuthInfo;
GET_ADDRESS_OF(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, AuthInfo, AuthInfo, tmp2);
dprintf("&ClientAuthInfo\t\t\t - 0x%I64x\n", AuthInfo);
do_authinfo(AuthInfo );
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ActiveContextHandles, "&ActiveContextHandles(ServerContextHandle_DICT)\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, DispatchBuffer, "DispatchBuffer\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, Association, "pAssociation(LRPC_ASSOCIATION)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, LrpcRequestMessage, "pLrpcMessage(LRPC_MESSAGE)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, LrpcReplyMessage, "pLrpcReplyMessage(LRPC_MESSAGE)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, SBinding, "pSBinding(LRPC_SBINDING)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ObjectUuidFlag, "ObjectUuidFlag\t\t\t", tmp1);
ULONG64 ObjectUuid;
GET_ADDRESS_OF(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ObjectUuid, ObjectUuid, tmp2);
dprintf("ObjectUuid\t\t\t - ");
PrintUuid(ObjectUuid); dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CallId, "CallId\t\t\t\t", tmp1);
ULONG64 ClientId;
GET_ADDRESS_OF(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ClientId, ClientId, tmp2);
PRINT_MEMBER_WITH_LABEL(ClientId, CLIENT_ID, RPCRT4!CLIENT_ID, UniqueProcess, "ClientId.UniqueProcess(CLIENT_ID.HANDLE)", tmp1);
PRINT_MEMBER_WITH_LABEL(ClientId, CLIENT_ID, RPCRT4!CLIENT_ID, UniqueThread, "ClientId.UniqueThread (CLIENT_ID.HANDLE)", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, MessageId, "MessageId\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, PushedResponse, "pPushedResponse(VOID)\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CurrentBufferLength, "CurrentBuffferLength\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, BufferComplete, "BufferComplete\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, Flags, "Flags\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, FirstSend, "FirstSend\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, PipeSendCalled, "PipeSendCalled\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, Deleted, "Deleted\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ReceiveEvent, "ReceiveEvent\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CallMutex, "CallMutex\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, RcvBufferLength, "RcvBufferLength\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, AsyncReply, "AsyncReply\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, NextSCall, "NextSCall\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, NeededLength, "NeededLength\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, fSyncDispatch, "fSyncDispatch\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, Choked, "Choked\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CancelPending, "CancelPending\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, RefCount, "RefCount\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, BufferQueue, "&BufferQueue\t\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, SContext, "SContext\t\t\t", tmp1);
dprintf("\n");
}
VOID
do_lpcbh(
ULONG64 qwAddr
)
{
ULONG64 tmp0;
ULONG tmp1;
do_bh(qwAddr);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, CurrentAssociation, "pCurrentAssociation(LRPC_CASSOCIATION)", tmp0);
PRINT_ADDRESS_OF(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, SecAssociation, tmp1);
PRINT_MEMBER(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, DceBinding, tmp0);
GET_ADDRESS_OF(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, DceBinding, tmp0, tmp1);
do_dcebinding(tmp0);
PRINT_MEMBER(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, BindingReferenceCount, tmp0);
PRINT_ADDRESS_OF(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, RecursiveCalls, tmp1);
PRINT_MEMBER(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, AuthInfoInitialized, tmp0);
}
VOID
do_lpcca(
ULONG64 qwAddr
)
{
dprintf("\n");
ULONG64 tmp1;
ULONG tmp2;
ULONG64 DceBinding;
GET_MEMBER(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, DceBinding, DceBinding);
dprintf("pDceBinding(DCE_BINDING)\t- 0x%I64x\n", DceBinding);
do_dcebinding(DceBinding);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, AssociationDictKey, "AssociationDictKey\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, Bindings, "&Bindings(LRPC_BINDING_DICT)\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, FreeCCalls, "&FreeCCalls\t\t\t", tmp2);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, ActiveCCalls, "&ActiveCCalls\t\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, LpcClientPort, "LpcClientPort\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, LpcReceivePort, "LpcReceivePort\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, AssociationMutex, "&AssociationMutex(MUTEX)\t", tmp2);
ULONG64 AssocAuthInfo;
GET_ADDRESS_OF(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, AssocAuthInfo, AssocAuthInfo, tmp2);
do_authinfo(AssocAuthInfo);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, BackConnectionCreated, "BackConnectionCreated\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, CachedCCall, "pCachedCCall(LRPC_CCALL)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, CachedCCallFlag, "CachedCCallFlag\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, CallIdCounter, "CallIdCounter\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, SequenceNumber, "SequenceNumber\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, SecurityContextDict, "&SecurityContextDict\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, LastSecContextTrimmingTimestamp, "Timestamp\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, BindingHandleReferenceCount, "BindingHAndleReferenceCount\t", tmp1);
dprintf("\n");
}
VOID
do_lpcccall(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, AsyncStatus, "AsyncStatus\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CachedAPCInfo, "pCachedAPCInfo\t\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CachedAPCInfoAvailable, "CachedAPCInfoAvailable\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, pAsync, "pAsync\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallingThread, "CallingThread\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, NotificationIssued, "NotificationIssued\t\t", tmp1);
ULONG64 AuthInfo;
GET_ADDRESS_OF(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, AuthInfo, AuthInfo, tmp2);
dprintf("AuthInfo\t\t\t- 0x%I64x\n", AuthInfo);
do_authinfo(AuthInfo);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CurrentBindingHandle, "pCurrentBindingHandle(LRPC_BINDING_HANDLE)", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, Association, "pAssociation(LRPC_CASSOCIATION)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, LrpcMessage, "pLrpcMessage(LRPC_MESSAGE)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, RpcReplyMessage, "RpcReplyMessage\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, LpcReplyMessage, "LpcReplyMessage\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, RcvBufferLength, "RcvBufferLength\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, Choked, "Choked\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, RecursiveCallsKey, "RecursiveCallsKey\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, FreeCallKey, "FreeCallKey\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallId, "CallId\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, MessageId, "MessageId\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallbackId, "CallbackId\t\t\t", tmp1);
ULONG64 ClientId;
GET_ADDRESS_OF(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, ClientId, ClientId, tmp2);
PRINT_MEMBER_WITH_LABEL(ClientId, CLIENT_ID, RPCRT4!CLIENT_ID, UniqueProcess, "ClientId.UniqueProcess(CLIENT_ID.HANDLE)", tmp1);
PRINT_MEMBER_WITH_LABEL(ClientId, CLIENT_ID, RPCRT4!CLIENT_ID, UniqueThread, "ClientId.UniqueThread (CLIENT_ID.HANDLE)", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, DataInfoOffset, "DataInfoOffset\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallAbortedFlag, "CallAbortedFlag\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, Thread, "Thread(THREAD_IDENTIFIER)\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, Binding, "Binding(LRPC_BINDING)", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, RecursionCount, "RecursionCount\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, SyncEvent, "SyncEvent\t\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, MsgFlags, "MsgFlags\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallMutex, "CallMutex\t\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallStack, "CallStack\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CachedLrpcMessage, "CachedLrpcMessage\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, FirstFrag, "FirstFrag\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CurrentBufferLength, "CurrentBufferLength\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, NeededLength, "NeededLength\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, BufferQueue, "BufferQueue\t\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, fSendComplete, "fSendcomplete\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CurrentSecurityContext, "CurrentSecurityContext\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, EEInfo, "Extended Error Info\t\t", tmp1);
dprintf("\n");
}
VOID
do_pasync(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Size, "Size\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Signature, "Signature\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Lock, "Lock\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Flags, "Flags\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, StubInfo, "StubInfo\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, UserInfo, "UserInfo\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, RuntimeInfo, "RuntimeInfo\t\t", tmp1);
ULONG64 Event;
GET_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Event, Event);
dprintf("Event\t\t\t - ");
switch ((ULONG)Event)
{
case RpcCallComplete:
dprintf("RpcCallComplete\n");
break;
case RpcSendComplete:
dprintf("RpcSendComplete\n");
break;
case RpcReceiveComplete:
dprintf("RpcReceiveComplete\n");
break;
default:
dprintf("(unknown) 0x%I64x\n", Event);
break;
}
ULONG64 NotificationType;
GET_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, NotificationType, NotificationType);
dprintf("NotificationType\t - ");
BOOL b;
char block[sizeof(RPC_ASYNC_STATE)];
PRPC_ASYNC_STATE pa = (PRPC_ASYNC_STATE)&block;
if (!fUseTypeInfo) {
b = GetData(qwAddr, &block, sizeof(RPC_ASYNC_STATE));
if ( !b ) {
dprintf("can't read %p\n", qwAddr);
return;
}
}
switch ((ULONG)NotificationType)
{
case RpcNotificationTypeNone:
dprintf("RpcNotificationTypeNone\n");
break;
case RpcNotificationTypeEvent:
dprintf("RpcNotificationTypeEvent\n");
if (!fUseTypeInfo)
dprintf("\thEvent\t\t - 0x%p\n", pa->u.hEvent);
break;
case RpcNotificationTypeApc:
dprintf("RpcNotificationTypeApc\n");
if (!fUseTypeInfo) {
dprintf("\tNotificationRoutine\t - 0x%p\n", pa->u.APC.NotificationRoutine);
dprintf("\thThread\t\t\t - 0x%p\n", pa->u.APC.hThread);
}
break;
case RpcNotificationTypeIoc:
dprintf("RpcNotificationTypeIoc\n");
if (!fUseTypeInfo) {
dprintf("\thIOPort\t\t\t - 0x%p\n", pa->u.IOC.hIOPort);
dprintf("\tdwNumberOfBytesTransferred - 0x%x\n",
pa->u.IOC.dwNumberOfBytesTransferred);
dprintf("\tdwCompletionKey\t\t - 0x%p\n", pa->u.IOC.dwCompletionKey);
dprintf("\tlpOverlapped\t\t - 0x%x\n", pa->u.IOC.lpOverlapped);
}
break;
case RpcNotificationTypeHwnd:
dprintf("RpcNotificationTypeHwnd\n");
if (!fUseTypeInfo) {
dprintf("\thWnd\t\t - 0x%p\n", pa->u.HWND.hWnd);
dprintf("\tMsg\t\t - 0x%x\n", pa->u.HWND.Msg);
}
break;
case RpcNotificationTypeCallback:
dprintf("RpcNotificationTypeCallback\n");
if (!fUseTypeInfo) {
dprintf("NotificationRoutine\t - 0x%p\n", pa->u.NotificationRoutine);
}
break;
default:
dprintf("Bad notification type\n");
}
dprintf("\n");
}
char *
ReceiveStates[] =
{
"START",
"COPY_PIPE_ELEM",
"RETURN_PARTIAL",
"READ_PARTIAL"
};
void
do_stubmsg(
ULONG64 msg
)
{
ULONG64 tmp0;
dprintf("MIDL_STUB_MESSAGE at 0x%I64x\n\n", msg);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, Buffer, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, BufferStart, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, BufferEnd, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, BufferMark, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, MemorySize, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, Memory, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, BufferLength, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pAllocAllNodesContext, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, RpcMsg, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, SavedHandle, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, StubDesc, tmp0);
PRINT_MEMBER_BOOLEAN(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, IsClient, tmp0);
PRINT_MEMBER_BOOLEAN(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, ReuseBuffer, tmp0);
PRINT_MEMBER_BOOLEAN(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, IgnoreEmbeddedPointers, tmp0);
PRINT_MEMBER_BOOLEAN(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, fBufferValid, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, MaxCount, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, ActualCount, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, Offset, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, StackTop, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pPresentedType, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pTransmitType, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pRpcChannelBuffer, tmp0);
PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pAsyncMsg, tmp0);
}
VOID
do_dgaddr(
ULONG64 qwAddr
)
{
ULONG64 tmp0;
ULONG tmp1;
dprintf("DG_ADDRESS at 0x%I64x\n\n", qwAddr);
do_rpcaddr(qwAddr);
PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, TransInfo, tmp0);
PRINT_MEMBER_SYMBOL(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, TransInfo, tmp0);
PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, ActiveCallCount, tmp0);
PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, CachedConnections, tmp0);
dprintf("\nendpoint data:\n");
GET_ADDRESS_OF(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, Endpoint, tmp0, tmp1);
do_dgep(tmp0);
dprintf("\nobsolete data:\n");
PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, TotalThreadsThisEndpoint, tmp0);
PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, ThreadsReceivingThisEndpoint, tmp0);
PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, MinimumCallThreads, tmp0);
PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, MaximumConcurrentCalls, tmp0);
PRINT_ADDRESS_OF(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, ScavengerTimer, tmp1);
}
VOID
do_dgbh(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
do_bh(qwAddr);
dprintf("DCE_BINDING:\n");
ULONG64 pDceBinding;
GET_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, pDceBinding, pDceBinding);
do_dcebinding(pDceBinding);
PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, EndpointFlags, tmp1);
PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, Association, tmp1);
PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, ReferenceCount, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, fDynamicEndpoint, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, fContextHandle, tmp1);
PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, TransportObject, tmp1);
PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, TransportInterface, tmp1);
}
VOID
do_dgpe(
ULONG64 qwAddr
)
{
DG_PACKET_ENGINE *dgpe;
char block[sizeof(DG_PACKET_ENGINE)];
dgpe = (DG_PACKET_ENGINE *) block;
ULONG64 tmp1;
ULONG tmp;
if (!fUseTypeInfo) {
GetData(qwAddr, &block, sizeof(DG_PACKET_ENGINE));
}
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SequenceNumber, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, ReferenceCount, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, PacketType,tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, ActivityHint, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, TimeoutCount, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, CurrentPduSize, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, MaxFragmentSize, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SecurityTrailerSize, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, pSavedPacket, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SourceEndpoint, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, RemoteAddress, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, BaseConnection, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, pReceivedPackets, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, ReceiveFragmentBase, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, LastReceiveBuffer, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, pLastConsecutivePacket, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, LastReceiveBufferLength, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, ConsecutiveDataBytes, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, fReceivedAllFragments, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, Buffer, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendWindowBase, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, FinalSendFrag, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, BufferLength, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendWindowBits, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, FackSerialNumber, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, BufferFlags,tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendWindowSize, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, fRetransmitted, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, FirstUnsentOffset, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendBurstLength, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, QueuedBufferHead, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, FirstUnsentFragment, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, QueuedBufferTail, tmp1);
PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, RingBufferBase, tmp1);
if (!fUseTypeInfo) {
dprintf(" Frag Offset Length Serial # | Frag Offset Length Serial #\n"
" ---- -------- ------ -------- | ---- -------- ------ --------\n"
);
}
ULONG64 RingBufferBase;
ULONG64 SendWindowBase;
GET_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, RingBufferBase, RingBufferBase);
GET_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendWindowBase, SendWindowBase);
unsigned short i;
for (i=1; i <= MAX_WINDOW_SIZE/2; ++i)
{
unsigned Index1 = (i + (ULONG)RingBufferBase) % MAX_WINDOW_SIZE;
unsigned Frag1 = (ULONG)SendWindowBase+i;
if (Frag1 >= MAX_WINDOW_SIZE)
{
Frag1 -= MAX_WINDOW_SIZE;
}
if (!fUseTypeInfo) {
dprintf(" %4x: %8lx %5hx %4hx |",
Frag1,
dgpe->FragmentRingBuffer[Index1].Offset,
dgpe->FragmentRingBuffer[Index1].Length,
dgpe->FragmentRingBuffer[Index1].SerialNumber
);
}
unsigned Index2 = (i+MAX_WINDOW_SIZE/2 + (ULONG)RingBufferBase) % MAX_WINDOW_SIZE;
unsigned Frag2 = (ULONG)SendWindowBase+i+MAX_WINDOW_SIZE/2;
if (Frag2 >= MAX_WINDOW_SIZE)
{
Frag2 -= MAX_WINDOW_SIZE;
}
if (!fUseTypeInfo) {
dprintf(" %4x: %8lx %5hx %4hx \n",
Frag2,
dgpe->FragmentRingBuffer[Index2].Offset,
dgpe->FragmentRingBuffer[Index2].Length,
dgpe->FragmentRingBuffer[Index2].SerialNumber
);
}
}
dprintf("\n");
}
char *
ClientState(
DG_CCALL::DG_CLIENT_STATE State
)
{
switch (State)
{
case DG_CCALL::CallInit: return "init";
case DG_CCALL::CallQuiescent: return "quiescent";
case DG_CCALL::CallSend: return "sending";
case DG_CCALL::CallSendReceive: return "sendreceive";
case DG_CCALL::CallReceive: return "receiving";
case DG_CCALL::CallCancellingSend:return "cancel send";
case DG_CCALL::CallComplete: return "complete";
default:
{
static char scratch[40];
sprintf(scratch, "0x%lx", State);
return scratch;
}
}
}
char *
ServerState(
DG_SCALL::CALL_STATE State
)
{
switch (State)
{
case DG_SCALL::CallInit: return "init";
case DG_SCALL::CallBeforeDispatch: return "receiving";
case DG_SCALL::CallDispatched: return "dispatched";
case DG_SCALL::CallAfterDispatch: return "after stub";
case DG_SCALL::CallSendingResponse: return "sending";
case DG_SCALL::CallComplete: return "complete";
default:
{
static char scratch[40];
sprintf(scratch, "0x%lx", State);
return scratch;
}
}
}
char *
PipeOp(
PENDING_OPERATION Op
)
{
switch (Op)
{
case PWT_NONE: return "none";
case PWT_RECEIVE: return "receive";
case PWT_SEND: return "send";
case PWT_SEND_RECEIVE: return "send/recv";
default:
{
static char scratch[40];
sprintf(scratch, "0x%lx", Op);
return scratch;
}
}
}
VOID
do_dgcc(
ULONG64 dgcc
)
{
ULONG64 State, PreviousState;
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
GET_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, State, State);
GET_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, PreviousState, PreviousState);
dprintf("state %-14s prev %-14s\n\n",
ClientState((DG_CCALL::DG_CLIENT_STATE)State),
ClientState((DG_CCALL::DG_CLIENT_STATE)PreviousState));
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, TimeStamp, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, TimeoutLimit, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, LastReceiveTime, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, AsyncStatus, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, CancelTime, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, EEInfo, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, ReceiveTimeout, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, WorkingCount, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, UnansweredRequestCount, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, PipeReceiveSize, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, Previous, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, Next, tmp1);
PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, pAsync, tmp1);
PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, StaticArgsSent, tmp1);
PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, DelayedSendPending, tmp1);
PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, AllArgsSent, tmp1);
PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, LastSendTimedOut, tmp1);
PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, CancelComplete, tmp1);
PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, ForceAck, tmp1);
PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, CancelPending, tmp1);
PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, AutoReconnectOk, tmp1);
dprintf("\n");
ULONG64 ActivityHint;
GET_ADDRESS_OF(dgcc, DG_CCALL, RPCRT4!DG_CCALL, ActivityHint, ActivityHint, tmp2);
do_dgpe(ActivityHint-AddressSize);
}
VOID
do_dgep(
ULONG64 ep
)
{
ULONG64 tmp0;
ULONG tmp1;
ULONG64 Stats;
PRINT_MEMBER_BOOLEAN(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, Async, tmp0);
PRINT_MEMBER(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, TimeStamp, tmp0);
PRINT_MEMBER(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, Next, tmp0);
PRINT_MEMBER(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, NumberOfCalls, tmp0);
PRINT_MEMBER(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, TransportInterface, tmp0);
PRINT_MEMBER_SYMBOL(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, TransportInterface, tmp0);
GET_ADDRESS_OF(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, Stats, Stats, tmp1);
PRINT_MEMBER(Stats, DG_ENDPOINT_STATS, RPCRT4!DG_ENDPOINT_STATS, PreferredPduSize, tmp0);
PRINT_MEMBER(Stats, DG_ENDPOINT_STATS, RPCRT4!DG_ENDPOINT_STATS, MaxPduSize, tmp0);
PRINT_MEMBER(Stats, DG_ENDPOINT_STATS, RPCRT4!DG_ENDPOINT_STATS, MaxPacketSize, tmp0);
PRINT_MEMBER(Stats, DG_ENDPOINT_STATS, RPCRT4!DG_ENDPOINT_STATS, ReceiveBufferSize, tmp0);
}
VOID
do_dgccn(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\nbase:\n");
ULONG64 ActivityNode;
GET_ADDRESS_OF(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, ActivityNode, ActivityNode, tmp2);
ULONG64 Uuid;
ULONG64 pPrev, pNext;
GET_ADDRESS_OF(ActivityNode, UUID_HASH_TABLE_NODE, RPCRT4!UUID_HASH_TABLE_NODE, Uuid, Uuid, tmp2);
GET_MEMBER(ActivityNode, UUID_HASH_TABLE_NODE, RPCRT4!UUID_HASH_TABLE_NODE, pPrev, pPrev);
GET_MEMBER(ActivityNode, UUID_HASH_TABLE_NODE, RPCRT4!UUID_HASH_TABLE_NODE, pNext, pNext);
dprintf(" activity ID "); PrintUuid(Uuid);
dprintf(" next %I64x prev %I64x\n", pNext, pPrev );
PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, TimeStamp, tmp1);
PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, TransportInterface, tmp1);
PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, ActiveSecurityContext, tmp1);
PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, ReferenceCount, tmp1);
PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, TransportInterface, tmp1);
PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, LowestActiveSequence, tmp1);
PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, LowestUnusedSequence, tmp1);
PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, CurrentPduSize, tmp1);
PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, RemoteWindowSize, tmp1);
}
VOID
do_dgcn(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
do_dgccn(qwAddr);
dprintf("\nclient:\n");
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, ActiveCallHead, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, CurrentCall, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, ActiveCallTail, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, CachedCalls, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, CachedCallCount, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, ThreadId, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, BindingHandle, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, ServerResponded, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, CallbackCompleted, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fServerSupportsAsync, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fSecurePacketReceived, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fBusy, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, InConnectionTable, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, AckPending, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, AckOrphaned, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, PossiblyRunDown, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fAutoReconnect,tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, Association, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, AssociationKey, tmp1);
PRINT_ADDRESS_OF(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, AuthInfo, tmp2);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, SecurityContextId, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, TimeStamp, tmp1);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, LastScavengeTime, tmp1);
PRINT_ADDRESS_OF(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, DelayedAckTimer, tmp2);
PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, Next, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fError, tmp1);
PRINT_ADDRESS_OF(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, Mutex, tmp2);
}
char *
CallbackState(
DG_SCONNECTION::CALLBACK_STATE State
)
{
switch (State)
{
case DG_SCONNECTION::NoCallbackAttempted: return "NoCallbackAttempted";
case DG_SCONNECTION::SetupInProgress: return "SetupInProgress";
case DG_SCONNECTION::MsConvWayAuthInProgress:return "MsConvWayAuthInProgress";
case DG_SCONNECTION:: ConvWayAuthInProgress:return " ConvWayAuthInProgress";
case DG_SCONNECTION::MsConvWay2InProgress: return "MsConvWay2InProgress";
case DG_SCONNECTION:: ConvWay2InProgress: return " ConvWay2InProgress";
case DG_SCONNECTION:: ConvWayInProgress: return " ConvWayInProgress";
case DG_SCONNECTION::CallbackSucceeded: return "CallbackSucceeded";
case DG_SCONNECTION::CallbackFailed: return "CallbackFailed";
default:
{
static char scratch[40];
sprintf(scratch, "0x%lx", State);
return scratch;
}
}
}
VOID
do_dgsn(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
do_dgccn(qwAddr);
dprintf("\nserver:\n");
PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, ActiveCalls, tmp1);
PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, CurrentCall, tmp1);
PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, CachedCalls, tmp1);
PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, pAddress, tmp1);
PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, LastInterface, tmp1);
PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, pAssocGroup, tmp1);
PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, Next, tmp1);
PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, ActivityHint, tmp1);
PRINT_ADDRESS_OF(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, AuthInfo, tmp2);
PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, MaxKeySeq, tmp1);
PRINT_ADDRESS_OF(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, SecurityContextDict, tmp2);
PRINT_ADDRESS_OF(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, Callback, tmp2);
if (!fUseTypeInfo) {
uchar buff[sizeof(DG_SCONNECTION)];
GetData(qwAddr, buff, sizeof(DG_SCONNECTION));
DG_SCONNECTION * cn = (DG_SCONNECTION *) buff;
dprintf( "\n"
" status %-8lx binding %p datarep %-8lx \n"
" scall %p client seq %-8lx \n"
"\n"
" token buffer %p token len %-8lx async state offset %x \n"
" response buf %p response len %-8lx ThirdLegNeeded %s\n"
" sec cxt %p credentials %p ksno %-8lx \n"
" data index %-8lx \n",
cn->Callback.Status, cn->Callback.Binding, cn->Callback.DataRep,
cn->Callback.Call, cn->Callback.ClientSequence,
cn->Callback.TokenBuffer, cn->Callback.TokenLength, offsetof(DG_SCONNECTION, Callback.AsyncState),
cn->Callback.ResponseBuffer, cn->Callback.ResponseLength, BoolString(cn->Callback.ThirdLegNeeded),
cn->Callback.SecurityContext, cn->Callback.Credentials, cn->Callback.KeySequence,
cn->Callback.DataIndex
);
}
}
VOID
do_dgca(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ReferenceCount, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, BindingHandleReferences, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, InternalTableIndex, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, LastScavengeTime, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, CurrentPduSize, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, RemoteWindowSize, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, TransportInterface, tmp1);
dprintf("\n");
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ServerAddress, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ServerBootTime, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ServerDataRep, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, AssociationFlag, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, fServerSupportsAsync, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, fLoneBindingHandle, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, fErrorFlag, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, LastReceiveTime, tmp1);
PRINT_ADDRESS_OF(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, Mutex, tmp2);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ResolvedEndpoint, tmp1);
PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, KeepAliveHandle, tmp1);
PRINT_ADDRESS_OF(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ActiveConnections, tmp2);
PRINT_ADDRESS_OF(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, InactiveConnections, tmp2);
PRINT_ADDRESS_OF(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, InterfaceAndObjectDict, tmp2);
ULONG64 pDceBinding;
GET_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, pDceBinding, pDceBinding);
dprintf("DCE_BINDING:\n");
do_dcebinding(pDceBinding);
}
VOID
do_dgsc(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
ULONG64 State;
GET_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, State, State);
dprintf("state - %-14s\n", ServerState((DG_SCALL::CALL_STATE)State));
ULONG64 PreviousState;
GET_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, PreviousState, PreviousState);
dprintf("prev state - %-14s\n", ServerState((DG_SCALL::CALL_STATE)State));
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, TimeStamp, tmp1);
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, DispatchBuffer, tmp1);
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, AsyncStatus, tmp1);
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, pAsync, tmp1);
ULONG64 PipeWaitType;
GET_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, PipeWaitType, PipeWaitType);
dprintf("pipe op - %-10s\n", PipeOp((PENDING_OPERATION)PipeWaitType));
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, PipeWaitLength, tmp1);
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, PipeThreadId, tmp1);
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, Previous, tmp1);
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, Next, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, CallInProgress, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, CallWasForwarded, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, KnowClientAddress, tmp1);
PRINT_MEMBER_BOOLEAN(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, TerminateWhenConvenient, tmp1);
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, AuthorizationService, tmp1);
PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, Privileges, tmp1);
dprintf("\n");
ULONG64 ActivityHint;
GET_ADDRESS_OF(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, ActivityHint, ActivityHint, tmp2);
do_dgpe(ActivityHint-AddressSize);
}
VOID
do_dgag(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
ULONG64 Node;
GET_ADDRESS_OF(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, Node, Node, tmp2);
ULONG64 Uuid;
GET_ADDRESS_OF(Node, UUID_HASH_TABLE_NODE, UUID_HASH_TABLE_NODE, Uuid, Uuid, tmp2);
dprintf("\n"
" CAG UUID: "); PrintUuid(Uuid);
ULONG64 ReferenceCount;
ULONG64 CurrentPduSize;
ULONG64 RemoteWindowSize;
ULONG64 AssociationID;
ULONG64 CtxCollection;
ULONG64 MutexAddr;
GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, ReferenceCount, ReferenceCount);
GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, CurrentPduSize, CurrentPduSize);
GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, RemoteWindowSize, RemoteWindowSize);
GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, AssociationID, AssociationID);
GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, CtxCollection, CtxCollection);
GET_ADDRESS_OF(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, Mutex, MutexAddr, tmp2);
dprintf(" \n"
" refs: %8.8x mutex at %p \n"
" pdu length: %8.8x assoc ID: %x \n"
" send window %8.8x CtxColl : %I64p \n",
(ULONG)ReferenceCount, MutexAddr,
(ULONG)CurrentPduSize, (ULONG)AssociationID,
(ULONG)RemoteWindowSize, CtxCollection);
}
// Do some arm twisting to include pipendr.h and asyncndr.
