649 lines
17 KiB
C
649 lines
17 KiB
C
/*++
|
||
|
||
|
||
|
||
Copyright (c) 1990 Microsoft Corporation
|
||
|
||
Module Name:
|
||
|
||
dbgsec.c
|
||
|
||
Abstract:
|
||
|
||
Argus debugging extensions. The routines here dump out Security Descriptors
|
||
and allow you to examine them.
|
||
|
||
|
||
Author:
|
||
|
||
Krishna Ganugapati (KrishnaG) 1-July-1993
|
||
|
||
Revision History:
|
||
KrishnaG: Created: 1-July-1993 (imported most of IanJa's stuff)
|
||
KrishnaG: Added: 7-July-1993 (added AndrewBe's UnicodeAnsi conversion routines)
|
||
KrishnaG Added: 3-Aug-1993 (added DevMode/SecurityDescriptor dumps)
|
||
|
||
|
||
To do:
|
||
|
||
|
||
--*/
|
||
|
||
#define NOMINMAX
|
||
#define SECURITY_WIN32
|
||
#include <nt.h>
|
||
#include <ntrtl.h>
|
||
#include <nturtl.h>
|
||
#include <windows.h>
|
||
#include <stdlib.h>
|
||
#include <math.h>
|
||
#include <ntsdexts.h>
|
||
|
||
#include <windows.h>
|
||
#include <winspool.h>
|
||
#include <security.h>
|
||
#include <wchar.h>
|
||
|
||
#include "dbglocal.h"
|
||
|
||
|
||
#define NULL_TERMINATED 0
|
||
#define VERBOSE_ON 1
|
||
#define VERBOSE_OFF 0
|
||
|
||
#define MAX_SDC_FLAGS 7
|
||
|
||
typedef struct _DBG_SED_CONTROL{
|
||
unsigned short Flag;
|
||
LPSTR String;
|
||
}DBG_SED_CONTROL, *PDBG_SED_CONTROL;
|
||
|
||
DBG_SED_CONTROL SDC_Table[] =
|
||
|
||
{
|
||
0x0001, "SE_OWNER_DEFAULTED",
|
||
|
||
0x0002, "SE_GROUP_DEFAULTED",
|
||
|
||
0x0004, "SE_DACL_PRESENT",
|
||
|
||
0x0008, "SE_DACL_DEFAULTED",
|
||
|
||
0x0010, "SE_SACL_PRESENT",
|
||
|
||
0x0020, "SE_SACL_DEFAULTED",
|
||
|
||
0x8000, "SE_SELF_RELATIVE"
|
||
|
||
};
|
||
|
||
#define MAX_ACE_FLAGS 6
|
||
|
||
typedef struct _DBG_ACE_FLAGS{
|
||
UCHAR Flags;
|
||
LPSTR String;
|
||
}DBG_ACE_FLAGS, *PDBG_ACE_FLAGS;
|
||
|
||
|
||
DBG_ACE_FLAGS AceFlagsTable[] =
|
||
|
||
{
|
||
0x1, "OBJECT_INHERIT_ACE",
|
||
|
||
0x2, "CONTAINER_INHERIT_ACE",
|
||
|
||
0x4, "NO_PROPAGATE_INHERIT_ACE",
|
||
|
||
0x8, "INHERIT_ONLY_ACE",
|
||
|
||
0x40, "SUCCESSFUL_ACCESS_ACE_FLAG",
|
||
|
||
0x80, "FAILED_ACCESS_ACE_FLAG"
|
||
};
|
||
|
||
|
||
|
||
typedef struct _ACCESSMASKTAB{
|
||
DWORD Flag;
|
||
LPSTR String;
|
||
}ACCESSMASKTAB, *PACCESSMASKTAB;
|
||
|
||
|
||
ACCESSMASKTAB AccessMaskTable[33] =
|
||
|
||
{
|
||
0x00000001, "SERVER_ACCESS_ADMINSTER",
|
||
|
||
0x00000002, "SERVER_ACCESS_ENUMERATE",
|
||
|
||
0x00000004, "PRINTER_ACCESS_ADMINSTER",
|
||
|
||
0x00000008, "PRINTER_ACCESS_USE",
|
||
|
||
0x00000010, "JOB_ACCESS_ADMINISTER",
|
||
|
||
