OS_Develop/Windows-Server-2003
OS_Develop/Windows-Server-2003
1
0
Fork 0
Code Pull Requests Activity
7507d3c0e1
Windows-Server-2003/sdktools/debuggers/ntsd64/process.cpp

2494 lines
61 KiB
C++
Raw Normal View History

Initiall commit
2024-08-04 01:28:15 +02:00
//----------------------------------------------------------------------------
//
// Process abstraction.
//
// Copyright (C) Microsoft Corporation, 2001-2002.
//
//----------------------------------------------------------------------------
#include "ntsdp.hpp"
#include <common.ver>
#define NTLDR_IMAGE_NAME "ntldr"
#define OSLOADER_IMAGE_NAME "osloader"
#define SETUPLDR_IMAGE_NAME "setupldr"
#define LDR_IMAGE_SIZE 0x80000
#define CSRSS_IMAGE_NAME "csrss.exe"
#define LSASS_IMAGE_NAME "lsass.exe"
#define SERVICES_IMAGE_NAME "services.exe"
void
RestrictModNameChars(PCSTR ModName, PSTR RewriteBuffer)
{
PCSTR Scan = ModName;
PSTR Write = RewriteBuffer;
while (*Scan)
{
if ((*Scan < 'a' || *Scan > 'z') &&
(*Scan < 'A' || *Scan > 'Z') &&
(*Scan < '0' || *Scan > '9') &&
*Scan != '_')
{
*Write++ = '_';
}
else
{
*Write++ = *Scan;
}
Scan++;
}
*Write = 0;
}
//----------------------------------------------------------------------------
//
// ProcCorDataAccessServices.
//
//----------------------------------------------------------------------------
ProcCorDataAccessServices::ProcCorDataAccessServices(void)
{
m_Process = NULL;
}
STDMETHODIMP
ProcCorDataAccessServices::QueryInterface(
THIS_
IN REFIID InterfaceId,
OUT PVOID* Interface
)
{
if (DbgIsEqualIID(InterfaceId, IID_IUnknown) ||
DbgIsEqualIID(InterfaceId, __uuidof(ICorDataAccessServices)))
{
*Interface = (ICorDataAccessServices*)this;
// No need to refcount as this class is contained.
return S_OK;
}
else
{
*Interface = NULL;
return E_NOINTERFACE;
}
}
STDMETHODIMP_(ULONG)
ProcCorDataAccessServices::AddRef(
THIS
)
{
// No need to refcount as this class is contained.
return 1;
}
STDMETHODIMP_(ULONG)
ProcCorDataAccessServices::Release(
THIS
)
{
// No need to refcount as this class is contained.
return 0;
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::GetMachineType(
/* [out] */ ULONG32 *machine)
{
*machine = m_Process->m_Target->m_MachineType;
return S_OK;
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::GetPointerSize(
/* [out] */ ULONG32 *size)
{
*size = m_Process->m_Target->m_Machine->m_Ptr64 ? 8 : 4;
return S_OK;
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::GetImageBase(
/* [string][in] */ LPCWSTR name,
/* [out] */ CORDATA_ADDRESS *base)
{
HRESULT Status;
PSTR Ansi;
INAME WhichName;
ImageInfo* Image;
if ((Status = WideToAnsi(name, &Ansi)) != S_OK)
{
return Status;
}
if (PathTail(Ansi) != Ansi)
{
WhichName = INAME_IMAGE_PATH;
}
else
{
WhichName = INAME_IMAGE_PATH_TAIL;
}
if (Image = m_Process->FindImageByName(Ansi, 0, WhichName, FALSE))
{
*base = Image->m_BaseOfImage;
Status = S_OK;
}
else
{
Status = E_NOINTERFACE;
}
FreeAnsi(Ansi);
return Status;
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::ReadVirtual(
/* [in] */ CORDATA_ADDRESS address,
/* [length_is][size_is][out] */ PBYTE buffer,
/* [in] */ ULONG32 request,
/* [optional][out] */ ULONG32 *done)
{
return m_Process->m_Target->
ReadVirtual(m_Process, address, buffer, request, (PULONG)done);
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::WriteVirtual(
/* [in] */ CORDATA_ADDRESS address,
/* [size_is][in] */ PBYTE buffer,
/* [in] */ ULONG32 request,
/* [optional][out] */ ULONG32 *done)
{
return m_Process->m_Target->
WriteVirtual(m_Process, address, buffer, request, (PULONG)done);
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::GetTlsValue(
/* [in] */ ULONG32 index,
/* [out] */ CORDATA_ADDRESS* value)
{
HRESULT Status;
ULONG64 SlotAddr;
if ((Status = m_Process->m_CurrentThread->
GetTlsSlotAddress((ULONG)index, &SlotAddr)) != S_OK)
{
return Status;
}
return m_Process->m_Target->
ReadPointer(m_Process, m_Process->m_Target->m_Machine,
SlotAddr, value);
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::SetTlsValue(
/* [in] */ ULONG32 index,
/* [in] */ CORDATA_ADDRESS value)
{
HRESULT Status;
ULONG64 SlotAddr;
if ((Status = m_Process->m_CurrentThread->
GetTlsSlotAddress((ULONG)index, &SlotAddr)) != S_OK)
{
return Status;
}
return m_Process->m_Target->
WritePointer(m_Process, m_Process->m_Target->m_Machine,
SlotAddr, value);
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::GetCurrentThreadId(
/* [out] */ ULONG32* threadId)
{
*threadId = g_Thread->m_SystemId;
return S_OK;
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::GetThreadContext(
/* [in] */ ULONG32 threadId,
/* [in] */ ULONG32 contextFlags,
/* [in] */ ULONG32 contextSize,
/* [out, size_is(contextSize)] */ PBYTE context)
{
HRESULT Status;
if (contextSize < m_Process->m_Target->m_TypeInfo.SizeTargetContext)
{
return E_INVALIDARG;
}
ThreadInfo* Thread = m_Process->FindThreadBySystemId(threadId);
if (!Thread)
{
return E_NOINTERFACE;
}
m_Process->m_Target->ChangeRegContext(Thread);
if ((Status = m_Process->m_Target->m_Machine->
GetContextState(MCTX_CONTEXT)) == S_OK)
{
Status = m_Process->m_Target->m_Machine->
ConvertContextTo(&m_Process->m_Target->m_Machine->m_Context,
m_Process->m_Target->m_SystemVersion,
m_Process->m_Target->m_TypeInfo.SizeTargetContext,
context);
}
m_Process->m_Target->ChangeRegContext(m_Process->m_CurrentThread);
return Status;
}
HRESULT STDMETHODCALLTYPE
ProcCorDataAccessServices::SetThreadContext(
/* [in] */ ULONG32 threadId,
/* [in] */ ULONG32 contextSize,
/* [out, size_is(contextSize)] */ PBYTE context)
{
HRESULT Status;
if (contextSize < m_Process->m_Target->m_TypeInfo.SizeTargetContext)
{
return E_INVALIDARG;
}
ThreadInfo* Thread = m_Process->FindThreadBySystemId(threadId);
if (!Thread)
{
return E_NOINTERFACE;
}
m_Process->m_Target->ChangeRegContext(Thread);
if ((Status = m_Process->m_Target->m_Machine->
GetContextState(MCTX_DIRTY)) == S_OK)
{
Status = m_Process->m_Target->m_Machine->
ConvertContextFrom(&m_Process->m_Target->m_Machine->m_Context,
m_Process->m_Target->m_SystemVersion,
m_Process->m_Target->
m_TypeInfo.SizeTargetContext,
context);
if (Status == S_OK)
{
NotifyChangeDebuggeeState(DEBUG_CDS_REGISTERS, DEBUG_ANY_ID);
}
}
m_Process->m_Target->ChangeRegContext(m_Process->m_CurrentThread);
return Status;
}
//----------------------------------------------------------------------------
//
// ProcessInfo.
