windows-server-2003/termsrv/tsdbg/exts.cpp

/*-----------------------------------------------------------------------------
   Copyright (c) 2000  Microsoft Corporation

Module:
  exts.cpp

  Sampe file showing couple of extension examples

-----------------------------------------------------------------------------*/
#include "tsdbg.h"


bool IsUserDbg()
{
/*
// Specific types of kernel debuggees.
#define DEBUG_KERNEL_CONNECTION  0
#define DEBUG_KERNEL_LOCAL       1
#define DEBUG_KERNEL_EXDI_DRIVER 2
#define DEBUG_KERNEL_SMALL_DUMP  DEBUG_DUMP_SMALL
#define DEBUG_KERNEL_DUMP        DEBUG_DUMP_DEFAULT
#define DEBUG_KERNEL_FULL_DUMP   DEBUG_DUMP_FULL

// Specific types of Windows user debuggees.
#define DEBUG_USER_WINDOWS_PROCESS        0
#define DEBUG_USER_WINDOWS_PROCESS_SERVER 1
#define DEBUG_USER_WINDOWS_SMALL_DUMP     DEBUG_DUMP_SMALL
#define DEBUG_USER_WINDOWS_DUMP           DEBUG_DUMP_DEFAULT
*/

/*
#define DEBUG_CLASS_UNINITIALIZED 0
#define DEBUG_CLASS_KERNEL        1
#define DEBUG_CLASS_USER_WINDOWS  2
*/

    ULONG Class, Qualifier;

	// Figure out if this is KD or NTSD piped to KD.
	if (S_OK != g_ExtControl->GetDebuggeeType(&Class, &Qualifier))
    {
        dprintf("*** GetDebuggeeType failed ***\n\n");
    }
	if (Class == DEBUG_CLASS_USER_WINDOWS)
        return true;
	else
        return false;
}



/*
   Sample extension to demonstrace ececuting debugger command
   
 */
HRESULT CALLBACK 
cmdsample(PDEBUG_CLIENT Client, PCSTR args)
{
    CHAR Input[256];
    INIT_API();

    UNREFERENCED_PARAMETER(args);

    //
    // Output a 10 frame stack
    //
    g_ExtControl->OutputStackTrace(DEBUG_OUTCTL_ALL_CLIENTS |   // Flags on what to do with output
                                   DEBUG_OUTCTL_OVERRIDE_MASK |
                                   DEBUG_OUTCTL_NOT_LOGGED, 
                                   NULL, 
                                   10,           // number of frames to display
                                   DEBUG_STACK_FUNCTION_INFO | DEBUG_STACK_COLUMN_NAMES |
                                   DEBUG_STACK_ARGUMENTS | DEBUG_STACK_FRAME_ADDRESSES);
    //
    // Engine interface for print 
    //
    g_ExtControl->Output(DEBUG_OUTCTL_ALL_CLIENTS, "\n\nDebugger module list\n");
    
    //
    // list all the modules by executing lm command
    //
    g_ExtControl->Execute(DEBUG_OUTCTL_ALL_CLIENTS |
                          DEBUG_OUTCTL_OVERRIDE_MASK |
                          DEBUG_OUTCTL_NOT_LOGGED,
                          "lm", // Command to be executed
                          DEBUG_EXECUTE_DEFAULT );
    
    //
    // Ask for user input
    //
    g_ExtControl->Output(DEBUG_OUTCTL_ALL_CLIENTS, "\n\n***User Input sample\n\nEnter Command to run : ");
    GetInputLine(NULL, &Input[0], sizeof(Input));
    g_ExtControl->Execute(DEBUG_OUTCTL_ALL_CLIENTS |
                          DEBUG_OUTCTL_OVERRIDE_MASK |
                          DEBUG_OUTCTL_NOT_LOGGED,
                          Input, // Command to be executed
                          DEBUG_EXECUTE_DEFAULT );
    
    EXIT_API();
    return S_OK;
}

/*
  Sample extension to read and dump a struct on target
    
  This reads the struct _EXCEPTION_RECORD which is defined as:
  
  typedef struct _EXCEPTION_RECORD {
    NTSTATUS ExceptionCode;
    ULONG ExceptionFlags;
    struct _EXCEPTION_RECORD *ExceptionRecord;
    PVOID ExceptionAddress;
    ULONG NumberParameters;
    ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
    } EXCEPTION_RECORD;
*/
HRESULT CALLBACK 
structsample(PDEBUG_CLIENT /*Client*/, PCSTR /*args*/)
{
    /*
    ULONG64 Address;
    INIT_API();

    Address = GetExpression(args);
    
