1120 lines
31 KiB
C++
1120 lines
31 KiB
C++
//----------------------------------------------------------------------------
|
|
//
|
|
// Module list abstraction.
|
|
//
|
|
// Copyright (C) Microsoft Corporation, 2001-2002.
|
|
//
|
|
//----------------------------------------------------------------------------
|
|
|
|
#include "ntsdp.hpp"
|
|
|
|
//
|
|
// Note by olegk
|
|
// We using KLDR_DATA_TABLE_ENTRY64 in some places like
|
|
// GetModNameFromLoaderList) instead of LDR_DATA_TABLE_ENTRY assuming that
|
|
// most important fields are the same in these structures.
|
|
// So I add some asserts for quick notification if anything will change
|
|
// (these are not fullproof checks just a basics)
|
|
//
|
|
C_ASSERT(&(((PLDR_DATA_TABLE_ENTRY64)0)->InLoadOrderLinks) ==
|
|
&(((PKLDR_DATA_TABLE_ENTRY64)0)->InLoadOrderLinks));
|
|
|
|
C_ASSERT(&(((PLDR_DATA_TABLE_ENTRY64)0)->DllBase) ==
|
|
&(((PKLDR_DATA_TABLE_ENTRY64)0)->DllBase));
|
|
|
|
C_ASSERT(&(((PLDR_DATA_TABLE_ENTRY64)0)->FullDllName) ==
|
|
&(((PKLDR_DATA_TABLE_ENTRY64)0)->FullDllName));
|
|
|
|
//----------------------------------------------------------------------------
|
|
//
|
|
// Module list abstraction.
|
|
//
|
|
//----------------------------------------------------------------------------
|
|
|
|
void
|
|
ModuleInfo::ReadImageHeaderInfo(PMODULE_INFO_ENTRY Entry)
|
|
{
|
|
HRESULT Status;
|
|
UCHAR SectorBuffer[ 1024 ];
|
|
PIMAGE_NT_HEADERS64 NtHeaders;
|
|
ULONG Result;
|
|
|
|
if (Entry->ImageInfoValid)
|
|
{
|
|
return;
|
|
}
|
|
|
|
//
|
|
// For live debugging of both user mode and kernel mode, we have
|
|
// to go load the checksum timestamp directly out of the image header
|
|
// because someone decided to overwrite these fields in the OS
|
|
// module list - Argh !
|
|
//
|
|
|
|
Entry->CheckSum = UNKNOWN_CHECKSUM;
|
|
Entry->TimeDateStamp = UNKNOWN_TIMESTAMP;
|
|
|
|
Status = m_Target->ReadVirtual(m_Process, Entry->Base, SectorBuffer,
|
|
sizeof(SectorBuffer), &Result);
|
|
if (Status == S_OK && Result >= sizeof(SectorBuffer))
|
|
{
|
|
NtHeaders = (PIMAGE_NT_HEADERS64)ImageNtHeader(SectorBuffer);
|
|
if (NtHeaders != NULL)
|
|
{
|
|
switch (NtHeaders->OptionalHeader.Magic)
|
|
{
|
|
case IMAGE_NT_OPTIONAL_HDR32_MAGIC:
|
|
Entry->CheckSum = ((PIMAGE_NT_HEADERS32)NtHeaders)->
|
|
OptionalHeader.CheckSum;
|
|
Entry->Size = ((PIMAGE_NT_HEADERS32)NtHeaders)->
|
|
OptionalHeader.SizeOfImage;
|
|
Entry->SizeOfCode = ((PIMAGE_NT_HEADERS32)NtHeaders)->
|
|
OptionalHeader.SizeOfCode;
|
|
Entry->SizeOfData = ((PIMAGE_NT_HEADERS32)NtHeaders)->
|
|
OptionalHeader.SizeOfInitializedData;
|
|
Entry->MajorImageVersion = ((PIMAGE_NT_HEADERS32)NtHeaders)->
|
|
OptionalHeader.MajorImageVersion;
|
|
Entry->MinorImageVersion = ((PIMAGE_NT_HEADERS32)NtHeaders)->
|
|
OptionalHeader.MinorImageVersion;
|
|
break;
|
|
case IMAGE_NT_OPTIONAL_HDR64_MAGIC:
|
|
Entry->CheckSum = NtHeaders->OptionalHeader.CheckSum;
|
|
Entry->Size = NtHeaders->OptionalHeader.SizeOfImage;
|
|
Entry->SizeOfCode = NtHeaders->OptionalHeader.SizeOfCode;
|
|
Entry->SizeOfData =
|
|
NtHeaders->OptionalHeader.SizeOfInitializedData;
|
|
Entry->MajorImageVersion =
|
|
NtHeaders->OptionalHeader.MajorImageVersion;
|
|
Entry->MinorImageVersion =
|
|
NtHeaders->OptionalHeader.MinorImageVersion;
|
|
break;
|
|
}
|
|
|
|
Entry->TimeDateStamp = NtHeaders->FileHeader.TimeDateStamp;
|
|
Entry->MachineType = NtHeaders->FileHeader.Machine;
|
|
|
|
Entry->ImageInfoValid = 1;
|
|
Entry->ImageVersionValid = 1;
|
|
Entry->ImageMachineTypeValid = 1;
|
|
}
|
|
}
|
|
}
|
|
|
|
void
|
|
ModuleInfo::InitSource(ThreadInfo* Thread)
|
|
{
|
|
m_Thread = Thread;
|
|
m_Process = m_Thread->m_Process;
|
|
m_Target = m_Process->m_Target;
|
|
m_Machine = m_Target->m_Machine;
|
|
|
|
m_InfoLevel = MODULE_INFO_ALL;
|
|
}
|
|
|
|
HRESULT
|
|
NtModuleInfo::GetEntry(PMODULE_INFO_ENTRY Entry)
|
|
{
|
|
HRESULT Status;
|
|
ULONG Result = 0;
|
|
ULONG Length;
|
|
ULONG64 Buffer;
|
|
|
|
if (m_Cur == m_Head)
|
|
{
|
|
return S_FALSE;
|
|
}
|
|
|
|
KLDR_DATA_TABLE_ENTRY64 LdrEntry;
|
|
|
|
Status = m_Target->
|
|
ReadLoaderEntry(m_Process, m_Machine, m_Cur, &LdrEntry);
|
|
if (Status != S_OK)
|
|
{
|
|
ErrOut("Unable to read KLDR_DATA_TABLE_ENTRY at %s - %s\n",
|
|
FormatAddr64(m_Cur), FormatStatusCode(Status));
|
|
return Status;
|
|
}
|
|
|
|
m_Cur = LdrEntry.InLoadOrderLinks.Flink;
|
|
|
|
//
|
|
// Get the image path if possible, otherwise
|
|
// just use the image base name.