//
//----------------------------------------------------------------------------
ProcessInfo::ProcessInfo(TargetInfo* Target,
ULONG SystemId,
HANDLE SymHandle,
ULONG64 SysHandle,
ULONG Flags,
ULONG Options)
{
m_Target = Target;
m_UserId = FindNextUserId(LAYER_PROCESS);
m_Next = NULL;
m_NumImages = 0;
m_NumUnloadedModules = 0;
m_ImageHead = NULL;
m_ExecutableImage = NULL;
m_SynthesizedImage = NULL;
m_NumThreads = 0;
m_ThreadHead = NULL;
m_CurrentThread = NULL;
m_SystemId = SystemId;
m_Exited = FALSE;
m_ModulesLoaded = FALSE;
m_InitialBreakDone = (Flags & ENG_PROC_NO_INITIAL_BREAK) != 0;
// Always ask for an "initial" break when the process
// won't generate its own initial break as the first
// break encountered will just be a normal break and
// so should cause a break-in.
m_InitialBreak =
(Flags & ENG_PROC_NO_INITIAL_BREAK) ||
IS_KERNEL_TARGET(m_Target) ||
(g_EngOptions & DEBUG_ENGOPT_INITIAL_BREAK) != 0;
m_InitialBreakWx86 =
(g_EngOptions & DEBUG_ENGOPT_INITIAL_BREAK) != 0;
m_DataOffset = 0;
m_SymHandle = SymHandle;
m_SysHandle = SysHandle;
m_Flags = Flags;
m_Options = Options;
m_NumBreakpoints = 0;
m_Breakpoints = NULL;
m_BreakpointsTail = NULL;
m_DynFuncTableList = 0;
m_OopFuncTableDlls = NULL;
m_RtlUnloadList = 0;
ResetImplicitData();
m_CorImage = NULL;
m_CorImageType = COR_DLL_INVALID;
m_CorDebugDll = NULL;
m_CorAccess = NULL;
m_CorServices.m_Process = this;
m_VirtualCache.SetProcess(this);
PCHAR CacheEnv = getenv("_NT_DEBUG_CACHE_SIZE");
if (CacheEnv != NULL)
{
m_VirtualCache.m_MaxSize = atol(CacheEnv);
}
m_VirtualCache.m_DecodePTEs =
IS_KERNEL_TARGET(m_Target) &&
!(m_Target->m_KdVersion.Flags & DBGKD_VERS_FLAG_NOMM);
m_Target->InsertProcess(this);
SymInitialize(m_SymHandle, NULL, FALSE);
SymRegisterCallback64(m_SymHandle, SymbolCallbackFunction,
(ULONG_PTR)this);
if (IS_USER_TARGET(m_Target) &&
m_Target->m_MachineType != IMAGE_FILE_MACHINE_I386)
{
SymRegisterFunctionEntryCallback64
(m_SymHandle, TargetInfo::DynamicFunctionTableCallback,
(ULONG_PTR)this);
}
SetSymbolSearchPath(this);
SynthesizeSymbols();
}
ProcessInfo::~ProcessInfo(void)
{
ClearOopFuncTableDlls();
RELEASE(m_CorAccess);
if (m_CorDebugDll)
{
FreeLibrary(m_CorDebugDll);
}
while (m_ThreadHead)
{
delete m_ThreadHead;
}
// Suppress notifications until all images are deleted.
g_EngNotify++;
while (m_ImageHead)
{
delete m_ImageHead;
}
delete m_SynthesizedImage;
// Notification can use process information so put things
// in a clean state before notify.
m_SynthesizedImage = NULL;
g_EngNotify--;
NotifyChangeSymbolState(DEBUG_CSS_UNLOADS, 0, this);
SymCleanup(m_SymHandle);
RemoveProcessBreakpoints(this);
if (m_Flags & ENG_PROC_THREAD_CLOSE_HANDLE)
{
DBG_ASSERT(IS_LIVE_USER_TARGET(m_Target) &&
((LiveUserTargetInfo*)m_Target)->m_Services);
((LiveUserTargetInfo*)m_Target)->m_Services->
CloseHandle(m_SysHandle);
}
m_Target->RemoveProcess(this);
g_UserIdFragmented[LAYER_PROCESS]++;
if (this == g_Process)
{
g_Process = NULL;
}
if (this == g_EventProcess)
{
g_EventProcess = NULL;
DiscardLastEvent();
}
if (g_StepTraceBp && g_StepTraceBp->m_Process == this)
{
g_StepTraceBp->m_Process = NULL;
if (g_WatchFunctions.IsStarted())
{
g_WatchFunctions.End(NULL);
}
ResetStepTrace();
g_StepTraceBp->m_Flags &= ~(DEBUG_BREAKPOINT_ENABLED |
BREAKPOINT_INSERTED);
}
if (g_ScopeBuffer.State == ScopeFromContext &&
g_ScopeBuffer.Process == this)
{
ResetCurrentScopeLazy();
}
}
ThreadInfo*
ProcessInfo::FindThreadByUserId(ULONG Id)
{
ThreadInfo* Thread;
ForProcessThreads(this)
{
if (Thread->m_UserId == Id)
{
return Thread;
}
}
return NULL;
}
ThreadInfo*
ProcessInfo::FindThreadBySystemId(ULONG Id)
{
ThreadInfo* Thread;
ForProcessThreads(this)
{
if (Thread->m_SystemId == Id)
{
return Thread;
}
}
return NULL;
}
ThreadInfo*
ProcessInfo::FindThreadByHandle(ULONG64 Handle)
{
ThreadInfo* Thread;
ForProcessThreads(this)
{
if (Thread->m_Handle == Handle)
{
return Thread;
}
}
return NULL;
}
void
ProcessInfo::InsertThread(ThreadInfo* Thread)
{
ThreadInfo* Cur;
ThreadInfo* Prev;
Prev = NULL;
for (Cur = m_ThreadHead; Cur; Cur = Cur->m_Next)
{
if (Cur->m_UserId > Thread->m_UserId)
{
break;
}
Prev = Cur;
}
Thread->m_Next = Cur;
if (!Prev)
{
m_ThreadHead = Thread;
}
else
{
Prev->m_Next = Thread;
}
m_NumThreads++;
Thread->m_Process = this;
if (!m_CurrentThread)
{
m_CurrentThread = Thread;
}
m_Target->AddThreadToAllProcessInfo(this, Thread);
}
void
ProcessInfo::RemoveThread(ThreadInfo* Thread)
{
ThreadInfo* Cur;
ThreadInfo* Prev;
Prev = NULL;
for (Cur = m_ThreadHead; Cur; Cur = Cur->m_Next)
{
if (Cur == Thread)
{
break;
}
Prev = Cur;
}
if (!Cur)
{
return;
}
if (!Prev)
{
m_ThreadHead = Thread->m_Next;
}
else
{
Prev->m_Next = Thread->m_Next;
}
m_NumThreads--;
Thread->m_Process = NULL;
if (m_CurrentThread == Thread)
{
m_CurrentThread = m_ThreadHead;
}
m_Target->RemoveThreadFromAllProcessInfo(this, Thread);
}
HRESULT
ProcessInfo::CreateVirtualThreads(ULONG StartId, ULONG Threads)
{
ThreadInfo* Thread;
while (Threads-- > 0)
{
Thread = new ThreadInfo(this, VIRTUAL_THREAD_ID(StartId), 0,
VIRTUAL_THREAD_HANDLE(StartId), 0, 0);
if (!Thread)
{
return E_OUTOFMEMORY;
}
StartId++;
}
return S_OK;
}
ImageInfo*
ProcessInfo::FindImageByIndex(ULONG Index)
{
ImageInfo* Image = m_ImageHead;
while (Index > 0 && Image != NULL)
{
Index--;
Image = Image->m_Next;
}
return Image;
}
ImageInfo*
ProcessInfo::FindImageByOffset(ULONG64 Offset, BOOL AllowSynth)
{
ImageInfo* Image = m_ImageHead;
while (Image != NULL &&
(Offset < Image->m_BaseOfImage ||
Offset >= Image->m_BaseOfImage + Image->m_SizeOfImage))
{
Image = Image->m_Next;
}
//
// If synthesized symbols are allowed, check those images
// also.
