1784 lines
44 KiB
C
1784 lines
44 KiB
C
/*++
|
|
|
|
Copyright (c) 1992-1999 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
wdbgexts.h
|
|
|
|
Abstract:
|
|
|
|
This file contains the necessary prototypes and data types for a user
|
|
to write a debugger extension DLL. This header file is also included
|
|
by the NT debuggers (WINDBG & KD).
|
|
|
|
This header file must be included after "windows.h" and "dbghelp.h".
|
|
|
|
Please see the NT DDK documentation for specific information about
|
|
how to write your own debugger extension DLL.
|
|
|
|
Environment:
|
|
|
|
Win32 only.
|
|
|
|
Revision History:
|
|
|
|
--*/
|
|
|
|
#ifndef _WDBGEXTS_
|
|
#pragma option push -b -a8 -pc -A- /*P_O_Push*/
|
|
#define _WDBGEXTS_
|
|
|
|
#if _MSC_VER > 1000
|
|
#pragma once
|
|
#endif
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
#if !defined(WDBGAPI)
|
|
#define WDBGAPI __stdcall
|
|
#endif
|
|
|
|
#if !defined(WDBGAPIV)
|
|
#define WDBGAPIV __cdecl
|
|
#endif
|
|
|
|
#ifndef _WINDEF_
|
|
typedef CONST void *LPCVOID;
|
|
#endif
|
|
|
|
#ifndef _ULONGLONG_
|
|
typedef unsigned __int64 ULONGLONG;
|
|
typedef ULONGLONG *PULONGLONG;
|
|
#endif
|
|
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPIV*PWINDBG_OUTPUT_ROUTINE)(
|
|
PCSTR lpFormat,
|
|
...
|
|
);
|
|
|
|
typedef
|
|
ULONG_PTR
|
|
(WDBGAPI*PWINDBG_GET_EXPRESSION)(
|
|
PCSTR lpExpression
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_GET_EXPRESSION32)(
|
|
PCSTR lpExpression
|
|
);
|
|
|
|
typedef
|
|
ULONG64
|
|
(WDBGAPI*PWINDBG_GET_EXPRESSION64)(
|
|
PCSTR lpExpression
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_GET_SYMBOL)(
|
|
PVOID offset,
|
|
PUCHAR pchBuffer,
|
|
ULONG_PTR *pDisplacement
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_GET_SYMBOL32)(
|
|
ULONG offset,
|
|
PUCHAR pchBuffer,
|
|
PULONG pDisplacement
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_GET_SYMBOL64)(
|
|
ULONG64 offset,
|
|
PUCHAR pchBuffer,
|
|
PULONG64 pDisplacement
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_DISASM)(
|
|
ULONG_PTR *lpOffset,
|
|
PCSTR lpBuffer,
|
|
ULONG fShowEffectiveAddress
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_DISASM32)(
|
|
ULONG *lpOffset,
|
|
PCSTR lpBuffer,
|
|
ULONG fShowEffectiveAddress
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_DISASM64)(
|
|
ULONG64 *lpOffset,
|
|
PCSTR lpBuffer,
|
|
ULONG fShowEffectiveAddress
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_CHECK_CONTROL_C)(
|
|
VOID
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE)(
|
|
ULONG_PTR offset,
|
|
PVOID lpBuffer,
|
|
ULONG cb,
|
|
PULONG lpcbBytesRead
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE32)(
|
|
ULONG offset,
|
|
PVOID lpBuffer,
|
|
ULONG cb,
|
|
PULONG lpcbBytesRead
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE64)(
|
|
ULONG64 offset,
|
|
PVOID lpBuffer,
|
|
ULONG cb,
|
|
PULONG lpcbBytesRead
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE)(
|
|
ULONG_PTR offset,
|
|
LPCVOID lpBuffer,
|
|
ULONG cb,
|
|
PULONG lpcbBytesWritten
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32)(
|
|
ULONG offset,
|
|
LPCVOID lpBuffer,
|
|
ULONG cb,
|
|
PULONG lpcbBytesWritten
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE64)(
|
|
ULONG64 offset,
|
|
LPCVOID lpBuffer,
|
|
ULONG cb,
|
|
PULONG lpcbBytesWritten
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_GET_THREAD_CONTEXT_ROUTINE)(
|
|
ULONG Processor,
|
|
PCONTEXT lpContext,
|
|
ULONG cbSizeOfContext
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_SET_THREAD_CONTEXT_ROUTINE)(
|
|
ULONG Processor,
|
|
PCONTEXT lpContext,
|
|
ULONG cbSizeOfContext
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_IOCTL_ROUTINE)(
|
|
USHORT IoctlType,
|
|
PVOID lpvData,
|
|
ULONG cbSize
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_OLDKD_READ_PHYSICAL_MEMORY)(
|
|
ULONGLONG address,
|
|
PVOID buffer,
|
|
ULONG count,
|
|
PULONG bytesread
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_OLDKD_WRITE_PHYSICAL_MEMORY)(
|
|
ULONGLONG address,
|
|
PVOID buffer,
|
|
ULONG length,
|
|
PULONG byteswritten
|
|
);
|
|
|
|
|
|
typedef struct _EXTSTACKTRACE {
|
|
ULONG FramePointer;
|
|
ULONG ProgramCounter;
|
|
ULONG ReturnAddress;
|
|
ULONG Args[4];
|
|
} EXTSTACKTRACE, *PEXTSTACKTRACE;
|
|
|
|
typedef struct _EXTSTACKTRACE32 {
|
|
ULONG FramePointer;
|
|
ULONG ProgramCounter;
|
|
ULONG ReturnAddress;
|
|
ULONG Args[4];
|
|
} EXTSTACKTRACE32, *PEXTSTACKTRACE32;
|
|
|
|
typedef struct _EXTSTACKTRACE64 {
|
|
ULONG64 FramePointer;
|
|
ULONG64 ProgramCounter;
|
|
ULONG64 ReturnAddress;
|
|
ULONG64 Args[4];
|
|
} EXTSTACKTRACE64, *PEXTSTACKTRACE64;
|
|
|
|
|
|
typedef
|
|
ULONG
|
|
(*PWINDBG_STACKTRACE_ROUTINE)(
|
|
ULONG FramePointer,
|
|
ULONG StackPointer,
|
|
ULONG ProgramCounter,
|
|
PEXTSTACKTRACE StackFrames,
|
|
ULONG Frames
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(*PWINDBG_STACKTRACE_ROUTINE32)(
|
|
ULONG FramePointer,
|
|
ULONG StackPointer,
|
|
ULONG ProgramCounter,
|
|
PEXTSTACKTRACE32 StackFrames,
|
|
ULONG Frames
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(*PWINDBG_STACKTRACE_ROUTINE64)(
|
|
ULONG64 FramePointer,
|
|
ULONG64 StackPointer,
|
|
ULONG64 ProgramCounter,
|
|
PEXTSTACKTRACE64 StackFrames,
|
|
ULONG Frames
|
|
);
|
|
|
|
typedef struct _WINDBG_EXTENSION_APIS {
|
|
ULONG nSize;
|
|
PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
|
|
PWINDBG_GET_EXPRESSION lpGetExpressionRoutine;
|
|
PWINDBG_GET_SYMBOL lpGetSymbolRoutine;
|
|
PWINDBG_DISASM lpDisasmRoutine;
|
|
PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
|
|
PWINDBG_READ_PROCESS_MEMORY_ROUTINE lpReadProcessMemoryRoutine;
|
|
PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE lpWriteProcessMemoryRoutine;
|
|
PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;
|
|
PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;
|
|
PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;
|
|
PWINDBG_STACKTRACE_ROUTINE lpStackTraceRoutine;
|
|
} WINDBG_EXTENSION_APIS, *PWINDBG_EXTENSION_APIS;
|
|
|
|
typedef struct _WINDBG_EXTENSION_APIS32 {
|
|
ULONG nSize;
|
|
PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
|
|
PWINDBG_GET_EXPRESSION32 lpGetExpressionRoutine;
|
|
PWINDBG_GET_SYMBOL32 lpGetSymbolRoutine;
|
|
PWINDBG_DISASM32 lpDisasmRoutine;
|
|
PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
|
|
PWINDBG_READ_PROCESS_MEMORY_ROUTINE32 lpReadProcessMemoryRoutine;
|
|
PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32 lpWriteProcessMemoryRoutine;
|
|
PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;
|
|
PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;
|
|
PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;
|
|
PWINDBG_STACKTRACE_ROUTINE32 lpStackTraceRoutine;
|
|
} WINDBG_EXTENSION_APIS32, *PWINDBG_EXTENSION_APIS32;
|
|
|
|
typedef struct _WINDBG_EXTENSION_APIS64 {
|
|
ULONG nSize;
|
|
PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
|
|
PWINDBG_GET_EXPRESSION64 lpGetExpressionRoutine;
|
|
PWINDBG_GET_SYMBOL64 lpGetSymbolRoutine;
|
|
PWINDBG_DISASM64 lpDisasmRoutine;
|
|
PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
|
|
PWINDBG_READ_PROCESS_MEMORY_ROUTINE64 lpReadProcessMemoryRoutine;
|
|
PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE64 lpWriteProcessMemoryRoutine;
|
|
PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;
|
|
PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;
|
|
PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;
|
|
PWINDBG_STACKTRACE_ROUTINE64 lpStackTraceRoutine;
|
|
} WINDBG_EXTENSION_APIS64, *PWINDBG_EXTENSION_APIS64;
|
|
|
|
|
|
typedef struct _WINDBG_OLD_EXTENSION_APIS {
|
|
ULONG nSize;
|
|
PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
|
|
PWINDBG_GET_EXPRESSION lpGetExpressionRoutine;
|
|
PWINDBG_GET_SYMBOL lpGetSymbolRoutine;
|
|
PWINDBG_DISASM lpDisasmRoutine;
|
|
PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
|
|
} WINDBG_OLD_EXTENSION_APIS, *PWINDBG_OLD_EXTENSION_APIS;
|
|
|
|
typedef struct _WINDBG_OLDKD_EXTENSION_APIS {
|
|
ULONG nSize;
|
|
PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
|
|
PWINDBG_GET_EXPRESSION32 lpGetExpressionRoutine;
|
|
PWINDBG_GET_SYMBOL32 lpGetSymbolRoutine;
|
|
PWINDBG_DISASM32 lpDisasmRoutine;
|
|
PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
|
|
PWINDBG_READ_PROCESS_MEMORY_ROUTINE32 lpReadVirtualMemRoutine;
|
|
PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32 lpWriteVirtualMemRoutine;
|
|
PWINDBG_OLDKD_READ_PHYSICAL_MEMORY lpReadPhysicalMemRoutine;
|
|
PWINDBG_OLDKD_WRITE_PHYSICAL_MEMORY lpWritePhysicalMemRoutine;
|
|
} WINDBG_OLDKD_EXTENSION_APIS, *PWINDBG_OLDKD_EXTENSION_APIS;
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_OLD_EXTENSION_ROUTINE)(
|
|
ULONG dwCurrentPc,
|
|
PWINDBG_EXTENSION_APIS lpExtensionApis,
|
|
PCSTR lpArgumentString
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_EXTENSION_ROUTINE)(
|
|
HANDLE hCurrentProcess,
|
|
HANDLE hCurrentThread,
|
|
ULONG dwCurrentPc,
|
|
ULONG dwProcessor,
|
|
PCSTR lpArgumentString
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_EXTENSION_ROUTINE32)(
|
|
HANDLE hCurrentProcess,
|
|
HANDLE hCurrentThread,
|
|
ULONG dwCurrentPc,
|
|
ULONG dwProcessor,
|
|
PCSTR lpArgumentString
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_EXTENSION_ROUTINE64)(
|
|
HANDLE hCurrentProcess,
|
|
HANDLE hCurrentThread,
|
|
ULONG64 dwCurrentPc,
|
|
ULONG dwProcessor,
|
|
PCSTR lpArgumentString
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_OLDKD_EXTENSION_ROUTINE)(
|
|
ULONG dwCurrentPc,
|
|
PWINDBG_OLDKD_EXTENSION_APIS lpExtensionApis,
|
|
PCSTR lpArgumentString
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_EXTENSION_DLL_INIT)(
|
|
PWINDBG_EXTENSION_APIS lpExtensionApis,
|
|
USHORT MajorVersion,
|
|
USHORT MinorVersion
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_EXTENSION_DLL_INIT32)(
|
|
PWINDBG_EXTENSION_APIS32 lpExtensionApis,
|
|
USHORT MajorVersion,
|
|
USHORT MinorVersion
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(WDBGAPI*PWINDBG_EXTENSION_DLL_INIT64)(
|
|
PWINDBG_EXTENSION_APIS64 lpExtensionApis,
|
|
USHORT MajorVersion,
|
|
USHORT MinorVersion
|
|
);
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PWINDBG_CHECK_VERSION)(
|
|
VOID
|
|
);
|
|
|
|
#define EXT_API_VERSION_NUMBER 5
|
|
#define EXT_API_VERSION_NUMBER32 5
|
|
#define EXT_API_VERSION_NUMBER64 6
|
|
|
|
typedef struct EXT_API_VERSION {
|
|
USHORT MajorVersion;
|
|
USHORT MinorVersion;
|
|
USHORT Revision;
|
|
USHORT Reserved;
|
|
} EXT_API_VERSION, *LPEXT_API_VERSION;
|
|
|
|
typedef
|
|
LPEXT_API_VERSION
|
|
(WDBGAPI*PWINDBG_EXTENSION_API_VERSION)(
|
|
VOID
|
|
);
|
|
|
|
#define IG_KD_CONTEXT 1
|
|
#define IG_READ_CONTROL_SPACE 2
|
|
#define IG_WRITE_CONTROL_SPACE 3
|
|
#define IG_READ_IO_SPACE 4
|
|
#define IG_WRITE_IO_SPACE 5
|
|
#define IG_READ_PHYSICAL 6
|
|
#define IG_WRITE_PHYSICAL 7
|
|
#define IG_READ_IO_SPACE_EX 8
|
|
#define IG_WRITE_IO_SPACE_EX 9
|
|
#define IG_KSTACK_HELP 10 // obsolete
|
|
#define IG_SET_THREAD 11
|
|
#define IG_READ_MSR 12
|
|
#define IG_WRITE_MSR 13
|
|
#define IG_GET_DEBUGGER_DATA 14
|
|
#define IG_GET_KERNEL_VERSION 15
|
|
#define IG_RELOAD_SYMBOLS 16
|
|
#define IG_GET_SET_SYMPATH 17
|
|
#define IG_GET_EXCEPTION_RECORD 18
|
|
#define IG_IS_PTR64 19
|
|
#define IG_GET_BUS_DATA 20
|
|
#define IG_SET_BUS_DATA 21
|
|
