able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/sdktools/debuggers/ntsd64/ntsym.cpp
CryptoAlgo Inc b3cac27891 Add source files
2020-09-26 16:20:57 +08:00

3102 lines
83 KiB
C++
Raw Blame History

//----------------------------------------------------------------------------
//
// Symbol-handling routines.
//
// Copyright (C) Microsoft Corporation, 1997-2001.
//
//----------------------------------------------------------------------------
#include "ntsdp.hpp"
#include <stddef.h>
#include <cvconst.h>
#include <common.ver>
typedef struct _EXAMINE_INFO
{
BOOL Verbose;
} EXAMINE_INFO, *PEXAMINE_INFO;
LPSTR g_SymbolSearchPath;
LPSTR g_ExecutableImageSearchPath;
// Symbol options that require symbol reloading to take effect.
#define RELOAD_SYM_OPTIONS \
(SYMOPT_UNDNAME | SYMOPT_NO_CPP | SYMOPT_DEFERRED_LOADS | \
SYMOPT_LOAD_LINES | SYMOPT_IGNORE_CVREC | SYMOPT_LOAD_ANYTHING | \
SYMOPT_EXACT_SYMBOLS)
ULONG g_SymOptions = SYMOPT_CASE_INSENSITIVE | SYMOPT_UNDNAME |
SYMOPT_NO_CPP | SYMOPT_OMAP_FIND_NEAREST |
SYMOPT_DEFERRED_LOADS;
CHAR g_SymBuffer[SYM_BUFFER_SIZE];
CHAR g_SymStartBuffer[SYM_BUFFER_SIZE];
PIMAGEHLP_SYMBOL64 g_Sym = (PIMAGEHLP_SYMBOL64) g_SymBuffer;
PIMAGEHLP_SYMBOL64 g_SymStart = (PIMAGEHLP_SYMBOL64) g_SymStartBuffer;
ULONG g_NumUnloadedModules;
PSTR g_DmtNameDescs[DMT_NAME_COUNT] =
{
"Loaded symbol image file", "Symbol file", "Mapped memory image file",
"Image path",
};
DEBUG_SCOPE g_ScopeBuffer;
void
RefreshAllModules(void)
{
PPROCESS_INFO Process;
// Force all loaded symbols to be unloaded so that symbols will
// be reloaded with any updated settings.
for (Process = g_ProcessHead;
Process != NULL;
Process = Process->Next)
{
PDEBUG_IMAGE_INFO Image;
for (Image = Process->ImageHead;
Image != NULL;
Image = Image->Next)
{
SymUnloadModule64(Process->Handle, Image->BaseOfImage);
ClearStoredTypes(Image->BaseOfImage);
if (!SymLoadModule64(Process->Handle,
Image->File,
PrepareImagePath(Image->ImagePath),
Image->ModuleName,
Image->BaseOfImage,
Image->SizeOfImage))
{
ErrOut("Unable to reload %s\n", Image->ModuleName);
}
}
}
}
void
SetSymOptions(ULONG Options)
{
ULONG OldOptions = g_SymOptions;
g_SymOptions = Options;
SymSetOptions(g_SymOptions);
NotifyChangeSymbolState(DEBUG_CSS_SYMBOL_OPTIONS, g_SymOptions, NULL);
if ((OldOptions ^ g_SymOptions) & RELOAD_SYM_OPTIONS)
{
RefreshAllModules();
}
}
BOOL
IsImageMachineType64(DWORD MachineType)
{
switch (MachineType)
{
case IMAGE_FILE_MACHINE_AXP64:
case IMAGE_FILE_MACHINE_IA64:
case IMAGE_FILE_MACHINE_AMD64:
return TRUE;
default:
return FALSE;
}
}
ULONG64
GetRegValIA64(
PCROSS_PLATFORM_CONTEXT Context,
PDEBUG_STACK_FRAME Frame,
ULONG RegID
)
{
ULONGLONG Registers[96+2];
ULONGLONG RegisterHome = Frame->FrameOffset;
ULONG RegisterCount;
ULONG RegisterNumber;
ULONG ReadLength;
ULONG i;
if (Frame->FrameNumber = 0)
{
RegisterCount = (ULONG) Context->IA64Context.StIFS & 0x7f;
}
else
{
RegisterCount = 96;
}
// Sanity.
if (RegisterCount > 96)
{
return g_Machine->GetReg64(RegID);
}
if (RegisterHome & 3)
{
return g_Machine->GetReg64(RegID);
}
if ((RegID >= INTR32) && (RegID < INTR32 + RegisterCount))
{
//
// Read only what we have to
//
RegisterCount = RegID - INTR32 + 1;
//
// Calculate the number of registers to read from the
// RSE stack. For every 63 registers there will be at
// at least one NaT collection register, depending on
// where we start, there may be another one.
//
// First, starting at the current BSP, if we cross a 64 (0x40)
// boundry, then we have an extra.
//
ReadLength = (((((ULONG)Frame->FrameOffset) >> 3) & 0x1f) +
RegisterCount) >> 6;
//
// Add 1 for every 63 registers.
//
ReadLength = (RegisterCount / 63) + RegisterCount;
ReadLength *= sizeof(ULONGLONG);
//
// Read the registers for this frame.
//
if (!SwReadMemory(g_CurrentProcess->Handle,
RegisterHome,
Registers,
ReadLength,
&i))
{
//
// This shouldn't have happened.
//
return g_Machine->GetReg64(RegID);
}
return Registers[RegID - INTR32];
}
else
{
return g_Machine->GetReg64(RegID);
}
if (RegisterCount == 0)
{
//
// Not much point doing anything in this case.
//
return g_Machine->GetReg64(RegID);
}
//
// Note: the following code should be altered to understand
// NaTs as they come from the register stack (currently
// it ignores them).
//
RegisterNumber = 32;
}
ULONG64
GetScopeRegVal(ULONG RegId)
{
PDEBUG_SCOPE Scope = GetCurrentScope();
if (g_EffMachine == IMAGE_FILE_MACHINE_IA64)
{
switch (RegId)
{
case INTSP:
return Scope->Frame.StackOffset;
case RSBSP:
return Scope->Frame.FrameOffset;
default:
// continue
;
}
CROSS_PLATFORM_CONTEXT Context;
Context = g_Machine->m_Context;
return GetRegValIA64(&Context, &Scope->Frame, RegId);
}
else if (g_EffMachine == IMAGE_FILE_MACHINE_I386)
{
switch (RegId)
{
case X86_EBP:
if (Scope->Frame.FuncTableEntry)
{
PFPO_DATA FpoData = (PFPO_DATA)Scope->Frame.FuncTableEntry;
if (FpoData->cbFrame == FRAME_FPO)
{
//
// Get EBP from FPO data, if available
//
if (SAVE_EBP(&Scope->Frame))
{
return SAVE_EBP(&Scope->Frame);
}
else
{
//
// Guess the ebp value, in most cases for FPO frames its
// a DWORD off frameoffset
//
return Scope->Frame.FrameOffset + sizeof(DWORD);
}
}
}
return Scope->Frame.FrameOffset;
case X86_ESP:
return Scope->Frame.StackOffset;
default:
// continue
;
}
}
return g_Machine->GetReg64(RegId);
}
/*
* TranslateAddress
* Flags Flags returned by dbghelp
* Address IN Address returned by dbghelp
* OUT Address of symbol
* Value Value of the symbol if its in register
*
*/
BOOL
TranslateAddress(
IN ULONG Flags,
IN ULONG RegId,
IN OUT PULONG64 Address,
OUT PULONG64 Value
)
{
PCROSS_PLATFORM_CONTEXT ScopeContext = GetCurrentScopeContext();
if (ScopeContext)
{
g_Machine->PushContext(ScopeContext);
}
if (Flags & SYMF_REGREL)
{
ULONG64 RegContent;
if (RegId)
{
RegContent = GetScopeRegVal(RegId);
}
else if (Value)
{
//
// *Value has RegID and *Address has Offset
//
RegContent = GetScopeRegVal(RegId = (ULONG) *Value);
}
else
{
DBG_ASSERT(FALSE);
if (ScopeContext)
{
g_Machine->PopContext();
}
return FALSE;
}
*Address = RegContent + ((LONG64) (LONG) (ULONG) *Address);
#if 0
// This is now adjusted in GetScopeRegVal
if (g_EffMachine == IMAGE_FILE_MACHINE_I386 &&
RegId == X86_EBP)
{
PDEBUG_SCOPE Scope = GetCurrentScope();
PFPO_DATA pFpoData = (PFPO_DATA)Scope->Frame.FuncTableEntry;
if (pFpoData &&
(pFpoData->cbFrame == FRAME_FPO ||
pFpoData->cbFrame == FRAME_TRAP))
{
// Compensate for FPO's not having ebp
*Address += sizeof(DWORD);
}
}
#endif
}
else if (Flags & SYMF_REGISTER)
{
if (Value)
{
if (RegId)
{
*Value = GetScopeRegVal(RegId);
}
else
{
*Value = GetScopeRegVal((ULONG) *Address);
}
}
}
else if (Flags & SYMF_FRAMEREL)
{
PDEBUG_SCOPE Scope = GetCurrentScope();
if (Scope->Frame.FrameOffset)
{
*Address += Scope->Frame.FrameOffset;
PFPO_DATA pFpoData = (PFPO_DATA)Scope->Frame.FuncTableEntry;
if (g_EffMachine == IMAGE_FILE_MACHINE_I386 &&
pFpoData &&
(pFpoData->cbFrame == FRAME_FPO ||
pFpoData->cbFrame == FRAME_TRAP))
{
// Compensate for FPO's not having ebp
*Address += sizeof(DWORD);
}
}
else
{
ADDR FP;
g_Machine->GetFP(&FP);
FP.flat = (LONG64) FP.flat + *Address;
*Address = FP.flat;
}
}
if (ScopeContext)
{
g_Machine->PopContext();
}
return TRUE;
}
void
GetSymbolStdCall(ULONG64 Offset,
PCHAR Buffer,
ULONG BufferLen,
PULONG64 Displacement,
PUSHORT StdCallParams
)
{
IMAGEHLP_MODULE64 Mod;
// Assert that we have at least a minimum amount of space.