#define _NEWINTRP_
typedef unsigned char uchar;
typedef unsigned short ushort;
typedef unsigned long ulong;
typedef unsigned int uint;
#include "..\..\ndr20\pipendr.h"
typedef void IAsyncManager;
#define MAX_CONTEXT_HNDL_NUMBER 8
#include "..\..\ndr20\mulsyntx.h"
#include "..\..\ndr20\asyncndr.h"
char *
PipeState(
int State
)
{
static char buf[40];
if (State <= 3)
{
return ReceiveStates[State];
}
sprintf(buf, "0x%x", State);
return buf;
}
char *
PipeFlags(
unsigned short Flags
)
{
static char buf[80];
buf[0] = 0;
if (Flags & NDR_IN_PIPE)
{
strcat(buf, "I ");
}
if (Flags & NDR_OUT_PIPE)
{
strcat(buf, "O ");
}
if (Flags & NDR_LAST_IN_PIPE)
{
strcat(buf, "LI ");
}
if (Flags & NDR_LAST_OUT_PIPE)
{
strcat(buf, "LO ");
}
if (Flags & NDR_OUT_ALLOCED)
{
strcat(buf, "ALLOC ");
}
if (Flags & 0xffe0)
{
char Excess[10];
sprintf(Excess, "%hx ", Flags & 0xffe0);
strcat(buf, Excess);
}
return buf;
}
char *
PipeStatusStrings[] =
{
"QUIET",
"IN",
"OUT",
"DRAIN"
};
char *
PipeStatus(
unsigned short Status
)
{
static char buf[40];
if (Status <= 3)
{
return PipeStatusStrings[Status];
}
sprintf(buf, "0x%x", Status);
return buf;
}
void
do_pipestate(
ULONG64 qwAddr
)
{
ULONG64 ElemsInChunk;
ULONG64 ElemAlign;
ULONG64 ElemWireSize;
ULONG64 ElemMemSize;
ULONG64 PartialBufferSize;
ULONG64 PartialElem;
ULONG64 PartialElemSize;
ULONG64 PartialOffset;
ULONG64 CurrentState;
ULONG64 EndOfPipe;
GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, ElemsInChunk, ElemsInChunk);
GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, ElemAlign, ElemAlign);
GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, ElemWireSize, ElemWireSize);
GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, ElemMemSize, ElemMemSize);
GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialBufferSize, PartialBufferSize);
GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialElem, PartialElem);
GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialElemSize, PartialElemSize);
GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialOffset, PartialOffset);
GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, CurrentState, CurrentState);
ULONG tmp2;
GET_ADDRESS_OF(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialOffset, EndOfPipe, tmp2);
EndOfPipe += 4;
dprintf("\n");
dprintf(" elems in chunk %8lx partial buf size %8lx state %s\n",
(ULONG)ElemsInChunk, (ULONG)PartialBufferSize, PipeState((ULONG)CurrentState) );
dprintf(" elem align %8lx partial element %8lx end of pipe bits %I64x\n",
(ULONG)ElemAlign, (ULONG)PartialElem, EndOfPipe );
dprintf(" elem wire size %8lx partial elem size %8lx \n",
(ULONG)ElemWireSize, (ULONG)PartialElemSize );
dprintf(" elem mem size %8lx partial offset %8lx \n",
(ULONG)ElemMemSize, (ULONG)PartialOffset );
}
void
do_pipedesc(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, CurrentPipe, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, InPipes, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, OutPipes, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, TotalPipes, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, Flags, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, PipeVersion, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, pPipeMsg, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, DispatchBuffer, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, ChainingBuffer, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, DispatchBufferLength, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, ChainingBufferSize, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, LastPartialBuffer, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, BufferSave, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, LastPartialSize, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, LengthSave, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, LeftoverSize, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, RuntimeState, tmp1);
PRINT_ADDRESS_OF(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, Leftover, tmp2);
do_pipestate(tmp1);
}
void
do_pipearg(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
dprintf("\n");
PRINT_MEMBER(qwAddr, GENERIC_PIPE_TYPE, RPCRT4!GENERIC_PIPE_TYPE, pfnPull, tmp1);
PRINT_MEMBER(qwAddr, GENERIC_PIPE_TYPE, RPCRT4!GENERIC_PIPE_TYPE, pfnPush, tmp1);
PRINT_MEMBER(qwAddr, GENERIC_PIPE_TYPE, RPCRT4!GENERIC_PIPE_TYPE, pfnAlloc, tmp1);
PRINT_MEMBER(qwAddr, GENERIC_PIPE_TYPE, RPCRT4!GENERIC_PIPE_TYPE, pState, tmp1);
}
void
do_pipemsg(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, Signature, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, PipeId, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, pPipeObject, tmp1);
ULONG64 pPipeObject = tmp1;
PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, pStubMsg, tmp1);
PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, pTypeFormat, tmp1);
ULONG64 PipeStatusVal;
ULONG64 PipeFlagsVal;
GET_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, PipeStatus, PipeStatusVal);
GET_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, PipeFlags, PipeFlagsVal);
dprintf("pipe status %5s\n", PipeStatus((unsigned short)PipeStatusVal));
dprintf("pipe flags %s\n", PipeFlags((unsigned short)PipeStatusVal));
do_pipearg(pPipeObject );
}
void
async_flags(
NDR_ASYNC_CALL_FLAGS flags
)
{
dprintf(" flags %4x: ", *(unsigned short *)&flags );
if ( flags.ValidCallPending )
dprintf(" call pending, " );
if ( flags.ErrorPending )
dprintf(" err pending, " );
if ( flags.BadStubData )
dprintf(" BSD, " );
if ( flags.RuntimeCleanedUp )
dprintf(" rt cleaned, " );
if ( flags.HandlelessObjCall )
dprintf(" autocomplete, " );
if ( flags.Unused )
dprintf(" Unused %4x ", flags.Unused );
dprintf("-\n" );
}
char * AsyncPhaseString[5] =
{
"zero",
"prep : initialized",
"set : (cl) after get buffer and ( cl | srv) register call",
"call : cl after marshaling, calling send",
"error : exception taken"
};
void
async_stub_phase(
unsigned short phase
)
{
dprintf(" phase %4x: ", phase );
if ( 0 <= phase && phase < 5 )
dprintf(" %s\n", AsyncPhaseString[ phase ] );
else
dprintf(" unknown??\n" );
}
typedef struct _NDR_ASYNC_OBJ_HANDLE
{
void * pIAMvtble;
void * pICMvtble;
NDR_ASYNC_MESSAGE * _pAsyncMsg;
unsigned long _Lock;
unsigned long _Signature;
GUID _iid;
void * _InnerUnknown;
unsigned long _iRef;
void * _pParent;
void * _pControl;
void * _pSyncInner;
unsigned long _fAutoComplete;
} NDR_ASYNC_OBJ_HANDLE;
void
do_asyncdcom(
ULONG64 qwAddr
)
{
if (fUseTypeInfo) {
dprintf("Can't dump NDR_ASYNC_OBJ_HANDLE when using type info\n");
}
else {
BOOL b;
char block[sizeof(NDR_ASYNC_OBJ_HANDLE)];
b = GetData(qwAddr, &block, sizeof(block));
if ( !b ) {
dprintf("can't read %p\n", qwAddr);
return;
}
NDR_ASYNC_OBJ_HANDLE * msg = (NDR_ASYNC_OBJ_HANDLE *) block;
dprintf("\n");
dprintf(" pIAMvtble %p pICMvtble %p asyncmsg %p lock %8lx\n",
msg->pIAMvtble, msg->pICMvtble, msg->_pAsyncMsg, msg->_Lock );
dprintf(" innerpUnk %p iref %8lx pParent %p pControl %p\n",
msg->_InnerUnknown,msg->_iRef, msg->_pParent,msg->_pControl );
dprintf(" Signature %8lx iid ", msg->_Signature ); PrintUuidLocal( & msg->_iid );dprintf("\n");
dprintf(" innerSync %p autocompl %d\n",
msg->_pSyncInner,msg->_fAutoComplete );
}
}
void
do_asyncrpc(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
dprintf("\n");
PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Size, tmp1);
PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Signature, tmp1);
PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Lock, tmp1);
PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Flags, tmp1);
PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, StubInfo, tmp1);
PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, UserInfo, tmp1);
PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, RuntimeInfo, tmp1);
}
void
do_asyncmsg(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, Signature, tmp1);
PRINT_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, Version, tmp1);
PRINT_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, AsyncHandle, tmp1);
PRINT_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, ProcContext, tmp1);
ULONG64 Flags;
GET_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, Flags, Flags);
async_flags( *((NDR_ASYNC_CALL_FLAGS*)&Flags) );
ULONG64 StubPhase;
GET_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, StubPhase, StubPhase);
async_stub_phase( (unsigned short) StubPhase );
ULONG64 StubMsg;
GET_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, StubMsg, StubMsg);
do_stubmsg( StubMsg );
}
//
// Datagram stuff
//
char * PacketFlagStrings[8] =
{
"forwarded ",
"lastfrag ",
"frag ",
"nofack ",
"maybe ",
"idem ",
"broadcast ",
"flags-0x80 "
};
char * PacketFlag2Strings[8] =
{
"fragmented ",
"cancel-pending ",
"flags2-0x04 ",
"flags2-0x08 ",
"flags2-0x10 ",
"flags2-0x20 ",
"flags2-0x40 ",
"flags2-0x80 "
};
char *
PrintPacketFlags(
unsigned char PacketFlags1,
unsigned char PacketFlags2
)
{
static char buf[160];
unsigned char Flags;
unsigned i;
buf[0] = 0;
Flags = PacketFlags1;
for (i=0; i < 8; i++)
{
if (Flags & 1)
{
strcat(buf, PacketFlagStrings[i]);
}
Flags >>= 1;
}
Flags = PacketFlags2;
for (i=0; i < 8; i++)
{
if (Flags & 1)
{
strcat(buf, PacketFlag2Strings[i]);
}
Flags >>= 1;
}
return buf;
}
char * PacketTypes[] =
{
"REQ ",
"PING",
"RESP",
"FLT ",
"WORK",
"NOCA",
"REJ ",
"ACK ",
"QUIT",
"FACK",
"QACK"
};
char *
PrintPacketType(
unsigned char PacketType
)
{
static char buf[40];
if (PacketType < sizeof(PacketTypes)/sizeof(PacketTypes[0]))
{
return PacketTypes[PacketType];
}
sprintf(buf, "illegal packet type %x ", PacketType);
return buf;
}
VOID
do_dgpkt(
ULONG64 p
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, MaxDataLength, tmp1);
PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, TimeReceived, tmp1);
PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, DataLength, tmp1);
PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, pNext, tmp1);
PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, pPrevious, tmp1);
ULONG64 Header;
GET_ADDRESS_OF(p, DG_PACKET, RPCRT4!DG_PACKET, Header, Header, tmp2);
do_dgpkthdr(Header);
}
VOID
do_dgpkthdr(
ULONG64 h
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, PacketType, tmp1);
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, RpcVersion, tmp1);
ULONG64 PacketFlags;
ULONG64 PacketFlags2;
GET_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, PacketFlags, PacketFlags);
GET_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, PacketFlags2, PacketFlags2);
dprintf("flags: %s\n", PrintPacketFlags((unsigned char)PacketFlags, (unsigned char)PacketFlags2));
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, FragmentNumber, tmp1);
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, PacketBodyLen, tmp1);
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, SerialLo, tmp1);
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, DataRep, tmp1);
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, ServerBootTime, tmp1);
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, AuthProto, tmp1);
dprintf(" activity ");
ULONG64 ActivityId;
GET_ADDRESS_OF(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, ActivityId, ActivityId, tmp2);
PrintUuid(ActivityId);
dprintf("\n");
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, ActivityHint, tmp1);
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, SequenceNumber, tmp1);
dprintf(" interface ");
ULONG64 InterfaceId;
GET_ADDRESS_OF(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, InterfaceId, InterfaceId, tmp2);
PrintUuid(InterfaceId);
dprintf("\n");
ULONG64 InterfaceVersion;
GET_ADDRESS_OF(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, InterfaceVersion, InterfaceVersion, tmp2);
PRINT_MEMBER(h, _RPC_VERSION, RPCRT4!_RPC_VERSION, MajorVersion, tmp1);
PRINT_MEMBER(h, _RPC_VERSION, RPCRT4!_RPC_VERSION, MinorVersion, tmp1);