//
if (!Image &&
AllowSynth &&
m_SynthesizedImage &&
Offset >= m_SynthesizedImage->m_BaseOfImage &&
Offset < m_SynthesizedImage->m_BaseOfImage +
m_SynthesizedImage->m_SizeOfImage)
{
Image = m_SynthesizedImage;
}
return Image;
}
ImageInfo*
ProcessInfo::FindImageByName(PCSTR Name, ULONG NameChars,
INAME Which, BOOL AllowSynth)
{
if (NameChars == 0)
{
NameChars = strlen(Name);
}
ImageInfo* Image = m_ImageHead;
while (Image != NULL)
{
PCSTR WhichStr;
switch(Which)
{
case INAME_IMAGE_PATH:
WhichStr = Image->m_ImagePath;
break;
case INAME_IMAGE_PATH_TAIL:
WhichStr = PathTail(Image->m_ImagePath);
break;
case INAME_MODULE:
if (Image->m_OriginalModuleName[0] &&
strlen(Image->m_OriginalModuleName) == NameChars &&
!_memicmp(Image->m_OriginalModuleName, Name, NameChars))
{
return Image;
}
WhichStr = Image->m_ModuleName;
break;
}
if (strlen(WhichStr) == NameChars &&
_memicmp(WhichStr, Name, NameChars) == 0)
{
break;
}
Image = Image->m_Next;
}
//
// If synthesized symbols are allowed, check those images
// also.
//
if (!Image &&
AllowSynth &&
m_SynthesizedImage &&
Which == INAME_MODULE &&
strlen(m_SynthesizedImage->m_ModuleName) == NameChars &&
!_memicmp(m_SynthesizedImage->m_ModuleName, Name, NameChars))
{
Image = m_SynthesizedImage;
}
return Image;
}
BOOL
ProcessInfo::GetOffsetFromMod(PCSTR String, PULONG64 Offset)
{
if (!strchr(String, '!'))
{
ULONG Len;
BOOL End;
//
// Could be a module name or module$ for the end
// of a module.
//
Len = strlen(String);
if (Len == 0)
{
return FALSE;
}
if (String[Len - 1] == '$')
{
// Retrieving end-of-module.
Len--;
End = TRUE;
}
else
{
End = FALSE;
}
ImageInfo* Image = FindImageByName(String, Len, INAME_MODULE, TRUE);
if (Image)
{
if (End)
{
*Offset = Image->m_BaseOfImage + Image->m_SizeOfImage;
}
else
{
*Offset = Image->m_BaseOfImage;
}
return TRUE;
}
}
return FALSE;
}
COR_DLL
IsCorDll(PCSTR ImagePath)
{
PCSTR ImagePathTail = PathTail(ImagePath);
if (!_stricmp(ImagePathTail, "mscoree.dll"))
{
return COR_DLL_EE;
}
if (!_stricmp(ImagePathTail, "mscorwks.dll"))
{
return COR_DLL_WKS;
}
if (!_stricmp(ImagePathTail, "mscorsvr.dll"))
{
return COR_DLL_SVR;
}
return COR_DLL_INVALID;
}
void
ProcessInfo::InsertImage(ImageInfo* Image)
{
ImageInfo* Cur;
ImageInfo* Prev;
Prev = NULL;
for (Cur = m_ImageHead; Cur; Cur = Cur->m_Next)
{
if (Cur->m_BaseOfImage > Image->m_BaseOfImage)
{
break;
}
Prev = Cur;
}
Image->m_Next = Cur;
if (!Prev)
{
m_ImageHead = Image;
}
else
{
Prev->m_Next = Image;
}
m_NumImages++;
Image->m_Process = this;
Image->m_Linked = TRUE;
if (m_ExecutableImage == NULL)
{
// Try and locate the executable image entry for
// the process to use as the process's name.
ULONG NameLen = strlen(Image->m_ImagePath);
if (NameLen > 4 &&
!_stricmp(Image->m_ImagePath + NameLen - 4, ".exe"))
{
m_ExecutableImage = Image;
}
}
COR_DLL CorDll = IsCorDll(Image->m_ImagePath);
if (CorDll > m_CorImageType)
{
m_CorImage = Image;
m_CorImageType = CorDll;
}
}
void
ProcessInfo::RemoveImage(ImageInfo* Image)
{
ImageInfo* Cur;
ImageInfo* Prev;
Prev = NULL;
for (Cur = m_ImageHead; Cur; Cur = Cur->m_Next)
{
if (Cur == Image)
{
break;
}
Prev = Cur;
}
if (!Cur)
{
return;
}
if (!Prev)
{
m_ImageHead = Image->m_Next;
}
else
{
Prev->m_Next = Image->m_Next;
}
m_NumImages--;
Image->m_Process = NULL;
Image->m_Linked = FALSE;
if (m_ExecutableImage == Image)
{
m_ExecutableImage = NULL;
}
if (m_CorImageType != COR_DLL_INVALID &&
IsCorDll(Image->m_ImagePath) != COR_DLL_INVALID)
{
m_CorImage = NULL;
m_CorImageType = COR_DLL_INVALID;
}
}
BOOL
ProcessInfo::DeleteImageByName(PCSTR Name, INAME Which)
{
ImageInfo* Image;
for (Image = m_ImageHead; Image; Image = Image->m_Next)
{
PCSTR WhichStr;
switch(Which)
{
case INAME_IMAGE_PATH:
WhichStr = Image->m_ImagePath;
break;
case INAME_IMAGE_PATH_TAIL:
WhichStr = PathTail(Image->m_ImagePath);
break;
case INAME_MODULE:
WhichStr = Image->m_ModuleName;
break;
}
if (!_stricmp(WhichStr, Name))
{
delete Image;
return TRUE;
}
}
return FALSE;
}
BOOL
ProcessInfo::DeleteImageByBase(ULONG64 BaseOfImage)
{
ImageInfo* Image;
for (Image = m_ImageHead; Image; Image = Image->m_Next)
{
if (Image->m_BaseOfImage == BaseOfImage)
{
delete Image;
return TRUE;
}
}
return FALSE;
}
void
ProcessInfo::DeleteImagesBelowOffset(ULONG64 Offset)
{
ImageInfo* Image, *Next;
ULONG Count = 0;
// Suppress notifications until all images are deleted.
g_EngNotify++;
for (Image = m_ImageHead; Image; Image = Next)
{
Next = Image->m_Next;
if (Image->m_BaseOfImage < Offset)
{
delete Image;
Count++;
}
}
g_EngNotify--;
if (Count)
{
NotifyChangeSymbolState(DEBUG_CSS_UNLOADS, 0, this);
}
}
void
ProcessInfo::DeleteImages(void)
{
// Suppress notifications until all images are deleted.
g_EngNotify++;
while (m_ImageHead)
{
delete m_ImageHead;
}
g_EngNotify--;
NotifyChangeSymbolState(DEBUG_CSS_UNLOADS, 0, this);
}
HRESULT
ProcessInfo::AddImage(PMODULE_INFO_ENTRY ModEntry,
BOOL ForceSymbolLoad,
ImageInfo** ImageAdded)
{
ImageInfo* ImageNew;
IMAGEHLP_MODULE64 SymModInfo;
ULONG64 LoadAddress;
BOOL LoadSymbols = TRUE;
PCSTR ImagePathTail;
MODLOAD_DATA ModLoadData;
HRESULT Status;
BOOL ReusedExisting = FALSE;
#if DBG_MOD_LIST
dprintf("AddImage:\n"
" ImagePath %s\n"
" File %I64x\n"
" BaseOfImage %I64x\n"
" SizeOfImage %x\n"
" CheckSum %x\n"
" ModuleName %s\n"
" ForceSymbolLoad %d\n",
ModEntry->NamePtr,
(ULONG64)(ULONG_PTR)File,
ModEntry->Base,
ModEntry->Size,
ModEntry->CheckSum,
ModEntry->ModuleName,
ForceSymbolLoad);
#endif
if (ModEntry->NamePtr == NULL)
{
WarnOut("AddImage(NULL) fails\n");
return E_INVALIDARG;
}
if (ModEntry->NamePtr &&
IS_USER_TARGET(m_Target) &&
m_Target->m_PlatformId == VER_PLATFORM_WIN32_NT)
{
TranslateNtPathName(ModEntry->NamePtr);
}
//
// Search for existing image at same base address.