DBG_ASSERT(BufferLen >= sizeof(Mod.ModuleName));
Buffer[BufferLen - 1] = 0;
// In the past symbolic information would report the
// size of stdcall arguments, thus the StdCallParams argument
// could be filled out. Nowadays we do not have access
// to this information so just set it to 0xffff, which
// means unknown. In the future perhaps this can be
// turned back on.
if (StdCallParams != NULL)
{
*StdCallParams = 0xffff;
}
Mod.SizeOfStruct = sizeof(Mod);
// SymGetModuleInfo does special things with a -1 offset,
// so just assume there's never a symbol there and skip the call.
if (Offset != -1 &&
SymGetModuleInfo64(g_CurrentProcess->Handle, Offset, &Mod))
{
if (SymGetSymFromAddr64(g_CurrentProcess->Handle, Offset,
Displacement, g_Sym))
{
if (*Displacement == (ULONG64)-1)
{
// In some BBT cases dbghelp can tell that an offset
// is associated with a particular symbol but it
// doesn't have a valid offset. Present the symbol
// but in a way that makes it clear that it's
// this special case.
_snprintf(Buffer, BufferLen - 1,
"%s!%s <PERF> (%s+0x%I64x)",
Mod.ModuleName, g_Sym->Name,
Mod.ModuleName, (Offset - Mod.BaseOfImage));
*Displacement = 0;
}
else
{
_snprintf(Buffer, BufferLen - 1,
"%s!%s", Mod.ModuleName, g_Sym->Name);
}
return;
}
else
{
if (Offset >= Mod.BaseOfImage &&
Offset <= Mod.BaseOfImage + Mod.ImageSize)
{
strcpy(Buffer, Mod.ModuleName);
*Displacement = Offset - Mod.BaseOfImage;
return;
}
}
}
ULONG64 FscBase;
// XXX drewb - Temporary hack so that stack traces
// show meaningful symbols for the fast system call
// code stuck in the shared user data area.
switch(IsInFastSyscall(Offset, &FscBase))
{
case FSC_FOUND:
strcpy(Buffer, "*SharedUserSystemCall");
*Displacement = Offset - FscBase;
return;
}
*Buffer = 0;
*Displacement = Offset;
}
BOOL
GetNearSymbol(
ULONG64 Offset,
PSTR Buffer,
ULONG BufferLen,
PULONG64 Disp,
LONG Delta
)
{
IMAGEHLP_MODULE64 Mod;
// Assert that we have at least a minimum amount of space.
DBG_ASSERT(BufferLen >= sizeof(Mod.ModuleName));
Buffer[BufferLen - 1] = 0;
Mod.SizeOfStruct = sizeof(Mod);
// SymGetModuleInfo does special things with a -1 offset,
// so just assume there's never a symbol there and skip the call.
if (Offset != -1 &&
SymGetModuleInfo64(g_CurrentProcess->Handle, Offset, &Mod))
{
if (SymGetSymFromAddr64(g_CurrentProcess->Handle, Offset, Disp, g_Sym))
{
if (Delta < 0)
{
while (Delta++ < 0)
{
if (!SymGetSymPrev(g_CurrentProcess->Handle, g_Sym))
{
return FALSE;
}
}
if (Disp != NULL)
{
*Disp = Offset - g_Sym->Address;
}
}
else if (Delta > 0)
{
while (Delta-- > 0)
{
if (!SymGetSymNext(g_CurrentProcess->Handle, g_Sym))
{
return FALSE;
}
}
if (Disp != NULL)
{
*Disp = g_Sym->Address - Offset;
}
}
_snprintf(Buffer, BufferLen - 1,
"%s!%s", Mod.ModuleName, g_Sym->Name);
return TRUE;
}
else if (Delta == 0 &&
Offset >= Mod.BaseOfImage &&
Offset <= Mod.BaseOfImage + Mod.ImageSize)
{
strcpy(Buffer, Mod.ModuleName);
if (Disp != NULL)
{
*Disp = Offset - Mod.BaseOfImage;
}
return TRUE;
}
}
return FALSE;
}
PDEBUG_IMAGE_INFO
GetImageByIndex(PPROCESS_INFO Process, ULONG Index)
{
PDEBUG_IMAGE_INFO Image = Process->ImageHead;
while (Index > 0 && Image != NULL)
{
Index--;
Image = Image->Next;
}
return Image;
}
PDEBUG_IMAGE_INFO
GetImageByOffset(PPROCESS_INFO Process, ULONG64 Offset)
{
PDEBUG_IMAGE_INFO Image = Process->ImageHead;
while (Image != NULL &&
(Offset < Image->BaseOfImage ||
Offset >= Image->BaseOfImage + Image->SizeOfImage))
{
Image = Image->Next;
}
return Image;
}
PDEBUG_IMAGE_INFO
GetImageByName(PPROCESS_INFO Process, PCSTR Name, INAME Which)
{
PDEBUG_IMAGE_INFO Image = Process->ImageHead;
while (Image != NULL)
{
PCSTR WhichStr;
switch(Which)
{
case INAME_IMAGE_PATH:
WhichStr = Image->ImagePath;
break;
case INAME_IMAGE_PATH_TAIL:
WhichStr = PathTail(Image->ImagePath);
break;
case INAME_MODULE:
if (Image->OriginalModuleName[0] &&
!_stricmp(Image->OriginalModuleName, Name))
{
return Image;
}
WhichStr = Image->ModuleName;
break;
}
if (_stricmp(WhichStr, Name) == 0)
{
break;
}
Image = Image->Next;
}
return Image;
}
#define IMAGE_IS_PATTERN ((PDEBUG_IMAGE_INFO)-1)
PDEBUG_IMAGE_INFO
ParseModuleName(PBOOL ModSpecified)
{
PSTR CmdSaved = g_CurCmd;
CHAR Name[MAX_MODULE];
PSTR Dst = Name;
CHAR ch;
BOOL HasWild = FALSE;
// first, parse out a possible module name, either a '*' or
// a string of 'A'-'Z', 'a'-'z', '0'-'9', '_', '~' (or null)
ch = PeekChar();
g_CurCmd++;
while ((ch >= 'A' && ch <= 'Z') ||
(ch >= 'a' && ch <= 'z') ||
(ch >= '0' && ch <= '9') ||
ch == '_' || ch == '~' || ch == '*' || ch == '?')
{
if (ch == '*' || ch == '?')
{
HasWild = TRUE;
}
*Dst++ = ch;
ch = *g_CurCmd++;
}
*Dst = '\0';
g_CurCmd--;
// if no '!' after name and white space, then no module specified
// restore text pointer and treat as null module (PC current)
if (PeekChar() == '!')
{
g_CurCmd++;
}
else
{
g_CurCmd = CmdSaved;
Name[0] = '\0';
}
// Name either has: '*' for all modules,
// '\0' for current module,
// nonnull string for module name.
*ModSpecified = Name[0] != 0;
if (HasWild)
{
return IMAGE_IS_PATTERN;
}
else if (Name[0])
{
return GetImageByName(g_CurrentProcess, Name, INAME_MODULE);
}
else
{
return NULL;
}
}
BOOL CALLBACK
ParseExamineSymbolInfo(
PSYMBOL_INFO SymInfo,
ULONG Size,
PVOID ExamineInfoArg
)
{
PEXAMINE_INFO ExamineInfo = (PEXAMINE_INFO)ExamineInfoArg;
ULONG64 Address = SymInfo->Address;
PDEBUG_IMAGE_INFO Image;
Image = GetImageByOffset(g_CurrentProcess, SymInfo->ModBase);
if (Image && ((SymInfo->Flags & IMAGEHLP_SYMBOL_INFO_LOCAL) == 0))
{
dprintf( "%s %s!%s",
FormatAddr64(Address),
Image->ModuleName,
SymInfo->Name);
}
else
{
ULONG64 Value = 0;
TranslateAddress(SymInfo->Flags, SymInfo->Register,
&Address, &Value);
dprintf( "%s %s",
FormatAddr64(Address),
SymInfo->Name);
}
if (ExamineInfo->Verbose)
{
dprintf(" ");
ShowSymbolInfo(SymInfo);
}
dprintf("\n");
return !CheckUserInterrupt();
}
/*** ParseExamine - parse and execute examine command
*
* Purpose:
* Parse the current command string and examine the symbol
* table to display the appropriate entries. The entries
* are displayed in increasing string order. This function
* accepts underscores, alphabetic, and numeric characters
* to match as well as the special characters '?', '*', '['-']'.
*
* Input:
* g_CurCmd - pointer to current command string
*
* Output:
* offset and string name of symbols displayed
*
*************************************************************************/
void
ParseExamine(void)
{
CHAR StringBuf[MAX_SYMBOL_LEN];
UCHAR ch;
PSTR String = StringBuf;
PSTR Start;
PSTR ModEnd;
BOOL ModSpecified;
ULONG64 Base = 0;
ULONG Count;
PDEBUG_IMAGE_INFO Image;
EXAMINE_INFO ExamineInfo;
// Get module pointer from name in command line (<string>!).
PeekChar();
Start = g_CurCmd;
Image = ParseModuleName(&ModSpecified);
ModEnd = g_CurCmd;
ch = PeekChar();
// Special case the command "x <pattern>!" to dump out the module table.
if (Image == IMAGE_IS_PATTERN &&
(ch == ';' || ch == '\0'))
{
*(ModEnd - 1) = 0;
_strupr(Start);
DumpModuleTable(DMT_STANDARD, Start);
return;
}
if (ModSpecified)
{
if (Image == NULL)
{
// The user specified a module that doesn't exist.
error(VARDEF);
}
else if (Image == IMAGE_IS_PATTERN)
{
// The user gave a pattern string for the module
// so we need to pass it on for dbghelp to scan with.
memcpy(String, Start, (ModEnd - Start));
String += ModEnd - Start;
}
else
{
// A specific image was given and found so
// confine the search to that one image.
