Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

536 lines
17 KiB

/*++
Copyright (C) Microsoft Corporation, 1997 - 2001
Module Name:
NtTrans.cxx
Abstract:
NTSD/KD extensions for debugging Windows NT transport interface
data structures.
Author:
Mario Goertzel [MarioGo]
Revision History:
MarioGo 3/21/1997 Bits 'n pieces
GrigoriK Mar 2001 Added support for type info.
--*/
#undef _RPCRT4_
#define KDEXT_64BIT
#define private public
#include "..\trans\Common\precomp.hxx"
#include "..\mtrt\precomp.hxx"
#include <stddef.h>
#include <wdbgexts.h>
#include <rpcexts.hxx>
VOID do_trans(ULONG64);
VOID do_protocols(ULONG64);
VOID do_overlap(ULONG64);
VOID do_addrvect(ULONG64);
MY_DECLARE_API(trans);
MY_DECLARE_API(overlap);
MY_DECLARE_API(addrvect);
const char *Protocols[] =
{
"INVALID",
"TCP/IP",
#ifdef SPX_ON
"SPX",
#else
"Invalid",
#endif
"Named pipes",
#ifdef NETBIOS_ON
"NetBEUI",
"Netbios(TCP)",
"Netbios(IPX)",
#else
"Invalid",
"Invalid",
"Invalid",
#endif
#ifdef APPLETALK_ON
"Appletalk DSP",
#else
"Invalid",
#endif
"Invalid", // former "Vines SPP",
"HTTP",
"UDP/IP",
#ifdef IPX_ON
"IPX",
#else
"Invalid",
#endif
"CDP",
#ifdef NCADG_MQ_ON
"MSMQ",
#else
"Invalid",
#endif
"TCP/IPv6"
};
const INT cProtocols = sizeof(Protocols)/sizeof(char *);
VOID
do_trans(
ULONG64 qwAddr
)
{
char const *pszProtocol;
ULONG64 tmp1;
ULONG tmp2;
DWORD protocol;
ULONG64 id;
ULONG64 type;
GET_MEMBER(qwAddr, BASE_ASYNC_OBJECT, RPCRT4!BASE_ASYNC_OBJECT, id, id);
GET_MEMBER(qwAddr, BASE_ASYNC_OBJECT, RPCRT4!BASE_ASYNC_OBJECT, type, type);
// Display protocol
if ((ULONG)id <= 0 ||
(ULONG)id >= cProtocols)
{
dprintf("Invalid protocol ID %d\n", id);
return;
}
protocol = (ULONG)id;
pszProtocol = Protocols[protocol];
dprintf("Object (0x%p), protocol\t - %s\n", qwAddr, pszProtocol);
switch(type & PROTO_MASK)
{
case CONNECTION:
{
if ((type & TYPE_MASK) == CLIENT)
{
dprintf("Client-side connection\t\t - (%p)\n", type);
}
else if (type & SERVER)
{
dprintf("Server-side connection\t\t - (%p)\n", type);
}
else
{
dprintf("Unknown type %d\n", type);
break;
}
PRINT_ADDRESS_OF(qwAddr, BASE_CONNECTION, RPCRT4!BASE_CONNECTION, Conn, tmp2);
PRINT_MEMBER_BOOLEAN(qwAddr, BASE_CONNECTION, RPCRT4!BASE_CONNECTION, fAborted, tmp1);
PRINT_MEMBER(qwAddr, BASE_CONNECTION, RPCRT4!BASE_CONNECTION, StartingReadIo, tmp1);
PRINT_MEMBER(qwAddr, BASE_CONNECTION, RPCRT4!BASE_CONNECTION, StartingWriteIo, tmp1);
PRINT_MEMBER(qwAddr, BASE_CONNECTION, RPCRT4!BASE_CONNECTION, iPostSize, tmp1);
ULONG64 Read;
GET_ADDRESS_OF(qwAddr, BASE_CONNECTION, RPCRT4!BASE_CONNECTION, Read, Read, tmp2);
do_overlap(Read);
PRINT_MEMBER(qwAddr, BASE_CONNECTION, RPCRT4!BASE_CONNECTION, pReadBuffer, tmp1);
PRINT_MEMBER(qwAddr, BASE_CONNECTION, RPCRT4!BASE_CONNECTION, maxReadBuffer, tmp1);
PRINT_MEMBER(qwAddr, BASE_CONNECTION, RPCRT4!BASE_CONNECTION, iLastRead, tmp1);
ULONG64 pAddress;
if (protocol == NMP)
{
GET_MEMBER(qwAddr, NMP_CONNECTION, RPCRT4!NMP_CONNECTION, pAddress, pAddress);
dprintf("Associated address\t\t - 0x%I64x\n", pAddress);
}
else if (protocol == TCP)
{
GET_MEMBER(qwAddr, WS_CONNECTION, RPCRT4!WS_CONNECTION, pAddress, pAddress);
dprintf("Associated address\t\t - 0x%I64x\n", pAddress);
}
else
{
