Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

2498 lines
65 KiB

  1. /*++
  2. Copyright (c) Microsoft Corporation. All rights reserved.
  3. Module Name:
  4. wdbgexts.h
  5. Abstract:
  6. This file contains the necessary prototypes and data types for a user
  7. to write a debugger extension DLL. This header file is also included
  8. by the NT debuggers (WINDBG & KD).
  9. This header file must be included after "windows.h" and "dbghelp.h".
  10. Please see the NT DDK documentation for specific information about
  11. how to write your own debugger extension DLL.
  12. Environment:
  13. Win32 only.
  14. Revision History:
  15. --*/
  16. #ifndef _WDBGEXTS_
  17. #define _WDBGEXTS_
  18. #if _MSC_VER > 1000
  19. #pragma once
  20. #endif
  21. #ifdef __cplusplus
  22. extern "C" {
  23. #endif
  24. #if !defined(WDBGAPI)
  25. #define WDBGAPI __stdcall
  26. #endif
  27. #if !defined(WDBGAPIV)
  28. #define WDBGAPIV __cdecl
  29. #endif
  30. #ifndef _WINDEF_
  31. typedef CONST void *LPCVOID;
  32. #endif
  33. #ifndef _ULONGLONG_
  34. typedef unsigned __int64 ULONGLONG;
  35. typedef ULONGLONG *PULONGLONG;
  36. #endif
  37. typedef
  38. VOID
  39. (WDBGAPIV*PWINDBG_OUTPUT_ROUTINE)(
  40. PCSTR lpFormat,
  41. ...
  42. );
  43. typedef
  44. ULONG_PTR
  45. (WDBGAPI*PWINDBG_GET_EXPRESSION)(
  46. PCSTR lpExpression
  47. );
  48. typedef
  49. ULONG
  50. (WDBGAPI*PWINDBG_GET_EXPRESSION32)(
  51. PCSTR lpExpression
  52. );
  53. typedef
  54. ULONG64
  55. (WDBGAPI*PWINDBG_GET_EXPRESSION64)(
  56. PCSTR lpExpression
  57. );
  58. typedef
  59. VOID
  60. (WDBGAPI*PWINDBG_GET_SYMBOL)(
  61. PVOID offset,
  62. PCHAR pchBuffer,
  63. ULONG_PTR *pDisplacement
  64. );
  65. typedef
  66. VOID
  67. (WDBGAPI*PWINDBG_GET_SYMBOL32)(
  68. ULONG offset,
  69. PCHAR pchBuffer,
  70. PULONG pDisplacement
  71. );
  72. typedef
  73. VOID
  74. (WDBGAPI*PWINDBG_GET_SYMBOL64)(
  75. ULONG64 offset,
  76. PCHAR pchBuffer,
  77. PULONG64 pDisplacement
  78. );
  79. typedef
  80. ULONG
  81. (WDBGAPI*PWINDBG_DISASM)(
  82. ULONG_PTR *lpOffset,
  83. PCSTR lpBuffer,
  84. ULONG fShowEffectiveAddress
  85. );
  86. typedef
  87. ULONG
  88. (WDBGAPI*PWINDBG_DISASM32)(
  89. ULONG *lpOffset,
  90. PCSTR lpBuffer,
  91. ULONG fShowEffectiveAddress
  92. );
  93. typedef
  94. ULONG
  95. (WDBGAPI*PWINDBG_DISASM64)(
  96. ULONG64 *lpOffset,
  97. PCSTR lpBuffer,
  98. ULONG fShowEffectiveAddress
  99. );
  100. typedef
  101. ULONG
  102. (WDBGAPI*PWINDBG_CHECK_CONTROL_C)(
  103. VOID
  104. );
  105. typedef
  106. ULONG
  107. (WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE)(
  108. ULONG_PTR offset,
  109. PVOID lpBuffer,
  110. ULONG cb,
  111. PULONG lpcbBytesRead
  112. );
  113. typedef
  114. ULONG
  115. (WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE32)(
  116. ULONG offset,
  117. PVOID lpBuffer,
  118. ULONG cb,
  119. PULONG lpcbBytesRead
  120. );
  121. typedef
  122. ULONG
  123. (WDBGAPI*PWINDBG_READ_PROCESS_MEMORY_ROUTINE64)(
  124. ULONG64 offset,
  125. PVOID lpBuffer,
  126. ULONG cb,
  127. PULONG lpcbBytesRead
  128. );
  129. typedef
  130. ULONG
  131. (WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE)(
  132. ULONG_PTR offset,
  133. LPCVOID lpBuffer,
  134. ULONG cb,
  135. PULONG lpcbBytesWritten
  136. );
  137. typedef
  138. ULONG
  139. (WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32)(
  140. ULONG offset,
  141. LPCVOID lpBuffer,
  142. ULONG cb,
  143. PULONG lpcbBytesWritten
  144. );
  145. typedef
  146. ULONG
  147. (WDBGAPI*PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE64)(
  148. ULONG64 offset,
  149. LPCVOID lpBuffer,
  150. ULONG cb,
  151. PULONG lpcbBytesWritten
  152. );
  153. typedef
  154. ULONG
  155. (WDBGAPI*PWINDBG_GET_THREAD_CONTEXT_ROUTINE)(
  156. ULONG Processor,
  157. PCONTEXT lpContext,
  158. ULONG cbSizeOfContext
  159. );
  160. typedef
  161. ULONG
  162. (WDBGAPI*PWINDBG_SET_THREAD_CONTEXT_ROUTINE)(
  163. ULONG Processor,
  164. PCONTEXT lpContext,
  165. ULONG cbSizeOfContext
  166. );
  167. typedef
  168. ULONG
  169. (WDBGAPI*PWINDBG_IOCTL_ROUTINE)(
  170. USHORT IoctlType,
  171. PVOID lpvData,
  172. ULONG cbSize
  173. );
  174. typedef
  175. ULONG
  176. (WDBGAPI*PWINDBG_OLDKD_READ_PHYSICAL_MEMORY)(
  177. ULONGLONG address,
  178. PVOID buffer,
  179. ULONG count,
  180. PULONG bytesread
  181. );
  182. typedef
  183. ULONG
  184. (WDBGAPI*PWINDBG_OLDKD_WRITE_PHYSICAL_MEMORY)(
  185. ULONGLONG address,
  186. PVOID buffer,
  187. ULONG length,
  188. PULONG byteswritten
  189. );
  190. typedef struct _EXTSTACKTRACE {
  191. ULONG FramePointer;
  192. ULONG ProgramCounter;
  193. ULONG ReturnAddress;
  194. ULONG Args[4];
  195. } EXTSTACKTRACE, *PEXTSTACKTRACE;
  196. typedef struct _EXTSTACKTRACE32 {
  197. ULONG FramePointer;
  198. ULONG ProgramCounter;
  199. ULONG ReturnAddress;
  200. ULONG Args[4];
  201. } EXTSTACKTRACE32, *PEXTSTACKTRACE32;
  202. typedef struct _EXTSTACKTRACE64 {
  203. ULONG64 FramePointer;
  204. ULONG64 ProgramCounter;
  205. ULONG64 ReturnAddress;
  206. ULONG64 Args[4];
  207. } EXTSTACKTRACE64, *PEXTSTACKTRACE64;
  208. typedef
  209. ULONG
  210. (WDBGAPI*PWINDBG_STACKTRACE_ROUTINE)(
  211. ULONG FramePointer,
  212. ULONG StackPointer,
  213. ULONG ProgramCounter,
  214. PEXTSTACKTRACE StackFrames,
  215. ULONG Frames
  216. );
  217. typedef
  218. ULONG
  219. (WDBGAPI*PWINDBG_STACKTRACE_ROUTINE32)(
  220. ULONG FramePointer,
  221. ULONG StackPointer,
  222. ULONG ProgramCounter,
  223. PEXTSTACKTRACE32 StackFrames,
  224. ULONG Frames
  225. );
  226. typedef
  227. ULONG
  228. (WDBGAPI*PWINDBG_STACKTRACE_ROUTINE64)(
  229. ULONG64 FramePointer,
  230. ULONG64 StackPointer,
  231. ULONG64 ProgramCounter,
  232. PEXTSTACKTRACE64 StackFrames,
  233. ULONG Frames
  234. );
  235. typedef struct _WINDBG_EXTENSION_APIS {
  236. ULONG nSize;
  237. PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
  238. PWINDBG_GET_EXPRESSION lpGetExpressionRoutine;
  239. PWINDBG_GET_SYMBOL lpGetSymbolRoutine;
  240. PWINDBG_DISASM lpDisasmRoutine;
  241. PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
  242. PWINDBG_READ_PROCESS_MEMORY_ROUTINE lpReadProcessMemoryRoutine;
  243. PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE lpWriteProcessMemoryRoutine;
  244. PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;
  245. PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;
  246. PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;
  247. PWINDBG_STACKTRACE_ROUTINE lpStackTraceRoutine;
  248. } WINDBG_EXTENSION_APIS, *PWINDBG_EXTENSION_APIS;
  249. typedef struct _WINDBG_EXTENSION_APIS32 {
  250. ULONG nSize;
  251. PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
  252. PWINDBG_GET_EXPRESSION32 lpGetExpressionRoutine;
  253. PWINDBG_GET_SYMBOL32 lpGetSymbolRoutine;
  254. PWINDBG_DISASM32 lpDisasmRoutine;
  255. PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
  256. PWINDBG_READ_PROCESS_MEMORY_ROUTINE32 lpReadProcessMemoryRoutine;
  257. PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32 lpWriteProcessMemoryRoutine;
  258. PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;
  259. PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;
  260. PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;
  261. PWINDBG_STACKTRACE_ROUTINE32 lpStackTraceRoutine;
  262. } WINDBG_EXTENSION_APIS32, *PWINDBG_EXTENSION_APIS32;
  263. typedef struct _WINDBG_EXTENSION_APIS64 {
  264. ULONG nSize;
  265. PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
  266. PWINDBG_GET_EXPRESSION64 lpGetExpressionRoutine;
  267. PWINDBG_GET_SYMBOL64 lpGetSymbolRoutine;
  268. PWINDBG_DISASM64 lpDisasmRoutine;
  269. PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
  270. PWINDBG_READ_PROCESS_MEMORY_ROUTINE64 lpReadProcessMemoryRoutine;
  271. PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE64 lpWriteProcessMemoryRoutine;
  272. PWINDBG_GET_THREAD_CONTEXT_ROUTINE lpGetThreadContextRoutine;
  273. PWINDBG_SET_THREAD_CONTEXT_ROUTINE lpSetThreadContextRoutine;
  274. PWINDBG_IOCTL_ROUTINE lpIoctlRoutine;
  275. PWINDBG_STACKTRACE_ROUTINE64 lpStackTraceRoutine;
  276. } WINDBG_EXTENSION_APIS64, *PWINDBG_EXTENSION_APIS64;
  277. typedef struct _WINDBG_OLD_EXTENSION_APIS {
  278. ULONG nSize;
  279. PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
  280. PWINDBG_GET_EXPRESSION lpGetExpressionRoutine;
  281. PWINDBG_GET_SYMBOL lpGetSymbolRoutine;
  282. PWINDBG_DISASM lpDisasmRoutine;
  283. PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
  284. } WINDBG_OLD_EXTENSION_APIS, *PWINDBG_OLD_EXTENSION_APIS;
  285. typedef struct _WINDBG_OLDKD_EXTENSION_APIS {
  286. ULONG nSize;
  287. PWINDBG_OUTPUT_ROUTINE lpOutputRoutine;
  288. PWINDBG_GET_EXPRESSION32 lpGetExpressionRoutine;
  289. PWINDBG_GET_SYMBOL32 lpGetSymbolRoutine;
  290. PWINDBG_DISASM32 lpDisasmRoutine;
  291. PWINDBG_CHECK_CONTROL_C lpCheckControlCRoutine;
