/*++ Copyright (c) 1995 Microsoft Corporation Module Name: symbolsp.c Abstract: This function implements a generic simple symbol handler. Author: Wesley Witt (wesw) 1-Sep-1994 Environment: User Mode --*/ #include #include #include #include #include "private.h" #include "symbols.h" #include "globals.h" #include "tlhelp32.h" #include "fecache.hpp" typedef BOOL (WINAPI *PMODULE32)(HANDLE, LPMODULEENTRY32); typedef HANDLE (WINAPI *PCREATE32SNAPSHOT)(DWORD, DWORD); typedef ULONG (NTAPI *PRTLQUERYPROCESSDEBUGINFORMATION)(HANDLE,ULONG,PRTL_DEBUG_INFORMATION); typedef PRTL_DEBUG_INFORMATION (NTAPI *PRTLCREATEQUERYDEBUGBUFFER)(ULONG,BOOLEAN); typedef NTSTATUS (NTAPI *PRTLDESTROYQUERYDEBUGBUFFER)(PRTL_DEBUG_INFORMATION); typedef NTSTATUS (NTAPI *PNTQUERYSYSTEMINFORMATION)(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG); typedef ULONG (NTAPI *PRTLNTSTATUSTODOSERROR)(NTSTATUS); //typedef NTSTATUS (NTAPI *PNTQUERYINFORMATIONPROCESS)(UINT_PTR,PROCESSINFOCLASS,UINT_PTR,ULONG,UINT_PTR); typedef NTSTATUS (NTAPI *PNTQUERYINFORMATIONPROCESS)(HANDLE,PROCESSINFOCLASS,PVOID,ULONG,PULONG); DWORD_PTR Win95GetProcessModules(HANDLE, PINTERNAL_GET_MODULE ,PVOID); DWORD_PTR NTGetProcessModules(HANDLE, PINTERNAL_GET_MODULE ,PVOID); DWORD64 miGetModuleBase(HANDLE hProcess, DWORD64 Address); // private version of qsort used to avoid compat problems on NT4 and win2k. // code is published from base\crts extern void __cdecl dbg_qsort(void *, size_t, size_t, int (__cdecl *) (const void *, const void *)); typedef struct _SYMBOL_INFO_LOOKUP { ULONG Segment; ULONG64 Offset; PCHAR NamePtr; SYMBOL_INFO SymInfo; } SYMBOL_INFO_LOOKUP; BOOL LoadSymbols( HANDLE hp, PMODULE_ENTRY mi, DWORD flags ) { if (flags & LS_JUST_TEST) { if ((mi->Flags & MIF_DEFERRED_LOAD) && !(mi->Flags & MIF_NO_SYMBOLS)) return FALSE; else return TRUE; } if (flags & LS_QUALIFIED) { if (g.SymOptions & SYMOPT_NO_UNQUALIFIED_LOADS) { if ((mi->Flags & MIF_DEFERRED_LOAD) && !(mi->Flags & MIF_NO_SYMBOLS)) return FALSE; } } if ((mi->Flags & MIF_DEFERRED_LOAD) && !(mi->Flags & MIF_NO_SYMBOLS)) return load(hp, mi); else if (flags & LS_FAIL_IF_LOADED) return FALSE; return TRUE; } // // Get the address form section no and offset in a PE file // ULONG GetAddressFromOffset( PMODULE_ENTRY mi, ULONG section, ULONG64 Offset, PULONG64 pAddress ) { ULONG Bias; if (section > mi->NumSections || !pAddress || !section || !mi ) { // Invalid !! return FALSE; } *pAddress = mi->BaseOfDll + mi->OriginalSectionHdrs[section-1].VirtualAddress + Offset; *pAddress = ConvertOmapFromSrc( mi, *pAddress, &Bias ); if (*pAddress) { *pAddress += Bias; } return TRUE; } /* * GetSymbolInfo * This extracts useful information from a CV SYMBOl record into a generic * SYMBOL_ENTRY structure. * * */ ULONG GetSymbolInfo( PMODULE_ENTRY me, PCHAR pRawSym, SYMBOL_INFO_LOOKUP *pSymEntry ) { PCHAR SymbolInfo = pRawSym; ULONG symIndex, typeIndex=0, segmentNum=0; ULONG64 Offset=0, Address=0, Value=0; // ULONG Register=0, bpRel=0, BaseReg=0; BOOL HasAddr=FALSE, HasValue=FALSE; PSYMBOL_INFO pSymInfo = &pSymEntry->SymInfo; if ((pRawSym != NULL) && (pSymEntry != NULL)) { SymbolInfo = (PCHAR) pRawSym; typeIndex = 0; symIndex = ((SYMTYPE *) (pRawSym))->rectyp; ZeroMemory(pSymEntry, sizeof(SYMBOL_INFO)); pSymInfo->ModBase = me->BaseOfDll; #define ExtractSymName(from) (pSymEntry->NamePtr = ((PCHAR) from) + 1); pSymInfo->NameLen = (UCHAR) *((PUCHAR) from); switch (symIndex) { case S_COMPILE : // 0x0001 Compile flags symbol case S_REGISTER_16t : { // 0x0002 Register variable break; } case S_CONSTANT_16t : { // 0x0003 constant symbol DWORD len=4; CONSTSYM_16t *constSym; constSym = (CONSTSYM_16t *) SymbolInfo; typeIndex = constSym->typind; // GetNumericValue((PCHAR)&constSym->value, &Value, &len); pSymInfo->Flags |= IMAGEHLP_SYMBOL_INFO_VALUEPRESENT; pSymInfo->Value = Value; ExtractSymName((constSym->name + len)); break; } case S_UDT_16t : { // 0x0004 User defined type UDTSYM_16t *udtSym; udtSym = (UDTSYM_16t *) SymbolInfo; typeIndex = udtSym->typind; ExtractSymName(udtSym->name); // strncpy(name, (PCHAR)symReturned + 7, (UCHAR) symReturned[6]); break; } case S_SSEARCH : // 0x0005 Start Search case S_END : // 0x0006 Block, procedure, "with" or thunk end case S_SKIP : // 0x0007 Reserve symbol space in $$Symbols table case S_CVRESERVE : // 0x0008 Reserved symbol for CV internal use case S_OBJNAME : // 0x0009 path to object file name case S_ENDARG : // 0x000a end of argument/return list case S_COBOLUDT_16t : // 0x000b special UDT for cobol that does not symbol pack case S_MANYREG_16t : // 0x000c multiple register variable case S_RETURN : // 0x000d return description symbol case S_ENTRYTHIS : // 0x000e description of this pointer on entry break; case S_BPREL16 : // 0x0100 BP-relative case S_LDATA16 : // 0x0101 Module-local symbol case S_GDATA16 : // 0x0102 Global data symbol case S_PUB16 : // 0x0103 a public symbol case S_LPROC16 : // 0x0104 Local procedure start case S_GPROC16 : // 0x0105 Global procedure start case S_THUNK16 : // 0x0106 Thunk Start case S_BLOCK16 : // 0x0107 block start case S_WITH16 : // 0x0108 with start case S_LABEL16 : // 0x0109 code label case S_CEXMODEL16 : // 0x010a change execution model case S_VFTABLE16 : // 0x010b address of virtual function table case S_REGREL16 : // 0x010c register relative address case S_BPREL32_16t : { // 0x0200 BP-relative break; } case S_LDATA32_16t :// 0x0201 Module-local symbol case S_GDATA32_16t :// 0x0202 Global data symbol case S_PUB32_16t : { // 0x0203 a public symbol (CV internal reserved) DATASYM32_16t *pData; pData = (DATASYM32_16t *) SymbolInfo; typeIndex = pData->typind; Offset = pData->off; segmentNum = pData->seg; HasAddr = TRUE; ExtractSymName(pData->name); // strncpy(name, (PCHAR)&pData->name[1], (UCHAR) pData->name[0]); break; } case S_LPROC32_16t : // 0x0204 Local procedure start case S_GPROC32_16t : { // 0x0205 Global procedure start PROCSYM32_16t *procSym; procSym = (PROCSYM32_16t *)SymbolInfo; // CONTEXT-SENSITIVE // Offset = procSym->off; segmentNum = procSym->seg; typeIndex = procSym->typind; ExtractSymName(procSym->name); // strncpy(name, (PCHAR)symReturned + 36, (UCHAR) symReturned[35]); break; } case S_THUNK32 : // 0x0206 Thunk Start case S_BLOCK32 : // 0x0207 block start case S_WITH32 : // 0x0208 with start case S_LABEL32 : // 0x0209 code label case S_CEXMODEL32 : // 0x020a change execution model case S_VFTABLE32_16t : // 0x020b address of virtual function table case S_REGREL32_16t : // 0x020c register relative address case S_LTHREAD32_16t : // 0x020d local thread storage case S_GTHREAD32_16t : // 0x020e global thread storage case S_SLINK32 : // 0x020f static link for MIPS EH implementation case S_LPROCMIPS_16t : // 0x0300 Local procedure start case S_GPROCMIPS_16t : { // 0x0301 Global procedure start break; } case S_PROCREF : { // 0x0400 Reference to a procedure // typeIndex = ((PDWORD) symReturned) + 3; // strncpy(name, symReturned + 13, (char) *(symReturned+12)); break; } case S_DATAREF : // 0x0401 Reference to data case S_ALIGN : // 0x0402 Used for page alignment of symbols case S_LPROCREF : // 0x0403 Local Reference to a procedure // sym records with 32-bit types embedded instead of 16-bit // all have 0x1000 bit set for easy identification // only do the 32-bit target versions since we don't really // care about 16-bit ones anymore. case S_TI16_MAX : // 0x1000, break; case S_REGISTER : { // 0x1001 Register variable REGSYM *regSym; regSym = (REGSYM *)SymbolInfo; typeIndex = regSym->typind; pSymInfo->Flags = IMAGEHLP_SYMBOL_INFO_REGISTER; LookupRegID((DWORD)regSym->reg, me->MachineType, &pSymInfo->Register); ExtractSymName(regSym->name); break; } case S_CONSTANT : { // 0x1002 constant symbol CONSTSYM *constSym; DWORD len=4, val; constSym = (CONSTSYM *) SymbolInfo; // GetNumericValue((PCHAR)&constSym->value, &Value, &len); pSymInfo->Flags |= IMAGEHLP_SYMBOL_INFO_VALUEPRESENT; pSymInfo->Value = Value; typeIndex = constSym->typind; ExtractSymName((constSym->name+len)); break; } case S_UDT : { // 0x1003 User defined type UDTSYM *udtSym; udtSym = (UDTSYM *) SymbolInfo; typeIndex = udtSym->typind; ExtractSymName(udtSym->name); break; } case S_COBOLUDT : // 0x1004 special UDT for cobol that does not symbol pack break; case S_MANYREG : // 0x1005 multiple register variable #if 0 typedef struct MANYREGSYM { unsigned short reclen; // Record length unsigned short rectyp; // S_MANYREG CV_typ_t typind; // Type index unsigned char count; // count of number of registers unsigned char reg[1]; // count register enumerates followed by // length-prefixed name. Registers are // most significant first. } MANYREGSYM; typedef struct MANYREGSYM2 { unsigned short reclen; // Record length unsigned short rectyp; // S_MANYREG2 CV_typ_t typind; // Type index unsigned short count; // count of number of registers unsigned short reg[1]; // count register enumerates followed by // length-prefixed name. Registers are // most significant first. } MANYREGSYM2; #endif break; case S_BPREL32 : { // 0x1006 BP-relative BPRELSYM32 *bprelSym; bprelSym = (BPRELSYM32 *)SymbolInfo; typeIndex = bprelSym->typind; pSymInfo->Flags = IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE; pSymInfo->Address = bprelSym->off; ExtractSymName(bprelSym->name); break; } case S_LDATA32 : // 0x1007 Module-local symbol case S_GDATA32 : // 0x1008 Global data symbol case S_PUB32 : { // 0x1009 a public symbol (CV internal reserved) DATASYM32 *dataSym; dataSym = (DATASYM32 *)SymbolInfo; HasAddr = TRUE; Offset = dataSym->off; segmentNum = dataSym->seg; typeIndex = dataSym->typind; //(PDWORD) symReturned; ExtractSymName(dataSym->name); // strncpy(name, (PCHAR)symReturned+11, (UCHAR) symReturned[10]); break; } case S_LPROC32 : // 0x100a Local procedure start case S_GPROC32 : { // 0x100b Global procedure start PROCSYM32 *procSym; procSym = (PROCSYM32 *) SymbolInfo; // CONTEXT-SENSITIVE HasAddr = TRUE; Offset = procSym->off; segmentNum = procSym->seg; typeIndex = procSym->typind; ExtractSymName(procSym->name); break; } case S_VFTABLE32 : // 0x100c address of virtual function table break; case S_REGREL32 : { // 0x100d register relative address REGREL32 *regrelSym; regrelSym = (REGREL32 *)SymbolInfo; typeIndex = regrelSym->typind; pSymInfo->Flags = IMAGEHLP_SYMBOL_INFO_REGRELATIVE; pSymInfo->Address = regrelSym->off; LookupRegID((DWORD)regrelSym->reg, me->MachineType, &pSymInfo->Register); ExtractSymName(regrelSym->name); break; } case S_LTHREAD32 : // 0x100e local thread storage case S_GTHREAD32 : // 0x100f global thread storage case S_LPROCMIPS : // 0x1010 Local procedure start case S_GPROCMIPS : // 0x1011 Global procedure start case S_FRAMEPROC : // 0x1012 extra frame and proc information case S_COMPILE2 : // 0x1013 extended compile flags and info case S_MANYREG2 : // 0x1014 multiple register variable case