1155 lines
33 KiB
C
1155 lines
33 KiB
C
#undef UNICODE
|
|
#include <windows.h>
|
|
#include <tlhelp32.h>
|
|
#include <stdio.h>
|
|
#include <winbase.h>
|
|
#include <psapi.h>
|
|
#include <tchar.h>
|
|
|
|
#ifndef NTSTATUS
|
|
#define NTSTATUS DWORD
|
|
#endif
|
|
#ifndef WINAPI
|
|
#define WINAPI
|
|
#endif
|
|
|
|
// XXX remove
|
|
#define WIN32_PI(x) x
|
|
#if 0
|
|
// list windows.. required to get list of windows for current pid and send kill signals
|
|
BOOL CALLBACK enumWindowsProc (HWND hwnd, LPARAM lParam) {
|
|
|
|
DWORD procid;
|
|
|
|
GetWindowThreadProcessId (hwnd, &procid);
|
|
|
|
if ((HANDLE)procid == g_hProc) { staticchar module[1024];
|
|
module[0] = 0;
|
|
|
|
if (g_softPhoneTitle.Size() > 0) { int rc = GetWindowText (hwnd, module, 1023);
|
|
module[rc] = 0;
|
|
|
|
}
|
|
|
|
if (IsWindow(hwnd) && ((g_appTitle.Size() == 0) || (g_appTitle.EqualsNoCase(module)))) {
|
|
g_hWnd = hwnd;
|
|
|
|
return (false);
|
|
}
|
|
|
|
}
|
|
|
|
return (true);
|
|
}
|
|
|
|
int
|
|
|
|
findApplicationWindow (void) {
|
|
g_hWnd = NULL;
|
|
|
|
EnumWindows (enumWindowsProc, 0);
|
|
|
|
return (0);
|
|
}
|
|
#endif
|
|
|
|
#if 0
|
|
|
|
1860 typedef struct _FLOATING_SAVE_AREA {
|
|
1861 DWORD ControlWord;
|
|
1862 DWORD StatusWord;
|
|
1863 DWORD TagWord;
|
|
1864 DWORD ErrorOffset;
|
|
|
|
1865 DWORD ErrorSelector;
|
|
1866 DWORD DataOffset;
|
|
1867 DWORD DataSelector;
|
|
1868 BYTE RegArea[80];
|
|
1869 DWORD Cr0NpxState;
|
|
1870 } FLOATING_SAVE_AREA;
|
|
|
|
1871 typedef struct _CONTEXT {
|
|
1872 DWORD ContextFlags;
|
|
1873 DWORD Dr0;
|
|
1874 DWORD Dr1;
|
|
1875 DWORD Dr2;
|
|
1876 DWORD Dr3;
|
|
1877 DWORD Dr6;
|
|
1878 DWORD Dr7;
|
|
1879 FLOATING_SAVE_AREA FloatSave;
|
|
1880 DWORD SegGs;
|
|
1881 DWORD SegFs;
|
|
1882 DWORD SegEs;
|
|
1883 DWORD SegDs;
|
|
1884 DWORD Edi;
|
|
1885 DWORD Esi;
|
|
1886 DWORD Ebx;
|
|
1887 DWORD Edx;
|
|
1888 DWORD Ecx;
|
|
1889 DWORD Eax;
|
|
1890 DWORD Ebp;
|
|
1891 DWORD Eip;
|
|
1892 DWORD SegCs;
|
|
1893 DWORD EFlags;
|
|
1894 DWORD Esp;
|
|
1895 DWORD SegSs;
|
|
1896 BYTE ExtendedRegs[MAXIMUM_SUPPORTED_EXTENSION];
|
|
1897 } CONTEXT;
|
|
#endif
|
|
|
|
typedef struct _SYSTEM_HANDLE
|
|
{
|
|
ULONG ProcessId;
|
|
BYTE ObjectTypeNumber;
|
|
BYTE Flags;
|
|
USHORT Handle;
|
|
PVOID Object;
|
|
ACCESS_MASK GrantedAccess;
|
|
} SYSTEM_HANDLE, *PSYSTEM_HANDLE;
|
|
typedef struct _SYSTEM_HANDLE_INFORMATION
|
|
{
|
|
ULONG HandleCount;
|
|
SYSTEM_HANDLE Handles[1];
|
|
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
|
|
typedef enum _POOL_TYPE
|
|
{
|
|
NonPagedPool,
|
|
PagedPool,
|
|
NonPagedPoolMustSucceed,
|
|
DontUseThisType,
|
|
NonPagedPoolCacheAligned,
|
|
PagedPoolCacheAligned,
|
|
NonPagedPoolCacheAlignedMustS
|
|
} POOL_TYPE, *PPOOL_TYPE;
|
|
typedef struct _UNICODE_STRING
|
|
{
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
} UNICODE_STRING, *PUNICODE_STRING;
|
|
typedef struct _OBJECT_TYPE_INFORMATION
|
|
{
|
|
UNICODE_STRING Name;
|
|
ULONG TotalNumberOfObjects;
|
|
ULONG TotalNumberOfHandles;
|
|
ULONG TotalPagedPoolUsage;
|
|
ULONG TotalNonPagedPoolUsage;
|
|
ULONG TotalNamePoolUsage;
|
|
ULONG TotalHandleTableUsage;
|
|
ULONG HighWaterNumberOfObjects;
|
|
ULONG HighWaterNumberOfHandles;
|
|
ULONG HighWaterPagedPoolUsage;
|
|
ULONG HighWaterNonPagedPoolUsage;
|
|
ULONG HighWaterNamePoolUsage;
|
|
ULONG HighWaterHandleTableUsage;
|
|
ULONG InvalidAttributes;
|
|
GENERIC_MAPPING GenericMapping;
|
|
ULONG ValidAccess;
|
|
BOOLEAN SecurityRequired;
|
|
BOOLEAN MaintainHandleCount;
|
|
USHORT MaintainTypeList;
|
|
POOL_TYPE PoolType;
|
|
ULONG PagedPoolUsage;
|
|
ULONG NonPagedPoolUsage;
|
|
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
|
|
|
|
static void (*w32_GetModuleBaseName)(HANDLE, HMODULE, LPCSTR, int) = NULL;
|
|
static int (*w32_GetModuleInformation)(HANDLE, HMODULE, LPMODULEINFO, int) = NULL;
|
|
static BOOL (WINAPI *w32_DebugActiveProcessStop)(DWORD) = NULL;
|
|
static HANDLE (WINAPI *w32_openthread)(DWORD, BOOL, DWORD) = NULL;
|
|
static BOOL (WINAPI *w32_DebugBreakProcess)(HANDLE) = NULL;
|
|
static DWORD (WINAPI *w32_getthreadid)(HANDLE) = NULL; // Vista
|
|
static DWORD (WINAPI *w32_getprocessid)(HANDLE) = NULL; // XP
|
|
static HANDLE (WINAPI *w32_OpenProcess)(DWORD, BOOL, DWORD) = NULL;
|
|
static BOOL (WINAPI *w32_queryfullprocessimagename)(HANDLE, DWORD, LPCSTR, PDWORD) = NULL;
|
|
static DWORD (WINAPI *w32_GetMappedFileName)(HANDLE, LPVOID, LPCSTR, DWORD) = NULL;