|
|
//
|
|
|
|
Entry->NamePtr = NULL;
|
|
Entry->NameLength = 0;
|
|
|
|
if (m_InfoLevel > MODULE_INFO_BASE_SIZE)
|
|
{
|
|
Length = (ULONG)(ULONG_PTR)LdrEntry.FullDllName.Length;
|
|
Buffer = LdrEntry.FullDllName.Buffer;
|
|
|
|
// In the NT4 dumps that we have the long name may
|
|
// point to valid memory but the memory content is
|
|
// rarely the correct name, so just don't bother
|
|
// trying to read the long name on NT4.
|
|
if (m_Target->m_SystemVersion >= NT_SVER_W2K &&
|
|
Length != 0 && Buffer != 0 &&
|
|
Length < (MAX_IMAGE_PATH * sizeof(WCHAR)))
|
|
{
|
|
Status = m_Target->ReadVirtual(m_Process, Buffer,
|
|
Entry->Buffer,
|
|
Length,
|
|
&Result);
|
|
|
|
if (Status != S_OK || (Result < Length))
|
|
{
|
|
// Make this a verbose message since it's possible the
|
|
// name is simply paged out.
|
|
VerbOut("Unable to read NT module Full Name "
|
|
"string at %s - %s\n",
|
|
FormatAddr64(Buffer), FormatStatusCode(Status));
|
|
Result = 0;
|
|
}
|
|
}
|
|
|
|
if (!Result)
|
|
{
|
|
Length = (ULONG)(ULONG_PTR)LdrEntry.BaseDllName.Length;
|
|
Buffer = LdrEntry.BaseDllName.Buffer;
|
|
|
|
if (Length != 0 && Buffer != 0 &&
|
|
Length < (MAX_IMAGE_PATH * sizeof(WCHAR)))
|
|
{
|
|
Status = m_Target->ReadVirtual(m_Process, Buffer,
|
|
Entry->Buffer,
|
|
Length,
|
|
&Result);
|
|
|
|
if (Status != S_OK || (Result < Length))
|
|
{
|
|
WarnOut("Unable to read NT module Base Name "
|
|
"string at %s - %s\n",
|
|
FormatAddr64(Buffer), FormatStatusCode(Status));
|
|
Result = 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!Result)
|
|
{
|
|
// We did not get any name - just return.
|
|
return S_OK;
|
|
}
|
|
|
|
*(PWCHAR)(Entry->Buffer + Length) = UNICODE_NULL;
|
|
|
|
Entry->NamePtr = &(Entry->Buffer[0]);
|
|
Entry->UnicodeNamePtr = 1;
|
|
Entry->NameLength = Length;
|
|
}
|
|
|
|
Entry->Base = LdrEntry.DllBase;
|
|
Entry->Size = LdrEntry.SizeOfImage;
|
|
Entry->CheckSum = LdrEntry.CheckSum;
|
|
Entry->TimeDateStamp = LdrEntry.TimeDateStamp;
|
|
|
|
//
|
|
// Update the image information, such as timestamp and real image size,
|
|
// directly from the image header
|
|
//
|
|
|
|
if (m_InfoLevel > MODULE_INFO_BASE_SIZE)
|
|
{
|
|
ReadImageHeaderInfo(Entry);
|
|
}
|
|
|
|
//
|
|
// For newer NT builds, we also have an alternate entry in the
|
|
// LdrDataTable to store image information in case the actual header
|
|
// is paged out. We do this for session space images only right now.