#define IG_DUMP_SYMBOL_INFO 22
|
|
#define IG_LOWMEM_CHECK 23
|
|
#define IG_SEARCH_MEMORY 24
|
|
|
|
//
|
|
// usermode only ioctls
|
|
//
|
|
#define IG_GET_TEB_ADDRESS 128
|
|
|
|
typedef struct _PROCESSORINFO {
|
|
USHORT Processor; // current processor
|
|
USHORT NumberProcessors; // total number of processors
|
|
} PROCESSORINFO, *PPROCESSORINFO;
|
|
|
|
typedef struct _READCONTROLSPACE {
|
|
USHORT Processor;
|
|
ULONG Address;
|
|
ULONG BufLen;
|
|
UCHAR Buf[1];
|
|
} READCONTROLSPACE, *PREADCONTROLSPACE;
|
|
|
|
typedef struct _READCONTROLSPACE32 {
|
|
USHORT Processor;
|
|
ULONG Address;
|
|
ULONG BufLen;
|
|
UCHAR Buf[1];
|
|
} READCONTROLSPACE32, *PREADCONTROLSPACE32;
|
|
|
|
typedef struct _READCONTROLSPACE64 {
|
|
USHORT Processor;
|
|
ULONG64 Address;
|
|
ULONG BufLen;
|
|
UCHAR Buf[1];
|
|
} READCONTROLSPACE64, *PREADCONTROLSPACE64;
|
|
|
|
typedef struct _IOSPACE {
|
|
ULONG Address;
|
|
ULONG Length; // 1, 2, or 4 bytes
|
|
ULONG Data;
|
|
} IOSPACE, *PIOSPACE;
|
|
|
|
typedef struct _IOSPACE32 {
|
|
ULONG Address;
|
|
ULONG Length; // 1, 2, or 4 bytes
|
|
ULONG Data;
|
|
} IOSPACE32, *PIOSPACE32;
|
|
|
|
typedef struct _IOSPACE64 {
|
|
ULONG64 Address;
|
|
ULONG Length; // 1, 2, or 4 bytes
|
|
ULONG Data;
|
|
} IOSPACE64, *PIOSPACE64;
|
|
|
|
typedef struct _IOSPACE_EX {
|
|
ULONG Address;
|
|
ULONG Length; // 1, 2, or 4 bytes
|
|
ULONG Data;
|
|
ULONG InterfaceType;
|
|
ULONG BusNumber;
|
|
ULONG AddressSpace;
|
|
} IOSPACE_EX, *PIOSPACE_EX;
|
|
|
|
typedef struct _IOSPACE_EX32 {
|
|
ULONG Address;
|
|
ULONG Length; // 1, 2, or 4 bytes
|
|
ULONG Data;
|
|
ULONG InterfaceType;
|
|
ULONG BusNumber;
|
|
ULONG AddressSpace;
|
|
} IOSPACE_EX32, *PIOSPACE_EX32;
|
|
|
|
typedef struct _IOSPACE_EX64 {
|
|
ULONG64 Address;
|
|
ULONG Length; // 1, 2, or 4 bytes
|
|
ULONG Data;
|
|
ULONG InterfaceType;
|
|
ULONG BusNumber;
|
|
ULONG AddressSpace;
|
|
} IOSPACE_EX64, *PIOSPACE_EX64;
|
|
|
|
typedef struct _GETSETBUSDATA {
|
|
ULONG BusDataType;
|
|
ULONG BusNumber;
|
|
ULONG SlotNumber;
|
|
PVOID Buffer;
|
|
ULONG Offset;
|
|
ULONG Length;
|
|
} BUSDATA, *PBUSDATA;
|
|
|
|
typedef struct _SEARCHMEMORY {
|
|
ULONG64 SearchAddress;
|
|
ULONG64 SearchLength;
|
|
ULONG64 FoundAddress;
|
|
ULONG PatternLength;
|
|
PVOID Pattern;
|
|
} SEARCHMEMORY, *PSEARCHMEMORY;
|
|
|
|
typedef struct _PHYSICAL {
|
|
ULONGLONG Address;
|
|
ULONG BufLen;
|
|
UCHAR Buf[1];
|
|
} PHYSICAL, *PPHYSICAL;
|
|
|
|
typedef struct _READ_WRITE_MSR {
|
|
ULONG Msr;
|
|
LONGLONG Value;
|
|
} READ_WRITE_MSR, *PREAD_WRITE_MSR;
|
|
|
|
typedef struct _GET_SET_SYMPATH {
|
|
PCSTR Args; // args to !reload command
|
|
PSTR Result; // returns new path
|
|
int Length; // Length of result buffer
|
|
} GET_SET_SYMPATH, *PGET_SET_SYMPATH;
|
|
|
|
typedef struct _GET_TEB_ADDRESS {
|
|
ULONGLONG Address;
|
|
} GET_TEB_ADDRESS, *PGET_TEB_ADDRESS;
|
|
|
|
|
|
#ifndef DBGKD_GET_VERSION_DEFINED
|
|
#define DBGKD_GET_VERSION_DEFINED
|
|
//
|
|
// The following structures have changed in more than pointer size.
|
|
//
|
|
//
|
|
// This is the version packet for pre-NT5 Beta 2 systems.
|
|
// For now, it is also still used on x86
|
|
//
|
|
typedef struct _DBGKD_GET_VERSION32 {
|
|
USHORT MajorVersion;
|
|
USHORT MinorVersion;
|
|
USHORT ProtocolVersion;
|
|
USHORT Flags;
|
|
ULONG KernBase;
|
|
ULONG PsLoadedModuleList;
|
|
|
|
USHORT MachineType;
|
|
|
|
//
|
|
// help for walking stacks with user callbacks:
|
|
//
|
|
|
|
//
|
|
// The address of the thread structure is provided in the
|
|
// WAIT_STATE_CHANGE packet. This is the offset from the base of
|
|
// the thread structure to the pointer to the kernel stack frame
|
|
// for the currently active usermode callback.
|
|
//
|
|
|
|
USHORT ThCallbackStack; // offset in thread data
|
|
|
|
//
|
|
// these values are offsets into that frame:
|
|
//
|
|
|
|
USHORT NextCallback; // saved pointer to next callback frame
|
|
USHORT FramePointer; // saved frame pointer
|
|
|
|
//
|
|
// Address of the kernel callout routine.
|
|
//
|
|
|
|
ULONG KiCallUserMode; // kernel routine
|
|
|
|
//
|
|
// Address of the usermode entry point for callbacks.
|
|
//
|
|
|
|
ULONG KeUserCallbackDispatcher; // address in ntdll
|
|
|
|
//
|
|
// DbgBreakPointWithStatus is a function which takes a ULONG argument
|
|
// and hits a breakpoint. This field contains the address of the
|
|
// breakpoint instruction. When the debugger sees a breakpoint
|
|
// at this address, it may retrieve the argument from the first
|
|
// argument register, or on x86 the eax register.
|
|
//
|
|
|
|
ULONG BreakpointWithStatus; // address of breakpoint
|
|
|
|
//
|
|
// Components may register a debug data block for use by
|
|
// debugger extensions. This is the address of the list head.
|
|
//
|
|
|
|
ULONG DebuggerDataList;
|
|
|
|
} DBGKD_GET_VERSION32, *PDBGKD_GET_VERSION32;
|
|
|
|
|
|
|
|
typedef struct _DBGKD_GET_VERSION64 {
|
|
USHORT MajorVersion;
|
|
USHORT MinorVersion;
|
|
USHORT ProtocolVersion;
|
|
USHORT Flags;
|
|
USHORT MachineType;
|
|
|
|
USHORT Unused[3];
|
|
|
|
ULONG64 KernBase;
|
|
ULONG64 PsLoadedModuleList;
|
|
|
|
//
|
|
// Components may register a debug data block for use by
|
|
// debugger extensions. This is the address of the list head.
|
|
//
|
|
// There will always be an entry for the debugger.
|
|
//
|
|
|
|
ULONG64 DebuggerDataList;
|
|
|
|
} DBGKD_GET_VERSION64, *PDBGKD_GET_VERSION64;
|
|
|
|
|
|
//
|
|
// If DBGKD_VERS_FLAG_DATA is set in Flags, info should be retrieved from
|
|
// the KDDEBUGGER_DATA block rather than from the DBGKD_GET_VERSION
|
|
// packet. The data will remain in the version packet for a while to
|
|
// reduce compatibility problems.