|
|
static NTSTATUS (WINAPI *w32_ntquerysysteminformation)(ULONG, PVOID, ULONG, PULONG) = NULL;
|
|
static NTSTATUS (WINAPI *w32_ntqueryinformationthread)(HANDLE, ULONG, PVOID, ULONG, PULONG) = NULL;
|
|
static NTSTATUS (WINAPI *w32_ntduplicateobject)(HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG) = NULL;
|
|
static NTSTATUS (WINAPI *w32_ntqueryobject)(HANDLE, ULONG, PVOID, ULONG, PULONG) = NULL;
|
|
// fpu access API
|
|
static ut64 (WINAPI *w32_GetEnabledXStateFeatures)() = NULL;
|
|
static BOOL (WINAPI *w32_InitializeContext)(PVOID, DWORD, PCONTEXT*, PDWORD) = NULL;
|
|
static BOOL (WINAPI *w32_GetXStateFeaturesMask)(PCONTEXT Context, PDWORD64) = NULL;
|
|
static PVOID(WINAPI *w32_LocateXStateFeature)(PCONTEXT Context, DWORD, PDWORD) = NULL;
|
|
static BOOL (WINAPI *w32_SetXStateFeaturesMask)(PCONTEXT Context, DWORD64) = NULL;
|
|
static DWORD (WINAPI *w32_GetModuleFileNameEx)(HANDLE, HMODULE, LPTSTR, DWORD) = NULL;
|
|
static HANDLE (WINAPI *w32_CreateToolhelp32Snapshot)(DWORD, DWORD) = NULL;
|
|
|
|
#ifndef XSTATE_GSSE
|
|
#define XSTATE_GSSE 2
|
|
#endif
|
|
|
|
#ifndef XSTATE_LEGACY_SSE
|
|
#define XSTATE_LEGACY_SSE 1
|
|
#endif
|
|
|
|
#if defined(XSTATE_MASK_GSSE) && defined (MINGW32)
|
|
#undef XSTATE_MASK_GSSE
|
|
#endif
|
|
#if !defined(XSTATE_MASK_GSSE)
|
|
#define XSTATE_MASK_GSSE (1LLU << (XSTATE_GSSE))
|
|
#endif
|
|
|
|
#undef CONTEXT_XSTATE
|
|
#if defined(_M_X64)
|
|
#define CONTEXT_XSTATE (0x00100040)
|
|
#else
|
|
#define CONTEXT_XSTATE (0x00010040)
|
|
#endif
|
|
#define XSTATE_AVX (XSTATE_GSSE)
|
|
#define XSTATE_MASK_AVX (XSTATE_MASK_GSSE)
|
|
#ifndef CONTEXT_ALL
|
|
#define CONTEXT_ALL 1048607
|
|
#endif
|
|
static bool w32dbg_SeDebugPrivilege() {
|
|
/////////////////////////////////////////////////////////
|
|
// Note: Enabling SeDebugPrivilege adapted from sample
|
|
// MSDN @ http://msdn.microsoft.com/en-us/library/aa446619%28VS.85%29.aspx
|
|
// Enable SeDebugPrivilege
|
|
bool ret = true;
|
|
TOKEN_PRIVILEGES tokenPriv;
|
|
HANDLE hToken = NULL;
|
|
LUID luidDebug;
|
|
if (!OpenProcessToken (GetCurrentProcess (),
|
|
TOKEN_ADJUST_PRIVILEGES, &hToken))
|
|
return false;
|
|
|
|
if (!LookupPrivilegeValue (NULL, SE_DEBUG_NAME, &luidDebug)) {
|
|
CloseHandle (hToken);
|
|
return false;
|
|
}
|
|
|
|
tokenPriv.PrivilegeCount = 1;
|
|
tokenPriv.Privileges[0].Luid = luidDebug;
|
|
tokenPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
|
|
if (AdjustTokenPrivileges (hToken, FALSE, &tokenPriv, 0, NULL, NULL) != FALSE) {
|
|
if (tokenPriv.Privileges[0].Attributes == SE_PRIVILEGE_ENABLED) {
|
|
// eprintf ("PRIV ENABLED\n");
|
|
}
|
|
// Always successful, even in the cases which lead to OpenProcess failure
|
|
// eprintf ("Successfully changed token privileges.\n");
|
|
// XXX if we cant get the token nobody tells?? wtf
|
|
} else {
|
|
eprintf ("Failed to change token privileges 0x%x\n", (int)GetLastError());
|
|
ret = false;
|
|
}
|
|
CloseHandle (hToken);
|
|
return ret;
|
|
}
|
|
|
|
static int w32_dbg_init() {
|
|
HANDLE lib;
|
|
|
|
/* escalate privs (required for win7/vista) */
|
|
w32dbg_SeDebugPrivilege ();
|
|
/* lookup function pointers for portability */
|
|
w32_DebugActiveProcessStop = (BOOL (WINAPI *)(DWORD))
|
|
GetProcAddress (GetModuleHandleA ("kernel32"),
|
|
"DebugActiveProcessStop");
|
|
w32_openthread = (HANDLE (WINAPI *)(DWORD, BOOL, DWORD))
|
|
GetProcAddress (GetModuleHandleA ("kernel32"), "OpenThread");
|
|
w32_OpenProcess = (HANDLE (WINAPI *)(DWORD, BOOL, DWORD))
|
|
GetProcAddress (GetModuleHandleA ("kernel32"), "OpenProcess");
|
|
w32_DebugBreakProcess = (BOOL (WINAPI *)(HANDLE))
|
|
GetProcAddress (GetModuleHandleA ("kernel32"),
|
|
"DebugBreakProcess");
|
|
w32_CreateToolhelp32Snapshot = (HANDLE (WINAPI *)(DWORD, DWORD))
|
|
GetProcAddress (GetModuleHandleA ("kernel32"),
|
|
"CreateToolhelp32Snapshot");
|
|
// only windows vista :(
|
|
w32_getthreadid = (DWORD (WINAPI *)(HANDLE))
|
|
GetProcAddress (GetModuleHandleA ("kernel32"), "GetThreadId");
|
|
// from xp1
|
|
w32_getprocessid = (DWORD (WINAPI *)(HANDLE))
|
|
GetProcAddress (GetModuleHandleA ("kernel32"), "GetProcessId");
|
|
w32_queryfullprocessimagename = (BOOL (WINAPI *)(HANDLE, DWORD, LPCSTR, PDWORD))
|
|
GetProcAddress (GetModuleHandleA ("kernel32"), "QueryFullProcessImageNameA");
|
|
// api to retrieve YMM from w7 sp1
|
|
w32_GetEnabledXStateFeatures = (ut64 (WINAPI *) ())
|
|
GetProcAddress(GetModuleHandleA ("kernel32"), "GetEnabledXStateFeatures");
