/*++
Copyright (c) 1992 Microsoft Corporation
Module Name:
NtfsKd.c
Abstract:
KD Extension Api for examining Ntfs specific data structures
Author:
Keith Kaplan [KeithKa] 24-Apr-96
Portions by Jeff Havens
Environment:
User Mode.
Revision History:
--*/
#include "pch.h"
KDDEBUGGER_DATA64 KdDebuggerData;
//
// The help strings printed out
//
static LPSTR Extensions[] = {
"NTFS Debugger Extensions:\n",
"cachedrecords Dump all threads with cached filerecord bcbs",
"cachedruns [addr] Dump the given cached run array ",
"ccb [addr] Dump Cache Control Block",
"fcb [addr] [1|2|...] Dump File Control Block",
"fcbtable [addr] [1|2|...] Dump File Control Block Table",
"file [addr] [1|2|...] Dump File Object",
"filerecord [addr] Dump the on-disk file record if cached, addr can be a fileobj, fcb or scb",
"foirp [addr] [1|2|...] Dump File Object by IRP address",
"hashtable [addr] Dump an lcb hashtable",
"icthread [addr] [1|2|...] Dump IrpContext by thread address",
"irpcontext [addr] [1|2|...] Dump IrpContext structure",
"lcb [addr] Dump Link Control Block",
"mcb [addr] Dump Map Control Block",
"ntfsdata [1|2|...] Dump NtfsData structure",
"ntfshelp Dump this display",
"scb [addr] [1|2|...] Dump Stream Control Block",
"transaction [addr] Dump the transaction attached to an irpcontext",
"vcb [addr] [0|1|2] Dump Volume Control Block",
0
};
VOID
ParseAndDump (
IN PCHAR args,
IN BOOL NoOptions,
IN STRUCT_DUMP_ROUTINE DumpFunction,
IN USHORT Processor,
IN HANDLE hCurrentThread
)
/*++
Routine Description:
Parse command line arguments and dump an ntfs structure.
Arguments:
Args - String of arguments to parse.
DumpFunction - Function to call with parsed arguments.
Return Value:
None
--*/
{
CHAR StringStructToDump[1024];
CHAR StringStructToDump2[1024];
ULONG64 StructToDump = 0;
ULONG64 StructToDump2 = 0;
LONG Options;
//
// If the caller specified an address then that's the item we dump
//
StructToDump = 0;
Options = 0;
StringStructToDump[0] = '\0';
if (*args) {
if (NoOptions) {
sscanf(args,"%s %s", StringStructToDump, StringStructToDump2 );
if (!GetExpressionEx(args,&StructToDump, &args)) {
dprintf("unable to get expression %s\n",StringStructToDump);
return;
}
if (!GetExpressionEx(args,&StructToDump2, &args)) {
dprintf("unable to get expression %s\n",StringStructToDump2);
return;
}
} else {
sscanf(args,"%s %lx", StringStructToDump, &Options );
if (!GetExpressionEx(args,&StructToDump, &args)) {
dprintf("unable to get expression %s\n",StringStructToDump);
return;
}
}
}
(*DumpFunction) ( StructToDump, StructToDump2, Options, Processor, hCurrentThread );
dprintf( "\n" );
}
VOID
PrintHelp (
VOID
)
/*++
Routine Description:
Dump out one line of help for each DECLARE_API
Arguments:
None
Return Value:
None
--*/
{
int i;
for( i=0; Extensions[i]; i++ ) {
dprintf( " %s\n", Extensions[i] );
}
}
DECLARE_API( ccb )
/*++
Routine Description:
Dump ccb struct
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpCcb, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( fcb )
/*++
Routine Description:
Dump fcb struct
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpFcb, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( fcbtable )
/*++
Routine Description:
Dump fcb table struct
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpFcbTable, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( file )
/*++
Routine Description:
Dump FileObject struct
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpFileObject, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( filerecord )
/*++
Routine Description:
Dump file record struct
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpFileRecord, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( foirp )
/*++
Routine Description:
Dump FileObject struct, given an irp
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpFileObjectFromIrp, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( icthread )
/*++
Routine Description:
Dump IrpContext struct, given a Thread
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpIrpContextFromThread, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( irpcontext )
/*++
Routine Description:
Dump IrpContext
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpIrpContext, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( lcb )
/*++
Routine Description:
Dump lcb struct
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpLcb, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( logfile )
/*++
Routine Description:
Dump log file
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpLogFile, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( mcb )
/*++
Routine Description:
Dump mcb struct
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpMcb, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( ntfsdata )
/*++
Routine Description:
Dump the NtfsData struct
Arguments:
arg - [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpNtfsData, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( ntfshelp )
/*++
Routine Description:
Dump help message
Arguments:
None
Return Value:
None
--*/
{
INIT_API();
PrintHelp();
}
DECLARE_API( scb )
/*++
Routine Description:
Dump Scb struct
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpScb, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( vcb )
/*++
Routine Description:
Dump Vcb struct
Arguments:
arg - [Address] [options]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpVcb, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( dsc )
/*++
Routine Description:
Dump private syscache log from SCB
Arguments:
arg - [scb address]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpSysCache, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( cachedrecords )
/*++
Routine Description:
Dump private syscache log from SCB
Arguments:
arg - [scb address]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpCachedRecords, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( extents )
/*++
Routine Description:
Dump private syscache log from SCB
Arguments:
arg - [scb address]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpExtents, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( hashtable )
/*++
Routine Description:
Dump private syscache log from SCB
Arguments:
arg - [scb address]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, TRUE, (STRUCT_DUMP_ROUTINE) DumpHashTable, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( dumpchain )
/*++
Routine Description:
Dump private syscache log from SCB
Arguments:
arg - [scb address]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpFcbLcbChain, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( overflow )
/*++
Routine Description:
Dump private syscache log from SCB
Arguments:
arg - [scb address]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpOverflow, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( cachedruns )
/*++
Routine Description:
Dump the cached runs structure
Arguments:
arg - [cached runs address]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpCachedRuns, (USHORT)dwProcessor, hCurrentThread );
}
DECLARE_API( transaction )
/*++
Routine Description:
Dump the transaction associated with the given irpcontext
Arguments:
arg - [irpcontext]
Return Value:
None
--*/
{
INIT_API();
ParseAndDump( (PCHAR) args, FALSE, (STRUCT_DUMP_ROUTINE) DumpTransaction, (USHORT)dwProcessor, hCurrentThread );
}