S_LPROCIA64 : // 0x1015 Local procedure start (IA64) case S_GPROCIA64 : // 0x1016 Global procedure start (IA64) case S_RECTYPE_MAX : default: return FALSE; } /* switch */ if (HasAddr && GetAddressFromOffset(me, segmentNum, Offset, &Address)) { pSymInfo->Address = Address; } pSymInfo->TypeIndex = typeIndex; pSymEntry->Offset = Offset; pSymEntry->Segment = segmentNum; } else { return FALSE; } return TRUE; } /* * cvExtractSymbolInfo * This extracts useful information from a CV SYMBOl record into a generic * SYMBOL_ENTRY structure. * * */ ULONG cvExtractSymbolInfo( PMODULE_ENTRY me, PCHAR pRawSym, PSYMBOL_ENTRY pSymEntry, BOOL fCopyName ) { SYMBOL_INFO_LOOKUP SymInfoLookup={0}; ULONG reg; pSymEntry->Size = 0; pSymEntry->Flags = 0; pSymEntry->Address = 0; if (fCopyName) *pSymEntry->Name = 0; else pSymEntry->Name = 0; pSymEntry->NameLength = 0; pSymEntry->Segment = 0; pSymEntry->Offset = 0; pSymEntry->TypeIndex = 0; pSymEntry->ModBase = 0; if (GetSymbolInfo(me, pRawSym, &SymInfoLookup)) { LARGE_INTEGER li; pSymEntry->NameLength = SymInfoLookup.SymInfo.NameLen; pSymEntry->TypeIndex = SymInfoLookup.SymInfo.TypeIndex; pSymEntry->Offset = SymInfoLookup.Offset; pSymEntry->Segment = SymInfoLookup.Segment; pSymEntry->ModBase = me->BaseOfDll; // NOTE: this was implented as a mask - but used differently switch (SymInfoLookup.SymInfo.Flags) { case IMAGEHLP_SYMBOL_INFO_REGISTER: pSymEntry->Flags = SYMF_REGISTER; pSymEntry->Address = SymInfoLookup.SymInfo.Register; break; case IMAGEHLP_SYMBOL_INFO_REGRELATIVE: // DBGHELP_HACK - HiPart of Addr = RegId , LowPart = Pffset pSymEntry->Flags = SYMF_REGREL; //LookupRegID((DWORD)SymInfoLookup.SymInfo.Register, me->MachineType, &pSymEntry->Segment); li.LowPart = (ULONG) SymInfoLookup.SymInfo.Address; li.HighPart = SymInfoLookup.SymInfo.Register; pSymEntry->Segment = SymInfoLookup.SymInfo.Register; pSymEntry->Address = li.QuadPart; break; case IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE: pSymEntry->Flags = SYMF_FRAMEREL; pSymEntry->Address = SymInfoLookup.SymInfo.Address; break; case IMAGEHLP_SYMBOL_INFO_VALUEPRESENT: default: pSymEntry->Address = SymInfoLookup.SymInfo.Address; break; } if (fCopyName) { if (!pSymEntry->Name) return FALSE; *pSymEntry->Name = 0; strncpy(pSymEntry->Name, SymInfoLookup.NamePtr ? SymInfoLookup.NamePtr : "", SymInfoLookup.SymInfo.NameLen); } else { pSymEntry->Name = SymInfoLookup.NamePtr; } return TRUE; } return FALSE; } DWORD_PTR NTGetPID( HANDLE hProcess ) { HMODULE hModule; PNTQUERYINFORMATIONPROCESS NtQueryInformationProcess; PROCESS_BASIC_INFORMATION pi; NTSTATUS status; hModule = GetModuleHandle( "ntdll.dll" ); if (!hModule) { return ERROR_MOD_NOT_FOUND; } NtQueryInformationProcess = (PNTQUERYINFORMATIONPROCESS)GetProcAddress( hModule, "NtQueryInformationProcess" ); if (!NtQueryInformationProcess) { return ERROR_INVALID_FUNCTION; } status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pi, sizeof(pi), NULL); if (!NT_SUCCESS(status)) return 0; return pi.UniqueProcessId; } // // the block bounded by the #ifdef _X86_ statement // contains the code for getting the PID from an // HPROCESS when running under Win9X // #ifdef _X86_ #define HANDLE_INVALID ((HANDLE)0xFFFFFFFF) #define HANDLE_CURRENT_PROCESS ((HANDLE)0x7FFFFFFF) #define HANDLE_CURRENT_THREAD ((HANDLE)0xFFFFFFFE) #define MAX_HANDLE_VALUE ((HANDLE)0x00FFFFFF) // Thread Information Block. typedef struct _TIB { DWORD unknown[12]; DWORD_PTR ppdb; } TIB, *PTIB; // Task Data Block typedef struct _TDB { DWORD unknown[2]; TIB tib; } TDB, *PTDB; typedef struct _OBJ { BYTE typObj; // object type BYTE objFlags; // object flags WORD cntUses; // count of this objects usage } OBJ, *POBJ; typedef struct _HTE { DWORD flFlags; POBJ pobj; } HTE, *PHTE; typedef struct _HTB { DWORD chteMax; HTE rghte[1]; } HTB, *PHTB; typedef struct _W9XPDB { DWORD unknown[17]; PHTB phtbHandles; } W9XPDB, *PW9XPDB; #pragma warning(disable:4035) _inline struct _TIB * GetCurrentTib(void) { _asm mov eax, fs:[0x18] } // stuff needed to convert local handle #define IHTETOHANDLESHIFT 2 #define GLOBALHANDLEMASK (0x453a4d3cLU) #define IHTEFROMHANDLE(hnd) ((hnd) == HANDLE_INVALID ? (DWORD)(hnd) : (((DWORD)(hnd)) >> IHTETOHANDLESHIFT)) #define IHTEISGLOBAL(ihte) \ (((ihte) >> (32 - 8 - IHTETOHANDLESHIFT)) == (((DWORD)GLOBALHANDLEMASK) >> 24)) #define IS_WIN32_PREDEFINED_HANDLE(hnd) \ ((hnd == HANDLE_CURRENT_PROCESS)||(hnd == HANDLE_CURRENT_THREAD)||(hnd == HANDLE_INVALID)) DWORD GetWin9xObsfucator( VOID ) /*++ Routine Description: GetWin9xObsfucator() Arguments: none Return Value: Obsfucator key used by Windows9x to hide Process and Thread Id's Notes: The code has only been tested on Windows98SE and Millennium. --*/ { DWORD ppdb = 0; // W9XPDB = Process Data Block DWORD processId = (DWORD) GetCurrentProcessId(); // get PDB pointer ppdb = GetCurrentTib()->ppdb; return ppdb ^ processId; } DWORD_PTR GetPtrFromHandle( IN HANDLE Handle ) /*++ Routine Description: GetPtrFromHandle() Arguments: Handle - handle from Process handle table Return Value: Real Pointer to object Notes: The code has only been tested on Windows98SE and Millennium. --*/ { DWORD_PTR ptr = 0; DWORD ihte = 0; PW9XPDB ppdb = 0; ppdb = (PW9XPDB) GetCurrentTib()->ppdb; // check for pre-defined handle values. if (Handle == HANDLE_CURRENT_PROCESS) { ptr = (DWORD_PTR) ppdb; } else if (Handle == HANDLE_CURRENT_THREAD) { ptr = (DWORD_PTR) CONTAINING_RECORD(GetCurrentTib(), TDB, tib); } else if (Handle == HANDLE_INVALID) { ptr = 0; } else { // not a special handle, we can perform our magic. ihte = IHTEFROMHANDLE(Handle); // if we have a global handle, it is only meaningful in the context // of the kernel process's handle table...we don't currently deal with // this type of handle if (!(IHTEISGLOBAL(ihte))) { ptr = (DWORD_PTR) ppdb->phtbHandles->rghte[ihte].pobj; } } return ptr; } DWORD_PTR Win9xGetPID( IN HANDLE hProcess ) /*++ Routine Description: Win9xGetPid() Arguments: hProcess - Process handle Return Value: Process Id Notes: The code has only been tested on Windows98SE and Millennium. --*/ { static DWORD dwObsfucator = 0; // check to see that we have a predefined handle or an index into // our local handle table. if (IS_WIN32_PREDEFINED_HANDLE(hProcess) || (hProcess < MAX_HANDLE_VALUE)) { if (!dwObsfucator) { dwObsfucator = GetWin9xObsfucator(); assert(dwObsfucator != 0); } return dwObsfucator ^ GetPtrFromHandle(hProcess); } // don't know what we have here return 0; } #endif // _X86_ DWORD_PTR GetPID( HANDLE hProcess ) { OSVERSIONINFO VerInfo; if (hProcess == GetCurrentProcess()) return GetCurrentProcessId(); VerInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO); GetVersionEx(&VerInfo); if (VerInfo.dwPlatformId == VER_PLATFORM_WIN32_NT) { return NTGetPID(hProcess); } else { #ifdef _X86_ return Win9xGetPID(hProcess); #else return 0; #endif } } PMODULE_ENTRY GetModFromAddr( PPROCESS_ENTRY pe, IN DWORD64 addr ) { PMODULE_ENTRY mi = NULL; __try { mi = GetModuleForPC(pe, addr, FALSE); if (!mi) { SetLastError(ERROR_MOD_NOT_FOUND); return NULL; } if (!LoadSymbols(pe->hProcess, mi, 0)) { SetLastError(ERROR_MOD_NOT_FOUND); return NULL; } } __except (EXCEPTION_EXECUTE_HANDLER) { ImagepSetLastErrorFromStatus(GetExceptionCode()); return NULL; } return mi; } DWORD GetProcessModules( HANDLE hProcess, PINTERNAL_GET_MODULE InternalGetModule, PVOID Context ) { #ifdef _X86_ OSVERSIONINFO VerInfo; VerInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO); GetVersionEx(&VerInfo); if (VerInfo.dwPlatformId == VER_PLATFORM_WIN32_NT) { return NTGetProcessModules(hProcess, InternalGetModule, Context); } else { return Win95GetProcessModules(hProcess, InternalGetModule, Context); } } DWORD Win95GetProcessModules( HANDLE hProcess, PINTERNAL_GET_MODULE InternalGetModule, PVOID Context ) { MODULEENTRY32 mi; PMODULE32 pModule32Next, pModule32First; PCREATE32SNAPSHOT pCreateToolhelp32Snapshot; HANDLE hSnapshot; HMODULE hToolHelp; DWORD pid; // get the PID: // this hack supports old bug workaround, in which callers were passing // a pid, because an hprocess didn't work on W9X. pid = GetPID(hProcess); if (!pid) pid = (DWORD)hProcess; // get the module list from toolhelp apis hToolHelp = GetModuleHandle("kernel32.dll"); if (!hToolHelp) return ERROR_MOD_NOT_FOUND; pModule32Next = (PMODULE32)GetProcAddress(hToolHelp, "Module32Next"); pModule32First = (PMODULE32)GetProcAddress(hToolHelp, "Module32First"); pCreateToolhelp32Snapshot = (PCREATE32SNAPSHOT)GetProcAddress(hToolHelp, "CreateToolhelp32Snapshot"); if (!pModule32Next || !pModule32First || !pCreateToolhelp32Snapshot) return ERROR_MOD_NOT_FOUND; hSnapshot = pCreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid); if (hSnapshot == (HANDLE)-1) { return ERROR_MOD_NOT_FOUND; } mi.dwSize = sizeof(MODULEENTRY32); if (pModule32First(hSnapshot, &mi)) { do { if (!InternalGetModule( hProcess, mi.szModule, (DWORD) mi.modBaseAddr, mi.modBaseSize, Context)) { break; } } while ( pModule32Next(hSnapshot, &mi) ); } CloseHandle(hSnapshot); return(ERROR_SUCCESS); } DWORD NTGetProcessModules( HANDLE hProcess, PINTERNAL_GET_MODULE InternalGetModule, PVOID Context ) { #endif // _X86_ PRTLQUERYPROCESSDEBUGINFORMATION RtlQueryProcessDebugInformation; PRTLCREATEQUERYDEBUGBUFFER RtlCreateQueryDebugBuffer; PRTLDESTROYQUERYDEBUGBUFFER RtlDestroyQueryDebugBuffer; HMODULE hModule; NTSTATUS Status; PRTL_DEBUG_INFORMATION Buffer; ULONG i; DWORD_PTR ProcessId; hModule = GetModuleHandle( "ntdll.dll" ); if (!hModule) { return ERROR_MOD_NOT_FOUND; } RtlQueryProcessDebugInformation = (PRTLQUERYPROCESSDEBUGINFORMATION)GetProcAddress( hModule, "RtlQueryProcessDebugInformation" ); if (!RtlQueryProcessDebugInformation) { return ERROR_INVALID_FUNCTION; } RtlCreateQueryDebugBuffer = (PRTLCREATEQUERYDEBUGBUFFER)GetProcAddress( hModule, "RtlCreateQueryDebugBuffer" ); if (!RtlCreateQueryDebugBuffer) { return ERROR_INVALID_FUNCTION; } RtlDestroyQueryDebugBuffer = (PRTLDESTROYQUERYDEBUGBUFFER)GetProcAddress( hModule, "RtlDestroyQueryDebugBuffer" ); if (!RtlDestroyQueryDebugBuffer) { return ERROR_INVALID_FUNCTION; } Buffer = RtlCreateQueryDebugBuffer( 0, FALSE ); if (!Buffer) { return ERROR_NOT_ENOUGH_MEMORY; } ProcessId = GetPID(hProcess); // for backwards compatibility with an old bug if (!ProcessId) ProcessId = (DWORD_PTR)hProcess; ULONG QueryFlags = RTL_QUERY_PROCESS_MODULES | RTL_QUERY_PROCESS_NONINVASIVE; if (g.SymOptions & SYMOPT_INCLUDE_32BIT_MODULES) { QueryFlags |= RTL_QUERY_PROCESS_MODULES32; } Status = RtlQueryProcessDebugInformation( (HANDLE)ProcessId, QueryFlags, Buffer ); if (Status != STATUS_SUCCESS) { RtlDestroyQueryDebugBuffer( Buffer ); return(ImagepSetLastErrorFromStatus(Status)); } for (i=0; iModules->NumberOfModules; i++) { PRTL_PROCESS_MODULE_INFORMATION Module = &Buffer->Modules->Modules[i]; if (!InternalGetModule( hProcess, (LPSTR) &Module->FullPathName[Module->OffsetToFileName], (DWORD64)Module->ImageBase, (DWORD)Module->ImageSize, Context )) { break; } } RtlDestroyQueryDebugBuffer( Buffer ); return ERROR_SUCCESS; } VOID FreeModuleEntry( PPROCESS_ENTRY pe, PMODULE_ENTRY mi ) { FunctionEntryCache* Cache; if (pe && (Cache = GetFeCache(mi->MachineType, FALSE))) { Cache->InvalidateProcessOrModule(pe->hProcess, mi->BaseOfDll); } if (pe && pe->ipmi == mi) { pe->ipmi = NULL; } if (mi->symbolTable) { MemFree( mi->symbolTable ); } if (mi->SectionHdrs) { MemFree( mi->SectionHdrs ); } if (mi->OriginalSectionHdrs) { MemFree( mi->OriginalSectionHdrs ); } if (mi->pFpoData) { VirtualFree( mi->pFpoData, 0, MEM_RELEASE ); } if (mi->pFpoDataOmap) { VirtualFree( mi->pFpoDataOmap, 0, MEM_RELEASE ); } if (mi->pExceptionData) { VirtualFree( mi->pExceptionData, 0, MEM_RELEASE ); } if (mi->pPData) { MemFree( mi->pPData ); } if (mi->pXData) { MemFree( mi->pXData ); } if (mi->TmpSym.Name) { MemFree( mi->TmpSym.Name ); } if (mi->ImageName) { MemFree( mi->ImageName ); } if (mi->LoadedImageName) { MemFree( mi->LoadedImageName ); } if (mi->LoadedPdbName) { MemFree( mi->LoadedPdbName ); } if (mi->pOmapTo) { MemFree( mi->pOmapTo ); } if (mi->pOmapFrom) { MemFree( mi->pOmapFrom ); } if (mi->CallerData) { MemFree( mi->CallerData ); } if (mi->SourceFiles) { PSOURCE_ENTRY Src, SrcNext; for (Src = mi->SourceFiles; Src != NULL; Src = SrcNext) { SrcNext = Src->Next; MemFree(Src); } } if (mi->dia) { diaRelease(mi->dia); } MemFree( mi ); } BOOL MatchSymbolName( PSYMBOL_ENTRY sym, LPSTR SymName ) { if (g.SymOptions & SYMOPT_CASE_INSENSITIVE) { if (_stricmp( sym->Name, SymName ) == 0) { return TRUE; } } else { if (strcmp( sym->Name, SymName ) == 0) { return TRUE; } } return FALSE; } PSYMBOL_ENTRY HandleDuplicateSymbols( PPROCESS_ENTRY pe, PMODULE_ENTRY mi, PSYMBOL_ENTRY sym ) { DWORD i; DWORD Dups; DWORD NameSize; PIMAGEHLP_SYMBOL64 Syms64 = NULL; PIMAGEHLP_SYMBOL Syms32 = NULL; PIMAGEHLP_DUPLICATE_SYMBOL64 DupSym64 = NULL; PIMAGEHLP_DUPLICATE_SYMBOL DupSym32 = NULL; PULONG SymSave; if (!pe->pCallbackFunction32 && !pe->pCallbackFunction64) { return sym; } if (!(sym->Flags & SYMF_DUPLICATE)) { return sym; } Dups = 0; NameSize = 0; for (i = 0; i < mi->numsyms; i++) { if ((mi->symbolTable[i].NameLength == sym->NameLength) && (strcmp( mi->symbolTable[i].Name, sym->Name ) == 0)) { Dups += 1; NameSize += (mi->symbolTable[i].NameLength + 1); } } if (pe->pCallbackFunction32) { DupSym32 = (PIMAGEHLP_DUPLICATE_SYMBOL) MemAlloc( sizeof(IMAGEHLP_DUPLICATE_SYMBOL) ); if (!DupSym32) { return sym; } Syms32 = (PIMAGEHLP_SYMBOL) MemAlloc( (sizeof(IMAGEHLP_SYMBOL) * Dups) + NameSize ); if (!Syms32) { MemFree( DupSym32 ); return sym; } SymSave = (PULONG) MemAlloc( sizeof(ULONG) * Dups ); if (!SymSave) { MemFree( Syms32 ); MemFree( DupSym32 ); return sym; } DupSym32->SizeOfStruct = sizeof(IMAGEHLP_DUPLICATE_SYMBOL); DupSym32->NumberOfDups = Dups; DupSym32->Symbol = Syms32; DupSym32->SelectedSymbol = (ULONG) -1; Dups = 0; for (i = 0; i < mi->numsyms; i++) { if ((mi->symbolTable[i].NameLength == sym->NameLength) && (strcmp( mi->symbolTable[i].Name, sym->Name ) == 0)) { symcpy32( Syms32, &mi->symbolTable[i] ); Syms32 += (sizeof(IMAGEHLP_SYMBOL) + mi->symbolTable[i].NameLength + 1); SymSave[Dups] = i; Dups += 1; } } } else { DupSym64 = (PIMAGEHLP_DUPLICATE_SYMBOL64) MemAlloc( sizeof(IMAGEHLP_DUPLICATE_SYMBOL64) ); if (!DupSym64) { return sym; } Syms64 = (PIMAGEHLP_SYMBOL64) MemAlloc( (sizeof(IMAGEHLP_SYMBOL64) * Dups) + NameSize ); if (!Syms64) { MemFree( DupSym64 ); return sym; } SymSave = (PULONG) MemAlloc( sizeof(ULONG) * Dups ); if (!SymSave) { MemFree( Syms64 ); MemFree( DupSym64 ); return sym; } DupSym64->SizeOfStruct = sizeof(IMAGEHLP_DUPLICATE_SYMBOL64); DupSym64->NumberOfDups = Dups; DupSym64->Symbol = Syms64; DupSym64->SelectedSymbol = (ULONG) -1; Dups = 0; for (i = 0; i < mi->numsyms; i++) { if ((mi->symbolTable[i].NameLength == sym->NameLength) && (strcmp( mi->symbolTable[i].Name, sym->Name ) == 0)) { symcpy64( Syms64, &mi->symbolTable[i] ); Syms64 += (sizeof(IMAGEHLP_SYMBOL64) + mi->symbolTable[i].NameLength + 1); SymSave[Dups] = i; Dups += 1; } } } sym = NULL; __try { if (pe->pCallbackFunction32) { pe->pCallbackFunction32( pe->hProcess, CBA_DUPLICATE_SYMBOL, (PVOID) DupSym32, (PVOID) pe->CallbackUserContext ); if (DupSym32->SelectedSymbol != (ULONG) -1) { if (DupSym32->SelectedSymbol < DupSym32->NumberOfDups) { sym = &mi->symbolTable[SymSave[DupSym32->SelectedSymbol]]; } } } else { pe->pCallbackFunction64( pe->hProcess, CBA_DUPLICATE_SYMBOL, (ULONG64) &DupSym64, pe->CallbackUserContext ); if (DupSym64->SelectedSymbol != (ULONG) -1) { if (DupSym64->SelectedSymbol < DupSym64->NumberOfDups) { sym = &mi->symbolTable[SymSave[DupSym64->SelectedSymbol]]; } } } } __except (EXCEPTION_EXECUTE_HANDLER) { ; } if (DupSym32) { MemFree( DupSym32 ); } if (DupSym64) { MemFree( DupSym64 ); } if (Syms32) { MemFree( Syms32 ); } if (Syms64) { MemFree( Syms64 ); } MemFree( SymSave ); return sym; } PSYMBOL_ENTRY FindSymbolByName( PPROCESS_ENTRY pe, PMODULE_ENTRY mi, LPSTR SymName ) { DWORD hash; PSYMBOL_ENTRY sym; DWORD i; if (!mi || mi->dia) return diaFindSymbolByName(pe, mi, SymName); hash = ComputeHash( SymName, strlen(SymName) ); sym = mi->NameHashTable[hash]; if (sym) { // // there are collision(s) so lets walk the // collision list and match the names // while( sym ) { if (MatchSymbolName( sym, SymName )) { sym = HandleDuplicateSymbols( pe, mi, sym ); return sym; } sym = sym->Next; } } // // the symbol did not hash to anything valid // this is possible if the caller passed an undecorated name // now we must look linearly thru the list // for (i=0; inumsyms; i++) { sym = &mi->symbolTable[i]; if (MatchSymbolName( sym, SymName )) { sym = HandleDuplicateSymbols( pe, mi, sym ); return sym; } } return NULL; } IMGHLP_RVA_FUNCTION_DATA * SearchRvaFunctionTable( IMGHLP_RVA_FUNCTION_DATA *FunctionTable, LONG High, LONG Low, DWORD dwPC ) { LONG Middle; IMGHLP_RVA_FUNCTION_DATA *FunctionEntry; // Perform binary search on the function table for a function table // entry that subsumes the specified PC. while (High >= Low) { // Compute next probe index and test entry. If the specified PC // is greater than of equal to the beginning address and less // than the ending address of the function table entry, then // return the address of the function table entry. Otherwise, // continue the search. Middle = (Low + High) >> 1; FunctionEntry = &FunctionTable[Middle]; if (dwPC < FunctionEntry->rvaBeginAddress) { High = Middle - 1; } else if (dwPC >= FunctionEntry->rvaEndAddress) { Low = Middle + 1; } else { return FunctionEntry; } } return NULL; } PIMGHLP_RVA_FUNCTION_DATA GetFunctionEntryFromDebugInfo ( PPROCESS_ENTRY pe, DWORD64 ControlPc ) { PMODULE_ENTRY mi; IMGHLP_RVA_FUNCTION_DATA *FunctionTable; mi = GetModuleForPC( pe, ControlPc, FALSE ); if (mi == NULL) { return NULL; } if (!GetPData(pe->hProcess, mi)) { return NULL; } FunctionTable = (IMGHLP_RVA_FUNCTION_DATA *)mi->pExceptionData; return SearchRvaFunctionTable(FunctionTable, mi->dwEntries - 1, 0, (ULONG)(ControlPc - mi->BaseOfDll)); } PIMAGE_FUNCTION_ENTRY LookupFunctionEntryAxp32 ( HANDLE hProcess, DWORD ControlPc ) { FunctionEntryCache* Cache; FeCacheEntry* FunctionEntry; if ((Cache = GetFeCache(IMAGE_FILE_MACHINE_ALPHA, TRUE)) == NULL) { return NULL; } // Don't specify the function table access callback or it will // cause recursion. FunctionEntry = Cache-> Find(hProcess, (ULONG64)(LONG)ControlPc, ReadInProcMemory, miGetModuleBase, NULL); if ( FunctionEntry == NULL ) { return NULL; } // Alpha function entries are always stored as 64-bit // so downconvert. tlsvar(FunctionEntry32).StartingAddress = (ULONG)FunctionEntry->Data.Axp64.BeginAddress; tlsvar(FunctionEntry32).EndingAddress = (ULONG)FunctionEntry->Data.Axp64.EndAddress; tlsvar(FunctionEntry32).EndOfPrologue = (ULONG)FunctionEntry->Data.Axp64.PrologEndAddress; return &tlsvar(FunctionEntry32); } PIMAGE_FUNCTION_ENTRY64 LookupFunctionEntryAxp64 ( HANDLE hProcess, DWORD64 ControlPc ) { FunctionEntryCache* Cache; FeCacheEntry* FunctionEntry; if ((Cache = GetFeCache(IMAGE_FILE_MACHINE_ALPHA64, TRUE)) == NULL) { return NULL; } // Don't specify the function table access callback or it will // cause recursion. FunctionEntry = Cache-> Find(hProcess, ControlPc, ReadInProcMemory, miGetModuleBase, NULL); if ( FunctionEntry == NULL ) { return NULL; } tlsvar(FunctionEntry64).StartingAddress = FunctionEntry->Data.Axp64.BeginAddress; tlsvar(FunctionEntry64).EndingAddress = FunctionEntry->Data.Axp64.EndAddress; tlsvar(FunctionEntry64).EndOfPrologue = FunctionEntry->Data.Axp64.PrologEndAddress; return &tlsvar(FunctionEntry64); } // NTRAID#96939-2000/03/27-patst // // All the platform dependent "LookupFunctionEntryXxx" should be retyped as returning // a PIMAGE_FUNCTION_ENTRY64. This would require a modification of the callers, especially // the IA64 specific locations that assume that the returned function entries contains RVAs // and not absolute addresses. I implemented a platform-independant // "per address space / per module" cache of function entries - capable of supporting the // dynamic function entries scheme but I fell short of time in delivering it. PIMAGE_IA64_RUNTIME_FUNCTION_ENTRY LookupFunctionEntryIa64 ( HANDLE hProcess, DWORD64 ControlPc ) { FunctionEntryCache* Cache; FeCacheEntry* FunctionEntry; if ((Cache = GetFeCache(IMAGE_FILE_MACHINE_IA64, TRUE)) == NULL) { return NULL; } // // IA64-NOTE 08/99: IA64 Function entries contain file offsets, not absolute relocated addresses. // IA64 Callers assume this. // // Don't specify the function table access callback or it will // cause recursion. FunctionEntry = Cache-> Find(hProcess, ControlPc, ReadInProcMemory, miGetModuleBase, NULL); if ( FunctionEntry == NULL ) { return NULL; } tlsvar(Ia64FunctionEntry) = FunctionEntry->Data.Ia64; return &tlsvar(Ia64FunctionEntry); } _PIMAGE_RUNTIME_FUNCTION_ENTRY LookupFunctionEntryAmd64 ( HANDLE hProcess, DWORD64 ControlPc ) { FunctionEntryCache* Cache; FeCacheEntry* FunctionEntry; if ((Cache = GetFeCache(IMAGE_FILE_MACHINE_AMD64, TRUE)) == NULL) { return NULL; } // Don't specify the function table access callback or it will // cause recursion. FunctionEntry = Cache-> Find(hProcess, ControlPc, ReadInProcMemory, miGetModuleBase, NULL); if ( FunctionEntry == NULL ) { return NULL; } tlsvar(Amd64FunctionEntry) = FunctionEntry->Data.Amd64; return &tlsvar(Amd64FunctionEntry); } PFPO_DATA SwSearchFpoData( DWORD key, PFPO_DATA base, DWORD num ) { PFPO_DATA lo = base; PFPO_DATA hi = base + (num - 1); PFPO_DATA mid; DWORD half; while (lo <= hi) { if (half = num / 2) { mid = lo + ((num & 1) ? half : (half - 1)); if ((key >= mid->ulOffStart)&&(key < (mid->ulOffStart+mid->cbProcSize))) { return mid; } if (key < mid->ulOffStart) { hi = mid - 