Base = Image->BaseOfImage;
}
}
g_CurCmd++;
// Condense leading underscores into a "_#"
// that will match zero or more underscores. This causes all
// underscore-prefixed symbols to match the base symbol name
// when the pattern is prefixed by an underscore.
if (ch == '_')
{
*String++ = '_';
*String++ = '#';
do
{
ch = *g_CurCmd++;
} while (ch == '_');
}
ch = (UCHAR)toupper(ch);
while (ch && ch != ';' && ch != ' ')
{
*String++ = ch;
ch = (CHAR)toupper(*g_CurCmd);
g_CurCmd++;
}
*String = '\0';
g_CurCmd--;
ExamineInfo.Verbose = TRUE;
// We nee the scope for all cases since param values are displayed for
// function in scope
RequireCurrentScope();
SymEnumSymbols(g_CurrentProcess->Handle,
Base,
StringBuf,
ParseExamineSymbolInfo,
&ExamineInfo);
}
/*** fnListNear - function to list symbols near an address
*
* Purpose:
* from the address specified, access the symbol table to
* find the closest symbolic addresses both before and after
* it. output these on one line (if spaces permits).
*
* Input:
* addrstart - address to base listing
*
* Output:
* symbolic and absolute addresses of variable on or before
* and after the specified address
*
*************************************************************************/
void
fnListNear(ULONG64 AddrStart)
{
ULONG64 Displacement;
IMAGEHLP_MODULE64 Mod;
if (g_SrcOptions & SRCOPT_LIST_LINE)
{
OutputLineAddr(AddrStart);
}
if (SymGetSymFromAddr64(g_CurrentProcess->Handle, AddrStart,
&Displacement, g_Sym))
{
Mod.SizeOfStruct = sizeof(Mod);
if (!SymGetModuleInfo64(g_CurrentProcess->Handle, AddrStart, &Mod))
{
return;
}
dprintf("(%s) %s!%s",
FormatAddr64(g_Sym->Address),
Mod.ModuleName,
g_Sym->Name);
if (Displacement)
{
dprintf("+0x%s ", FormatDisp64(Displacement));
}
else
{
dprintf(" ");
}
if (SymGetSymNext64(g_CurrentProcess->Handle, g_Sym))
{
dprintf("| (%s) %s!%s",
FormatAddr64(g_Sym->Address),
Mod.ModuleName,
g_Sym->Name);
}
dprintf("\n");
}
}
void
DumpModuleTable(ULONG Flags, PSTR Pattern)
{
PDEBUG_IMAGE_INFO Image;
IMAGEHLP_MODULE64 mi;
DBH_MODSYMINFO SymFile;
ULONG i;
if (g_TargetMachine->m_Ptr64)
{
dprintf("start end module name\n");
}
else
{
dprintf("start end module name\n");
}
Image = g_CurrentProcess->ImageHead;
while (Image)
{
ULONG PrimaryName;
PSTR Names[DMT_NAME_COUNT];
if (Pattern != NULL &&
!MatchPattern(Image->ModuleName, Pattern))
{
Image = Image->Next;
continue;
}
mi.SizeOfStruct = sizeof(mi);
if (!SymGetModuleInfo64( g_CurrentProcess->Handle,
Image->BaseOfImage, &mi ))
{
mi.SymType = SymNone;
}
if (Flags & (DMT_SYM_FILE_NAME | DMT_VERBOSE))
{
SymFile.function = dbhModSymInfo;
SymFile.sizeofstruct = sizeof(SymFile);
SymFile.addr = Image->BaseOfImage;
if (!dbghelp(g_CurrentProcess->Handle, &SymFile))
{
sprintf(SymFile.file, "<Error: %s>",
FormatStatusCode(WIN32_LAST_STATUS()));
}
}
else
{
SymFile.file[0] = 0;
}
Names[DMT_NAME_SYM_IMAGE] = mi.LoadedImageName;
Names[DMT_NAME_SYM_FILE] = SymFile.file;
Names[DMT_NAME_MAPPED_IMAGE] = Image->MappedImagePath;
Names[DMT_NAME_IMAGE_PATH] = Image->ImagePath;
if (Flags & DMT_SYM_FILE_NAME)
{
PrimaryName = DMT_NAME_SYM_FILE;
}
else if (Flags & DMT_MAPPED_IMAGE_NAME)
{
PrimaryName = DMT_NAME_MAPPED_IMAGE;
}
else if (Flags & DMT_IMAGE_PATH_NAME)
{
PrimaryName = DMT_NAME_IMAGE_PATH;
}
else
{
PrimaryName = DMT_NAME_SYM_IMAGE;
}
//
// Skip modules filtered by flags
//
if ((Flags & DMT_ONLY_LOADED_SYMBOLS) &&
(mi.SymType == SymDeferred))
{
Image = Image->Next;
continue;
}
if (IS_KERNEL_TARGET())
{
if ((Flags & DMT_ONLY_USER_SYMBOLS) &&
(Image->BaseOfImage >= g_SystemRangeStart))
{
Image = Image->Next;
continue;
}
if ((Flags & DMT_ONLY_KERNEL_SYMBOLS) &&
(Image->BaseOfImage <= g_SystemRangeStart))
{
Image = Image->Next;
continue;
}
}
_strlwr( Image->ModuleName );
dprintf( "%s %s %-8s ",
FormatAddr64(Image->BaseOfImage),
FormatAddr64(Image->BaseOfImage + Image->SizeOfImage),
Image->ModuleName
);
if (Flags & DMT_NO_SYMBOL_OUTPUT)
{
goto SkipSymbolOutput;
}
if (PrimaryName == DMT_NAME_MAPPED_IMAGE ||
PrimaryName == DMT_NAME_IMAGE_PATH)
{
dprintf(" %s\n",
*Names[PrimaryName] ? Names[PrimaryName] : "<none>");
goto SkipSymbolOutput;
}
switch (Image->GoodCheckSum)
{
case DII_GOOD_CHECKSUM:
dprintf( " " );
break;
case DII_UNKNOWN_TIMESTAMP:
dprintf( "T " );
break;
case DII_UNKNOWN_CHECKSUM:
dprintf( "C " );
break;
case DII_BAD_CHECKSUM:
dprintf( "# " );
break;
}
if (mi.SymType == SymDeferred)
{
dprintf( "(deferred) " );
}
else if (mi.SymType == SymNone)
{
dprintf( "(no symbolic information) " );
}
else
{
switch ( mi.SymType )
{
case SymCoff:
dprintf( "(coff symbols) " );
break;
case SymCv:
dprintf( "(codeview symbols) " );
break;
case SymPdb:
dprintf( "(pdb symbols) " );
break;
case SymExport:
dprintf( "(export symbols) " );
break;
}
dprintf("%s", *Names[PrimaryName] ? Names[PrimaryName] : "<none>");
}
dprintf("\n");
SkipSymbolOutput:
if (Flags & DMT_VERBOSE)
{
for (i = 0; i < DMT_NAME_COUNT; i++)
{
if (i != PrimaryName && *Names[i])
{
dprintf(" %s: %s\n", g_DmtNameDescs[i], Names[i]);
}
}
}
if (Flags & (DMT_VERBOSE | DMT_IMAGE_TIMESTAMP))
{
LPSTR TimeDateStr = TimeToStr(Image->TimeDateStamp);
dprintf(" Checksum: %08X Timestamp: %s (%08X)\n",
Image->CheckSum, TimeDateStr, Image->TimeDateStamp);
}
if (Flags & DMT_VERBOSE)
{
VS_FIXEDFILEINFO FixedVer;
if (g_Target->GetImageVersionInformation
(Image->ImagePath, Image->BaseOfImage, "\\",
&FixedVer, sizeof(FixedVer), NULL) == S_OK)
{
char Item[64];
char VerString[128];
dprintf(" File version: %d.%d.%d.%d"
" Product version: %d.%d.%d.%d\n",
FixedVer.dwFileVersionMS >> 16,
FixedVer.dwFileVersionMS & 0xFFFF,
FixedVer.dwFileVersionLS >> 16,
FixedVer.dwFileVersionLS & 0xFFFF,
FixedVer.dwProductVersionMS >> 16,
FixedVer.dwProductVersionMS & 0xFFFF,
FixedVer.dwProductVersionLS >> 16,
FixedVer.dwProductVersionLS & 0xFFFF);
dprintf(" File flags: %X (Mask %X) File OS: %X "
"File type: %X.%X\n",
FixedVer.dwFileFlags & FixedVer.dwFileFlagsMask,
FixedVer.dwFileFlagsMask, FixedVer.dwFileOS,
FixedVer.dwFileType, FixedVer.dwFileSubtype);
dprintf(" File date: %08X.%08X\n",
FixedVer.dwFileDateMS, FixedVer.dwFileDateLS);
sprintf(Item, "\\StringFileInfo\\%04x%04x\\FileVersion",
VER_VERSION_TRANSLATION);
if (SUCCEEDED(g_Target->GetImageVersionInformation
(Image->ImagePath, Image->BaseOfImage, Item,
VerString, sizeof(VerString), NULL)))
{
dprintf(" Version string: %s\n", VerString);
}
}
}
if (CheckUserInterrupt())
{
break;
}
Image = Image->Next;
}
UnloadedModuleInfo* Unl;
if ((Flags & (DMT_ONLY_LOADED_SYMBOLS | DMT_ONLY_USER_SYMBOLS)) == 0)
{
ULONG LumFlags = LUM_OUTPUT;
LumFlags |= ((Flags & DMT_VERBOSE) ? LUM_OUTPUT_VERBOSE : 0);
LumFlags |= ((Flags & DMT_IMAGE_TIMESTAMP) ? LUM_OUTPUT_TIMESTAMP : 0);
dprintf("\n");
ListUnloadedModules(LumFlags, Pattern);
}
}
void
ParseDumpModuleTable(void)
{
ULONG Flags = DMT_STANDARD;
char Pattern[MAX_MODULE];
PSTR Pat = NULL;
g_CurCmd++;
for (;;)
{
// skip white space
while (isspace(*g_CurCmd))
{
g_CurCmd++;
}
if (*g_CurCmd == 'f')
{
Flags = (Flags & ~DMT_NAME_FLAGS) | DMT_IMAGE_PATH_NAME;
g_CurCmd++;
}
else if (*g_CurCmd == 'i')
{
Flags = (Flags & ~DMT_NAME_FLAGS) | DMT_SYM_IMAGE_FILE_NAME;
g_CurCmd++;
}
else if (*g_CurCmd == 'l')
{
Flags |= DMT_ONLY_LOADED_SYMBOLS;