GET_MEMBER(qwAddr, WS_CONNECTION, RPCRT4!WS_CONNECTION, saClientAddress, pAddress);
dprintf("Winsock sockaddr (server)\t - 0x%I64x\n", pAddress);
#ifdef NETBIOS_ON
if ( protocol == NBF
|| protocol == NBT
|| protocol == NBI)
{
ULONG64 SequenceNumber;
GET_MEMBER(qwAddr, NB_CONNECTION, RPCRT4!NB_CONNECTION, SequenceNumber, SequenceNumber);
// Netbios based connection has more state
dprintf("Netbios sequence number\t\t - %d\n", (ULONG)SequenceNumber);
}
else
#endif
if ((type & TYPE_MASK) == CLIENT)
{
// Client-side non-netbios connections have more state
PRINT_MEMBER(qwAddr, WS_CLIENT_CONNECTION, RPCRT4!WS_CLIENT_CONNECTION, fCallStarted, tmp1);
PRINT_MEMBER(qwAddr, WS_CLIENT_CONNECTION, RPCRT4!WS_CLIENT_CONNECTION, fShutdownReceived, tmp1);
PRINT_MEMBER(qwAddr, WS_CLIENT_CONNECTION, RPCRT4!WS_CLIENT_CONNECTION, fReceivePending, tmp1);
PRINT_MEMBER(qwAddr, WS_CLIENT_CONNECTION, RPCRT4!WS_CLIENT_CONNECTION, dwLastCallTime, tmp1);
}
}
break;
}
case ADDRESS:
case DATAGRAM|ADDRESS:
{
dprintf("Address type\t\t\t - (%p)", type);
if (type & ~(PROTO_MASK | TYPE_MASK | IO_MASK))
{
dprintf(" unknown bits 0x%lx\n", type & ~(PROTO_MASK | TYPE_MASK | IO_MASK));
}
else
{
if (type & DATAGRAM)
dprintf(" d/g");
else
dprintf(" c/o");
if (type & SERVER)
dprintf(" server");
else
dprintf(" client or bit not set");
dprintf("\n");
}
ULONG64 Endpoint;
GET_MEMBER(qwAddr, BASE_ADDRESS, RPCRT4!BASE_ADDRESS, Endpoint, Endpoint);
if (Endpoint)
{
dprintf("Endpoint\t\t\t - %ws\n", ReadProcessRpcChar(Endpoint));
}
else
{
dprintf("Endpoint\t\t\t - (null)\n");
}
ULONG64 pAddressVector;
GET_MEMBER(qwAddr, BASE_ADDRESS, RPCRT4!BASE_ADDRESS, pAddressVector, pAddressVector);
if (pAddressVector)
{
do_addrvect(pAddressVector);
}
else
{
dprintf("No address vector\n");
}
ULONG64 SubmitListen;
GET_MEMBER(qwAddr, BASE_ADDRESS, RPCRT4!BASE_ADDRESS, SubmitListen, SubmitListen);
dprintf("SubmitListen (pfn)\t\t - 0x%I64x %s\n", SubmitListen,
MapSymbol(SubmitListen));
PRINT_MEMBER_WITH_LABEL(qwAddr, BASE_ADDRESS, RPCRT4!BASE_ADDRESS, pNext, "Next\t\t\t\t", tmp1);
if (
#ifdef IPX_ON
protocol != IPX &&
#endif
protocol != UDP &&
protocol != CDP)
{
GET_OFFSET_OF(CO_ADDRESS, RPCRT4!CO_ADDRESS, Listen, &tmp2);
do_overlap(qwAddr+tmp2);
ULONG64 NewConnection;
GET_MEMBER(qwAddr, CO_ADDRESS, RPCRT4!CO_ADDRESS, NewConnection, NewConnection);
dprintf("NewConnection (pfn)\t\t - 0x%I64x %s\n", NewConnection, MapSymbol(NewConnection));
}
#ifdef NETBIOS_ON
BOOL fNetbios = FALSE;
#endif
switch(protocol)
{
#ifdef NETBIOS_ON
case NBI:
case NBT:
case NBF:
fNetbios = TRUE;
// Fall into winsock case
#endif
case TCP:
#ifdef SPX_ON
case SPX:
#endif
#ifdef APPLETALK_ON
case DSP:
#endif
{
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_ADDRESS, RPCRT4!WS_ADDRESS, pFirstAddress, "Real address\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_ADDRESS, RPCRT4!WS_ADDRESS, pNextAddress, "Next address\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_ADDRESS, RPCRT4!WS_ADDRESS, ListenSocket, "Listen socket\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_ADDRESS, RPCRT4!WS_ADDRESS, ConnectionSocket, "Connect socket\t\t\t", tmp1);
#ifdef NETBIOS_ON
ULONG64 dwProtocolMultiplier;
GET_MEMBER(qwAddr, WS_ADDRESS, RPCRT4!WS_ADDRESS, dwProtocolMultiplier, dwProtocolMultiplier);
