mirror of
https://github.com/reactos/reactos.git
synced 2024-12-28 18:15:11 +00:00
Porting pice. Added coff symbol parsing to pice, and some other small things.
svn path=/trunk/; revision=2486
This commit is contained in:
parent
fae2e4844a
commit
fa8eafcb38
10 changed files with 591 additions and 463 deletions
|
@ -32,6 +32,7 @@ Copyright notice:
|
||||||
///////////////////////////////////////////////////////////////////////////////////
|
///////////////////////////////////////////////////////////////////////////////////
|
||||||
// includes
|
// includes
|
||||||
#include "stdinc.h"
|
#include "stdinc.h"
|
||||||
|
#include <wchar.h>
|
||||||
|
|
||||||
///////////////////////////////////////////////////////////////////////////////////
|
///////////////////////////////////////////////////////////////////////////////////
|
||||||
// constant defines
|
// constant defines
|
||||||
|
@ -53,7 +54,7 @@ ULONG ulGlobalVerbose = 0;
|
||||||
///////////////////////////////////////////////////////////////////////////////////
|
///////////////////////////////////////////////////////////////////////////////////
|
||||||
void process_stabs(
|
void process_stabs(
|
||||||
char* pExeName, // name of exe
|
char* pExeName, // name of exe
|
||||||
int fileout, // symbol file handle
|
HANDLE fileout, // symbol file handle
|
||||||
PIMAGE_SECTION_HEADER section, //Elf32_Shdr* pSHdr,
|
PIMAGE_SECTION_HEADER section, //Elf32_Shdr* pSHdr,
|
||||||
int sectionHeadersSize, //int nSHdrSize,
|
int sectionHeadersSize, //int nSHdrSize,
|
||||||
void* p, // ptr to memory where whole exe was read
|
void* p, // ptr to memory where whole exe was read
|
||||||
|
@ -74,6 +75,8 @@ void process_stabs(
|
||||||
LPSTR pSlash,pDot;
|
LPSTR pSlash,pDot;
|
||||||
char temp[2048];
|
char temp[2048];
|
||||||
char* pCopyExeName = temp;
|
char* pCopyExeName = temp;
|
||||||
|
WCHAR tempstr[64];
|
||||||
|
DWORD wrote;
|
||||||
|
|
||||||
//printf("LOADER: enter process_stabs()\n");
|
//printf("LOADER: enter process_stabs()\n");
|
||||||
|
|
||||||
|
@ -91,7 +94,10 @@ void process_stabs(
|
||||||
{
|
{
|
||||||
pCopyExeName = pSlash+1;
|
pCopyExeName = pSlash+1;
|
||||||
}
|
}
|
||||||
strcpy(SymbolFileHeader.name,pCopyExeName);
|
strLen = MultiByteToWideChar(CP_ACP, NULL, pCopyExeName, -1, tempstr, 64 );
|
||||||
|
if( !strLen )
|
||||||
|
printf("Cannot convert string to multibyte: %s\n", pCopyExeName );
|
||||||
|
wcscpy(SymbolFileHeader.name,tempstr);
|
||||||
|
|
||||||
for(i=0;i<(nStabLen/sizeof(STAB_ENTRY));i++)
|
for(i=0;i<(nStabLen/sizeof(STAB_ENTRY));i++)
|
||||||
{
|
{
|
||||||
|
@ -219,22 +225,25 @@ void process_stabs(
|
||||||
SymbolFileHeader.ulOffsetToSrcFiles = sizeof(PICE_SYMBOLFILE_HEADER)+sectionHeadersSize+nGlobalLen+nGlobalStrLen+nStabLen+nStrLen;
|
SymbolFileHeader.ulOffsetToSrcFiles = sizeof(PICE_SYMBOLFILE_HEADER)+sectionHeadersSize+nGlobalLen+nGlobalStrLen+nStabLen+nStrLen;
|
||||||
SymbolFileHeader.ulNumberOfSrcFiles = ulCurrentSrcFile;
|
SymbolFileHeader.ulNumberOfSrcFiles = ulCurrentSrcFile;
|
||||||
|
|
||||||
write(fileout,&SymbolFileHeader,sizeof(SymbolFileHeader));