// If found, remove symbols, but leave image structure intact.
//
for (ImageNew = m_ImageHead; ImageNew; ImageNew = ImageNew->m_Next)
{
if (ImageNew->m_BaseOfImage == ModEntry->Base)
{
VerbOut("Force unload of %s\n", ImageNew->m_ImagePath);
ImageNew->DeleteResources(FALSE);
break;
}
}
//
// If we didn't reuse an existing image, allocate
// a new one.
//
if (!ImageNew)
{
ImageNew = new ImageInfo(this,
ModEntry->NamePtr, ModEntry->Base, TRUE);
if (ImageNew == NULL)
{
ErrOut("Unable to allocate memory for %s symbols.\n",
ModEntry->NamePtr);
return E_OUTOFMEMORY;
}
// Module name is set later after possible renaming.
ImageNew->m_File = ModEntry->File;
ImageNew->m_CheckSum = ModEntry->CheckSum;
ImageNew->m_TimeDateStamp = ModEntry->TimeDateStamp;
ImageNew->m_SymState = ISS_MATCHED;
ImageNew->m_UserMode = ModEntry->UserMode;
}
else
{
ReusedExisting = TRUE;
// Update the reused entry with the latest information.
if (ModEntry->NamePtr)
{
CopyString(ImageNew->m_ImagePath, ModEntry->NamePtr,
DIMA(ImageNew->m_ImagePath));
}
else
{
ImageNew->m_ImagePath[0] = 0;
}
}
// Always update the entry size as this allows users
// to update explicit entries (.reload image.ext=base,size)
// without having to unload them first.
ImageNew->m_SizeOfImage = ModEntry->Size;
ImagePathTail = PathTail(ImageNew->m_ImagePath);
if (ForceSymbolLoad)
{
// Try to load the image memory right away in this
// case to catch incomplete-information errors.
if (!ImageNew->DemandLoadImageMemory(!ReusedExisting, TRUE))
{
if (!ReusedExisting)
{
g_EngNotify++;
delete ImageNew;
g_EngNotify--;
}
return E_OUTOFMEMORY;
}
}
if (IS_KERNEL_TARGET(m_Target))
{
CHAR Buf[MAX_IMAGE_PATH];
MODULE_ALIAS_LIST* ModAlias;
//
// Determine the actual image name for kernel images which
// are known to have multiple identities.
//
if ((ModEntry->ModuleName &&
_stricmp(ModEntry->ModuleName, KERNEL_MODULE_NAME) == 0) ||
ModEntry->Base == m_Target->m_KdDebuggerData.KernBase)
{
ModAlias = &g_AliasLists[MODALIAS_KERNEL];
}
else
{
ModAlias = FindModuleAliasList(ImagePathTail, NULL);
}
if (ModAlias)
{
if (GetModnameFromImage(this, ModEntry->Base, NULL,
Buf, sizeof(Buf), FALSE))
{
CopyString(ImageNew->m_ImagePath, Buf,
DIMA(ImageNew->m_ImagePath));
}
ModEntry->ModuleName = (PSTR)ModAlias->BaseModule;
}
else if (ImageNew->m_SizeOfImage == 0 &&
((_stricmp(ImagePathTail, NTLDR_IMAGE_NAME) == 0) ||
(_stricmp(ImagePathTail, NTLDR_IMAGE_NAME ".exe") == 0) ||
(_stricmp(ImagePathTail, OSLOADER_IMAGE_NAME) == 0) ||
(_stricmp(ImagePathTail, OSLOADER_IMAGE_NAME ".exe") == 0) ||
(_stricmp(ImagePathTail, SETUPLDR_IMAGE_NAME) == 0) ||
(_stricmp(ImagePathTail, SETUPLDR_IMAGE_NAME ".exe") == 0)))
{
ImageNew->m_SizeOfImage = LDR_IMAGE_SIZE;
}
}
else if (!IS_DUMP_TARGET(m_Target))
{
//
// When debugging CSR, LSA or Services.exe, force the use of local-only
// symbols. Otherwise we can deadlock the entire machine when trying
// to load the symbol file from the network.
//
if (((LiveUserTargetInfo*)m_Target)->m_Local &&
(_stricmp(ImagePathTail, CSRSS_IMAGE_NAME) == 0 ||
_stricmp(ImagePathTail, LSASS_IMAGE_NAME) == 0 ||
_stricmp(ImagePathTail, SERVICES_IMAGE_NAME) == 0))
{
if (g_EngOptions & DEBUG_ENGOPT_ALLOW_NETWORK_PATHS)
{
//
// Since the user has chambered a round and pointed the barrel
// of the gun at his head, we may as well tell him that it's
// going to hurt if he pulls the trigger.
//
WarnOut("WARNING: Using network symbols with %s\n",
ImagePathTail);
WarnOut("WARNING: You may deadlock your machine.\n");
}
else
{
g_EngOptions |= DEBUG_ENGOPT_DISALLOW_NETWORK_PATHS;
}
}
if (g_EngOptions & DEBUG_ENGOPT_DISALLOW_NETWORK_PATHS)
{
DWORD NetPath;
NetPath = NetworkPathCheck(g_SymbolSearchPath);
if (NetPath == ERROR_FILE_OFFLINE)
{
ErrOut("ERROR: sympath contained network references but "
"they were not allowed.\n");
ErrOut("Symbols not loaded for %s\n",
ImagePathTail);
LoadSymbols = FALSE;
}
else if (NetPath == ERROR_BAD_PATHNAME)
{
VerbOut("WARNING: sympath contains invalid references.\n");
}
}
}
if (ModEntry->ModuleName == NULL)
{
CreateModuleNameFromPath(ImageNew->m_ImagePath,
ImageNew->m_ModuleName);
RestrictModNameChars(ImageNew->m_ModuleName, ImageNew->m_ModuleName);
strcpy(ImageNew->m_OriginalModuleName, ImageNew->m_ModuleName);
}
else
{
RestrictModNameChars(ModEntry->ModuleName, ImageNew->m_ModuleName);
//
// We have an alias, so keep original module name from path
//
CreateModuleNameFromPath(ImageNew->m_ImagePath,
ImageNew->m_OriginalModuleName);
RestrictModNameChars(ImageNew->m_OriginalModuleName,
ImageNew->m_OriginalModuleName);
}
//
// Check for duplicate module names and
// image overlaps.
//
ImageInfo* Check;
for (Check = m_ImageHead; Check != NULL; Check = Check->m_Next)
{
if (Check != ImageNew &&
!_strcmpi(ImageNew->m_ModuleName, Check->m_ModuleName))
{
int Len = strlen(ImageNew->m_ModuleName);
// Module names match, so qualify with the base address.
// Resulting name must be unique since base addresses are.
if (m_Target->m_Machine->m_Ptr64)
{
if (Len >= MAX_MODULE - 17)
{
Len = MAX_MODULE - 18;
}
sprintf(ImageNew->m_ModuleName + Len, "_%I64x",
ModEntry->Base);
}
else
{
if (Len >= MAX_MODULE - 9)
{
Len = MAX_MODULE - 10;
}
sprintf(ImageNew->m_ModuleName + Len, "_%x",
(ULONG)ModEntry->Base);
}
// Force all references to this module to be
// through the exact module name and not through
// an original name that may have been ambiguous.