|
|
w32_InitializeContext = (BOOL (WINAPI *) (PVOID, DWORD, PCONTEXT*, PDWORD))
|
|
GetProcAddress(GetModuleHandleA ("kernel32"), "InitializeContext");
|
|
w32_GetXStateFeaturesMask = (BOOL (WINAPI *) (PCONTEXT Context, PDWORD64))
|
|
GetProcAddress(GetModuleHandleA ("kernel32"), "GetXStateFeaturesMask");
|
|
w32_LocateXStateFeature = (PVOID (WINAPI *) (PCONTEXT Context, DWORD ,PDWORD))
|
|
GetProcAddress(GetModuleHandleA ("kernel32"), "LocateXStateFeature");
|
|
w32_SetXStateFeaturesMask = (BOOL (WINAPI *) (PCONTEXT Context, DWORD64))
|
|
GetProcAddress(GetModuleHandleA ("kernel32"), "SetXStateFeaturesMask");
|
|
lib = LoadLibraryA ("psapi.dll");
|
|
if(!lib) {
|
|
eprintf ("Cannot load psapi.dll. Aborting\n");
|
|
return false;
|
|
}
|
|
w32_GetMappedFileName = (DWORD (WINAPI *)(HANDLE, LPVOID, LPCSTR, DWORD))
|
|
GetProcAddress (lib, "GetMappedFileNameA");
|
|
w32_GetModuleBaseName = (void (*)(HANDLE, HMODULE, LPCSTR, int))
|
|
GetProcAddress (lib, "GetModuleBaseNameA");
|
|
w32_GetModuleInformation = (int (*)(HANDLE, HMODULE, LPMODULEINFO, int))
|
|
GetProcAddress (lib, "GetModuleInformation");
|
|
w32_GetModuleFileNameEx = (DWORD (WINAPI *)(HANDLE, HMODULE, LPTSTR, DWORD))
|
|
GetProcAddress (lib, "GetModuleFileNameExA");
|
|
|
|
lib=LoadLibraryA("ntdll.dll");
|
|
w32_ntquerysysteminformation = (NTSTATUS (WINAPI *)(ULONG, PVOID, ULONG, PULONG))
|
|
GetProcAddress (lib, "NtQuerySystemInformation");
|
|
w32_ntduplicateobject = (NTSTATUS (WINAPI *)(HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG))
|
|
GetProcAddress (lib, "NtDuplicateObject");
|
|
w32_ntqueryobject = (NTSTATUS (WINAPI *)(HANDLE, ULONG, PVOID, ULONG, PULONG))
|
|
GetProcAddress(lib,"NtQueryObject");
|
|
w32_ntqueryinformationthread = (NTSTATUS (WINAPI *)(HANDLE, ULONG, PVOID, ULONG, PULONG))
|
|
GetProcAddress (lib, "NtQueryInformationThread");
|
|
if (!w32_DebugActiveProcessStop || !w32_openthread || !w32_DebugBreakProcess ||
|
|
!w32_GetModuleBaseName || !w32_GetModuleInformation) {
|
|
// OOPS!
|
|
eprintf ("debug_init_calls:\n"
|
|
"DebugActiveProcessStop: 0x%p\n"
|
|
"OpenThread: 0x%p\n"
|
|
"DebugBreakProcess: 0x%p\n"
|
|
"GetThreadId: 0x%p\n",
|
|
w32_DebugActiveProcessStop, w32_openthread, w32_DebugBreakProcess, w32_getthreadid);
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
#if 0
|
|
static HANDLE w32_t2h(pid_t tid) {
|
|
TH_INFO *th = get_th (tid);
|
|
if(!th) {
|
|
/* refresh thread list */
|
|
w32_dbg_threads (tid);
|
|
|
|
/* try to search thread */
|
|
if(!(th = get_th (tid)))
|
|
return NULL;
|
|
}
|
|
return th->ht;
|
|
}
|
|
#endif
|
|
|
|
inline static int w32_h2t(HANDLE h) {
|
|
if (w32_getthreadid != NULL) // >= Windows Vista
|
|
return w32_getthreadid (h);
|
|
if (w32_getprocessid != NULL) // >= Windows XP1
|
|
return w32_getprocessid (h);
|
|
return (int)(size_t)h; // XXX broken
|
|
}
|
|
|
|
static inline int w32_h2p(HANDLE h) {
|
|
return w32_getprocessid (h);
|
|
}
|
|
|
|
static int w32_first_thread(int pid) {
|
|
HANDLE th;
|
|
HANDLE thid;
|
|
THREADENTRY32 te32;
|
|
te32.dwSize = sizeof (THREADENTRY32);
|
|
|
|
if (!w32_openthread) {
|
|
eprintf("w32_thread_list: no w32_openthread?\n");
|
|
return -1;
|
|
}
|
|
th = CreateToolhelp32Snapshot (TH32CS_SNAPTHREAD, pid);
|
|
if (th == INVALID_HANDLE_VALUE) {
|
|
eprintf ("w32_thread_list: invalid handle\n");
|
|
return -1;
|
|
}
|
|
if (!Thread32First (th, &te32)) {
|
|
CloseHandle (th);
|
|
eprintf ("w32_thread_list: no thread first\n");
|
|
return -1;
|
|
}
|
|
do {
|
|
/* get all threads of process */
|
|
if (te32.th32OwnerProcessID == pid) {
|
|
thid = w32_openthread (THREAD_ALL_ACCESS, 0, te32.th32ThreadID);
|
|
if (!thid) {
|
|
r_sys_perror ("w32_first_thread/OpenThread");
|
|
goto err_load_th;
|
|
}
|
|
CloseHandle (th);
|
|
return te32.th32ThreadID;
|
|
}
|
|
} while (Thread32Next (th, &te32));
|
|
err_load_th:
|
|
eprintf ("Could not find an active thread for pid %d\n", pid);
|
|
CloseHandle (th);
|
|
return pid;
|
|
}
|
|
|
|
static char *get_w32_excep_name(unsigned long code) {
|
|
char *desc;
|
|
switch (code) {
|
|
/* fatal exceptions */
|
|
case EXCEPTION_ACCESS_VIOLATION:
|
|
desc = "access violation";
|
|
break;
|
|
case EXCEPTION_ARRAY_BOUNDS_EXCEEDED:
|
|
desc = "array bounds exceeded";
|
|
break;
|
|
case EXCEPTION_ILLEGAL_INSTRUCTION:
|
|
desc = "illegal instruction";
|
|
break;
|
|
case EXCEPTION_INT_DIVIDE_BY_ZERO:
|
|
desc = "divide by zero";
|
|
break;
|