  292. PWINDBG_READ_PROCESS_MEMORY_ROUTINE32 lpReadVirtualMemRoutine;
  293. PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE32 lpWriteVirtualMemRoutine;
  294. PWINDBG_OLDKD_READ_PHYSICAL_MEMORY lpReadPhysicalMemRoutine;
  295. PWINDBG_OLDKD_WRITE_PHYSICAL_MEMORY lpWritePhysicalMemRoutine;
  296. } WINDBG_OLDKD_EXTENSION_APIS, *PWINDBG_OLDKD_EXTENSION_APIS;
  297. typedef
  298. VOID
  299. (WDBGAPI*PWINDBG_OLD_EXTENSION_ROUTINE)(
  300. ULONG dwCurrentPc,
  301. PWINDBG_EXTENSION_APIS lpExtensionApis,
  302. PCSTR lpArgumentString
  303. );
  304. typedef
  305. VOID
  306. (WDBGAPI*PWINDBG_EXTENSION_ROUTINE)(
  307. HANDLE hCurrentProcess,
  308. HANDLE hCurrentThread,
  309. ULONG dwCurrentPc,
  310. ULONG dwProcessor,
  311. PCSTR lpArgumentString
  312. );
  313. typedef
  314. VOID
  315. (WDBGAPI*PWINDBG_EXTENSION_ROUTINE32)(
  316. HANDLE hCurrentProcess,
  317. HANDLE hCurrentThread,
  318. ULONG dwCurrentPc,
  319. ULONG dwProcessor,
  320. PCSTR lpArgumentString
  321. );
  322. typedef
  323. VOID
  324. (WDBGAPI*PWINDBG_EXTENSION_ROUTINE64)(
  325. HANDLE hCurrentProcess,
  326. HANDLE hCurrentThread,
  327. ULONG64 dwCurrentPc,
  328. ULONG dwProcessor,
  329. PCSTR lpArgumentString
  330. );
  331. typedef
  332. VOID
  333. (WDBGAPI*PWINDBG_OLDKD_EXTENSION_ROUTINE)(
  334. ULONG dwCurrentPc,
  335. PWINDBG_OLDKD_EXTENSION_APIS lpExtensionApis,
  336. PCSTR lpArgumentString
  337. );
  338. typedef
  339. VOID
  340. (WDBGAPI*PWINDBG_EXTENSION_DLL_INIT)(
  341. PWINDBG_EXTENSION_APIS lpExtensionApis,
  342. USHORT MajorVersion,
  343. USHORT MinorVersion
  344. );
  345. typedef
  346. VOID
  347. (WDBGAPI*PWINDBG_EXTENSION_DLL_INIT32)(
  348. PWINDBG_EXTENSION_APIS32 lpExtensionApis,
  349. USHORT MajorVersion,
  350. USHORT MinorVersion
  351. );
  352. typedef
  353. VOID
  354. (WDBGAPI*PWINDBG_EXTENSION_DLL_INIT64)(
  355. PWINDBG_EXTENSION_APIS64 lpExtensionApis,
  356. USHORT MajorVersion,
  357. USHORT MinorVersion
  358. );
  359. typedef
  360. ULONG
  361. (WDBGAPI*PWINDBG_CHECK_VERSION)(
  362. VOID
  363. );
  364. #define EXT_API_VERSION_NUMBER 5
  365. #define EXT_API_VERSION_NUMBER32 5
  366. #define EXT_API_VERSION_NUMBER64 6
  367. typedef struct EXT_API_VERSION {
  368. USHORT MajorVersion;
  369. USHORT MinorVersion;
  370. USHORT Revision;
  371. USHORT Reserved;
  372. } EXT_API_VERSION, *LPEXT_API_VERSION;
  373. typedef
  374. LPEXT_API_VERSION
  375. (WDBGAPI*PWINDBG_EXTENSION_API_VERSION)(
  376. VOID
  377. );
  378. #define IG_KD_CONTEXT 1
  379. #define IG_READ_CONTROL_SPACE 2
  380. #define IG_WRITE_CONTROL_SPACE 3
  381. #define IG_READ_IO_SPACE 4
  382. #define IG_WRITE_IO_SPACE 5
  383. #define IG_READ_PHYSICAL 6
  384. #define IG_WRITE_PHYSICAL 7
  385. #define IG_READ_IO_SPACE_EX 8
  386. #define IG_WRITE_IO_SPACE_EX 9
  387. #define IG_KSTACK_HELP 10 // obsolete
  388. #define IG_SET_THREAD 11
  389. #define IG_READ_MSR 12
  390. #define IG_WRITE_MSR 13
  391. #define IG_GET_DEBUGGER_DATA 14
  392. #define IG_GET_KERNEL_VERSION 15
  393. #define IG_RELOAD_SYMBOLS 16
  394. #define IG_GET_SET_SYMPATH 17
  395. #define IG_GET_EXCEPTION_RECORD 18
  396. #define IG_IS_PTR64 19
  397. #define IG_GET_BUS_DATA 20
  398. #define IG_SET_BUS_DATA 21
  399. #define IG_DUMP_SYMBOL_INFO 22
  400. #define IG_LOWMEM_CHECK 23
  401. #define IG_SEARCH_MEMORY 24
  402. #define IG_GET_CURRENT_THREAD 25
  403. #define IG_GET_CURRENT_PROCESS 26
  404. #define IG_GET_TYPE_SIZE 27
  405. #define IG_GET_CURRENT_PROCESS_HANDLE 28
  406. #define IG_GET_INPUT_LINE 29
  407. #define IG_GET_EXPRESSION_EX 30
  408. #define IG_TRANSLATE_VIRTUAL_TO_PHYSICAL 31
  409. #define IG_GET_CACHE_SIZE 32
  410. #define IG_READ_PHYSICAL_WITH_FLAGS 33
  411. #define IG_WRITE_PHYSICAL_WITH_FLAGS 34
  412. #define IG_POINTER_SEARCH_PHYSICAL 35
  413. #define IG_GET_COR_DATA_ACCESS 36
  414. #define IG_GET_TEB_ADDRESS 128
  415. #define IG_GET_PEB_ADDRESS 129
  416. typedef struct _PROCESSORINFO {
  417. USHORT Processor; // current processor
  418. USHORT NumberProcessors; // total number of processors
  419. } PROCESSORINFO, *PPROCESSORINFO;
  420. typedef struct _READCONTROLSPACE {
  421. USHORT Processor;
  422. ULONG Address;
  423. ULONG BufLen;
  424. UCHAR Buf[1];
  425. } READCONTROLSPACE, *PREADCONTROLSPACE;
  426. typedef struct _READCONTROLSPACE32 {
  427. USHORT Processor;
  428. ULONG Address;
  429. ULONG BufLen;
  430. UCHAR Buf[1];
  431. } READCONTROLSPACE32, *PREADCONTROLSPACE32;
  432. typedef struct _READCONTROLSPACE64 {
  433. USHORT Processor;
  434. ULONG64 Address;
  435. ULONG BufLen;
  436. UCHAR Buf[1];
  437. } READCONTROLSPACE64, *PREADCONTROLSPACE64;
  438. typedef struct _IOSPACE {
  439. ULONG Address;
  440. ULONG Length; // 1, 2, or 4 bytes
  441. ULONG Data;
  442. } IOSPACE, *PIOSPACE;
  443. typedef struct _IOSPACE32 {
  444. ULONG Address;
  445. ULONG Length; // 1, 2, or 4 bytes
  446. ULONG Data;
  447. } IOSPACE32, *PIOSPACE32;
  448. typedef struct _IOSPACE64 {
  449. ULONG64 Address;
  450. ULONG Length; // 1, 2, or 4 bytes
  451. ULONG Data;
  452. } IOSPACE64, *PIOSPACE64;
  453. typedef struct _IOSPACE_EX {
  454. ULONG Address;
  455. ULONG Length; // 1, 2, or 4 bytes
  456. ULONG Data;
  457. ULONG InterfaceType;
  458. ULONG BusNumber;
  459. ULONG AddressSpace;
  460. } IOSPACE_EX, *PIOSPACE_EX;
  461. typedef struct _IOSPACE_EX32 {
  462. ULONG Address;
  463. ULONG Length; // 1, 2, or 4 bytes
  464. ULONG Data;
  465. ULONG InterfaceType;
  466. ULONG BusNumber;
  467. ULONG AddressSpace;
  468. } IOSPACE_EX32, *PIOSPACE_EX32;
  469. typedef struct _IOSPACE_EX64 {
  470. ULONG64 Address;
  471. ULONG Length; // 1, 2, or 4 bytes
  472. ULONG Data;
  473. ULONG InterfaceType;
  474. ULONG BusNumber;
  475. ULONG AddressSpace;
  476. } IOSPACE_EX64, *PIOSPACE_EX64;
  477. typedef struct _GETSETBUSDATA {
  478. ULONG BusDataType;
  479. ULONG BusNumber;
  480. ULONG SlotNumber;
  481. PVOID Buffer;
  482. ULONG Offset;
  483. ULONG Length;
  484. } BUSDATA, *PBUSDATA;
  485. typedef struct _SEARCHMEMORY {
  486. ULONG64 SearchAddress;
  487. ULONG64 SearchLength;
  488. ULONG64 FoundAddress;
  489. ULONG PatternLength;
  490. PVOID Pattern;
  491. } SEARCHMEMORY, *PSEARCHMEMORY;
  492. typedef struct _PHYSICAL {
  493. ULONGLONG Address;
  494. ULONG BufLen;
  495. UCHAR Buf[1];
  496. } PHYSICAL, *PPHYSICAL;
  497. #define PHYS_FLAG_DEFAULT 0
  498. #define PHYS_FLAG_CACHED 1
  499. #define PHYS_FLAG_UNCACHED 2
  500. #define PHYS_FLAG_WRITE_COMBINED 3
  501. typedef struct _PHYSICAL_WITH_FLAGS {
  502. ULONGLONG Address;
  503. ULONG BufLen;
  504. ULONG Flags;
  505. UCHAR Buf[1];
  506. } PHYSICAL_WITH_FLAGS, *PPHYSICAL_WITH_FLAGS;
  507. typedef struct _READ_WRITE_MSR {
  508. ULONG Msr;
  509. LONGLONG Value;
  510. } READ_WRITE_MSR, *PREAD_WRITE_MSR;
  511. typedef struct _GET_SET_SYMPATH {
  512. PCSTR Args; // args to !reload command
  513. PSTR Result; // returns new path
  514. int Length; // Length of result buffer
  515. } GET_SET_SYMPATH, *PGET_SET_SYMPATH;
  516. typedef struct _GET_TEB_ADDRESS {
  517. ULONGLONG Address;
  518. } GET_TEB_ADDRESS, *PGET_TEB_ADDRESS;
  519. typedef struct _GET_PEB_ADDRESS {
  520. ULONG64 CurrentThread;
  521. ULONGLONG Address;
  522. } GET_PEB_ADDRESS, *PGET_PEB_ADDRESS;
  523. typedef struct _GET_CURRENT_THREAD_ADDRESS {
  524. ULONG Processor;
  525. ULONG64 Address;
  526. } GET_CURRENT_THREAD_ADDRESS, *PGET_CURRENT_THREAD_ADDRESS;
  527. typedef struct _GET_CURRENT_PROCESS_ADDRESS {
  528. ULONG Processor;
  529. ULONG64 CurrentThread;
  530. ULONG64 Address;
  531. } GET_CURRENT_PROCESS_ADDRESS, *PGET_CURRENT_PROCESS_ADDRESS;
  532. typedef struct _GET_INPUT_LINE {
  533. PCSTR Prompt;
  534. PSTR Buffer;
  535. ULONG BufferSize;
  536. ULONG InputSize;
  537. } GET_INPUT_LINE, *PGET_INPUT_LINE;
  538. typedef struct _GET_EXPRESSION_EX {
  539. PCSTR Expression;
  540. PCSTR Remainder;
  541. ULONG64 Value;
  542. } GET_EXPRESSION_EX, *PGET_EXPRESSION_EX;
  543. typedef struct _TRANSLATE_VIRTUAL_TO_PHYSICAL {
  544. ULONG64 Virtual;
  545. ULONG64 Physical;
  546. } TRANSLATE_VIRTUAL_TO_PHYSICAL, *PTRANSLATE_VIRTUAL_TO_PHYSICAL;
  547. #define PTR_SEARCH_PHYS_ALL_HITS 0x00000001
  548. #define PTR_SEARCH_PHYS_PTE 0x00000002
  549. #define PTR_SEARCH_NO_SYMBOL_CHECK 0x80000000
  550. typedef struct _POINTER_SEARCH_PHYSICAL {
  551. IN ULONG64 Offset;
  552. IN ULONG64 Length;
  553. IN ULONG64 PointerMin;
  554. IN ULONG64 PointerMax;
  555. IN ULONG Flags;
  556. OUT PULONG64 MatchOffsets;
  557. IN ULONG MatchOffsetsSize;
  558. OUT ULONG MatchOffsetsCount;
  559. } POINTER_SEARCH_PHYSICAL, *PPOINTER_SEARCH_PHYSICAL;
  560. //
  561. // If DBGKD_VERS_FLAG_DATA is set in Flags, info should be retrieved from
  562. // the KDDEBUGGER_DATA block rather than from the DBGKD_GET_VERSION
  563. // packet. The data will remain in the version packet for a while to
  564. // reduce compatibility problems.