ImageNew->m_OriginalModuleName[0] = 0;
}
if (Check != ImageNew &&
ImageNew->m_BaseOfImage <
Check->m_BaseOfImage + Check->m_SizeOfImage &&
Check->m_BaseOfImage <
ImageNew->m_BaseOfImage + ImageNew->m_SizeOfImage)
{
WarnOut("WARNING: %s overlaps %s\n",
ImageNew->m_ModuleName,
Check->m_ModuleName);
}
}
//
// If we do not want to load symbolic information, just return here.
//
if (!LoadSymbols)
{
*ImageAdded = ImageNew;
return S_OK;
}
if (ModEntry->DebugHeader)
{
ModLoadData.ssize = sizeof(ModLoadData);
ModLoadData.ssig = DBHHEADER_DEBUGDIRS;
ModLoadData.data = ModEntry->DebugHeader;
ModLoadData.size = ModEntry->SizeOfDebugHeader;
ModLoadData.flags = 0;
}
LoadAddress = SymLoadModuleEx(m_SymHandle,
ImageNew->m_File,
PrepareImagePath(ImageNew->m_ImagePath),
ImageNew->m_ModuleName,
ImageNew->m_BaseOfImage,
ImageNew->m_SizeOfImage,
ModEntry->DebugHeader ? &ModLoadData : NULL,
0);
if (!LoadAddress)
{
Status = WIN32_LAST_STATUS();
VerbOut("SymLoadModule(%N, %N, \"%s\", \"%s\", %s, %x) fails\n",
m_SymHandle,
ImageNew->m_File,
ImageNew->m_ImagePath,
ImageNew->m_ModuleName,
FormatAddr64(ImageNew->m_BaseOfImage),
ImageNew->m_SizeOfImage);
// We don't want deletion to notify of a symbol change
// if this is a partially newly created image.
if (!ReusedExisting)
{
g_EngNotify++;
}
delete ImageNew;
if (!ReusedExisting)
{
g_EngNotify--;
}
return Status;
}
if (!ImageNew->m_BaseOfImage)
{
ImageNew->m_BaseOfImage = LoadAddress;
}
if (ForceSymbolLoad)
{
SymLoadModule64(m_SymHandle,
NULL,
NULL,
NULL,
ImageNew->m_BaseOfImage,
0);
}
SymModInfo.SizeOfStruct = sizeof(SymModInfo);
if (SymGetModuleInfo64(m_SymHandle,
ImageNew->m_BaseOfImage, &SymModInfo))
{
ImageNew->m_SizeOfImage = SymModInfo.ImageSize;
}
else
{
Status = WIN32_LAST_STATUS();
VerbOut("SymGetModuleInfo(%N, %s) fails\n",
m_SymHandle, FormatAddr64(ImageNew->m_BaseOfImage));
// We don't want DelImage to notify of a symbol change
// if this is a partially newly created image.
if (!ReusedExisting)
{
g_EngNotify++;
}
delete ImageNew;
if (!ReusedExisting)
{
g_EngNotify--;
}
return Status;
}
if (ModEntry->ImageMachineTypeValid)
{
ImageNew->m_MachineType = ModEntry->MachineType;
}
StartOutLine(DEBUG_OUTPUT_VERBOSE, OUT_LINE_NO_PREFIX);
VerbOut("ModLoad: %s %s %-8s\n",
FormatAddr64(ImageNew->m_BaseOfImage),
FormatAddr64(ImageNew->m_BaseOfImage + ImageNew->m_SizeOfImage),
ImageNew->m_ImagePath);
NotifyChangeSymbolState(DEBUG_CSS_LOADS, ImageNew->m_BaseOfImage, this);
*ImageAdded = ImageNew;
return S_OK;
}
void
ProcessInfo::SynthesizeSymbols(void)
{
// SynthesizeSymbols can result in symbol
// callbacks but the symbols involved aren't real symbols
// so suppress notifications.
g_EngNotify++;
if (m_Target->m_TypeInfo.UmSharedUserDataOffset)
{
//
// Create a fake module for the shared user
// data area. Add a symbol for the system
// call stub there if a stub exists.
//
ImageInfo* Image;
Image = new ImageInfo(this, "SharedUserData",
m_Target->m_TypeInfo.UmSharedUserDataOffset,
FALSE);
if (!Image)
{
WarnOut("Unable to create shared user data image\n");
}
else
{
Image->m_SizeOfImage = m_Target->m_Machine->m_PageSize;
strcpy(Image->m_ModuleName, Image->m_ImagePath);
strcpy(Image->m_OriginalModuleName, Image->m_ImagePath);
if (!SymLoadModuleEx(m_SymHandle, NULL,
Image->m_ImagePath,
Image->m_ModuleName, Image->m_BaseOfImage,
Image->m_SizeOfImage, NULL, SLMFLAG_VIRTUAL))
{
WarnOut("Unable to add shared user data module\n");
delete Image;
}
else if (m_Target->m_TypeInfo.UmSharedSysCallOffset &&
!SymAddSymbol(m_SymHandle,
Image->m_BaseOfImage,
"SystemCallStub",
m_Target->m_TypeInfo.UmSharedSysCallOffset,
m_Target->m_TypeInfo.UmSharedSysCallSize,
0))
{
WarnOut("Unable to add system call symbol\n");
delete Image;
}
else
{
m_SynthesizedImage = Image;
}
}
}
g_EngNotify--;
}
void
ProcessInfo::VerifyKernel32Version(void)
{
ImageInfo* Image = FindImageByName("kernel32", 8, INAME_MODULE, FALSE);
if (!Image)
{
return;
}
//
// Verify the OS version matches kernel32's image version.