|
|
//
|
|
|
|
if (m_InfoLevel > MODULE_INFO_BASE_SIZE &&
|
|
(LdrEntry.Flags & LDRP_NON_PAGED_DEBUG_INFO))
|
|
{
|
|
NON_PAGED_DEBUG_INFO di;
|
|
|
|
Status = m_Target->ReadVirtual(m_Process,
|
|
LdrEntry.NonPagedDebugInfo,
|
|
&di,
|
|
sizeof(di), // Only read the base struct
|
|
&Result);
|
|
|
|
if (Status != S_OK || (Result < sizeof(di)))
|
|
{
|
|
WarnOut("Unable to read NonPagedDebugInfo at %s - %s\n",
|
|
FormatAddr64(LdrEntry.NonPagedDebugInfo),
|
|
FormatStatusCode(Status));
|
|
return S_OK;
|
|
}
|
|
|
|
Entry->TimeDateStamp = di.TimeDateStamp;
|
|
Entry->CheckSum = di.CheckSum;
|
|
Entry->Size = di.SizeOfImage;
|
|
Entry->MachineType = di.Machine;
|
|
|
|
Entry->ImageInfoPartial = 1;
|
|
Entry->ImageInfoValid = 1;
|
|
Entry->ImageMachineTypeValid = 1;
|
|
|
|
if (di.Flags == 1)
|
|
{
|
|
Entry->DebugHeader = malloc(di.Size - sizeof(di));
|
|
|
|
if (Entry->DebugHeader)
|
|
{
|
|
Status = m_Target->ReadVirtual(m_Process,
|
|
LdrEntry.NonPagedDebugInfo +
|
|
sizeof(di),
|
|
Entry->DebugHeader,
|
|
di.Size - sizeof(di),
|
|
&Result);
|
|
|
|
if (Status != S_OK || (Result < di.Size - sizeof(di)))
|
|
{
|
|
WarnOut("Unable to read NonPagedDebugInfo data at %s - %s\n",
|
|
FormatAddr64(LdrEntry.NonPagedDebugInfo + sizeof(di)),
|
|
FormatStatusCode(Status));
|
|
return S_OK;
|
|
}
|
|
|
|
Entry->ImageDebugHeader = 1;
|
|
Entry->SizeOfDebugHeader = di.Size - sizeof(di);
|
|
}
|
|
}
|
|
}
|
|
|
|
return S_OK;
|
|
}
|
|
|
|
HRESULT
|
|
NtKernelModuleInfo::Initialize(ThreadInfo* Thread)
|
|
{
|
|
HRESULT Status;
|
|
LIST_ENTRY64 List64;
|
|
|
|
InitSource(Thread);
|
|
|
|
if ((m_Head = m_Target->m_KdDebuggerData.PsLoadedModuleList) == 0)
|
|
{
|
|
//
|
|
// This field is ALWAYS set in NT 5 targets.
|
|
//
|
|
// We will only fail here if someone changed the debugger code
|
|
// and did not "make up" this structure properly for NT 4 or
|
|
// dump targets..
|
|
//
|
|
|
|
ErrOut("Module List address is NULL - "
|
|
"debugger not initialized properly.\n");
|
|
return E_FAIL;
|
|
}
|
|
|
|
Status = m_Target->ReadListEntry(m_Process, m_Machine, m_Head, &List64);
|
|
if (Status != S_OK)
|
|
{
|
|
// PsLoadedModuleList is a global kernel variable, so if
|
|
// it isn't around the kernel must not be mapped and
|
|
// we're in a very weird state.
|
|
ErrOut("Unable to read PsLoadedModuleList\n");
|
|
return S_FALSE;
|
|
}
|
|
|
|
if (!List64.Flink)
|
|
{
|
|
ULONG64 LoaderBlock;
|
|
IMAGE_NT_HEADERS64 ImageHdr;
|
|
|
|
//
|
|
// In live debug sessions, the debugger connects before Mm creates
|
|
// the actual module list. If PsLoadedModuleList is
|
|
// uninitialized, try to load symbols from the loader
|
|
// block module list.
|
|
//
|
|
// If there is no loader block module list but we know
|
|
// the kernel base address and can read the image headers
|
|
// we fake a single entry for the kernel so that kernel
|
|
// symbols will load even without any module lists.
|
|
//
|
|
|
|
if (m_Target->m_KdDebuggerData.KeLoaderBlock &&
|
|
m_Target->ReadPointer(m_Process, m_Machine,
|
|
m_Target->m_KdDebuggerData.KeLoaderBlock,
|
|
&LoaderBlock) == S_OK &&
|
|
LoaderBlock &&
|
|
m_Target->ReadListEntry(m_Process, m_Machine, LoaderBlock,
|
|
&List64) == S_OK &&
|
|
List64.Flink)
|
|
{
|
|
m_Head = LoaderBlock;
|
|
}
|
|
else if (m_Target->m_KdDebuggerData.KernBase &&
|
|
m_Target->ReadImageNtHeaders(m_Process, m_Target->
|
|
m_KdDebuggerData.KernBase,
|
|
&ImageHdr) == S_OK)
|
|
{
|
|
m_Head = m_Target->m_KdDebuggerData.KernBase;
|
|
List64.Flink = m_Target->m_KdDebuggerData.KernBase;
|
|
}
|
|
else
|
|
{
|
|
dprintf("No module list information. Delay kernel load.\n");
|
|
return S_FALSE;
|
|
}
|
|
}
|
|
|
|
m_Cur = List64.Flink;
|
|
|
|
return S_OK;
|
|
}
|
|
|
|
HRESULT
|
|
NtKernelModuleInfo::GetEntry(PMODULE_INFO_ENTRY Entry)
|
|
{
|
|
HRESULT Status;
|
|
|
|
if (m_Head && m_Head == m_Target->m_KdDebuggerData.KernBase)
|
|
{
|
|
//
|
|
// We weren't able to locate any actual module list
|
|
// information but we do have a kernel base and valid
|
|
// image at that address. Fake up a kernel module entry.