0x00010000, "DELETE",
|
||
|
||
0x00020000, "READ_CONTROL",
|
||
|
||
0x00040000, "WRITE_DAC",
|
||
|
||
0x00080000, "WRITE_OWNER",
|
||
|
||
0x00100000, "SYNCHRONIZE",
|
||
|
||
0x01000000, "ACCESS_SYSTEM_SECURITY",
|
||
|
||
0x10000000, "GENERIC_ALL",
|
||
|
||
0x20000000, "GENERIC_EXECUTE",
|
||
|
||
0x40000000, "GENERIC_WRITE",
|
||
|
||
0x80000000, "GENERIC_READ",
|
||
|
||
0x0000FFFF, "SPECIFIC_RIGHTS_ALL",
|
||
|
||
0x000F0000, "STANDARD_RIGHTS_REQUIRED <D-R/C-W/DAC-W/O>",
|
||
|
||
0x001F0000, "STANDARD_RIGHTS_ALL <D-R/C-W/DAC-W/O-S>",
|
||
|
||
READ_CONTROL, "STANDARD_RIGHTS_READ <R/C>",
|
||
|
||
READ_CONTROL, "STANDARD_RIGHTS_WRITE <R/C>",
|
||
|
||
READ_CONTROL, "STANDARD_RIGHTS_EXECUTE <R/C>",
|
||
|
||
SERVER_ALL_ACCESS, "SERVER_ALL_ACCESS <SRREQ-SAA-SAE>",
|
||
|
||
SERVER_READ, "SERVER_READ <SRR-SAE>",
|
||
|
||
SERVER_WRITE, "SERVER_WRITE <SRW-SAA-SAE>",
|
||
|
||
SERVER_EXECUTE, "SERVER_EXECUTE <SRE-SAE>",
|
||
|
||
PRINTER_ALL_ACCESS, "PRINTER_ALL_ACCESS <SRREQ-PAA-PAU>",
|
||
|
||
PRINTER_READ, "PRINTER_READ <SRR-PAU>",
|
||
|
||
PRINTER_WRITE, "PRINTER_WRITE <SRW-PAU>",
|
||
|
||
PRINTER_EXECUTE, "PRINTER_EXECUTE <SRE-PAU>",
|
||
|
||
JOB_ALL_ACCESS, "JOB_ALL_ACCESS <SRREQ-JAA>",
|
||
|
||
JOB_READ, "JOB_READ <SRR-JAA>",
|
||
|
||
JOB_WRITE, "JOB_WRITE <SRW-JAA>",
|
||
|
||
JOB_EXECUTE, "JOB_EXECUTE <SRE-JAA>"
|
||
|
||
};
|
||
|
||
|
||
|
||
BOOL
|
||
DbgDumpSecurityDescriptor(
|
||
HANDLE hCurrentProcess,
|
||
PNTSD_OUTPUT_ROUTINE Print,
|
||
PISECURITY_DESCRIPTOR pSecurityDescriptor
|
||
)
|
||
{
|
||
BOOL bSe_Self_Relative = FALSE;
|
||
DWORD i;
|
||
DWORD OwnerSidAddress, GroupSidAddress;
|
||
DWORD SaclAddress, DaclAddress;
|
||
SECURITY_DESCRIPTOR SecurityDescriptor;
|
||
|
||
memset(&SecurityDescriptor, 0, sizeof(SECURITY_DESCRIPTOR));
|
||
movestruct(pSecurityDescriptor, &SecurityDescriptor, SECURITY_DESCRIPTOR);
|
||
|
||
(*Print)("SecurityDescriptor\n");
|
||
|
||
bSe_Self_Relative = SecurityDescriptor.Control & SE_SELF_RELATIVE;
|
||
if (bSe_Self_Relative) {
|
||
(*Print)("This Security Descriptor is a Self-Relative Security Descriptor\n");
|
||
}
|
||
|
||
(*Print)("UCHAR Revision 0x%x\n", SecurityDescriptor.Revision);
|
||
(*Print)("UCHAR Sbz1 0x%x\n", SecurityDescriptor.Sbz1);
|
||
(*Print)("USHORT Control 0x%x\n", SecurityDescriptor.Control);
|
||
for (i = 0; i < MAX_SDC_FLAGS; i++ ) {
|
||
if (SecurityDescriptor.Control & SDC_Table[i].Flag) {
|
||
(*Print)("%s - ON (%.4x)\n", SDC_Table[i].String, SDC_Table[i].Flag);
|
||
} else {
|
