/*++
Copyright (c) 1989-2000 Microsoft Corporation
Module Name:
Debugger.cpp
Abstract:
This module implements the AppVerifier.exe debugger.
Author:
clupu created 01/25/2001
Revision History:
--*/
#include "stdafx.h"
#include "appverif.h"
#include "Log.h"
#include <memory.h>
#include <stdlib.h>
#include "wdbgexts.h"
#include "Debugger.h"
#include "Setting.h"
#include "UserDump.h"
#include "DbgHelp.h"
#include "ChooseExe.h"
#ifdef BP_SIZE
ULONG g_BpSize = BP_SIZE;
#endif
#ifdef BP_INSTR
ULONG g_BpInstr = BP_INSTR;
#endif
typedef void (*PFNDBGEXT)(HANDLE hCurrentProcess,
HANDLE hCurrentThread,
DWORD dwUnused,
PWINDBG_EXTENSION_APIS lpExtensionApis,
LPSTR lpArgumentString);
PFNDBGEXT g_pfnPhextsInit;
BOOL g_bInitialBreakpoint = TRUE;
PROCESS_INFORMATION g_ProcessInformation;
WINDBG_EXTENSION_APIS ExtensionAPIs;
typedef struct tagLOADEDDLL
{
struct tagLOADEDDLL* pNext;
LPTSTR pszName;
LPVOID lpBaseOfDll;
} LOADEDDLL, *PLOADEDDLL;
PLOADEDDLL g_pFirstDll;
PPROCESS_INFO g_pProcessHead = NULL;
PPROCESS_INFO g_pFirstProcess = NULL;
//
// BUGBUG: what's this for ?
//
TCHAR g_szDbgString[1024];
//
// Local function prototypes
//
void DebuggerLoop(void);
DWORD WINAPI ExecuteAppThread( LPVOID lParam )
/*++
Return: TRUE if successful, FALSE otherwise.
Desc: Launch the debuggee.
--*/
{
BOOL bRet;
STARTUPINFO StartupInfo;
ZeroMemory(&StartupInfo, sizeof(StartupInfo));
StartupInfo.cb = sizeof(StartupInfo);
//
// Set some pageheap flags
//
AVSetVerifierFlagsForExe(g_szAppShortName, (DWORD)(LPARAM)lParam);
bRet = CreateProcess(NULL,
g_szAppFullPath,
NULL,
NULL,
FALSE,
CREATE_SEPARATE_WOW_VDM | DEBUG_ONLY_THIS_PROCESS,
NULL,
NULL,
&StartupInfo,
&g_ProcessInformation);
if ( !bRet )
{
LogMessage(LOG_ERROR, _T("[ExecuteApp] Couldn't start \"%s\""), g_szAppFullPath);
return 0;
}
LogMessage(LOG_INFO,
_T("[ExecuteApp] CreateProcess hProcess 0x%X. \"%s\""),
g_ProcessInformation.hProcess,
g_szAppFullPath);
if ( g_ProcessInformation.hProcess != NULL )
{
//
// Start the debugger loop.
//
DebuggerLoop();
//
// Free the memory.
//
PPROCESS_INFO pProcess = g_pProcessHead;
PPROCESS_INFO pProcessNext;
while ( pProcess != NULL )
{
pProcessNext = pProcess->pNext;
PTHREAD_INFO pThread = pProcess->pFirstThreadInfo;
PTHREAD_INFO pThreadNext;
while ( pThread != NULL )
{
pThreadNext = pThread->pNext;
HeapFree(GetProcessHeap(), 0, pThread);
pThread = pThreadNext;
}
HeapFree(GetProcessHeap(), 0, pProcess);
pProcess = pProcessNext;
}
g_pProcessHead = NULL;
PLOADEDDLL pDll = g_pFirstDll;
PLOADEDDLL pDllNext;
while ( pDll != NULL )
{
pDllNext = pDll->pNext;
HeapFree(GetProcessHeap(), 0, pDll->pszName);
HeapFree(GetProcessHeap(), 0, pDll);
pDll = pDllNext;
}
g_pFirstDll = NULL;
g_bDebuggeeExited = TRUE;
CloseHandle(g_ProcessInformation.hProcess);
CloseHandle(g_ProcessInformation.hThread);
ZeroMemory(&g_ProcessInformation, sizeof(PROCESS_INFORMATION));
}
//
// Delete the pageheap flags
//
AVSetVerifierFlagsForExe(g_szAppShortName, 0);