  565. //
  566. #define DBGKD_VERS_FLAG_MP 0x0001 // kernel is MP built
  567. #define DBGKD_VERS_FLAG_DATA 0x0002 // DebuggerDataList is valid
  568. #define DBGKD_VERS_FLAG_PTR64 0x0004 // native pointers are 64 bits
  569. #define DBGKD_VERS_FLAG_NOMM 0x0008 // No MM - don't decode PTEs
  570. #define DBGKD_VERS_FLAG_HSS 0x0010 // hardware stepping support
  571. #define DBGKD_VERS_FLAG_PARTITIONS 0x0020 // multiple OS partitions exist
  572. #define KDBG_TAG 'GBDK'
  573. //
  574. // KD version MajorVersion high-byte identifiers.
  575. //
  576. typedef enum _DBGKD_MAJOR_TYPES
  577. {
  578. DBGKD_MAJOR_NT,
  579. DBGKD_MAJOR_XBOX,
  580. DBGKD_MAJOR_BIG,
  581. DBGKD_MAJOR_EXDI,
  582. DBGKD_MAJOR_NTBD,
  583. DBGKD_MAJOR_EFI,
  584. DBGKD_MAJOR_TNT,
  585. DBGKD_MAJOR_COUNT
  586. } DBGKD_MAJOR_TYPES;
  587. #define DBGKD_MAJOR_TYPE(MajorVersion) \
  588. ((DBGKD_MAJOR_TYPES)((MajorVersion) >> 8))
  589. // **********************************************************************
  590. // DO NOT CHANGE THESE 32 BIT STRUCTURES!
  591. // ONLY MAKE CHAGES TO THE 64 BIT VERSION BELOW!!
  592. // **********************************************************************
  593. //
  594. // The following structure has changed in more than pointer size.
  595. //
  596. // This is the version packet for pre-NT5 Beta 2 systems.
  597. // For now, it is also still used on x86
  598. //
  599. typedef struct _DBGKD_GET_VERSION32 {
  600. USHORT MajorVersion;
  601. USHORT MinorVersion;
  602. USHORT ProtocolVersion;
  603. USHORT Flags;
  604. ULONG KernBase;
  605. ULONG PsLoadedModuleList;
  606. USHORT MachineType;
  607. //
  608. // help for walking stacks with user callbacks:
  609. //
  610. //
  611. // The address of the thread structure is provided in the
  612. // WAIT_STATE_CHANGE packet. This is the offset from the base of
  613. // the thread structure to the pointer to the kernel stack frame
  614. // for the currently active usermode callback.
  615. //
  616. USHORT ThCallbackStack; // offset in thread data
  617. //
  618. // these values are offsets into that frame:
  619. //
  620. USHORT NextCallback; // saved pointer to next callback frame
  621. USHORT FramePointer; // saved frame pointer
  622. //
  623. // Address of the kernel callout routine.
  624. //
  625. ULONG KiCallUserMode; // kernel routine
  626. //
  627. // Address of the usermode entry point for callbacks.
  628. //
  629. ULONG KeUserCallbackDispatcher; // address in ntdll
  630. //
  631. // DbgBreakPointWithStatus is a function which takes a ULONG argument
  632. // and hits a breakpoint. This field contains the address of the
  633. // breakpoint instruction. When the debugger sees a breakpoint
  634. // at this address, it may retrieve the argument from the first
  635. // argument register, or on x86 the eax register.
  636. //
  637. ULONG BreakpointWithStatus; // address of breakpoint
  638. //
  639. // Components may register a debug data block for use by
  640. // debugger extensions. This is the address of the list head.
  641. //
  642. ULONG DebuggerDataList;
  643. } DBGKD_GET_VERSION32, *PDBGKD_GET_VERSION32;
  644. //
  645. // This is the debugger data packet for pre NT5 Beta 2 systems.
  646. // For now, it is still used on x86
  647. //
  648. typedef struct _DBGKD_DEBUG_DATA_HEADER32 {
  649. LIST_ENTRY32 List;
  650. ULONG OwnerTag;
  651. ULONG Size;
  652. } DBGKD_DEBUG_DATA_HEADER32, *PDBGKD_DEBUG_DATA_HEADER32;
  653. typedef struct _KDDEBUGGER_DATA32 {
  654. DBGKD_DEBUG_DATA_HEADER32 Header;
  655. ULONG KernBase;
  656. ULONG BreakpointWithStatus; // address of breakpoint
  657. ULONG SavedContext;
  658. USHORT ThCallbackStack; // offset in thread data
  659. USHORT NextCallback; // saved pointer to next callback frame
  660. USHORT FramePointer; // saved frame pointer
  661. USHORT PaeEnabled:1;
  662. ULONG KiCallUserMode; // kernel routine
  663. ULONG KeUserCallbackDispatcher; // address in ntdll
  664. ULONG PsLoadedModuleList;
  665. ULONG PsActiveProcessHead;
  666. ULONG PspCidTable;
  667. ULONG ExpSystemResourcesList;
  668. ULONG ExpPagedPoolDescriptor;
  669. ULONG ExpNumberOfPagedPools;
  670. ULONG KeTimeIncrement;
  671. ULONG KeBugCheckCallbackListHead;
  672. ULONG KiBugcheckData;
  673. ULONG IopErrorLogListHead;
  674. ULONG ObpRootDirectoryObject;
  675. ULONG ObpTypeObjectType;
  676. ULONG MmSystemCacheStart;
  677. ULONG MmSystemCacheEnd;
  678. ULONG MmSystemCacheWs;
  679. ULONG MmPfnDatabase;
  680. ULONG MmSystemPtesStart;
  681. ULONG MmSystemPtesEnd;
  682. ULONG MmSubsectionBase;
  683. ULONG MmNumberOfPagingFiles;
  684. ULONG MmLowestPhysicalPage;
  685. ULONG MmHighestPhysicalPage;
  686. ULONG MmNumberOfPhysicalPages;
  687. ULONG MmMaximumNonPagedPoolInBytes;
  688. ULONG MmNonPagedSystemStart;
  689. ULONG MmNonPagedPoolStart;
  690. ULONG MmNonPagedPoolEnd;
  691. ULONG MmPagedPoolStart;
  692. ULONG MmPagedPoolEnd;
  693. ULONG MmPagedPoolInformation;
  694. ULONG MmPageSize;
  695. ULONG MmSizeOfPagedPoolInBytes;
  696. ULONG MmTotalCommitLimit;
  697. ULONG MmTotalCommittedPages;
  698. ULONG MmSharedCommit;
  699. ULONG MmDriverCommit;
  700. ULONG MmProcessCommit;
  701. ULONG MmPagedPoolCommit;
  702. ULONG MmExtendedCommit;
  703. ULONG MmZeroedPageListHead;
  704. ULONG MmFreePageListHead;
  705. ULONG MmStandbyPageListHead;
  706. ULONG MmModifiedPageListHead;
  707. ULONG MmModifiedNoWritePageListHead;
  708. ULONG MmAvailablePages;
  709. ULONG MmResidentAvailablePages;
  710. ULONG PoolTrackTable;
  711. ULONG NonPagedPoolDescriptor;
  712. ULONG MmHighestUserAddress;
  713. ULONG MmSystemRangeStart;
  714. ULONG MmUserProbeAddress;
  715. ULONG KdPrintCircularBuffer;
  716. ULONG KdPrintCircularBufferEnd;
  717. ULONG KdPrintWritePointer;
  718. ULONG KdPrintRolloverCount;
  719. ULONG MmLoadedUserImageList;
  720. } KDDEBUGGER_DATA32, *PKDDEBUGGER_DATA32;
  721. // **********************************************************************
  722. //
  723. // DO NOT CHANGE KDDEBUGGER_DATA32!!
  724. // ONLY MAKE CHANGES TO KDDEBUGGER_DATA64!!!
  725. //
  726. // **********************************************************************
  727. enum
  728. {
  729. DBGKD_SIMULATION_NONE,
  730. DBGKD_SIMULATION_EXDI
  731. };
  732. typedef struct _DBGKD_GET_VERSION64 {
  733. USHORT MajorVersion;
  734. USHORT MinorVersion;
  735. USHORT ProtocolVersion;
  736. USHORT Flags;
  737. USHORT MachineType;
  738. //
  739. // Protocol command support descriptions.
  740. // These allow the debugger to automatically
  741. // adapt to different levels of command support
  742. // in different kernels.
  743. //
  744. // One beyond highest packet type understood, zero based.
  745. UCHAR MaxPacketType;
  746. // One beyond highest state change understood, zero based.
  747. UCHAR MaxStateChange;
  748. // One beyond highest state manipulate message understood, zero based.
  749. UCHAR MaxManipulate;
  750. // Kind of execution environment the kernel is running in,
  751. // such as a real machine or a simulator. Written back
  752. // by the simulation if one exists.
  753. UCHAR Simulation;
  754. USHORT Unused[1];
  755. ULONG64 KernBase;
  756. ULONG64 PsLoadedModuleList;
  757. //
  758. // Components may register a debug data block for use by
  759. // debugger extensions. This is the address of the list head.