|
|
//
|
|
|
|
wcscpy((PWSTR)Entry->Buffer, L"kd_ntoskrnl");
|
|
Entry->NamePtr = &(Entry->Buffer[0]);
|
|
Entry->UnicodeNamePtr = 1;
|
|
Entry->NameLength = wcslen((PWSTR)Entry->NamePtr) * sizeof(WCHAR);
|
|
Entry->Base = m_Head;
|
|
ReadImageHeaderInfo(Entry);
|
|
|
|
m_Head = 0;
|
|
m_Cur = 0;
|
|
Status = S_OK;
|
|
}
|
|
else
|
|
{
|
|
Status = NtModuleInfo::GetEntry(Entry);
|
|
}
|
|
|
|
// We know that all kernel modules must be
|
|
// native modules so force the machine type
|
|
// if it isn't already set.
|
|
if (Status == S_OK && !Entry->ImageMachineTypeValid)
|
|
{
|
|
Entry->MachineType = m_Machine->m_ExecTypes[0];
|
|
Entry->ImageMachineTypeValid = 1;
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
NtKernelModuleInfo g_NtKernelModuleIterator;
|
|
|
|
HRESULT
|
|
NtUserModuleInfo::Initialize(ThreadInfo* Thread)
|
|
{
|
|
if (Thread)
|
|
{
|
|
InitSource(Thread);
|
|
}
|
|
return GetUserModuleListAddress(m_Thread, m_Machine, m_Peb, FALSE,
|
|
&m_Head, &m_Cur) ? S_OK : S_FALSE;
|
|
}
|
|
|
|
HRESULT
|
|
NtUserModuleInfo::GetEntry(PMODULE_INFO_ENTRY Entry)
|
|
{
|
|
HRESULT Status = NtModuleInfo::GetEntry(Entry);
|
|
if (Status == S_OK)
|
|
{
|
|
Entry->UserMode = TRUE;
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
HRESULT
|
|
NtTargetUserModuleInfo::Initialize(ThreadInfo* Thread)
|
|
{
|
|
m_Peb = 0;
|
|
return NtUserModuleInfo::Initialize(Thread);
|
|
}
|
|
|
|
NtTargetUserModuleInfo g_NtTargetUserModuleIterator;
|
|
|
|
HRESULT
|
|
NtWow64UserModuleInfo::Initialize(ThreadInfo* Thread)
|
|
{
|
|
HRESULT Status;
|
|
|
|
InitSource(Thread);
|
|
|
|
if (m_Target->m_Machine->m_NumExecTypes < 2)
|
|
{
|
|
return E_UNEXPECTED;
|
|
}
|
|
|
|
m_Machine = MachineTypeInfo(m_Target, m_Target->m_Machine->m_ExecTypes[1]);
|
|
|
|
if ((Status = GetPeb32(&m_Peb)) != S_OK)
|
|
{
|
|
return Status;
|
|
}
|
|
|
|
return NtUserModuleInfo::Initialize(NULL);
|
|
}
|
|
|
|
HRESULT
|
|
NtWow64UserModuleInfo::GetPeb32(PULONG64 Peb32)
|
|
{
|
|
ULONG64 Teb;
|
|
ULONG64 Teb32;
|
|
HRESULT Status;
|
|
|
|
if ((Status = m_Process->GetImplicitThreadDataTeb(m_Thread, &Teb)) == S_OK)
|
|
{
|
|
if ((Status = m_Target->
|
|
ReadPointer(m_Process, m_Machine, Teb, &Teb32)) == S_OK)
|
|
{
|
|
if (!Teb32)
|
|
{
|
|
return E_UNEXPECTED;
|
|
}
|
|
|
|
ULONG RawPeb32;
|
|
|
|
Status = m_Target->
|
|
ReadAllVirtual(m_Process, Teb32 + PEB_FROM_TEB32, &RawPeb32,
|
|
sizeof(RawPeb32));
|
|
if (Status != S_OK)
|
|
{
|
|
ErrOut("Cannot read PEB32 from WOW64 TEB32 %s - %s\n",
|
|
FormatAddr64(Teb32), FormatStatusCode(Status));
|
|
return Status;
|
|
}
|
|
|
|
*Peb32 = EXTEND64(RawPeb32);
|
|
}
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
NtWow64UserModuleInfo g_NtWow64UserModuleIterator;
|
|
|
|
HRESULT
|
|
DebuggerModuleInfo::Initialize(ThreadInfo* Thread)
|
|
{
|
|
InitSource(Thread);
|
|
m_Image = m_Process->m_ImageHead;
|
|
return S_OK;
|
|
}
|
|
|
|
HRESULT
|
|
DebuggerModuleInfo::GetEntry(PMODULE_INFO_ENTRY Entry)
|
|
{
|
|
if (m_Image == NULL)
|
|
{
|
|
return S_FALSE;
|
|
}
|
|
|
|
Entry->NamePtr = m_Image->m_ImagePath;
|
|
Entry->UnicodeNamePtr = 0;
|
|
Entry->NameLength = strlen(Entry->NamePtr);
|
|
Entry->ModuleName = m_Image->m_ModuleName;
|
|
Entry->File = m_Image->m_File;
|
|
Entry->Base = m_Image->m_BaseOfImage;
|
|
Entry->Size = m_Image->m_SizeOfImage;
|
|
Entry->CheckSum = m_Image->m_CheckSum;
|
|
Entry->TimeDateStamp = m_Image->m_TimeDateStamp;
|
|
Entry->MachineType = m_Image->GetMachineType();
|
|
|
|
Entry->ImageInfoValid = TRUE;
|
|
Entry->ImageMachineTypeValid =
|
|
Entry->MachineType != IMAGE_FILE_MACHINE_UNKNOWN ? TRUE : FALSE;
|
|
Entry->UserMode = m_Image->m_UserMode;
|
|
|
|
m_Image = m_Image->m_Next;
|
|
|
|
return S_OK;
|
|
}
|
|
|
|
DebuggerModuleInfo g_DebuggerModuleIterator;
|
|
|
|
void
|
|
UnloadedModuleInfo::InitSource(ThreadInfo* Thread)
|
|
{
|
|
m_Thread = Thread;
|
|
m_Process = m_Thread->m_Process;
|
|
m_Target = m_Process->m_Target;
|
|
m_Machine = m_Target->m_Machine;
|
|
}
|
|
|
|
HRESULT
|
|
NtKernelUnloadedModuleInfo::Initialize(ThreadInfo* Thread)
|
|
{
|
|
// Make sure that the kernel dump size doesn't exceed
|
|
// the generic size limit.