|
case EXCEPTION_STACK_OVERFLOW:
|
|
desc = "stack overflow";
|
|
break;
|
|
default:
|
|
desc = "unknown";
|
|
}
|
|
|
|
return desc;
|
|
}
|
|
|
|
static int debug_exception_event (DEBUG_EVENT *de) {
|
|
unsigned long code = de->u.Exception.ExceptionRecord.ExceptionCode;
|
|
switch (code) {
|
|
case EXCEPTION_BREAKPOINT:
|
|
break;
|
|
case EXCEPTION_SINGLE_STEP:
|
|
break;
|
|
/* fatal exceptions */
|
|
case EXCEPTION_ACCESS_VIOLATION:
|
|
case EXCEPTION_ARRAY_BOUNDS_EXCEEDED:
|
|
case EXCEPTION_ILLEGAL_INSTRUCTION:
|
|
case EXCEPTION_INT_DIVIDE_BY_ZERO:
|
|
case EXCEPTION_STACK_OVERFLOW:
|
|
eprintf ("(%d) Fatal exception (%s) in thread %d\n",
|
|
(int)de->dwProcessId,
|
|
get_w32_excep_name(code),
|
|
(int)de->dwThreadId);
|
|
break;
|
|
#if __MINGW64__ || _WIN64
|
|
/* STATUS_WX86_BREAKPOINT */
|
|
case 0x4000001f:
|
|
eprintf ("(%d) WOW64 loaded.\n", (int)de->dwProcessId);
|
|
return 1;
|
|
#endif
|
|
/* MS_VC_EXCEPTION */
|
|
case 0x406D1388:
|
|
eprintf ("(%d) MS_VC_EXCEPTION (%x) in thread %d\n",
|
|
(int)de->dwProcessId, (int)code, (int)de->dwThreadId);
|
|
return 1;
|
|
default:
|
|
eprintf ("(%d) Unknown exception %x in thread %d\n",
|
|
(int)de->dwProcessId, (int)code, (int)de->dwThreadId);
|
|
break;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static char *get_file_name_from_handle (HANDLE handle_file) {
|
|
HANDLE handle_file_map;
|
|
CHAR *filename = NULL;
|
|
|
|
DWORD file_size_high = 0;
|
|
DWORD file_size_low = GetFileSize (handle_file, &file_size_high);
|
|
if (file_size_low == 0 && file_size_high == 0) {
|
|
return NULL;
|
|
}
|
|
|
|
handle_file_map = CreateFileMappingA (handle_file, NULL, PAGE_READONLY, 0, 1, NULL);
|
|
|
|
if (!handle_file_map) {
|
|
return NULL;
|
|
}
|
|
filename = malloc(MAX_PATH+1);
|
|
|
|
/* Create a file mapping to get the file name. */
|
|
void* map = MapViewOfFile (handle_file_map, FILE_MAP_READ, 0, 0, 1);
|
|
|
|
if (!map) {
|
|
free (filename);
|
|
CloseHandle (handle_file_map);
|
|
return NULL;
|
|
}
|
|
|
|
if (!w32_GetMappedFileName (GetCurrentProcess (),
|
|
map,
|
|
filename,
|
|
MAX_PATH)) {
|
|
|
|
free(filename);
|
|
UnmapViewOfFile (map);
|
|
CloseHandle (handle_file_map);
|
|
return NULL;
|
|
}
|
|
|
|
/* Translate path with device name to drive letters. */
|
|
CHAR temp_buffer[512];
|
|
temp_buffer[0] = '\0';
|
|
|
|
if (!GetLogicalDriveStringsA (511, temp_buffer)) {
|
|
free (filename);
|
|
UnmapViewOfFile (map);
|
|
CloseHandle (handle_file_map);
|
|
return NULL;
|
|
}
|
|
|
|
CHAR name[MAX_PATH];
|
|
CHAR drive[3] = " :";
|
|
BOOL found = FALSE;
|
|
CHAR *p = temp_buffer;
|
|
do {
|
|
/* Look up each device name */
|
|
*drive = *p;
|
|
if (QueryDosDeviceA (drive, name, MAX_PATH)) {
|
|
size_t name_length = strlen (name);
|
|
|
|
if (name_length < MAX_PATH) {
|
|
found = strncmp (filename, name, name_length) == 0
|
|
&& *(filename + name_length) == _T ('\\');
|
|
|
|
if (found) {
|
|
CHAR temp_filename[MAX_PATH];
|
|
snprintf (temp_filename, MAX_PATH-1, "%s%s",
|
|
drive, filename+name_length);
|
|
strncpy (filename, temp_filename, MAX_PATH-1);
|
|
}
|
|
}
|
|
}
|
|
while (*p++);
|
|
} while (!found && *p);
|
|
|
|
UnmapViewOfFile (map);
|
|
CloseHandle (handle_file_map);
|
|
return filename;
|
|
}
|
|
|
|
typedef struct{
|
|
int pid;
|
|
HANDLE hFile;
|
|
void* BaseOfDll;
|
|
char Path[MAX_PATH];
|
|
char Name[MAX_PATH];
|
|
} LIB_ITEM, *PLIB_ITEM;
|
|
LPVOID lstLib = 0;
|
|
PLIB_ITEM lstLibPtr = 0;
|
|
/*
|
|
static char * r_debug_get_dll() {
|
|
return lstLibPtr->Path;
|
|
}
|
|
*/
|
|
static PLIB_ITEM r_debug_get_lib_item() {
|
|
return lstLibPtr;
|
|
}
|
|
#define PLIB_MAX 512
|
|
static void r_debug_lstLibAdd(DWORD pid,LPVOID lpBaseOfDll, HANDLE hFile,char * dllname) {
|
|
int x;
|
|
if (lstLib == 0)
|
|
lstLib = VirtualAlloc (0, PLIB_MAX * sizeof (LIB_ITEM), MEM_COMMIT, PAGE_READWRITE);
|
|
lstLibPtr = (PLIB_ITEM)lstLib;
|
|
for (x=0; x<PLIB_MAX; x++) {
|
|
if (!lstLibPtr->hFile) {
|
|
lstLibPtr->pid = pid;
|
|
lstLibPtr->hFile = hFile; //DBGEvent->u.LoadDll.hFile;
|
|
lstLibPtr->BaseOfDll = lpBaseOfDll;//DBGEvent->u.LoadDll.lpBaseOfDll;
|
|
strncpy (lstLibPtr->Path,dllname,MAX_PATH-1);
|
|
int i = strlen (dllname);
|
|
int n = i;
|
|
while(dllname[i] != '\\' && i >= 0) {
|
|
i--;
|
|
}
|
|
strncpy (lstLibPtr->Name, &dllname[i+1], n-i);
|
|
return;
|
|
}
|
|
lstLibPtr++;
|
|
}
|
|
eprintf("r_debug_lstLibAdd: Cannot find slot\n");
|
|
}
|
|
static void * r_debug_findlib (void * BaseOfDll) {