return 1;
}
PPROCESS_INFO GetProcessInfo( HANDLE hProcess )
{
PPROCESS_INFO pProcess = g_pProcessHead;
while ( pProcess != NULL )
{
if ( pProcess->hProcess == hProcess )
{
return pProcess;
}
}
return NULL;
}
SIZE_T
ReadMemoryDbg(
HANDLE hProcess,
LPVOID Address,
LPVOID Buffer,
SIZE_T Length
)
{
SIZE_T cbRead;
LPVOID AddressBp;
PPROCESS_INFO pProcess;
if ( !ReadProcessMemory(hProcess,
Address,
Buffer,
Length,
&cbRead) )
{
return 0;
}
pProcess = GetProcessInfo(hProcess);
if ( pProcess == NULL )
{
return 0;
}
#if defined(BP_INSTR) && defined(BP_SIZE)
for ( int i = 0; i < MAX_BREAKPOINTS; i++ )
{
AddressBp = pProcess->bp[i].Address;
if ( (ULONG_PTR)AddressBp >= (ULONG_PTR)Address &&
(ULONG_PTR)AddressBp < (ULONG_PTR)Address + Length )
{
CopyMemory((LPVOID)((ULONG_PTR)Buffer + (ULONG_PTR)AddressBp - (ULONG_PTR)Address),
&pProcess->bp[i].OriginalInstr,
g_BpSize);
}
}
#endif
return cbRead;
}
BOOL
WriteMemoryDbg(
HANDLE hProcess,
PVOID Address,
PVOID Buffer,
SIZE_T Length
)
{
SIZE_T cb = 0;
BOOL bSuccess;
bSuccess = WriteProcessMemory(hProcess, Address, Buffer, Length, &cb);
if ( !bSuccess || cb != Length )
{
return FALSE;
}
return TRUE;
}
BOOL
GetImageName(
HANDLE hProcess,
ULONG_PTR ImageBase,
PVOID ImageNamePtr,
LPTSTR ImageName,
DWORD ImageNameLength
)
/*++
Return: TRUE if successful, FALSE otherwise.
Desc: BUGBUG: give details here
--*/
{
DWORD_PTR i;
BYTE UnicodeBuf[256 * 2];
IMAGE_DOS_HEADER dh;
IMAGE_NT_HEADERS nh;
IMAGE_EXPORT_DIRECTORY expdir;
if ( !ReadMemoryDbg(hProcess,
(ULONG*)ImageNamePtr,
&i,
sizeof(i)) )
{
goto GetFromExports;
}
if ( !ReadMemoryDbg(hProcess,
(ULONG*)i,
(ULONG*)UnicodeBuf,
sizeof(UnicodeBuf)) )
{
goto GetFromExports;
}
ZeroMemory(ImageName, ImageNameLength);
#ifdef UNICODE
lstrcpyW(ImageName, (LPCWSTR)UnicodeBuf);
#else
WideCharToMultiByte(CP_ACP,
0,
(LPWSTR)UnicodeBuf,
wcslen((LPWSTR)UnicodeBuf),
ImageName,
ImageNameLength,
NULL,
NULL);
#endif // UNICODE
if ( lstrlen(ImageName) == 0 )
{
goto GetFromExports;
}
return TRUE;
GetFromExports:
if ( !ReadMemoryDbg(hProcess,
(ULONG*)ImageBase,
(ULONG*)&dh,
sizeof(IMAGE_DOS_HEADER)) )
{
return FALSE;
}
if ( dh.e_magic != IMAGE_DOS_SIGNATURE )
{
return FALSE;
}
if ( !ReadMemoryDbg(hProcess,
(ULONG*)(ImageBase + dh.e_lfanew),
(ULONG*)&nh,
sizeof(IMAGE_NT_HEADERS)) )
{
return FALSE;
}
if ( nh.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress == 0 )
{
return FALSE;
}
if ( !ReadMemoryDbg(hProcess,
(ULONG*)(ImageBase +
nh.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress),
(ULONG*)&expdir,
sizeof(IMAGE_EXPORT_DIRECTORY)) )
{
return FALSE;
}
if ( !ReadMemoryDbg(hProcess,
(ULONG*)(ImageBase + expdir.Name),
#ifdef UNICODE
(ULONG*)UnicodeBuf,
#else
(ULONG*)ImageName,
#endif // UNICODE
ImageNameLength) )
{
return FALSE;
}
#ifdef UNICODE
MultiByteToWideChar(CP_ACP,
0,
(LPCSTR)UnicodeBuf,
-1,
ImageName,
ImageNameLength);
#endif // UNICODE
return TRUE;
}
void
AddDll(
LPVOID lpBaseOfDll,
LPCTSTR pszDllName
)
/*++
Return: void.