||
(*Print)("%s - OFF (%.4x)\n", SDC_Table[i].String, SDC_Table[i].Flag);
|
||
}
|
||
}
|
||
|
||
//
|
||
// Now dumping out the owner's sid
|
||
//
|
||
|
||
if (SecurityDescriptor.Owner == NULL) {
|
||
(*Print)("PSID Owner null -- no owner sid present in the security descriptor\n");
|
||
}else {
|
||
if (bSe_Self_Relative) {
|
||
// (*Print)("PSID Owner Offset 0x%.8x\n",SecurityDescriptor.Owner);
|
||
OwnerSidAddress = (DWORD)pSecurityDescriptor + (DWORD)SecurityDescriptor.Owner;
|
||
}else {
|
||
OwnerSidAddress = (DWORD)SecurityDescriptor.Owner;
|
||
}
|
||
// (*Print)("PSID Owner 0x%.8x\n", OwnerSidAddress);
|
||
}
|
||
(*Print)("The owner's sid is:\t\n");
|
||
DbgDumpSid(hCurrentProcess, Print, (PVOID)OwnerSidAddress);
|
||
(*Print)("\n\n");
|
||
|
||
//
|
||
// Now dumping out the group's sid
|
||
|
||
if (SecurityDescriptor.Group == NULL) {
|
||
(*Print)("PSID Group null -- no group sid present in the security descriptor\n");
|
||
}else {
|
||
if (bSe_Self_Relative) {
|
||
// (*Print)("PSID Group Offset 0x%.8x\n", SecurityDescriptor.Group);
|
||
GroupSidAddress = (DWORD)pSecurityDescriptor + (DWORD)SecurityDescriptor.Group;
|
||
}else {
|
||
GroupSidAddress = (DWORD)SecurityDescriptor.Group;
|
||
}
|
||
// (*Print)("PSID Group 0x%.8x\n", GroupSidAddress);
|
||
}
|
||
(*Print)("The group's sid is:\t\n");
|
||
DbgDumpSid(hCurrentProcess, Print, (PVOID)GroupSidAddress);
|
||
(*Print)("\n");
|
||
|
||
|
||
|
||
if (SecurityDescriptor.Sacl == NULL) {
|
||
(*Print)("PACL Sacl null -- no sacl present in this security descriptor\n");
|
||
}else {
|
||
if (bSe_Self_Relative) {
|
||
// (*Print)("PACL Sacl Offset %.8x\n", SecurityDescriptor.Sacl);
|
||
SaclAddress = (DWORD)pSecurityDescriptor + (DWORD)SecurityDescriptor.Sacl;
|
||
}else{
|
||
SaclAddress = (DWORD)SecurityDescriptor.Sacl;
|
||
|
||
}
|
||
// (*Print)("PACL Sacl 0x%.8x\n", SaclAddress);
|
||
}
|
||
|
||
if (SecurityDescriptor.Dacl == NULL) {
|
||
(*Print)("PACL Dacl null -- no dacl present in this security descriptor\n");
|
||
}else {
|
||
if (bSe_Self_Relative) {
|
||
// (*Print)("PACL Dacl Offset %.8x\n", SecurityDescriptor.Dacl);
|
||
DaclAddress = (DWORD)pSecurityDescriptor + (DWORD)SecurityDescriptor.Dacl;
|
||
}else {
|
||
DaclAddress = (DWORD)SecurityDescriptor.Dacl;
|
||
}
|
||
|
||
(*Print)("PACL Dacl 0x%.8x\n", DaclAddress);
|
||
|
||
DbgDumpAcl(hCurrentProcess, Print,(PVOID)DaclAddress);
|
||
}
|
||
|
||
}
|
||
|
||
|
||
BOOL
|
||
DbgDumpSid(
|
||
HANDLE hCurrentProcess,
|
||
PNTSD_OUTPUT_ROUTINE Print,