1; num = (num & 1) ? half : half-1; } else { lo = mid + 1; num = half; } } else if (num) { if ((key >= lo->ulOffStart)&&(key < (lo->ulOffStart+lo->cbProcSize))) { return lo; } else { break; } } else { break; } } return(NULL); } BOOL DoSymbolCallback ( PPROCESS_ENTRY pe, ULONG CallbackType, IN PMODULE_ENTRY mi, PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 idsl64, LPSTR FileName ) { BOOL Status; IMAGEHLP_DEFERRED_SYMBOL_LOAD idsl32; Status = FALSE; if (pe->pCallbackFunction32) { idsl32.SizeOfStruct = sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD); idsl32.BaseOfImage = (ULONG)mi->BaseOfDll; idsl32.CheckSum = mi->CheckSum; idsl32.TimeDateStamp = mi->TimeDateStamp; idsl32.Reparse = FALSE; idsl32.FileName[0] = 0; if (FileName) { strncat( idsl32.FileName, FileName, MAX_PATH - 1 ); } __try { Status = pe->pCallbackFunction32( pe->hProcess, CallbackType, (PVOID)&idsl32, (PVOID)pe->CallbackUserContext ); idsl64->SizeOfStruct = sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64); idsl64->BaseOfImage = idsl32.BaseOfImage; idsl64->CheckSum = idsl32.CheckSum; idsl64->TimeDateStamp = idsl32.TimeDateStamp; idsl64->Reparse = idsl32.Reparse; if (idsl32.FileName) { strncpy( idsl64->FileName, idsl32.FileName, MAX_PATH ); } } __except (EXCEPTION_EXECUTE_HANDLER) { } } else if (pe->pCallbackFunction64) { idsl64->SizeOfStruct = sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64); idsl64->BaseOfImage = mi->BaseOfDll; idsl64->CheckSum = mi->CheckSum; idsl64->TimeDateStamp = mi->TimeDateStamp; idsl64->Reparse = FALSE; idsl64->FileName[0] = 0; if (FileName) { strncat( idsl64->FileName, FileName, MAX_PATH ); } __try { Status = pe->pCallbackFunction64( pe->hProcess, CallbackType, (ULONG64)(ULONG_PTR)idsl64, pe->CallbackUserContext ); } __except (EXCEPTION_EXECUTE_HANDLER) { } } return Status; } BOOL DoCallback( PPROCESS_ENTRY pe, ULONG type, PVOID data ) { BOOL rc = TRUE; __try { // if we weren't passed a process entry, then call all processes if (!pe) { BOOL ret; PLIST_ENTRY next; next = g.ProcessList.Flink; if (!next) return FALSE; while ((PVOID)next != (PVOID)&g.ProcessList) { pe = CONTAINING_RECORD( next, PROCESS_ENTRY, ListEntry ); next = pe->ListEntry.Flink; if (!pe) return rc; ret = DoCallback(pe, type, data); if (!ret) rc = ret; } return rc; } // otherwise call this process if (pe->pCallbackFunction32) { rc = pe->pCallbackFunction32(pe->hProcess, type, data, (PVOID)pe->CallbackUserContext); } else if (pe->pCallbackFunction64) { rc = pe->pCallbackFunction64(pe->hProcess, type, (ULONG64)data, pe->CallbackUserContext); } } __except (EXCEPTION_EXECUTE_HANDLER) { rc = FALSE; } return rc; } VOID SympSendDebugString( PPROCESS_ENTRY pe, LPSTR String ) { __try { if (!pe) pe = FindFirstProcessEntry(); if (!pe) { printf(String); } else if (pe->pCallbackFunction32) { pe->pCallbackFunction32(pe->hProcess, CBA_DEBUG_INFO, (PVOID)String, (PVOID)pe->CallbackUserContext ); } else if (pe->pCallbackFunction64) { pe->pCallbackFunction64(pe->hProcess, CBA_DEBUG_INFO, (ULONG64)String, pe->CallbackUserContext ); } } __except (EXCEPTION_EXECUTE_HANDLER) { } } int WINAPIV _pprint( PPROCESS_ENTRY pe, LPSTR Format, ... ) { static char buf[1000] = "DBGHELP: "; va_list args; va_start(args, Format); _vsnprintf(buf+9, sizeof(buf)-9, Format, args); va_end(args); SympSendDebugString(pe, buf); return 1; } int WINAPIV _peprint( PPROCESS_ENTRY pe, LPSTR Format, ... ) { static char buf[1000] = ""; va_list args; va_start(args, Format); _vsnprintf(buf, sizeof(buf), Format, args); va_end(args); SympSendDebugString(pe, buf); return 1; } int WINAPIV _dprint( LPSTR format, ... ) { static char buf[1000] = "DBGHELP: "; va_list args; va_start(args, format); _vsnprintf(buf+9, sizeof(buf)-9, format, args); va_end(args); SympSendDebugString(NULL, buf); return 1; } int WINAPIV _eprint( LPSTR format, ... ) { static char buf[1000] = ""; va_list args; va_start(args, format); _vsnprintf(buf, sizeof(buf), format, args); va_end(args); SympSendDebugString(NULL, buf); return 1; } BOOL WINAPIV evtprint( PPROCESS_ENTRY pe, DWORD severity, DWORD code, PVOID object, LPSTR format, ... ) { static char buf[1000] = ""; IMAGEHLP_CBA_EVENT evt; va_list args; va_start(args, format); _vsnprintf(buf, sizeof(buf), format, args); va_end(args); evt.severity = severity; evt.code = code; evt.desc = buf; evt.object = object; return DoCallback(pe, CBA_EVENT, &evt); } BOOL traceAddr( DWORD64 addr ) { DWORD64 taddr = 0; if (!*g.DebugToken) return FALSE; sscanf(g.DebugToken, "0x%I64x", &taddr); taddr = EXTEND64(taddr); addr = EXTEND64(addr); return (addr == taddr); } BOOL traceName( PCHAR name ) { if (!*g.DebugToken) return FALSE; return !_strnicmp(name, g.DebugToken, strlen(g.DebugToken)); } BOOL traceSubName( PCHAR name ) { char *lname; BOOL rc; if (!*g.DebugToken) return FALSE; lname = (char *)MemAlloc(sizeof(char) * (strlen(name) + 1)); if (!lname) { return FALSE; } strcpy(lname, name); if (!lname) return FALSE; _strlwr(lname); rc = strstr(lname, g.DebugToken) ? TRUE : FALSE; MemFree(lname); return rc; } BOOL load( IN HANDLE hProcess, IN PMODULE_ENTRY mi ) { IMAGEHLP_DEFERRED_SYMBOL_LOAD64 idsl; PPROCESS_ENTRY pe; ULONG i; PIMGHLP_DEBUG_DATA pIDD; ULONG bias; PIMAGE_SYMBOL lpSymbolEntry; PUCHAR lpStringTable; PUCHAR p; BOOL SymbolsLoaded = FALSE; PCHAR CallbackFileName, ImageName; ULONG Size; g.LastSymLoadError = SYMLOAD_DEFERRED; pe = FindProcessEntry( hProcess ); if (!pe) { SetLastError(ERROR_INVALID_HANDLE); return FALSE; } // if (traceName(mi->ModuleName)) // for setting debug breakpoints from DBGHELP_TOKEN // pprint(pe, "debug(%s)\n", mi->ModuleName); CallbackFileName = mi->LoadedImageName ? mi->LoadedImageName : mi->ImageName ? mi->ImageName : mi->ModuleName; DoSymbolCallback( pe, CBA_DEFERRED_SYMBOL_LOAD_START, mi, &idsl, CallbackFileName ); ImageName = mi->ImageName; for (; ;) { pIDD = GetDebugData( hProcess, mi->hFile, ImageName, pe->SymbolSearchPath, mi->BaseOfDll, &mi->mld, 0 ); mi->SymLoadError = g.LastSymLoadError; if (pIDD) { break; } pprint(pe, "GetDebugData(%p, %s, %s, %I64x, 0) failed\n", mi->hFile, ImageName, pe->SymbolSearchPath, mi->BaseOfDll ); if (!DoSymbolCallback( pe, CBA_DEFERRED_SYMBOL_LOAD_FAILURE, mi, &idsl, CallbackFileName ) || !idsl.Reparse) { mi->SymType = SymNone; mi->Flags |= MIF_NO_SYMBOLS; return FALSE; } ImageName = idsl.FileName; CallbackFileName = idsl.FileName; } pIDD->flags = mi->Flags; // The following code ONLY works if the dll wasn't rebased // during install. Is it really useful? if (!mi->BaseOfDll) { // // This case occurs when modules are loaded multiple times by // name with no explicit base address. // if (GetModuleForPC( pe, pIDD->ImageBaseFromImage, TRUE )) { if (pIDD->ImageBaseFromImage) { pprint(pe, "GetModuleForPC(%p, %I64x, TRUE) failed\n", pe, pIDD->ImageBaseFromImage, TRUE ); } else { pprint(pe, "No base address for %s: Please specify\n", ImageName); } return FALSE; } mi->BaseOfDll = pIDD->ImageBaseFromImage; } if (!mi->DllSize) { mi->DllSize = pIDD->SizeOfImage; } mi->hProcess = pIDD->hProcess; mi->InProcImageBase = pIDD->InProcImageBase; mi->CheckSum = pIDD->CheckSum; mi->TimeDateStamp = pIDD->TimeDateStamp; mi->MachineType = pIDD->Machine; mi->ImageType = pIDD->ImageType; mi->PdbSrc = pIDD->PdbSrc; mi->ImageSrc = pIDD->ImageSrc; if (!mi->MachineType && g.MachineType) { mi->MachineType = (USHORT) g.MachineType; } if (pIDD->dia) { mi->LoadedPdbName = StringDup(pIDD->PdbFileName); } if (pIDD->DbgFileMap) { mi->LoadedImageName = StringDup(pIDD->DbgFilePath); } else if (*pIDD->ImageFilePath) { mi->LoadedImageName = StringDup(pIDD->ImageFilePath); } else if (pIDD->dia) { mi->LoadedImageName = StringDup(pIDD->PdbFileName); } else { mi->LoadedImageName = StringDup(""); } if (pIDD->fROM) { mi->Flags |= MIF_ROM_IMAGE; } if (!mi->ImageName) { mi->ImageName = StringDup(pIDD->OriginalImageFileName); _splitpath( mi->ImageName, NULL, NULL, mi->ModuleName, NULL ); mi->AliasName[0] = 0; } mi->dsExceptions = pIDD->dsExceptions; if (pIDD->cFpo) { // // use virtualalloc() because the rtf search function // return a pointer into this memory. we want to make // all of this memory read only so that callers cannot // stomp on imagehlp's data // mi->pFpoData = (PFPO_DATA)VirtualAlloc( NULL, sizeof(FPO_DATA) * pIDD->cFpo, MEM_COMMIT, PAGE_READWRITE ); if (mi->pFpoData) { mi->dwEntries = pIDD->cFpo; CopyMemory( mi->pFpoData, pIDD->pFpo, sizeof(FPO_DATA) * mi->dwEntries ); VirtualProtect( mi->pFpoData, sizeof(FPO_DATA) * mi->dwEntries, PAGE_READONLY, &i ); } } // copy the pdata block from the pdb if (pIDD->pPData) { mi->pPData = MemAlloc(pIDD->cbPData); if (mi->pPData) { mi->cPData = pIDD->cPData; mi->cbPData = pIDD->cbPData; CopyMemory(mi->pPData, pIDD->pPData, pIDD->cbPData); } } if (pIDD->pXData) { mi->pXData = MemAlloc(pIDD->cbXData); if (mi->pXData) { mi->cXData = pIDD->cXData; mi->cbXData = pIDD->cbXData; CopyMemory(mi->pXData, pIDD->pXData, pIDD->cbXData); } } // now the sections mi->NumSections = pIDD->cCurrentSections; if (pIDD->fCurrentSectionsMapped) { mi->SectionHdrs = (PIMAGE_SECTION_HEADER) MemAlloc( sizeof(IMAGE_SECTION_HEADER) * mi->NumSections ); if (mi->SectionHdrs) { CopyMemory( mi->SectionHdrs, pIDD->pCurrentSections, sizeof(IMAGE_SECTION_HEADER) * mi->NumSections ); } } else { mi->SectionHdrs = pIDD->pCurrentSections; } if (pIDD->pOriginalSections) { mi->OriginalNumSections = pIDD->cOriginalSections; mi->OriginalSectionHdrs = pIDD->pOriginalSections; } else { mi->OriginalNumSections = mi->NumSections; mi->OriginalSectionHdrs = (PIMAGE_SECTION_HEADER) MemAlloc( sizeof(IMAGE_SECTION_HEADER) * mi->NumSections ); if (mi->OriginalSectionHdrs) { CopyMemory( mi->OriginalSectionHdrs, pIDD->pCurrentSections, sizeof(IMAGE_SECTION_HEADER) * mi->NumSections ); } } // symbols mi->TmpSym.Name = (LPSTR) MemAlloc( TMP_SYM_LEN ); if (pIDD->dia) { mi->SymType = SymDia; SymbolsLoaded = TRUE; } else { if (pIDD->pMappedCv) { SymbolsLoaded = LoadCodeViewSymbols( hProcess, mi, pIDD ); pprint(pe, "codeview symbols %sloaded\n", SymbolsLoaded?"":"not "); } if (!SymbolsLoaded && pIDD->pMappedCoff) { SymbolsLoaded = LoadCoffSymbols(hProcess, mi, pIDD); pprint(pe, "coff symbols %sloaded\n", SymbolsLoaded?"":"not "); } if (!SymbolsLoaded && pIDD->cExports) { SymbolsLoaded = LoadExportSymbols( mi, pIDD ); if (SymbolsLoaded) { mi->PdbSrc = srcNone; } pprint(pe, "export symbols %sloaded\n", SymbolsLoaded?"":"not "); } if (!SymbolsLoaded) { mi->SymType = SymNone; pprint(pe, "no symbols loaded\n"); } } mi->dia = pIDD->dia; ProcessOmapForModule( mi, pIDD ); ReleaseDebugData(pIDD, IMGHLP_FREE_FPO | IMGHLP_FREE_SYMPATH | IMGHLP_FREE_PDATA | IMGHLP_FREE_XDATA); mi->Flags &= ~MIF_DEFERRED_LOAD; DoSymbolCallback(pe, CBA_DEFERRED_SYMBOL_LOAD_COMPLETE, mi, &idsl, CallbackFileName); return TRUE; } DWORD64 InternalLoadModule( IN HANDLE hProcess, IN PSTR