|
printf("sectionHeaderSize: %ld, nGlobalLen: %ld, nGlobalStrLen: %ld, nStabLen: %ld,
|
||||||
write(fileout,section,sectionHeadersSize);
|
nStrLen: %ld, ulCurrentSrcFile: %ld, ulOffsetToStabs: %ld \n", sectionHeadersSize, nGlobalLen, nGlobalStrLen,
|
||||||
write(fileout,pGlobals,nGlobalLen);
|
nStabLen, nStrLen, ulCurrentSrcFile, SymbolFileHeader.ulOffsetToStabs);
|
||||||
write(fileout,pGlobalsStr,nGlobalStrLen);
|
WriteFile(fileout,&SymbolFileHeader,sizeof(PICE_SYMBOLFILE_HEADER),&wrote, NULL);
|
||||||
write(fileout,pStab,nStabLen);
|
WriteFile(fileout,section,sectionHeadersSize,&wrote, NULL);
|
||||||
write(fileout,pStr,nStrLen);
|
WriteFile(fileout,pGlobals,nGlobalLen,&wrote, NULL);
|
||||||
|
WriteFile(fileout,pGlobalsStr,nGlobalStrLen,&wrote, NULL);
|
||||||
|
WriteFile(fileout,pStab,nStabLen,&wrote, NULL);
|
||||||
|
WriteFile(fileout,pStr,nStrLen,&wrote, NULL);
|
||||||
|
|
||||||
for(i=0;i<ulCurrentSrcFile;i++)
|
for(i=0;i<ulCurrentSrcFile;i++)
|
||||||
{
|
{
|
||||||
int file;
|
HANDLE file;
|
||||||
int len;
|
int len;
|
||||||
PVOID pFile;
|
PVOID pFile;
|
||||||
PICE_SYMBOLFILE_SOURCE pss;
|
PICE_SYMBOLFILE_SOURCE pss;
|
||||||
|
|
||||||
file = _open(SrcFileNames[i],O_RDONLY);
|
file = CreateFile(SrcFileNames[i],O_RDONLY, 0, NULL, OPEN_EXISTING, 0, 0);
|
||||||
if( file <= 0 ){
|
if( file == INVALID_HANDLE_VALUE ){
|
||||||
//let's try win format drive:/file
|
//let's try win format drive:/file
|
||||||
char srctmp[2048];
|
char srctmp[2048];
|
||||||
strcpy(srctmp, SrcFileNames[i] );
|
strcpy(srctmp, SrcFileNames[i] );
|
||||||
|
@ -242,19 +251,19 @@ void process_stabs(
|
||||||
*(srctmp) = *(srctmp+2);
|
*(srctmp) = *(srctmp+2);
|
||||||
*(srctmp+1) = ':';
|
*(srctmp+1) = ':';
|
||||||
*(srctmp+2) = '/';
|
*(srctmp+2) = '/';
|
||||||
file = _open(srctmp,O_RDONLY);
|
file = CreateFile(srctmp,O_RDONLY, 0, NULL, OPEN_EXISTING, 0, 0);
|
||||||
if( file <= 0 )
|
if( file == INVALID_HANDLE_VALUE )
|
||||||
printf("Can't open file: %s\n", srctmp );
|
printf("Can't open file: %s\n", srctmp );
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
if(file>0)
|
if(file != INVALID_HANDLE_VALUE)
|
||||||
{
|
{
|
||||||
//printf("LOADER: [%u] opened %s as FD %x\n",i,SrcFileNames[i],file);
|
//printf("LOADER: [%u] opened %s as FD %x\n",i,SrcFileNames[i],file);
|
||||||
|
|
||||||
len = _lseek(file,0,SEEK_END);
|
len = SetFilePointer(file,0,NULL,FILE_END);
|
||||||
//printf("LOADER: length = %x\n",(int)len);
|
//printf("LOADER: length = %x\n",(int)len);
|
||||||
|
|
||||||
_lseek(file,0,SEEK_SET);
|
SetFilePointer(file,0,NULL,FILE_BEGIN);
|
||||||
|
|
||||||
strcpy(pss.filename,SrcFileNames[i]);
|
strcpy(pss.filename,SrcFileNames[i]);
|
||||||
pss.ulOffsetToNext = len+sizeof(PICE_SYMBOLFILE_SOURCE);
|
pss.ulOffsetToNext = len+sizeof(PICE_SYMBOLFILE_SOURCE);
|
||||||
|
@ -264,15 +273,15 @@ void process_stabs(
|
||||||
if(pFile)
|
if(pFile)
|
||||||
{
|
{
|
||||||
//printf("LOADER: reading file...\n");
|
//printf("LOADER: reading file...\n");
|
||||||
_read(file,pFile,len);
|
ReadFile(file,pFile,len,&wrote,NULL);
|
||||||
|
|
||||||