|
||
PVOID SidAddress
|
||
)
|
||
{
|
||
BYTE Sid[256];
|
||
CHAR SidString[256];
|
||
SID_NAME_USE SidType = 1;
|
||
|
||
// (*Print)("Size of a SID is %d\n", sizeof(SID));
|
||
|
||
// movestruct(SidAddress, &Sid, SID);
|
||
memset(Sid, 0, 256);
|
||
movemem(SidAddress, Sid, 256);
|
||
ConvertSidToAsciiString(Sid, SidString);
|
||
(*Print)("PSID %s\n", SidString);
|
||
|
||
}
|
||
|
||
|
||
BOOL
|
||
DbgDumpAceHeader(
|
||
HANDLE hCurrentProcess,
|
||
PNTSD_OUTPUT_ROUTINE Print,
|
||
PVOID AceHeaderAddress
|
||
)
|
||
{
|
||
ACE_HEADER AceHeader;
|
||
DWORD i = 0;
|
||
|
||
memset(&AceHeader, 0, sizeof(ACE_HEADER));
|
||
movestruct(AceHeaderAddress, &AceHeader, ACE_HEADER);
|
||
(*Print)("UCHAR AceType %.2x\n", AceHeader.AceType);
|
||
switch (AceHeader.AceType) {
|
||
case ACCESS_ALLOWED_ACE_TYPE:
|
||
(*Print)("This is an ace of type: ACCESS_ALLOWED_ACE_TYPE\n");
|
||
break;
|
||
case ACCESS_DENIED_ACE_TYPE:
|
||
(*Print)("This is an ace of type: ACCESS_DENIED_ACE_TYPE\n");
|
||
break;
|
||
case SYSTEM_AUDIT_ACE_TYPE:
|
||
(*Print)("This is an ace of type: SYSTEM_AUDIT_ACE_TYPE\n");
|
||
break;
|
||
|
||
case SYSTEM_ALARM_ACE_TYPE:
|
||
(*Print)("This is an ace of type: SYSTEM_ALARM_ACE_TYPE\n");
|
||
break;
|
||
}
|
||
(*Print)("UCHAR AceFlags %.2x\n", AceHeader.AceFlags);
|
||
|
||
for (i = 0; i < MAX_ACE_FLAGS; i++ ) {
|
||
if (AceFlagsTable[i].Flags & AceHeader.AceFlags) {
|
||
(*Print)("%s - ON (%d)\n", AceFlagsTable[i].String, AceFlagsTable[i].Flags);
|
||
}else {
|
||
(*Print)("%s - OFF (%d)\n", AceFlagsTable[i].String, AceFlagsTable[i].Flags);
|
||
}
|
||
}
|
||
|
||
(*Print)("USHORT AceSize %d\n", AceHeader.AceSize);
|
||
|
||
}
|
||
|
||
|
||
BOOL
|
||
DbgDumpAcl(
|
||
HANDLE hCurrentProcess,
|
||
PNTSD_OUTPUT_ROUTINE Print,
|
||
PVOID AclAddress
|
||
)
|
||
{
|
||
ACL Acl;
|
||
PVOID AceAddress;
|
||
ACE_HEADER AceHeader;
|
||
ACCESS_ALLOWED_ACE AccessAllowedAce;
|
||
ACCESS_DENIED_ACE AccessDeniedAce;
|
||
SYSTEM_AUDIT_ACE SystemAuditAce;
|
||
SYSTEM_ALARM_ACE SystemAlarmAce;
|
||
DWORD i;
|
||
DWORD SidAddress;
|
||
|
||
// Pull the Acl across
|
||
|
||
movestruct(AclAddress, &Acl, ACL);
|
||
|
||
(*Print)("ACL\n");
|
||
|
||
(*Print)("UCHAR AclRevision 0x%x\n", Acl.AclRevision);
|
||
(*Print)("UCHAR Sbz1 0x%x\n", Acl.Sbz1);
|
||
(*Print)("USHORT AclSize %d\n", Acl.AclSize);
|
||
(*Print)("USHORT AceCount %d\n", Acl.AceCount);
|
||
(*Print)("USHORT Sz2 0x%x\n", Acl.Sbz2);
|
||
|
||
AceAddress = (LPBYTE)AclAddress + sizeof(ACL);
|
||