if (dwProtocolMultiplier != 1
&& !fNetbios)
{
dprintf("Invalid protocol multipler (%d) for winsock address\n", (ULONG)dwProtocolMultiplier);
}
else
{
dprintf("Multipler\t\t\t - %d\n", (ULONG)dwProtocolMultiplier);
}
#endif
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, WS_ADDRESS, RPCRT4!WS_ADDRESS, AcceptBuffer, "AcceptBuffer\t\t\t", tmp2);
break;
}
case NMP:
{
PRINT_MEMBER_WITH_LABEL(qwAddr, NMP_ADDRESS, RPCRT4!NMP_ADDRESS, hConnectPipe, "Connect pipe\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, NMP_ADDRESS, RPCRT4!NMP_ADDRESS, sparePipes, "Spare pipes\t\t\t", tmp2);
PRINT_MEMBER_WITH_LABEL(qwAddr, NMP_ADDRESS, RPCRT4!NMP_ADDRESS, SecurityDescriptor, "Security descriptor\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, NMP_ADDRESS, RPCRT4!NMP_ADDRESS, LocalEndpoint, "Local Endpoint\t\t\t", tmp1);
break;
}
case UDP:
#ifdef IPX_ON
case IPX:
#endif
case CDP:
{
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_DATAGRAM_ENDPOINT, RPCRT4!WS_DATAGRAM_ENDPOINT, Socket, "The socket\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_DATAGRAM_ENDPOINT, RPCRT4!WS_DATAGRAM_ENDPOINT, cPendingIos, "Pending recvs\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_DATAGRAM_ENDPOINT, RPCRT4!WS_DATAGRAM_ENDPOINT, cMinimumIos, "Min recvs\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_DATAGRAM_ENDPOINT, RPCRT4!WS_DATAGRAM_ENDPOINT, cMaximumIos, "Max recvs\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_DATAGRAM_ENDPOINT, RPCRT4!WS_DATAGRAM_ENDPOINT, aDatagrams, "Array of datagrams\t\t", tmp1);
}
default:
{
dprintf("ERROR: Invalid/unknown protocol\n");
}
}
break;
}
case DATAGRAM:
{
dprintf("Datagram\t\t\t - (%p)\n", type);
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_DATAGRAM, RPCRT4!WS_DATAGRAM, pEndpoint, "Pointer to owning address\t", tmp1);
PRINT_MEMBER_BOOLEAN_WITH_LABEL(qwAddr, WS_DATAGRAM, RPCRT4!WS_DATAGRAM, Busy, "Busy\t\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(qwAddr, WS_DATAGRAM, RPCRT4!WS_DATAGRAM, AddressPair, "AddrPair\t\t\t", tmp1);
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, WS_DATAGRAM, RPCRT4!WS_DATAGRAM, Packet, "Packet", tmp2);
GET_OFFSET_OF(WS_DATAGRAM, RPCRT4!WS_DATAGRAM, Read, &tmp2)
do_overlap(qwAddr + tmp2);
break;
}
default:
dprintf("Unknown type %d\n", type);
break;
}
dprintf("\n");
return;
}
char *strtok(char *String);
DECLARE_API( protocols )
{
ULONG64 qwAddr;
BOOL fArgNotSpecified = FALSE;
ULONG64 ProtocolArrayAddress;
LPSTR lpArgumentString = (LPSTR)args;
if (0 == strtok(lpArgumentString))
{
lpArgumentString = "rpcrt4!TransportProtocolArray";
fArgNotSpecified = TRUE;
}
qwAddr = GetExpression(lpArgumentString);
if ( !qwAddr )
{
dprintf("Error: can't evaluate '%s'\n", lpArgumentString);
return;
}
if (fArgNotSpecified)
{
if (!ReadPointer(qwAddr, &ProtocolArrayAddress))
{
dprintf("couldn't read memory at address %I64x\n", qwAddr);
return;
}
}
else
ProtocolArrayAddress = qwAddr;
do_protocols(ProtocolArrayAddress);
}
const char *ProtocolStateNames[] = {"ProtocolNotLoaded", "ProtocolLoadedWithoutAddress" ,
"ProtocolWasLoadedOrNeedsAct.", "ProtocolLoaded",
"ProtocolWasLoadedOrNAWithoutAddr",
"ProtocolLoadedAndMonitored"};