_write(fileout,&pss,sizeof(PICE_SYMBOLFILE_SOURCE));
|
WriteFile(fileout,&pss,sizeof(PICE_SYMBOLFILE_SOURCE),&wrote, NULL);
|
||||||
//printf("LOADER: writing file...\n");
|
//printf("LOADER: writing file...\n");
|
||||||
_write(fileout,pFile,len);
|
WriteFile(fileout,pFile,len,&wrote, NULL);
|
||||||
free(pFile);
|
free(pFile);
|
||||||
}
|
}
|
||||||
|
|
||||||
_close(file);
|
CloseHandle(file);
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
@ -329,7 +338,7 @@ int process_pe(char* filename,int file,void* p,int len)
|
||||||
char* pSymTab;
|
char* pSymTab;
|
||||||
|
|
||||||
char szSymName[2048];
|
char szSymName[2048];
|
||||||
int fileout;
|
HANDLE fileout;
|
||||||
int nSymStrLen,nStabStrLen;
|
int nSymStrLen,nStabStrLen;
|
||||||
int iRetVal = 0;
|
int iRetVal = 0;
|
||||||
|
|
||||||
|
@ -346,9 +355,8 @@ int process_pe(char* filename,int file,void* p,int len)
|
||||||
nSym = pNTHeaders->FileHeader.NumberOfSymbols;
|
nSym = pNTHeaders->FileHeader.NumberOfSymbols;
|
||||||
//string table follows immediately after symbol table. first 4 bytes give the length of the table
|
//string table follows immediately after symbol table. first 4 bytes give the length of the table
|
||||||
//references to string table include the first 4 bytes.
|
//references to string table include the first 4 bytes.
|
||||||
pStrTab = (PIMAGE_SYMBOL)pSymTab + nSym;
|
pStrTab = (char*)((PIMAGE_SYMBOL)pSymTab + nSym);
|
||||||
nSymStrLen = *((DWORD*)pStrTab);
|
nSymStrLen = *((DWORD*)pStrTab);
|
||||||
|
|
||||||
find_stab_sections(p,IMAGE_FIRST_SECTION(pNTHeaders),pNTHeaders->FileHeader.NumberOfSections,
|
find_stab_sections(p,IMAGE_FIRST_SECTION(pNTHeaders),pNTHeaders->FileHeader.NumberOfSections,
|
||||||
&pStab,&nStabLen,&pStr,&nStabStrLen);
|
&pStab,&nStabLen,&pStr,&nStabStrLen);
|
||||||
|
|
||||||
|
@ -370,24 +378,32 @@ int process_pe(char* filename,int file,void* p,int len)
|
||||||
//printf("LOADER: symbol file name = %s\n",szSymName);
|
//printf("LOADER: symbol file name = %s\n",szSymName);
|
||||||
printf("LOADER: creating symbol file %s for %s\n",szSymName,filename);
|
printf("LOADER: creating symbol file %s for %s\n",szSymName,filename);
|
||||||
|
|
||||||
fileout = _creat(szSymName, _S_IREAD | _S_IWRITE ); // make r/w
|
fileout = CreateFile(szSymName,
|
||||||
if(fileout != -1)
|
GENERIC_READ | GENERIC_WRITE,
|
||||||
|
0,
|
||||||
|
NULL,
|
||||||
|
CREATE_ALWAYS,
|
||||||
|
0,
|
||||||
|
0);
|
||||||
|
|
||||||
|
if(fileout != INVALID_HANDLE_VALUE)
|
||||||
{
|
{
|
||||||
|
printf("NumberOfSections: %d, size: %d\n", pNTHeaders->FileHeader.NumberOfSections,sizeof(IMAGE_SECTION_HEADER));
|
||||||
process_stabs(szSymName,
|
process_stabs(szSymName,
|
||||||
fileout,
|
fileout,
|
||||||
IMAGE_FIRST_SECTION(pNTHeaders),
|
IMAGE_FIRST_SECTION(pNTHeaders),
|
||||||
pNTHeaders->FileHeader.NumberOfSections*sizeof(PIMAGE_SECTION_HEADER),
|
pNTHeaders->FileHeader.NumberOfSections*sizeof(IMAGE_SECTION_HEADER),
|
||||||
p,
|
p,
|
||||||
pStab,
|
pStab,
|
||||||
nStabLen,
|
nStabLen,
|
||||||
pStr,
|
pStr,
|
||||||
nStabStrLen,
|
nStabStrLen,
|
||||||
(char*)pSymTab,