|
|
//
|
|
|
|
#define DBGKD_VERS_FLAG_MP 0x0001 // kernel is MP built
|
|
#define DBGKD_VERS_FLAG_DATA 0x0002 // DebuggerDataList is valid
|
|
#define DBGKD_VERS_FLAG_PTR64 0x0004 // native pointers are 64 bits
|
|
#define DBGKD_VERS_FLAG_NOMM 0x0008 // No MM - don't decode PTEs
|
|
|
|
#define KDBG_TAG 'GBDK'
|
|
|
|
typedef struct _DBGKD_DEBUG_DATA_HEADER32 {
|
|
|
|
//
|
|
// Link to other blocks
|
|
//
|
|
|
|
LIST_ENTRY32 List;
|
|
|
|
//
|
|
// This is a unique tag to identify the owner of the block.
|
|
// If your component only uses one pool tag, use it for this, too.
|
|
//
|
|
|
|
ULONG OwnerTag;
|
|
|
|
//
|
|
// This must be initialized to the size of the data block,
|
|
// including this structure.
|
|
//
|
|
|
|
ULONG Size;
|
|
|
|
} DBGKD_DEBUG_DATA_HEADER32, *PDBGKD_DEBUG_DATA_HEADER32;
|
|
|
|
|
|
|
|
|
|
//
|
|
// DO NOT CHANGE THIS STRUCTURE!
|
|
// ONLY MAKE CHAGES TO THE 64 BIT VERSION ABOVE!!
|
|
//
|
|
// This is the debugger data packet for pre NT5 Beta 2 systems.
|
|
// For now, it is still used on x86
|
|
//
|
|
typedef struct _KDDEBUGGER_DATA32 {
|
|
|
|
DBGKD_DEBUG_DATA_HEADER32 Header;
|
|
|
|
//
|
|
// Base address of kernel image
|
|
//
|
|
|
|
ULONG KernBase;
|
|
|
|
//
|
|
// DbgBreakPointWithStatus is a function which takes an argument
|
|
// and hits a breakpoint. This field contains the address of the
|
|
// breakpoint instruction. When the debugger sees a breakpoint
|
|
// at this address, it may retrieve the argument from the first
|
|
// argument register, or on x86 the eax register.
|
|
//
|
|
|
|
ULONG BreakpointWithStatus; // address of breakpoint
|
|
|
|
//
|
|
// Address of the saved context record during a bugcheck
|
|
//
|
|
// N.B. This is an automatic in KeBugcheckEx's frame, and
|
|
// is only valid after a bugcheck.
|
|
//
|
|
|
|
ULONG SavedContext;
|
|
|
|
//
|
|
// help for walking stacks with user callbacks:
|
|
//
|
|
|
|
//
|
|
// The address of the thread structure is provided in the
|
|
// WAIT_STATE_CHANGE packet. This is the offset from the base of
|
|
// the thread structure to the pointer to the kernel stack frame
|
|
// for the currently active usermode callback.
|
|
//
|
|
|
|
USHORT ThCallbackStack; // offset in thread data
|
|
|
|
//
|
|
// these values are offsets into that frame:
|
|
//
|
|
|
|
USHORT NextCallback; // saved pointer to next callback frame
|
|
USHORT FramePointer; // saved frame pointer
|
|
|
|
USHORT PaeEnabled:1;
|
|
|
|
//
|
|
// Address of the kernel callout routine.
|
|
//
|
|
|
|
ULONG KiCallUserMode; // kernel routine
|
|
|
|
//
|
|
// Address of the usermode entry point for callbacks.
|
|
//
|
|
|
|
ULONG KeUserCallbackDispatcher; // address in ntdll
|
|
|
|
|
|
//
|
|
// Addresses of various kernel data structures and lists
|
|
// that are of interest to the kernel debugger.
|
|
//
|
|
|
|
ULONG PsLoadedModuleList;
|
|
ULONG PsActiveProcessHead;
|
|
ULONG PspCidTable;
|
|
|
|
ULONG ExpSystemResourcesList;
|
|
ULONG ExpPagedPoolDescriptor;
|
|
ULONG ExpNumberOfPagedPools;
|
|
|
|
ULONG KeTimeIncrement;
|
|
ULONG KeBugCheckCallbackListHead;
|
|
ULONG KiBugcheckData;
|
|
|
|
ULONG IopErrorLogListHead;
|
|
|
|
ULONG ObpRootDirectoryObject;
|
|
ULONG ObpTypeObjectType;
|
|
|
|
ULONG MmSystemCacheStart;
|
|
ULONG MmSystemCacheEnd;
|
|
ULONG MmSystemCacheWs;
|
|
|
|
ULONG MmPfnDatabase;
|
|
ULONG MmSystemPtesStart;
|
|
ULONG MmSystemPtesEnd;
|
|
ULONG MmSubsectionBase;
|
|
ULONG MmNumberOfPagingFiles;
|
|
|
|
ULONG MmLowestPhysicalPage;
|
|
ULONG MmHighestPhysicalPage;
|
|
ULONG MmNumberOfPhysicalPages;
|
|
|
|
ULONG MmMaximumNonPagedPoolInBytes;
|
|
ULONG MmNonPagedSystemStart;
|
|
ULONG MmNonPagedPoolStart;
|
|
ULONG MmNonPagedPoolEnd;
|
|
|
|
ULONG MmPagedPoolStart;
|
|
ULONG MmPagedPoolEnd;
|
|
ULONG MmPagedPoolInformation;
|
|
ULONG Unused2;
|
|
|
|
ULONG MmSizeOfPagedPoolInBytes;
|
|
|
|
ULONG MmTotalCommitLimit;
|
|
ULONG MmTotalCommittedPages;
|
|
ULONG MmSharedCommit;
|
|
ULONG MmDriverCommit;
|
|
ULONG MmProcessCommit;
|
|
ULONG MmPagedPoolCommit;
|
|
ULONG MmExtendedCommit;
|
|
|
|
ULONG MmZeroedPageListHead;
|
|
ULONG MmFreePageListHead;
|
|
ULONG MmStandbyPageListHead;
|
|
ULONG MmModifiedPageListHead;
|
|
ULONG MmModifiedNoWritePageListHead;
|
|
ULONG MmAvailablePages;
|
|
ULONG MmResidentAvailablePages;
|
|
|
|
ULONG PoolTrackTable;
|
|
ULONG NonPagedPoolDescriptor;
|
|
|
|
ULONG MmHighestUserAddress;
|
|
ULONG MmSystemRangeStart;
|
|
ULONG MmUserProbeAddress;
|
|
|
|
ULONG KdPrintCircularBuffer;
|
|
ULONG KdPrintCircularBufferEnd;
|
|
ULONG KdPrintWritePointer;
|
|
ULONG KdPrintRolloverCount;
|
|
|
|
ULONG MmLoadedUserImageList;
|
|
} KDDEBUGGER_DATA32, *PKDDEBUGGER_DATA32;
|
|
|
|
//
|
|
// DO NOT CHANGE KDDEBUGGER_DATA32!!
|
|
// ONLY MAKE CHANGES TO KDDEBUGGER_DATA64!!!
|
|
//
|
|
|
|
|
|
|
|
|
|
//
|
|
// This structure is used by the debugger for all targets
|
|
// It is the same size as DBGKD_DATA_HEADER on all systems
|
|
//
|
|
typedef struct _DBGKD_DEBUG_DATA_HEADER64 {
|
|
|
|
//
|
|
// Link to other blocks
|
|
//
|
|
|
|
LIST_ENTRY64 List;
|
|
|
|
//
|
|
// This is a unique tag to identify the owner of the block.
|
|
// If your component only uses one pool tag, use it for this, too.
|
|
//
|
|
|
|
ULONG OwnerTag;
|
|
|
|
//
|
|
// This must be initialized to the size of the data block,
|
|
// including this structure.
|
|
//
|
|
|
|
ULONG Size;
|
|
|
|
} DBGKD_DEBUG_DATA_HEADER64, *PDBGKD_DEBUG_DATA_HEADER64;
|
|
|
|
|
|
//
|
|
// This structure is the same size on all systems. The only field
|
|
// which must be translated by the debugger is Header.List.