    DWORD Buffer[4], cb;

    // Read and display first 4 dwords at Address
    if (ReadMemory(Address, &Buffer, sizeof(Buffer), &cb) && cb == sizeof(Buffer)) {
        dprintf("%p: %08lx %08lx %08lx %08lx\n\n", Address,
                Buffer[0], Buffer[1], Buffer[2], Buffer[3]);
    }

    //
    // Method 1 to dump a struct
    //
    dprintf("Method 1:\n");
    // Inititalze type read from the Address
    if (InitTypeRead(Address, _EXCEPTION_RECORD) != 0) {
        dprintf("Error in reading _EXCEPTION_RECORD at %p", // Use %p to print pointer values
                Address);
    } else {
        // read and dump the fields
        dprintf("_EXCEPTION_RECORD @ %p\n", Address);
        dprintf("\tExceptionCode           : %lx\n", (ULONG) ReadField(ExceptionCode));
        dprintf("\tExceptionAddress        : %p\n", ReadField(ExceptionAddress));
        dprintf("\tExceptionInformation[1] : %I64lx\n", ReadField(ExceptionInformation[1]));
        // And so on...
    }

    //
    // Method 2 to read a struct
    //
    ULONG64 ExceptionInformation_1, ExceptionAddress, ExceptionCode;
    dprintf("\n\nMethod 2:\n");
    // Read and dump the fields by specifying type and address individually 
    if (GetFieldValue(Address, "_EXCEPTION_RECORD", "ExceptionCode", ExceptionCode)) {
        dprintf("Error in reading _EXCEPTION_RECORD at %p\n",
                Address);
    } else {
        // Pointers are read as ULONG64 values
        GetFieldValue(Address, "_EXCEPTION_RECORD", "ExceptionAddress", ExceptionAddress);
        GetFieldValue(Address, "_EXCEPTION_RECORD", "ExceptionInformation[1]", ExceptionInformation_1);
        // And so on..
        
        dprintf("_EXCEPTION_RECORD @ %p\n", Address);
        dprintf("\tExceptionCode           : %lx\n", ExceptionCode);
        dprintf("\tExceptionAddress        : %p\n", ExceptionAddress);
        dprintf("\tExceptionInformation[1] : %I64lx\n", ExceptionInformation_1);
    }

    ULONG64 Module;
    ULONG   i, TypeId;
    CHAR Name[MAX_PATH];
    //
    // To get/list field names
    //
    g_ExtSymbols->GetSymbolTypeId("_EXCEPTION_RECORD", &TypeId, &Module);
    dprintf("Fields of _EXCEPTION_RECORD\n");
    for (i=0; ;i++) {
	HRESULT Hr;
	ULONG Offset=0;

	Hr = g_ExtSymbols2->GetFieldName(Module, TypeId, i, Name, MAX_PATH, NULL);
	if (Hr == S_OK) {
	    g_ExtSymbols->GetFieldOffset(Module, TypeId, Name, &Offset);
	    dprintf("%lx (+%03lx) %s\n", i, Offset, Name);
	} else if (Hr == E_INVALIDARG) {
	    // All Fields done
	    break;
	} else {
	    dprintf("GetFieldName Failed %lx\n", Hr);
	    break;
	}
    }

    //
    // Get name for an enumerate
    //
    //     typedef enum {
    //        Enum1,
    //	      Enum2,
    //        Enum3,
    //     } TEST_ENUM;
    //
    ULONG   ValueOfEnum = 0;
    g_ExtSymbols->GetSymbolTypeId("TEST_ENUM", &TypeId, &Module);
    g_ExtSymbols2->GetConstantName(Module, TypeId, ValueOfEnum, Name, MAX_PATH, NULL);
    dprintf("Testenum %I64lx == %s\n", ExceptionCode, Name);
    // This prints out, Testenum 0 == Enum1

    //
    // Read an array
    //
    //    typedef struct FOO_TYPE {
    //      ULONG Bar;
    //      ULONG Bar2;
    //    } FOO_TYPE;
    //
    //    FOO_TYPE sampleArray[20];
    ULONG Bar, Bar2;
    CHAR TypeName[100];
    for (i=0; i<20; i++) {
	sprintf(TypeName, "sampleArray[%lx]", i);
	if (GetFieldValue(0, TypeName, "Bar", Bar)) 
	    break;
	GetFieldValue(0, TypeName, "Bar2", Bar2);
	dprintf("%16s -  Bar %2ld  Bar2 %ld\n", TypeName, Bar, Bar2);
    }

    EXIT_API();
    */
    return S_OK;
    