for (i = 0; i < Acl.AceCount; i++ ) {
|
||
(*Print)("\nAce # %d: ",i);
|
||
DbgDumpAceHeader(hCurrentProcess, Print, AceAddress);
|
||
movestruct(AceAddress, &AceHeader, ACE_HEADER);
|
||
|
||
switch (AceHeader.AceType) {
|
||
case ACCESS_ALLOWED_ACE_TYPE:
|
||
memset(&AccessAllowedAce, 0, sizeof(ACCESS_ALLOWED_ACE));
|
||
movestruct(AceAddress, &AccessAllowedAce, ACCESS_ALLOWED_ACE);
|
||
(*Print)("ACCESSMASK AccessMask %.8x\n", AccessAllowedAce.Mask);
|
||
SidAddress = (DWORD)((LPBYTE)AceAddress + sizeof(ACE_HEADER) + sizeof(ACCESS_MASK));
|
||
// (*Print)("The Address of the Sid is %.8x\n", SidAddress);
|
||
DbgDumpSid(hCurrentProcess, Print, (PVOID)SidAddress);
|
||
break;
|
||
|
||
case ACCESS_DENIED_ACE_TYPE:
|
||
memset(&AccessDeniedAce, 0, sizeof(ACCESS_DENIED_ACE));
|
||
movestruct(AceAddress, &AccessDeniedAce, ACCESS_DENIED_ACE);
|
||
(*Print)("ACCESSMASK AccessMask %.8x\n", AccessDeniedAce.Mask);
|
||
SidAddress = (DWORD)((LPBYTE)AceAddress + sizeof(ACE_HEADER) + sizeof(ACCESS_MASK));
|
||
DbgDumpSid(hCurrentProcess, Print, (PVOID)SidAddress);
|
||
break;
|
||
|
||
case SYSTEM_AUDIT_ACE_TYPE:
|
||
memset(&SystemAuditAce, 0, sizeof(SYSTEM_AUDIT_ACE));
|
||
movestruct(AceAddress, &SystemAuditAce, SYSTEM_AUDIT_ACE);
|
||
(*Print)("ACCESSMASK AccessMask %.8x\n", SystemAuditAce.Mask);
|
||
SidAddress = (DWORD)((LPBYTE)AceAddress + sizeof(ACE_HEADER) + sizeof(ACCESS_MASK));
|
||
DbgDumpSid(hCurrentProcess, Print, (PVOID)SidAddress);
|
||
break;
|
||
|
||
case SYSTEM_ALARM_ACE_TYPE:
|
||
memset(&SystemAlarmAce, 0, sizeof(SYSTEM_ALARM_ACE));
|
||
movestruct(AceAddress, &SystemAlarmAce, SYSTEM_ALARM_ACE);
|
||
(*Print)("ACCESSMASK AccessMask %.8x\n", SystemAlarmAce.Mask);
|
||
SidAddress = (DWORD)((LPBYTE)AceAddress + sizeof(ACE_HEADER) + sizeof(ACCESS_MASK));
|
||
DbgDumpSid(hCurrentProcess, Print, (PVOID)SidAddress);
|
||
break;
|
||
}
|
||
AceAddress = (PVOID)((DWORD)AceAddress + AceHeader.AceSize);
|
||
(*Print)("\n");
|
||
}
|
||
}
|
||
|
||
|
||
BOOL
|
||
dsd(
|
||
HANDLE hCurrentProcess,
|
||
HANDLE hCurrentThread,
|
||
DWORD dwCurrentPc,
|
||
PNTSD_EXTENSION_APIS lpExtensionApis,
|
||
LPSTR lpArgumentString)
|
||
{
|
||
PNTSD_OUTPUT_ROUTINE Print;
|
||
PNTSD_GET_EXPRESSION EvalExpression;
|
||
PNTSD_GET_SYMBOL GetSymbol;
|
||
DWORD dwAddress = (DWORD)NULL;
|
||
DWORD dwCount = 0;
|
||
BOOL bThereAreOptions = TRUE;
|
||
|
||
UNREFERENCED_PARAMETER(hCurrentProcess);
|
||
UNREFERENCED_PARAMETER(hCurrentThread);
|
||
UNREFERENCED_PARAMETER(dwCurrentPc);
|