|
|
C_ASSERT((MAX_UNLOADED_NAME_LENGTH / sizeof(WCHAR)) + 1 <=
|
|
MAX_INFO_UNLOADED_NAME);
|
|
|
|
InitSource(Thread);
|
|
|
|
if (m_Target->m_KdDebuggerData.MmUnloadedDrivers == 0 ||
|
|
m_Target->m_KdDebuggerData.MmLastUnloadedDriver == 0)
|
|
{
|
|
return E_FAIL;
|
|
}
|
|
|
|
// If this is the initial module load we need to be
|
|
// careful because much of the system isn't initialized
|
|
// yet. Some versions of the OS can crash when scanning
|
|
// the unloaded module list, plus at this point we can
|
|
// safely assume there are no unloaded modules, so just
|
|
// don't enumerate anything.
|
|
if (g_EngStatus & ENG_STATUS_AT_INITIAL_MODULE_LOAD)
|
|
{
|
|
return E_FAIL;
|
|
}
|
|
|
|
HRESULT Status;
|
|
ULONG Read;
|
|
|
|
if ((Status = m_Target->ReadPointer(m_Process, m_Machine,
|
|
m_Target->
|
|
m_KdDebuggerData.MmUnloadedDrivers,
|
|
&m_Base)) != S_OK ||
|
|
(Status = m_Target->ReadVirtual(m_Process, m_Target->
|
|
m_KdDebuggerData.MmLastUnloadedDriver,
|
|
&m_Index, sizeof(m_Index),
|
|
&Read)) != S_OK)
|
|
{
|
|
return Status;
|
|
}
|
|
if (Read != sizeof(m_Index))
|
|
{
|
|
return HRESULT_FROM_WIN32(ERROR_READ_FAULT);
|
|
}
|
|
|
|
m_Count = 0;
|
|
return S_OK;
|
|
}
|
|
|
|
HRESULT
|
|
NtKernelUnloadedModuleInfo::GetEntry(PSTR Name,
|
|
PDEBUG_MODULE_PARAMETERS Params)
|
|
{
|
|
if (m_Count == MI_UNLOADED_DRIVERS)
|
|
{
|
|
return S_FALSE;
|
|
}
|
|
|
|
if (m_Index == 0)
|
|
{
|
|
m_Index = MI_UNLOADED_DRIVERS - 1;
|
|
}
|
|
else
|
|
{
|
|
m_Index--;
|
|
}
|
|
|
|
ULONG64 Offset;
|
|
ULONG Read;
|
|
HRESULT Status;
|
|
ULONG64 WideName;
|
|
ULONG NameLen;
|
|
|
|
ZeroMemory(Params, sizeof(*Params));
|
|
Params->Flags |= DEBUG_MODULE_UNLOADED;
|
|
|
|
if (m_Target->m_Machine->m_Ptr64)
|
|
{
|
|
UNLOADED_DRIVERS64 Entry;
|
|
|
|
Offset = m_Base + m_Index * sizeof(Entry);
|
|
if ((Status = m_Target->
|
|
ReadAllVirtual(m_Process, Offset, &Entry, sizeof(Entry))) != S_OK)
|
|
{
|
|
return Status;
|
|
}
|
|
|
|
if (Entry.Name.Buffer == 0)
|
|
{
|
|
m_Count = MI_UNLOADED_DRIVERS;
|
|
return S_FALSE;
|
|
}
|
|
|
|
Params->Base = Entry.StartAddress;
|
|
Params->Size = (ULONG)(Entry.EndAddress - Entry.StartAddress);
|
|
Params->TimeDateStamp =
|
|
FileTimeToTimeDateStamp(Entry.CurrentTime.QuadPart);
|
|
WideName = Entry.Name.Buffer;
|
|
NameLen = Entry.Name.Length;
|
|
}
|
|
else
|
|
{
|
|
UNLOADED_DRIVERS32 Entry;
|
|
|
|
Offset = m_Base + m_Index * sizeof(Entry);
|
|
if ((Status = m_Target->
|
|
ReadAllVirtual(m_Process, Offset, &Entry, sizeof(Entry))) != S_OK)
|
|
{
|
|
return Status;
|
|
}
|
|
|
|
if (Entry.Name.Buffer == 0)
|
|
{
|
|
m_Count = MI_UNLOADED_DRIVERS;
|
|
return S_FALSE;
|
|
}
|
|
|
|
Params->Base = EXTEND64(Entry.StartAddress);
|
|
Params->Size = Entry.EndAddress - Entry.StartAddress;
|
|
Params->TimeDateStamp =
|
|
FileTimeToTimeDateStamp(Entry.CurrentTime.QuadPart);
|
|
WideName = EXTEND64(Entry.Name.Buffer);
|
|
NameLen = Entry.Name.Length;
|
|
}
|
|
|
|
if (Name != NULL)
|
|
{
|
|
//
|
|
// This size restriction is in force for minidumps only.