|
|
PLIB_ITEM libPtr = NULL;
|
|
if (lstLib) {
|
|
libPtr = (PLIB_ITEM)lstLib;
|
|
while (libPtr->hFile != NULL) {
|
|
if (libPtr->hFile != (HANDLE)-1)
|
|
if (libPtr->BaseOfDll == BaseOfDll)
|
|
return ((void*)libPtr);
|
|
libPtr = (PLIB_ITEM)((ULONG_PTR)libPtr + sizeof (LIB_ITEM));
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
// thread list
|
|
typedef struct {
|
|
int pid;
|
|
int tid;
|
|
BOOL bFinished;
|
|
HANDLE hThread;
|
|
LPVOID lpThreadLocalBase;
|
|
LPVOID lpStartAddress;
|
|
PVOID lpThreadEntryPoint;
|
|
DWORD dwExitCode;
|
|
} THREAD_ITEM, *PTHREAD_ITEM;
|
|
LPVOID lstThread = 0;
|
|
PTHREAD_ITEM lstThreadPtr = 0;
|
|
static PTHREAD_ITEM r_debug_get_thread_item () {
|
|
return lstThreadPtr;
|
|
}
|
|
#define PTHREAD_MAX 1024
|
|
static void r_debug_lstThreadAdd (DWORD pid, DWORD tid, HANDLE hThread, LPVOID lpThreadLocalBase, LPVOID lpStartAddress, BOOL bFinished) {
|
|
int x;
|
|
PVOID startAddress = 0;
|
|
if (lstThread == 0)
|
|
lstThread = VirtualAlloc (0, PTHREAD_MAX * sizeof (THREAD_ITEM), MEM_COMMIT, PAGE_READWRITE);
|
|
lstThreadPtr = (PTHREAD_ITEM)lstThread;
|
|
for (x = 0; x < PTHREAD_MAX; x++) {
|
|
if (!lstThreadPtr->tid) {
|
|
lstThreadPtr->pid = pid;
|
|
lstThreadPtr->tid = tid;
|
|
lstThreadPtr->bFinished = bFinished;
|
|
lstThreadPtr->hThread = hThread;
|
|
lstThreadPtr->lpThreadLocalBase = lpThreadLocalBase;
|
|
lstThreadPtr->lpStartAddress = lpStartAddress;
|
|
if (w32_ntqueryinformationthread (hThread, 0x9 /*ThreadQuerySetWin32StartAddress*/, &startAddress, sizeof (PVOID), NULL) == 0) {
|
|
lstThreadPtr->lpThreadEntryPoint = startAddress;
|
|
}
|
|
return;
|
|
}
|
|
lstThreadPtr++;
|
|
}
|
|
eprintf ("r_debug_lstThreadAdd: Cannot find slot\n");
|
|
}
|
|
|
|
static void * r_debug_findthread (int pid, int tid) {
|
|
PTHREAD_ITEM threadPtr = NULL;
|
|
if (lstThread) {
|
|
threadPtr = (PTHREAD_ITEM)lstThread;
|
|
while (threadPtr->tid != 0) {
|
|
if (threadPtr->pid == pid) {
|
|
if (threadPtr->tid == tid) {
|
|
return ((void*)threadPtr);
|
|
}
|
|
}
|
|
threadPtr = (PTHREAD_ITEM)((ULONG_PTR)threadPtr + sizeof (THREAD_ITEM));
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
static int w32_dbg_wait(RDebug *dbg, int pid) {
|
|
DEBUG_EVENT de;
|
|
int tid, next_event = 0;
|
|
unsigned int code;
|
|
char *dllname = NULL;
|
|
int ret = R_DEBUG_REASON_UNKNOWN;
|
|
static int exited_already = 0;
|
|
/* handle debug events */
|
|
do {
|
|
/* do not continue when already exited but still open for examination */
|
|
if (exited_already == pid) {
|
|
return -1;
|
|
}
|
|
memset (&de, 0, sizeof (DEBUG_EVENT));
|
|
if (WaitForDebugEvent (&de, INFINITE) == 0) {
|
|
r_sys_perror ("w32_dbg_wait/WaitForDebugEvent");
|
|
return -1;
|
|
}
|
|
code = de.dwDebugEventCode;
|
|
tid = de.dwThreadId;
|
|
pid = de.dwProcessId;
|
|
dbg->tid = tid;
|
|
dbg->pid = pid;
|
|
/* TODO: DEBUG_CONTROL_C */
|
|
switch (code) {
|
|
case CREATE_PROCESS_DEBUG_EVENT:
|
|
eprintf ("(%d) created process (%d:%p)\n",
|
|
pid, w32_h2t (de.u.CreateProcessInfo.hProcess),
|
|
de.u.CreateProcessInfo.lpStartAddress);
|
|
r_debug_native_continue (dbg, pid, tid, -1);
|
|
next_event = 1;
|
|
ret = R_DEBUG_REASON_NEW_PID;
|
|
break;
|
|
case EXIT_PROCESS_DEBUG_EVENT:
|
|
eprintf ("(%d) Process %d exited with exit code %d\n", (int)de.dwProcessId, (int)de.dwProcessId,
|
|
(int)de.u.ExitProcess.dwExitCode);
|
|
//debug_load();
|
|
next_event = 0;
|
|
exited_already = pid;
|
|
ret = R_DEBUG_REASON_EXIT_PID;
|
|
break;
|
|
case CREATE_THREAD_DEBUG_EVENT:
|
|
//eprintf ("(%d) Created thread %d (start @ %p)\n", pid, tid, de.u.CreateThread.lpStartAddress);
|
|
r_debug_lstThreadAdd (pid, tid, de.u.CreateThread.hThread, de.u.CreateThread.lpThreadLocalBase, de.u.CreateThread.lpStartAddress, FALSE);
|
|
//r_debug_native_continue (dbg, pid, tid, -1);
|
|
ret = R_DEBUG_REASON_NEW_TID;
|
|
next_event = 0;
|
|
break;
|
|
case EXIT_THREAD_DEBUG_EVENT:
|
|
//eprintf ("(%d) Finished thread %d\n", pid, tid);
|
|
lstThreadPtr = (PTHREAD_ITEM)r_debug_findthread (pid, tid);
|
|
if (lstThreadPtr) {
|
|
lstThreadPtr->bFinished = TRUE;
|
|
lstThreadPtr->dwExitCode = de.u.ExitThread.dwExitCode;
|
|
} else {
|
|
r_debug_lstThreadAdd (pid, tid, de.u.CreateThread.hThread, de.u.CreateThread.lpThreadLocalBase, de.u.CreateThread.lpStartAddress, TRUE);
|
|
}
|
|
//r_debug_native_continue (dbg, pid, tid, -1);
|
|
next_event = 0;
|
|
ret = R_DEBUG_REASON_EXIT_TID;
|
|
break;
|
|