  760. //
  761. // There will always be an entry for the debugger.
  762. //
  763. ULONG64 DebuggerDataList;
  764. } DBGKD_GET_VERSION64, *PDBGKD_GET_VERSION64;
  765. //
  766. // This structure is used by the debugger for all targets
  767. // It is the same size as DBGKD_DATA_HEADER on all systems
  768. //
  769. typedef struct _DBGKD_DEBUG_DATA_HEADER64 {
  770. //
  771. // Link to other blocks
  772. //
  773. LIST_ENTRY64 List;
  774. //
  775. // This is a unique tag to identify the owner of the block.
  776. // If your component only uses one pool tag, use it for this, too.
  777. //
  778. ULONG OwnerTag;
  779. //
  780. // This must be initialized to the size of the data block,
  781. // including this structure.
  782. //
  783. ULONG Size;
  784. } DBGKD_DEBUG_DATA_HEADER64, *PDBGKD_DEBUG_DATA_HEADER64;
  785. //
  786. // This structure is the same size on all systems. The only field
  787. // which must be translated by the debugger is Header.List.
  788. //
  789. //
  790. // DO NOT ADD OR REMOVE FIELDS FROM THE MIDDLE OF THIS STRUCTURE!!!
  791. //
  792. // If you remove a field, replace it with an "unused" placeholder.
  793. // Do not reuse fields until there has been enough time for old debuggers
  794. // and extensions to age out.
  795. //
  796. typedef struct _KDDEBUGGER_DATA64 {
  797. DBGKD_DEBUG_DATA_HEADER64 Header;
  798. //
  799. // Base address of kernel image
  800. //
  801. ULONG64 KernBase;
  802. //
  803. // DbgBreakPointWithStatus is a function which takes an argument
  804. // and hits a breakpoint. This field contains the address of the
  805. // breakpoint instruction. When the debugger sees a breakpoint
  806. // at this address, it may retrieve the argument from the first
  807. // argument register, or on x86 the eax register.
  808. //
  809. ULONG64 BreakpointWithStatus; // address of breakpoint
  810. //
  811. // Address of the saved context record during a bugcheck
  812. //
  813. // N.B. This is an automatic in KeBugcheckEx's frame, and
  814. // is only valid after a bugcheck.
  815. //
  816. ULONG64 SavedContext;
  817. //
  818. // help for walking stacks with user callbacks:
  819. //
  820. //
  821. // The address of the thread structure is provided in the
  822. // WAIT_STATE_CHANGE packet. This is the offset from the base of
  823. // the thread structure to the pointer to the kernel stack frame
  824. // for the currently active usermode callback.
  825. //
  826. USHORT ThCallbackStack; // offset in thread data
  827. //
  828. // these values are offsets into that frame:
  829. //
  830. USHORT NextCallback; // saved pointer to next callback frame
  831. USHORT FramePointer; // saved frame pointer
  832. //
  833. // pad to a quad boundary
  834. //
  835. USHORT PaeEnabled:1;
  836. //
  837. // Address of the kernel callout routine.
  838. //
  839. ULONG64 KiCallUserMode; // kernel routine
  840. //
  841. // Address of the usermode entry point for callbacks.
  842. //
  843. ULONG64 KeUserCallbackDispatcher; // address in ntdll
  844. //
  845. // Addresses of various kernel data structures and lists
  846. // that are of interest to the kernel debugger.
  847. //
  848. ULONG64 PsLoadedModuleList;
  849. ULONG64 PsActiveProcessHead;
  850. ULONG64 PspCidTable;
  851. ULONG64 ExpSystemResourcesList;
  852. ULONG64 ExpPagedPoolDescriptor;
  853. ULONG64 ExpNumberOfPagedPools;
  854. ULONG64 KeTimeIncrement;
  855. ULONG64 KeBugCheckCallbackListHead;
  856. ULONG64 KiBugcheckData;
  857. ULONG64 IopErrorLogListHead;
  858. ULONG64 ObpRootDirectoryObject;
  859. ULONG64 ObpTypeObjectType;
  860. ULONG64 MmSystemCacheStart;
  861. ULONG64 MmSystemCacheEnd;
  862. ULONG64 MmSystemCacheWs;
  863. ULONG64 MmPfnDatabase;
  864. ULONG64 MmSystemPtesStart;
  865. ULONG64 MmSystemPtesEnd;
  866. ULONG64 MmSubsectionBase;
  867. ULONG64 MmNumberOfPagingFiles;
  868. ULONG64 MmLowestPhysicalPage;
  869. ULONG64 MmHighestPhysicalPage;
  870. ULONG64 MmNumberOfPhysicalPages;
  871. ULONG64 MmMaximumNonPagedPoolInBytes;
  872. ULONG64 MmNonPagedSystemStart;
  873. ULONG64 MmNonPagedPoolStart;
  874. ULONG64 MmNonPagedPoolEnd;
  875. ULONG64 MmPagedPoolStart;
  876. ULONG64 MmPagedPoolEnd;
  877. ULONG64 MmPagedPoolInformation;
  878. ULONG64 MmPageSize;
  879. ULONG64 MmSizeOfPagedPoolInBytes;
  880. ULONG64 MmTotalCommitLimit;
  881. ULONG64 MmTotalCommittedPages;
  882. ULONG64 MmSharedCommit;
  883. ULONG64 MmDriverCommit;
  884. ULONG64 MmProcessCommit;
  885. ULONG64 MmPagedPoolCommit;
  886. ULONG64 MmExtendedCommit;
  887. ULONG64 MmZeroedPageListHead;
  888. ULONG64 MmFreePageListHead;
  889. ULONG64 MmStandbyPageListHead;
  890. ULONG64 MmModifiedPageListHead;
  891. ULONG64 MmModifiedNoWritePageListHead;
  892. ULONG64 MmAvailablePages;
  893. ULONG64 MmResidentAvailablePages;
  894. ULONG64 PoolTrackTable;
  895. ULONG64 NonPagedPoolDescriptor;
  896. ULONG64 MmHighestUserAddress;
  897. ULONG64 MmSystemRangeStart;
  898. ULONG64 MmUserProbeAddress;
  899. ULONG64 KdPrintCircularBuffer;
  900. ULONG64 KdPrintCircularBufferEnd;
  901. ULONG64 KdPrintWritePointer;
  902. ULONG64 KdPrintRolloverCount;
  903. ULONG64 MmLoadedUserImageList;
  904. // NT 5.1 Addition
  905. ULONG64 NtBuildLab;
  906. ULONG64 KiNormalSystemCall;
  907. // NT 5.0 QFE addition
  908. ULONG64 KiProcessorBlock;
  909. ULONG64 MmUnloadedDrivers;
  910. ULONG64 MmLastUnloadedDriver;
  911. ULONG64 MmTriageActionTaken;
  912. ULONG64 MmSpecialPoolTag;
  913. ULONG64 KernelVerifier;
  914. ULONG64 MmVerifierData;
  915. ULONG64 MmAllocatedNonPagedPool;
  916. ULONG64 MmPeakCommitment;
  917. ULONG64 MmTotalCommitLimitMaximum;
  918. ULONG64 CmNtCSDVersion;
  919. // NT 5.1 Addition
  920. ULONG64 MmPhysicalMemoryBlock;
  921. ULONG64 MmSessionBase;
  922. ULONG64 MmSessionSize;
  923. ULONG64 MmSystemParentTablePage;
  924. // Server 2003 addition
  925. ULONG64 MmVirtualTranslationBase;
  926. USHORT OffsetKThreadNextProcessor;
  927. USHORT OffsetKThreadTeb;
  928. USHORT OffsetKThreadKernelStack;
  929. USHORT OffsetKThreadInitialStack;
  930. USHORT OffsetKThreadApcProcess;
  931. USHORT OffsetKThreadState;
  932. USHORT OffsetKThreadBStore;
  933. USHORT OffsetKThreadBStoreLimit;
  934. USHORT SizeEProcess;
  935. USHORT OffsetEprocessPeb;
  936. USHORT OffsetEprocessParentCID;
  937. USHORT OffsetEprocessDirectoryTableBase;
  938. USHORT SizePrcb;
  939. USHORT OffsetPrcbDpcRoutine;
  940. USHORT OffsetPrcbCurrentThread;
  941. USHORT OffsetPrcbMhz;
  942. USHORT OffsetPrcbCpuType;
  943. USHORT OffsetPrcbVendorString;
  944. USHORT OffsetPrcbProcStateContext;
  945. USHORT OffsetPrcbNumber;
  946. USHORT SizeEThread;
  947. ULONG64 KdPrintCircularBufferPtr;
  948. ULONG64 KdPrintBufferSize;
  949. ULONG64 KeLoaderBlock;
  950. USHORT SizePcr;
  951. USHORT OffsetPcrSelfPcr;
  952. USHORT OffsetPcrCurrentPrcb;
  953. USHORT OffsetPcrContainedPrcb;
  954. USHORT OffsetPcrInitialBStore;
  955. USHORT OffsetPcrBStoreLimit;
  956. USHORT OffsetPcrInitialStack;
  957. USHORT OffsetPcrStackLimit;
  958. USHORT OffsetPrcbPcrPage;
  959. USHORT OffsetPrcbProcStateSpecialReg;
  960. USHORT GdtR0Code;
  961. USHORT GdtR0Data;
  962. USHORT GdtR0Pcr;
  963. USHORT GdtR3Code;
  964. USHORT GdtR3Data;
  965. USHORT GdtR3Teb;
  966. USHORT GdtLdt;
  967. USHORT GdtTss;
  968. USHORT Gdt64R3CmCode;
  969. USHORT Gdt64R3CmTeb;
  970. ULONG64 IopNumTriageDumpDataBlocks;
  971. ULONG64 IopTriageDumpDataBlocks;
  972. } KDDEBUGGER_DATA64, *PKDDEBUGGER_DATA64;
  973. /************************************
  974. Type Dump Ioctl
  975. *************************************/
  976. //
  977. // Fields are not indented if this is set
  978. //
  979. #define DBG_DUMP_NO_INDENT 0x00000001
  980. //
  981. // Offsets are not printed if this is set
  982. //
  983. #define DBG_DUMP_NO_OFFSET 0x00000002
  984. //
  985. // Verbose output
  986. //
  987. #define DBG_DUMP_VERBOSE 0x00000004
  988. //
  989. // Callback is done for each of fields
  990. //
  991. #define DBG_DUMP_CALL_FOR_EACH 0x00000008
  992. //
  993. // A list of type is dumped, listLink should have info about next element pointer
  994. //
  995. #define DBG_DUMP_LIST 0x00000020
  996. //
  997. // Nothing is printed if this is set (only callbacks and data copies done)
  998. //
  999. #define DBG_DUMP_NO_PRINT 0x00000040
  1000. //
  1001. // Ioctl returns the size as usual, but will not do field prints/callbacks if this is set
  1002. //
  1003. #define DBG_DUMP_GET_SIZE_ONLY 0x00000080
  1004. //
  1005. // Specifies how much deep into structs we can go
  1006. //
  1007. #define DBG_DUMP_RECUR_LEVEL(l) ((l & 0xf) << 8)
  1008. //
  1009. // No newlines are printed after each field
  1010. //
  1011. #define DBG_DUMP_COMPACT_OUT 0x00002000
  1012. //
  1013. // An array of type is dumped, number of elements can be specified in listLink->size
  1014. //
  1015. #define DBG_DUMP_ARRAY 0x00008000
  1016. //
  1017. // The specified addr value is actually the address of field listLink->fName
  1018. //
  1019. #define DBG_DUMP_ADDRESS_OF_FIELD 0x00010000
  1020. //
  1021. // The specified addr value is actually the adress at the end of type
  1022. //
  1023. #define DBG_DUMP_ADDRESS_AT_END 0x00020000
  1024. //
  1025. // This could be used to copy only the primitive types like ULONG, PVOID etc.