|
|
//
|
|
|
|
//
|
|
// DO NOT ADD OR REMOVE FIELDS FROM THE MIDDLE OF THIS STRUCTURE!!!
|
|
//
|
|
// If you remove a field, replace it with an "unused" placeholder.
|
|
// Do not reuse fields until there has been enough time for old debuggers
|
|
// and extensions to age out.
|
|
//
|
|
typedef struct _KDDEBUGGER_DATA64 {
|
|
|
|
DBGKD_DEBUG_DATA_HEADER64 Header;
|
|
|
|
//
|
|
// Base address of kernel image
|
|
//
|
|
|
|
ULONG64 KernBase;
|
|
|
|
//
|
|
// DbgBreakPointWithStatus is a function which takes an argument
|
|
// and hits a breakpoint. This field contains the address of the
|
|
// breakpoint instruction. When the debugger sees a breakpoint
|
|
// at this address, it may retrieve the argument from the first
|
|
// argument register, or on x86 the eax register.
|
|
//
|
|
|
|
ULONG64 BreakpointWithStatus; // address of breakpoint
|
|
|
|
//
|
|
// Address of the saved context record during a bugcheck
|
|
//
|
|
// N.B. This is an automatic in KeBugcheckEx's frame, and
|
|
// is only valid after a bugcheck.
|
|
//
|
|
|
|
ULONG64 SavedContext;
|
|
|
|
//
|
|
// help for walking stacks with user callbacks:
|
|
//
|
|
|
|
//
|
|
// The address of the thread structure is provided in the
|
|
// WAIT_STATE_CHANGE packet. This is the offset from the base of
|
|
// the thread structure to the pointer to the kernel stack frame
|
|
// for the currently active usermode callback.
|
|
//
|
|
|
|
USHORT ThCallbackStack; // offset in thread data
|
|
|
|
//
|
|
// these values are offsets into that frame:
|
|
//
|
|
|
|
USHORT NextCallback; // saved pointer to next callback frame
|
|
USHORT FramePointer; // saved frame pointer
|
|
|
|
//
|
|
// pad to a quad boundary
|
|
//
|
|
USHORT PaeEnabled:1;
|
|
|
|
//
|
|
// Address of the kernel callout routine.
|
|
//
|
|
|
|
ULONG64 KiCallUserMode; // kernel routine
|
|
|
|
//
|
|
// Address of the usermode entry point for callbacks.
|
|
//
|
|
|
|
ULONG64 KeUserCallbackDispatcher; // address in ntdll
|
|
|
|
|
|
//
|
|
// Addresses of various kernel data structures and lists
|
|
// that are of interest to the kernel debugger.
|
|
//
|
|
|
|
ULONG64 PsLoadedModuleList;
|
|
ULONG64 PsActiveProcessHead;
|
|
ULONG64 PspCidTable;
|
|
|
|
ULONG64 ExpSystemResourcesList;
|
|
ULONG64 ExpPagedPoolDescriptor;
|
|
ULONG64 ExpNumberOfPagedPools;
|
|
|
|
ULONG64 KeTimeIncrement;
|
|
ULONG64 KeBugCheckCallbackListHead;
|
|
ULONG64 KiBugcheckData;
|
|
|
|
ULONG64 IopErrorLogListHead;
|
|
|
|
ULONG64 ObpRootDirectoryObject;
|
|
ULONG64 ObpTypeObjectType;
|
|
|
|
ULONG64 MmSystemCacheStart;
|
|
ULONG64 MmSystemCacheEnd;
|
|
ULONG64 MmSystemCacheWs;
|
|
|
|
ULONG64 MmPfnDatabase;
|
|
ULONG64 MmSystemPtesStart;
|
|
ULONG64 MmSystemPtesEnd;
|
|
ULONG64 MmSubsectionBase;
|
|
ULONG64 MmNumberOfPagingFiles;
|
|
|
|
ULONG64 MmLowestPhysicalPage;
|
|
ULONG64 MmHighestPhysicalPage;
|
|
ULONG64 MmNumberOfPhysicalPages;
|
|
|
|
ULONG64 MmMaximumNonPagedPoolInBytes;
|
|
ULONG64 MmNonPagedSystemStart;
|
|
ULONG64 MmNonPagedPoolStart;
|
|
ULONG64 MmNonPagedPoolEnd;
|
|
|
|
ULONG64 MmPagedPoolStart;
|
|
ULONG64 MmPagedPoolEnd;
|
|
ULONG64 MmPagedPoolInformation;
|
|
ULONG64 Unused2;
|
|
|
|
ULONG64 MmSizeOfPagedPoolInBytes;
|
|
|
|
ULONG64 MmTotalCommitLimit;
|
|
ULONG64 MmTotalCommittedPages;
|
|
ULONG64 MmSharedCommit;
|
|
ULONG64 MmDriverCommit;
|
|
ULONG64 MmProcessCommit;
|
|
ULONG64 MmPagedPoolCommit;
|
|
ULONG64 MmExtendedCommit;
|
|
|
|
ULONG64 MmZeroedPageListHead;
|
|
ULONG64 MmFreePageListHead;
|
|
ULONG64 MmStandbyPageListHead;
|
|
ULONG64 MmModifiedPageListHead;
|
|
ULONG64 MmModifiedNoWritePageListHead;
|
|
ULONG64 MmAvailablePages;
|
|
ULONG64 MmResidentAvailablePages;
|
|
|
|
ULONG64 PoolTrackTable;
|
|
ULONG64 NonPagedPoolDescriptor;
|
|
|
|
ULONG64 MmHighestUserAddress;
|
|
ULONG64 MmSystemRangeStart;
|
|
ULONG64 MmUserProbeAddress;
|
|
|
|
ULONG64 KdPrintCircularBuffer;
|
|
ULONG64 KdPrintCircularBufferEnd;
|
|
ULONG64 KdPrintWritePointer;
|
|
ULONG64 KdPrintRolloverCount;
|
|
|
|
ULONG64 MmLoadedUserImageList;
|
|
} KDDEBUGGER_DATA64, *PKDDEBUGGER_DATA64;
|
|
|
|
#endif
|
|
|
|
|
|
#define DBG_DUMP_NO_INDENT 0x00000001
|
|
#define DBG_DUMP_NO_OFFSET 0x00000002
|
|
#define DBG_DUMP_VERBOSE 0x00000004
|
|
#define DBG_DUMP_CALL_FOR_EACH 0x00000008
|
|
#define DBG_DUMP_LIST 0x00000020
|
|
#define DBG_DUMP_NO_PRINT 0x00000040
|
|
#define DBG_DUMP_GET_SIZE_ONLY 0x00000080
|
|
#define DBG_DUMP_RECUR_LEVEL(l) ((l & 0xf) << 8)
|
|
#define DBG_DUMP_PRINT_TYPE_NAME 0x00004000
|
|
#define DBG_DUMP_ARRAY 0x00008000
|
|
#define DBG_DUMP_COMPACT_OUT 0x00200000
|
|
|
|
// Dump and callback optons for fields
|
|
#define DBG_DUMP_FIELD_CALL_BEFORE_PRINT 0x00000001
|
|
#define DBG_DUMP_FIELD_NO_CALLBACK_REQ 0x00000002
|
|
#define DBG_DUMP_FIELD_RECUR_ON_THIS 0x00000004
|
|
#define DBG_DUMP_FIELD_FULL_NAME 0x00000008
|
|
#define DBG_DUMP_FIELD_ARRAY 0x00000010
|
|
#define DBG_DUMP_FIELD_COPY_FIELD_DATA 0x00000020
|
|
#define DBG_DUMP_FIELD_RETURN_ADDRESS 0x00001000
|
|
#define DBG_DUMP_FIELD_DEFAULT_STRING 0x00010000
|
|
#define DBG_DUMP_FIELD_WCHAR_STRING 0x00020000
|
|
#define DBG_DUMP_FIELD_MULTI_STRING 0x00040000
|
|
#define DBG_DUMP_FIELD_GUID_STRING 0x00080000
|
|
#define DBG_DUMP_FIELD_STRING 0x000F0000
|
|
#define DBG_DUMP_FIELD_PRINT_ULONG 0x00400000
|
|
|
|
typedef
|
|
ULONG
|
|
(WDBGAPI*PSYM_DUMP_FIELD_CALLBACK)(
|
|
struct _FIELD_INFO *pField,
|
|
PVOID UserContext
|
|
);
|
|
|
|
typedef struct _FIELD_INFO {
|
|
UCHAR fName[256]; // Name of the field
|
|
UCHAR printName[80]; // Name to be printed at dump
|
|
ULONG size; // Size of the field