case LOAD_DLL_DEBUG_EVENT:
|
|
dllname = get_file_name_from_handle (de.u.LoadDll.hFile);
|
|
//eprintf ("(%d) Loading library at %p (%s)\n",pid, de.u.LoadDll.lpBaseOfDll, dllname ? dllname : "no name");
|
|
r_debug_lstLibAdd (pid,de.u.LoadDll.lpBaseOfDll, de.u.LoadDll.hFile, dllname);
|
|
if (dllname) {
|
|
free (dllname);
|
|
}
|
|
next_event = 0;
|
|
ret = R_DEBUG_REASON_NEW_LIB;
|
|
break;
|
|
case UNLOAD_DLL_DEBUG_EVENT:
|
|
//eprintf ("(%d) Unloading library at %p\n", pid, de.u.UnloadDll.lpBaseOfDll);
|
|
lstLibPtr = (PLIB_ITEM)r_debug_findlib (de.u.UnloadDll.lpBaseOfDll);
|
|
if (lstLibPtr != NULL) {
|
|
lstLibPtr->hFile = (HANDLE)-1;
|
|
} else {
|
|
r_debug_lstLibAdd (pid, de.u.UnloadDll.lpBaseOfDll, (HANDLE)-1, "not cached");
|
|
if (dllname)
|
|
free (dllname);
|
|
}
|
|
next_event = 0;
|
|
ret = R_DEBUG_REASON_EXIT_LIB;
|
|
break;
|
|
case OUTPUT_DEBUG_STRING_EVENT:
|
|
eprintf ("(%d) Debug string\n", pid);
|
|
r_debug_native_continue (dbg, pid, tid, -1);
|
|
next_event = 1;
|
|
break;
|
|
case RIP_EVENT:
|
|
eprintf ("(%d) RIP event\n", pid);
|
|
r_debug_native_continue (dbg, pid, tid, -1);
|
|
next_event = 1;
|
|
// XXX unknown ret = R_DEBUG_REASON_TRAP;
|
|
break;
|
|
case EXCEPTION_DEBUG_EVENT:
|
|
switch (de.u.Exception.ExceptionRecord.ExceptionCode) {
|
|
#if __MINGW64__ || _WIN64
|
|
case 0x4000001f:
|
|
#endif
|
|
case EXCEPTION_BREAKPOINT:
|
|
ret = R_DEBUG_REASON_BREAKPOINT;
|
|
next_event = 0;
|
|
break;
|
|
case EXCEPTION_SINGLE_STEP:
|
|
ret = R_DEBUG_REASON_STEP;
|
|
next_event = 0;
|
|
break;
|
|
default:
|
|
if (!debug_exception_event (&de)) {
|
|
ret = R_DEBUG_REASON_TRAP;
|
|
next_event = 0;
|
|
}
|
|
else {
|
|
next_event = 1;
|
|
r_debug_native_continue (dbg, pid, tid, -1);
|
|
}
|
|
|
|
}
|
|
break;
|
|
default:
|
|
eprintf ("(%d) unknown event: %d\n", pid, code);
|
|
return -1;
|
|
}
|
|
} while (next_event);
|
|
return ret;
|
|
}
|
|
|
|
static inline int is_pe_hdr(unsigned char *pe_hdr) {
|
|
IMAGE_DOS_HEADER *dos_header = (IMAGE_DOS_HEADER *)pe_hdr;
|
|
IMAGE_NT_HEADERS *nt_headers;
|
|
|
|
if (dos_header->e_magic==IMAGE_DOS_SIGNATURE) {
|
|
nt_headers = (IMAGE_NT_HEADERS *)((char *)dos_header
|
|
+ dos_header->e_lfanew);
|
|
if (nt_headers->Signature==IMAGE_NT_SIGNATURE)
|
|
return 1;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static HANDLE w32_open_thread (int pid, int tid) {
|
|
HANDLE thread = w32_openthread (THREAD_ALL_ACCESS, 0, tid);
|
|
if (thread == INVALID_HANDLE_VALUE) {
|
|
r_sys_perror ("w32_open_thread/OpenThread");
|
|
}
|
|
return thread;
|
|
}
|
|
|
|
RList *w32_thread_list (int pid, RList *list) {
|
|
HANDLE th;
|
|
HANDLE thid;
|
|
THREADENTRY32 te32;
|
|
|
|
te32.dwSize = sizeof(THREADENTRY32);
|
|
|
|
if (!w32_openthread) {
|
|
eprintf("w32_thread_list: no w32_openthread?\n");
|
|
return list;
|
|
}
|
|
th = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, pid);
|
|
if(th == INVALID_HANDLE_VALUE || !Thread32First (th, &te32))
|
|
goto err_load_th;
|
|
do {
|
|
/* get all threads of process */
|
|
if (te32.th32OwnerProcessID == pid) {
|
|
//te32.dwFlags);
|
|
/* open a new handler */
|
|
// XXX: fd leak?
|
|
#if 0
|
|
75 typedef struct tagTHREADENTRY32 {
|
|
76 DWORD dwSize;
|
|
77 DWORD cntUsage;
|
|
78 DWORD th32ThreadID;
|
|
79 DWORD th32OwnerProcessID;
|
|
80 LONG tpBasePri;
|
|
81 LONG tpDeltaPri;
|
|
82 DWORD dwFlags;
|
|
#endif
|
|
thid = w32_openthread (THREAD_ALL_ACCESS, 0, te32.th32ThreadID);
|
|
if (!thid) {
|
|
r_sys_perror ("w32_thread_list/OpenThread");
|
|
goto err_load_th;
|
|
}
|
|
r_list_append (list, r_debug_pid_new ("???", te32.th32ThreadID, 0, 's', 0));
|
|
}
|
|
} while (Thread32Next (th, &te32));
|
|
err_load_th:
|
|
if(th != INVALID_HANDLE_VALUE)
|
|
CloseHandle (th);
|
|
return list;
|
|
}
|
|
|
|
static RDebugPid *build_debug_pid(PROCESSENTRY32 *pe) {
|
|
HANDLE process = w32_OpenProcess (0x1000, //PROCESS_QUERY_LIMITED_INFORMATION,
|
|
FALSE, pe->th32ProcessID);
|
|
|
|
if (!process || !w32_queryfullprocessimagename) {
|
|
return r_debug_pid_new (pe->szExeFile, pe->th32ProcessID, 0, 's', 0);
|
|
}
|
|
|
|
char image_name[MAX_PATH + 1];
|
|
image_name[0] = '\0';
|
|
DWORD length = MAX_PATH;
|
|
|
|
if (w32_queryfullprocessimagename (process, 0,
|
|
image_name, (PDWORD)&length)) {
|
|
CloseHandle(process);
|
|
return r_debug_pid_new (image_name, pe->th32ProcessID, 0, 's', 0);
|
|
}
|
|
|
|
CloseHandle(process);
|
|
return r_debug_pid_new (pe->szExeFile, pe->th32ProcessID, 0, 's', 0);