||
|
||
Print = lpExtensionApis->lpOutputRoutine;
|
||
EvalExpression = lpExtensionApis->lpGetExpressionRoutine;
|
||
GetSymbol = lpExtensionApis->lpGetSymbolRoutine;
|
||
|
||
while (bThereAreOptions) {
|
||
while (isspace(*lpArgumentString)) {
|
||
lpArgumentString++;
|
||
}
|
||
|
||
switch (*lpArgumentString) {
|
||
case 'c':
|
||
lpArgumentString++;
|
||
dwCount = EvalValue(&lpArgumentString, EvalExpression, Print);
|
||
break;
|
||
|
||
default: // go get the address because there's nothing else
|
||
bThereAreOptions = FALSE;
|
||
break;
|
||
}
|
||
}
|
||
|
||
if (*lpArgumentString != 0) {
|
||
dwAddress = EvalValue(&lpArgumentString, EvalExpression, Print);
|
||
}
|
||
|
||
// if we've got no address, then quit now - nothing we can do
|
||
|
||
if (dwAddress == (DWORD)NULL) {
|
||
Print("We have a Null address\n");
|
||
return(0);
|
||
}
|
||
|
||
DbgDumpSecurityDescriptor(
|
||
hCurrentProcess,
|
||
Print,
|
||
(PISECURITY_DESCRIPTOR)dwAddress
|
||
);
|
||
|
||
// Add Command to the Command Queue
|
||
return 0;
|
||
|
||
DBG_UNREFERENCED_PARAMETER(hCurrentProcess);
|
||
DBG_UNREFERENCED_PARAMETER(hCurrentThread);
|
||
DBG_UNREFERENCED_PARAMETER(dwCurrentPc);
|
||
}
|
||
|
||
|
||
|
||
|
||
BOOL
|
||
dsid(
|
||
HANDLE hCurrentProcess,
|
||
HANDLE hCurrentThread,
|
||
DWORD dwCurrentPc,
|
||
PNTSD_EXTENSION_APIS lpExtensionApis,
|
||
LPSTR lpArgumentString)
|
||
{
|
||
PNTSD_OUTPUT_ROUTINE Print;
|
||
PNTSD_GET_EXPRESSION EvalExpression;
|
||
PNTSD_GET_SYMBOL GetSymbol;
|
||
DWORD dwAddress = (DWORD)NULL;
|
||
DWORD dwCount = 0;
|
||
BOOL bThereAreOptions = TRUE;
|
||
|
||
UNREFERENCED_PARAMETER(hCurrentProcess);
|
||
UNREFERENCED_PARAMETER(hCurrentThread);
|
||
UNREFERENCED_PARAMETER(dwCurrentPc);
|
||
|
||
Print = lpExtensionApis->lpOutputRoutine;
|
||
EvalExpression = lpExtensionApis->lpGetExpressionRoutine;
|
||
GetSymbol = lpExtensionApis->lpGetSymbolRoutine;
|
||
|
||
while (bThereAreOptions) {
|
||
while (isspace(*lpArgumentString)) {
|
||
lpArgumentString++;
|
||
}
|
||
|
||
switch (*lpArgumentString) {
|
||
case 'c':
|
||
lpArgumentString++;
|
||
dwCount = EvalValue(&lpArgumentString, EvalExpression, Print);
|
||
break;
|
||
|
||
default: // go get the address because there's nothing else
|
||
bThereAreOptions = FALSE;
|
||
break;
|
||
}
|
||
}
|
||
|
||
if (*lpArgumentString != 0) {
|
||
dwAddress = EvalValue(&lpArgumentString, EvalExpression, Print);
|
||
}
|
||
|
||
// if we've got no address, then quit now - nothing we can do
|
||
|
||