|
|
ULONG fOptions; // Dump Options for the field
|
|
ULONG64 address; // address of the field
|
|
PVOID fieldCallBack; // Return info or callBack routine for the field
|
|
} FIELD_INFO, *PFIELD_INFO;
|
|
|
|
typedef struct _SYM_DUMP_PARAM {
|
|
ULONG size; // size of this struct
|
|
PUCHAR sName; // type name
|
|
ULONG Options; // Dump options
|
|
ULONG64 addr; // Address to take data for type
|
|
PFIELD_INFO listLink; // fName here would be used to do list dump
|
|
PVOID Context; // Usercontext passed to CallbackRoutine
|
|
PSYM_DUMP_FIELD_CALLBACK CallbackRoutine;
|
|
// Routine called back
|
|
ULONG nFields; // # elements in Fields
|
|
PFIELD_INFO Fields; // Used to return information about field
|
|
} SYM_DUMP_PARAM, *PSYM_DUMP_PARAM;
|
|
|
|
#ifdef __cplusplus
|
|
#define CPPMOD extern "C"
|
|
#else
|
|
#define CPPMOD
|
|
#endif
|
|
|
|
|
|
#ifndef NOEXTAPI
|
|
|
|
#if defined(KDEXT_64BIT)
|
|
#define WINDBG_EXTENSION_APIS WINDBG_EXTENSION_APIS64
|
|
#define DECLARE_API(s) DECLARE_API64(s)
|
|
#elif defined(KDEXT_32BIT)
|
|
#define WINDBG_EXTENSION_APIS WINDBG_EXTENSION_APIS32
|
|
#define DECLARE_API(s) DECLARE_API32(s)
|
|
#else
|
|
#define DECLARE_API(s) \
|
|
CPPMOD VOID \
|
|
s( \
|
|
HANDLE hCurrentProcess, \
|
|
HANDLE hCurrentThread, \
|
|
ULONG dwCurrentPc, \
|
|
ULONG dwProcessor, \
|
|
PCSTR args \
|
|
)
|
|
#endif
|
|
|
|
#define DECLARE_API32(s) \
|
|
CPPMOD VOID \
|
|
s( \
|
|
HANDLE hCurrentProcess, \
|
|
HANDLE hCurrentThread, \
|
|
ULONG dwCurrentPc, \
|
|
ULONG dwProcessor, \
|
|
PCSTR args \
|
|
)
|
|
|
|
#define DECLARE_API64(s) \
|
|
CPPMOD VOID \
|
|
s( \
|
|
HANDLE hCurrentProcess, \
|
|
HANDLE hCurrentThread, \
|
|
ULONG64 dwCurrentPc, \
|
|
ULONG dwProcessor, \
|
|
PCSTR args \
|
|
)
|
|
|
|
|
|
extern WINDBG_EXTENSION_APIS ExtensionApis;
|
|
|
|
|
|
#define dprintf (ExtensionApis.lpOutputRoutine)
|
|
#define GetExpression (ExtensionApis.lpGetExpressionRoutine)
|
|
#define CheckControlC (ExtensionApis.lpCheckControlCRoutine)
|
|
#define GetContext (ExtensionApis.lpGetThreadContextRoutine)
|
|
#define SetContext (ExtensionApis.lpSetThreadContextRoutine)
|
|
#define Ioctl (ExtensionApis.lpIoctlRoutine)
|
|
#define Disasm (ExtensionApis.lpDisasmRoutine)
|
|
#define GetSymbol (ExtensionApis.lpGetSymbolRoutine)
|
|
#define ReadMemory (ExtensionApis.lpReadProcessMemoryRoutine)
|
|
#define WriteMemory (ExtensionApis.lpWriteProcessMemoryRoutine)
|
|
#define StackTrace (ExtensionApis.lpStackTraceRoutine)
|
|
|
|
|
|
#define GetKdContext(ppi) \
|
|
Ioctl( IG_KD_CONTEXT, (PVOID)ppi, sizeof(*ppi) )
|
|
|
|
//
|
|
// BOOL
|
|
// GetDebuggerData(
|
|
// ULONG Tag,
|
|
// PVOID Buf,
|
|
// ULONG Size
|
|
// )
|
|
//
|
|
|
|
#define GetDebuggerData(TAG, BUF, SIZE) \
|
|
( (((PDBGKD_DEBUG_DATA_HEADER64)(BUF))->OwnerTag = (TAG)), \
|
|
(((PDBGKD_DEBUG_DATA_HEADER64)(BUF))->Size = (SIZE)), \
|
|
Ioctl( IG_GET_DEBUGGER_DATA, (PVOID)(BUF), (SIZE) ) )
|
|
|
|
// Check if LocalAlloc is prototyped
|
|
//#ifdef _WINBASE_
|
|
|
|
__inline VOID
|
|
ReadPhysical(
|
|
ULONG64 address,
|
|
PVOID buf,
|
|
ULONG size,
|
|
PULONG sizer
|
|
)
|
|
{
|
|
PPHYSICAL phy;
|
|
phy = (PPHYSICAL)LocalAlloc(LPTR, sizeof(*phy) + size );
|
|
ZeroMemory( phy->Buf, size );
|
|
phy->Address = address;
|
|
phy->BufLen = size;
|
|
Ioctl( IG_READ_PHYSICAL, (PVOID)phy, sizeof(*phy) + size );
|
|
*sizer = phy->BufLen;
|
|
CopyMemory( buf, phy->Buf, *sizer );
|
|
LocalFree( phy );
|
|
}
|
|
|
|
__inline VOID
|
|
WritePhysical(
|
|
ULONG64 address,
|
|
PVOID buf,
|
|
ULONG size,
|
|
PULONG sizew
|
|
)
|
|
{
|
|
PPHYSICAL phy;
|
|
phy = (PPHYSICAL)LocalAlloc(LPTR, sizeof(*phy) + size );
|
|
ZeroMemory( phy->Buf, size );
|
|
phy->Address = address;
|
|
phy->BufLen = size;
|
|
CopyMemory( phy->Buf, buf, size );
|
|
Ioctl( IG_WRITE_PHYSICAL, (PVOID)phy, sizeof(*phy) + size );
|
|
*sizew = phy->BufLen;
|
|
LocalFree( phy );
|
|
}
|
|
|
|
__inline VOID
|
|
ReadMsr(
|
|
ULONG MsrReg,
|
|
ULONGLONG *MsrValue
|
|
)
|
|
{
|
|
PREAD_WRITE_MSR msr;
|
|
|
|
msr = (PREAD_WRITE_MSR)LocalAlloc(LPTR, sizeof(*msr));
|
|
msr->Msr = MsrReg;
|
|
Ioctl( IG_READ_MSR, (PVOID)msr, sizeof(*msr) );
|
|
|
|
*MsrValue = msr->Value;
|
|
LocalFree( msr );
|
|
}
|
|
|
|
__inline VOID
|
|
WriteMsr(
|
|
ULONG MsrReg,
|
|
ULONGLONG MsrValue
|
|
)
|
|
{
|
|
PREAD_WRITE_MSR msr;
|
|
|
|
msr = (PREAD_WRITE_MSR)LocalAlloc(LPTR, sizeof(*msr));
|
|
msr->Msr = MsrReg;
|
|
msr->Value = MsrValue;
|
|
Ioctl( IG_WRITE_MSR, (PVOID)msr, sizeof(*msr) );
|
|
LocalFree( msr );
|
|
}
|
|
|
|
__inline VOID
|
|
SetThreadForOperation(
|
|
ULONG_PTR * Thread
|
|
)
|
|
{
|
|
Ioctl(IG_SET_THREAD, (PVOID)Thread, sizeof(PULONG));
|
|
}
|
|
|
|
__inline VOID
|
|
SetThreadForOperation32(
|
|
ULONG Thread
|
|
)
|
|
{
|
|
Ioctl(IG_SET_THREAD, (PVOID)LongToPtr(Thread), sizeof(PULONG));
|
|
}
|
|
|
|
__inline VOID
|
|
SetThreadForOperation64(
|
|
PULONG64 Thread
|
|
)
|
|
{
|
|
Ioctl(IG_SET_THREAD, (PVOID)Thread, sizeof(PULONG));
|
|
}
|
|
|
|
|
|
__inline VOID
|
|
ReadControlSpace(
|
|
USHORT processor,
|
|
ULONG address,
|
|
PVOID buf,
|
|
ULONG size
|
|
)
|
|
{
|
|
PREADCONTROLSPACE prc;
|
|
prc = (PREADCONTROLSPACE)LocalAlloc(LPTR, sizeof(*prc) + size );
|
|
ZeroMemory( prc->Buf, size );
|
|
prc->Processor = processor;
|
|
prc->Address = address;
|
|
prc->BufLen = size;
|
|
Ioctl( IG_READ_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );
|
|
CopyMemory( buf, prc->Buf, size );
|
|
LocalFree( prc );
|
|
}
|
|
|
|
__inline VOID
|
|
ReadControlSpace32(
|
|
USHORT processor,
|
|
ULONG address,
|
|
PVOID buf,
|
|
ULONG size
