portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WinKD: Save kernel module info from state change packet

Browse source
This commit is contained in:
GustavoLCR 2022-05-02 21:50:40 -03:00 committed by Anton Kochkov
parent b6a84d284c
commit 0296e87b26
2 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
subprojects/rzwinkd/winkd.c
View file

@ -206,6 +206,7 @@ void winkd_kdctx_free(KdCtx **ctx) {
RZ_FREE(desc);
rz_th_lock_free((*ctx)->dontmix);
winkd_ctx_fini(&(*ctx)->windctx);
free((*ctx)->kernel_module.name);
RZ_FREE(*ctx);
}
@ -307,6 +308,11 @@ int winkd_wait_packet(KdCtx *ctx, const uint32_t type, kd_packet_t **p) {
char *path = (char *)pkt->data + pkt->length - stc->load_symbols.pathsize;
path[stc->load_symbols.pathsize - 1] = 0;
RZ_LOG_VERBOSE(" Image : %s\n", path);
if (rz_str_endswith(path, "\\ntoskrnl.exe")) {
ctx->kernel_module.addr = stc->load_symbols.base;
ctx->kernel_module.size = stc->load_symbols.size;
ctx->kernel_module.name = strdup(path);
}
}
} else if (stc->state == DbgKdCommandStringStateChange) {
RZ_LOG_VERBOSE("CommandString\n");

1
subprojects/rzwinkd/winkd.h
View file

@ -94,6 +94,7 @@ typedef struct _KdCtx {
RzList *plist_cache;
RzList *tlist_cache;
RzThreadLock *dontmix;
WindModule kernel_module;
} KdCtx;
#define TARGET_BACKEND 0