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, InterfaceHint, tmp1);
PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, OperationNumber, tmp1);
PRINT_ADDRESS_OF(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, ObjectId, tmp2);
dprintf("\n");
}
void
do_assoctable(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
dprintf("DG_ASSOCIATION_TABLE at 0x%I64x:\n", qwAddr);
ULONG64 CasUuid;
ULONG64 fCasUuidReady;
GET_MEMBER(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, CasUuid, CasUuid);
GET_MEMBER(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, fCasUuidReady, fCasUuidReady);
dprintf(" CAS: "); PrintUuid( CasUuid );
dprintf(", %svalid\n", (ULONG)fCasUuidReady ? "" : "not ");
dprintf("\n");
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, Mutex, "&Mutex (CSharedLock)", tmp2);
ULONG64 Associations;
ULONG64 AssociationsLength;
GET_MEMBER(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, Associations, Associations);
GET_MEMBER(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, AssociationsLength, AssociationsLength);
dprintf("association array at 0x%I64x, %x elements\n", Associations, AssociationsLength);
}
char *
strtok(
char *String
)
{
char * Word;
static char * End;
if (String)
{
Word = String;
}
else if (!End)
{
return 0;
}
else
{
Word = End+1;
}
while (*Word == ' ' || *Word == '\t')
{
++Word;
}
if (!*Word)
{
End = 0;
return 0;
}
End = Word;
while (*End && *End != ' ' && *End != '\t')
{
++End;
}
if (!*End)
{
End = 0;
}
else
{
*End = 0;
}
return Word;
}
BOOL
IsMember(
char Item,
char * List
)
{
BOOL Mask = FALSE;
if (List[0] == '~')
{
Mask = TRUE;
}
while (*List)
{
if (Item == *List)
{
return TRUE ^ Mask;
}
++List;
}
return FALSE ^ Mask;
}
BOOL
FetchEvent(
IN ULONG_PTR RpcEvents,
IN unsigned Index,
IN struct RPC_EVENT * Entry
)
{
return GetData(RpcEvents + Index * sizeof(struct RPC_EVENT), Entry, sizeof(struct RPC_EVENT));
}
BOOL
FetchEventAddress(
IN ULONG64 RpcEvents,
IN int Index,
IN PULONG64 EntryAddress
)
{
static ULONG EntrySize = 0;
if (EntrySize == 0) {
EntrySize = GetTypeSize("RPCRT4!RPC_EVENT");
if (EntrySize == 0) {
return FALSE;
}
}
*EntryAddress = RpcEvents + Index * EntrySize;
return TRUE;
}
BOOL
DoesEntryMatch(
IN struct RPC_EVENT * Entry,
IN char * Subjects,
IN char * verbs,
IN DWORD thread,
IN ULONG_PTR addr,
IN ULONG_PTR obj_addr
)
{
if (!Entry->Subject)
{
return FALSE;
}
if (Subjects && !IsMember(Entry->Subject, Subjects))
{
return FALSE;
}
if (verbs && !IsMember(Entry->Verb, verbs))
{
return FALSE;
}
if (thread && Entry->Thread != (unsigned short) thread)
{
return FALSE;
}
if (addr && Entry->SubjectPointer != (void *) addr)
{
return FALSE;
}
if (obj_addr && Entry->ObjectPointer != (void *) obj_addr)
{
return FALSE;
}
return TRUE;
}
BOOL
DoesEntryAddressMatch(
IN ULONG64 Entry,
IN char * Subjects,
IN char * verbs,
IN DWORD thread,
IN ULONG64 addr,
IN ULONG64 obj_addr
)
{
ULONG64 tmp;
char item;
GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Subject, tmp);
if (!tmp)
{
return FALSE;
}
if (Subjects && !IsMember((char)tmp, Subjects))
{
return FALSE;
}
GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Verb, tmp);
if (verbs && !IsMember((char)tmp, verbs))
{
return FALSE;
}
GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Thread, tmp);
if (thread && tmp != (unsigned short) thread)
{
return FALSE;
}
GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, SubjectPointer, tmp);
if (addr && tmp != addr)
{
return FALSE;
}
GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, ObjectPointer, tmp);
if (obj_addr && tmp != obj_addr)
{
return FALSE;
}
return TRUE;
}
char * DgPacketTypes[] =
{
"REQ",
"PING",
"RESP",
"FAULT",
"WORKING",
"NOCALL",
"REJECT",
"ACK",
"QUIT",
"FACK",
"QUACK",
"BIND",
"BIND-ACK",
"BIND_NAK",
"ALTER-CXT",
"ALTER-RESP",
"AUTH-3",
"SHUTDOWN",
"CANCEL",
"ORPHAN"
};
char * ScallStates[] =
{
"Init",
"BeforeDispatch",
"Dispatched",
"DispatchedWithCompleteData",
"AfterDispatch",
"SendingResponse",
"Complete"
};
char * CcallStates[] =
{
"Init",
"Quiescent",
"Send",
"SendReceive",
"Receive",
"CancellingSend",
"Complete"
};
char * HandleTypeStrings[] =
{
"wmsg_cas ",
"wmsg_handle ",
"dg_ccall ",
"dg_scall ",
"dg_binding ",
"osf_ccall ",
"osf_scall ",
"osf_cconn ",
"osf_sconn ",
"osf_cassoc ",
"osf_assoc ",
"osf_address ",
"lrpc_ccall ",
"lrpc_scall ",
"lrpc_cassoc ",
"lrpc_sassoc ",
"lrpc_binding ",
"svr_binding ",
"dg_cconn ",
"dg_sconn ",
"osf_binding ",
"dg_callback ",
"dg_address ",
"lrpc_address ",
"dg_assoc "
};
char *
GetHandleType(
void * Value
)
{
int i;
for (i=0; i < sizeof(HandleTypeStrings)/sizeof(char *); ++i)
{
if ((1UL << i) == PtrToUlong(Value))
{
return HandleTypeStrings[i];
}
}
static char scratch[40];
sprintf(scratch, "refobj %p", Value);
return scratch;
}
char *
GetHandleTypeAddr(
ULONG64 Pointer
)
{
int i;
ULONG64 Value;
for (i=0; i < sizeof(HandleTypeStrings)/sizeof(char *); ++i)
{
ReadPtr(Pointer, &Value);
if ((1UL << i) == Pointer)
{
return HandleTypeStrings[i];
}
}
static char scratch[40];
sprintf(scratch, "refobj %.6x", Pointer);
return scratch;
}
int
PrintEntry(
IN struct RPC_EVENT * Entry,
IN ULONG index,
IN BOOL ShowStack
)
{
char * Subject;
char * Verb;
BOOL Printed = FALSE;
switch (Entry->Subject)
{
case SU_HANDLE : Subject = "binding "; break;
case SU_CCONN : Subject = "cconn "; break;
case SU_SCONN : Subject = "sconn "; break;
case SU_CASSOC : Subject = "cassoc "; break;
case SU_SASSOC : Subject = "sassoc "; break;
case SU_CCALL : Subject = "ccall "; break;
case SU_SCALL : Subject = "scall "; break;
case SU_PACKET : Subject = "packet "; break;
case SU_CENDPOINT: Subject = "endpnt "; break;
case SU_ENGINE : Subject = " call "; break;
case SU_ASSOC : Subject = " assoc "; break;
case SU_MUTEX : Subject = "mutex "; break;
case SU_STABLE : Subject = "sc tabl "; break;
case SU_BCACHE : Subject = "bcache "; break;
case SU_HEAP : Subject = "heap "; break;
case SU_THREAD : Subject = "thread "; break;
case SU_EVENT : Subject = "event "; break;
case SU_TRANS_CONN:Subject = "trans conn "; break;
case SU_ADDRESS : Subject = "address "; break;
case SU_EXCEPT : Subject = "exception "; break;
case SU_REFOBJ :
{
Subject = GetHandleType(Entry->ObjectPointer);
break;
}
case SU_CTXHANDLE: Subject = "ctx handle "; break;
default:
{
static char string[4];
Subject = string;
Subject[0] = '\"';
Subject[1] = Entry->Subject;
Subject[2] = '\"';
Subject[3] = '\0';
break;
}
}
dprintf("%5x: %06.6d.%03.3d/%-4x %s %p ", index, Entry->Time /1000, Entry->Time % 1000, Entry->Thread, Subject, Entry->SubjectPointer);
Verb = "(extension bug)";
switch (Entry->Verb)
{
case EV_CREATE : Verb = "create "; break;
case EV_DELETE : Verb = "delete "; break;
case EV_START : Verb = "active "; break;
case EV_STOP : Verb = "inactive "; break;
case EV_INC : Verb = "ref++ "; break;
case EV_DEC : Verb = "ref-- "; break;
case EV_ACK : Verb = "ack sent "; break;
case EV_NOTIFY : Verb = "notify "; break;
case EV_APC : Verb = "APC fired"; break;
case EV_RESOLVED : Verb = "resolved "; break;
case EV_REMOVED : Verb = "removed "; break;
case EV_CLEANUP : Verb = "cleanup "; break;
case EV_SEC_INIT1 : Verb = "init SC 1"; break;
case EV_SEC_INIT3 : Verb = "init SC 3"; break;
case EV_SEC_ACCEPT1 : Verb = "accptSC 1"; break;
case EV_SEC_ACCEPT3 : Verb = "accptSC 3"; break;
case EV_STATUS:
{
if (Entry->Subject != SU_EXCEPT)
{
if (Entry->ObjectPointer)
{
dprintf("status %lx, location %d", Entry->Data, Entry->ObjectPointer);
}
else
{
dprintf("status %lx", Entry->Data);
}
Printed = TRUE;
break;
}
else
{
dprintf("exception info: %lx, %lx, %lx", Entry->SubjectPointer, Entry->ObjectPointer, Entry->Data);
Printed = TRUE;
break;
}
}
case EV_DISASSOC : Verb = "disassoc "; break;
case EV_STATE:
{
char * state = "----";
if (Entry->Subject == SU_CCALL)
{
if (Entry->Data < DG_CCALL::CallInit ||
Entry->Data > DG_CCALL::CallComplete )
{
dprintf("unknown state 0x%x", Entry->Data);
Printed = TRUE;
}
else
{
state = CcallStates[Entry->Data - DG_CCALL::CallInit];
}
}
else
{
if (Entry->Data < DG_SCALL::CallInit ||
Entry->Data > DG_SCALL::CallComplete )
{
dprintf("unknown state 0x%x", Entry->Data);
Printed = TRUE;
}
else
{
state = ScallStates[Entry->Data - DG_SCALL::CallInit];
}
}
if (!Printed)
{
dprintf("state %s", state);
Printed = TRUE;
}
break;
}
case EV_POP : Verb = "pop "; break;
case EV_PUSH : Verb = "push "; break;
case EV_PKT_IN:
{
unsigned short frag = (unsigned short) (Entry->Data);
unsigned short ptype = (unsigned short) (Entry->Data >> 16);
char * ptypestring;
if (ptype >= sizeof(DgPacketTypes)/sizeof(DgPacketTypes[0]))
{
dprintf("recv pkt unknown type 0x%hx", ptype);
Printed = TRUE;
}
else
{
ptypestring = DgPacketTypes[ptype];
}
if (!Printed)
{
if (Entry->ObjectPointer)
{
dprintf("recv pkt %s frag %hx, location %d", ptypestring, frag, Entry->ObjectPointer);
}
else
{
dprintf("recv pkt %s frag/len %hx", ptypestring, frag);
}
Printed = TRUE;
}
break;
}
case EV_BUFFER_IN : Verb = "buf in"; break;
case EV_BUFFER_OUT: Verb = "buf out"; break;
case EV_TRANSFER: Verb = "xfer call"; break;
case EV_DROP: Verb = "dropped "; break;
case EV_DELAY: Verb = "delayed "; break;
case EV_CALLBACK: Verb = "callback "; break;
default:
{
static char string[4];
Verb = string;
Verb[0] = '\"';
Verb[1] = Entry->Verb;
Verb[2] = '\"';
Verb[3] = '\0';
break;
}
case 'p':
{
if (Entry->Subject == SU_STABLE)
{
Verb = "prune ";
}
else
{
DWORD buf[2];
buf[0] = (DWORD) Entry->Data;
buf[1] = 0;
dprintf("proc %s %p", (char *) buf, Entry->ObjectPointer);
Printed = TRUE;
}
break;
}
case EV_PKT_OUT:
{
unsigned short frag = (unsigned short) (Entry->Data);
unsigned short ptype = (unsigned short) (Entry->Data >> 16);
char * ptypestring;
if (ptype >= sizeof(DgPacketTypes)/sizeof(DgPacketTypes[0]))
{
ptypestring = "???";
}
else
{
ptypestring = DgPacketTypes[ptype];
}
dprintf("sent pkt %s frag/len %hx", ptypestring, frag);
Printed = TRUE;
break;
}
}
if (!Printed)
{
dprintf("%s %p %p", Verb, Entry->ObjectPointer, Entry->Data);
}
dprintf("\n");
int LinesPrinted = 1;
if (ShowStack && Entry->EventStackTrace[0])
{
int i;
for (i = 0; Entry->EventStackTrace[i] && i < STACKTRACE_DEPTH; i++)
{
dprintf(" ");
do_symbol((ULONG_PTR) Entry->EventStackTrace[i]);
++LinesPrinted;
}
}
return LinesPrinted;
}
int
PrintEntryAddress(
IN ULONG64 Entry,
IN int index,
IN BOOL ShowStack
)
{
char * Subject;
char * Verb;
BOOL Printed = FALSE;
ULONG tmp;
ULONG64 Time = 0;
ULONG64 Thread = 0;
ULONG64 SubjectPointer = 0;
ULONG64 ObjectPointer = 0;
ULONG64 SubjectData = 0;
ULONG64 VerbData = 0;
ULONG64 Data = 0;
ULONG64 EventStackTraceAddress =0 ;
ULONG64 EventStackTrace_0 = 0;
GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Time, Time);
GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Thread, Thread);
GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, SubjectPointer, SubjectPointer);
GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Subject, SubjectData);
GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, ObjectPointer, ObjectPointer);
GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Verb, VerbData);
GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Data, Data);
GET_ADDRESS_OF(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, EventStackTrace, EventStackTraceAddress, tmp);
ReadPtr(EventStackTraceAddress, &EventStackTrace_0);
switch ((char)SubjectData)
{
case SU_HANDLE : Subject = "binding "; break;
case SU_CCONN : Subject = "cconn "; break;
case SU_SCONN : Subject = "sconn "; break;
case SU_CASSOC : Subject = "cassoc "; break;
case SU_SASSOC : Subject = "sassoc "; break;
case SU_CCALL : Subject = "ccall "; break;
case SU_SCALL : Subject = "scall "; break;
case SU_PACKET : Subject = "packet "; break;
case SU_CENDPOINT: Subject = "endpnt "; break;
case SU_ENGINE : Subject = " call "; break;
case SU_ASSOC : Subject = " assoc "; break;
case SU_MUTEX : Subject = "mutex "; break;
case SU_STABLE : Subject = "sc tabl "; break;