}

/*
  This gets called (by DebugExtensionNotify whentarget is halted and is accessible
*/
HRESULT 
NotifyOnTargetAccessible(PDEBUG_CONTROL  /* Control */)
{/*
    dprintf("Extension dll detected a break");
    if (Connected) {
        dprintf(" connected to ");
        switch (TargetMachine) { 
        case IMAGE_FILE_MACHINE_I386:
            dprintf("X86");
            break;
        case IMAGE_FILE_MACHINE_AMD64:
            dprintf("AMD64");
            break;
        case IMAGE_FILE_MACHINE_IA64:
            dprintf("IA64");
            break;
        default:
            dprintf("Other");
            break;
        }
    }
    dprintf("\n");
    
    //
    // show the top frame and execute dv to dump the locals here and return
    //
    Control->Execute(DEBUG_OUTCTL_ALL_CLIENTS |
                     DEBUG_OUTCTL_OVERRIDE_MASK |
                     DEBUG_OUTCTL_NOT_LOGGED,
                     ".frame", // Command to be executed
                     DEBUG_EXECUTE_DEFAULT );
    Control->Execute(DEBUG_OUTCTL_ALL_CLIENTS |
                     DEBUG_OUTCTL_OVERRIDE_MASK |
                     DEBUG_OUTCTL_NOT_LOGGED,
                     "dv", // Command to be executed
                     DEBUG_EXECUTE_DEFAULT );
*/
    return S_OK;
}

/*
  A built-in help for the extension dll
*/
HRESULT CALLBACK 
help(PDEBUG_CLIENT Client, PCSTR args)
{
    INIT_API();

    UNREFERENCED_PARAMETER(args);

    dprintf("Help for tsdbg.dll\n"
            "  qwinsta             - lists winstation data structures\n"
            "  help                = Shows this help\n"
            // "  structsample <addr> - This dumps a struct at given address\n"
            //"  cmdsample           - This does stacktrace and lists\n"
            );
    EXIT_API();

    return S_OK;
}


void PrintBuildNumber()
{
    ULONG64 Address;
    Address = GetExpression("poi(nt!ntbuildnumber)");

    
    if (Address & 0xf0000000)
    {
        Address &= 0x0fffffff;
        dprintf("Build Number = %d Free\n", Address);
        
    }
    else if (Address & 0xc0000000)
    {
        Address &= 0x0fffffff;
        dprintf("Build Number = %d Chk\n", Address);
     
    }
    else
    {
        dprintf("Error getting Build Number!\n");
        
    }

}




HRESULT CALLBACK 
qwinsta(PDEBUG_CLIENT Client, PCSTR args)
{
    ULONG64 winstationlisthead, FLink;
    ULONG64 TermSrvProcPerTermDD = 0;


    bool bDebugMode = false;

    INIT_API();

    dprintf("qwinsta 1.2\n");
    
    if (strstr(args, "debug"))
        bDebugMode = true;

    if (bDebugMode)
    {
        dprintf("*** in debug mode *** \n");
    }

    if (bDebugMode)
        dprintf("IsUserDebugger = %s\n", (IsUserDbg() ? "true" : "false"));


    dprintf("----------------------------------------------------------------------------------------------------\n");
    //
    // Find Termsrv proccess id.
    //
    if (!IsUserDbg())
    {
        TermSrvProcPerTermDD = GetExpression("poi(termdd!g_TermServProcessID)");
        dprintf("termsrv process    = %p \n", TermSrvProcPerTermDD);

        if (!TermSrvProcPerTermDD)
        {
            dprintf("ERROR:tsdbg failed to retrive the value for termdd!g_TermServProcessID\n");
            dprintf("please make sure that the symbols are alright\n");
            goto doneError;
        }
      
        ULONG64 ImpliciteProcess;
        g_ExtSysObjects2->GetImplicitProcessDataOffset(&ImpliciteProcess);
        dprintf("Implicit Process   = %p \n", ImpliciteProcess);

        ULONG64 CurrentProcess;
        g_ExtSysObjects2->GetCurrentProcessDataOffset(&CurrentProcess);
        dprintf("current Process    = %p \n", CurrentProcess);

        if (ImpliciteProcess != TermSrvProcPerTermDD)
        {
            dprintf("ERROR:tsdbg for this command to work current implicite process must be termsrv.\n");
            dprintf("please do .process /p %p and then try again.\n", TermSrvProcPerTermDD);
            goto doneError;
        }
    }