//
IMAGE_NT_HEADERS64 NtHeaders;
if (m_Target->ReadImageNtHeaders(this, Image->m_BaseOfImage,
&NtHeaders) == S_OK)
{
if (NtHeaders.OptionalHeader.MajorImageVersion !=
m_Target->m_KdVersion.MajorVersion ||
NtHeaders.OptionalHeader.MinorImageVersion !=
m_Target->m_KdVersion.MinorVersion)
{
WarnOut("WARNING: System version is %d.%d but "
"kernel32.dll is version %d.%d.\n",
m_Target->m_KdVersion.MajorVersion,
m_Target->m_KdVersion.MinorVersion,
NtHeaders.OptionalHeader.MajorImageVersion,
NtHeaders.OptionalHeader.MinorImageVersion);
if (IS_USER_DUMP(m_Target))
{
WarnOut("If this dump was generated by userdump.exe on "
"Windows NT 4.0 the dump\n"
"version is probably incorrect. "
"Set DBGENG_FULL_DUMP_VERSION=4.0 in your\n"
"environment to override the dump version.\n");
}
}
}
}
BOOL
ProcessInfo::DeleteExitedInfos(void)
{
ThreadInfo* Thread;
ThreadInfo* ThreadNext;
BOOL DeletedSomething = FALSE;
for (Thread = m_ThreadHead; Thread; Thread = ThreadNext)
{
ThreadNext = Thread->m_Next;
if (Thread->m_Exited)
{
delete Thread;
DeletedSomething = TRUE;
}
}
ImageInfo* Image;
ImageInfo* ImagePrev;
ImageInfo* ImageNext;
ImagePrev = NULL;
for (Image = m_ImageHead; Image; Image = ImageNext)
{
ImageNext = Image->m_Next;
if (Image->m_Unloaded)
{
delete Image;
DeletedSomething = TRUE;
}
else
{
ImagePrev = Image;
}
}
return DeletedSomething;
}
void
ProcessInfo::PrepareForExecution(void)
{
ThreadInfo* Thread;
ForProcessThreads(this)
{
Thread->PrepareForExecution();
}
ResetImplicitData();
m_VirtualCache.Empty();
m_VirtualCache.SetForceDecodePtes(FALSE, m_Target);
FlushCorState();
}
void
ProcessInfo::OutputThreadInfo(ThreadInfo* Match, BOOL Verbose)
{
ThreadInfo* Thread;
Thread = m_ThreadHead;
while (Thread)
{
if (Match == NULL || Match == Thread)
{
ULONG64 DataOffset;
HRESULT Status;
char CurMark;
Status =
m_Target->
GetThreadInfoDataOffset(Thread, 0, &DataOffset);
if (Status != S_OK)
{
WarnOut("Unable to get thread data for thread %u\n",
Thread->m_UserId);
DataOffset = 0;
}
if (Thread == g_Thread)
{
CurMark = '.';
}
else if (Thread == g_EventThread)
{
CurMark = '#';
}
else
{
CurMark = ' ';
}
dprintf("%c%3ld Id: %lx.%lx Suspend: %d Teb: %s ",
CurMark,
Thread->m_UserId,
m_SystemId,
Thread->m_SystemId,
Thread->m_SuspendCount,
FormatAddr64(DataOffset));
if (Thread->m_Frozen)
{
dprintf("Frozen ");
}
else
{
dprintf("Unfrozen");
}
if (Thread->m_Name[0])
{
dprintf(" \"%s\"", Thread->m_Name);
}
dprintf("\n");
if (Verbose)
{
dprintf(" ");
if (!Thread->m_StartOffset)
{
if (m_Target->
GetThreadStartOffset(Thread,
&Thread->m_StartOffset) != S_OK)
{
Thread->m_StartOffset = 0;
}
}
if (Thread->m_StartOffset)
{
dprintf("Start: ");
OutputSymAddr(Thread->m_StartOffset,
SYMADDR_FORCE | SYMADDR_OFFSET, NULL);
}
dprintf("\n");
}
}
if (CheckUserInterrupt())
{
break;
}
Thread = Thread->m_Next;
}
}
HRESULT
ProcessInfo::AddOopFuncTableDll(PWSTR Dll, ULONG64 Handle)
{
OUT_OF_PROC_FUNC_TABLE_DLL* OopDll;
OopDll = (OUT_OF_PROC_FUNC_TABLE_DLL*)
malloc(sizeof(*OopDll) + (wcslen(Dll) + 1) * sizeof(Dll));
if (!OopDll)
{
return E_OUTOFMEMORY;
}
OopDll->Next = m_OopFuncTableDlls;
m_OopFuncTableDlls = OopDll;
OopDll->Handle = Handle;
wcscpy((PWSTR)(OopDll + 1), Dll);
return S_OK;
}
void
ProcessInfo::ClearOopFuncTableDlls(void)
{
while (m_OopFuncTableDlls)
{
OUT_OF_PROC_FUNC_TABLE_DLL* OopDll = m_OopFuncTableDlls;
m_OopFuncTableDlls = OopDll->Next;
if (IS_LIVE_USER_TARGET(m_Target))
{
((LiveUserTargetInfo*)m_Target)->m_Services->
FreeLibrary(OopDll->Handle);
}
free(OopDll);
}
}
OUT_OF_PROC_FUNC_TABLE_DLL*
ProcessInfo::FindOopFuncTableDll(PWSTR Dll)
{
OUT_OF_PROC_FUNC_TABLE_DLL* OopDll;
for (OopDll = m_OopFuncTableDlls; OopDll; OopDll = OopDll->Next)
{
if (!_wcsicmp(Dll, (PWSTR)(OopDll + 1)))
{
return OopDll;
}
}
return NULL;
}
HRESULT
ProcessInfo::LoadCorDebugDll(void)
{
HRESULT Status;
MachineInfo* CorMachine;
if (m_CorDebugDll)
{
return S_OK;
}
if (!m_CorImage ||
!(CorMachine = MachineTypeInfo(m_Target,
m_CorImage->GetMachineType())))
{
return E_UNEXPECTED;
}
VS_FIXEDFILEINFO CorVer;
if ((Status = m_Target->
GetImageVersionInformation(this,
m_CorImage->m_ImagePath,
m_CorImage->m_BaseOfImage,
"\\", &CorVer, sizeof(CorVer),
NULL)) != S_OK)
{
ErrOut("Unable to get version information for %s\n",
m_CorImage->m_ModuleName);
return Status;
}
PSTR CorDacType;
switch(m_CorImageType)
{
case COR_DLL_EE:
CorDacType = "ee";
break;
case COR_DLL_WKS:
CorDacType = "wks";
break;
case COR_DLL_SVR:
CorDacType = "svr";
break;
default:
ErrOut("Unknown runtime DLL type %s\n",
m_CorImage->m_ModuleName);
return E_INVALIDARG;
}
char DacDll[MAX_PATH];
PSTR CorImagePath = NULL;
PSTR Tail;
// If this is a live session we want to look for the
// debug DLL in the same place that the runtime is.
// If this is a dump, we want to look in the same place
// that the runtime image file was mapped from.
if (IS_DUMP_TARGET(m_Target) &&
m_CorImage->m_MappedImagePath[0])
{
CorImagePath = m_CorImage->m_MappedImagePath;
}
if (!CorImagePath)
{
CorImagePath = m_CorImage->m_ImagePath;
}
if (!CopyString(DacDll, CorImagePath, DIMA(DacDll)))
{
ErrOut("Runtime debugging DLL path overflow\n");
return E_OUTOFMEMORY;
}
// We need to request the debugging DLL that runs
// using the currently running processor type and
// that can debug the current target's processor type.
#if defined(_X86_)
PSTR HostCpu = "x86";
#elif defined(_IA64_)
PSTR HostCpu = "IA64";
#elif defined(_AMD64_)
PSTR HostCpu = "AMD64";
#elif defined(_ARM_)
PSTR HostCpu = "ARM";
#else
#error Unknown processor.
#endif
Tail = (PSTR)PathTail(DacDll);
if (!PrintString(Tail, (ULONG)(DIMA(DacDll) - (Tail - DacDll)),
"mscordac%s_%s_%s_%u.%u.%u.%u%s.dll",
CorDacType,
HostCpu,
CorMachine->m_AbbrevName,
CorVer.dwFileVersionMS >> 16,
CorVer.dwFileVersionMS & 0xffff,
CorVer.dwFileVersionLS >> 16,
CorVer.dwFileVersionLS & 0xffff,
(CorVer.dwFileFlags & VS_FF_DEBUG) ?
((CorVer.dwFileFlags & VS_FF_PRIVATEBUILD) ?
".fastchecked" : ".checked") : ""))
{
ErrOut("Runtime debugging DLL path overflow\n");
return E_OUTOFMEMORY;
}
//
// First try and load the debugging DLL using the same
// path as the runtime DLL. This makes it easy to pick
// up debugging DLLs that come with runtime installations.
//
PSTR DllPath = DacDll;
m_CorDebugDll = LoadLibrary(DllPath);
if (!m_CorDebugDll &&
(GetLastError() == ERROR_PATH_NOT_FOUND ||
GetLastError() == ERROR_FILE_NOT_FOUND ||
GetLastError() == ERROR_MOD_NOT_FOUND))
{
// Couldn't find it, so allow a path search.