ImageName, IN PSTR ModuleName, IN DWORD64 BaseOfDll, IN DWORD DllSize, IN HANDLE hFile, IN PMODLOAD_DATA data, IN DWORD flags ) { IMAGEHLP_DEFERRED_SYMBOL_LOAD64 idsl; PPROCESS_ENTRY pe; PMODULE_ENTRY mi; LPSTR p; DWORD64 ip; // if (traceSubName(ImageName)) // for setting debug breakpoints from DBGHELP_TOKEN // dprint("debug(%s)\n", ImageName); if (BaseOfDll == (DWORD64)-1) return 0; __try { CHAR c; if (ImageName) c = *ImageName; if (ModuleName) c = *ModuleName; } __except(EXCEPTION_EXECUTE_HANDLER) { SetLastError(ERROR_INVALID_PARAMETER); return 0; } pe = FindProcessEntry( hProcess ); if (!pe) { return 0; } if (BaseOfDll) { mi = GetModuleForPC( pe, BaseOfDll, TRUE ); } else { mi = NULL; } if (mi) { // // in this case the symbols are already loaded // so the caller really wants the deferred // symbols to be loaded // if ( (mi->Flags & MIF_DEFERRED_LOAD) && load( hProcess, mi )) { return mi->BaseOfDll; } else { return 0; } } // // look to see if there is an overlapping module entry // if (BaseOfDll) { do { mi = GetModuleForPC( pe, BaseOfDll, FALSE ); if (mi) { RemoveEntryList( &mi->ListEntry ); DoSymbolCallback( pe, CBA_SYMBOLS_UNLOADED, mi, &idsl, mi->LoadedImageName ? mi->LoadedImageName : mi->ImageName ? mi->ImageName : mi->ModuleName ); FreeModuleEntry(pe, mi); } } while(mi); } mi = (PMODULE_ENTRY) MemAlloc( sizeof(MODULE_ENTRY) ); if (!mi) { return 0; } InitModuleEntry(mi); mi->BaseOfDll = BaseOfDll; mi->DllSize = DllSize; mi->hFile = hFile; if (ImageName) { char SplitMod[_MAX_FNAME]; mi->ImageName = StringDup(ImageName); _splitpath( ImageName, NULL, NULL, SplitMod, NULL ); mi->ModuleName[0] = 0; strncat(mi->ModuleName, SplitMod, sizeof(mi->ModuleName) - 1); if (ModuleName && _stricmp( ModuleName, mi->ModuleName ) != 0) { mi->AliasName[0] = 0; strncat( mi->AliasName, ModuleName, sizeof(mi->AliasName) - 1 ); } else { mi->AliasName[0] = 0; } } else { if (ModuleName) { mi->AliasName[0] = 0; strncat( mi->AliasName, ModuleName, sizeof(mi->AliasName) - 1 ); } } mi->mod = NULL; mi->cbPdbSymbols = 0; mi->pPdbSymbols = NULL; if (data) { if (data->ssize != sizeof(MODLOAD_DATA)) { SetLastError(ERROR_INVALID_PARAMETER); return 0; } memcpy(&mi->mld, data, data->ssize); mi->CallerData = MemAlloc(mi->mld.size); if (!mi->CallerData) { SetLastError(ERROR_NOT_ENOUGH_MEMORY); return 0; } mi->mld.data = mi->CallerData; memcpy(mi->mld.data, data->data, mi->mld.size); } if ((g.SymOptions & SYMOPT_DEFERRED_LOADS) && BaseOfDll) { mi->Flags |= MIF_DEFERRED_LOAD; mi->SymType = SymDeferred; } else if (!load( hProcess, mi )) { FreeModuleEntry(pe, mi); return 0; } pe->Count += 1; InsertTailList( &pe->ModuleList, &mi->ListEntry); ip = GetIP(pe); if ((mi->BaseOfDll <= ip) && (mi->BaseOfDll + DllSize >= ip)) diaSetModFromIP(pe); return mi->BaseOfDll; } PPROCESS_ENTRY FindProcessEntry( HANDLE hProcess ) { PLIST_ENTRY next; PPROCESS_ENTRY pe; DWORD count; next = g.ProcessList.Flink; if (!next) { return NULL; } for (count = 0; (PVOID)next != (PVOID)&g.ProcessList; count++) { assert(count < g.cProcessList); if (count >= g.cProcessList) return NULL; pe = CONTAINING_RECORD( next, PROCESS_ENTRY, ListEntry ); next = pe->ListEntry.Flink; if (pe->hProcess == hProcess) { return pe; } } return NULL; } PPROCESS_ENTRY FindFirstProcessEntry( ) { return CONTAINING_RECORD(g.ProcessList.Flink, PROCESS_ENTRY, ListEntry); } PMODULE_ENTRY FindModule( HANDLE hProcess, PPROCESS_ENTRY pe, LPSTR ModuleName, BOOL fLoad ) { PLIST_ENTRY next; PMODULE_ENTRY mi; if (!ModuleName || !*ModuleName) return NULL; next = pe->ModuleList.Flink; if (next) { while ((PVOID)next != (PVOID)&pe->ModuleList) { mi = CONTAINING_RECORD( next, MODULE_ENTRY, ListEntry ); next = mi->ListEntry.Flink; if ((_stricmp( mi->ModuleName, ModuleName ) == 0) || (mi->AliasName[0] && _stricmp( mi->AliasName, ModuleName ) == 0)) { if (fLoad && !LoadSymbols(hProcess, mi, 0)) { return NULL; } return mi; } } } return NULL; } #ifndef _DBGHELP_USER_GENERATED_SYMBOLS_NOTSUPPORTED BOOL SymCheckUserGenerated( ULONG64 dwAddr, PSYMBOL_ENTRY sym, PMODULE_ENTRY mi ) { PSYMBOL_ENTRY nextSym; /* // We do not know the size of a user generated symbol... // This work because of the execution of CompleteSymbolTable() after AllocSym(). // Particularly, the size has been adjusted. */ if ( !(sym->Flags & SYMF_USER_GENERATED) ) { dprint("SymCheckUserGenerated: We should not call this function. This is not a user generated symbol...\n" ); return FALSE; } if ( (dwAddr == sym->Address) || (sym == &mi->symbolTable[mi->numsyms - 1]) ) { return TRUE; } nextSym = sym + 1; if ( dwAddr < nextSym->Address ) { return TRUE; } return FALSE; } #endif // !_DBGHELP_USER_GENERATED_SYMBOLS_NOTSUPPORTED PSYMBOL_ENTRY GetSymFromAddr( DWORD64 dwAddr, PDWORD64 pqwDisplacement, PMODULE_ENTRY mi ) { PSYMBOL_ENTRY sym = NULL; LONG High; LONG Low; LONG Middle; if (mi == NULL) { return NULL; } if (mi->dia) return diaGetSymFromAddr(dwAddr, mi, pqwDisplacement); // // do a binary search to locate the symbol // Low = 0; High = mi->numsyms - 1; while (High >= Low) { Middle = (Low + High) >> 1; sym = &mi->symbolTable[Middle]; if (dwAddr < sym->Address) { High = Middle - 1; } else if (dwAddr >= sym->Address + sym->Size) { #ifndef _DBGHELP_USER_GENERATED_SYMBOLS_NOTSUPPORTED if ( (sym->Flags & SYMF_USER_GENERATED) && SymCheckUserGenerated( dwAddr, sym, mi ) ) { if (pqwDisplacement) { *pqwDisplacement = dwAddr - sym->Address; } return sym; } #endif // !_DBGHELP_USER_GENERATED_SYMBOLS_NOTSUPPORTED Low = Middle + 1; } else { if (pqwDisplacement) { *pqwDisplacement = dwAddr - sym->Address; } return sym; } } return NULL; } PMODULE_ENTRY GetModuleForPC( PPROCESS_ENTRY pe, DWORD64 dwPcAddr, BOOL ExactMatch ) { static PLIST_ENTRY next = NULL; PMODULE_ENTRY mi; if (dwPcAddr == (DWORD64)-1) { if (!next) return NULL; if ((PVOID)next == (PVOID)&pe->ModuleList) { // Reset to NULL so the list can be re-walked next = NULL; return NULL; } mi = CONTAINING_RECORD( next, MODULE_ENTRY, ListEntry ); next = mi->ListEntry.Flink; return mi; } next = pe->ModuleList.Flink; if (!next) { return NULL; } while ((PVOID)next != (PVOID)&pe->ModuleList) { mi = CONTAINING_RECORD( next, MODULE_ENTRY, ListEntry ); next = mi->ListEntry.Flink; if (dwPcAddr == 0) { return mi; } if (ExactMatch) { if (dwPcAddr == mi->BaseOfDll) { return mi; } } else if ((dwPcAddr == mi->BaseOfDll && mi->DllSize == 0) || ((dwPcAddr >= mi->BaseOfDll) && (dwPcAddr < mi->BaseOfDll + mi->DllSize))) { return mi; } } return NULL; } PSYMBOL_ENTRY GetSymFromAddrAllContexts( DWORD64 dwAddr, PDWORD64 pqwDisplacement, PPROCESS_ENTRY pe ) { PMODULE_ENTRY mi = GetModuleForPC( pe, dwAddr, FALSE ); if (mi == NULL) { return NULL; } return GetSymFromAddr( dwAddr, pqwDisplacement, mi ); } DWORD ComputeHash( LPSTR lpbName, ULONG cb ) { ULONG UNALIGNED * lpulName; ULONG ulEnd = 0; int cul; int iul; ULONG ulSum = 0; while (cb & 3) { ulEnd |= (lpbName[cb - 1] & 0xdf); ulEnd <<= 8; cb -= 1; } cul = cb / 4; lpulName = (ULONG UNALIGNED *) lpbName; for (iul =0; iul < cul; iul++) { ulSum ^= (lpulName[iul] & 0xdfdfdfdf); ulSum = _lrotl( ulSum, 4); } ulSum ^= ulEnd; return ulSum % HASH_MODULO; } PSYMBOL_ENTRY AllocSym( PMODULE_ENTRY mi, DWORD64 addr, LPSTR name ) { PSYMBOL_ENTRY sym; ULONG Length; if (mi->numsyms == mi->MaxSyms) { // dprint("AllocSym: ERROR - symbols Table overflow!\n"); return NULL; } if (!mi->StringSize) { // dprint("AllocSym: ERROR - symbols strings not allocated for module!\n"); return NULL; } Length = strlen(name); if ((Length + 1) > mi->StringSize) { // dprint("AllocSym: ERROR - symbols strings buffer overflow!\n"); return NULL; } sym = &mi->symbolTable[mi->numsyms]; mi->numsyms += 1; sym->Name = mi->SymStrings; mi->SymStrings += (Length + 2); mi->StringSize -= (Length + 2); strcpy( sym->Name, name ); sym->Address = addr; sym->Size = 0; sym->Flags = 0; sym->Next = NULL; sym->NameLength = Length; return sym; } int __cdecl SymbolTableAddressCompare( const void *e1, const void *e2 ) { PSYMBOL_ENTRY sym1 = (PSYMBOL_ENTRY) e1; PSYMBOL_ENTRY sym2 = (PSYMBOL_ENTRY) e2; LONG64 diff; if ( sym1 && sym2 ) { diff = (sym1->Address - sym2->Address); return (diff < 0) ? -1 : (diff == 0) ? 0 : 1; } else { return 1; } } int __cdecl SymbolTableNameCompare( const void *e1, const void *e2 ) { PSYMBOL_ENTRY sym1 = (PSYMBOL_ENTRY) e1; PSYMBOL_ENTRY sym2 = (PSYMBOL_ENTRY) e2; return strcmp( sym1->Name, sym2->Name ); } VOID CompleteSymbolTable( PMODULE_ENTRY mi ) { PSYMBOL_ENTRY sym; PSYMBOL_ENTRY symH; ULONG Hash; ULONG i; ULONG dups; ULONG seq; // // sort the symbols by name // dbg_qsort( mi->symbolTable, mi->numsyms, sizeof(SYMBOL_ENTRY), SymbolTableNameCompare ); // // mark duplicate names // seq = 0; for (i=0; inumsyms; i++) { dups = 0; while ((mi->symbolTable[i+dups].NameLength == mi->symbolTable[i+dups+1].NameLength) && (strcmp( mi->symbolTable[i+dups].Name, mi->symbolTable[i+dups+1].Name ) == 0)) { mi->symbolTable[i+dups].Flags |= SYMF_DUPLICATE; mi->symbolTable[i+dups+1].Flags |= SYMF_DUPLICATE; dups += 1; } i += dups; } // // sort the symbols by address // dbg_qsort( mi->symbolTable, mi->numsyms, sizeof(SYMBOL_ENTRY), SymbolTableAddressCompare ); // // calculate the size of each symbol // for (i=0; inumsyms; i++) { mi->symbolTable[i].Next = NULL; if (i+1 < mi->numsyms) { mi->symbolTable[i].Size = (ULONG)(mi->symbolTable[i+1].Address - mi->symbolTable[i].Address); } } // // compute the hash for each symbol // ZeroMemory( mi->NameHashTable, sizeof(mi->NameHashTable) ); for (i=0; inumsyms; i++) { sym = &mi->symbolTable[i]; Hash = ComputeHash( sym->Name, sym->NameLength ); if (mi->NameHashTable[Hash]) { // // we have a collision // symH = mi->NameHashTable[Hash]; while( symH->Next ) { symH = symH->Next; } symH->Next = sym; } else { mi->NameHashTable[Hash] = sym; } } } BOOL CreateSymbolTable( PMODULE_ENTRY mi, DWORD SymbolCount, SYM_TYPE SymType, DWORD NameSize ) { // // allocate the symbol table // NameSize += OMAP_SYM_STRINGS; mi->symbolTable = (PSYMBOL_ENTRY) MemAlloc( (sizeof(SYMBOL_ENTRY) * (SymbolCount + OMAP_SYM_EXTRA)) + NameSize + (SymbolCount * CPP_EXTRA) ); if (!mi->symbolTable) { return FALSE; } // // initialize the relevant fields // mi->numsyms = 0; mi->MaxSyms = SymbolCount + OMAP_SYM_EXTRA; mi->SymType = SymType; mi->StringSize = NameSize + (SymbolCount * CPP_EXTRA); mi->SymStrings = (LPSTR)(mi->symbolTable + SymbolCount + OMAP_SYM_EXTRA); return TRUE; } PIMAGE_SECTION_HEADER FindSection( PIMAGE_SECTION_HEADER sh, ULONG NumSections, ULONG Address ) { ULONG i; for (i=0; i= sh[i].VirtualAddress && Address < (sh[i].VirtualAddress + sh[i].Misc.VirtualSize)) { return &sh[i]; } } return NULL; } PVOID GetSectionPhysical( HANDLE hp, ULONG64 base, PIMGHLP_DEBUG_DATA pIDD, ULONG Address ) { PIMAGE_SECTION_HEADER sh; sh = FindSection( pIDD->pCurrentSections, pIDD->cCurrentSections, Address ); if (!sh) { return 0; } return (PCHAR)pIDD->ImageMap + sh->PointerToRawData + (Address - sh->VirtualAddress); } BOOL ReadSectionInfo( HANDLE hp, ULONG64 base, PIMGHLP_DEBUG_DATA pIDD, ULONG address, PVOID buf, DWORD size ) { PIMAGE_SECTION_HEADER sh; DWORD_PTR status = TRUE; sh = FindSection( pIDD->pCurrentSections, pIDD->cCurrentSections, address ); if (!sh) return FALSE; if (!hp) { status = (DWORD_PTR)memcpy((PCHAR)buf, (PCHAR)base + sh->PointerToRawData + (address - sh->VirtualAddress), size); } else { status = ReadImageData(hp, base, address, buf, size); } if (!status) return FALSE; return TRUE; } PCHAR expptr( HANDLE hp, ULONG64 base, PIMGHLP_DEBUG_DATA pIDD, ULONG address ) { PIMAGE_SECTION_HEADER sh; DWORD_PTR status = TRUE; if (hp) return (PCHAR)base + address; sh = FindSection( pIDD->pCurrentSections, pIDD->cCurrentSections, address ); if (!sh) return FALSE; return (PCHAR)base + sh->PointerToRawData + (address - sh->VirtualAddress); } ULONG LoadExportSymbols( PMODULE_ENTRY mi, PIMGHLP_DEBUG_DATA pIDD ) { PULONG names; PULONG addrs; PUSHORT ordinals; PUSHORT ordidx = NULL; ULONG cnt; ULONG idx; PIMAGE_EXPORT_DIRECTORY expdir; PCHAR expbuf = NULL; ULONG i; PSYMBOL_ENTRY sym; ULONG NameSize; HANDLE hp; ULONG64 base; CHAR name[2048]; BOOL rc; DWORD64 endExports; PCHAR p; if (g.SymOptions & SYMOPT_EXACT_SYMBOLS) return 0; // setup pointers for grabing data switch (pIDD->dsExports) { case dsInProc: hp = pIDD->hProcess; expbuf = (PCHAR)MemAlloc(pIDD->cExports); if (!expbuf) goto cleanup; if (!ReadImageData(hp, pIDD->InProcImageBase, pIDD->oExports, expbuf, pIDD->cExports)) goto cleanup; base = (ULONG64)expbuf - pIDD->oExports; expdir = (PIMAGE_EXPORT_DIRECTORY)expbuf; break; case dsImage: hp = NULL; expbuf = NULL; if (!pIDD->ImageMap) pIDD->ImageMap = MapItRO(pIDD->ImageFileHandle); base = (ULONG64)pIDD->ImageMap; expdir = &pIDD->expdir; break; default: return 0; } cnt = 0; names = (PULONG)expptr(hp, base, pIDD, expdir->AddressOfNames); if (!names) goto cleanup; addrs = (PULONG)expptr(hp, base, pIDD, expdir->AddressOfFunctions); if (!addrs) goto cleanup; ordinals = (PUSHORT)expptr(hp, base, pIDD, expdir->AddressOfNameOrdinals); if (!ordinals) goto cleanup; ordidx = (PUSHORT) MemAlloc( max(expdir->NumberOfFunctions, expdir->NumberOfNames) * sizeof(USHORT) ); if (!ordidx) goto cleanup; cnt = 0; NameSize = 0; // count the symbols for (i=0; iNumberOfNames; i++) { *name = 0; p = expptr(hp, base, pIDD, names[i]); if (!p) continue; strcpy(name, p); if (!*name) continue; if (g.SymOptions & SYMOPT_UNDNAME) { SymUnDNameInternal( mi->TmpSym.Name, TMP_SYM_LEN, name, strlen(name), mi->MachineType, TRUE ); NameSize += strlen(mi->TmpSym.Name); cnt += 1; } else { NameSize += (strlen(name) + 2); cnt += 1; } } for (i=0,idx=expdir->NumberOfNames; iNumberOfFunctions; i++) { if (!ordidx[i]) { NameSize += 16; cnt += 1; } } // allocate the symbol table if (!CreateSymbolTable( mi, cnt, SymExport, NameSize )) { cnt = 0; goto cleanup; } // allocate the symbols cnt = 0; endExports = pIDD->oExports + pIDD->cExports; for (i=0; iNumberOfNames; i++) { idx = ordinals[i]; ordidx[idx] = TRUE; *name = 0; p = expptr(hp, base, pIDD, names[i]); if (!p) continue; strcpy(name, p); if (!*name) continue; if (g.SymOptions & SYMOPT_UNDNAME) { SymUnDNameInternal( mi->TmpSym.Name, TMP_SYM_LEN, (LPSTR)name, strlen(name), mi->MachineType, TRUE ); sym = AllocSym( mi, addrs[idx] + mi->BaseOfDll, mi->TmpSym.Name); } else { sym = AllocSym( mi, addrs[idx] + mi->BaseOfDll, name); } if (sym) { cnt += 1; } if (pIDD->oExports <= addrs[idx] && addrs[idx] <= endExports) { sym->Flags |= SYMF_FORWARDER; } else { sym->Flags |= SYMF_EXPORT; } } for (i=0,idx=expdir->NumberOfNames; iNumberOfFunctions; i++) { if (!ordidx[i]) { CHAR NameBuf[sizeof("Ordinal99999") + 1]; // Ordinals are only 64k max. strcpy( NameBuf, "Ordinal" ); _itoa( i+expdir->Base, &NameBuf[7], 10 ); sym = AllocSym( mi, addrs[i] + mi->BaseOfDll, NameBuf); if (sym) { cnt += 1; } idx += 1; } } CompleteSymbolTable( mi ); cleanup: if (expbuf) { MemFree(expbuf); } if (ordidx) { MemFree(ordidx); } return cnt; } BOOL LoadCoffSymbols( HANDLE hProcess, PMODULE_ENTRY mi, PIMGHLP_DEBUG_DATA pIDD ) { PIMAGE_COFF_SYMBOLS_HEADER pCoffHeader = (PIMAGE_COFF_SYMBOLS_HEADER)(pIDD->pMappedCoff); PUCHAR stringTable; PIMAGE_SYMBOL allSymbols; DWORD numberOfSymbols; PIMAGE_LINENUMBER LineNumbers; PIMAGE_SYMBOL NextSymbol; PIMAGE_SYMBOL Symbol; PSYMBOL_ENTRY sym; CHAR szSymName[256]; DWORD i; DWORD64 addr; DWORD CoffSymbols = 0; DWORD NameSize = 0; DWORD64 Bias; allSymbols = (PIMAGE_SYMBOL)((PCHAR)pCoffHeader + pCoffHeader->LvaToFirstSymbol); stringTable = (PUCHAR)pCoffHeader + pCoffHeader->LvaToFirstSymbol + (pCoffHeader->NumberOfSymbols * IMAGE_SIZEOF_SYMBOL); numberOfSymbols = pCoffHeader->NumberOfSymbols; LineNumbers = (PIMAGE_LINENUMBER)(PCHAR)pCoffHeader + pCoffHeader->LvaToFirstLinenumber; // // count the number of actual symbols // NextSymbol = allSymbols; for (i= 0; i < numberOfSymbols; i++) { Symbol = NextSymbol++; if (Symbol->StorageClass == IMAGE_SYM_CLASS_EXTERNAL && Symbol->SectionNumber > 0) { GetSymName( Symbol, stringTable, szSymName, sizeof(szSymName) ); if (szSymName[0] == '?' && szSymName[1] == '?' && szSymName[2] == '_' && szSymName[3] == 'C' ) { // // ignore strings // } else if (g.SymOptions & SYMOPT_UNDNAME) { SymUnDNameInternal(mi->TmpSym.Name, TMP_SYM_LEN, szSymName, strlen(szSymName), mi->MachineType, TRUE); NameSize += strlen(mi->TmpSym.Name); CoffSymbols += 1; } else { CoffSymbols += 1; NameSize += (strlen(szSymName) + 1); } } NextSymbol += Symbol->NumberOfAuxSymbols; i += Symbol->NumberOfAuxSymbols; } // // allocate the symbol table // if (!CreateSymbolTable( mi, CoffSymbols, SymCoff, NameSize )) { return FALSE; } // // populate the symbol table // if (mi->Flags & MIF_ROM_IMAGE) { Bias = mi->BaseOfDll & 0xffffffff00000000; } else { Bias = mi->BaseOfDll; } NextSymbol = allSymbols; for (i= 0; i < numberOfSymbols; i++) { Symbol = NextSymbol++; if (Symbol->StorageClass == IMAGE_SYM_CLASS_EXTERNAL && Symbol->SectionNumber > 0) { GetSymName( Symbol, stringTable, szSymName, sizeof(szSymName) ); addr = Symbol->Value + Bias; if (szSymName[0] == '?' && szSymName[1] == '?' && szSymName[2] == '_' && szSymName[3] == 'C' ) { // // ignore strings // } else if (g.SymOptions & SYMOPT_UNDNAME) { SymUnDNameInternal(mi->TmpSym.Name, TMP_SYM_LEN, szSymName, strlen(szSymName), mi->MachineType, TRUE); AllocSym( mi, addr, mi->TmpSym.Name); } else { AllocSym( mi, addr, szSymName ); } } NextSymbol += Symbol->NumberOfAuxSymbols; i += Symbol->NumberOfAuxSymbols; } CompleteSymbolTable( mi ); if (g.SymOptions & SYMOPT_LOAD_LINES) { AddLinesForCoff(mi, allSymbols, numberOfSymbols, LineNumbers); } return TRUE; } BOOL LoadCodeViewSymbols( HANDLE hProcess, PMODULE_ENTRY mi, PIMGHLP_DEBUG_DATA pIDD ) { DWORD i, j; PPROCESS_ENTRY pe; OMFSignature *omfSig; OMFDirHeader *omfDirHdr; OMFDirEntry *omfDirEntry; OMFSymHash *omfSymHash; DATASYM32 *dataSym; DWORD64 addr; DWORD CvSymbols; DWORD NameSize; SYMBOL_ENTRY SymEntry; pe = FindProcessEntry( hProcess ); if (!pe) { return FALSE; } pprint(pe, "LoadCodeViewSymbols:\n" " hProcess %p\n" " mi %p\n" " pCvData %p\n" " dwSize %x\n", hProcess, mi, pIDD->pMappedCv, pIDD->cMappedCv ); omfSig = (OMFSignature*) pIDD->pMappedCv; if ((*(DWORD *)(omfSig->Signature) != '80BN') && (*(DWORD *)(omfSig->Signature) != '90BN') && (*(DWORD *)(omfSig->Signature) != '11BN')) { if ((*(DWORD *)(omfSig->Signature) != '01BN') && (*(DWORD *)(omfSig->Signature) != 'SDSR')) { pprint(pe, "unrecognized OMF sig: %x\n", *(DWORD *)(omfSig->Signature)); } return FALSE; } // // count the number of actual symbols // omfDirHdr = (OMFDirHeader*) ((ULONG_PTR)omfSig + (DWORD)omfSig->filepos); omfDirEntry = (OMFDirEntry*) ((ULONG_PTR)omfDirHdr + sizeof(OMFDirHeader)); NameSize = 0; CvSymbols = 0; for (i=0; icDir; i++,omfDirEntry++) { LPSTR SymbolName; UCHAR SymbolLen; SYMBOL_ENTRY SymEntry; if (omfDirEntry->SubSection == sstGlobalPub) { omfSymHash = (OMFSymHash*) ((ULONG_PTR)omfSig + omfDirEntry->lfo); dataSym = (DATASYM32*) ((ULONG_PTR)omfSig + omfDirEntry->lfo + sizeof(OMFSymHash)); for (j=sizeof(OMFSymHash); j<=omfSymHash->cbSymbol; ) { addr = 0; cvExtractSymbolInfo(mi, (PCHAR) dataSym, &SymEntry, FALSE); if (SymEntry.Segment && (SymEntry.Segment <= mi->OriginalNumSections)) { addr = mi->OriginalSectionHdrs[SymEntry.Segment-1].VirtualAddress + SymEntry.Offset + mi->BaseOfDll; SymbolName = SymEntry.Name; SymbolLen = (UCHAR) SymEntry.NameLength; if (SymbolName[0] == '?' && SymbolName[1] == '?' && SymbolName[2] == '_' && SymbolName[3] == 'C' ) { // // ignore strings // } else if (g.SymOptions & SYMOPT_UNDNAME) { SymUnDNameInternal(mi->TmpSym.Name, TMP_SYM_LEN, SymbolName, SymbolLen, mi->MachineType, TRUE); NameSize += strlen(mi->TmpSym.Name); CvSymbols += 1; } else { CvSymbols += 1; NameSize += SymbolLen + 1; } } j += dataSym->reclen + 2; dataSym = (DATASYM32*) ((ULONG_PTR)dataSym + dataSym->reclen + 2); } break; } } // // allocate the symbol table // if (!CreateSymbolTable( mi, CvSymbols, SymCv, NameSize )) { pprint(pe, "CreateSymbolTable failed\n"); return FALSE; } // // populate the symbol table // omfDirHdr = (OMFDirHeader*) ((ULONG_PTR)omfSig + (DWORD)omfSig->filepos); omfDirEntry = (OMFDirEntry*) ((ULONG_PTR)omfDirHdr + sizeof(OMFDirHeader)); for (i=0; icDir; i++,omfDirEntry++) { LPSTR SymbolName; if (omfDirEntry->SubSection == sstGlobalPub) { omfSymHash = (OMFSymHash*) ((ULONG_PTR)omfSig + omfDirEntry->lfo); dataSym = (DATASYM32*) ((ULONG_PTR)omfSig + omfDirEntry->lfo + sizeof(OMFSymHash)); for (j=sizeof(OMFSymHash); j<=omfSymHash->cbSymbol; ) { addr = 0; cvExtractSymbolInfo(mi, (PCHAR) dataSym, &SymEntry, FALSE); if (SymEntry.Segment && (SymEntry.Segment <= mi->OriginalNumSections)) { addr = mi->OriginalSectionHdrs[SymEntry.Segment-1].VirtualAddress + SymEntry.Offset + mi->BaseOfDll; SymbolName = SymEntry.Name; if (SymbolName[0] == '?' && SymbolName[1] == '?' && SymbolName[2] == '_' && SymbolName[3] == 'C' ) { // // ignore strings // } else if (g.SymOptions & SYMOPT_UNDNAME) { SymUnDNameInternal(mi->TmpSym.Name, TMP_SYM_LEN, SymbolName, SymEntry.NameLength, mi->MachineType, TRUE); AllocSym( mi, addr, (LPSTR) mi->TmpSym.Name); } else { mi->TmpSym.NameLength = SymEntry.NameLength; memcpy( mi->TmpSym.Name, SymbolName, mi->TmpSym.NameLength ); mi->TmpSym.Name[mi->TmpSym.NameLength] = 0; AllocSym( mi, addr, mi->TmpSym.Name); } } j += dataSym->reclen + 2; dataSym = (DATASYM32*) ((ULONG_PTR)dataSym + dataSym->reclen + 2); } break; } else if (omfDirEntry->SubSection == sstSrcModule && (g.SymOptions & SYMOPT_LOAD_LINES)) { AddLinesForOmfSourceModule(mi, (PUCHAR)(pIDD->pMappedCv)+omfDirEntry->lfo, (OMFSourceModule *) ((PCHAR)(pIDD->pMappedCv)+omfDirEntry->lfo), NULL); } } CompleteSymbolTable( mi ); return TRUE; } VOID GetSymName( PIMAGE_SYMBOL