  1026. // - will not work with structures/unions
  1027. //
  1028. #define DBG_DUMP_COPY_TYPE_DATA 0x00040000
  1029. //
  1030. // Flag to allow read directly from physical memory
  1031. //
  1032. #define DBG_DUMP_READ_PHYSICAL 0x00080000
  1033. //
  1034. // This causes a function type to be dumped in format function(arg1, arg2, ...)
  1035. //
  1036. #define DBG_DUMP_FUNCTION_FORMAT 0x00100000
  1037. //
  1038. // This recurses on a struct but doesn't expand pointers
  1039. //
  1040. #define DBG_DUMP_BLOCK_RECURSE 0x00200000
  1041. //
  1042. // Obsolete defs
  1043. //
  1044. #define DBG_RETURN_TYPE 0
  1045. #define DBG_RETURN_SUBTYPES 0
  1046. #define DBG_RETURN_TYPE_VALUES 0
  1047. //
  1048. // Dump and callback optons for fields - Options used in FIELD_INFO.fOptions
  1049. //
  1050. //
  1051. // Callback is done before printing the field if this is set
  1052. //
  1053. #define DBG_DUMP_FIELD_CALL_BEFORE_PRINT 0x00000001
  1054. //
  1055. // No callback is done
  1056. //
  1057. #define DBG_DUMP_FIELD_NO_CALLBACK_REQ 0x00000002
  1058. //
  1059. // Subfields of the fields are processesed
  1060. //
  1061. #define DBG_DUMP_FIELD_RECUR_ON_THIS 0x00000004
  1062. //
  1063. // fName must match completely for the field to be dumped instead just a prefix
  1064. // match by default
  1065. //
  1066. #define DBG_DUMP_FIELD_FULL_NAME 0x00000008
  1067. //
  1068. // This causes array elements of an array field to be printed
  1069. //
  1070. #define DBG_DUMP_FIELD_ARRAY 0x00000010
  1071. //
  1072. // The data of the field is copied into fieldCallBack
  1073. //
  1074. #define DBG_DUMP_FIELD_COPY_FIELD_DATA 0x00000020
  1075. //
  1076. // In callback or when Ioctl returns, the FIELD_INFO.address has the address of field.
  1077. // If no address is supplied for the type, it contains total offset of the field.
  1078. //
  1079. #define DBG_DUMP_FIELD_RETURN_ADDRESS 0x00001000
  1080. //
  1081. // Return the offset and size in bits instead of bytes is case of Bitfield
  1082. //
  1083. #define DBG_DUMP_FIELD_SIZE_IN_BITS 0x00002000
  1084. //
  1085. // Nothing is printed for field if this is set (only callbacks and data copies done)
  1086. //
  1087. #define DBG_DUMP_FIELD_NO_PRINT 0x00004000
  1088. //
  1089. // If the field is a pointer, it is dumped as a string, ANSI, WCHAR, MULTI or GUID
  1090. // depending on following options
  1091. //
  1092. #define DBG_DUMP_FIELD_DEFAULT_STRING 0x00010000
  1093. #define DBG_DUMP_FIELD_WCHAR_STRING 0x00020000
  1094. #define DBG_DUMP_FIELD_MULTI_STRING 0x00040000
  1095. #define DBG_DUMP_FIELD_GUID_STRING 0x00080000
  1096. //
  1097. // Error status returned on TYPE DUMP Ioctl failure
  1098. //
  1099. #define MEMORY_READ_ERROR 0x01
  1100. #define SYMBOL_TYPE_INDEX_NOT_FOUND 0x02
  1101. #define SYMBOL_TYPE_INFO_NOT_FOUND 0x03
  1102. #define FIELDS_DID_NOT_MATCH 0x04
  1103. #define NULL_SYM_DUMP_PARAM 0x05
  1104. #define NULL_FIELD_NAME 0x06
  1105. #define INCORRECT_VERSION_INFO 0x07
  1106. #define EXIT_ON_CONTROLC 0x08
  1107. #define CANNOT_ALLOCATE_MEMORY 0x09
  1108. #define INSUFFICIENT_SPACE_TO_COPY 0x0a
  1109. //////////////////////////////////////////////////////////////////////////*/
  1110. typedef
  1111. ULONG
  1112. (WDBGAPI*PSYM_DUMP_FIELD_CALLBACK)(
  1113. struct _FIELD_INFO *pField,
  1114. PVOID UserContext
  1115. );
  1116. typedef struct _FIELD_INFO {
  1117. PUCHAR fName; // Name of the field
  1118. PUCHAR printName; // Name to be printed at dump
  1119. ULONG size; // Size of the field
  1120. ULONG fOptions; // Dump Options for the field
  1121. ULONG64 address; // address of the field
  1122. union {
  1123. PVOID fieldCallBack; // Return info or callBack routine for the field
  1124. PVOID pBuffer; // the type data is copied into this
  1125. };
  1126. ULONG TypeId; // OUT Type index of the field
  1127. ULONG FieldOffset; // OUT Offset of field inside struct
  1128. ULONG BufferSize; // size of buffer used with DBG_DUMP_FIELD_COPY_FIELD_DATA
  1129. struct _BitField {
  1130. USHORT Position; // OUT set to start position for bitfield
  1131. USHORT Size; // OUT set to size for bitfields
  1132. } BitField;
  1133. ULONG fPointer:1; // OUT set to 1 for pointers
  1134. } FIELD_INFO, *PFIELD_INFO;
  1135. typedef struct _SYM_DUMP_PARAM {
  1136. ULONG size; // size of this struct
  1137. PUCHAR sName; // type name
  1138. ULONG Options; // Dump options
  1139. ULONG64 addr; // Address to take data for type
  1140. PFIELD_INFO listLink; // fName here would be used to do list dump
  1141. union {
  1142. PVOID Context; // Usercontext passed to CallbackRoutine
  1143. PVOID pBuffer; // the type data is copied into this
  1144. };
  1145. PSYM_DUMP_FIELD_CALLBACK CallbackRoutine;
  1146. // Routine called back
  1147. ULONG nFields; // # elements in Fields
  1148. PFIELD_INFO Fields; // Used to return information about field
  1149. ULONG64 ModBase; // OUT Module base address containing type
  1150. ULONG TypeId; // OUT Type index of the symbol
  1151. ULONG TypeSize; // OUT Size of type
  1152. ULONG BufferSize; // IN size of buffer (used with DBG_DUMP_COPY_TYPE_DATA)
  1153. ULONG fPointer:1; // OUT set to 1 for pointers
  1154. } SYM_DUMP_PARAM, *PSYM_DUMP_PARAM;
  1155. #ifdef __cplusplus
  1156. #define CPPMOD extern "C"
  1157. #else
  1158. #define CPPMOD
  1159. #endif
  1160. #ifndef NOEXTAPI
  1161. #if defined(KDEXT_64BIT)
  1162. #define WINDBG_EXTENSION_APIS WINDBG_EXTENSION_APIS64
  1163. #define PWINDBG_EXTENSION_APIS PWINDBG_EXTENSION_APIS64
  1164. #define DECLARE_API(s) DECLARE_API64(s)
  1165. #elif defined(KDEXT_32BIT)
  1166. #define WINDBG_EXTENSION_APIS WINDBG_EXTENSION_APIS32
  1167. #define PWINDBG_EXTENSION_APIS PWINDBG_EXTENSION_APIS32
  1168. #define DECLARE_API(s) DECLARE_API32(s)
  1169. #else
  1170. #define DECLARE_API(s) \
  1171. CPPMOD VOID \
  1172. s( \
  1173. HANDLE hCurrentProcess, \
  1174. HANDLE hCurrentThread, \
  1175. ULONG dwCurrentPc, \
  1176. ULONG dwProcessor, \
  1177. PCSTR args \
  1178. )
  1179. #endif
  1180. #define DECLARE_API32(s) \
  1181. CPPMOD VOID \
  1182. s( \
  1183. HANDLE hCurrentProcess, \
  1184. HANDLE hCurrentThread, \
  1185. ULONG dwCurrentPc, \
  1186. ULONG dwProcessor, \
  1187. PCSTR args \
  1188. )
  1189. #define DECLARE_API64(s) \
  1190. CPPMOD VOID \
  1191. s( \
  1192. HANDLE hCurrentProcess, \
  1193. HANDLE hCurrentThread, \
  1194. ULONG64 dwCurrentPc, \
  1195. ULONG dwProcessor, \
  1196. PCSTR args \
  1197. )
  1198. extern WINDBG_EXTENSION_APIS ExtensionApis;
  1199. #define dprintf (ExtensionApis.lpOutputRoutine)
  1200. #define GetExpression (ExtensionApis.lpGetExpressionRoutine)
  1201. #define CheckControlC (ExtensionApis.lpCheckControlCRoutine)
  1202. #define GetContext (ExtensionApis.lpGetThreadContextRoutine)
  1203. #define SetContext (ExtensionApis.lpSetThreadContextRoutine)
  1204. #define Ioctl (ExtensionApis.lpIoctlRoutine)
  1205. #define Disasm (ExtensionApis.lpDisasmRoutine)
  1206. #define GetSymbol (ExtensionApis.lpGetSymbolRoutine)
  1207. #define ReadMemory (ExtensionApis.lpReadProcessMemoryRoutine)
  1208. #define WriteMemory (ExtensionApis.lpWriteProcessMemoryRoutine)
  1209. #define StackTrace (ExtensionApis.lpStackTraceRoutine)
  1210. #define GetKdContext(ppi) \
  1211. Ioctl( IG_KD_CONTEXT, (PVOID)ppi, sizeof(*ppi) )
  1212. //
  1213. // BOOL
  1214. // GetDebuggerData(
  1215. // ULONG Tag,
  1216. // PVOID Buf,
  1217. // ULONG Size
  1218. // )
  1219. //
  1220. #define GetDebuggerData(TAG, BUF, SIZE) \
  1221. ( (((PDBGKD_DEBUG_DATA_HEADER64)(BUF))->OwnerTag = (TAG)), \
  1222. (((PDBGKD_DEBUG_DATA_HEADER64)(BUF))->Size = (SIZE)), \
  1223. Ioctl( IG_GET_DEBUGGER_DATA, (PVOID)(BUF), (SIZE) ) )
  1224. // Check if LocalAlloc is prototyped
  1225. //#ifdef _WINBASE_
  1226. __inline VOID
  1227. ReadPhysical(
  1228. ULONG64 address,
  1229. PVOID buf,
  1230. ULONG size,