DllPath = Tail;
m_CorDebugDll = LoadLibrary(DllPath);
}
if (!m_CorDebugDll)
{
Status = WIN32_LAST_STATUS();
VerbOut("Unable to load runtime debug DLL %s, %s\n",
DllPath, FormatStatusCode(Status));
return Status;
}
PFN_CreateCorDataAccess Entry = (PFN_CreateCorDataAccess)
GetProcAddress(m_CorDebugDll, "CreateCorDataAccess");
if (!Entry)
{
Status = WIN32_LAST_STATUS();
FreeLibrary(m_CorDebugDll);
m_CorDebugDll = NULL;
ErrOut("Runtime debug DLL %s missing entry point\n", DllPath);
return Status;
}
if ((Status = Entry(__uuidof(ICorDataAccess), &m_CorServices,
(void**)&m_CorAccess)) != S_OK)
{
FreeLibrary(m_CorDebugDll);
m_CorDebugDll = NULL;
ErrOut("Runtime debug DLL %s init failure, %s\n",
DllPath, FormatStatusCode(Status));
return Status;
}
VerbOut("Loaded runtime debug DLL %s\n", DllPath);
return S_OK;
}
HRESULT
ProcessInfo::IsCorCode(ULONG64 Native)
{
HRESULT Status;
if ((Status = LoadCorDebugDll()) != S_OK)
{
return Status;
}
return m_CorAccess->IsCorCode(Native);
}
HRESULT
ProcessInfo::ConvertNativeToIlOffset(ULONG64 Native,
PULONG64 ImageBase,
PULONG32 MethodToken,
PULONG32 MethodOffs)
{
HRESULT Status;
if ((Status = LoadCorDebugDll()) != S_OK)
{
return Status;
}
if ((Status = m_CorAccess->
GetILOffsetFromTargetAddress(Native, ImageBase,
MethodToken, MethodOffs)) != S_OK)
{
return Status;
}
if (!FindImageByOffset(*ImageBase, FALSE))
{
IMAGE_NT_HEADERS64 NtHdr;
char Name[MAX_IMAGE_PATH];
// XXX drewb - Need to work out when the
// module list should be updated for managed
// code that's not system-loaded.
// We don't know about this module, so load it
// right now.
if (m_Target->ReadImageNtHeaders(this, *ImageBase, &NtHdr) == S_OK &&
GetModnameFromImage(this, *ImageBase, NULL,
Name, DIMA(Name), TRUE))
{
char ReloadCmd[MAX_IMAGE_PATH];
PCSTR ArgsRet;
PrintString(ReloadCmd, DIMA(ReloadCmd), "%s=0x%s,0x%x",
Name, FormatAddr64(*ImageBase),
NtHdr.OptionalHeader.SizeOfImage);
m_Target->Reload(m_CurrentThread, ReloadCmd, &ArgsRet);
ImageInfo* Image = FindImageByOffset(*ImageBase, FALSE);
if (Image)
{
Image->m_CorImage = TRUE;
}
}
}
return S_OK;
}
HRESULT
ProcessInfo::GetCorSymbol(ULONG64 Native, PSTR Buffer, ULONG BufferChars,
PULONG64 Displacement)
{
HRESULT Status;
if ((Status = LoadCorDebugDll()) != S_OK)
{
return Status;
}
WCHAR SymWide[MAX_SYMBOL_LEN];
if ((Status = m_CorAccess->
GetCodeSymbolForTargetAddress(Native, SymWide, DIMA(SymWide),
Displacement)) != S_OK)
{
return Status;
}
if (!WideCharToMultiByte(CP_ACP, 0, SymWide, -1,
Buffer, BufferChars,
NULL, NULL))
{
return WIN32_LAST_STATUS();
}
return S_OK;
}
ICorDataStackWalk*
ProcessInfo::StartCorStack(ULONG32 CorThreadId)
{
HRESULT Status;
ICorDataStackWalk* Walk;
if ((Status = LoadCorDebugDll()) != S_OK)
{
return NULL;
}
if ((Status = m_CorAccess->StartStackWalk(CorThreadId,
DAC_STACK_ALL_FRAMES,
&Walk)) != S_OK)
{
return NULL;
}
return Walk;
}
HRESULT
ProcessInfo::Terminate(void)
{
if (!IS_LIVE_USER_TARGET(m_Target))
{
return E_UNEXPECTED;
}
PUSER_DEBUG_SERVICES Services =
((LiveUserTargetInfo*)m_Target)->m_Services;
HRESULT Status = S_OK;
if (!m_Exited)
{
if ((m_Flags & ENG_PROC_EXAMINED) == 0 &&
(Status = Services->TerminateProcess(m_SysHandle,
E_FAIL)) != S_OK)
{
ErrOut("TerminateProcess failed, %s\n",
FormatStatusCode(Status));
}
else
{
MarkExited();
}
}
return Status;
}
HRESULT
ProcessInfo::Detach(void)
{
if (!IS_LIVE_USER_TARGET(m_Target))
{
return E_UNEXPECTED;
}
PUSER_DEBUG_SERVICES Services =
((LiveUserTargetInfo*)m_Target)->m_Services;
HRESULT Status = S_OK;
if (!m_Exited)
{
if ((m_Flags & ENG_PROC_EXAMINED) == 0 &&
(Status = Services->DetachProcess(m_SystemId)) != S_OK)
{
// Older systems don't support detach so
// don't show an error message in that case.
if (Status != E_NOTIMPL)
{
ErrOut("DebugActiveProcessStop(%d) failed, %s\n",
m_SystemId, FormatStatusCode(Status));
}
}
else
{
MarkExited();
}
}
return Status;
}
HRESULT
ProcessInfo::Abandon(void)
{
if (!IS_LIVE_USER_TARGET(m_Target))
{
return E_UNEXPECTED;
}
PUSER_DEBUG_SERVICES Services =
((LiveUserTargetInfo*)m_Target)->m_Services;
HRESULT Status;
if ((Status = Services->AbandonProcess(m_SysHandle)) != S_OK)
{
// Older systems don't support abandon so
// don't show an error message in that case.
if (Status != E_NOTIMPL)
{
ErrOut("Unable to abandon process\n");
}
return Status;
}
// We need to continue any existing event as it won't
// be returned from WaitForDebugEvent again. We
// do not want to resume execution, though.
if (m_Target->m_DeferContinueEvent)
{
if ((Status = Services->ContinueEvent(DBG_CONTINUE)) != S_OK)
{
ErrOut("Unable to continue abandoned event, %s\n",
FormatStatusCode(Status));
return Status;
}
m_Target->m_DeferContinueEvent = FALSE;
}
return Status;
}
HRESULT
ProcessInfo::GetImplicitThreadData(ThreadInfo* Thread, PULONG64 Offset)
{
HRESULT Status;
if (m_ImplicitThreadData == 0 ||
(m_ImplicitThreadDataIsDefault &&
Thread != m_ImplicitThreadDataThread))
{
Status = SetImplicitThreadData(Thread, 0, FALSE);
}
else
{
Status = S_OK;
}
*Offset = m_ImplicitThreadData;
return Status;
}
HRESULT
ProcessInfo::GetImplicitThreadDataTeb(ThreadInfo* Thread, PULONG64 Offset)
{
if (IS_USER_TARGET(m_Target))
{
// In user mode the thread data is the TEB.
return GetImplicitThreadData(Thread, Offset);
}
else if (IS_KERNEL_TARGET(m_Target))
{
return ReadImplicitThreadInfoPointer
(Thread, m_Target->m_KdDebuggerData.OffsetKThreadTeb, Offset);
}
else
{
return E_UNEXPECTED;
}
}
HRESULT
ProcessInfo::SetImplicitThreadData(ThreadInfo* Thread,
ULONG64 Offset, BOOL Verbose)
{
HRESULT Status;
BOOL Default = FALSE;
if (Offset == 0)
{
if (!Thread || Thread->m_Process != this)
{
if (Verbose)
{
ErrOut("Unable to get the current thread data\n");
}
return E_UNEXPECTED;
}
if ((Status = m_Target->
GetThreadInfoDataOffset(Thread, 0, &Offset)) != S_OK)
{
if (Verbose)
{
ErrOut("Unable to get the current thread data\n");
}
return Status;
}
if (Offset == 0)
{
if (Verbose)
{
ErrOut("Current thread data is NULL\n");
}
return E_FAIL;
}
Default = TRUE;
}
m_ImplicitThreadData = Offset;
m_ImplicitThreadDataIsDefault = Default;
m_ImplicitThreadDataThread = Thread;
return S_OK;
}
HRESULT
ProcessInfo::ReadImplicitThreadInfoPointer(ThreadInfo* Thread,
ULONG Offset, PULONG64 Ptr)
{
HRESULT Status;
ULONG64 CurThread;
// Retrieve the current ETHREAD.
if ((Status = GetImplicitThreadData(Thread, &CurThread)) != S_OK)
{
return Status;
}
return m_Target->
ReadPointer(this, m_Target->m_Machine, CurThread + Offset, Ptr);
}
//----------------------------------------------------------------------------
//
// Functions.