g_CurCmd++;
}
else if (*g_CurCmd == 'm')
{
g_CurCmd++;
// skip white space
while (isspace(*g_CurCmd))
{
g_CurCmd++;
}
Pat = Pattern;
while (*g_CurCmd && !isspace(*g_CurCmd))
{
if ((Pat - Pattern) < sizeof(Pattern) - 1)
{
*Pat++ = *g_CurCmd;
}
g_CurCmd++;
}
*Pat = 0;
Pat = Pattern;
_strupr(Pat);
}
else if (*g_CurCmd == 'p')
{
Flags = (Flags & ~DMT_NAME_FLAGS) | DMT_MAPPED_IMAGE_NAME;
g_CurCmd++;
}
else if (*g_CurCmd == 't')
{
Flags = (Flags & ~(DMT_NAME_FLAGS)) | DMT_NAME_SYM_IMAGE | DMT_IMAGE_TIMESTAMP
| DMT_NO_SYMBOL_OUTPUT;
g_CurCmd++;
}
else if (*g_CurCmd == 'v')
{
Flags |= DMT_VERBOSE;
g_CurCmd++;
}
else if (IS_KERNEL_TARGET())
{
if (*g_CurCmd == 'u')
{
Flags |= DMT_ONLY_USER_SYMBOLS;
g_CurCmd++;
}
else if (*g_CurCmd == 'k')
{
Flags |= DMT_ONLY_KERNEL_SYMBOLS;
g_CurCmd++;
}
else
{
break;
}
}
else
{
break;
}
}
DumpModuleTable(Flags, Pat);
}
void
GetCurrentMemoryOffsets (
PULONG64 pMemoryLow,
PULONG64 pMemoryHigh
)
{
*pMemoryLow = (ULONG64)(LONG64)-1; // default value for no source
}
ULONG
ReadImageData(
ULONG64 Address,
HANDLE hFile,
LPVOID Buffer,
ULONG Size
)
{
if (hFile)
{
ULONG Result;
if (!SetFilePointer( hFile, (ULONG)Address, NULL, FILE_BEGIN ))
{
return 0;
}
if (!ReadFile( hFile, Buffer, Size, &Result, NULL))
{
return 0;
}
}
else
{
ULONG Result;
if (g_Target->ReadVirtual(Address, Buffer, Size, &Result) != S_OK ||
Result < Size)
{
return 0;
}
}
return Size;
}
BOOL
GetModnameFromImageInternal(ULONG64 BaseOfDll,
HANDLE hFile,
LPSTR lpName,
ULONG NameSize
)
{
IMAGE_DEBUG_DIRECTORY DebugDir;
PIMAGE_DEBUG_MISC pMisc;
PIMAGE_DEBUG_MISC pT;
DWORD rva;
int nDebugDirs;
int i;
int j;
int l;
BOOL rVal = FALSE;
PVOID pExeName;
IMAGE_DOS_HEADER dh;
USHORT NumberOfSections;
USHORT Characteristics;
ULONG64 address;
DWORD sig;
PIMAGE_SECTION_HEADER pSH = NULL;
DWORD cb;
NTSTATUS Status;
ULONG Result;
IMAGE_NT_HEADERS64 nh64;
PIMAGE_NT_HEADERS32 pnh32 = (PIMAGE_NT_HEADERS32) &nh64;
BOOL fCheckDllExtensionInExportTable = FALSE;
lpName[0] = 0;
if (hFile)
{
BaseOfDll = 0;
}
address = BaseOfDll;
ReadImageData( address, hFile, &dh, sizeof(dh) );
if (dh.e_magic == IMAGE_DOS_SIGNATURE)
{
address += dh.e_lfanew;
}
ReadImageData( address, hFile, &sig, sizeof(sig) );
if (sig != IMAGE_NT_SIGNATURE)
{
IMAGE_FILE_HEADER fh;
IMAGE_ROM_OPTIONAL_HEADER rom;
ReadImageData( address, hFile, &fh, sizeof(IMAGE_FILE_HEADER) );
address += sizeof(IMAGE_FILE_HEADER);
ReadImageData( address, hFile, &rom, sizeof(rom) );
address += sizeof(rom);
if (rom.Magic == IMAGE_ROM_OPTIONAL_HDR_MAGIC)
{
NumberOfSections = fh.NumberOfSections;
Characteristics = fh.Characteristics;
nDebugDirs = rva = 0;
}
else
{
goto Finish;
}
}
else
{
//
// read the head as a 64 bit header and cast it appropriately.
//
ReadImageData( address, hFile, &nh64, sizeof(nh64) );
if (IsImageMachineType64(pnh32->FileHeader.Machine))
{
address += sizeof(IMAGE_NT_HEADERS64);
NumberOfSections = nh64.FileHeader.NumberOfSections;
Characteristics = nh64.FileHeader.Characteristics;
nDebugDirs = nh64.OptionalHeader.
DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size /
sizeof(IMAGE_DEBUG_DIRECTORY);
rva = nh64.OptionalHeader.
DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress;
}
else
{
address += sizeof(IMAGE_NT_HEADERS32);
NumberOfSections = pnh32->FileHeader.NumberOfSections;
Characteristics = pnh32->FileHeader.Characteristics;
nDebugDirs = pnh32->OptionalHeader.
DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size /
sizeof(IMAGE_DEBUG_DIRECTORY);
rva = pnh32->OptionalHeader.
DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress;
}
}
// After this point, none of the image datastructures have changed between
// 32bit NT and 64bit NT.
cb = NumberOfSections * IMAGE_SIZEOF_SECTION_HEADER;
pSH = (PIMAGE_SECTION_HEADER)malloc( cb );
if (!pSH)
{
goto Finish;
}
if (!ReadImageData( address, hFile, pSH, cb ))
{
goto Finish;
}
if (!nDebugDirs)
{
goto CheckExportTable;
}
for (i = 0; i < NumberOfSections; i++)
{
if (rva >= pSH[i].VirtualAddress &&
rva < pSH[i].VirtualAddress + pSH[i].SizeOfRawData)
{
break;
}
}
if (i >= NumberOfSections)
{
goto CheckExportTable;
}
rva = rva - pSH[i].VirtualAddress;
if (hFile)
{
rva += pSH[i].PointerToRawData;
}
else
{
rva += pSH[i].VirtualAddress;
}
for (j = 0; j < nDebugDirs; j++)
{
ReadImageData( rva + (sizeof(DebugDir) * j) + BaseOfDll,
hFile, &DebugDir, sizeof(DebugDir) );
if (DebugDir.Type == IMAGE_DEBUG_TYPE_MISC)
{
l = DebugDir.SizeOfData;
pMisc = pT = (PIMAGE_DEBUG_MISC)malloc(l);
if (!pMisc)
{
break;
}
if (!hFile &&
((ULONG)DebugDir.AddressOfRawData < pSH[i].VirtualAddress ||
(ULONG)DebugDir.AddressOfRawData >=
pSH[i].VirtualAddress + pSH[i].SizeOfRawData))
{
//
// the misc debug data MUST be in the .rdata section
// otherwise the debugger cannot access it as it is not
// mapped in.
//
break;
}
if (hFile)
{
address = DebugDir.PointerToRawData;
}
else
{
address = DebugDir.AddressOfRawData + BaseOfDll;
}
ReadImageData( address, hFile, pMisc, l );
while (l > 0)
{
if (pMisc->DataType != IMAGE_DEBUG_MISC_EXENAME)
{
//
// beware corrupt images:
//
if (pMisc->Length == 0 ||
pMisc->Length > (ULONG)l)
{
break;
}
l -= pMisc->Length;
pMisc = (PIMAGE_DEBUG_MISC)
(((LPSTR)pMisc) + pMisc->Length);
}
else
{
pExeName = (PVOID)&pMisc->Data[ 0 ];
if (!pMisc->Unicode)
{
strncat(lpName, (LPSTR)pExeName, NameSize - 1);
rVal = TRUE;
}
else
{
WideCharToMultiByte(CP_ACP,
0,
(LPWSTR)pExeName,
-1,
lpName,
NameSize,
NULL,
NULL);
rVal = TRUE;
}
//
// Undo stevewo's error
//
if (_stricmp(&lpName[strlen(lpName) - 4], ".DBG") == 0)
{
char rgchPath[MAX_IMAGE_PATH];
char rgchBase[_MAX_FNAME];
_splitpath(lpName, NULL, rgchPath, rgchBase, NULL);
if (strlen(rgchPath) == 4)
{
rgchPath[strlen(rgchPath) - 1] = 0;
strcpy(lpName, rgchBase);
strcat(lpName, ".");
strcat(lpName, rgchPath);
}
else if (Characteristics & IMAGE_FILE_DLL)
{
strcpy(lpName, rgchBase);
strcat(lpName, ".dll");
}
else
{
strcpy(lpName, rgchBase);
strcat(lpName, ".exe");
}
}
break;
}
}
free(pT);
break;
}
else if ((DebugDir.Type == IMAGE_DEBUG_TYPE_CODEVIEW) &&
((!hFile && DebugDir.AddressOfRawData) ||
(hFile && DebugDir.PointerToRawData)) &&
(DebugDir.SizeOfData > sizeof(NB10IH)))
{
DWORD Signature;
char rgchPath[MAX_IMAGE_PATH];
char rgchBase[_MAX_FNAME];
// Mapped CV info. Read the data and see what the content is.
if (hFile)
{
address = DebugDir.PointerToRawData;
}
else
{
address = DebugDir.AddressOfRawData + BaseOfDll;
}
if (!ReadImageData( address, hFile, &Signature,
sizeof(Signature) ))
{
break;
}
// NB10 or PDB7 signature?
if (Signature == NB10_SIG ||
Signature == RSDS_SIG)
{
ULONG HdrSize = Signature == NB10_SIG ?
sizeof(NB10IH) : sizeof(RSDSIH);
address += HdrSize;
if ((DebugDir.SizeOfData - sizeof(HdrSize)) > MAX_PATH)
{
// Something's wrong here. The record should only contain
// a MAX_PATH path name.
break;
}
if (DebugDir.SizeOfData - HdrSize > NameSize)
{
break;
}
if (!ReadImageData(address, hFile, lpName,
DebugDir.SizeOfData - HdrSize))
{
break;
}
_splitpath(lpName, NULL, rgchPath, rgchBase, NULL);
// Files are sometimes generated with .pdb appended
// to the image name rather than replacing the extension
// of the image name, such as foo.exe.pdb.