case SU_BCACHE : Subject = "bcache "; break;
case SU_HEAP : Subject = "heap "; break;
case SU_THREAD : Subject = "thread "; break;
case SU_EVENT : Subject = "event "; break;
case SU_TRANS_CONN:Subject = "trans conn "; break;
case SU_ADDRESS : Subject = "address "; break;
case SU_EXCEPT : Subject = "exception "; break;
case SU_REFOBJ :
{
Subject = GetHandleTypeAddr(ObjectPointer);
break;
}
case SU_CTXHANDLE: Subject = "ctx handle "; break;
case SU_EEINFO : Subject = "EEInfo "; break;
default:
{
static char string[4];
Subject = string;
Subject[0] = '\"';
Subject[1] = (char)SubjectData;
Subject[2] = '\"';
Subject[3] = '\0';
break;
}
}
dprintf("%5x: %06.6d.%03.3d/%-4x %s %I64p ", index, (ULONG)Time / 1000, (ULONG)Time % 1000, (ULONG)Thread, Subject, SubjectPointer);
if (SubjectData != SU_EEINFO)
{
Verb = "(extension bug)";
switch ((char)VerbData)
{
case EV_CREATE : Verb = "create "; break;
case EV_DELETE : Verb = "delete "; break;
case EV_START : Verb = "active "; break;
case EV_STOP : Verb = "inactive "; break;
case EV_INC : Verb = "ref++ "; break;
case EV_DEC : Verb = "ref-- "; break;
case EV_ACK : Verb = "ack sent "; break;
case EV_NOTIFY : Verb = "notify "; break;
case EV_APC : Verb = "APC fired"; break;
case EV_RESOLVED : Verb = "resolved "; break;
case EV_REMOVED : Verb = "removed "; break;
case EV_CLEANUP : Verb = "cleanup "; break;
case EV_SEC_INIT1 : Verb = "init SC 1"; break;
case EV_SEC_INIT3 : Verb = "init SC 3"; break;
case EV_SEC_ACCEPT1 : Verb = "accptSC 1"; break;
case EV_SEC_ACCEPT3 : Verb = "accptSC 3"; break;
case EV_STATUS:
{
if ((ULONG)SubjectData != SU_EXCEPT)
{
if (VerbData)
{
dprintf("status %lx, location %d", (ULONG)Data, (ULONG)ObjectPointer);
}
else
{
dprintf("status %lx", (ULONG)Data);
}
Printed = TRUE;
break;
}
else
{
dprintf("exception info: %lx, %lx, %lx", (ULONG)SubjectPointer, (ULONG)ObjectPointer, (ULONG)Data);
Printed = TRUE;
break;
}
}
case EV_DISASSOC : Verb = "disassoc "; break;
case EV_STATE:
{
char * state = "----";
if ((ULONG)SubjectData == SU_CCALL)
{
if (Data < GetExpression("rpcrt4!DG_CCALL__CallInit") ||
Data > GetExpression("rpcrt4!DG_CCALL__CallComplete"))
{
dprintf("unknown state 0x%x", Data);
Printed = TRUE;
}
else
{
state = CcallStates[Data - GetExpression("rpcrt4!DG_CCALL__CallInit")];
}
}
else
{
if (Data < GetExpression("RPCRT4!DG_SCALL__CallInit") ||
Data > GetExpression("RPCRT4!DG_SCALL__CallComplete"))
{
dprintf("unknown state 0x%x", Data);
Printed = TRUE;
}
else
{
state = ScallStates[Data - GetExpression("RPCRT4!DG_SCALL__CallInit")];
}
}
if (!Printed)
{
dprintf("state %s", state);
Printed = TRUE;
}
break;
}
case EV_POP : Verb = "pop "; break;
case EV_PUSH : Verb = "push "; break;
case EV_PKT_IN:
{
unsigned short frag = (unsigned short) (Data);
unsigned short ptype = (unsigned short) (Data >> 16);
char * ptypestring;
if (ptype >= sizeof(DgPacketTypes)/sizeof(DgPacketTypes[0]))
{
dprintf("recv pkt unknown type 0x%hx", ptype);
Printed = TRUE;
}
else
{
ptypestring = DgPacketTypes[ptype];
}
if (!Printed)
{
if (ObjectPointer)
{
dprintf("recv pkt %s frag %hx, location %d", ptypestring, frag, (ULONG)ObjectPointer);
}
else
{
dprintf("recv pkt %s frag/len %hx", ptypestring, frag);
}
Printed = TRUE;
}
break;
}
case EV_BUFFER_IN : Verb = "buf in"; break;
case EV_BUFFER_OUT: Verb = "buf out"; break;
case EV_TRANSFER: Verb = "xfer call"; break;
case EV_DROP: Verb = "dropped "; break;
case EV_DELAY: Verb = "delayed "; break;
case EV_CALLBACK: Verb = "callback "; break;
default:
{
static char string[10];
Verb = string;
Verb[0] = '\"';
Verb[1] = (char)VerbData;
Verb[2] = '\"';
Verb[3] = '\0';
break;
}
case 'p':
{
if (SubjectData == SU_STABLE)
{
Verb = "prune ";
}
else
{
DWORD buf[2];
buf[0] = (DWORD) Data;
buf[1] = 0;
dprintf("proc %s %I64x", (char *) buf, ObjectPointer);
Printed = TRUE;
}
break;
}
case EV_PKT_OUT:
{
unsigned short frag = (unsigned short) (Data);
unsigned short ptype = (unsigned short) ((Data >> 16) & 0xFF);
unsigned short opnum = (unsigned short) (Data >> 24);
ULONG CallId = (ULONG)ObjectPointer;
char * ptypestring;
if (ptype >= sizeof(DgPacketTypes)/sizeof(DgPacketTypes[0]))
{
ptypestring = "???";
}
else
{
ptypestring = DgPacketTypes[ptype];
}
if (opnum)
{
dprintf("sent p %s fr/len %hx op# %d cid %d", ptypestring, frag, opnum, CallId);
}
else
{
dprintf("sent p %s fr/len %hx cid %d", ptypestring, frag, CallId);
}
Printed = TRUE;
break;
}
}
}
else
{
// this is an eeinfo record
dprintf("GC %d St %d DL %d P#1 %d", (ULONG)VerbData, (ULONG)SubjectPointer, (ULONG)ObjectPointer, (ULONG)Data);
Printed = TRUE;
}
if (!Printed)
{
dprintf("%s %I64p %I64p", Verb, ObjectPointer, Data);
}
dprintf("\n");
int LinesPrinted = 1;
if (ShowStack && EventStackTrace_0)
{
int i = 0;
ULONG64 StackEntry = 0;
do {
ReadPtr(EventStackTraceAddress + i * AddressSize, &StackEntry);
dprintf(" ");
do_symbol(StackEntry);
++LinesPrinted;
++i;
}
while (StackEntry && i < STACKTRACE_DEPTH);
}
return LinesPrinted;
}
void scan_usage()
{
dprintf("options:\n"
"\n"
" -sXYZ print entries with subject character == X or Y or Z\n"
" -vXYZ print entries with verb character == X or Y or Z\n"
" -s~XYZ print entries with subject character != X or Y or Z\n"
" -v~XYZ print entries with verb character != X or Y or Z\n"
" -t NNNN print entries for thread NNNN \n"
" -a NNNN print entries for subject at address NNNN \n"
" -o NNNN print entries for object at address NNNN \n"
" -k or -k+ show stack traces if available\n"
" -k- don't show stack traces (default)\n"
" -b NNNN1 NNNN2 NNNN3 \n"
" (if symbols are broken) RpcEvents is at NNNN1"
" and NextEvent is NNNN2\n"
" and event array length is NNNN3\n"
" -NNNN print the NNNN entries ending with NextEvent (or specified base)\n"
" +NNNN print the NNNN entries starting with NextEvent (or specified base)\n"
" NNNN the base index is NNNN"
" -f filename reads a binary version of the log and displays it as text\n"
"\n"
"e.g. '!scan -40 -sN' would print the last 40 DG_SCONNECTION events\n"
" '!scan +30 200' would print 30 entries starting at index 200\n"
);
}
char VerbsToDisplay[40];
char SubjectsToDisplay[40];
DECLARE_API( scan )
{
char * Subject = 0;
char * verb = 0;
ULONG64 addr = 0;
ULONG64 obj_addr = 0;
DWORD thread = 0;
static ULONG64 RpcEvents = 0;
static LONG EventArrayLength = 0;
static LONG NextEvent = 0;
int RequestCount = 30;
int NextEventToPrint = 0;
BOOL ForwardSearch = FALSE;
BOOL ShowStackTraces = FALSE;
BOOL Wrapped = FALSE;
int BaseIndex = -1;
int MatchCount = 0;
int index;
int i;
BOOL fFileInput = FALSE;
HANDLE hFile;
struct RPC_EVENT Entry;
ULONG64 EntryAddress;
ULONG64 tmp;
//
// Interpret options.
//
char * arg;
LPSTR lpArgumentString = (LPSTR)args;
for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
{
if (arg[0] == '-')
{
++arg;
switch (arg[0])
{
case 's':
{
if (!arg[1])
{
scan_usage();
return;
}
if (strlen(arg+1) >= sizeof(SubjectsToDisplay))
{
dprintf("-s: too many subject types proposed\n");
return;
}
strcpy(SubjectsToDisplay, arg+1);
Subject = SubjectsToDisplay;
if (Subject[0] == '*')
{
Subject = 0;
}
break;
}
case 'v':
{
if (!arg[1])
{
scan_usage();
return;
}
if (strlen(arg+1) >= sizeof(VerbsToDisplay))
{
dprintf("-v: too many verbs proposed\n");
return;
}
strcpy(VerbsToDisplay, arg+1);
verb = VerbsToDisplay;
if (verb[0] == '*')
{
verb = 0;
}
break;
}
case 'a':
{
if (arg[1])
{
scan_usage();
return;
}
arg = strtok(0);
if (!arg)
{
dprintf("-a: no object address specified\n");
return;
}
addr = GetExpression(arg);
if (!addr)
{
dprintf("-a: can't evaluate %s\n", arg);
return;
}
break;
}
case 'o':
{
if (arg[1])
{
scan_usage();
return;
}
arg = strtok(0);
if (!arg)
{
dprintf("-o: no object address specified\n");
return;
}
obj_addr = GetExpression(arg);
if (!obj_addr)
{
dprintf("-o: can't evaluate %s\n", arg);
return;
}
break;
}
case 't':
{
if (arg[1])
{
scan_usage();
return;
}
arg = strtok(0);
if (!arg)
{
dprintf("-t: no thread ID specified\n");
return;
}
thread = (DWORD) GetExpression(arg);
if (!thread)
{
dprintf("-t: can't evaluate %s\n", arg);
return;
}
break;
}
case 'b':
{
arg = strtok(0);
if (!arg)
{
dprintf("-b: no base address specified\n");
return;
}
RpcEvents = GetExpression(arg);
arg = strtok(0);
if (!arg)
{
dprintf("-b: no NextEvent specified\n");
return;
}
NextEvent = (LONG) GetExpression(arg);
arg = strtok(0);
if (!arg)
{
dprintf("-b: no event array length specified\n");
return;
}
EventArrayLength = (long) GetExpression(arg);
break;
}
case 'k':
{
if (arg[1] == '+' ||
arg[1] == '\0')
{
ShowStackTraces = TRUE;
}
else if (arg[1] == '-')
{
ShowStackTraces = FALSE;
}
else
{
dprintf("-k: use '-k' or '-k+' for stack traces, '-k-' for none\n");
return;
}
break;
}
case 'f':
{
arg = strtok(0);
if (!arg)
{
dprintf("-f: no file name specified\n");
return;
}
hFile = CreateFileA(arg, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile == INVALID_HANDLE_VALUE)
{
dprintf("-f: Couldn't open file name %s - error %d\n", arg, GetLastError());
return;
}
fFileInput = TRUE;
}
break;
case '0':
case '1':
case '2':
case '3':
case '4':
case '5':
case '6':
case '7':
case '8':
case '9':
{
ForwardSearch = FALSE;
RequestCount = myatol(arg);
if (!RequestCount)
{
dprintf("-%s: zero lines specified\n", arg);
return;
}
break;
}
default:
{
dprintf("unknown option %s\n", arg);
scan_usage();
return;
}
}
}
else if (arg[0] == '+')
{
++arg;
RequestCount = myatol(arg);
if (!RequestCount)
{
dprintf("+%s: zero lines specified\n", arg);
return;
}
MatchCount = RequestCount;
ForwardSearch = TRUE;
}
else
{
BaseIndex = (int) GetExpression(arg);
}
}
if (fFileInput)
{
BOOL Result;
DWORD NumberOfBytesRead;
index = 1;
while (1)
{
Result = ReadFile(hFile, &Entry, sizeof(Entry), &NumberOfBytesRead, NULL);
if (!Result)
{
dprintf("-f: Error reading file: %d\n", GetLastError());
break;
}
if (NumberOfBytesRead < sizeof(Entry))
{
dprintf("-f: EOF reached\n");
break;
}
PrintEntry(&Entry, index, ShowStackTraces);
index ++;
if ((CheckControlC)())
{
CloseHandle(hFile);
return;
}
}
CloseHandle(hFile);
return;
}
ULONG64 NextEventAddress = GetExpression("rpcrt4!NextEvent");
ULONG64 EventLengthAddress = GetExpression("rpcrt4!EventArrayLength");
//
// Find the current event.
//
if (!RpcEvents)
{
RpcEvents = GetExpression("rpcrt4!RpcEvents");
if (!RpcEvents || !NextEventAddress)
{
dprintf("I can't find rpcrt4!RpcEvents or rpcrt4!NextEvent; use -b\n");
return;
}
if (!ReadMemory(NextEventAddress, &NextEvent, sizeof(DWORD), 0))
{
dprintf("I can't read NextEvent from 0x%I64x\n", NextEventAddress);
return;
}
if (EventLengthAddress)
{
if (!ReadMemory(EventLengthAddress, &EventArrayLength, sizeof(DWORD), 0))
{
dprintf("I can't read EventArrayLength from 0x%I64x\n", EventLengthAddress);
return;
}
if (!ReadMemory(RpcEvents, &tmp, sizeof(ULONG64), 0))
{
dprintf("I can't read rpcrt4!RpcEvents at 0x%I64x\n", RpcEvents);
return;
}
RpcEvents = tmp;
}
else
{
dprintf("rpcrt4!EventArrayLength isn't defined; probably an older build\n");
EventArrayLength = 4096;
}
dprintf("RpcEvents at 0x%I64x; array has %u entries; NextEvent = %lx, %s\n",
RpcEvents, EventArrayLength, NextEvent, Wrapped ? "wrapped around" : "");
}
if (FALSE == FetchEventAddress(RpcEvents, 0, &EntryAddress))
{
dprintf("I can't read memory at 0x%I64x \n", RpcEvents);
return;
}
GET_MEMBER(EntryAddress, RPC_EVENT, RPCRT4!RPC_EVENT, Subject, tmp);
if (tmp)
{
Wrapped = TRUE;
}
if (thread || Subject || verb || addr || obj_addr)
{
dprintf("filter: ");
}
else
{
dprintf("no filter");
}
if (thread)
{
dprintf("thread %x ", thread);
}
if (Subject)
{
dprintf("subjects '%s' ", Subject);
}
if (verb)
{
dprintf("verbs '%s' ", verb);
}
if (addr)
{
dprintf("address %x ", addr);
}
if (obj_addr)
{
dprintf("direct-object address 0x%I64x ", obj_addr);
}
dprintf(", base index = %x\n", BaseIndex);
// Allow one set of debug spew to be printed if some data can't
// be properly read or fields extracted.
fSpew = TRUE;
//
// Scan backwards until we have enough matching events.