|
|
// For kernel dumps, just truncate the name for now ...
|
|
//
|
|
|
|
if (NameLen > MAX_UNLOADED_NAME_LENGTH)
|
|
{
|
|
NameLen = MAX_UNLOADED_NAME_LENGTH;
|
|
}
|
|
|
|
WCHAR WideBuf[MAX_UNLOADED_NAME_LENGTH / sizeof(WCHAR) + 1];
|
|
|
|
if ((Status = m_Target->
|
|
ReadVirtual(m_Process, WideName, WideBuf, NameLen,
|
|
&Read)) != S_OK)
|
|
{
|
|
return Status;
|
|
}
|
|
|
|
WideBuf[NameLen / sizeof(WCHAR)] = 0;
|
|
if (WideCharToMultiByte(CP_ACP, 0,
|
|
WideBuf, NameLen / sizeof(WCHAR) + 1,
|
|
Name,
|
|
MAX_UNLOADED_NAME_LENGTH / sizeof(WCHAR) + 1,
|
|
NULL, NULL) == 0)
|
|
{
|
|
return WIN32_LAST_STATUS();
|
|
}
|
|
|
|
Name[MAX_UNLOADED_NAME_LENGTH / sizeof(WCHAR)] = 0;
|
|
}
|
|
|
|
m_Count++;
|
|
return S_OK;
|
|
}
|
|
|
|
NtKernelUnloadedModuleInfo g_NtKernelUnloadedModuleIterator;
|
|
|
|
HRESULT
|
|
NtUserUnloadedModuleInfo::Initialize(ThreadInfo* Thread)
|
|
{
|
|
HRESULT Status;
|
|
|
|
InitSource(Thread);
|
|
|
|
if ((Status = m_Target->
|
|
GetUnloadedModuleListHead(m_Process, &m_Base)) != S_OK)
|
|
{
|
|
return Status;
|
|
}
|
|
|
|
m_Index = 0;
|
|
return S_OK;
|
|
}
|
|
|
|
HRESULT
|
|
NtUserUnloadedModuleInfo::GetEntry(PSTR Name,
|
|
PDEBUG_MODULE_PARAMETERS Params)
|
|
{
|
|
if (m_Index >= RTL_UNLOAD_EVENT_TRACE_NUMBER)
|
|
{
|
|
return S_FALSE;
|
|
}
|
|
|
|
ULONG64 Offset;
|
|
HRESULT Status;
|
|
PWSTR NameArray;
|
|
RTL_UNLOAD_EVENT_TRACE32 Entry32;
|
|
RTL_UNLOAD_EVENT_TRACE64 Entry64;
|
|
|
|
// Make sure that the RTL record size doesn't exceed
|
|
// the generic size limit.
|
|
C_ASSERT(DIMA(Entry32.ImageName) <= MAX_INFO_UNLOADED_NAME);
|
|
|
|
ZeroMemory(Params, sizeof(*Params));
|
|
Params->Flags |= DEBUG_MODULE_UNLOADED | DEBUG_MODULE_USER_MODE;
|
|
|
|
if (m_Machine->m_Ptr64)
|
|
{
|
|
Offset = m_Base + m_Index * sizeof(Entry64);
|
|
if ((Status = m_Target->
|
|
ReadAllVirtual(m_Process, Offset,
|
|
&Entry64, sizeof(Entry64))) != S_OK)
|
|
{
|
|
return Status;
|
|
}
|
|
|
|
if (Entry64.BaseAddress == 0)
|
|
{
|
|
m_Index = RTL_UNLOAD_EVENT_TRACE_NUMBER;
|
|
return S_FALSE;
|
|
}
|
|
|
|
Params->Base = Entry64.BaseAddress;
|
|
Params->Size = (ULONG)Entry64.SizeOfImage;
|
|
Params->TimeDateStamp = Entry64.TimeDateStamp;
|
|
Params->Checksum = Entry64.CheckSum;
|
|
NameArray = Entry64.ImageName;
|
|
}
|
|
else
|
|
{
|
|
Offset = m_Base + m_Index * sizeof(Entry32);
|
|
if ((Status = m_Target->
|
|
ReadAllVirtual(m_Process, Offset,
|
|
&Entry32, sizeof(Entry32))) != S_OK)
|
|
{
|
|
return Status;
|
|
}
|
|
|
|
if (Entry32.BaseAddress == 0)
|
|
{
|
|
m_Index = RTL_UNLOAD_EVENT_TRACE_NUMBER;
|
|
return S_FALSE;
|
|
}
|
|
|
|
Params->Base = EXTEND64(Entry32.BaseAddress);
|
|
Params->Size = (ULONG)Entry32.SizeOfImage;
|
|
Params->TimeDateStamp = Entry32.TimeDateStamp;
|
|
Params->Checksum = Entry32.CheckSum;
|
|
NameArray = Entry32.ImageName;
|
|
}
|
|
|
|
if (Name != NULL)
|
|
{
|
|
NameArray[DIMA(Entry32.ImageName) - 1] = 0;
|
|
if (WideCharToMultiByte(CP_ACP, 0,
|
|
NameArray, -1,
|
|
Name,
|
|
MAX_INFO_UNLOADED_NAME,
|
|
NULL, NULL) == 0)
|
|
{
|
|
return WIN32_LAST_STATUS();
|
|
}
|
|
|
|
Name[MAX_INFO_UNLOADED_NAME - 1] = 0;
|
|
}
|
|
|
|
m_Index++;
|
|
return S_OK;
|
|
}
|
|
|
|
NtUserUnloadedModuleInfo g_NtUserUnloadedModuleIterator;
|
|
|
|
HRESULT
|
|
ToolHelpModuleInfo::Initialize(ThreadInfo* Thread)
|
|
{
|
|
InitSource(Thread);
|
|
|
|
m_Snap = g_Kernel32Calls.