Desc: BUGBUG: give details here
--*/
{
PLOADEDDLL pDll;
pDll = (PLOADEDDLL)HeapAlloc(GetProcessHeap(), 0, sizeof(LOADEDDLL));
if ( pDll == NULL )
{
LogMessage(LOG_ERROR, _T("[AddDll] Failed to allocate %d bytes"), sizeof(LOADEDDLL));
return;
}
pDll->pszName = (LPTSTR)HeapAlloc(GetProcessHeap(), 0, (lstrlen(pszDllName) + 1) * sizeof(TCHAR));
if ( pDll->pszName == NULL )
{
HeapFree(GetProcessHeap(), 0, pDll);
LogMessage(LOG_ERROR,
_T("[AddDll] Failed to allocate %d bytes"),
(lstrlen(pszDllName) + 1) * sizeof(TCHAR));
return;
}
lstrcpy(pDll->pszName, pszDllName);
pDll->lpBaseOfDll = lpBaseOfDll;
pDll->pNext = g_pFirstDll;
g_pFirstDll = pDll;
}
LPTSTR GetDll( LPVOID lpBaseOfDll )
/*++
Return: The name of the DLL with the specified base address.
Desc: BUGBUG
--*/
{
PLOADEDDLL pDll = g_pFirstDll;
while ( pDll != NULL )
{
if ( pDll->lpBaseOfDll == lpBaseOfDll )
{
return pDll->pszName;
}
pDll = pDll->pNext;
}
return NULL;
}
void RemoveDll( LPVOID lpBaseOfDll )
/*++
Return: void.
Desc: BUGBUG: give details here
--*/
{
PLOADEDDLL* ppDll = &g_pFirstDll;
PLOADEDDLL pDllFree;
while ( *ppDll != NULL )
{
if ( (*ppDll)->lpBaseOfDll == lpBaseOfDll )
{
HeapFree(GetProcessHeap(), 0, (*ppDll)->pszName);
pDllFree = *ppDll;
*ppDll = (*ppDll)->pNext;
HeapFree(GetProcessHeap(), 0, pDllFree);
break;
}
ppDll = &((*ppDll)->pNext);
}
}
BOOL ProcessModuleLoad( PPROCESS_INFO pProcess, DEBUG_EVENT* pde )
/*++
Return: TRUE on success, FALSE otherwise
Desc: Process all module load debug events, create process & dll load.
The purpose is to allocate a MODULEINFO structure, fill in the
necessary values, and load the symbol table.
--*/
{
HANDLE hFile=NULL;
DWORD_PTR dwBaseOfImage;
if ( pde->dwDebugEventCode == CREATE_PROCESS_DEBUG_EVENT )
{
hFile = pde->u.CreateProcessInfo.hFile;
dwBaseOfImage = (DWORD_PTR)pde->u.CreateProcessInfo.lpBaseOfImage;
SymInitialize(pProcess->hProcess, NULL, FALSE);
}
else if ( pde->dwDebugEventCode == LOAD_DLL_DEBUG_EVENT )
{
hFile = pde->u.LoadDll.hFile;
dwBaseOfImage = (DWORD_PTR)pde->u.LoadDll.lpBaseOfDll;
}
if ( hFile == NULL || hFile == INVALID_HANDLE_VALUE )
{
return FALSE;
}
if ( dwBaseOfImage==(DWORD_PTR)NULL )
{
return FALSE;
}
if ( !SymLoadModule(pProcess->hProcess, hFile, NULL, NULL, dwBaseOfImage, 0) )
{
return FALSE;
}
return TRUE;
}
void DebuggerLoop( void )
/*++
Return: void.
Desc: BUGBUG: give details here
--*/
{
DEBUG_EVENT DebugEv; // debugging event information
DWORD dwContinueStatus = DBG_CONTINUE; // exception continuation
PPROCESS_INFO pProcess = NULL;
PTHREAD_INFO pThread = NULL;
while ( TRUE )
{
//
// Wait for a debugging event to occur. The second parameter indicates
// that the function does not return until a debugging event occurs.
//
WaitForDebugEvent(&DebugEv, INFINITE);
//
// Update the processes and threads lists.