  1231. PULONG sizer
  1232. )
  1233. {
  1234. PPHYSICAL phy;
  1235. *sizer = 0;
  1236. phy = (PPHYSICAL)LocalAlloc(LPTR, sizeof(*phy) + size );
  1237. if (phy) {
  1238. ZeroMemory( phy->Buf, size );
  1239. phy->Address = address;
  1240. phy->BufLen = size;
  1241. Ioctl( IG_READ_PHYSICAL, (PVOID)phy, sizeof(*phy) + size );
  1242. *sizer = phy->BufLen;
  1243. CopyMemory( buf, phy->Buf, *sizer );
  1244. LocalFree( phy );
  1245. }
  1246. }
  1247. __inline VOID
  1248. WritePhysical(
  1249. ULONG64 address,
  1250. PVOID buf,
  1251. ULONG size,
  1252. PULONG sizew
  1253. )
  1254. {
  1255. PPHYSICAL phy;
  1256. *sizew = 0;
  1257. phy = (PPHYSICAL)LocalAlloc(LPTR, sizeof(*phy) + size );
  1258. if (phy) {
  1259. ZeroMemory( phy->Buf, size );
  1260. phy->Address = address;
  1261. phy->BufLen = size;
  1262. CopyMemory( phy->Buf, buf, size );
  1263. Ioctl( IG_WRITE_PHYSICAL, (PVOID)phy, sizeof(*phy) + size );
  1264. *sizew = phy->BufLen;
  1265. LocalFree( phy );
  1266. }
  1267. }
  1268. __inline VOID
  1269. ReadPhysicalWithFlags(
  1270. ULONG64 address,
  1271. PVOID buf,
  1272. ULONG size,
  1273. ULONG flags,
  1274. PULONG sizer
  1275. )
  1276. {
  1277. PPHYSICAL_WITH_FLAGS phy;
  1278. *sizer = 0;
  1279. phy = (PPHYSICAL_WITH_FLAGS)LocalAlloc(LPTR, sizeof(*phy) + size );
  1280. if (phy) {
  1281. ZeroMemory( phy->Buf, size );
  1282. phy->Address = address;
  1283. phy->BufLen = size;
  1284. phy->Flags = flags;
  1285. Ioctl( IG_READ_PHYSICAL_WITH_FLAGS, (PVOID)phy, sizeof(*phy) + size );
  1286. *sizer = phy->BufLen;
  1287. CopyMemory( buf, phy->Buf, *sizer );
  1288. LocalFree( phy );
  1289. }
  1290. }
  1291. __inline VOID
  1292. WritePhysicalWithFlags(
  1293. ULONG64 address,
  1294. PVOID buf,
  1295. ULONG size,
  1296. ULONG flags,
  1297. PULONG sizew
  1298. )
  1299. {
  1300. PPHYSICAL_WITH_FLAGS phy;
  1301. *sizew = 0;
  1302. phy = (PPHYSICAL_WITH_FLAGS)LocalAlloc(LPTR, sizeof(*phy) + size );
  1303. if (phy) {
  1304. ZeroMemory( phy->Buf, size );
  1305. phy->Address = address;
  1306. phy->BufLen = size;
  1307. phy->Flags = flags;
  1308. CopyMemory( phy->Buf, buf, size );
  1309. Ioctl( IG_WRITE_PHYSICAL_WITH_FLAGS, (PVOID)phy, sizeof(*phy) + size );
  1310. *sizew = phy->BufLen;
  1311. LocalFree( phy );
  1312. }
  1313. }
  1314. __inline VOID
  1315. ReadMsr(
  1316. ULONG MsrReg,
  1317. ULONGLONG *MsrValue
  1318. )
  1319. {
  1320. READ_WRITE_MSR msr;
  1321. msr.Msr = MsrReg;
  1322. Ioctl( IG_READ_MSR, (PVOID)&msr, sizeof(msr) );
  1323. *MsrValue = msr.Value;
  1324. }
  1325. __inline VOID
  1326. WriteMsr(
  1327. ULONG MsrReg,
  1328. ULONGLONG MsrValue
  1329. )
  1330. {
  1331. READ_WRITE_MSR msr;
  1332. msr.Msr = MsrReg;
  1333. msr.Value = MsrValue;
  1334. Ioctl( IG_WRITE_MSR, (PVOID)&msr, sizeof(msr) );
  1335. }
  1336. __inline VOID
  1337. SetThreadForOperation(
  1338. ULONG_PTR * Thread
  1339. )
  1340. {
  1341. Ioctl(IG_SET_THREAD, (PVOID)Thread, sizeof(PULONG));
  1342. }
  1343. __inline VOID
  1344. SetThreadForOperation32(
  1345. ULONG Thread
  1346. )
  1347. {
  1348. Ioctl(IG_SET_THREAD, (PVOID)LongToPtr(Thread), sizeof(ULONG));
  1349. }
  1350. __inline VOID
  1351. SetThreadForOperation64(
  1352. PULONG64 Thread
  1353. )
  1354. {
  1355. Ioctl(IG_SET_THREAD, (PVOID)Thread, sizeof(ULONG64));
  1356. }
  1357. __inline VOID
  1358. ReadControlSpace(
  1359. USHORT processor,
  1360. ULONG address,
  1361. PVOID buf,
  1362. ULONG size
  1363. )
  1364. {
  1365. PREADCONTROLSPACE prc;
  1366. prc = (PREADCONTROLSPACE)LocalAlloc(LPTR, sizeof(*prc) + size );
  1367. if (prc) {
  1368. ZeroMemory( prc->Buf, size );
  1369. prc->Processor = processor;
  1370. prc->Address = address;
  1371. prc->BufLen = size;
  1372. Ioctl( IG_READ_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );
  1373. CopyMemory( buf, prc->Buf, size );
  1374. LocalFree( prc );
  1375. }
  1376. }
  1377. __inline VOID
  1378. ReadControlSpace32(
  1379. USHORT processor,
  1380. ULONG address,
  1381. PVOID buf,
  1382. ULONG size
  1383. )
  1384. {
  1385. PREADCONTROLSPACE32 prc;
  1386. prc = (PREADCONTROLSPACE32)LocalAlloc(LPTR, sizeof(*prc) + size );
  1387. if (prc) {
  1388. ZeroMemory( prc->Buf, size );
  1389. prc->Processor = processor;
  1390. prc->Address = address;
  1391. prc->BufLen = size;
  1392. Ioctl( IG_READ_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );
  1393. CopyMemory( buf, prc->Buf, size );
  1394. LocalFree( prc );
  1395. }
  1396. }
  1397. #define ReadTypedControlSpace32( _Proc, _Addr, _Buf ) \
  1398. ReadControlSpace64( (USHORT)(_Proc), (ULONG)(_Addr), (PVOID)&(_Buf), (ULONG)sizeof(_Buf) )
  1399. __inline VOID
  1400. ReadControlSpace64(
  1401. USHORT processor,
  1402. ULONG64 address,
  1403. PVOID buf,
  1404. ULONG size
  1405. )
  1406. {
  1407. PREADCONTROLSPACE64 prc;
  1408. prc = (PREADCONTROLSPACE64)LocalAlloc(LPTR, sizeof(*prc) + size );
  1409. if (prc) {
  1410. ZeroMemory( prc->Buf, size );
  1411. prc->Processor = processor;
  1412. prc->Address = address;
  1413. prc->BufLen = size;
  1414. Ioctl( IG_READ_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );
  1415. CopyMemory( buf, prc->Buf, size );
  1416. LocalFree( prc );
  1417. }
  1418. }
  1419. #define ReadTypedControlSpace64( _Proc, _Addr, _Buf ) \
  1420. ReadControlSpace64( (USHORT)(_Proc), (ULONG64)(_Addr), (PVOID)&(_Buf), (ULONG)sizeof(_Buf) )
  1421. __inline VOID
  1422. WriteControlSpace(
  1423. USHORT processor,
  1424. ULONG address,
  1425. PVOID buf,
  1426. ULONG size
  1427. )
  1428. {
  1429. PREADCONTROLSPACE64 prc;
  1430. prc = (PREADCONTROLSPACE64)LocalAlloc(LPTR, sizeof(*prc) + size );
  1431. if (prc) {
  1432. ZeroMemory( prc->Buf, size );
  1433. prc->Processor = processor;
  1434. prc->Address = address;
  1435. prc->BufLen = size;
  1436. CopyMemory( prc->Buf, buf, size );
  1437. Ioctl( IG_WRITE_CONTROL_SPACE, (PVOID)prc, sizeof(*prc) + size );
  1438. LocalFree( prc );
  1439. }
  1440. }
  1441. // #endif // _WINBASE_
  1442. __inline VOID
  1443. ReadIoSpace(
  1444. ULONG address,
  1445. PULONG data,
  1446. PULONG size
  1447. )
  1448. {
  1449. IOSPACE is;
  1450. is.Address = address;
  1451. is.Length = *size;
  1452. Ioctl( IG_READ_IO_SPACE, (PVOID)&is, sizeof(is) );
  1453. memcpy(data, &is.Data, is.Length);
  1454. *size = is.Length;
  1455. }
  1456. __inline VOID
  1457. ReadIoSpace32(
  1458. ULONG address,
  1459. PULONG data,
  1460. PULONG size
  1461. )
  1462. {
  1463. IOSPACE32 is;
  1464. is.Address = address;
  1465. is.Length = *size;
  1466. Ioctl( IG_READ_IO_SPACE, (PVOID)&is, sizeof(is) );
  1467. memcpy(data, &is.Data, is.Length);
  1468. *size = is.Length;
  1469. }
  1470. __inline VOID
  1471. ReadIoSpace64(
  1472. ULONG64 address,
  1473. PULONG data,
  1474. PULONG size
  1475. )
  1476. {
  1477. IOSPACE64 is;
  1478. is.Address = address;
  1479. is.Length = *size;
  1480. Ioctl( IG_READ_IO_SPACE, (PVOID)&is, sizeof(is) );
  1481. memcpy(data, &is.Data, is.Length);
  1482. *size = is.Length;
  1483. }
  1484. __inline VOID
  1485. WriteIoSpace(
  1486. ULONG address,
  1487. ULONG data,
  1488. PULONG size
  1489. )
  1490. {
  1491. IOSPACE is;
  1492. is.Address = (ULONG)address;
  1493. is.Length = *size;
  1494. is.Data = data;
  1495. Ioctl( IG_WRITE_IO_SPACE, (PVOID)&is, sizeof(is) );
  1496. *size = is.Length;
  1497. }
  1498. __inline VOID
  1499. WriteIoSpace32(
  1500. ULONG address,
  1501. ULONG data,
  1502. PULONG size
  1503. )
  1504. {
  1505. IOSPACE32 is;
  1506. is.Address = address;
  1507. is.Length = *size;
  1508. is.Data = data;
  1509. Ioctl( IG_WRITE_IO_SPACE, (PVOID)&is, sizeof(is) );
  1510. *size = is.Length;
  1511. }
  1512. __inline VOID
  1513. WriteIoSpace64(
  1514. ULONG64 address,
  1515. ULONG data,
  1516. PULONG size
  1517. )
  1518. {
  1519. IOSPACE64 is;
  1520. is.Address = address;