|
|
CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,
|
|
m_Process->m_SystemId);
|
|
if (m_Snap == INVALID_HANDLE_VALUE)
|
|
{
|
|
m_Snap = NULL;
|
|
ErrOut("Can't create snapshot\n");
|
|
return WIN32_LAST_STATUS();
|
|
}
|
|
|
|
m_First = TRUE;
|
|
m_LastId = 0;
|
|
return S_OK;
|
|
}
|
|
|
|
HRESULT
|
|
ToolHelpModuleInfo::GetEntry(PMODULE_INFO_ENTRY Entry)
|
|
{
|
|
if (m_Snap == NULL)
|
|
{
|
|
return S_FALSE;
|
|
}
|
|
|
|
BOOL Succ;
|
|
MODULEENTRY32 Mod;
|
|
|
|
Mod.dwSize = sizeof(Mod);
|
|
if (m_First)
|
|
{
|
|
Succ = g_Kernel32Calls.Module32First(m_Snap, &Mod);
|
|
m_First = FALSE;
|
|
}
|
|
else
|
|
{
|
|
// Win9x seems to require that this module ID be saved
|
|
// between calls so stick it back in to keep Win9x happy.
|
|
Mod.th32ModuleID = m_LastId;
|
|
Succ = g_Kernel32Calls.Module32Next(m_Snap, &Mod);
|
|
}
|
|
if (!Succ)
|
|
{
|
|
CloseHandle(m_Snap);
|
|
m_Snap = NULL;
|
|
return S_FALSE;
|
|
}
|
|
|
|
m_LastId = Mod.th32ModuleID;
|
|
CopyString(Entry->Buffer, Mod.szModule, DIMA(Entry->Buffer));
|
|
Entry->NamePtr = Entry->Buffer;
|
|
Entry->UnicodeNamePtr = 0;
|
|
Entry->NameLength = strlen(Entry->NamePtr);
|
|
Entry->Base = EXTEND64((ULONG_PTR)Mod.modBaseAddr);
|
|
Entry->Size = Mod.modBaseSize;
|
|
// Toolhelp only enumerates user-mode modules.
|
|
Entry->UserMode = TRUE;
|
|
|
|
//
|
|
// Update the image informaion, such as timestamp and real image size,
|
|
// Directly from the image header
|
|
//
|
|
|
|
ReadImageHeaderInfo(Entry);
|
|
|
|
return S_OK;
|
|
}
|
|
|
|
ToolHelpModuleInfo g_ToolHelpModuleIterator;
|
|
|
|
//----------------------------------------------------------------------------
|
|
//
|
|
// Functions.
|
|
//
|
|
//----------------------------------------------------------------------------
|
|
|
|
BOOL
|
|
GetUserModuleListAddress(
|
|
ThreadInfo* Thread,
|
|
MachineInfo* Machine,
|
|
ULONG64 Peb,
|
|
BOOL Quiet,
|
|
PULONG64 OrderModuleListStart,
|
|
PULONG64 FirstEntry
|
|
)
|
|
{
|
|
ULONG64 PebLdrOffset;
|
|
ULONG64 ModuleListOffset;
|
|
ULONG64 PebLdr = 0;
|
|
|
|
*OrderModuleListStart = 0;
|
|
*FirstEntry = 0;
|
|
|
|
if (!Thread || !Machine)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// Triage dumps have no user mode information.
|
|
// User-mode minidumps don't have a loader list.