if (dwAddress == (DWORD)NULL) {
|
||
Print("We have a Null address\n");
|
||
return(0);
|
||
}
|
||
|
||
DbgDumpSid(
|
||
hCurrentProcess,
|
||
Print,
|
||
(PVOID)dwAddress
|
||
);
|
||
|
||
// Add Command to the Command Queue
|
||
return 0;
|
||
|
||
DBG_UNREFERENCED_PARAMETER(hCurrentProcess);
|
||
DBG_UNREFERENCED_PARAMETER(hCurrentThread);
|
||
DBG_UNREFERENCED_PARAMETER(dwCurrentPc);
|
||
}
|
||
|
||
|
||
BOOL
|
||
DbgDumpAccessMask(
|
||
HANDLE hCurrentProcess,
|
||
PNTSD_OUTPUT_ROUTINE Print,
|
||
DWORD AccessMask
|
||
)
|
||
{
|
||
DWORD i;
|
||
for (i = 0; i < 33; i++) {
|
||
if (AccessMask & AccessMaskTable[i].Flag) {
|
||
(*Print)("%s\t\tON\n", AccessMaskTable[i].String);
|
||
}else {
|
||
(*Print)("%s\t\tOFF\n", AccessMaskTable[i].String);
|
||
}
|
||
}
|
||
return TRUE;
|
||
}
|
||
|
||
|
||
|
||
|
||
BOOL
|
||
dam(
|
||
HANDLE hCurrentProcess,
|
||
HANDLE hCurrentThread,
|
||
DWORD dwCurrentPc,
|
||
PNTSD_EXTENSION_APIS lpExtensionApis,
|
||
LPSTR lpArgumentString)
|
||
{
|
||
PNTSD_OUTPUT_ROUTINE Print;
|
||
PNTSD_GET_EXPRESSION EvalExpression;
|
||
PNTSD_GET_SYMBOL GetSymbol;
|
||
DWORD AccessMask = (DWORD)NULL;
|
||
DWORD dwCount = 0;
|
||
BOOL bThereAreOptions = TRUE;
|
||
|
||
UNREFERENCED_PARAMETER(hCurrentProcess);
|
||
UNREFERENCED_PARAMETER(hCurrentThread);
|
||
UNREFERENCED_PARAMETER(dwCurrentPc);
|
||
|
||
Print = lpExtensionApis->lpOutputRoutine;
|
||
EvalExpression = lpExtensionApis->lpGetExpressionRoutine;
|
||
GetSymbol = lpExtensionApis->lpGetSymbolRoutine;
|
||
|
||
while (bThereAreOptions) {
|
||
while (isspace(*lpArgumentString)) {
|
||
lpArgumentString++;
|
||
}
|
||
|
||
switch (*lpArgumentString) {
|
||
case 'c':
|
||
lpArgumentString++;
|
||
dwCount = EvalValue(&lpArgumentString, EvalExpression, Print);
|
||
break;
|
||
|
||
default: // go get the address because there's nothing else
|
||
bThereAreOptions = FALSE;
|
||
break;
|
||
}
|
||
}
|
||
|
||
if (*lpArgumentString != 0) {
|
||
AccessMask = EvalValue(&lpArgumentString, EvalExpression, Print);
|
||
}
|
||
|
||
// if we've got no address, then quit now - nothing we can do
|
||
|
||
if (AccessMask == (DWORD)NULL) {
|
||
Print("We have a Null address\n");
|
||
return(0);
|
||
}
|
||
|
||
DbgDumpAccessMask(
|
||
hCurrentProcess,
|
||
Print,
|
||
AccessMask
|
||
);
|
||
|
||
// Add Command to the Command Queue
|
||
return 0;
|
||
|
||
DBG_UNREFERENCED_PARAMETER(hCurrentProcess);
|
||
DBG_UNREFERENCED_PARAMETER(hCurrentThread);
|
||
DBG_UNREFERENCED_PARAMETER(dwCurrentPc);
|
||
}
|
||
|