VOID
do_protocols(
ULONG64 qwAddr
)
{
ULONG64 pTransportProtocol;
const char *pProtStateName;
ULONG64 ListHead;
ULONG64 ObjectEntry;
ULONG64 pCurrentObject;
int i;
BOOL fFirstObject;
BOOL b;
ULONG64 tmp1;
ULONG tmp2;
dprintf(" Protocol State AddrChngSock AddrChngOl\n");
dprintf("-----------------------------------------------------------------------\n");
pTransportProtocol = qwAddr;
for (i = 1; i < MAX_PROTOCOLS; i++)
{
fFirstObject = TRUE;
ULONG64 State;
ULONG64 addressChangeSocket;
ULONG64 addressChangeOverlapped;
GET_MEMBER(pTransportProtocol, TransportProtocol, RPCRT4!TransportProtocol, State, State);
GET_ADDRESS_OF(pTransportProtocol, TransportProtocol, RPCRT4!TransportProtocol, addressChangeSocket, addressChangeSocket, tmp2);
GET_ADDRESS_OF(pTransportProtocol, TransportProtocol, RPCRT4!TransportProtocol, addressChangeOverlapped, addressChangeOverlapped, tmp2);
if ((ULONG)State >= sizeof(ProtocolStateNames)/sizeof(ProtocolStateNames[0]))
pProtStateName = "INVALID";
else
pProtStateName = ProtocolStateNames[(ULONG)State];
dprintf("%13s%31s%15I64x%12I64x\n", Protocols[i], pProtStateName,
addressChangeSocket, addressChangeOverlapped);
GET_OFFSET_OF(TransportProtocol, RPCRT4!TransportProtocol, ObjectList, &tmp2);
ListHead = pTransportProtocol;
ListHead += tmp2;
ULONG64 ObjectList;
GET_ADDRESS_OF(pTransportProtocol, TransportProtocol, RPCRT4!TransportProtocol, ObjectList, ObjectList, tmp2);
ULONG64 Flink;
GET_MEMBER(ObjectList, _LIST_ENTRY, RPCRT4!_LIST_ENTRY, Flink, Flink);
ObjectEntry = Flink;
while (ObjectEntry != ListHead)
{
GET_OFFSET_OF(BASE_ASYNC_OBJECT, RPCRT4!BASE_ASYNC_OBJECT, ObjectList, &tmp2);
pCurrentObject = ObjectEntry;
pCurrentObject -= tmp2;
if (fFirstObject)
{
dprintf("Object List:\n");
fFirstObject = FALSE;
}
dprintf("%8lX\n", pCurrentObject);
// move to the next element in the list
GET_ADDRESS_OF(pCurrentObject, BASE_ASYNC_OBJECT, RPCRT4!BASE_ASYNC_OBJECT, ObjectList, ObjectList, tmp2);
GET_MEMBER(ObjectList, _LIST_ENTRY, RPCRT4!_LIST_ENTRY, Flink, Flink);
}
pTransportProtocol += GET_TYPE_SIZE(TransportProtocol, RPCRT4!TransportProtocol);
}
}
VOID
do_overlap(
ULONG64 qwAddr
)
{
ULONG64 tmp1;
ULONG tmp2;
PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, BASE_OVERLAPPED, RPCRT4!BASE_OVERLAPPED, pAsyncObject, "Overlapped\t\t\t", tmp2);
ULONG64 ol;
GET_ADDRESS_OF(qwAddr, BASE_OVERLAPPED, RPCRT4!BASE_OVERLAPPED, ol, ol, tmp2);
PRINT_MEMBER_WITH_LABEL(ol, _OVERLAPPED, RPCRT4!_OVERLAPPED, Pointer, "Overlapped, containing object\t", tmp1);
PRINT_MEMBER_WITH_LABEL(ol, _OVERLAPPED, RPCRT4!_OVERLAPPED, Internal, "ol.Internal (status)\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(ol, _OVERLAPPED, RPCRT4!_OVERLAPPED, InternalHigh, "ol.InternalHigh\t\t\t", tmp1);
PRINT_MEMBER_WITH_LABEL(ol, _OVERLAPPED, RPCRT4!_OVERLAPPED, hEvent, "ol.hEvent\t\t\t", tmp1);
return;
}
VOID
do_addrvect(
ULONG64 qwAddr
)
{
DWORD count;
BOOL b;
ULONG64 p;
GetData(qwAddr, &count, sizeof(count));
dprintf("Address vector entries\t\t - %d\n", count);
for (unsigned i = 0; i < count; i++)
{
ULONG64 tmp;
tmp = qwAddr + (i + 1) * AddressSize;
ReadPointer(tmp, &p);
dprintf("NetworkAddress[%d]\t\t - (0x%I64x) %ws\n",
i,
p,
ReadProcessRpcChar(p));
}
}