//
if (NextEvent > EventArrayLength)
{
NextEvent %= EventArrayLength;
}
if (ForwardSearch)
{
if (BaseIndex == -1)
{
BaseIndex = NextEventToPrint;
}
if (!Wrapped && BaseIndex + MatchCount > NextEvent+1)
{
MatchCount = NextEvent+1 - BaseIndex;
}
}
else
{
if (BaseIndex == -1)
{
BaseIndex = NextEvent;
}
LONG Point = BaseIndex;
for (index = Point; index >= 0 && MatchCount < RequestCount; --index )
{
if (FALSE == FetchEventAddress(RpcEvents, index, &EntryAddress))
{
dprintf("I can't read memory at index %x\n", index);
return;
}
if (DoesEntryAddressMatch(EntryAddress, Subject, verb, thread, addr, obj_addr))
{
++MatchCount;
BaseIndex = index;
}
}
if (Wrapped && MatchCount < RequestCount)
{
for (index = EventArrayLength-1; index > Point && MatchCount < RequestCount; --index )
{
ULONG64 EntryAddress;
if (FALSE == FetchEventAddress(RpcEvents, index, &EntryAddress))
{
dprintf("I can't read memory at index %d\n", index);
return;
}
if (DoesEntryAddressMatch(EntryAddress, Subject, verb, thread, addr, obj_addr))
{
++MatchCount;
BaseIndex = index;
}
}
}
}
//
// Print matching events.
//
index = BaseIndex;
do
{
if (FALSE == FetchEventAddress(RpcEvents, index, &EntryAddress))
{
dprintf("I can't read memory at index %x\n", index);
return;
}
if (DoesEntryAddressMatch(EntryAddress, Subject, verb, thread, addr, obj_addr))
{
PrintEntryAddress(EntryAddress, index, ShowStackTraces);
--MatchCount;
}
++index;
index = index % EventArrayLength;
if ((CheckControlC)())
{
return;
}
}
while (MatchCount && index != BaseIndex);
NextEventToPrint = index;
}
DECLARE_API( rpcsleep )
{
int nInterval;
LPSTR lpArgumentString = (LPSTR)args;
nInterval=atoi(lpArgumentString);
if (nInterval == 0)
{
dprintf("Invalid wait interval %s\n", lpArgumentString);
return;
}
Sleep(nInterval);
}
DECLARE_API( rpctime )
{
DWORD dwCurrentTime;
if (fKD)
{
dprintf("Cannot dump time in kd\n");
return;
}
dwCurrentTime = GetTickCount();
dprintf("Current time is: %06.6d.%03.3d (0x%06.6x.%03.3x)\n", dwCurrentTime / 1000, dwCurrentTime % 1000,
dwCurrentTime / 1000, dwCurrentTime % 1000);
}
DECLARE_API( version )
{
#if DBG
PCSTR kind = "Checked";
#else
PCSTR kind = "Free";
#endif
if (fKD)
{
dprintf(
"%s RPC Extension dll for Build %d debugging %s kernel for Build %d\n",
kind,
VER_PRODUCTBUILD,
SavedMajorVersion == 0x0c ? "Checked" : "Free",
SavedMinorVersion
);
}
else
{
dprintf(
"%s RPC Extension dll for Build %d\n",
kind,
VER_PRODUCTBUILD
);
}
}
DECLARE_API( bcache )
{
ULONG64 tmp1;
ULONG tmp2;
ULONG64 StateArray = 0;
// For process cache
ULONG64 Cache;
ULONG64 CacheAddress;
BOOL b, fGuardPageMode = FALSE;
//
// Interpret options.
//
char * arg1;
char * arg2;
LPSTR lpArgumentString = (LPSTR)args;
arg1 = strtok(lpArgumentString);
arg2 = strtok(0);
if (arg2)
{
dprintf("usage: \n"
" !bcache <TEB-address> for a thread's cache\n"
" !bcache for the process cache\n"
"\n");
return;
}
if (arg1)
{
ULONG64 RpcThread;
ULONG64 pTeb = GetExpression(arg1);
GET_MEMBER(pTeb, TEB, TEB, ReservedForNtRpc, RpcThread);
GET_ADDRESS_OF(RpcThread, THREAD, RPCRT4!THREAD, BufferCache, StateArray, tmp2);
}
else
{
ULONG64 CachePointerAddress = GetExpression("rpcrt4!gBufferCache");
if (!CachePointerAddress)
{
dprintf("can't find rpcrt4!gBufferCache\n");
return;
}
b = GetData(CachePointerAddress, &CacheAddress, sizeof(PVOID));
if ( !b )
{
dprintf("couldn't read process buffer cache pointer at %x\n", CacheAddress);
return;
}
dprintf("process-wide buffer cache:\n");
ULONG64 GuardPageMode = GetExpression("rpcrt4!fGuardPageMode");
if(GuardPageMode)
b = GetData(GuardPageMode, &fGuardPageMode, sizeof(fGuardPageMode));
if (!b)
{
dprintf("couldn't read guard page mode flag at address %p\n", GuardPageMode);
return;
}
if (fGuardPageMode)
{
dprintf("---> GUARD PAGE mode enabled!\n");
}
GET_ADDRESS_OF(CacheAddress, BCACHE, RPCRT4!BCACHE, _bcGlobalState, StateArray, tmp2);
}
//
// Load the size hints.
//
ULONG64 HintAddress;
HintAddress = GetExpression("rpcrt4!pHints");
ReadPtr(HintAddress, &HintAddress);
//
// Dump the buffer states.
//
int i;
ULONG64 State = StateArray;
ULONG64 Hint = HintAddress;
ULONG64 cBlocks;
ULONG64 pList;
ULONG64 cSize;
for (i=0; i < 4; ++i)
{
GET_MEMBER(State, BCACHE_STATE, RPCRT4!BCACHE_STATE, cBlocks, cBlocks);
GET_MEMBER(State, BCACHE_STATE, RPCRT4!BCACHE_STATE, pList, pList);
GET_MEMBER(Hint, BUFFER_CACHE_HINTS, RPCRT4!BUFFER_CACHE_HINTS, cSize, cSize);
dprintf(" count %5u head %I64x size %5x\n",
(ULONG)cBlocks,
pList,
(ULONG)cSize);
State += GET_TYPE_SIZE(BCACHE_STATE, RPCRT4!BCACHE_STATE);
Hint += GET_TYPE_SIZE(BUFFER_CACHE_HINTS, RPCRT4!BUFFER_CACHE_HINTS);
}
if (!arg1)
{
ULONG64 _bcGlobalStats;
GET_ADDRESS_OF(CacheAddress, BCACHE, RPCRT4!BCACHE, _bcGlobalStats, _bcGlobalStats, tmp2);
// Dump out the bcache cache stats
dprintf("\nGlobal Stats:\n cap hits misses\n");
for (i = 0; i < ((fGuardPageMode) ? 2 : 4); i++)
{
ULONG64 cBufferCacheCap;
ULONG64 cAllocationHits;
ULONG64 cAllocationMisses;
GET_MEMBER(_bcGlobalStats, BCACHE_STATS, RPCRT4!BCACHE_STATS, cBufferCacheCap, cBufferCacheCap);
GET_MEMBER(_bcGlobalStats, BCACHE_STATS, RPCRT4!BCACHE_STATS, cAllocationHits, cAllocationHits);
GET_MEMBER(_bcGlobalStats, BCACHE_STATS, RPCRT4!BCACHE_STATS, cAllocationMisses, cAllocationMisses);
dprintf(" %5d %5d %5d\n",
cBufferCacheCap,
cAllocationHits,
cAllocationMisses);
_bcGlobalStats += GET_TYPE_SIZE(BCACHE_STATS, RPCRT4!BCACHE_STATS);
}
}
}
VOID
CheckVersion(
VOID
)
{
}
LPEXT_API_VERSION
ExtensionApiVersion(
VOID
)
{
return &ApiVersion;
}
void PrintGetCallInfoUsage(void)
{
dprintf("Usage: \n\tgetcallinfo [CallID|0 [IfStart|0 [ProcNum|FFFF [ProcessID|0]]]]\n");
}
DECLARE_API( getcallinfo )
{
ULONG CallID = 0;
ULONG IfStart = 0;
USHORT ProcNum = RPCDBG_NO_PROCNUM_SPECIFIED;
ULONG ProcessID = 0;
int ArgumentNo = 0;
//
// Interpret options.
//
char * arg;
if (fKD != 0)
{
dprintf("This extension command does not work under kd\n");
return;
}
LPSTR lpArgumentString = (LPSTR)args;
for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
{
switch(ArgumentNo)
{
case 0:
// either help or CallID
if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
{
PrintGetCallInfoUsage();
return;
}
else
{
CallID = (ULONG)GetExpression(arg);
}
break;
case 1:
IfStart = (ULONG)GetExpression(arg);
break;
case 2:
ProcNum = (unsigned short) GetExpression(arg);
break;
case 3:
ProcessID = (ULONG)GetExpression(arg);
break;
default:
dprintf("Too many arguments\n");
PrintGetCallInfoUsage();
}
ArgumentNo ++;
}
GetAndPrintCallInfo(CallID, IfStart, ProcNum, ProcessID, dprintf);
}
void PrintGetDbgCellUsage(void)
{
dprintf("Usage: \n\tgetdbgcell ProcessID CellID1.CellID2\n");
}
DECLARE_API( getdbgcell )
{
ULONG ProcessID = 0;
int ArgumentNo = 0;
DebugCellID CellID;
char *DotSeparator;
//
// Interpret options.
//
char * arg;
if (fKD != 0)
{
dprintf("This extension command does not work under kd\n");
return;
}
LPSTR lpArgumentString = (LPSTR)args;
for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
{
switch(ArgumentNo)
{
case 0:
// either help or ProcessID
if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
{
PrintGetCallInfoUsage();
return;
}
else
{
ProcessID = (ULONG)GetExpression(arg);
}
break;
case 1:
DotSeparator = strchr(arg, '.');
if (DotSeparator == NULL)
{
PrintGetCallInfoUsage();
return;
}
*DotSeparator = 0;
DotSeparator ++;
CellID.SectionID = (USHORT)GetExpression(arg);
CellID.CellID = (USHORT)GetExpression(DotSeparator);
break;
default:
dprintf("Too many arguments\n");
PrintGetDbgCellUsage();
}
ArgumentNo ++;
}
GetAndPrintDbgCellInfo(ProcessID, CellID, dprintf);
}
void PrintGetEndpointInfoUsage(void)
{
dprintf("Usage: \n\tgetendpointinfo [EndpointName]\n");
}
DECLARE_API( getendpointinfo )
{
int ArgumentNo = 0;
char *EndpointName = NULL;
//
// Interpret options.
//
char * arg;
if (fKD != 0)
{
dprintf("This extension command does not work under kd\n");
return;
}
LPSTR lpArgumentString = (LPSTR)args;
for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
{
switch(ArgumentNo)
{
case 0:
// either help or EndpointName
if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
{
PrintGetEndpointInfoUsage();
return;
}
else
{
EndpointName = arg;
}
break;
default:
dprintf("Too many arguments\n");
PrintGetCallInfoUsage();
}
ArgumentNo ++;
}
GetAndPrintEndpointInfo(EndpointName, dprintf);
}
void PrintGetThreadInfoUsage(void)
{
dprintf("Usage: \n\tgetthreadinfo ProcessID [ThreadID]\n");
}
DECLARE_API( getthreadinfo )
{
DWORD ProcessID = 0;
DWORD ThreadID = 0;
int ArgumentNo = 0;
BOOL fFirstTime = TRUE;
//
// Interpret options.
//
char * arg;
if (fKD != 0)
{
dprintf("This extension command does not work under kd\n");
return;
}
LPSTR lpArgumentString = (LPSTR)args;
for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
{
switch(ArgumentNo)
{
case 0:
// either help or EndpointName
if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
{
PrintGetThreadInfoUsage();
return;
}
else
{
ProcessID = (DWORD)GetExpression(arg);
}
fFirstTime = FALSE;
break;
case 1:
ThreadID = (DWORD)GetExpression(arg);
break;
default:
dprintf("Too many arguments\n");
PrintGetThreadInfoUsage();
}
ArgumentNo ++;
}
if (fFirstTime)
{
dprintf("You must specify at least a process id\n");
PrintGetThreadInfoUsage();
return;
}
GetAndPrintThreadInfo(ProcessID, ThreadID, dprintf);
}
void PrintGetClientCallInfoUsage(void)
{
dprintf("Usage: \n\tgetclientcallinfo [CallID|0 [IfStart|0 [ProcNum|FFFF [ProcessID|0]]]]\n");
}
DECLARE_API( getclientcallinfo )
{
ULONG CallID = 0;
ULONG IfStart = 0;
USHORT ProcNum = RPCDBG_NO_PROCNUM_SPECIFIED;
ULONG ProcessID = 0;
int ArgumentNo = 0;
//
// Interpret options.