|
|
//
|
|
|
|
if (IS_KERNEL_TRIAGE_DUMP(Machine->m_Target) ||
|
|
IS_USER_MINI_DUMP(Machine->m_Target))
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
if (Machine->m_Ptr64)
|
|
{
|
|
PebLdrOffset = PEBLDR_FROM_PEB64;
|
|
ModuleListOffset = MODULE_LIST_FROM_PEBLDR64;
|
|
}
|
|
else
|
|
{
|
|
PebLdrOffset = PEBLDR_FROM_PEB32;
|
|
ModuleListOffset = MODULE_LIST_FROM_PEBLDR32;
|
|
}
|
|
|
|
if (!Peb)
|
|
{
|
|
if (Thread->m_Process->m_Target->
|
|
GetImplicitProcessDataPeb(Thread, &Peb) != S_OK)
|
|
{
|
|
if (!Quiet)
|
|
{
|
|
ErrOut("Unable to get PEB pointer\n");
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
if (!Peb)
|
|
{
|
|
// This is a common error as the idle and system process has no
|
|
// user address space. So only print the error if we really
|
|
// expected to find a user mode address space:
|
|
// The Idle and system process have a NULL parent client id - all
|
|
// other threads have a valid ID.
|
|
//
|
|
|
|
ULONG64 Pcid;
|
|
|
|
if ((Thread->m_Process->m_Target->
|
|
GetImplicitProcessDataParentCID(Thread, &Pcid) != S_OK) ||
|
|
Pcid)
|
|
{
|
|
if (!Quiet)
|
|
{
|
|
ErrOut("PEB address is NULL !\n");
|
|
}
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Read address the PEB Ldr data from the PEB structure
|
|
//
|
|
|
|
Peb += PebLdrOffset;
|
|
|
|
if ( (Machine->m_Target->
|
|
ReadPointer(Thread->m_Process, Machine, Peb, &PebLdr) != S_OK) ||
|
|
(PebLdr == 0) )
|
|
{
|
|
if (!Quiet)
|
|
{
|
|
ErrOut("PEB is paged out (Peb = %s). "
|
|
"Type \".hh dbgerr001\" for details\n",
|
|
FormatMachineAddr64(Machine, Peb));
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// Read address of the user mode module list from the PEB Ldr Data.
|
|
//
|
|
|
|
PebLdr += ModuleListOffset;
|
|
*OrderModuleListStart = PebLdr;
|
|
|
|
if ( (Machine->m_Target->
|
|
ReadPointer(Thread->m_Process, Machine,
|
|
PebLdr, FirstEntry) != S_OK) ||
|
|
(*FirstEntry == 0) )
|
|
{
|
|
if (!Quiet)
|
|
{
|
|
ErrOut("UserMode Module List Address is NULL (Addr= %s)\n",
|
|
FormatMachineAddr64(Machine, PebLdr));
|
|
ErrOut("This is usually caused by being in the wrong process\n");
|
|
ErrOut("context or by paging\n");
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
BOOL
|
|
GetModNameFromLoaderList(
|
|
ThreadInfo* Thread,
|
|
MachineInfo* Machine,
|
|
ULONG64 Peb,
|
|
ULONG64 ModuleBase,
|
|
PSTR NameBuffer,
|
|
ULONG BufferSize,
|
|
BOOL FullPath
|
|
)
|
|
{
|
|
ULONG64 ModList;
|
|
ULONG64 List;
|
|
HRESULT Status;
|
|
KLDR_DATA_TABLE_ENTRY64 Entry;
|
|
WCHAR UnicodeBuffer[MAX_IMAGE_PATH];
|
|
ULONG Read;
|
|
|
|
if (!GetUserModuleListAddress(Thread, Machine, Peb, TRUE,
|
|
&ModList, &List))
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
while (List != ModList)
|
|
{
|
|
Status = Machine->m_Target->
|
|
ReadLoaderEntry(Thread->m_Process, Machine, List, &Entry);
|
|
if (Status != S_OK)
|
|
{
|
|
ErrOut("Unable to read LDR_DATA_TABLE_ENTRY at %s - %s\n",
|
|
FormatMachineAddr64(Machine, List),
|
|
FormatStatusCode(Status));
|
|
return FALSE;
|
|
}
|
|
|
|
List = Entry.InLoadOrderLinks.Flink;
|
|
|
|
if (Entry.DllBase == ModuleBase)
|
|
{
|
|
UNICODE_STRING64 Name;
|
|
|
|
//
|
|
// We found a matching entry. Try to get the name.
|
|
//
|
|
if (FullPath)
|
|
{
|
|
Name = Entry.FullDllName;
|
|
}
|
|
else
|
|
{
|
|
Name = Entry.BaseDllName;
|
|
}
|
|
if (Name.Length == 0 ||
|
|
Name.Buffer == 0 ||
|
|
Name.Length >= sizeof(UnicodeBuffer) - sizeof(WCHAR))
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
Status = Machine->m_Target->
|
|
ReadVirtual(Thread->m_Process, Name.Buffer, UnicodeBuffer,
|
|
Name.Length, &Read);
|
|
if (Status != S_OK || Read < Name.Length)
|
|
{
|
|
ErrOut("Unable to read name string at %s - %s\n",
|
|
FormatMachineAddr64(Machine, Name.Buffer),
|
|
FormatStatusCode(Status));
|
|
return FALSE;
|
|
}
|
|
|
|
UnicodeBuffer[Name.Length / sizeof(WCHAR)] = UNICODE_NULL;
|
|
|
|
if (!WideCharToMultiByte(CP_ACP, 0, UnicodeBuffer,
|
|
Name.Length / sizeof(WCHAR) + 1,
|
|
NameBuffer, BufferSize,
|
|
NULL, NULL))
|
|
{
|
|
ErrOut("Unable to convert Unicode string %ls to ANSI\n",
|
|
UnicodeBuffer);
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
}
|
|
|
|
return FALSE;
|
|
}
|