|
|
}
|
|
|
|
RList *w32_pids (int pid, RList *list) {
|
|
HANDLE process_snapshot;
|
|
PROCESSENTRY32 pe;
|
|
pe.dwSize = sizeof (PROCESSENTRY32);
|
|
int show_all_pids = pid == 0;
|
|
|
|
process_snapshot = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, pid);
|
|
if (process_snapshot == INVALID_HANDLE_VALUE) {
|
|
r_sys_perror ("w32_pids/CreateToolhelp32Snapshot");
|
|
return list;
|
|
}
|
|
if (!Process32First (process_snapshot, &pe)) {
|
|
r_sys_perror ("w32_pids/Process32First");
|
|
CloseHandle (process_snapshot);
|
|
return list;
|
|
}
|
|
do {
|
|
if (show_all_pids ||
|
|
pe.th32ProcessID == pid ||
|
|
pe.th32ParentProcessID == pid) {
|
|
|
|
RDebugPid *debug_pid = build_debug_pid (&pe);
|
|
if (debug_pid) {
|
|
r_list_append (list, debug_pid);
|
|
}
|
|
}
|
|
} while (Process32Next (process_snapshot, &pe));
|
|
|
|
CloseHandle (process_snapshot);
|
|
return list;
|
|
}
|
|
|
|
bool w32_terminate_process (RDebug *dbg, int pid) {
|
|
HANDLE h_proc = w32_OpenProcess(PROCESS_TERMINATE | SYNCHRONIZE , FALSE, pid);
|
|
bool ret = false;
|
|
if (!h_proc) {
|
|
r_sys_perror ("w32_terminate_process/OpenProcess");
|
|
goto err_w32_terminate_process;
|
|
}
|
|
/* stop debugging if we are still attached */
|
|
if (w32_DebugActiveProcessStop) {
|
|
w32_DebugActiveProcessStop (pid); //DebugActiveProcessStop (pid);
|
|
}
|
|
if (TerminateProcess (h_proc, 1) == 0) {
|
|
r_sys_perror ("e32_terminate_process/TerminateProcess");
|
|
goto err_w32_terminate_process;
|
|
|
|
}
|
|
/* wait up to one second to give the process some time to exit */
|
|
DWORD ret_wait = WaitForSingleObject (h_proc, 1000);
|
|
if (ret_wait == WAIT_FAILED) {
|
|
r_sys_perror ("w32_terminate_process/WaitForSingleObject");
|
|
goto err_w32_terminate_process;
|
|
}
|
|
if (ret_wait == WAIT_TIMEOUT) {
|
|
eprintf ("(%d) Waiting for process to terminate timed out.\n", pid);
|
|
goto err_w32_terminate_process;
|
|
}
|
|
ret = true;
|
|
err_w32_terminate_process:
|
|
if (h_proc) {
|
|
CloseHandle (h_proc);
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
void w32_break_process (void *d) {
|
|
RDebug *dbg = (RDebug *)d;
|
|
HANDLE h_proc = w32_OpenProcess (PROCESS_ALL_ACCESS, FALSE, dbg->pid);
|
|
if (!h_proc) {
|
|
r_sys_perror ("w32_break_process/w32_OpenProcess");
|
|
goto err_w32_break_process;
|
|
}
|
|
if (!w32_DebugBreakProcess (h_proc)) {
|
|
r_sys_perror ("w32_break_process/w32_DebugBreakProcess");
|
|
goto err_w32_break_process;
|
|
}
|
|
err_w32_break_process:
|
|
if (h_proc) {
|
|
CloseHandle (h_proc);
|
|
}
|
|
}
|
|
|
|
static int GetAVX (HANDLE hThread, ut128 * xmm, ut128 * ymm) {
|
|
BOOL Success;
|
|
int nRegs = 0, Index = 0;
|
|
DWORD ContextSize = 0;
|
|
DWORD FeatureLength = 0;
|
|
ut64 FeatureMask = 0;
|
|
ut128 * Xmm = NULL;
|
|
ut128 * Ymm = NULL;
|
|
void * buffer = NULL;
|
|
PCONTEXT Context;
|
|
if (w32_GetEnabledXStateFeatures == (ut64 (WINAPI *) ())-1) {
|
|
return 0;
|
|
}
|
|
// Check for AVX extension
|
|
FeatureMask = w32_GetEnabledXStateFeatures();
|
|
if ((FeatureMask & XSTATE_MASK_AVX) == 0) {
|
|
return 0;
|
|
}
|
|
Success = w32_InitializeContext(NULL, CONTEXT_ALL | CONTEXT_XSTATE, NULL, &ContextSize);
|
|
if ((Success == TRUE) || (GetLastError() != ERROR_INSUFFICIENT_BUFFER)) {
|
|
return 0;
|
|
}
|
|
buffer = malloc(ContextSize);
|
|
if (buffer == NULL) {
|
|
return 0;
|
|
}
|
|
Success = w32_InitializeContext(buffer, CONTEXT_ALL | CONTEXT_XSTATE, &Context, &ContextSize);
|
|
if (Success == FALSE) {
|
|
free(buffer);
|
|
return 0;
|
|
}
|
|
Success = w32_SetXStateFeaturesMask(Context, XSTATE_MASK_AVX);
|
|
if (Success == FALSE) {
|
|
free(buffer);
|
|
return 0;
|
|
}
|
|
Success = GetThreadContext(hThread, Context);
|
|
if (Success == FALSE) {
|
|
free(buffer);
|
|
return 0;
|
|
}
|
|
Success = w32_GetXStateFeaturesMask(Context, &FeatureMask);
|
|
if (Success == FALSE) {
|
|
free(buffer);
|
|
return 0;
|
|
}
|
|
Xmm = (ut128 *)w32_LocateXStateFeature(Context, XSTATE_LEGACY_SSE, &FeatureLength);
|
|
nRegs = FeatureLength / sizeof(*Xmm);
|
|
for (Index = 0; Index < nRegs; Index++) {
|
|
ymm[Index].High = 0;
|
|
xmm[Index].High = 0;
|
|
ymm[Index].Low = 0;
|
|
xmm[Index].Low = 0;
|
|
}
|
|
if (Xmm != NULL) {
|
|
for (Index = 0; Index < nRegs; Index++) {
|
|
xmm[Index].High = Xmm[Index].High;
|
|
xmm[Index].Low = Xmm[Index].Low;
|
|
}
|
|
}
|
|
if ((FeatureMask & XSTATE_MASK_AVX) != 0) {
|
|
// check for AVX initialization and get the pointer.