// splitpath only takes off the outermost extension,
// so check and see if the base already has an extension
// we recognize.
PSTR Ext = strrchr(rgchBase, '.');
if (Ext != NULL &&
(!strcmp(Ext, ".exe") || !strcmp(Ext, ".dll") ||
!strcmp(Ext, ".sys")))
{
// The base already has an extension so use
// it as-is.
strcpy(lpName, rgchBase);
fCheckDllExtensionInExportTable = !strcmp(Ext, ".dll");
}
else if (Characteristics & IMAGE_FILE_DLL)
{
strcpy(lpName, rgchBase);
strcat(lpName, ".dll");
fCheckDllExtensionInExportTable = TRUE;
}
else
{
strcpy(lpName, rgchBase);
strcat(lpName, ".exe");
}
rVal = TRUE;
}
}
}
if (!rVal || fCheckDllExtensionInExportTable)
{
CHAR Char;
ULONG64 ExportNameRva;
char FileName[MAX_IMAGE_PATH];
int x;
ExportNameRva = 0;
CheckExportTable:
// No luck wandering the debug info. Try the export table.
if (IsImageMachineType64(pnh32->FileHeader.Machine))
{
rva = nh64.OptionalHeader.
DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
}
else
{
rva = pnh32->OptionalHeader.
DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
}
if (!rva)
{
goto Finish;
}
for (i = 0; i < NumberOfSections; i++)
{
if (rva >= pSH[i].VirtualAddress &&
rva < pSH[i].VirtualAddress + pSH[i].SizeOfRawData)
{
break;
}
}
if (i >= NumberOfSections)
{
goto Finish;
}
if (hFile)
{
rva = rva - pSH[i].VirtualAddress + pSH[i].PointerToRawData;
}
if (!ReadImageData( rva + offsetof(IMAGE_EXPORT_DIRECTORY, Name) +
BaseOfDll, hFile, &ExportNameRva, sizeof(DWORD)))
{
goto Finish;
}
if (hFile)
{
ExportNameRva = ExportNameRva - pSH[i].VirtualAddress +
pSH[i].PointerToRawData;
}
ExportNameRva += BaseOfDll;
rVal = TRUE;
x = 0;
do
{
if (!ReadImageData( ExportNameRva,
hFile, &Char, sizeof(Char)))
{
rVal = FALSE;
break;
}
ExportNameRva++;
FileName[x] = Char;
x++;
} while (Char && (x < sizeof(FileName)));
if (fCheckDllExtensionInExportTable)
{
char rgchExtFromExportTable[_MAX_EXT];
_splitpath(FileName, NULL, NULL, NULL, rgchExtFromExportTable);
if (_stricmp(rgchExtFromExportTable, ".dll"))
{
// Export table has something different.
// Use it with our base name.
strcpy(lpName + strlen(lpName) - 4,
rgchExtFromExportTable);
}
}
else
{
lpName[0] = 0;
strncat(lpName, FileName, NameSize - 1);
}
}
Finish:
if (pSH)
{
free(pSH);
}
return rVal;
}
BOOL
GetModnameFromImage(ULONG64 BaseOfDll,
HANDLE hFile,
LPSTR lpName,
ULONG NameSize)
{
BOOL Status = GetModnameFromImageInternal( BaseOfDll, NULL,
lpName, NameSize );
if (!Status && hFile != NULL)
{
Status = GetModnameFromImageInternal( BaseOfDll, hFile,
lpName, NameSize );
}
return Status;
}
BOOL
GetHeaderInfo(
IN ULONG64 BaseOfDll,
OUT LPDWORD CheckSum,
OUT LPDWORD TimeDateStamp,
OUT LPDWORD SizeOfImage
)
{
IMAGE_NT_HEADERS32 nh32;
IMAGE_DOS_HEADER dh;
ULONG64 address;
DWORD sig;
address = BaseOfDll;
ReadImageData( address, NULL, &dh, sizeof(dh) );
if (dh.e_magic == IMAGE_DOS_SIGNATURE) {
address += dh.e_lfanew;
}
ReadImageData( address, NULL, &sig, sizeof(sig) );
if (sig != IMAGE_NT_SIGNATURE) {
IMAGE_FILE_HEADER fh;
ReadImageData( address, NULL, &fh, sizeof(IMAGE_FILE_HEADER) );
*CheckSum = 0;
*TimeDateStamp = fh.TimeDateStamp;
*SizeOfImage = 0;
return TRUE;
}
// Attempt to read as a 32bit header, then reread if the image type is 64bit.
// This works because IMAGE_FILE_HEADER, which is at the start of the IMAGE_NT_HEADERS,
// is the same on 32bit NT and 64bit NT and IMAGE_NT_HEADER32 <= IMAGE_NT_HEADER64.
ReadImageData( address, NULL, &nh32, sizeof(nh32) );
if (IsImageMachineType64(nh32.FileHeader.Machine)) {
// Image is 64bit. Reread as a 64bit structure.
IMAGE_NT_HEADERS64 nh64;
ReadImageData( address, NULL, &nh64, sizeof(nh64) );
*CheckSum = nh64.OptionalHeader.CheckSum;
*TimeDateStamp = nh64.FileHeader.TimeDateStamp;
*SizeOfImage = nh64.OptionalHeader.SizeOfImage;
}
else {
*CheckSum = nh32.OptionalHeader.CheckSum;
*TimeDateStamp = nh32.FileHeader.TimeDateStamp;
*SizeOfImage = nh32.OptionalHeader.SizeOfImage;
}
return TRUE;
}
PCSTR
PrependPrefixToSymbol( char PrefixedString[],
PCSTR pString,
PCSTR *RegString
)
{
if ( RegString )
{
*RegString = NULL;
}
PCSTR bangPtr;
int bang = '!';
PCSTR Tail;
bangPtr = strchr( pString, bang );
if ( bangPtr )
{
Tail = bangPtr + 1;
}
else
{
Tail = pString;
}
if ( strncmp( Tail, g_Machine->m_SymPrefix, g_Machine->m_SymPrefixLen ) )
{
ULONG Loc = (ULONG)(Tail - pString);
if (Loc > 0)
{
memcpy( PrefixedString, pString, Loc );
}
memcpy( PrefixedString + Loc, g_Machine->m_SymPrefix,
g_Machine->m_SymPrefixLen );
if ( RegString )
{
*RegString = &PrefixedString[Loc];
}
Loc += g_Machine->m_SymPrefixLen;
strcpy( &PrefixedString[Loc], Tail );
return PrefixedString;
}
else
{
return pString;
}
}
BOOL
ForceSymbolCodeAddress(PSYMBOL_INFO Symbol, MachineInfo* Machine)
{
ULONG64 Code = Symbol->Address;
if (Symbol->Flags & SYMF_FORWARDER)
{
char Fwd[2 * MAX_PATH];
ULONG Read;
PSTR Sep;
// The address of a forwarder entry points to the
// string name of the function that things are forwarded
// to. Look up that name and try to get the address
// from it.
if (g_Target->ReadVirtual(Symbol->Address, Fwd, sizeof(Fwd),
&Read) != S_OK ||
Read < 2)
{
ErrOut("Unable to read forwarder string\n");
return FALSE;
}
Fwd[sizeof(Fwd) - 1] = 0;
if (!(Sep = strchr(Fwd, '.')))
{
ErrOut("Unable to read forwarder string\n");
return FALSE;
}
*Sep = '!';
if (GetOffsetFromSym(Fwd, &Code, NULL) != 1)
{
ErrOut("Unable to get address of forwarder '%s'\n", Fwd);
return FALSE;
}
}
else if (Machine->m_ExecTypes[0] == IMAGE_FILE_MACHINE_IA64 &&
(Symbol->Flags & SYMF_EXPORT))
{
// On IA64 the export entries contain the address
// of the plabel. We want the actual code address
// so resolve the plabel to its code.
if (!Machine->GetPrefixedSymbolOffset(Symbol->Address,
GETPREF_VERBOSE,
&Code))
{
return FALSE;
}
}
Symbol->Address = Code;
return TRUE;
}
/*** GetOffsetFromSym - return offset from symbol specified
*
* Purpose:
* external routine.
* With the specified symbol, set the pointer to
* its offset. The variable chSymbolSuffix may
* be used to append a character to repeat the search
* if it first fails.
*
* Input:
* pString - pointer to input symbol
*
* Output:
* pOffset - pointer to offset to be set
*
* Returns:
* BOOL value of success
*
*************************************************************************/
#ifndef _DBGHELP_USER_GENERATED_SYMBOLS_NOTSUPPORTED
extern "C" {
BOOL
IMAGEAPI
SymSetSymWithAddr64(
IN HANDLE hProcess,
IN DWORD64 qwAddr,
IN LPSTR SymString,
OUT PIMAGEHLP_SYMBOL64 Symbol
);
}
#endif // ! _DBGHELP_USER_GENERATED_SYMBOLS_NOTSUPPORTED
BOOL
GetOffsetFromMod(
PCSTR pString,
PULONG64 pOffset
)
{
if (!strchr(pString, '!'))
{
// Could be a module name
PDEBUG_IMAGE_INFO pImage = g_CurrentProcess->ImageHead;
while (pImage)
{
if (!_stricmp(pString, &pImage->ModuleName[0]) ||
(pImage->OriginalModuleName[0] &&
!_stricmp(pString, &pImage->OriginalModuleName[0])))
{
*pOffset = pImage->BaseOfImage;
return TRUE;
}
pImage = pImage->Next;
}
}
return FALSE;
}
BOOL
IgnoreEnumeratedSymbol(class MachineInfo* Machine,
PSYMBOL_INFO SymInfo)
{
ULONG64 Func;
//
// IA64 plabels are publics with the same name
// as the function they refer to. This causes
// ambiguity problems as we end up with two
// hits. The plabel is rarely interesting, though,
// so just filter them out here so that expressions
// always evaluate to the function itself.