  1521. is.Length = *size;
  1522. is.Data = data;
  1523. Ioctl( IG_WRITE_IO_SPACE, (PVOID)&is, sizeof(is) );
  1524. *size = is.Length;
  1525. }
  1526. __inline VOID
  1527. ReadIoSpaceEx(
  1528. ULONG address,
  1529. PULONG data,
  1530. PULONG size,
  1531. ULONG interfacetype,
  1532. ULONG busnumber,
  1533. ULONG addressspace
  1534. )
  1535. {
  1536. IOSPACE_EX is;
  1537. is.Address = (ULONG)address;
  1538. is.Length = *size;
  1539. is.Data = 0;
  1540. is.InterfaceType = interfacetype;
  1541. is.BusNumber = busnumber;
  1542. is.AddressSpace = addressspace;
  1543. Ioctl( IG_READ_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
  1544. *data = is.Data;
  1545. *size = is.Length;
  1546. }
  1547. __inline VOID
  1548. ReadIoSpaceEx32(
  1549. ULONG address,
  1550. PULONG data,
  1551. PULONG size,
  1552. ULONG interfacetype,
  1553. ULONG busnumber,
  1554. ULONG addressspace
  1555. )
  1556. {
  1557. IOSPACE_EX32 is;
  1558. is.Address = address;
  1559. is.Length = *size;
  1560. is.Data = 0;
  1561. is.InterfaceType = interfacetype;
  1562. is.BusNumber = busnumber;
  1563. is.AddressSpace = addressspace;
  1564. Ioctl( IG_READ_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
  1565. *data = is.Data;
  1566. *size = is.Length;
  1567. }
  1568. __inline VOID
  1569. ReadIoSpaceEx64(
  1570. ULONG64 address,
  1571. PULONG data,
  1572. PULONG size,
  1573. ULONG interfacetype,
  1574. ULONG busnumber,
  1575. ULONG addressspace
  1576. )
  1577. {
  1578. IOSPACE_EX64 is;
  1579. is.Address = address;
  1580. is.Length = *size;
  1581. is.Data = 0;
  1582. is.InterfaceType = interfacetype;
  1583. is.BusNumber = busnumber;
  1584. is.AddressSpace = addressspace;
  1585. Ioctl( IG_READ_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
  1586. *data = is.Data;
  1587. *size = is.Length;
  1588. }
  1589. __inline VOID
  1590. WriteIoSpaceEx(
  1591. ULONG address,
  1592. ULONG data,
  1593. PULONG size,
  1594. ULONG interfacetype,
  1595. ULONG busnumber,
  1596. ULONG addressspace
  1597. )
  1598. {
  1599. IOSPACE_EX is;
  1600. is.Address = (ULONG)address;
  1601. is.Length = *size;
  1602. is.Data = data;
  1603. is.InterfaceType = interfacetype;
  1604. is.BusNumber = busnumber;
  1605. is.AddressSpace = addressspace;
  1606. Ioctl( IG_WRITE_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
  1607. *size = is.Length;
  1608. }
  1609. __inline VOID
  1610. WriteIoSpaceEx32(
  1611. ULONG address,
  1612. ULONG data,
  1613. PULONG size,
  1614. ULONG interfacetype,
  1615. ULONG busnumber,
  1616. ULONG addressspace
  1617. )
  1618. {
  1619. IOSPACE_EX32 is;
  1620. is.Address = address;
  1621. is.Length = *size;
  1622. is.Data = data;
  1623. is.InterfaceType = interfacetype;
  1624. is.BusNumber = busnumber;
  1625. is.AddressSpace = addressspace;
  1626. Ioctl( IG_WRITE_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
  1627. *size = is.Length;
  1628. }
  1629. __inline VOID
  1630. WriteIoSpaceEx64(
  1631. ULONG64 address,
  1632. ULONG data,
  1633. PULONG size,
  1634. ULONG interfacetype,
  1635. ULONG busnumber,
  1636. ULONG addressspace
  1637. )
  1638. {
  1639. IOSPACE_EX64 is;
  1640. is.Address = address;
  1641. is.Length = *size;
  1642. is.Data = data;
  1643. is.InterfaceType = interfacetype;
  1644. is.BusNumber = busnumber;
  1645. is.AddressSpace = addressspace;
  1646. Ioctl( IG_WRITE_IO_SPACE_EX, (PVOID)&is, sizeof(is) );
  1647. *size = is.Length;
  1648. }
  1649. __inline VOID
  1650. ReloadSymbols(
  1651. IN PSTR Arg OPTIONAL
  1652. )
  1653. /*++
  1654. Routine Description:
  1655. Calls the debugger to reload symbols.
  1656. Arguments:
  1657. Args - Supplies the tail of a !reload command string.
  1658. !reload [flags] [module[=address]]
  1659. flags: /n do not load from usermode list
  1660. /u unload symbols, no reload
  1661. /v verbose
  1662. A value of NULL is equivalent to an empty string
  1663. Return Value:
  1664. None
  1665. --*/
  1666. {
  1667. Ioctl(IG_RELOAD_SYMBOLS, (PVOID)Arg, Arg?((ULONG)strlen(Arg)+1):0);
  1668. }
  1669. __inline VOID
  1670. GetSetSympath(
  1671. IN PSTR Arg,
  1672. OUT PSTR Result OPTIONAL,
  1673. IN int Length
  1674. )
  1675. /*++
  1676. Routine Description:
  1677. Calls the debugger to set or retrieve symbol search path.
  1678. Arguments:
  1679. Arg - Supplies new search path. If Arg is NULL or string is empty,
  1680. the search path is not changed and the current setting is
  1681. returned in Result. When the symbol search path is changed,
  1682. a call to ReloadSymbols is made implicitly.
  1683. Result - OPTIONAL Returns the symbol search path setting.
  1684. Length - Supplies the size of the buffer supplied by Result.
  1685. Return Value:
  1686. None
  1687. --*/
  1688. {
  1689. GET_SET_SYMPATH gss;
  1690. gss.Args = Arg;
  1691. gss.Result = Result;
  1692. gss.Length = Length;
  1693. Ioctl(IG_GET_SET_SYMPATH, (PVOID)&gss, sizeof(gss));
  1694. }
  1695. #if defined(KDEXT_64BIT)
  1696. __inline
  1697. ULONG
  1698. IsPtr64(
  1699. void
  1700. )
  1701. {
  1702. static ULONG flag = (ULONG)-1;
  1703. ULONG dw;
  1704. if (flag == (ULONG)-1) {
  1705. if (Ioctl(IG_IS_PTR64, &dw, sizeof(dw))) {
  1706. flag = ((dw != 0) ? 1 : 0);
  1707. } else {
  1708. flag = 0;
  1709. }
  1710. }
  1711. return flag;
  1712. }
  1713. __inline
  1714. ULONG
  1715. ReadListEntry(
  1716. ULONG64 Address,
  1717. PLIST_ENTRY64 List
  1718. )
  1719. {
  1720. ULONG cb;
  1721. if (IsPtr64()) {
  1722. return (ReadMemory(Address, (PVOID)List, sizeof(*List), &cb) && cb == sizeof(*List));
  1723. } else {
  1724. LIST_ENTRY32 List32;
  1725. ULONG Status;
  1726. Status = ReadMemory(Address,
  1727. (PVOID)&List32,
  1728. sizeof(List32),
  1729. &cb);
  1730. if (Status && cb == sizeof(List32)) {
  1731. List->Flink = (ULONG64)(LONG64)(LONG)List32.Flink;
  1732. List->Blink = (ULONG64)(LONG64)(LONG)List32.Blink;
  1733. return 1;
  1734. }
  1735. return 0;
  1736. }
  1737. }
  1738. __inline
  1739. ULONG
  1740. ReadPointer(
  1741. ULONG64 Address,
  1742. PULONG64 Pointer
  1743. )
  1744. {
  1745. ULONG cb;
  1746. if (IsPtr64()) {
  1747. return (ReadMemory(Address, (PVOID)Pointer, sizeof(*Pointer), &cb) && cb == sizeof(*Pointer));
  1748. } else {
  1749. ULONG Pointer32;
  1750. ULONG Status;
  1751. Status = ReadMemory(Address,
  1752. (PVOID)&Pointer32,
  1753. sizeof(Pointer32),
  1754. &cb);
  1755. if (Status && cb == sizeof(Pointer32)) {
  1756. *Pointer = (ULONG64)(LONG64)(LONG)Pointer32;
  1757. return 1;
  1758. }
  1759. return 0;
  1760. }
  1761. }
  1762. __inline
  1763. ULONG
  1764. WritePointer(
  1765. ULONG64 Address,
  1766. ULONG64 Pointer
  1767. )
  1768. {
  1769. ULONG cb;
  1770. if (IsPtr64()) {
  1771. return (WriteMemory(Address, &Pointer, sizeof(Pointer), &cb) && cb == sizeof(Pointer));
  1772. } else {
  1773. ULONG Pointer32 = (ULONG)Pointer;
  1774. ULONG Status;
  1775. Status = WriteMemory(Address,
  1776. &Pointer32,
  1777. sizeof(Pointer32),
  1778. &cb);
  1779. return (Status && cb == sizeof(Pointer32)) ? 1 : 0;
  1780. }
  1781. }
  1782. /**
  1783. This does Ioctl call for type info and returns size of the type on success.
  1784. **/
  1785. __inline
  1786. ULONG
  1787. GetTypeSize (
  1788. IN LPCSTR Type
  1789. )
  1790. {
  1791. SYM_DUMP_PARAM Sym = {
  1792. sizeof (SYM_DUMP_PARAM), (PUCHAR)Type, DBG_DUMP_NO_PRINT | DBG_DUMP_GET_SIZE_ONLY, 0,
  1793. NULL, NULL, NULL, 0, NULL
  1794. };
  1795. return Ioctl( IG_GET_TYPE_SIZE, &Sym, Sym.size );
  1796. }
  1797. /**
  1798. GetFieldData
  1799. Copies the value of the specified field into pOutValue assuming TypeAddress
  1800. points to start of the type in debugee.
  1801. If the Field is NULL and the size of Type is <= 8 Whole type value is read into
  1802. pOutValue. This is to allow to read in primitive types suchas ULONG, PVOID etc.