|
|
Ymm = (ut128 *)w32_LocateXStateFeature(Context, XSTATE_AVX, NULL);
|
|
for (Index = 0; Index < nRegs; Index++) {
|
|
ymm[Index].High = Ymm[Index].High;
|
|
ymm[Index].Low = Ymm[Index].Low;
|
|
}
|
|
}
|
|
free(buffer);
|
|
return nRegs;
|
|
}
|
|
|
|
static void printwincontext(HANDLE hThread, CONTEXT * ctx) {
|
|
ut128 xmm[16];
|
|
ut128 ymm[16];
|
|
ut80 st[8];
|
|
ut64 mm[8];
|
|
ut16 top = 0;
|
|
int x = 0, nxmm = 0, nymm = 0;
|
|
#if __MINGW64__ || _WIN64
|
|
eprintf ("ControlWord = %08x StatusWord = %08x\n", ctx->FltSave.ControlWord, ctx->FltSave.StatusWord);
|
|
eprintf ("MxCsr = %08x TagWord = %08x\n", ctx->MxCsr, ctx->FltSave.TagWord);
|
|
eprintf ("ErrorOffset = %08x DataOffset = %08x\n", ctx->FltSave.ErrorOffset, ctx->FltSave.DataOffset);
|
|
eprintf ("ErrorSelector = %08x DataSelector = %08x\n", ctx->FltSave.ErrorSelector, ctx->FltSave.DataSelector);
|
|
for (x = 0; x < 8; x++) {
|
|
st[x].Low = ctx->FltSave.FloatRegisters[x].Low;
|
|
st[x].High = (ut16)ctx->FltSave.FloatRegisters[x].High;
|
|
}
|
|
top = (ctx->FltSave.StatusWord & 0x3fff) >> 11;
|
|
x = 0;
|
|
for (x = 0; x < 8; x++) {
|
|
mm[top] = ctx->FltSave.FloatRegisters[x].Low;
|
|
top++;
|
|
if (top > 7) {
|
|
top = 0;
|
|
}
|
|
}
|
|
for (x = 0; x < 16; x++) {
|
|
xmm[x].High = ctx->FltSave.XmmRegisters[x].High;
|
|
xmm[x].Low = ctx->FltSave.XmmRegisters[x].Low;
|
|
}
|
|
nxmm = 16;
|
|
#else
|
|
eprintf ("ControlWord = %08x StatusWord = %08x\n", (ut32) ctx->FloatSave.ControlWord, (ut32) ctx->FloatSave.StatusWord);
|
|
eprintf ("MxCsr = %08x TagWord = %08x\n", *(ut32 *)&ctx->ExtendedRegisters[24], (ut32)ctx->FloatSave.TagWord);
|
|
eprintf ("ErrorOffset = %08x DataOffset = %08x\n", (ut32)ctx->FloatSave.ErrorOffset, (ut32)ctx->FloatSave.DataOffset);
|
|
eprintf ("ErrorSelector = %08x DataSelector = %08x\n", (ut32)ctx->FloatSave.ErrorSelector, (ut32) ctx->FloatSave.DataSelector);
|
|
for (x = 0; x < 8; x++) {
|
|
st[x].High = (ut16) *((ut16 *)(&ctx->FloatSave.RegisterArea[x * 10] + 8));
|
|
st[x].Low = (ut64) *((ut64 *)&ctx->FloatSave.RegisterArea[x * 10]);
|
|
}
|
|
top = (ctx->FloatSave.StatusWord & 0x3fff) >> 11;
|
|
for (x = 0; x < 8; x++) {
|
|
mm[top] = *((ut64 *)&ctx->FloatSave.RegisterArea[x * 10]);
|
|
top++;
|
|
if (top>7) {
|
|
top = 0;
|
|
}
|
|
}
|
|
for (x = 0; x < 8; x++) {
|
|
xmm[x] = *((ut128 *)&ctx->ExtendedRegisters[(10 + x) * 16]);
|
|
}
|
|
nxmm = 8;
|
|
#endif
|
|
// show fpu,mm,xmm regs
|
|
for (x = 0; x < 8; x++) {
|
|
// the conversin from long double to double only work for compilers
|
|
// with long double size >=10 bytes (also we lost 2 bytes of precision)
|
|
// in mingw long double is 12 bytes size
|
|
// in msvc long double is alias for double = 8 bytes size
|
|
// in gcc long double is 10 bytes (correct representation)
|
|
eprintf ("ST%i %04x %016"PFMT64x" (%f)\n", x, st[x].High, st[x].Low, (double)(*((long double *)&st[x])));
|
|
}
|
|
for (x = 0; x < 8; x++) {
|
|
eprintf ("MM%i %016"PFMT64x"\n", x, mm[x]);
|
|
}
|
|
for (x = 0; x < nxmm; x++) {
|
|
eprintf ("XMM%i %016"PFMT64x" %016"PFMT64x"\n", x, xmm[x].High, xmm[x].Low);
|
|
}
|
|
// show Ymm regs
|
|
nymm = GetAVX (hThread, &xmm, &ymm);
|
|
if (nymm) {
|
|
for (x = 0; x < nymm; x++) {
|
|
eprintf ("Ymm%d: %016"PFMT64x" %016"PFMT64x" %016"PFMT64x" %016"PFMT64x"\n", x, ymm[x].High, ymm[x].Low, xmm[x].High, xmm[x].Low );
|
|
}
|
|
}
|
|
}
|
|
|
|
static int w32_reg_read (RDebug *dbg, int type, ut8 *buf, int size) {
|
|
#ifdef _MSC_VER
|
|
CONTEXT ctx;
|
|
#else
|
|
CONTEXT ctx __attribute__ ((aligned (16)));
|
|
#endif
|
|
int showfpu = false;
|
|
int pid = dbg->pid;
|
|
int tid = dbg->tid;
|
|
HANDLE hThread = NULL;
|
|
if (type < -1) {
|
|
showfpu = true; // hack for debugging
|
|
type = -type;
|
|
}
|
|
hThread = w32_open_thread (pid, tid);
|
|
memset(&ctx, 0, sizeof (CONTEXT));
|
|
ctx.ContextFlags = CONTEXT_ALL ;
|
|
if (GetThreadContext (hThread, &ctx) == TRUE) {
|
|
if (type == R_REG_TYPE_GPR) {
|
|
if (size > sizeof (CONTEXT)) {
|
|
size = sizeof (CONTEXT);
|
|
}
|
|
memcpy (buf, &ctx, size);
|
|
} else {
|
|
size = 0;
|
|
}
|
|
} else {
|
|
r_sys_perror ("w32_reg_read/GetThreadContext");
|
|
size = 0;
|
|
}
|
|
if (showfpu) {
|
|
printwincontext (hThread, &ctx);
|
|
}
|
|
CloseHandle(hThread);
|
|
return size;
|
|
}
|
|
|
|
static int w32_reg_write (RDebug *dbg, int type, const ut8* buf, int size) {
|
|
BOOL ret = false;
|
|
HANDLE thread;
|
|
#if _MSC_VER
|
|
CONTEXT ctx;
|
|
#else
|
|
CONTEXT ctx __attribute__((aligned (16)));
|
|
#endif
|
|
thread = w32_open_thread (dbg->pid, dbg->tid);
|
|
ctx.ContextFlags = CONTEXT_ALL;
|
|
GetThreadContext (thread, &ctx);
|
|
if (type == R_REG_TYPE_GPR) {
|
|
if (size > sizeof (CONTEXT)) {
|
|
size = sizeof (CONTEXT);
|
|
}
|
|
memcpy (&ctx, buf, size);
|
|
ret = SetThreadContext (thread, &ctx)? true: false;
|
|
}
|
|
CloseHandle (thread);
|
|
return ret;
|
|
}
|
|
|
|
static RDebugInfo* w32_info (RDebug *dbg, const char *arg) {
|
|
RDebugInfo *rdi = R_NEW0 (RDebugInfo);
|
|
rdi->status = R_DBG_PROC_SLEEP; // TODO: Fix this
|
|
rdi->pid = dbg->pid;
|
|
rdi->tid = dbg->tid;
|
|
rdi->lib = (void *) r_debug_get_lib_item();
|
|
rdi->thread = (void *)r_debug_get_thread_item ();
|
|
rdi->uid = -1;// TODO
|
|
rdi->gid = -1;// TODO
|
|
rdi->cwd = NULL;
|
|
rdi->exe = NULL;
|
|
rdi->cmdline = NULL;
|
|
rdi->libname = NULL;
|
|
return rdi;
|
|
}
|
|
|
|
#include "maps/windows.c"
|