//
if (Machine->m_ExecTypes[0] != IMAGE_FILE_MACHINE_IA64 ||
SymInfo->Scope != SymTagPublicSymbol ||
SymInfo->Flags & SYMF_FUNCTION ||
!Machine->GetPrefixedSymbolOffset(SymInfo->Address, 0, &Func))
{
return FALSE;
}
PSTR FuncSym;
__try
{
FuncSym = (PSTR)alloca(MAX_SYMBOL_LEN * 2);
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
FuncSym = NULL;
}
if (FuncSym == NULL)
{
return FALSE;
}
SYMBOL_INFO LocalSymInfo;
// We have to save and restore the original data as
// dbghelp always uses a single buffer to store all
// symbol information. The incoming symbol info
// is going to be wiped out when we
// call GetSymbolStdCall.
LocalSymInfo = *SymInfo;
strcpy(FuncSym + MAX_SYMBOL_LEN, SymInfo->Name);
ULONG64 FuncSymDisp;
GetSymbolStdCall(Func, FuncSym, MAX_SYMBOL_LEN,
&FuncSymDisp, NULL);
*SymInfo = LocalSymInfo;
strcpy(SymInfo->Name, FuncSym + MAX_SYMBOL_LEN);
return FuncSymDisp == 0 && strstr(FuncSym, SymInfo->Name);
}
struct COUNT_SYMBOL_MATCHES
{
MachineInfo* Machine;
SYMBOL_INFO ReturnSymInfo;
CHAR SymbolNameOverflowBuffer[MAX_SYMBOL_LEN];
ULONG Matches;
};
BOOL CALLBACK
CountSymbolMatches(
PSYMBOL_INFO SymInfo,
ULONG Size,
PVOID UserContext
)
{
COUNT_SYMBOL_MATCHES* Context =
(COUNT_SYMBOL_MATCHES*)UserContext;
if (IgnoreEnumeratedSymbol(Context->Machine, SymInfo))
{
return TRUE;
}
if (Context->Matches == 1)
{
// We already have one match, check if we got a duplicate.
if ((SymInfo->Address == Context->ReturnSymInfo.Address) &&
!strcmp(SymInfo->Name, Context->ReturnSymInfo.Name))
{
// Looks like the same symbol, ignore it.
return TRUE;
}
}
Context->ReturnSymInfo = *SymInfo;
if (SymInfo->NameLen < MAX_SYMBOL_LEN)
{
strcpy(Context->ReturnSymInfo.Name, SymInfo->Name);
}
Context->Matches++;
return TRUE;
}
ULONG
MultiSymFromName(IN HANDLE Process,
IN LPSTR Name,
IN ULONG64 ImageBase,
IN MachineInfo* Machine,
OUT PSYMBOL_INFO Symbol)
{
ULONG Matches;
RequireCurrentScope();
if (ImageBase == 0)
{
if (!SymFromName(Process, Name, Symbol))
{
return 0;
}
Matches = 1;
}
else
{
COUNT_SYMBOL_MATCHES Context;
ULONG MaxName = Symbol->MaxNameLen;
Context.Machine = Machine;
Context.ReturnSymInfo = *Symbol;
if (Symbol->NameLen < MAX_SYMBOL_LEN)
{
strcpy(Context.ReturnSymInfo.Name, Symbol->Name);
}
Context.Matches = 0;
SymEnumSymbols(Process, ImageBase, Name,
CountSymbolMatches, &Context);
*Symbol = Context.ReturnSymInfo;
Symbol->MaxNameLen = MaxName;
if (Symbol->MaxNameLen > Context.ReturnSymInfo.NameLen)
{
strcpy(Symbol->Name, Context.ReturnSymInfo.Name);
}
Matches = Context.Matches;
}
if (Matches == 1 &&
!ForceSymbolCodeAddress(Symbol, Machine))
{
return 0;
}
return Matches;
}
ULONG
GetOffsetFromSym(PCSTR String,
PULONG64 Offset,
PDEBUG_IMAGE_INFO* Image)
{
CHAR ModifiedString[MAX_SYMBOL_LEN + 64];
CHAR Suffix[2];
SYMBOL_INFO SymInfo = {0};
ULONG Count;
if (Image != NULL)
{
*Image = NULL;
}
//
// We can't do anything without a current process.
//
if (g_CurrentProcess == NULL)
{
return 0;
}
if ( strlen(String) == 0 )
{
return 0;
}
if (GetOffsetFromMod(String, Offset))
{
return 1;
}
//
// If a module name was given look up the module
// and determine the processor type so that the
// appropriate machine is used for the following
// machine-specific operations.
//
PDEBUG_IMAGE_INFO StrImage;
ULONG64 ImageBase;
PCSTR ModSep = strchr(String, '!');
if (ModSep != NULL)
{
ULONG Len = (ULONG)(ModSep - String);
memcpy(ModifiedString, String, Len);
ModifiedString[Len] = 0;
StrImage = GetImageByName(g_CurrentProcess, ModifiedString,
INAME_MODULE);
if (Image != NULL)
{
*Image = StrImage;
}
ImageBase = StrImage ? StrImage->BaseOfImage : 0;
}
else
{
StrImage = NULL;
ImageBase = 0;
}
MachineInfo* Machine = g_Machine;
if (StrImage != NULL)
{
Machine = MachineTypeInfo(ModuleMachineType(g_CurrentProcess,
StrImage->BaseOfImage));
if (Machine == NULL)
{
Machine = g_Machine;
}
}
if ( g_PrefixSymbols && Machine->m_SymPrefix != NULL )
{
PCSTR PreString;
PCSTR RegString;
PreString = PrependPrefixToSymbol( ModifiedString, String,
&RegString );
if ( Count =
MultiSymFromName( g_CurrentProcess->Handle, (PSTR)PreString,
ImageBase, Machine, &SymInfo ) )
{
*Offset = SymInfo.Address;
goto GotOffsetSuccess;
}
if ( (PreString != String) &&
(Count =
MultiSymFromName( g_CurrentProcess->Handle, (PSTR)String,
ImageBase, Machine, &SymInfo ) ) )
{
// Ambiguous plabels shouldn't be further resolved,
// so just return the information for the plabel.
if (Count > 1)
{
*Offset = SymInfo.Address;
goto GotOffsetSuccess;
}
if (Machine->GetPrefixedSymbolOffset(SymInfo.Address,
GETPREF_VERBOSE,
Offset))
{
#ifndef _DBGHELP_USER_GENERATED_SYMBOLS_NOTSUPPORTED
if ( ! SymSetSymWithAddr64( g_CurrentProcess->Handle,
*Offset, (PSTR)RegString,
g_Sym ) )
{
DWORD LastError = GetLastError();
if ( LastError != ERROR_ALREADY_EXISTS )
{
ErrOut("GetOffsetFromSym: "
"%s registration in dbghelp: "
"FAILED!!!, lerr:0x%lx\n",
RegString, LastError );
}
#endif // !_DBGHELP_USER_GENERATED_SYMBOLS_NOTSUPPORTED
}
else
{
// This symbol doesn't appear to actually
// be a plabel so just use the symbol address.
*Offset = SymInfo.Address;
}
}
else
{
*Offset = SymInfo.Address;
}
goto GotOffsetSuccess;
}
}
else if (Count =
MultiSymFromName( g_CurrentProcess->Handle, (PSTR)String,
ImageBase, Machine, &SymInfo ))
{
*Offset = SymInfo.Address;
goto GotOffsetSuccess;
}
if (g_SymbolSuffix != 'n')
{
strcpy( ModifiedString, String );
Suffix[0] = g_SymbolSuffix;
Suffix[1] = '\0';
strcat( ModifiedString, Suffix );
if (Count =
MultiSymFromName( g_CurrentProcess->Handle, ModifiedString,
ImageBase, Machine, &SymInfo ))
{
*Offset = SymInfo.Address;
goto GotOffsetSuccess;
}
}
return 0;
GotOffsetSuccess:
TranslateAddress(SymInfo.Flags, SymInfo.Register, Offset, &SymInfo.Value);
if (SymInfo.Flags & SYMF_REGISTER)
{
*Offset = SymInfo.Value;
}
return Count;
}
void
CreateModuleNameFromPath(LPSTR ImagePath, LPSTR ModuleName)
{
PSTR Scan;
ModuleName[0] = 0;
strncat( ModuleName, PathTail(ImagePath), MAX_MODULE - 1 );
Scan = strchr( ModuleName, '.' );
if (Scan != NULL)
{
*Scan = '\0';
}
}
void
GetAdjacentSymOffsets(
ULONG64 addrStart,
PULONG64 prevOffset,
PULONG64 nextOffset
)
{
DWORD64 Displacement;
//
// assume failure
//
*prevOffset = 0;
*nextOffset = (ULONG64) -1;
//
// get the symbol for the initial address
//
if (!SymGetSymFromAddr64( g_CurrentProcess->Handle, addrStart, &Displacement, g_SymStart )) {
return;
}
*prevOffset = g_SymStart->Address;
if (SymGetSymNext64( g_CurrentProcess->Handle, g_SymStart )) {
*nextOffset = g_SymStart->Address;
}
return;
}
BOOL
SymbolCallbackFunction(
HANDLE hProcess,
ULONG ActionCode,
ULONG64 CallbackData,
ULONG64 UserContext
)
{
PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 idsl;
PIMAGEHLP_CBA_READ_MEMORY prm;
PIMAGEHLP_CBA_EVENT evt;
PDEBUG_IMAGE_INFO pImage;
IMAGEHLP_MODULE64 mi;
PUCHAR p;
ULONG i;
ULONG OldSymOptions;
idsl = (PIMAGEHLP_DEFERRED_SYMBOL_LOAD64) CallbackData;
switch ( ActionCode )
{
case CBA_DEBUG_INFO:
assert(CallbackData && *(LPSTR)CallbackData);
dprintf("%s", (LPSTR)CallbackData);
break;
case CBA_EVENT:
evt = (PIMAGEHLP_CBA_EVENT)CallbackData;
assert(evt);
if (evt->desc && *evt->desc)
dprintf("%s", evt->desc);
break;
case CBA_DEFERRED_SYMBOL_LOAD_CANCEL:
if (g_EngStatus & (ENG_STATUS_USER_INTERRUPT |
ENG_STATUS_PENDING_BREAK_IN))
{
return TRUE;
}
break;
case CBA_DEFERRED_SYMBOL_LOAD_START:
pImage = g_CurrentProcess->ImageHead;
while (pImage)
{
if (idsl->BaseOfImage == pImage->BaseOfImage)
{
_strlwr( idsl->FileName );
VerbOut( "Loading symbols for %s %16s -> ",
FormatAddr64(idsl->BaseOfImage),
idsl->FileName
);
return TRUE;
}
pImage = pImage->Next;
}
break;
case CBA_DEFERRED_SYMBOL_LOAD_FAILURE:
if (IS_KERNEL_TARGET() &&
idsl->SizeOfStruct >= FIELD_OFFSET(IMAGEHLP_DEFERRED_SYMBOL_LOAD,
Reparse))
{
i = 0;
if (strncmp(idsl->FileName, "dump_", sizeof("dump_")-1) == 0)
{
i = sizeof("dump_")-1;
}
if (strncmp(idsl->FileName, "hiber_", sizeof("hiber_")-1) == 0)
{
i = sizeof("hiber_")-1;
}
if (i)
{
if (_stricmp (idsl->FileName+i, "scsiport.sys") == 0)
{
strcpy (idsl->FileName, "diskdump.sys");
}
else
{
strcpy(idsl->FileName, idsl->FileName+i);
}
idsl->Reparse = TRUE;
return TRUE;
}
}
if (idsl->FileName && *idsl->FileName)
{
VerbOut( "*** Error: could not load symbols for %s\n",
idsl->FileName );
}
else
{
VerbOut( "*** Error: could not load symbols [MODNAME UNKNOWN]\n");
}
break;
case CBA_DEFERRED_SYMBOL_LOAD_COMPLETE:
pImage = g_CurrentProcess->ImageHead;
// Do not load unqualified symbols in this callback sine this
// could result in stack owerflow
OldSymOptions = SymGetOptions();
SymSetOptions(OldSymOptions | SYMOPT_NO_UNQUALIFIED_LOADS);
while (pImage)
{
if ((idsl->BaseOfImage == pImage->BaseOfImage) ||
(pImage->BaseOfImage == 0))
{
VerbOut( "%s\n", idsl->FileName );
pImage->GoodCheckSum = DII_GOOD_CHECKSUM;
//
// If we had a 0 timestamp for the image, try to update it
// from the image since for NT4 - XP, the kernel
// does not report timestamps in the initial symbol load
// module
//
if (pImage->BaseOfImage &&
(pImage->TimeDateStamp == 0))
{
DWORD CheckSum;
DWORD TimeDateStamp;
DWORD SizeOfImage;
if (GetHeaderInfo(pImage->BaseOfImage,
&CheckSum,
&TimeDateStamp,
&SizeOfImage))
{
pImage->TimeDateStamp = TimeDateStamp;
}
}
if ((idsl->TimeDateStamp == 0) ||
(pImage->TimeDateStamp == 0) ||
(pImage->TimeDateStamp == UNKNOWN_TIMESTAMP))
{
dprintf( "*** WARNING: Unable to verify "
"timestamp for %s\n", idsl->FileName );
pImage->GoodCheckSum = DII_UNKNOWN_TIMESTAMP;
}
else
{
if ((idsl->CheckSum == 0) ||
(pImage->CheckSum == 0) ||
(pImage->CheckSum == UNKNOWN_CHECKSUM))
{
dprintf( "*** WARNING: Unable to verify "
"checksum for %s\n", idsl->FileName );
pImage->GoodCheckSum = DII_UNKNOWN_CHECKSUM;
}
else if (idsl->CheckSum != pImage->CheckSum)
{
pImage->GoodCheckSum = DII_BAD_CHECKSUM;
if (g_TargetMachineType == IMAGE_FILE_MACHINE_I386)
{
if (IS_USER_TARGET() ||
g_TargetNumberProcessors == 1)
{
//
// See if this is an MP image with the
// lock table removed by setup. If
// it is and the timestamps match, don't
// print the invalid checksum warning.
//
char szFileName[_MAX_FNAME];
_splitpath(idsl->FileName, NULL, NULL,
szFileName, NULL);
if ((!_stricmp(szFileName, "kernel32") ||
(IS_KERNEL_TARGET() &&
!_stricmp(szFileName, "win32k")) ||
!_stricmp(szFileName, "wow32") ||
!_stricmp(szFileName, "ntvdm") ||
!_stricmp(szFileName, "ntdll")) &&
(pImage->TimeDateStamp ==
idsl->TimeDateStamp))
{
pImage->GoodCheckSum = DII_GOOD_CHECKSUM;
}
}
}
if (pImage->GoodCheckSum == DII_BAD_CHECKSUM)
{
//
// Only print the message if the timestamps
// are wrong.
//
if (pImage->TimeDateStamp != idsl->TimeDateStamp)
{
dprintf("*** WARNING: symbols timestamp "
"is wrong 0x%08x 0x%08x for %s\n",
pImage->TimeDateStamp,
idsl->TimeDateStamp,
idsl->FileName);
}
}
}
}
mi.SizeOfStruct = sizeof(mi);
if (SymGetModuleInfo64( g_CurrentProcess->Handle,
idsl->BaseOfImage, &mi ))
{
if (mi.SymType == SymExport)
{
WarnOut("*** ERROR: Symbol file could not be found."
" Defaulted to export symbols for %s - \n",
idsl->FileName);
}
if (mi.SymType == SymNone)
{
WarnOut("*** ERROR: Module load completed but "
"symbols could not be loaded for %s\n",
idsl->FileName);
}
}
NotifyChangeSymbolState(DEBUG_CSS_LOADS,
idsl->BaseOfImage, g_CurrentProcess);
SymSetOptions(OldSymOptions);
return TRUE;
}
pImage = pImage->Next;
}
VerbOut( "\n" );
NotifyChangeSymbolState(DEBUG_CSS_LOADS,
idsl->BaseOfImage,
g_CurrentProcess);
SymSetOptions(OldSymOptions);
break;
case CBA_SYMBOLS_UNLOADED:
VerbOut( "Symbols unloaded for %s %s\n",
FormatAddr64(idsl->BaseOfImage),
idsl->FileName
);
break;
case CBA_READ_MEMORY:
prm = (PIMAGEHLP_CBA_READ_MEMORY)CallbackData;
return g_Target->ReadVirtual(prm->addr,
prm->buf,
prm->bytes,
prm->bytesread) == S_OK;
case CBA_SET_OPTIONS:
// Symbol options are set through the interface
// so the debugger generally knows about them
// already. The only flag that we want to check
// here is the debug flag since it can be changed
// through !sym. There is no need to notify
// about this as it's only an internal flag.
g_SymOptions = (g_SymOptions & ~SYMOPT_DEBUG) |
(*(PULONG)CallbackData & SYMOPT_DEBUG);
break;
default:
return FALSE;
}
return FALSE;
}
BOOL
ValidatePathComponent(PCSTR Part)
{
if (strlen(Part) == 0)
{
return FALSE;
}
else if (!_strnicmp(Part, "SYMSRV*", 7) ||
IsUrlPathComponent(Part))
{
// No easy way to validate symbol server or URL paths.
// They're virtually always network references,
// so just disallow all such usage when net
// access isn't allowed.
if (g_EngOptions & DEBUG_ENGOPT_DISALLOW_NETWORK_PATHS)
{
return FALSE;
}
return TRUE;
}
else
{
DWORD Attrs;
DWORD OldMode;
char Expand[MAX_PATH];
// Otherwise make sure this is a valid directory.
if (!ExpandEnvironmentStrings(Part, Expand, sizeof(Expand)))
{
return FALSE;
}
if (g_EngOptions & DEBUG_ENGOPT_DISALLOW_NETWORK_PATHS)
{
// Don't call GetFileAttributes when network paths
// are disabled as net operations may cause deadlocks.
if (NetworkPathCheck(Expand) != ERROR_SUCCESS)
{
return FALSE;
}
}
// We can still get to this point when debugging CSR
// if the user has explicitly allowed net paths.
// This check isn't important enough to risk a hang.
if (SYSTEM_PROCESSES())
{
return TRUE;
}
OldMode = SetErrorMode(SEM_FAILCRITICALERRORS);
Attrs = GetFileAttributes(Expand);
SetErrorMode(OldMode);
return Attrs != 0xffffffff && (Attrs & FILE_ATTRIBUTE_DIRECTORY);
}
}
VOID
FeedSymPath(
LPSTR pSymbolSearchPath,
LPSTR raw
)
{
DWORD dw;
LPSTR rawbuf;
LPSTR p;
BOOL bAppend;
if (!raw)
{
return;
}
p = strtok(raw, ";");
while (p)
{
bAppend = FALSE;
// Check and see if this string is already in the path.
// If it is, don't add it again.
PSTR Dup = strstr(pSymbolSearchPath, p);
if (Dup != NULL)
{
PSTR DupEnd = Dup + strlen(p);
if ((Dup == pSymbolSearchPath || Dup[-1] == ';') &&
(*DupEnd == 0 || *DupEnd == ';'))
{
p = strtok(NULL, ";");
continue;
}
}
bAppend = ValidatePathComponent(p);
if (bAppend)
{
if (*pSymbolSearchPath)
{
strcat(pSymbolSearchPath, ";");
}
strcat(pSymbolSearchPath, p);
}
else
{
WarnOut("WARNING: %s is not accessible, ignoring\n", p);
}
p = strtok(NULL, ";");
}
}
void
SetSymbolSearchPath(PPROCESS_INFO Process)
{
LPSTR lpExePathEnv;
size_t cbExePath;
LPSTR lpSymPathEnv;
LPSTR lpAltSymPathEnv;
LPSTR lpSymPath;
size_t cbSymPath;
LPSTR NewMem;
//
// Load the Binary path (needed for triage dumps)
//
// No clue why this or the next is 18 ...