Symbol, PUCHAR StringTable, LPSTR s, DWORD size ) { DWORD i; if (Symbol->n_zeroes) { for (i=0; i<8; i++) { if ((Symbol->n_name[i]>0x1f) && (Symbol->n_name[i]<0x7f)) { *s++ = Symbol->n_name[i]; } } *s = 0; } else { strncpy( s, (char *) &StringTable[Symbol->n_offset], size ); } } VOID ProcessOmapForModule( PMODULE_ENTRY mi, PIMGHLP_DEBUG_DATA pIDD ) { PSYMBOL_ENTRY sym; PSYMBOL_ENTRY symN; DWORD i; ULONG64 addr; DWORD bias; PFPO_DATA fpo; if (pIDD->cOmapTo && pIDD->pOmapTo) { if (pIDD->fOmapToMapped || pIDD->dia) { mi->pOmapTo = (POMAP)MemAlloc(pIDD->cOmapTo * sizeof(OMAP)); if (mi->pOmapTo) { CopyMemory( mi->pOmapTo, pIDD->pOmapTo, pIDD->cOmapTo * sizeof(OMAP) ); } } else { mi->pOmapTo = pIDD->pOmapTo; } mi->cOmapTo = pIDD->cOmapTo; } if (pIDD->cOmapFrom && pIDD->pOmapFrom) { if (pIDD->fOmapFromMapped) { mi->pOmapFrom = (POMAP)MemAlloc(pIDD->cOmapFrom * sizeof(OMAP)); if (mi->pOmapFrom) { CopyMemory( mi->pOmapFrom, pIDD->pOmapFrom, pIDD->cOmapFrom * sizeof(OMAP) ); } } else { mi->pOmapFrom = pIDD->pOmapFrom; } mi->cOmapFrom = pIDD->cOmapFrom; } if (mi->pFpoData) { // // if this module is BBT-optimized, then build // another fpo table with omap transalation // mi->pFpoDataOmap = (PFPO_DATA)VirtualAlloc( NULL, sizeof(FPO_DATA) * mi->dwEntries, MEM_COMMIT, PAGE_READWRITE ); if (mi->pFpoDataOmap) { CopyMemory( mi->pFpoDataOmap, pIDD->pFpo, sizeof(FPO_DATA) * mi->dwEntries ); for (i = 0, fpo = mi->pFpoDataOmap; i < mi->dwEntries; i++, fpo++) { addr = ConvertOmapFromSrc(mi, mi->BaseOfDll + fpo->ulOffStart, &bias); if (addr) fpo->ulOffStart = (ULONG)(addr - mi->BaseOfDll) + bias; } VirtualProtect( mi->pFpoData, sizeof(FPO_DATA) * mi->dwEntries, PAGE_READONLY, &i ); } } if (!mi->pOmapFrom || !mi->symbolTable || ((mi->SymType != SymCoff) && (mi->SymType != SymCv)) ) { return; } for (i=0; inumsyms; i++) { ProcessOmapSymbol( mi, &mi->symbolTable[i] ); } CompleteSymbolTable( mi ); } BOOL ProcessOmapSymbol( PMODULE_ENTRY mi, PSYMBOL_ENTRY sym ) { DWORD bias; DWORD64 OptimizedSymAddr; DWORD rvaSym; POMAPLIST pomaplistHead; DWORD64 SymbolValue; DWORD64 OrgSymAddr; POMAPLIST pomaplistNew; POMAPLIST pomaplistPrev; POMAPLIST pomaplistCur; POMAPLIST pomaplistNext; DWORD rva; DWORD rvaTo; DWORD cb; DWORD end; DWORD rvaToNext; LPSTR NewSymName; CHAR Suffix[32]; DWORD64 addrNew; POMAP pomap; PSYMBOL_ENTRY symOmap; if ((sym->Flags & SYMF_OMAP_GENERATED) || (sym->Flags & SYMF_OMAP_MODIFIED)) { return FALSE; } OrgSymAddr = SymbolValue = sym->Address; OptimizedSymAddr = ConvertOmapFromSrc( mi, SymbolValue, &bias ); if (OptimizedSymAddr == 0) { // // No equivalent address // sym->Address = 0; return FALSE; } // // We have successfully converted // sym->Address = OptimizedSymAddr + bias; rvaSym = (ULONG)(SymbolValue - mi->BaseOfDll); SymbolValue = sym->Address; pomap = GetOmapFromSrcEntry( mi, OrgSymAddr ); if (!pomap) { goto exit; } pomaplistHead = NULL; // // Look for all OMAP entries belonging to SymbolEntry // end = (ULONG)(OrgSymAddr - mi->BaseOfDll + sym->Size); while (pomap && (pomap->rva < end)) { if (pomap->rvaTo == 0) { pomap++; continue; } // // Allocate and initialize a new entry // pomaplistNew = (POMAPLIST) MemAlloc( sizeof(OMAPLIST) ); if (!pomaplistNew) { return FALSE; } pomaplistNew->omap = *pomap; pomaplistNew->cb = pomap[1].rva - pomap->rva; pomaplistPrev = NULL; pomaplistCur = pomaplistHead; while (pomaplistCur != NULL) { if (pomap->rvaTo < pomaplistCur->omap.rvaTo) { // // Insert between Prev and Cur // break; } pomaplistPrev = pomaplistCur; pomaplistCur = pomaplistCur->next; } if (pomaplistPrev == NULL) { // // Insert in head position // pomaplistHead = pomaplistNew; } else { pomaplistPrev->next = pomaplistNew; } pomaplistNew->next = pomaplistCur; pomap++; } if (pomaplistHead == NULL) { goto exit; } pomaplistCur = pomaplistHead; pomaplistNext = pomaplistHead->next; // // we do have a list // while (pomaplistNext != NULL) { rva = pomaplistCur->omap.rva; rvaTo = pomaplistCur->omap.rvaTo; cb = pomaplistCur->cb; rvaToNext = pomaplistNext->omap.rvaTo; if (rvaToNext == sym->Address - mi->BaseOfDll) { // // Already inserted above // } else if (rvaToNext < (rvaTo + cb + 8)) { // // Adjacent to previous range // } else { addrNew = mi->BaseOfDll + rvaToNext; Suffix[0] = '_'; _ltoa( pomaplistNext->omap.rva - rvaSym, &Suffix[1], 10 ); memcpy( mi->TmpSym.Name, sym->Name, sym->NameLength ); strncpy( &mi->TmpSym.Name[sym->NameLength], Suffix, strlen(Suffix) + 1 ); symOmap = AllocSym( mi, addrNew, mi->TmpSym.Name); if (symOmap) { symOmap->Flags |= SYMF_OMAP_GENERATED; } } MemFree(pomaplistCur); pomaplistCur = pomaplistNext; pomaplistNext = pomaplistNext->next; } MemFree(pomaplistCur); exit: if (sym->Address != OrgSymAddr) { sym->Flags |= SYMF_OMAP_MODIFIED; } return TRUE; } DWORD64 ConvertOmapFromSrc( PMODULE_ENTRY mi, DWORD64 addr, LPDWORD bias ) { DWORD rva; DWORD comap; POMAP pomapLow; POMAP pomapHigh; DWORD comapHalf; POMAP pomapMid; *bias = 0; if (!mi->pOmapFrom) { return addr; } rva = (DWORD)(addr - mi->BaseOfDll); comap = mi->cOmapFrom; pomapLow = mi->pOmapFrom; pomapHigh = pomapLow + comap; while (pomapLow < pomapHigh) { comapHalf = comap / 2; pomapMid = pomapLow + ((comap & 1) ? comapHalf : (comapHalf - 1)); if (rva == pomapMid->rva) { if (pomapMid->rvaTo) { return mi->BaseOfDll + pomapMid->rvaTo; } else { return(0); // No need adding the base. This address was discarded... } } if (rva < pomapMid->rva) { pomapHigh = pomapMid; comap = (comap & 1) ? comapHalf : (comapHalf - 1); } else { pomapLow = pomapMid + 1; comap = comapHalf; } } // // If no exact match, pomapLow points to the next higher address // if (pomapLow == mi->pOmapFrom) { // // This address was not found // return 0; } if (pomapLow[-1].rvaTo == 0) { // // This address is in a discarded block // return 0; } // // Return the closest address plus the bias // *bias = rva - pomapLow[-1].rva; return mi->BaseOfDll + pomapLow[-1].rvaTo; } DWORD64 ConvertOmapToSrc( PMODULE_ENTRY mi, DWORD64 addr, LPDWORD bias, BOOL fBackup ) { DWORD rva; DWORD comap; POMAP pomapLow; POMAP pomapHigh; DWORD comapHalf; POMAP pomapMid; *bias = 0; if (!mi->pOmapTo) { return addr; } rva = (DWORD)(addr - mi->BaseOfDll); comap = mi->cOmapTo; pomapLow = mi->pOmapTo; pomapHigh = pomapLow + comap; while (pomapLow < pomapHigh) { comapHalf = comap / 2; pomapMid = pomapLow + ((comap & 1) ? comapHalf : (comapHalf - 1)); if (rva == pomapMid->rva) { if (pomapMid->rvaTo == 0) { // // We may be at the start of an inserted branch instruction // if (fBackup) { // // Return information about the next lower address // rva--; pomapLow = pomapMid; break; } return 0; } return mi->BaseOfDll + pomapMid->rvaTo; } if (rva < pomapMid->rva) { pomapHigh = pomapMid; comap = (comap & 1) ? comapHalf : (comapHalf - 1); } else { pomapLow = pomapMid + 1; comap = comapHalf; } } // // If no exact match, pomapLow points to the next higher address // if (pomapLow == mi->pOmapTo) { // // This address was not found // return 0; } // find the previous valid item in the omap do { pomapLow--; if (pomapLow->rvaTo) break; } while (pomapLow > mi->pOmapTo); // should never occur // assert(pomapLow->rvaTo); if (pomapLow->rvaTo == 0) { return 0; } // // Return the new address plus the bias // *bias = rva - pomapLow->rva; return mi->BaseOfDll + pomapLow->rvaTo; } POMAP GetOmapFromSrcEntry( PMODULE_ENTRY mi, DWORD64 addr ) { DWORD rva; DWORD comap; POMAP pomapLow; POMAP pomapHigh; DWORD comapHalf; POMAP pomapMid; if (mi->pOmapFrom == NULL) { return NULL; } rva = (DWORD)(addr - mi->BaseOfDll); comap = mi->cOmapFrom; pomapLow = mi->pOmapFrom; pomapHigh = pomapLow + comap; while (pomapLow < pomapHigh) { comapHalf = comap / 2; pomapMid = pomapLow + ((comap & 1) ? comapHalf : (comapHalf - 1)); if (rva == pomapMid->rva) { return pomapMid; } if (rva < pomapMid->rva) { pomapHigh = pomapMid; comap = (comap & 1) ? comapHalf : (comapHalf - 1); } else { pomapLow = pomapMid + 1; comap = comapHalf; } } return NULL; } VOID DumpOmapForModule( PMODULE_ENTRY mi ) { POMAP pomap; DWORD i; i = sizeof(ULONG_PTR); i = sizeof(DWORD); if (!mi->pOmapFrom) return; dprint("\nOMAP FROM:\n"); for(i = 0, pomap = mi->pOmapFrom; i < 100; // mi->cOmapFrom; i++, pomap++) { dprint("%8x %8x\n", pomap->rva, pomap->rvaTo); } if (!mi->pOmapTo) return; dprint("\nOMAP TO:\n"); for(i = 0, pomap = mi->pOmapTo; i < 100; // mi->cOmapTo; i++, pomap++) { dprint("%8x %8x\n", pomap->rva, pomap->rvaTo); } } LPSTR StringDup( LPSTR str ) { LPSTR ds = (LPSTR) MemAlloc( strlen(str) + 1 ); if (ds) { strcpy( ds, str ); } return ds; } BOOL InternalGetModule( HANDLE hProcess, LPSTR ModuleName, DWORD64 ImageBase, DWORD ImageSize, PVOID Context ) { InternalLoadModule( hProcess, ModuleName, NULL, ImageBase, ImageSize, NULL, 0, NULL ); return TRUE; } BOOL LoadedModuleEnumerator( HANDLE hProcess, LPSTR ModuleName, DWORD64 ImageBase, DWORD ImageSize, PLOADED_MODULE lm ) { if (lm->EnumLoadedModulesCallback64) { return lm->EnumLoadedModulesCallback64( ModuleName, ImageBase, ImageSize, lm->Context ); } else { return lm->EnumLoadedModulesCallback32( ModuleName, (DWORD)ImageBase, ImageSize, lm->Context ); } } BOOL ToggleFailCriticalErrors( BOOL reset ) { static UINT oldmode = 0; if (!(g.SymOptions & SYMOPT_FAIL_CRITICAL_ERRORS)) return FALSE; if (reset) SetErrorMode(oldmode); else oldmode = SetErrorMode(SEM_FAILCRITICALERRORS); return TRUE; } DWORD fnGetFileAttributes( LPCTSTR lpFileName ) { DWORD rc; SetCriticalErrorMode(); rc = GetFileAttributes(lpFileName); ResetCriticalErrorMode(); return rc; } LPSTR SymUnDNameInternal( LPSTR UnDecName, DWORD UnDecNameLength, LPSTR DecName, DWORD DecNameLength, DWORD MachineType, BOOL IsPublic ) { LPSTR p; ULONG Suffix; ULONG i; LPSTR TmpDecName; UnDecName[0] = 0; if (DecName[0] == '?' || !strncmp(DecName, ".?", 2) || !strncmp(DecName, "..?", 3)) { __try { if (DecName[0] == '.') { if (DecName[1] == '.') { Suffix = 2; UnDecName[0] = '.'; UnDecName[1] = '.'; } else { // DecName[1] = '?' Suffix = 1; UnDecName[0] = '.'; } } else { // DecName[0] = '?' Suffix = 0; } TmpDecName = (LPSTR)MemAlloc( 4096 ); if (!TmpDecName) { strncat( UnDecName, DecName, min(DecNameLength,UnDecNameLength) ); return UnDecName; } TmpDecName[0] = 0; strncat( TmpDecName, DecName+Suffix, DecNameLength ); if (UnDecorateSymbolName( TmpDecName, UnDecName+Suffix, UnDecNameLength-Suffix, UNDNAME_NAME_ONLY ) == 0 ) { strncat( UnDecName, DecName, min(DecNameLength,UnDecNameLength) ); } MemFree( TmpDecName ); } __except (EXCEPTION_EXECUTE_HANDLER) { strncat( UnDecName, DecName, min(DecNameLength,UnDecNameLength) ); } } else { __try { if ((IsPublic && (DecName[0] == '_' || DecName[0] == '.')) || DecName[0] == '@') { DecName += 1; DecNameLength -= 1; } p = 0; for (i = 0; i < DecNameLength; i++) { if (DecName [i] == '@') { p = &DecName [i]; break; } } if (p) { i = (int)(p - DecName); } else { i = min(DecNameLength,UnDecNameLength); } strncat( UnDecName, DecName, i ); } __except (EXCEPTION_EXECUTE_HANDLER) { strncat( UnDecName, DecName, min(DecNameLength,UnDecNameLength) ); } } if (g.SymOptions & SYMOPT_NO_CPP) { while (p = strstr( UnDecName, "::" )) { p[0] = '_'; p[1] = '_'; } } return UnDecName; } BOOL MatchSymName( LPSTR matchName, LPSTR symName ) { assert(matchName && symName); if (!