//
pProcess = g_pProcessHead;
while ( pProcess != NULL )
{
if ( pProcess->dwProcessId == DebugEv.dwProcessId )
{
break;
}
pProcess = pProcess->pNext;
}
if ( pProcess == NULL )
{
//
// New process.
//
pProcess = (PPROCESS_INFO)HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY,
sizeof(PROCESS_INFO));
if ( pProcess == NULL )
{
LogMessage(LOG_ERROR,
_T("[DebuggerLoop] Failed to allocate memory for the new process. Fatal !"));
break;
}
pProcess->dwProcessId = DebugEv.dwProcessId;
pProcess->pNext = g_pProcessHead;
g_pProcessHead = pProcess;
}
pThread = pProcess->pFirstThreadInfo;
while ( pThread != NULL )
{
if ( pThread->dwThreadId == DebugEv.dwThreadId )
{
break;
}
pThread = pThread->pNext;
}
if ( pThread == NULL )
{
//
// New thread.
//
pThread = (PTHREAD_INFO)HeapAlloc(GetProcessHeap(),
HEAP_ZERO_MEMORY,
sizeof(THREAD_INFO));
if ( pThread == NULL )
{
LogMessage(LOG_ERROR,
_T("[DebuggerLoop] Failed to allocate memory for the new thread. Fatal !"));
break;
}
pThread->dwThreadId = DebugEv.dwThreadId;
pThread->pNext = pProcess->pFirstThreadInfo;
pProcess->pFirstThreadInfo = pThread;
}
dwContinueStatus = DBG_CONTINUE;
if ( DebugEv.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT )
{
goto EndProcess;
}
switch ( DebugEv.dwDebugEventCode )
{
case EXCEPTION_DEBUG_EVENT:
switch ( DebugEv.u.Exception.ExceptionRecord.ExceptionCode )
{
case EXCEPTION_BREAKPOINT:
//
// Hit a breakpoint.
//
if ( !pProcess->bSeenLdrBp )
{
pProcess->bSeenLdrBp = TRUE;
//
// When the initial breakpoint is hit all the
// staticly linked DLLs are already loaded so
// we can go ahead and set breakpoints.
//
LogMessage(LOG_INFO, _T("[DebuggerLoop] Hit initial breakpoint."));
//
// Now it would be a good time to initialize the debugger extensions.
//
break;
}
LogMessage(LOG_INFO, _T("[DebuggerLoop] Hit breakpoint."));
LogAVStatus(AVS_PAGEHEAP_DOUBLEFREE);
if ( MessageBox(NULL,
_T("An Access Violation occured. Do you want to create")
_T(" a crash dump file so you can later debug this problem ?"),
_T("Error"),
MB_ICONEXCLAMATION | MB_YESNO | MB_DEFBUTTON1) == IDYES )
{
pProcess->DebugEvent = DebugEv;
GenerateUserModeDump(g_szCrashDumpFile,
pProcess,
&DebugEv.u.Exception);
}
if ( MessageBox(NULL,
_T("Do you want to continue running the program ?"),
_T("Error"),
MB_ICONEXCLAMATION | MB_YESNO | MB_DEFBUTTON1) != IDYES )
{
goto EndProcess;
}
dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;
break;
case STATUS_SINGLE_STEP:
LogMessage(LOG_INFO, _T("[DebuggerLoop] Hit single step breakpoint."));
break;
case EXCEPTION_ACCESS_VIOLATION:
LogMessage(LOG_INFO,
_T("[DebuggerLoop] AV. Addr: 0x%08X, firstChance %d"),
DebugEv.u.Exception.ExceptionRecord.ExceptionAddress,
DebugEv.u.Exception.dwFirstChance);
LogAVStatus(AVS_PAGEHEAP_DOUBLEFREE);
if ( MessageBox(NULL,
_T("An Access Violation occured. Do you want to create")
_T(" a crash dump file so you can later debug this problem ?"),
_T("Error"),
MB_ICONEXCLAMATION | MB_YESNO | MB_DEFBUTTON1) == IDYES )
{
pProcess->DebugEvent = DebugEv;
GenerateUserModeDump(g_szCrashDumpFile,
pProcess,
&DebugEv.u.Exception);
}
if ( MessageBox(NULL,
_T("Do you want to continue running the program ?"),