//
char * arg;
if (fKD != 0)
{
dprintf("This extension command does not work under kd\n");
return;
}
LPSTR lpArgumentString = (LPSTR)args;
for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
{
switch(ArgumentNo)
{
case 0:
// either help or CallID
if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
{
PrintGetClientCallInfoUsage();
return;
}
else
{
CallID = (ULONG)GetExpression(arg);
}
break;
case 1:
IfStart = (ULONG)GetExpression(arg);
break;
case 2:
ProcNum = (USHORT)GetExpression(arg);
break;
case 3:
ProcessID = (ULONG)GetExpression(arg);
break;
default:
dprintf("Too many arguments\n");
PrintGetCallInfoUsage();
}
ArgumentNo ++;
}
GetAndPrintClientCallInfo(CallID, IfStart, ProcNum, ProcessID, dprintf);
}
DECLARE_API( checkrpcsym )
{
PVOID FunctionPtr;
DWORD Data;
BOOL b;
BOOL fUnsure = FALSE;
const int ExpectedDataSize = 3;
const DWORD ExpectedData[3] = {0x55, 0x8B, 0xEC};
const int FunctionNamesSize = 2;
const char *FunctionNames[2] = {"RPCRT4!WS_NewConnection", "RPCRT4!OSF_ADDRESS__NewConnection"};
int i, FunctionNo;
for (FunctionNo = 0; FunctionNo < FunctionNamesSize; FunctionNo ++)
{
FunctionPtr = (PVOID)GetExpression(FunctionNames[FunctionNo]);
if (FunctionPtr == NULL)
{
dprintf("Cannot find address of %s - RPC symbols are wrong\n",
FunctionNames[FunctionNo]);
return;
}
b = GetData(HandleToUlong(FunctionPtr), &Data, sizeof(DWORD));
if (!b)
{
// under UM debugger this is bad symbols
if (fKD == 0)
{
dprintf("Cannot access address %x - RPC symbols are wrong\n", FunctionPtr);
return;
}
// in kd this is possible even with valid symbols
fUnsure = TRUE;
}
else
{
for (i = 0; i < ExpectedDataSize; i ++)
{
if ((Data & 0xFF) != ExpectedData[i])
{
dprintf("Function %s does not have expected "
"contents () - non-X86 architecture or RPC symbols are wrong\n",
FunctionNames[FunctionNo], Data & 0xFF, ExpectedData[i]);
return;
}
Data >>= 8;
}
}
}
if (fUnsure)
{
dprintf("The correctness of RPC symbols could not be determined conclusively\n");
}
else
{
dprintf("RPC symbols are correct\n");
}
}
typedef struct tagCallStackPatternMatch
{
const char *FunctionBase;
int ValueOffset; // 0 if the value is not relative to this symbols, or
// any positive/negative if the value is relative to
// this symbol
} CallStackPatternMatch;
typedef struct tagStackGroupPattern
{
CallStackPatternMatch *StackPattern;
int NumberOfEntries;
} StackGroupPattern;
CallStackPatternMatch WS_CallStack1[] = {{"kernel32!WaitForSingleObjectEx", 0},
{"rpcrt4!UTIL_WaitForSyncIO", 0},
{"rpcrt4!WS_SyncRecv", 0},
{"rpcrt4!WS_SyncRecv", 0},
{"rpcrt4!OSF_CCONNECTION__TransSendReceive", 0},
{"rpcrt4!OSF_CCONNECTION__SendFragment", 0},
{"rpcrt4!OSF_CCALL__SendNextFragment", 0},
{"rpcrt4!OSF_CCALL__FastSendReceive", 0},
{"rpcrt4!OSF_CCALL__SendReceiveHelper", 0},
{"rpcrt4!OSF_CCALL__SendReceive", 0},
{"rpcrt4!I_RpcSendReceive", 0},
{"rpcrt4!NdrSendReceive", sizeof(PVOID)}};
CallStackPatternMatch WS_CallStack2[] = {{"kernel32!WaitForSingleObjectEx", 0},
{"rpcrt4!UTIL_WaitForSyncIO", 0},
{"rpcrt4!UTIL_GetOverlappedResultEx", 0},
{"rpcrt4!WS_SyncRecv", 0},
{"rpcrt4!OSF_CCONNECTION__TransSendReceive", 0},
{"rpcrt4!OSF_CCONNECTION__SendFragment", 0},
{"rpcrt4!OSF_CCALL__SendNextFragment", 0},
{"rpcrt4!OSF_CCALL__FastSendReceive", 0},
{"rpcrt4!OSF_CCALL__SendReceiveHelper", 0},
{"rpcrt4!OSF_CCALL__SendReceive", 0},
{"rpcrt4!I_RpcSendReceive", 0},
{"rpcrt4!NdrSendReceive", sizeof(PVOID)}};
CallStackPatternMatch NMP_CallStack1[] = {{"kernel32!WaitForSingleObjectEx", 0},
{"rpcrt4!UTIL_WaitForSyncIO", 0},
{"rpcrt4!UTIL_GetOverlappedResultEx", 0},
{"rpcrt4!NMP_SyncSendRecv", 0},
{"rpcrt4!OSF_CCONNECTION__TransSendReceive", 0},
{"rpcrt4!OSF_CCONNECTION__SendFragment", 0},
{"rpcrt4!OSF_CCALL__SendNextFragment", 0},
{"rpcrt4!OSF_CCALL__FastSendReceive", 0},
{"rpcrt4!OSF_CCALL__SendReceiveHelper", 0},
{"rpcrt4!OSF_CCALL__SendReceive", 0},
{"rpcrt4!I_RpcSendReceive", 0},
{"rpcrt4!NdrSendReceive", sizeof(PVOID)}};
CallStackPatternMatch LRPC_CallStack1[] = {{"rpcrt4!LRPC_CCALL__SendReceive", 0},
{"rpcrt4!I_RpcSendReceive", 0},
{"rpcrt4!NdrSendReceive", sizeof(PVOID)}};
const int NumberOfWsCallStacks = 2;
StackGroupPattern WS_CallStacks[] = {{WS_CallStack1, 12}, {WS_CallStack2, 12}};
const int NumberOfNmpCallStacks = 1;
StackGroupPattern NMP_CallStacks[] = {{NMP_CallStack1, 12}};
const int NumberOfLrpcCallStacks = 1;
StackGroupPattern LRPC_CallStacks[] = {{LRPC_CallStack1, 3}};
ULONG_PTR Buffer[40];
ULONG_PTR *LastPos = NULL;
int BufferPos = 0;
BOOL VerboseStack = FALSE;
BOOL GetStackValue(ULONG_PTR *CurrentPos, ULONG_PTR *Value)
{
BOOL Result;
// if we keep fetching the same data, and we still have data in the
// buffer, keep going
if (((CurrentPos - 1) == LastPos) && ((BufferPos + 1) < (sizeof(Buffer) / sizeof(Buffer[0]))))
{
LastPos = CurrentPos;
BufferPos ++;
*Value = Buffer[BufferPos];
return TRUE;
}
// either we started a new search, or we exhausted the fetched data -
// fetch new data
Result = GetData((ULONG_PTR)CurrentPos, Buffer, sizeof(Buffer));
// there may be not be enough readable data for the whole buffer -
// switch to slow mode and fetch them one by one
if (Result == FALSE)
{
Result = GetData((ULONG_PTR)CurrentPos, Value, sizeof(ULONG_PTR));
if (Result == FALSE)
return FALSE;
else
return TRUE;
}
// data were successfully fetched to the buffer
LastPos = CurrentPos;
BufferPos = 0;
*Value = Buffer[0];
return TRUE;
}
BOOL MatchStack(IN PVOID StackStart, IN StackGroupPattern *StackGroup,
IN int NumberOfElementsInGroup, OUT ULONG_PTR *Value)
{
int i;
BOOL Result;
ULONG_PTR CurrentPos;
ULONG_PTR CurrentValue;
ULONG_PTR Displacement;
int StackPatternPos; // the next stack entry to match
ULONG_PTR FinalValue = 0;
int ValueOffset;
CHAR CurrentName[256];
for (i = 0; i < NumberOfElementsInGroup; i ++)
{
CurrentPos = (ULONG_PTR)StackStart;
StackPatternPos = 0;
while (TRUE)
{
Result = GetStackValue((ULONG_PTR *)CurrentPos, &CurrentValue);
if (Result == FALSE)
goto NextStack;
GetSymbol((ULONG64)CurrentValue, CurrentName, (PULONG64)&Displacement);
if (RpcpStringCompareA((const char *)CurrentName, StackGroup[i].StackPattern[StackPatternPos].FunctionBase) == 0)
{
if (VerboseStack)
{
dprintf("Stack: %d: Match with '%s'\n", i, CurrentName);
}
ValueOffset = StackGroup[i].StackPattern[StackPatternPos].ValueOffset;
if (ValueOffset != 0)
{
Result = GetData(CurrentPos + ValueOffset, &FinalValue,
sizeof(ULONG_PTR));
if (Result == FALSE)
goto NextStack;
}
StackPatternPos ++;
if (StackPatternPos >= StackGroup[i].NumberOfEntries)
{
// full stack match - return success
ASSERT(FinalValue != 0);
*Value = FinalValue;
return TRUE;
}
}
CurrentPos += sizeof(ULONG_PTR);
}
NextStack:
;
}
return FALSE;
}
BOOL GetDataFromRpcMessage(IN ULONG_PTR RpcMessage, OUT ULONG_PTR *CallObject,
OUT DWORD *IfStart, OUT USHORT *ProcNum)
{
BOOL Result;
union
{
RPC_MESSAGE RpcMessage;
RPC_CLIENT_INTERFACE Interface;
} MemLoc;
ULONG_PTR Interface;
Result = GetData(RpcMessage, (PVOID) &MemLoc.RpcMessage, sizeof(MemLoc.RpcMessage));
if (Result == FALSE)
return FALSE;
*CallObject = (ULONG_PTR)MemLoc.RpcMessage.Handle;
*ProcNum = (USHORT)MemLoc.RpcMessage.ProcNum;
Interface = (ULONG_PTR)MemLoc.RpcMessage.RpcInterfaceInformation;
Result = GetData(Interface, &MemLoc.Interface, sizeof(MemLoc.Interface));
if (Result == FALSE)
return FALSE;
*IfStart = MemLoc.Interface.InterfaceId.SyntaxGUID.Data1;
return TRUE;
}
BOOL PrintDceBinding(ULONG_PTR DceBindingPointer)
{
NO_CONSTRUCTOR_TYPE(DCE_BINDING, DceBinding);
RPC_CHAR *RpcProtocolSequence;
RPC_CHAR *NetworkAddress;
RPC_CHAR *Endpoint;
BOOL Result;
Result = GetData(DceBindingPointer, DceBinding, sizeof(DCE_BINDING));
if (Result == FALSE)
return FALSE;
RpcProtocolSequence = ReadProcessRpcChar((ULONG64)DceBinding->RpcProtocolSequence);
NetworkAddress = ReadProcessRpcChar((ULONG64)DceBinding->NetworkAddress);
Endpoint = ReadProcessRpcChar((ULONG64)DceBinding->Endpoint);
if ((RpcProtocolSequence == NULL) && (NetworkAddress == NULL)
&& (Endpoint == NULL))
{
return FALSE;
}
dprintf("\tProtocol Sequence: \t\"%ws\"\t(Address: %p)\n", RpcProtocolSequence, DceBinding->RpcProtocolSequence);
dprintf("\tNetworkAddress:\t\t\"%ws\"\t(Address: %p)\n", NetworkAddress, DceBinding->NetworkAddress);
dprintf("\tEndpoint:\t\t\"%ws\" \t(Address: %p)\n", Endpoint, DceBinding->Endpoint);
delete RpcProtocolSequence;
delete NetworkAddress;
delete Endpoint;
return TRUE;
}
BOOL PrintOsfCallInfoFromRpcMessage(ULONG_PTR RpcMessage)
{
ULONG_PTR CallObject;
BOOL Result;
NO_CONSTRUCTOR_TYPE(OSF_CCALL, OsfCCall);
DWORD CallID;
DWORD IfStart;
USHORT ProcNum;
ULONG_PTR ConnPointer;
ULONG_PTR AssocPointer;
ULONG_PTR DceBindingPointer;
Result = GetDataFromRpcMessage(RpcMessage, &CallObject, &IfStart, &ProcNum);
if (Result == FALSE)
return FALSE;
Result = GetData(CallObject, OsfCCall, sizeof(OSF_CCALL));
if (Result == FALSE)
return FALSE;
CallID = OsfCCall->CallId;
dprintf("CallID: %d\n", CallID);
dprintf("IfStart: %x\n", IfStart);
dprintf("ProcNum: %d\n", (int)ProcNum);
ConnPointer = (ULONG_PTR)OsfCCall->Connection;
// get the association pointer
Result = GetData(ConnPointer + FIELD_OFFSET(OSF_CCONNECTION, Association), &AssocPointer,
sizeof(ULONG_PTR));
if (Result == FALSE)
return FALSE;
// get the dcebinding pointer
Result = GetData(AssocPointer + FIELD_OFFSET(OSF_CASSOCIATION, DceBinding), &DceBindingPointer,
sizeof(ULONG_PTR));
if (Result == FALSE)
return FALSE;
// print the DCE binding info
PrintDceBinding(DceBindingPointer);
return TRUE;
}
BOOL PrintLrpcCallInfoFromRpcMessage(ULONG_PTR RpcMessage)
{
ULONG_PTR CallObject;
BOOL Result;
NO_CONSTRUCTOR_TYPE(LRPC_CCALL, LrpcCCall);
DWORD CallID;
DWORD IfStart;
USHORT ProcNum;
ULONG_PTR AssocPointer;
ULONG_PTR DceBindingPointer;
Result = GetDataFromRpcMessage(RpcMessage, &CallObject, &IfStart, &ProcNum);
if (Result == FALSE)
return FALSE;
Result = GetData(CallObject, LrpcCCall, sizeof(LRPC_CCALL));
if (Result == FALSE)
return FALSE;
CallID = LrpcCCall->CallId;
dprintf("CallID: %d\n", CallID);
dprintf("IfStart: %x\n", IfStart);
dprintf("ProcNum: %d\n", (int)ProcNum);
AssocPointer = (ULONG_PTR)LrpcCCall->Association;
// get the dcebinding pointer
Result = GetData(AssocPointer + FIELD_OFFSET(LRPC_CASSOCIATION, DceBinding), &DceBindingPointer,
sizeof(ULONG_PTR));
if (Result == FALSE)
return FALSE;
// print the DCE binding info
PrintDceBinding(DceBindingPointer);
return TRUE;
}
DECLARE_API (rpcreadstack)
{
PVOID StackStart;
BOOL Result;
ULONG_PTR Value;
LPSTR lpArgumentString = (LPSTR)args;
StackStart = (PVOID)GetExpression(lpArgumentString);
// try to match the stack against the different types we support
// first, try Winsock
if (VerboseStack)
{
dprintf("Matching Winsock stacks\n");
}
Result = MatchStack(StackStart, WS_CallStacks, NumberOfWsCallStacks, &Value);
if (Result == TRUE)
{