  1803. If address is zero this considers Type a global variable.
  1804. It raises an exception if OutSize is less than size to be copied.
  1805. Returns 0 on success, errorvalue (defined with SYM_DUMP_PARAM) otherwise.
  1806. **/
  1807. __inline
  1808. ULONG
  1809. GetFieldData (
  1810. IN ULONG64 TypeAddress,
  1811. IN LPCSTR Type,
  1812. IN LPCSTR Field,
  1813. IN ULONG OutSize,
  1814. OUT PVOID pOutValue
  1815. )
  1816. {
  1817. FIELD_INFO flds = {(PUCHAR)Field, NULL, 0, DBG_DUMP_FIELD_FULL_NAME | DBG_DUMP_FIELD_COPY_FIELD_DATA | DBG_DUMP_FIELD_RETURN_ADDRESS, 0, pOutValue};
  1818. SYM_DUMP_PARAM Sym = {
  1819. sizeof (SYM_DUMP_PARAM), (PUCHAR)Type, DBG_DUMP_NO_PRINT, TypeAddress,
  1820. NULL, NULL, NULL, 1, &flds
  1821. };
  1822. ULONG RetVal;
  1823. if (!Field) {
  1824. Sym.nFields =0; Sym.Options |= DBG_DUMP_COPY_TYPE_DATA;
  1825. Sym.Context = pOutValue;
  1826. }
  1827. ZeroMemory(pOutValue, OutSize);
  1828. RetVal = Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size );
  1829. if (OutSize < ((Field == NULL) ? 8 : flds.size)) {
  1830. // Fail
  1831. dprintf("Not enough space to read %s-%s\n", Type, Field);
  1832. RaiseException(EXCEPTION_ACCESS_VIOLATION, 0, 0, NULL);
  1833. return 0;
  1834. }
  1835. return RetVal;
  1836. }
  1837. //
  1838. // Typecast the buffer where value is to be read
  1839. //
  1840. #define GetFieldValue(Addr, Type, Field, OutValue) \
  1841. GetFieldData(Addr, Type, Field, sizeof(OutValue), (PVOID) &(OutValue))
  1842. //
  1843. // Used to read in value of a short (<= 8 bytes) fields
  1844. //
  1845. __inline
  1846. ULONG64
  1847. GetShortField (
  1848. IN ULONG64 TypeAddress,
  1849. IN LPCSTR Name,
  1850. IN USHORT StoreAddress
  1851. )
  1852. {
  1853. static ULONG64 SavedAddress;
  1854. static PUCHAR SavedName;
  1855. static ULONG ReadPhysical;
  1856. FIELD_INFO flds = {(PUCHAR) Name, NULL, 0, DBG_DUMP_FIELD_FULL_NAME, 0, NULL};
  1857. SYM_DUMP_PARAM Sym = {
  1858. sizeof (SYM_DUMP_PARAM), SavedName, DBG_DUMP_NO_PRINT | ((StoreAddress & 2) ? DBG_DUMP_READ_PHYSICAL : 0),
  1859. SavedAddress, NULL, NULL, NULL, 1, &flds
  1860. };
  1861. if (StoreAddress) {
  1862. Sym.sName = (PUCHAR) Name;
  1863. Sym.nFields = 0;
  1864. SavedName = (PUCHAR) Name;
  1865. Sym.addr = SavedAddress = TypeAddress;
  1866. ReadPhysical = (StoreAddress & 2);
  1867. return SavedAddress ? Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size ) : MEMORY_READ_ERROR; // zero on success
  1868. } else {
  1869. Sym.Options |= ReadPhysical ? DBG_DUMP_READ_PHYSICAL : 0;
  1870. }
  1871. if (!Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size )) {
  1872. return flds.address;
  1873. }
  1874. return 0;
  1875. }
  1876. //
  1877. // Stores the address and type name for future reads
  1878. //
  1879. #define InitTypeRead(Addr, Type) GetShortField(Addr, #Type, 1)
  1880. //
  1881. // Stores the address and type name for future reads
  1882. //
  1883. #define InitTypeReadPhysical(Addr, Type) GetShortField(Addr, #Type, 3)
  1884. //
  1885. // Returns the field's value as ULONG64 if size of field is <= sizeof (ULONG64)
  1886. //
  1887. #define ReadField(Field) GetShortField(0, #Field, 0)
  1888. //
  1889. // Read in a pointer value
  1890. //
  1891. __inline
  1892. ULONG
  1893. ReadPtr(
  1894. ULONG64 Addr,
  1895. PULONG64 pPointer
  1896. )
  1897. {
  1898. return !ReadPointer(Addr, pPointer);
  1899. }
  1900. /*
  1901. * ListType
  1902. *
  1903. * Routine ListType gives a callback on each element in the list of Type.
  1904. *
  1905. * Type : Name of the type to be listed
  1906. *
  1907. * NextPointer : Name of field which gives address of next element in list
  1908. *
  1909. * Context, CallbackRoutine :
  1910. * Context and the callback routine. The address field in PFIELD_INFO
  1911. * parameter of callback contains the address of next Type element in list.
  1912. *
  1913. * Address, ListByFieldAddress :
  1914. * if ListByFieldAddress is 0, Adress is the address of first element of Type List.
  1915. *
  1916. * Lists by LIST_ENTRY are also handled implicitly (by Ioctl). If the NextPointer
  1917. * is a pointer to LIST_ENTRY type, the type address is properly calculated by
  1918. * subtracting the offsets.
  1919. *
  1920. * If ListByFieldAddress is 1, the Address is considered to be the address of field
  1921. * "NextPointer" of the first Type element and first element address is derived
  1922. * from it.
  1923. *
  1924. */
  1925. __inline
  1926. ULONG
  1927. ListType (
  1928. IN LPCSTR Type,
  1929. IN ULONG64 Address,
  1930. IN USHORT ListByFieldAddress,
  1931. IN LPCSTR NextPointer,
  1932. IN PVOID Context,
  1933. IN PSYM_DUMP_FIELD_CALLBACK CallbackRoutine
  1934. )
  1935. {
  1936. FIELD_INFO flds = {(PUCHAR)NextPointer, NULL, 0, 0, 0, NULL};
  1937. SYM_DUMP_PARAM Sym = {
  1938. sizeof (SYM_DUMP_PARAM), (PUCHAR) Type, DBG_DUMP_NO_PRINT | DBG_DUMP_LIST, Address,
  1939. &flds, Context, CallbackRoutine, 0, NULL
  1940. };
  1941. if (ListByFieldAddress==1) {
  1942. //
  1943. // Address is the address of "NextPointer"
  1944. //
  1945. Sym.Options |= DBG_DUMP_ADDRESS_OF_FIELD;
  1946. }
  1947. return Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size );
  1948. }
  1949. /**
  1950. Routine to get offset of a "Field" of "Type" on a debugee machine. This uses
  1951. Ioctl call for type info.
  1952. Returns 0 on success, Ioctl error value otherwise.
  1953. **/
  1954. __inline
  1955. ULONG
  1956. GetFieldOffset (
  1957. IN LPCSTR Type,
  1958. IN LPCSTR Field,
  1959. OUT PULONG pOffset
  1960. )
  1961. {
  1962. FIELD_INFO flds = {
  1963. (PUCHAR)Field,
  1964. (PUCHAR)"",
  1965. 0,
  1966. DBG_DUMP_FIELD_FULL_NAME | DBG_DUMP_FIELD_RETURN_ADDRESS,
  1967. 0,
  1968. NULL};
  1969. SYM_DUMP_PARAM Sym = {
  1970. sizeof (SYM_DUMP_PARAM),
  1971. (PUCHAR)Type,
  1972. DBG_DUMP_NO_PRINT,
  1973. 0,
  1974. NULL,
  1975. NULL,
  1976. NULL,
  1977. 1,
  1978. &flds
  1979. };
  1980. ULONG Err;
  1981. Sym.nFields = 1;
  1982. Err = Ioctl( IG_DUMP_SYMBOL_INFO, &Sym, Sym.size );
  1983. *pOffset = (ULONG) (flds.address - Sym.addr);
  1984. return Err;
  1985. }
  1986. #endif // defined(KDEXT_64BIT)
  1987. __inline VOID
  1988. GetCurrentProcessHandle(
  1989. PHANDLE hp
  1990. )
  1991. {
  1992. Ioctl(IG_GET_CURRENT_PROCESS_HANDLE, hp, sizeof(HANDLE));
  1993. }
  1994. __inline VOID
  1995. GetTebAddress(
  1996. PULONGLONG Address
  1997. )
  1998. {
  1999. GET_TEB_ADDRESS gpt;
  2000. gpt.Address = 0;
  2001. Ioctl(IG_GET_TEB_ADDRESS, (PVOID)&gpt, sizeof(gpt));
  2002. *Address = gpt.Address;
  2003. }
  2004. __inline VOID
  2005. GetPebAddress(
  2006. ULONG64 CurrentThread,
  2007. PULONGLONG Address
  2008. )
  2009. {
  2010. GET_PEB_ADDRESS gpt;
  2011. gpt.CurrentThread = CurrentThread;
  2012. gpt.Address = 0;
  2013. Ioctl(IG_GET_PEB_ADDRESS, (PVOID)&gpt, sizeof(gpt));
  2014. *Address = gpt.Address;
  2015. }
  2016. __inline VOID
  2017. GetCurrentThreadAddr(
  2018. DWORD Processor,
  2019. PULONG64 Address
  2020. )
  2021. {
  2022. GET_CURRENT_THREAD_ADDRESS ct;
  2023. ct.Processor = Processor;
  2024. Ioctl(IG_GET_CURRENT_THREAD, (PVOID)&ct, sizeof(ct));
  2025. *Address = ct.Address;
  2026. }
  2027. __inline VOID
  2028. GetCurrentProcessAddr(
  2029. DWORD Processor,
  2030. ULONG64 CurrentThread,
  2031. PULONG64 Address
  2032. )
  2033. {
  2034. GET_CURRENT_PROCESS_ADDRESS cp;
  2035. cp.Processor = Processor;
  2036. cp.CurrentThread = CurrentThread;
  2037. Ioctl(IG_GET_CURRENT_PROCESS, (PVOID)&cp, sizeof(cp));
  2038. *Address = cp.Address;
  2039. }
  2040. __inline VOID
  2041. SearchMemory(
  2042. ULONG64 SearchAddress,
  2043. ULONG64 SearchLength,
  2044. ULONG PatternLength,
  2045. PVOID Pattern,
  2046. PULONG64 FoundAddress
  2047. )
  2048. {
  2049. SEARCHMEMORY sm;
  2050. sm.SearchAddress = SearchAddress;
  2051. sm.SearchLength = SearchLength;
  2052. sm.FoundAddress = 0;
  2053. sm.PatternLength = PatternLength;
  2054. sm.Pattern = Pattern;
  2055. Ioctl(IG_SEARCH_MEMORY, (PVOID)&sm, sizeof(sm));
  2056. *FoundAddress = sm.FoundAddress;
  2057. }
  2058. __inline ULONG
  2059. GetInputLine(
  2060. PCSTR Prompt,
  2061. PSTR Buffer,
  2062. ULONG BufferSize
  2063. )
  2064. {
  2065. GET_INPUT_LINE InLine;
  2066. InLine.Prompt = Prompt;
  2067. InLine.Buffer = Buffer;
  2068. InLine.BufferSize = BufferSize;
  2069. if (Ioctl(IG_GET_INPUT_LINE, (PVOID)&InLine, sizeof(InLine)))
  2070. {
  2071. return InLine.InputSize;
  2072. }
  2073. else
  2074. {
  2075. return 0;
  2076. }
  2077. }
  2078. __inline BOOL
  2079. GetExpressionEx(
  2080. PCSTR Expression,
  2081. ULONG64* Value,
  2082. PCSTR* Remainder
  2083. )
  2084. {
  2085. GET_EXPRESSION_EX Expr;
  2086. Expr.Expression = Expression;
  2087. if (Ioctl(IG_GET_EXPRESSION_EX, (PVOID)&Expr, sizeof(Expr)))
  2088. {
  2089. *Value = Expr.Value;
  2090. if (Remainder != NULL)
  2091. {
  2092. *Remainder = Expr.Remainder;
  2093. }
  2094. return TRUE;
  2095. }
  2096. return FALSE;
  2097. }
  2098. __inline BOOL
  2099. TranslateVirtualToPhysical(
  2100. ULONG64 Virtual,
  2101. ULONG64* Physical
  2102. )
  2103. {
  2104. TRANSLATE_VIRTUAL_TO_PHYSICAL VToP;
  2105. VToP.Virtual = Virtual;
  2106. if (Ioctl(IG_TRANSLATE_VIRTUAL_TO_PHYSICAL, (PVOID)&VToP, sizeof(VToP)))
  2107. {
  2108. *Physical = VToP.Physical;
  2109. return TRUE;
  2110. }
  2111. return FALSE;
  2112. }
  2113. __inline BOOL
  2114. GetDebuggerCacheSize(
  2115. OUT PULONG64 CacheSize
  2116. )
  2117. {
  2118. return Ioctl(IG_GET_CACHE_SIZE, (PVOID) CacheSize, sizeof(ULONG64));
  2119. }
  2120. #endif
  2121. #ifdef __cplusplus
  2122. }
  2123. #endif
  2124. #endif // _WDBGEXTS_