|
|
)
|
|
{
|
|
PREADCONTROLSPACE32 prc;
|
|
prc = (PREADCONTROLSPACE32)LocalAlloc(LPTR, sizeof(*prc) + size );
|
|
ZeroMemory( prc->Buf, size );
|
|
prc->Processor = processor;
|
|
prc->Address = address;
|
|
prc->BufLen = size;
|
|
Ioctl( IG_READ_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );
|
|
CopyMemory( buf, prc->Buf, size );
|
|
LocalFree( prc );
|
|
}
|
|
|
|
__inline VOID
|
|
ReadControlSpace64(
|
|
USHORT processor,
|
|
ULONG64 address,
|
|
PVOID buf,
|
|
ULONG size
|
|
)
|
|
{
|
|
PREADCONTROLSPACE64 prc;
|
|
prc = (PREADCONTROLSPACE64)LocalAlloc(LPTR, sizeof(*prc) + size );
|
|
ZeroMemory( prc->Buf, size );
|
|
prc->Processor = processor;
|
|
prc->Address = address;
|
|
prc->BufLen = size;
|
|
Ioctl( IG_READ_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );
|
|
CopyMemory( buf, prc->Buf, size );
|
|
LocalFree( prc );
|
|
}
|
|
|
|
// #endif // _WINBASE_
|
|
|
|
__inline VOID
|
|
ReadIoSpace(
|
|
ULONG address,
|
|
PULONG data,
|
|
PULONG size
|
|
)
|
|
{
|
|
IOSPACE is;
|
|
is.Address = address;
|
|
is.Length = *size;
|
|
Ioctl( IG_READ_IO_SPACE, (PVOID)&is, sizeof(is) );
|
|
memcpy(data, &is.Data, is.Length);
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
ReadIoSpace32(
|
|
ULONG address,
|
|
PULONG data,
|
|
PULONG size
|
|
)
|
|
{
|
|
IOSPACE32 is;
|
|
is.Address = address;
|
|
is.Length = *size;
|
|
Ioctl( IG_READ_IO_SPACE, (PVOID)&is, sizeof(is) );
|
|
memcpy(data, &is.Data, is.Length);
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
ReadIoSpace64(
|
|
ULONG64 address,
|
|
PULONG data,
|
|
PULONG size
|
|
)
|
|
{
|
|
IOSPACE64 is;
|
|
is.Address = address;
|
|
is.Length = *size;
|
|
Ioctl( IG_READ_IO_SPACE, (PVOID)&is, sizeof(is) );
|
|
memcpy(data, &is.Data, is.Length);
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
WriteIoSpace(
|
|
ULONG address,
|
|
ULONG data,
|
|
PULONG size
|
|
)
|
|
{
|
|
IOSPACE is;
|
|
is.Address = (ULONG)address;
|
|
is.Length = *size;
|
|
is.Data = data;
|
|
Ioctl( IG_WRITE_IO_SPACE, (PVOID)&is, sizeof(is) );
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
WriteIoSpace32(
|
|
ULONG address,
|
|
ULONG data,
|
|
PULONG size
|
|
)
|
|
{
|
|
IOSPACE32 is;
|
|
is.Address = address;
|
|
is.Length = *size;
|
|
is.Data = data;
|
|
Ioctl( IG_WRITE_IO_SPACE, (PVOID)&is, sizeof(is) );
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
WriteIoSpace64(
|
|
ULONG64 address,
|
|
ULONG data,
|
|
PULONG size
|
|
)
|
|
{
|
|
IOSPACE64 is;
|
|
is.Address = address;
|
|
is.Length = *size;
|
|
is.Data = data;
|
|
Ioctl( IG_WRITE_IO_SPACE, (PVOID)&is, sizeof(is) );
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
ReadIoSpaceEx(
|
|
ULONG address,
|
|
PULONG data,
|
|
PULONG size,
|
|
ULONG interfacetype,
|
|
ULONG busnumber,
|
|
ULONG addressspace
|
|
)
|
|
{
|
|
IOSPACE_EX is;
|
|
is.Address = (ULONG)address;
|
|
is.Length = *size;
|
|
is.Data = 0;
|
|
is.InterfaceType = interfacetype;
|
|
is.BusNumber = busnumber;
|
|
is.AddressSpace = addressspace;
|
|
Ioctl( IG_READ_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
|
|
*data = is.Data;
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
ReadIoSpaceEx32(
|
|
ULONG address,
|
|
PULONG data,
|
|
PULONG size,
|
|
ULONG interfacetype,
|
|
ULONG busnumber,
|
|
ULONG addressspace
|
|
)
|
|
{
|
|
IOSPACE_EX32 is;
|
|
is.Address = address;
|
|
is.Length = *size;
|
|
is.Data = 0;
|
|
is.InterfaceType = interfacetype;
|
|
is.BusNumber = busnumber;
|
|
is.AddressSpace = addressspace;
|
|
Ioctl( IG_READ_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
|
|
*data = is.Data;
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
ReadIoSpaceEx64(
|
|
ULONG64 address,
|
|
PULONG data,
|
|
PULONG size,
|
|
ULONG interfacetype,
|
|
ULONG busnumber,
|
|
ULONG addressspace
|
|
)
|
|
{
|
|
IOSPACE_EX64 is;
|
|
is.Address = address;
|
|
is.Length = *size;
|
|
is.Data = 0;
|
|
is.InterfaceType = interfacetype;
|
|
is.BusNumber = busnumber;
|
|
is.AddressSpace = addressspace;
|
|
Ioctl( IG_READ_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
|
|
*data = is.Data;
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
WriteIoSpaceEx(
|
|
ULONG address,
|
|
ULONG data,
|
|
PULONG size,
|
|
ULONG interfacetype,
|
|
ULONG busnumber,
|
|
ULONG addressspace
|
|
)
|
|
{
|
|
IOSPACE_EX is;
|
|
is.Address = (ULONG)address;
|
|
is.Length = *size;
|
|
is.Data = data;
|
|
is.InterfaceType = interfacetype;
|
|
is.BusNumber = busnumber;
|
|
is.AddressSpace = addressspace;
|
|
Ioctl( IG_WRITE_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
WriteIoSpaceEx32(
|
|
ULONG address,
|
|
ULONG data,
|
|
PULONG size,
|
|
ULONG interfacetype,
|
|
ULONG busnumber,
|
|
ULONG addressspace
|
|
)
|
|
{
|
|
IOSPACE_EX32 is;
|
|
is.Address = address;
|
|
is.Length = *size;
|
|
is.Data = data;
|
|
is.InterfaceType = interfacetype;
|
|
is.BusNumber = busnumber;
|
|
is.AddressSpace = addressspace;
|
|
Ioctl( IG_WRITE_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
WriteIoSpaceEx64(
|
|
ULONG64 address,
|
|
ULONG data,
|
|
PULONG size,
|
|
ULONG interfacetype,
|
|
ULONG busnumber,
|
|
ULONG addressspace
|
|
)
|
|
{
|
|
IOSPACE_EX64 is;
|
|
is.Address = address;
|
|
is.Length = *size;
|
|
is.Data = data;
|
|
is.InterfaceType = interfacetype;
|
|
is.BusNumber = busnumber;
|
|
is.AddressSpace = addressspace;
|
|
Ioctl( IG_WRITE_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
|
|
*size = is.Length;
|
|
}
|
|
|
|
__inline VOID
|
|
ReloadSymbols(
|
|
IN PSTR Arg OPTIONAL
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Calls the debugger to reload symbols.