// call the Winsock stack analysis function
PrintOsfCallInfoFromRpcMessage(Value);
return;
}
// next, try Named pipes
if (VerboseStack)
{
dprintf("Matching named pipe stacks\n");
}
Result = MatchStack(StackStart, NMP_CallStacks, NumberOfNmpCallStacks, &Value);
if (Result == TRUE)
{
// call the named pipe stack analysis function
PrintOsfCallInfoFromRpcMessage(Value);
return;
}
// next, try LRPC
if (VerboseStack)
{
dprintf("Matching LRPC stacks\n");
}
Result = MatchStack(StackStart, LRPC_CallStacks, NumberOfLrpcCallStacks, &Value);
if (Result == TRUE)
{
// call the Lrpc stack analysis function
PrintLrpcCallInfoFromRpcMessage(Value);
return;
}
dprintf("Not found!\n");
}
DECLARE_API (rpcverbosestack)
{
VerboseStack = !VerboseStack;
if (VerboseStack)
{
dprintf("Switched to ON\n");
}
else
{
dprintf("Switched to OFF\n");
}
}
VOID
do_eerecord(
ULONG64 qwAddr
)
{
ULONG64 tmp0;
ULONG64 tmp1;
ULONG tmp2;
unsigned char Buf[sizeof(ExtendedErrorInfo) + sizeof(ExtendedErrorParam) * (MaxNumberOfEEInfoParams - 1)];
ULONG64 EEInfoAddr;
BOOL Result;
int EEInfoSize;
RPC_CHAR *ComputerNameStr;
SYSTEMTIME SystemTime;
int i;
ULONG64 nLen;
ULONG64 TimeStamp;
ULONG64 ComputerName;
ULONG64 Params;
ULONG64 ParamType;
ULONG64 ParamAddr;
ULONG64 UnicodeStringAddr;
ULONG64 AnsiStringAddr;
ULONG64 BlobAddr;
ULONG64 nLength;
ULONG64 pString;
char *AnsiBuf;
RPC_CHAR *UnicodeBuf;
dprintf("eerecord at 0x%I64x:\n", qwAddr);
GET_MEMBER(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, nLen, nLen);
GET_MEMBER(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, TimeStamp, TimeStamp);
GET_ADDRESS_OF(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Params, Params, tmp2);
GET_ADDRESS_OF(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, ComputerName, ComputerName, tmp2);
GET_MEMBER(ComputerName, EEComputerName, RPCRT4!EEComputerName, Type, tmp1);
if ((ULONG)tmp1 == eecnpPresent)
{
GET_ADDRESS_OF(ComputerName, EEComputerName, RPCRT4!EEComputerName, Name, tmp1, tmp2);
GET_MEMBER(tmp1, EEUString, RPCRT4!EEUString, pString, tmp0);
ComputerNameStr = ReadProcessRpcChar(tmp0);
if (ComputerNameStr != NULL)
{
dprintf("Computer Name: %S\n", ComputerNameStr);
delete ComputerNameStr;
}
}
else
{
dprintf("Computer Name: (null)\n");
}
PRINT_MEMBER_DECIMAL_AND_HEX(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, ProcessID, tmp0);
PRINT_MEMBER_DECIMAL_AND_HEX(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Status, tmp0);
// BUG
dprintf ("TimeStamp=%I64x\n", TimeStamp);
Result = FileTimeToSystemTime((FILETIME *)&TimeStamp, &SystemTime);
if (Result)
{
dprintf("System Time is: %d/%d/%d %d:%d:%d:%d\n",
SystemTime.wMonth,
SystemTime.wDay,
SystemTime.wYear,
SystemTime.wHour,
SystemTime.wMinute,
SystemTime.wSecond,
SystemTime.wMilliseconds);
}
else
{
dprintf("Couldn't extract system time. Error is %d\n", GetLastError());
}
PRINT_MEMBER(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, GeneratingComponent, tmp0);
PRINT_MEMBER_DECIMAL_AND_HEX(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Status, tmp0);
PRINT_MEMBER_DECIMAL_AND_HEX(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, DetectionLocation, tmp0);
GET_MEMBER(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Flags, tmp0);
dprintf("Flags: %S %S\n",
tmp0 & EEInfoPreviousRecordsMissing ? "Previous Record Missing" : "",
tmp0 & EEInfoNextRecordsMissing ? "Next Record Missing" : "");
dprintf("nLen = %d\n", (int)nLen);
ParamAddr = Params;
for (i = 0; i < (int)nLen; i++)
{
dprintf("Parameter %d:", i);
GET_MEMBER(ParamAddr, tagParam, RPCRT4!tagParam, Type, ParamType);
switch((ULONG)ParamType)
{
case eeptiAnsiString:
dprintf("(Ansi string) : ");
GET_ADDRESS_OF(ParamAddr, tagParam, RPCRT4!tagParam, AnsiString, AnsiStringAddr, tmp2);
GET_MEMBER(AnsiStringAddr, tagEEAString, RPCRT4!tagEEAString, nLength, nLength);
GET_MEMBER(AnsiStringAddr, tagEEAString, RPCRT4!tagEEAString, pString, pString);
// we know the length - use GetData
AnsiBuf = new char [(unsigned)nLength];
if (AnsiBuf != NULL)
{
Result = GetData(pString,
AnsiBuf,
(ULONG)nLength);
if (Result)
{
dprintf("%s\n", AnsiBuf);
}
// else
// error info has already been printed - nothing to do
delete AnsiBuf;
}
break;
case eeptiUnicodeString:
dprintf("(Unicode string) : ");
GET_ADDRESS_OF(ParamAddr, tagParam, RPCRT4!tagParam, UnicodeString, UnicodeStringAddr, tmp2);
GET_MEMBER(UnicodeStringAddr, tagEEAString, RPCRT4!tagEEAString, nLength, nLength);
GET_MEMBER(UnicodeStringAddr, tagEEAString, RPCRT4!tagEEAString, pString, pString);
// we know the length - use GetData
UnicodeBuf = new RPC_CHAR [(unsigned)nLength];
if (UnicodeBuf != NULL)
{
Result = GetData(pString,
UnicodeBuf,
(ULONG)(nLength * sizeof(RPC_CHAR)));
if (Result)
{
dprintf("%S\n", UnicodeBuf);
}
// else
// error info has already been printed - nothing to do
delete UnicodeBuf;
}
break;
case eeptiLongVal:
PRINT_MEMBER_DECIMAL_AND_HEX(ParamAddr, tagParam, RPCRT4!tagParam, LVal, tmp0);
break;
case eeptiShortVal:
PRINT_MEMBER_DECIMAL_AND_HEX(ParamAddr, tagParam, RPCRT4!tagParam, IVal, tmp0);
break;
case eeptiPointerVal:
PRINT_MEMBER_DECIMAL_AND_HEX(ParamAddr, tagParam, RPCRT4!tagParam, PVal, tmp0);
break;
case eeptiNone:
dprintf("(Truncated value)\n");
break;
case eeptiBinary:
dprintf("(Binary value:)\n");
GET_ADDRESS_OF(ParamAddr, tagParam, RPCRT4!tagParam, Blob, BlobAddr, tmp2);
PRINT_MEMBER_DECIMAL_AND_HEX(BlobAddr, tagBinaryEEInfo, RPCRT4!tagBinaryEEInfo, nSize, tmp0);
PRINT_MEMBER_DECIMAL_AND_HEX(BlobAddr, tagBinaryEEInfo, RPCRT4!tagBinaryEEInfo, pBlob, tmp0);
break;
default:
dprintf("Invalid type: %d\n", (ULONG)ParamType);
}
ParamAddr += GET_TYPE_SIZE(tagParam, RPCRT4!tagParam);
}
}
VOID
do_eeinfo(
ULONG64 qwAddr
)
{
ULONG64 PrevNextElement = qwAddr;
ULONG64 NextElement = qwAddr;
ULONG64 FirstElement = qwAddr;
BOOL Result;
do
{
do_eerecord(NextElement);
PrevNextElement = NextElement;
GET_MEMBER(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Next, NextElement);
// prevent loops
if (NextElement == FirstElement)
{
dprintf("Loop detected - exitting ...\n");
return;
}
dprintf("------------------------\n");
}
while(NextElement != 0 && PrevNextElement != NextElement);
}
VOID PrintTypeinfoUsage(VOID) {
dprintf("Wrong arguments to !rpcexts.typeinfo\n");
dprintf("Please use !rpcexts.typeinfo on|off\n");
}
DECLARE_API (typeinfo)
{
LPSTR lpArgumentString = (LPSTR)args;
if (strcmp(lpArgumentString, "on") == 0)
fUseTypeInfo = TRUE;
else if (strcmp(lpArgumentString, "off") == 0)
fUseTypeInfo = FALSE;
else if (strcmp(lpArgumentString, "") == 0)
{
if (fUseTypeInfo == TRUE)
dprintf ("typeinfo use is on\n");
else
dprintf ("typeinfo use is off\n");
}
else
PrintTypeinfoUsage();
return;
}
VOID PrintStackMatchUsage(VOID) {
dprintf("Wrong arguments to !rpcexts.stackmatch");
dprintf("Please use !rpcexts.stackmatch start_addr [depth]\n");
}
DECLARE_API( stackmatch )
{
static ULONG64 Start;
static ULONG Depth = 0x80;
CHAR Symbol[128];
ULONG64 Displacement = 0;
//
// Interpret options.
//
ULONG ProcessID = 0;
int ArgumentNo = 0;
DebugCellID CellID;
char *DotSeparator;
//
// Interpret options.
//
char * arg;
LPSTR lpArgumentString = (LPSTR)args;
for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
{
switch(ArgumentNo)
{
case 0:
Start = GetExpression(arg);
break;
case 1:
Depth = (ULONG) GetExpression(arg);
break;
default:
dprintf("Too many arguments\n");
PrintStackMatchUsage();
}
ArgumentNo ++;
}
for (ULONG64 Addr=Start; Addr<=Start+Depth; Addr+=AddressSize) {
ULONG64 Val;
ReadPtr(Addr, &Val);
dprintf("%I64p %I64p", Addr, Val);
GetSymbol(Val, Symbol, &Displacement);
if (strcmp(Symbol, "") != 0)
dprintf(" %s+%x", Symbol, Displacement);
else {
ULONG64 Obj;
ReadPtr(Val, &Obj);
if (Obj) {
dprintf(" -> %I64p", Obj);
GetSymbol(Obj, Symbol, &Displacement);
if (strcmp(Symbol, "") != 0)
dprintf(" %s+%x", Symbol, Displacement);
}
}
dprintf("\n");
}
Start = Addr;
}
DECLARE_API( listcalls )
{
ULONG64 qwAddr;
BOOL fArgSpecified = FALSE;
ULONG64 ServerAddress;
LPSTR lpArgumentString = (LPSTR)args;
if (0 == strtok(lpArgumentString))
{
lpArgumentString = "rpcrt4!GlobalRpcServer";
fArgSpecified = TRUE;
}
qwAddr = GetExpression(lpArgumentString);
if ( !qwAddr )
{
dprintf("Error: can't evaluate '%s'\n", lpArgumentString);
return;
}
if (fArgSpecified)
{
if (ReadPtr(qwAddr, &ServerAddress))
{
dprintf("couldn't read memory at address 0x%I64x\n", qwAddr);
return;
}
}
else
ServerAddress = qwAddr;
do_listcalls(ServerAddress);
}
VOID LoopThroughDict(ULONG64 Dict, PCHAR offset) {
ULONG64 tmp0;
ULONG64 tmp1;
ULONG tmp2;
ULONG64 cDictSize;
ULONG64 cDictSlots;
ULONG64 DictSlots;
int j;
ULONG64 DictSlot;
GET_MEMBER(Dict, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, cDictSize, cDictSize);
GET_MEMBER(Dict, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, cDictSlots, cDictSlots);
if ((ULONG)cDictSize > (ULONG)cDictSlots)
{
dprintf("Bad dictionary\t\t- %I64p\n", Dict);
return;
}
GET_MEMBER(Dict, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, DictSlots, DictSlots);
dprintf("%sPrinting %d items in dictionary: %I64p with %d slots\n\n", offset, (ULONG)cDictSize, Dict, (ULONG)cDictSlots);
// Loop throught the associations.
for (j = 0; j < MIN((int)cDictSize, MAX_ITEMS_IN_DICTIONARY); j++)
{
ReadPtr(DictSlots + j * AddressSize, &DictSlot);
dprintf ("%s(%d): 0x%I64x - ", offset, j, DictSlot);
ULONG64 MagicValue;
ULONG64 ObjectType;
ULONG64 Dict;
ReadPtr(DictSlot+AddressSize, &MagicValue);
ReadPtr(DictSlot+AddressSize+4, &ObjectType);
if ((ULONG)MagicValue != MAGICLONG)
{
dprintf("Bad or deleted object at %p\n", DictSlot);
}
switch (((ULONG)ObjectType) & (~OBJECT_DELETED))
{
case DG_ADDRESS_TYPE:
dprintf("DG_ADDRESS\n");
break;
case OSF_ADDRESS_TYPE:
dprintf("OSF_ADDRESS\n");
GET_ADDRESS_OF(DictSlot, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, Associations, Dict, tmp2);
LoopThroughDict(Dict, "\t\t");
break;
case LRPC_ADDRESS_TYPE:
dprintf("LRPC_ADDRESS\n");
GET_ADDRESS_OF(DictSlot, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, AssociationDictionary, Dict, tmp2);
LoopThroughDict(Dict, "\t\t");
break;
case OSF_ASSOCIATION_TYPE:
dprintf("OSF_ASSOCIATION_TYPE\n");
break;
case LRPC_SASSOCIATION_TYPE:
dprintf("LRPC_SASSOCIATION_TYPE\n");
break;
default:
dprintf("The RPC object type is 0x%lx and I don't recognize it.\n", (ObjectType) & ~(OBJECT_DELETED));
}
}
}
VOID
do_listcalls(
ULONG64 qwAddr
)
{
ULONG64 tmp0;
ULONG64 tmp1;
ULONG tmp2;
dprintf("\n");
dprintf("RPC_SERVER at 0x%I64x\n", qwAddr);
ULONG64 RpcAddressDictionary;
GET_ADDRESS_OF(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, RpcAddressDictionary, RpcAddressDictionary, tmp2);
dprintf("&RpcAddressDictionary(RPC_SIMPLE_DICT) - 0x%I64x\n", RpcAddressDictionary);
LoopThroughDict(RpcAddressDictionary, "\t");
dprintf("\n");
}
Reference in a new issue Copy permalink