*matchName || !*symName) return FALSE; if (g.SymOptions & SYMOPT_CASE_INSENSITIVE) { if (!_strnicmp(matchName, symName, MAX_SYM_NAME)) return TRUE; } else { if (!strncmp(matchName, symName, MAX_SYM_NAME)) return TRUE; } return FALSE; } PIMAGEHLP_SYMBOL symcpy32( PIMAGEHLP_SYMBOL External, PSYMBOL_ENTRY Internal ) { External->Address = (ULONG)Internal->Address; External->Size = Internal->Size; External->Flags = Internal->Flags; External->Name[0] = 0; strncat( External->Name, Internal->Name, External->MaxNameLength ); return External; } PIMAGEHLP_SYMBOL64 symcpy64( PIMAGEHLP_SYMBOL64 External, PSYMBOL_ENTRY Internal ) { External->Address = Internal->Address; External->Size = Internal->Size; External->Flags = Internal->Flags; External->Name[0] = 0; strncat( External->Name, Internal->Name, External->MaxNameLength ); return External; } BOOL SympConvertSymbol64To32( PIMAGEHLP_SYMBOL64 Symbol64, PIMAGEHLP_SYMBOL Symbol32 ) { Symbol32->Address = (DWORD)Symbol64->Address; Symbol32->Size = Symbol64->Size; Symbol32->Flags = Symbol64->Flags; Symbol32->MaxNameLength = Symbol64->MaxNameLength; Symbol32->Name[0] = 0; strncat( Symbol32->Name, Symbol64->Name, Symbol32->MaxNameLength ); return (Symbol64->Address >> 32) == 0; } BOOL SympConvertSymbol32To64( PIMAGEHLP_SYMBOL Symbol32, PIMAGEHLP_SYMBOL64 Symbol64 ) { Symbol64->Address = Symbol32->Address; Symbol64->Size = Symbol32->Size; Symbol64->Flags = Symbol32->Flags; Symbol64->MaxNameLength = Symbol32->MaxNameLength; Symbol64->Name[0] = 0; strncat( Symbol64->Name, Symbol32->Name, Symbol64->MaxNameLength ); return TRUE; } BOOL SympConvertLine64To32( PIMAGEHLP_LINE64 Line64, PIMAGEHLP_LINE Line32 ) { Line32->Key = Line64->Key; Line32->LineNumber = Line64->LineNumber; Line32->FileName = Line64->FileName; Line32->Address = (DWORD)Line64->Address; return (Line64->Address >> 32) == 0; } BOOL SympConvertLine32To64( PIMAGEHLP_LINE Line32, PIMAGEHLP_LINE64 Line64 ) { Line64->Key = Line32->Key; Line64->LineNumber = Line32->LineNumber; Line64->FileName = Line32->FileName; Line64->Address = Line32->Address; return TRUE; } BOOL __stdcall ReadInProcMemory( HANDLE hProcess, DWORD64 addr, PVOID buf, DWORD bytes, DWORD *bytesread ) { DWORD rc; PPROCESS_ENTRY pe; IMAGEHLP_CBA_READ_MEMORY rm; rm.addr = addr; rm.buf = buf; rm.bytes = bytes; rm.bytesread = bytesread; rc = FALSE; __try { pe = FindProcessEntry(hProcess); if (!pe) { SetLastError( ERROR_INVALID_HANDLE ); return FALSE; } if (pe->pCallbackFunction32) { rc = pe->pCallbackFunction32(pe->hProcess, CBA_READ_MEMORY, (PVOID)&rm, (PVOID)pe->CallbackUserContext); } else if (pe->pCallbackFunction64) { rc = pe->pCallbackFunction64(pe->hProcess, CBA_READ_MEMORY, (ULONG64)&rm, pe->CallbackUserContext); } else { SIZE_T RealBytesRead=0; rc = ReadProcessMemory(hProcess, (LPVOID)(ULONG_PTR)addr, buf, bytes, &RealBytesRead); *bytesread = (DWORD)RealBytesRead; } } __except (EXCEPTION_EXECUTE_HANDLER) { rc = FALSE; } return (rc != FALSE); } DWORD64 miGetModuleBase( HANDLE hProcess, DWORD64 Address ) { IMAGEHLP_MODULE64 ModuleInfo = {0}; ModuleInfo.SizeOfStruct = sizeof(ModuleInfo); if (SymGetModuleInfo64(hProcess, Address, &ModuleInfo)) { return ModuleInfo.BaseOfImage; } else { return 0; } } BOOL GetPData( HANDLE hp, PMODULE_ENTRY mi ) { BOOL status; ULONG cb; PCHAR pc; BOOL fROM = FALSE; IMAGE_DOS_HEADER DosHeader; IMAGE_NT_HEADERS ImageNtHeaders; PIMAGE_FILE_HEADER ImageFileHdr; PIMAGE_OPTIONAL_HEADER ImageOptionalHdr; PIMAGE_OPTIONAL_HEADER32 OptionalHeader32 = NULL; PIMAGE_OPTIONAL_HEADER64 OptionalHeader64 = NULL; ULONG feCount = 0; ULONG i; HANDLE fh = 0; PCHAR base = NULL; USHORT filetype; PIMAGE_SEPARATE_DEBUG_HEADER sdh; PIMAGE_DOS_HEADER dh; PIMAGE_NT_HEADERS inth; PIMAGE_OPTIONAL_HEADER32 ioh32; PIMAGE_OPTIONAL_HEADER64 ioh64; ULONG cdd; PCHAR p; PIMAGE_DEBUG_DIRECTORY dd; ULONG cexp = 0; ULONG tsize; ULONG csize = 0; // if the pdata is already loaded, return if (mi->pExceptionData) return TRUE; if (!LoadSymbols(hp, mi, 0)) return FALSE; // try to get pdata from dia if (mi->dia) { if ((mi->pPData) && (mi->dsExceptions == dsDia)) goto dia; if (diaGetPData(mi)) { p = (PCHAR)mi->pPData; csize = mi->cbPData; goto dia; } } if (!mi->dsExceptions) return FALSE; // open the file and get the file type SetCriticalErrorMode(); fh = CreateFile(mi->LoadedImageName, GENERIC_READ, g.OSVerInfo.dwPlatformId == VER_PLATFORM_WIN32_NT ? (FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE) : (FILE_SHARE_READ | FILE_SHARE_WRITE), NULL, OPEN_EXISTING, 0, NULL ); ResetCriticalErrorMode(); if (fh == INVALID_HANDLE_VALUE) return FALSE; base = (PCHAR)MapItRO(fh); if (!base) goto cleanup; p = base; filetype = *(USHORT *)p; if (filetype == IMAGE_DOS_SIGNATURE) goto image; if (filetype == IMAGE_SEPARATE_DEBUG_SIGNATURE) goto dbg; goto cleanup; image: // process disk-based image dh = (PIMAGE_DOS_HEADER)p; p += dh->e_lfanew; inth = (PIMAGE_NT_HEADERS)p; if (inth->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) { ioh32 = (PIMAGE_OPTIONAL_HEADER32)&inth->OptionalHeader; p = base + ioh32->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].VirtualAddress; csize = ioh32->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].Size; } else if (inth->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) { ioh64 = (PIMAGE_OPTIONAL_HEADER64)&inth->OptionalHeader; p = base + ioh64->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].VirtualAddress; csize = ioh64->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].Size; } dia: if (!csize) goto cleanup; switch (mi->MachineType) { case IMAGE_FILE_MACHINE_ALPHA: cexp = csize / sizeof(IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY); break; case IMAGE_FILE_MACHINE_ALPHA64: cexp = csize / sizeof(IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY); break; case IMAGE_FILE_MACHINE_IA64: cexp = csize / sizeof(IMAGE_IA64_RUNTIME_FUNCTION_ENTRY); break; case IMAGE_FILE_MACHINE_AMD64: cexp = csize / sizeof(_IMAGE_RUNTIME_FUNCTION_ENTRY); break; default: goto cleanup; } goto table; dbg: // process dbg file sdh = (PIMAGE_SEPARATE_DEBUG_HEADER)p; cdd = sdh->DebugDirectorySize / sizeof(IMAGE_DEBUG_DIRECTORY); p += sizeof(IMAGE_SEPARATE_DEBUG_HEADER) + (sdh->NumberOfSections * sizeof(IMAGE_SECTION_HEADER)) + sdh->ExportedNamesSize; dd = (PIMAGE_DEBUG_DIRECTORY)p; for (i = 0; i < cdd; i++, dd++) { if (dd->Type == IMAGE_DEBUG_TYPE_EXCEPTION) { p = base + dd->PointerToRawData; cexp = dd->SizeOfData / sizeof(IMAGE_FUNCTION_ENTRY); break; } } table: // parse the pdata into a table if (!cexp) goto cleanup; tsize = cexp * sizeof(IMGHLP_RVA_FUNCTION_DATA); mi->pExceptionData = (PIMGHLP_RVA_FUNCTION_DATA)VirtualAlloc( NULL, tsize, MEM_COMMIT, PAGE_READWRITE ); if (mi->pExceptionData) { PIMGHLP_RVA_FUNCTION_DATA pIRFD = mi->pExceptionData; switch (mi->MachineType) { case IMAGE_FILE_MACHINE_ALPHA: if (filetype == IMAGE_SEPARATE_DEBUG_SIGNATURE) { // easy case. The addresses are already in rva format. PIMAGE_FUNCTION_ENTRY pFE = (PIMAGE_FUNCTION_ENTRY)p; for (i = 0; i < cexp; i++) { pIRFD[i].rvaBeginAddress = pFE[i].StartingAddress; pIRFD[i].rvaEndAddress = pFE[i].EndingAddress; pIRFD[i].rvaPrologEndAddress = pFE[i].EndOfPrologue; pIRFD[i].rvaExceptionHandler = 0; pIRFD[i].rvaHandlerData = 0; } } else { PIMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY pRFE = (PIMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY)p; for (i = 0; i < cexp; i++) { pIRFD[i].rvaBeginAddress = pRFE[i].BeginAddress - (ULONG)mi->BaseOfDll; pIRFD[i].rvaEndAddress = pRFE[i].EndAddress - (ULONG)mi->BaseOfDll; pIRFD[i].rvaPrologEndAddress = pRFE[i].PrologEndAddress - (ULONG)mi->BaseOfDll; pIRFD[i].rvaExceptionHandler = pRFE[i].ExceptionHandler - (ULONG)mi->BaseOfDll; pIRFD[i].rvaHandlerData = pRFE[i].HandlerData - (ULONG)mi->BaseOfDll; } } break; case IMAGE_FILE_MACHINE_ALPHA64: { PIMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY pRFE = (PIMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY)p; for (i = 0; i < cexp; i++) { pIRFD[i].rvaBeginAddress = (DWORD)(pRFE[i].BeginAddress - mi->BaseOfDll); pIRFD[i].rvaEndAddress = (DWORD)(pRFE[i].EndAddress - mi->BaseOfDll); pIRFD[i].rvaPrologEndAddress = (DWORD)(pRFE[i].PrologEndAddress - mi->BaseOfDll); pIRFD[i].rvaExceptionHandler = (DWORD)(pRFE[i].ExceptionHandler - mi->BaseOfDll); pIRFD[i].rvaHandlerData = (DWORD)(pRFE[i].HandlerData - mi->BaseOfDll); } } break; case IMAGE_FILE_MACHINE_IA64: { PIMAGE_IA64_RUNTIME_FUNCTION_ENTRY pRFE = (PIMAGE_IA64_RUNTIME_FUNCTION_ENTRY)p; for (i = 0; i < cexp; i++) { pIRFD[i].rvaBeginAddress = pRFE[i].BeginAddress; pIRFD[i].rvaEndAddress = pRFE[i].EndAddress; pIRFD[i].rvaPrologEndAddress = pRFE[i].UnwindInfoAddress; pIRFD[i].rvaExceptionHandler = 0; pIRFD[i].rvaHandlerData = 0; } } break; case IMAGE_FILE_MACHINE_AMD64: { _PIMAGE_RUNTIME_FUNCTION_ENTRY pRFE = (_PIMAGE_RUNTIME_FUNCTION_ENTRY)p; for (i = 0; i < cexp; i++) { pIRFD[i].rvaBeginAddress = pRFE[i].BeginAddress; pIRFD[i].rvaEndAddress = pRFE[i].EndAddress; pIRFD[i].rvaPrologEndAddress = pRFE[i].UnwindInfoAddress; pIRFD[i].rvaExceptionHandler = 0; pIRFD[i].rvaHandlerData = 0; } } break; default: break; } VirtualProtect( mi->pExceptionData, tsize, PAGE_READONLY, &i ); mi->dwEntries = cexp; } cleanup: if (mi->pPData) { MemFree(mi->pPData); mi->pPData = NULL; } if (base) UnmapViewOfFile(base); if (fh) CloseHandle(fh); return (cexp) ? TRUE : FALSE; } BOOL GetXData( HANDLE hp, PMODULE_ENTRY mi ) { if (mi->pXData) return TRUE; if (LoadSymbols(hp, mi, 0) && !mi->pXData && mi->dia && !diaGetXData(mi)) return FALSE; return (mi->pXData != NULL); } PVOID GetXDataFromBase( HANDLE hp, DWORD64 base, ULONG_PTR* size ) { PPROCESS_ENTRY pe; PMODULE_ENTRY mi; pe = FindProcessEntry(hp); if (!pe) { SetLastError(ERROR_INVALID_HANDLE); return NULL; } mi = GetModuleForPC(pe, base, FALSE); if (!mi) { SetLastError(ERROR_MOD_NOT_FOUND); return NULL; } if (!GetXData(hp, mi)) return NULL; if (size) *size = mi->cbXData; return mi->pXData; } PVOID GetUnwindInfoFromSymbols( HANDLE hProcess, DWORD64 ModuleBase, ULONG UnwindInfoAddress, ULONG_PTR* Size ) { ULONG_PTR XDataSize; PBYTE pXData = (PBYTE)GetXDataFromBase(hProcess, ModuleBase, &XDataSize); if (!pXData) return NULL; DWORD DataBase = *(DWORD*)pXData; pXData += sizeof(DWORD); if (DataBase > UnwindInfoAddress) return NULL; ULONG_PTR Offset = UnwindInfoAddress - DataBase; if (Offset >= XDataSize) return NULL; if (Size) *Size = XDataSize - Offset; return pXData + Offset; }