Windows NT 4.0 source code leak
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

183 lines
4.5 KiB

/*++
Copyright (c) 1991 Microsoft Corporation
Module Name:
pcr.c
Abstract:
This module provides access to the pcr and a bang command to dump the pcr.
Author:
Wesley Witt (wesw) 26-Aug-1993 (ported to WinDbg)
Revision History:
--*/
#include "precomp.h"
#pragma hdrstop
DECLARE_API( pcr )
/*++
Routine Description:
Arguments:
args -
Return Value:
None
--*/
{
KPCR Pcr;
KPRCB Prcb;
PKPRCB PrcbSanity;
ULONG Address;
PKPCR pp;
NT_TIB Tib;
PNT_TIB pTib = &Tib;
USHORT Processor;
ULONG Result;
ULONG ScanSuccess;
ULONG KiProcessorBlockAddr;
//
// Apply to whichever processor user asks for
//
Processor = 0xffff; // default to current processor
PrcbSanity = (PKPRCB)0;
ScanSuccess = sscanf(args,"%lx",&Result);
if ( ScanSuccess ) {
if ( Result < 32 ) { // NT supports only 32 processors 0..31
Processor = (USHORT)Result;
KiProcessorBlockAddr = GetExpression( "&KiProcessorBlock" );
if ( KiProcessorBlockAddr ) {
KiProcessorBlockAddr += (Processor * sizeof(ULONG));
if (!ReadMemory( KiProcessorBlockAddr,
&PrcbSanity,
sizeof(ULONG),
&Result )) {
dprintf("Unable to read KiProcessorBlock[%u]\n",
Processor);
Processor = 0xffff;
} else if ( !PrcbSanity ) {
dprintf("KiProcessorBlock[%u] = 0!!!! Defaulting to current processor\n", Processor);
Processor = 0xffff;
}
} else {
dprintf("Unable to read symbol KiProcessorBlock\n");
}
}
}
pp = &Pcr;
if (!ReadPcr(Processor, (PVOID) pp, &Address,(HANDLE) NULL)) {
dprintf("Unable to read PCR for Processor %u\n", Processor);
return;
}
//
// pp->Prcb, read in the PRCB.
//
if (!ReadMemory((ULONG)pp->Prcb,(PULONG) &Prcb, sizeof(KPRCB), &Result)) {
dprintf("Unable to read PRCB for Processor %u\n", Processor);
return;
}
//
// pp->Teb, read the TIB structure from the thread environment block.
//
if (pp->Teb) {
if (!ReadMemory((ULONG)pp->Teb,(PULONG) &Tib, sizeof(NT_TIB), &Result)) {
dprintf("Unable to read TIB\n");
pp->Teb = NULL;
}
}
//
// Print out the PCR up through PrcbData, let dumpprcb print that.
//
dprintf("PCR Processor %ld @%08lx\n", pp->Number, Address);
dprintf("\t Kernel StackBase: %08lx\n", pp->InitialStack);
dprintf("\t SoftwareInterrupt: %08lx\n", pp->SoftwareInterrupt);
dprintf("\n");
dprintf("\t Prcb: %08lx\n", pp->Prcb);
dprintf("\t Current Irql: %08lx\n", (ULONG)pp->CurrentIrql);
dprintf("\n");
dprintf("\t CurrentThread: %08lx\n", Prcb.CurrentThread);
dprintf("\t NextThread: %08lx\n", Prcb.NextThread);
dprintf("\t IdleThread: %08lx\n", Prcb.IdleThread);
dprintf("\n");
if (pp->Teb) {
dprintf("\tNtTib.ExceptionList: %08lx\n", pTib->ExceptionList);
dprintf("\t NtTib.StackBase: %08lx\n", pTib->StackBase);
dprintf("\t NtTib.StackLimit: %08lx\n", pTib->StackLimit);
dprintf("\t NtTib.SubSystemTib: %08lx\n", pTib->SubSystemTib);
dprintf("\t NtTib.Version: %08lx\n", pTib->Version);
dprintf("\t NtTib.UserPointer: %08lx\n", pTib->ArbitraryUserPointer);
dprintf("\t NtTib.SelfTib: %08lx\n", pTib->Self);
dprintf("\n");
}
return;
}
BOOL
ReadPcr(
USHORT Processor,
PVOID Pcr,
PULONG AddressOfPcr,
HANDLE hThread
)
{
ULONG Result;
ULONG Address;
//
// Find base address of PCR for processor
//
if ( Processor == 0xffff ) {
//
// Default to current processor
//
Address = KIPCR;
} else {
//
// Find address of PCR for specified processor
//
ReadControlSpace(
(USHORT)Processor,
(sizeof(CONTEXT)+FIELD_OFFSET(KSPECIAL_REGISTERS,Sprg1)),
(PVOID)&Address,
sizeof(ULONG)
);
}
//
// Address -> base of the pcr, read the PCR in.
//
if (!ReadMemory(Address, Pcr, sizeof(KPCR), &Result)) {
return FALSE;
}
*AddressOfPcr = Address;
return TRUE;
}