//
//----------------------------------------------------------------------------
ProcessInfo*
FindAnyProcessByUserId(ULONG Id)
{
TargetInfo* Target;
ProcessInfo* Process;
ForAllLayersToProcess()
{
if (Process->m_UserId == Id)
{
return Process;
}
}
return NULL;
}
ProcessInfo*
FindAnyProcessBySystemId(ULONG Id)
{
TargetInfo* Target;
ProcessInfo* Process;
ForAllLayersToProcess()
{
if (Process->m_SystemId == Id)
{
return Process;
}
}
return NULL;
}
void
ParseProcessCmds(void)
{
char Ch;
ProcessInfo* Process;
ULONG Id;
if (!g_Target)
{
error(BADTHREAD);
}
Ch = PeekChar();
if (Ch == '\0' || Ch == ';')
{
g_Target->OutputProcessInfo(NULL);
}
else
{
Process = g_Process;
g_CurCmd++;
if (Ch == '.')
{
;
}
else if (Ch == '#')
{
Process = g_EventProcess;
}
else if (Ch == '*')
{
Process = NULL;
}
else if (Ch == '[')
{
g_CurCmd--;
Id = (ULONG)GetTermExpression("Process ID missing from");
Process = FindAnyProcessByUserId(Id);
if (Process == NULL)
{
error(BADPROCESS);
}
}
else if (Ch == '~')
{
if (*g_CurCmd != '[')
{
error(SYNTAX);
}
Id = (ULONG)GetTermExpression("Process ID missing from");
Process = FindAnyProcessBySystemId(Id);
if (Process == NULL)
{
error(BADPROCESS);
}
}
else if (Ch >= '0' && Ch <= '9')
{
Id = 0;
do
{
Id = Id * 10 + Ch - '0';
Ch = *g_CurCmd++;
} while (Ch >= '0' && Ch <= '9');
g_CurCmd--;
Process = FindAnyProcessByUserId(Id);
if (Process == NULL)
{
error(BADPROCESS);
}
}
else
{
g_CurCmd--;
}
Ch = PeekChar();
if (Ch == '\0' || Ch == ';')
{
g_Target->OutputProcessInfo(Process);
}
else
{
g_CurCmd++;
if (tolower(Ch) == 's')
{
if (Process == NULL)
{
error(BADPROCESS);
}
if (Process->m_CurrentThread == NULL)
{
Process->m_CurrentThread = Process->m_ThreadHead;
if (Process->m_CurrentThread == NULL)
{
error(BADPROCESS);
}
}
SetPromptThread(Process->m_CurrentThread,
SPT_DEFAULT_OCI_FLAGS);
}
else
{
g_CurCmd--;
}
}
}
}
//----------------------------------------------------------------------------
//
// Process creation and attach functions.
//
//----------------------------------------------------------------------------
HRESULT
TerminateProcesses(void)
{
HRESULT Status;
if (!AnyLiveUserTargets())
{
// Nothing to do.
return S_OK;
}
if (g_SymOptions & SYMOPT_SECURE)
{
ErrOut("SECURE: Process termination disallowed\n");
return HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED);
}
Status = PrepareForSeparation();
if (Status != S_OK)
{
ErrOut("Unable to prepare for termination, %s\n",
FormatStatusCode(Status));
return Status;
}
TargetInfo* Target;
HRESULT SingleStatus;
ForAllLayersToTarget()
{
// If we fail in the middle of killing things there
// isn't much that can be done so just attempt to
// kill as many things as possible.
if (IS_LIVE_USER_TARGET(Target) &&
(SingleStatus = Target->TerminateProcesses()) != S_OK)
{
Status = SingleStatus;
}
}
DiscardLastEvent();
return Status;
}
HRESULT
DetachProcesses(void)
{
HRESULT Status;
if (!AnyLiveUserTargets())
{
// Nothing to do.
return S_OK;
}
if (g_SymOptions & SYMOPT_SECURE)
{
ErrOut("SECURE: Process detach disallowed\n");
return HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED);
}
Status = PrepareForSeparation();
if (Status != S_OK)
{
ErrOut("Unable to prepare for detach, %s\n",
FormatStatusCode(Status));
return Status;
}
TargetInfo* Target;
HRESULT SingleStatus;
ForAllLayersToTarget()
{
// If we fail in the middle of detaching things there
// isn't much that can be done so just attempt to
// detach as many things as possible.
if (IS_LIVE_USER_TARGET(Target) &&
(SingleStatus = Target->DetachProcesses()) != S_OK)
{
Status = SingleStatus;
}
}
DiscardLastEvent();
return Status;
}
HRESULT
SeparateCurrentProcess(ULONG Mode, PSTR Description)
{
if (!IS_LIVE_USER_TARGET(g_Target) ||
g_Process == NULL)
{
return E_INVALIDARG;
}
if (g_SymOptions & SYMOPT_SECURE)
{
ErrOut("SECURE: Process separation disallowed\n");
return HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED);
}
PUSER_DEBUG_SERVICES Services =
((LiveUserTargetInfo*)g_Target)->m_Services;
if ((Mode == SEP_DETACH || Mode == SEP_TERMINATE) &&
IS_CUR_CONTEXT_ACCESSIBLE())
{
ADDR Pc;
// Move the PC past any current breakpoint instruction so that
// the process has a chance of running.
g_Machine->GetPC(&Pc);
if (g_Machine->IsBreakpointInstruction(g_Process, &Pc))
{
g_Machine->AdjustPCPastBreakpointInstruction
(&Pc, DEBUG_BREAKPOINT_CODE);
}
}
// Flush any buffered changes.
if (IS_CUR_CONTEXT_ACCESSIBLE())
{
g_Target->FlushRegContext();
}
if (g_EventProcess == g_Process && Mode != SEP_TERMINATE)
{
if (g_Target->m_DeferContinueEvent)
{
Services->ContinueEvent(DBG_CONTINUE);
g_Target->m_DeferContinueEvent = FALSE;
}
}
((LiveUserTargetInfo*)g_Target)->
SuspendResumeThreads(g_Process, FALSE, NULL);
HRESULT Status;
PSTR Operation;
switch(Mode)
{
case SEP_DETACH:
Status = g_Process->Detach();
Operation = "Detached";
break;
case SEP_TERMINATE:
Status = g_Process->Terminate();
if ((g_Process->m_Flags & ENG_PROC_EXAMINED) == 0)
{
Operation = "Terminated. "
"Exit thread and process events will occur.";
}
else
{
Operation = "Terminated";
}
break;
case SEP_ABANDON:
Status = g_Process->Abandon();
Operation = "Abandoned";
break;
}
if (Status == S_OK)
{
if (Description != NULL)
{
strcpy(Description, Operation);
}
// If we're detaching or abandoning it's safe to go
// ahead and remove the process now so that it
// can't be access further.
// If we're terminating we have to wait for
// the exit events to come through so
// keep the process until that happens.
if (Mode != SEP_TERMINATE)
{
delete g_Process;
SetToAnyLayers(TRUE);
}
else
{
g_Process->m_Exited = FALSE;
}
}
else
{
((LiveUserTargetInfo*)g_Target)->
SuspendResumeThreads(g_Process, TRUE, NULL);
}
return Status;
}
Copy Permalink