    //
    // get active console session id.
    //
    LONG ActiveConsoleId = STATUS_UNSUCCESSFUL;
    if (GetFieldValue((ULONG64) MM_SHARED_USER_DATA_VA, "termsrv!KUSER_SHARED_DATA", "ActiveConsoleId", ActiveConsoleId))
        ActiveConsoleId = STATUS_UNSUCCESSFUL;
    
    dprintf("ActiveConsoleId    = %d \n", ActiveConsoleId);

    //
    // winstation list head.
    //
    winstationlisthead = GetExpression("termsrv!winstationlisthead");
    if (!winstationlisthead)
    {
        dprintf("ERROR:tsdbg failed to retrive the value for termsrv!winstationlisthead\n");
        dprintf("please make sure that the symbols are alright\n");
        goto doneError;
    }

    dprintf("winstationlisthead = %p \n", winstationlisthead);

    if (GetFieldValue(winstationlisthead, "termsrv!LIST_ENTRY", "Flink", FLink))
    {
        dprintf("failed to get winstationlisthead.flink\n\n");
        goto doneError;
    }

    UINT uiWinstations = 0;

    //
    // print winstation list.
    //
    dprintf("----------------------------------------------------------------------------------------------------\n");
    dprintf("%8s", "Winsta");
    dprintf("  ");
    dprintf("%7s",  "LogonId");
    dprintf("  ");
    dprintf("%-10s", "Name");
    dprintf("  ");
    dprintf("%-22s", "State");
    dprintf("  ");
    dprintf("%8s",  "Flags");
    dprintf("  ");
    dprintf("%8s",  "SFlags");
    dprintf("  ");
    dprintf("%-10s", "Starting");
    dprintf("  ");
    dprintf("%-10s", "Terminating");
    dprintf("\n");
    while (winstationlisthead != FLink && uiWinstations < 500)
    {
        if (CheckControlC()) goto doneError;

        uiWinstations++;
        ULONG ret = 0;

        ULONG LogonId, State, Flags, StateFlags;
        WCHAR WinStationName[33];
        UCHAR Starting, Terminating;

        
        // InitTypeRead(FLink, Type)

        ret += GetFieldValue(FLink, "termsrv!_WINSTATION", "LogonId", LogonId);
        ret += GetFieldValue(FLink, "termsrv!_WINSTATION", "WinStationName", WinStationName);
        ret += GetFieldValue(FLink, "termsrv!_WINSTATION", "State", State);
        ret += GetFieldValue(FLink, "termsrv!_WINSTATION", "Flags", Flags);
        ret += GetFieldValue(FLink, "termsrv!_WINSTATION", "Starting", Starting);
        ret += GetFieldValue(FLink, "termsrv!_WINSTATION", "LogonId", LogonId);
        ret += GetFieldValue(FLink, "termsrv!_WINSTATION", "Terminating", Terminating);
        ret += GetFieldValue(FLink, "termsrv!_WINSTATION", "StateFlags", StateFlags);
        

        //
        // get string value for the enum _WINSTATIONSTATECLASS.
        //
        ULONG64 Module;
        ULONG   TypeId;
        char StateName[MAX_PATH];
        g_ExtSymbols->GetSymbolTypeId("_WINSTATIONSTATECLASS", &TypeId, &Module);
        g_ExtSymbols2->GetConstantName(Module, TypeId, State, StateName, MAX_PATH, NULL);

        if (ret)
        {
            dprintf("failed to get winstationlisthead.flink\n\n");
            goto doneError;
        }

        dprintf("%p", FLink);
        dprintf("  ");
        dprintf("%#7x",  LogonId);
        dprintf("  ");
        dprintf("%-10S", WinStationName);
        dprintf("  ");
        dprintf("%1x:%-20s", State, StateName);
        dprintf("  ");
        dprintf("%08x", Flags);
        dprintf("  ");
        dprintf("%08x", StateFlags);
        dprintf("  ");
        dprintf("%-10s", (Starting ? "True" : "False"));
        dprintf("  ");
        dprintf("%-10s", (Terminating ? "True" : "False"));
        dprintf("\n");
    
        //dprintf("%10p %7d %-10S %5d:%-20s %5d %10d %-8s %-11s\n", FLink, LogonId, WinStationName, State, StateName, Flags, StateFlags, (Starting ? "true" : "false"), (Terminating ? "true" : "false"));

        if (GetFieldValue(FLink, "termsrv!LIST_ENTRY", "Flink", FLink))
        {
            dprintf("failed to get winstationlisthead.flink\n\n");
            goto doneError;
        }


    }
    dprintf("----------------------------------------------------------------------------------------------------\n");
    // dprintf("Total Winstations = %d\n", uiWinstations);
    

doneError:

    EXIT_API();
    return S_OK;
}