_T("Error"),
MB_ICONEXCLAMATION | MB_YESNO | MB_DEFBUTTON1) != IDYES )
{
goto EndProcess;
}
dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;
break;
default:
LogMessage(LOG_INFO, _T("[DebuggerLoop] Unknown debugger exception."));
dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;
break;
}
break;
case CREATE_THREAD_DEBUG_EVENT:
pThread->hProcess = pProcess->hProcess;
pThread->hThread = DebugEv.u.CreateThread.hThread;
LogMessage(LOG_INFO,
_T("[DebuggerLoop] new thread. StartAddress: 0x%x"),
DebugEv.u.CreateThread.lpStartAddress);
break;
case EXIT_THREAD_DEBUG_EVENT:
LogMessage(LOG_INFO,
_T("[DebuggerLoop] exiting thread with code: 0x%x"),
DebugEv.u.ExitThread.dwExitCode);
break;
case CREATE_PROCESS_DEBUG_EVENT:
pProcess->hProcess = DebugEv.u.CreateProcessInfo.hProcess;
pThread->hProcess = pProcess->hProcess;
pThread->hThread = DebugEv.u.CreateProcessInfo.hThread;
if ( g_pFirstProcess == NULL )
{
g_pFirstProcess = pProcess;
}
pProcess->EntryPoint = DebugEv.u.CreateProcessInfo.lpStartAddress;
ProcessModuleLoad(pProcess, &DebugEv);
LogMessage(LOG_INFO,
_T("[DebuggerLoop] new process. BaseImage: 0x%x StartAddress: 0x%x"),
DebugEv.u.CreateProcessInfo.lpBaseOfImage,
DebugEv.u.CreateProcessInfo.lpStartAddress);
break;
case LOAD_DLL_DEBUG_EVENT:
{
TCHAR szAsciiBuf[256];
TCHAR szDllName[128];
TCHAR szExt[16];
BOOL bRet;
bRet = GetImageName(pProcess->hProcess,
(ULONG_PTR)DebugEv.u.LoadDll.lpBaseOfDll,
DebugEv.u.LoadDll.lpImageName,
szAsciiBuf,
sizeof(szAsciiBuf));
if (!bRet) {
LogMessage(LOG_INFO,
_T("[DebuggerLoop] DLL LOADED. BaseDll: 0x%X cannot get the name."),
DebugEv.u.LoadDll.lpBaseOfDll);
AddDll(DebugEv.u.LoadDll.lpBaseOfDll, NULL);
} else {
_tsplitpath(szAsciiBuf, NULL, NULL, szDllName, szExt);
lstrcat(szDllName, szExt);
AddDll(DebugEv.u.LoadDll.lpBaseOfDll, szDllName);
LogMessage(LOG_INFO,
_T("[DebuggerLoop] DLL LOADED. BaseDll: 0x%X \"%s\"."),
DebugEv.u.LoadDll.lpBaseOfDll,
szDllName);
}
ProcessModuleLoad(pProcess, &DebugEv);
CloseHandle(DebugEv.u.LoadDll.hFile);
break;
}
case UNLOAD_DLL_DEBUG_EVENT:
{
LPTSTR pszName = GetDll(DebugEv.u.UnloadDll.lpBaseOfDll);
if ( pszName == NULL )
{
LogMessage(LOG_INFO,
_T("[DebuggerLoop] DLL UNLOADED. BaseDll: 0x%X unknown."),
DebugEv.u.UnloadDll.lpBaseOfDll);
}
else
{
LogMessage(LOG_INFO,
_T("[DebuggerLoop] DLL UNLOADED. BaseDll: 0x%X \"%s\"."),
DebugEv.u.UnloadDll.lpBaseOfDll, pszName);
}
RemoveDll(DebugEv.u.UnloadDll.lpBaseOfDll);
break;
}
case OUTPUT_DEBUG_STRING_EVENT:
ReadMemoryDbg(pThread->hProcess,
DebugEv.u.DebugString.lpDebugStringData,
g_szDbgString,
DebugEv.u.DebugString.nDebugStringLength);
#ifdef UNICODE
LogMessage(LOG_INFO, _T("DPF - %S"), g_szDbgString);
#else
LogMessage(LOG_INFO, _T("DPF - %s"), g_szDbgString);
#endif // UNICODE
break;
default:
LogMessage(LOG_ERROR,
_T("[DebuggerLoop] Unknown event 0x%X"),
DebugEv.dwDebugEventCode);
break;
}
//
// Resume executing the thread that reported the debugging event.
//
ContinueDebugEvent(DebugEv.dwProcessId,
DebugEv.dwThreadId,
dwContinueStatus);
}
EndProcess:
LogMessage(LOG_INFO, _T("[DebuggerLoop] The debugged process has exited."));
LogAVStatus(AVS_APP_TERMINATED);
}