|
|
|
|
Arguments:
|
|
|
|
Args - Supplies the tail of a !reload command string.
|
|
|
|
!reload [flags] [module[=address]]
|
|
flags: /n do not load from usermode list
|
|
/u unload symbols, no reload
|
|
/v verbose
|
|
|
|
A value of NULL is equivalent to an empty string
|
|
|
|
Return Value:
|
|
|
|
None
|
|
|
|
--*/
|
|
{
|
|
Ioctl(IG_RELOAD_SYMBOLS, (PVOID)Arg, Arg?(strlen(Arg)+1):0);
|
|
}
|
|
|
|
__inline VOID
|
|
GetSetSympath(
|
|
IN PSTR Arg,
|
|
OUT PSTR Result OPTIONAL,
|
|
IN int Length
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Calls the debugger to set or retrieve symbol search path.
|
|
|
|
Arguments:
|
|
|
|
Arg - Supplies new search path. If Arg is NULL or string is empty,
|
|
the search path is not changed and the current setting is
|
|
returned in Result. When the symbol search path is changed,
|
|
a call to ReloadSymbols is made implicitly.
|
|
|
|
Result - OPTIONAL Returns the symbol search path setting.
|
|
|
|
Length - Supplies the size of the buffer supplied by Result.
|
|
|
|
Return Value:
|
|
|
|
None
|
|
|
|
--*/
|
|
{
|
|
GET_SET_SYMPATH gss;
|
|
gss.Args = Arg;
|
|
gss.Result = Result;
|
|
gss.Length = Length;
|
|
Ioctl(IG_GET_SET_SYMPATH, (PVOID)&gss, sizeof(gss));
|
|
}
|
|
|
|
#if defined(KDEXT_64BIT)
|
|
|
|
__inline
|
|
ULONG
|
|
IsPtr64(
|
|
void
|
|
)
|
|
{
|
|
static ULONG flag = -1;
|
|
ULONG dw;
|
|
if (flag == -1) {
|
|
if (Ioctl(IG_IS_PTR64, &dw, sizeof(dw))) {
|
|
flag = ((dw != 0) ? 1 : 0);
|
|
} else {
|
|
flag = 0;
|
|
}
|
|
}
|
|
return flag;
|
|
}
|
|
|
|
__inline
|
|
ULONG
|
|
ReadListEntry(
|
|
ULONG64 Address,
|
|
PLIST_ENTRY64 List
|
|
)
|
|
{
|
|
ULONG cb;
|
|
if (IsPtr64()) {
|
|
return (ReadMemory(Address, (PVOID)List, sizeof(*List), &cb) && cb == sizeof(*List));
|
|
} else {
|
|
LIST_ENTRY32 List32;
|
|
ULONG Status;
|
|
Status = ReadMemory(Address,
|
|
(PVOID)&List32,
|
|
sizeof(List32),
|
|
&cb);
|
|
if (Status && cb == sizeof(List32)) {
|
|
List->Flink = (ULONG64)(LONG64)(LONG)List32.Flink;
|
|
List->Blink = (ULONG64)(LONG64)(LONG)List32.Blink;
|
|
return 1;
|
|
}
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
__inline
|
|
ULONG
|
|
ReadPointer(
|
|
ULONG64 Address,
|
|
PULONG64 Pointer
|
|
)
|
|
{
|
|
ULONG cb;
|
|
if (IsPtr64()) {
|
|
return (ReadMemory(Address, (PVOID)Pointer, sizeof(*Pointer), &cb) && cb == sizeof(*Pointer));
|
|
} else {
|
|
ULONG Pointer32;
|
|
ULONG Status;
|
|
Status = ReadMemory(Address,
|
|
(PVOID)&Pointer32,
|
|
sizeof(Pointer32),
|
|
&cb);
|
|
if (Status && cb == sizeof(Pointer32)) {
|
|
*Pointer = (ULONG64)(LONG64)(LONG)Pointer32;
|
|
return 1;
|
|
}
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
__inline
|
|
ULONG
|
|
WritePointer(
|
|
ULONG64 Address,
|
|
ULONG64 Pointer
|
|
)
|
|
{
|
|
ULONG cb;
|
|
if (IsPtr64()) {
|
|
return (WriteMemory(Address, &Pointer, sizeof(Pointer), &cb) && cb == sizeof(Pointer));
|
|
} else {
|
|
ULONG Pointer32 = (ULONG)Pointer;
|
|
ULONG Status;
|
|
Status = WriteMemory(Address,
|
|
&Pointer32,
|
|
sizeof(Pointer32),
|
|
&cb);
|
|
return (Status && cb == sizeof(Pointer32)) ? 1 : 0;
|
|
}
|
|
}
|
|
|
|
#endif // defined(KDEXT_64BIT)
|
|
|
|
__inline VOID
|
|
GetTebAddress(
|
|
PULONGLONG Address
|
|
)
|
|
{
|
|
GET_TEB_ADDRESS gpt;
|
|
gpt.Address = 0;
|
|
Ioctl(IG_GET_TEB_ADDRESS, (PVOID)&gpt, sizeof(gpt));
|
|
*Address = gpt.Address;
|
|
}
|
|
|
|
__inline VOID
|
|
SearchMemory(
|
|
ULONG64 SearchAddress,
|
|
ULONG64 SearchLength,
|
|
ULONG PatternLength,
|
|
PVOID Pattern,
|
|
PULONG64 FoundAddress
|
|
)
|
|
{
|
|
SEARCHMEMORY sm;
|
|
sm.SearchAddress = SearchAddress;
|
|
sm.SearchLength = SearchLength;
|
|
sm.FoundAddress = 0;
|
|
sm.PatternLength = PatternLength;
|
|
sm.Pattern = Pattern;
|
|
Ioctl(IG_SEARCH_MEMORY, (PVOID)&sm, sizeof(sm));
|
|
*FoundAddress = sm.FoundAddress;
|
|
}
|
|
|
|
|
|
#endif
|
|
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#pragma option pop /*P_O_Pop*/
|
|
#endif // _WDBGEXTS_
|