cbExePath = 18;
if (g_ExecutableImageSearchPath)
{
cbExePath += strlen(g_ExecutableImageSearchPath) + 1;
}
if (lpExePathEnv = getenv("_NT_EXECUTABLE_IMAGE_PATH"))
{
cbExePath += strlen(lpExePathEnv) + 1;
}
NewMem = (char*)realloc(g_ExecutableImageSearchPath, cbExePath);
if (!NewMem)
{
ErrOut("Not enough memory to allocate/initialize "
"ExecutableImageSearchPath");
return;
}
if (!g_ExecutableImageSearchPath)
{
*NewMem = 0;
}
g_ExecutableImageSearchPath = NewMem;
FeedSymPath(g_ExecutableImageSearchPath, lpExePathEnv);
//
// Load symbol Path
//
cbSymPath = 18;
if (g_SymbolSearchPath)
{
cbSymPath += strlen(g_SymbolSearchPath) + 1;
}
if (lpSymPathEnv = getenv("_NT_SYMBOL_PATH"))
{
cbSymPath += strlen(lpSymPathEnv) + 1;
}
if (lpAltSymPathEnv = getenv("_NT_ALT_SYMBOL_PATH"))
{
cbSymPath += strlen(lpAltSymPathEnv) + 1;
}
NewMem = (char*)realloc(g_SymbolSearchPath, cbSymPath);
if (!NewMem)
{
ErrOut("Not enough memory to allocate/initialize "
"SymbolSearchPath");
return;
}
if (!g_SymbolSearchPath)
{
*NewMem = 0;
}
g_SymbolSearchPath = NewMem;
FeedSymPath(g_SymbolSearchPath, lpAltSymPathEnv);
FeedSymPath(g_SymbolSearchPath, lpSymPathEnv);
SymSetSearchPath( Process->Handle, g_SymbolSearchPath );
dprintf("Symbol search path is: %s\n",
*g_SymbolSearchPath ?
g_SymbolSearchPath :
"*** Invalid *** : Verify _NT_SYMBOL_PATH setting" );
if (g_ExecutableImageSearchPath)
{
dprintf("Executable search path is: %s\n",
g_ExecutableImageSearchPath);
}
}
BOOL
SetCurrentScope(
IN PDEBUG_STACK_FRAME ScopeFrame,
IN OPTIONAL PVOID ScopeContext,
IN ULONG ScopeContextSize
)
{
BOOL ScopeChanged;
PDEBUG_SCOPE Scope = &g_ScopeBuffer;
if (Scope->State == ScopeDefaultLazy)
{
// Its not a lazy scope now
Scope->State = ScopeDefault;
}
ScopeChanged = SymSetContext(g_CurrentProcess->Handle,
(PIMAGEHLP_STACK_FRAME) ScopeFrame,
ScopeContext);
if (ScopeContext && (sizeof(Scope->Context) >= ScopeContextSize))
{
memcpy(&Scope->Context, ScopeContext, ScopeContextSize);
Scope->ContextState = MCTX_FULL;
Scope->State = ScopeFromContext;
NotifyChangeDebuggeeState(DEBUG_CDS_REGISTERS, DEBUG_ANY_ID);
}
Scope->LocalsChanged = ScopeChanged;
if (ScopeChanged ||
(ScopeFrame->FrameOffset != Scope->Frame.FrameOffset))
{
Scope->Frame = *ScopeFrame;
Scope->LocalsChanged = TRUE;
if (ScopeFrame->FuncTableEntry)
{
// Cache the FPO data since the pointer is only temporary
Scope->CachedFpo =
*((PFPO_DATA) ScopeFrame->FuncTableEntry);
Scope->Frame.FuncTableEntry =
(ULONG64) &Scope->CachedFpo;
}
NotifyChangeSymbolState(DEBUG_CSS_SCOPE, 0, g_CurrentProcess);
}
else
{
Scope->Frame = *ScopeFrame;
if (ScopeFrame->FuncTableEntry)
{
// Cache the FPO data since the pointer is only temporary
Scope->CachedFpo =
*((PFPO_DATA) ScopeFrame->FuncTableEntry);
Scope->Frame.FuncTableEntry =
(ULONG64) &Scope->CachedFpo;
}
}
return ScopeChanged;
}
BOOL
ResetCurrentScopeLazy(void)
{
PDEBUG_SCOPE Scope = &g_ScopeBuffer;
if (Scope->State == ScopeFromContext)
{
NotifyChangeDebuggeeState(DEBUG_CDS_REGISTERS, DEBUG_ANY_ID);
}
Scope->State = ScopeDefaultLazy;
return TRUE;
}
BOOL
ResetCurrentScope(void)
{
DEBUG_STACK_FRAME LocalFrame;
PDEBUG_SCOPE Scope = &g_ScopeBuffer;
if (Scope->State == ScopeFromContext)
{
NotifyChangeDebuggeeState(DEBUG_CDS_REGISTERS, DEBUG_ANY_ID);
}
Scope->State = ScopeDefault;
ZeroMemory(&LocalFrame, sizeof(LocalFrame));
// At the initial kernel load the system is only partially
// initialized and is very sensitive to bad memory reads.
// Stack traces can cause reads through unusual memory areas
// so it's best to avoid them at this time. This isn't
// much of a problem since users don't usually expect a locals
// context at this point.
if ((IS_USER_TARGET() ||
(g_EngStatus & ENG_STATUS_AT_INITIAL_MODULE_LOAD) == 0) &&
IS_CONTEXT_ACCESSIBLE())
{
if (!StackTrace(0, 0, 0, &LocalFrame, 1, 0, 0, TRUE))
{
ADDR Addr;
g_Machine->GetPC(&Addr);
LocalFrame.InstructionOffset = Addr.off;
}
}
return SetCurrentScope(&LocalFrame, NULL, 0);
}
void
ListUnloadedModules(ULONG Flags, PSTR Pattern)
{
UnloadedModuleInfo* Unl;
g_NumUnloadedModules = 0;
if (!IS_KERNEL_TARGET())
{
return;
}
Unl = g_Target->GetUnloadedModuleInfo();
if (Unl == NULL || Unl->Initialize() != S_OK)
{
ErrOut("Unable to examine unloaded module list\n");
return;
}
char UnlName[MAX_UNLOADED_NAME_LENGTH / sizeof(WCHAR) + 1];
DEBUG_MODULE_PARAMETERS Params;
if (Flags & LUM_OUTPUT)
{
dprintf("Unloaded modules:\n");
}
while (Unl->GetEntry(UnlName, &Params) == S_OK)
{
g_NumUnloadedModules++;
if (Pattern != NULL &&
!MatchPattern(UnlName, Pattern))
{
continue;
}
if (Flags & LUM_OUTPUT_TERSE)
{
dprintf(".");
continue;
}
if (Flags & LUM_OUTPUT)
{
dprintf("%s %s %-8s",
FormatAddr64(Params.Base),
FormatAddr64(Params.Base + Params.Size),
UnlName);
}
if (Flags & ( LUM_OUTPUT_VERBOSE | LUM_OUTPUT_TIMESTAMP))
{
PSTR TimeDateStr = TimeToStr(Params.TimeDateStamp);
dprintf(" Timestamp: %s (%08X)",
TimeDateStr, Params.TimeDateStamp);
}
dprintf("\n");
}
dprintf("\n");
}
ULONG
ModuleMachineType(PPROCESS_INFO Process, ULONG64 Offset)
{
ULONG64 Base = SymGetModuleBase64(Process->Handle, Offset);
if (Base == 0)
{
return IMAGE_FILE_MACHINE_UNKNOWN;
}
PPROCESS_INFO OldCur = g_CurrentProcess;
g_CurrentProcess = Process;
ULONG Machine = IMAGE_FILE_MACHINE_UNKNOWN;
IMAGE_DOS_HEADER DosHdr;
IMAGE_NT_HEADERS64 NtHdr;
ULONG Done;
if (g_Target->ReadVirtual(Base, &DosHdr, sizeof(DosHdr), &Done) == S_OK &&
Done == sizeof(DosHdr) &&
DosHdr.e_magic == IMAGE_DOS_SIGNATURE &&
g_Target->ReadVirtual(Base + DosHdr.e_lfanew, &NtHdr,
FIELD_OFFSET(IMAGE_NT_HEADERS64,
FileHeader.NumberOfSections),
&Done) == S_OK &&
Done == FIELD_OFFSET(IMAGE_NT_HEADERS64,
FileHeader.NumberOfSections) &&
NtHdr.Signature == IMAGE_NT_SIGNATURE &&
MachineTypeIndex(NtHdr.FileHeader.Machine) != MACHIDX_COUNT)
{
Machine = NtHdr.FileHeader.Machine;
}
g_CurrentProcess = OldCur;
return Machine;
}
ULONG
IsInFastSyscall(ULONG64 Addr, PULONG64 Base)
{
if (g_TargetMachineType != IMAGE_FILE_MACHINE_I386 ||
g_TargetPlatformId != VER_PLATFORM_WIN32_NT ||
g_SystemVersion < NT_SVER_W2K_WHISTLER)
{
return FSC_NONE;
}
ULONG64 FastBase = g_TargetBuildNumber >= 2412 ?
X86_SHARED_SYSCALL_BASE_GTE2412 :
X86_SHARED_SYSCALL_BASE_LT2412;
if (Addr >= FastBase &&
Addr < (FastBase + X86_SHARED_SYSCALL_SIZE))
{
*Base = FastBase;
return FSC_FOUND;
}
return FSC_NONE;
}
BOOL
ShowFunctionParameters(PDEBUG_STACK_FRAME StackFrame,
PSTR SymBuf, ULONG64 Displacement)
{
SYM_DUMP_PARAM_EX SymFunction = {0};
ULONG Status = 0;
PDEBUG_SCOPE Scope = GetCurrentScope();
DEBUG_SCOPE SavScope = *Scope;
SymFunction.size = sizeof(SYM_DUMP_PARAM_EX);
// SymFunction.sName = (PUCHAR) SymBuf;
SymFunction.addr = StackFrame->InstructionOffset;
SymFunction.Options = DBG_DUMP_COMPACT_OUT | DBG_DUMP_FUNCTION_FORMAT;
// SetCurrentScope to this function
SymSetContext(g_CurrentProcess->Handle,
(PIMAGEHLP_STACK_FRAME) StackFrame, NULL);
Scope->Frame = *StackFrame;
if (StackFrame->FuncTableEntry)
{
// Cache the FPO data since the pointer is only temporary
Scope->CachedFpo = *((PFPO_DATA) StackFrame->FuncTableEntry);
Scope->Frame.FuncTableEntry =
(ULONG64) &Scope->CachedFpo;
}
if (!SymbolTypeDumpNew(&SymFunction, &Status) &&
!Status)
{
Status = TRUE;
}
g_ScopeBuffer = SavScope;
SymSetContext(g_CurrentProcess->Handle,
(PIMAGEHLP_STACK_FRAME) &Scope->Frame, NULL);
return !Status;
}
Reference in a new issue View git blame Copy permalink