[NTOSKRNL] Add support for large allocations in !poolfind

This commit is contained in:
Pierre Schweitzer 2019-01-08 08:42:51 +01:00
parent e1342127f0
commit a3f8813fff
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B

View file

@ -26,6 +26,10 @@ typedef struct _IRP_FIND_CTXT
} IRP_FIND_CTXT, *PIRP_FIND_CTXT;
extern PVOID MmNonPagedPoolEnd0;
extern SIZE_T PoolBigPageTableSize;
extern PPOOL_TRACKER_BIG_PAGES PoolBigPageTable;
#define POOL_BIG_TABLE_ENTRY_FREE 0x1
/* Pool block/header/list access macros */
#define POOL_ENTRY(x) (PPOOL_HEADER)((ULONG_PTR)(x) - sizeof(POOL_HEADER))
@ -210,6 +214,34 @@ ExpKdbgExtPoolUsed(
return TRUE;
}
static
VOID
ExpKdbgExtPoolFindLargePool(
ULONG Tag,
ULONG Mask)
{
ULONG i;
KdbpPrint("Scanning large pool allocation table for Tag: %.4s (%p : %p)\n", (PCHAR)&Tag, &PoolBigPageTable[0], &PoolBigPageTable[PoolBigPageTableSize - 1]);
for (i = 0; i < PoolBigPageTableSize; i++)
{
/* Free entry? */
if ((ULONG_PTR)PoolBigPageTable[i].Va & POOL_BIG_TABLE_ENTRY_FREE)
{
continue;
}
if ((PoolBigPageTable[i].Key & Mask) == (Tag & Mask))
{
/* Print the line */
KdbpPrint("%p: tag %.4s, size: %I64x\n",
PoolBigPageTable[i].Va, (PCHAR)&PoolBigPageTable[i].Key,
PoolBigPageTable[i].NumberOfPages << PAGE_SHIFT);
}
}
}
static
BOOLEAN
ExpKdbgExtValidatePoolHeader(
@ -423,7 +455,8 @@ ExpKdbgExtPoolFind(
}
}
/* FIXME: What about large pool? */
/* First search for large allocations */
ExpKdbgExtPoolFindLargePool(Tag, Mask);
if (PoolType == NonPagedPool)
{