|
(char*)pSymTab,
|
||||||
nSym,
|
nSym*sizeof(IMAGE_SYMBOL),
|
||||||
pStrTab,
|
pStrTab,
|
||||||
nSymStrLen);
|
nSymStrLen);
|
||||||
|
|
||||||
close(fileout);
|
CloseHandle(fileout);
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
|
|
|
@ -1,15 +1,37 @@
|
||||||
CC = gcc
|
#CC = gcc
|
||||||
CFLAGS := -Wall -fomit-frame-pointer -O2 -DLINUX
|
#CFLAGS := -g -Wall -fomit-frame-pointer -O2
|
||||||
LDFLAGS := -dynamic
|
#LDFLAGS := -dynamic
|
||||||
#-lncurses
|
#-lncurses
|
||||||
|
|
||||||
OBJS = main.o terminal.o
|
#OBJS = main.o terminal.o
|
||||||
|
#
|
||||||
|
|
||||||
|
#loader: $(OBJS)
|
||||||
|
# $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^
|
||||||
|
|
||||||
|
#clean:
|
||||||
|
# @echo deleting all intermediate files
|
||||||
|
# @rm $(OBJS) loader -f
|
||||||
|
# make
|
||||||
|
|
||||||
|
|
||||||
loader: $(OBJS)
|
PATH_TO_TOP = ../../..
|
||||||
$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^
|
|
||||||
|
TARGET_NORC = yes
|
||||||
|
|
||||||
|
TARGET_TYPE = program
|
||||||
|
|
||||||
|
TARGET_APPTYPE = console
|
||||||
|
|
||||||
|
TARGET_NAME = loader
|
||||||
|
|
||||||
|
TARGET_CFLAGS = -g -fomit-frame-pointer
|
||||||
|
|
||||||
|
TARGET_SDKLIBS =
|
||||||
|
|
||||||
|
TARGET_OBJECTS = main.o terminal.o
|
||||||
|
|
||||||
|
include $(PATH_TO_TOP)/rules.mak
|
||||||
|
|
||||||
|
include $(TOOLS_PATH)/helper.mk
|
||||||
|
|
||||||
clean:
|
|
||||||
@echo deleting all intermediate files
|
|
||||||
@rm $(OBJS) loader -f
|
|
||||||
make
|
|
||||||
|
|
|
@ -2,9 +2,11 @@
|
||||||
#include <string.h>
|
#include <string.h>
|
||||||
#include <malloc.h>
|
#include <malloc.h>
|
||||||
#include <io.h>
|
#include <io.h>
|
||||||
|
|
||||||
//#include <ddk/winnt.h>
|
//#include <ddk/winnt.h>
|
||||||
#include <windows.h>
|
#include <windows.h>
|
||||||
#include <winnt.h>
|
|
||||||
|
//#include <winnt.h>
|
||||||
#include <sys/types.h>
|
#include <sys/types.h>
|
||||||
//#include <sys/wait.h>
|
//#include <sys/wait.h>
|
||||||
//#include <sys/ioctl.h>
|
//#include <sys/ioctl.h>
|
||||||
|
@ -15,7 +17,7 @@
|
||||||
//#include <unistd.h>
|
//#include <unistd.h>
|
||||||
//#include <linux/unistd.h>
|
//#include <linux/unistd.h>
|
||||||
|
|
||||||
//#include "../../../include/pe.h"
|
#include "../../../include/pe.h"
|
||||||
#include "stab_gnu.h"
|
#include "stab_gnu.h"
|
||||||
//#include "retypes.h"
|
//#include "retypes.h"
|
||||||
//#include "terminal.h"
|
//#include "terminal.h"
|
||||||
|
|
|
@ -46,6 +46,10 @@ ULONG ulDoInitialBreak=1;
|
||||||
char szBootParams[1024]="";
|
char szBootParams[1024]="";
|
||||||
char tempInit[256];
|
char tempInit[256];
|
||||||
|
|
||||||
|
PDIRECTORY_OBJECT *pNameSpaceRoot = NULL;
|
||||||
|
PDEBUG_MODULE pdebug_module_tail = NULL;
|
||||||
|
PDEBUG_MODULE pdebug_module_head = NULL;
|
||||||
|
|
||||||
//*************************************************************************
|
//*************************************************************************
|
||||||
// InitPICE()
|
// InitPICE()
|
||||||
//
|
//
|
||||||
|
@ -143,11 +147,12 @@ BOOLEAN InitPICE(void)
|
||||||
}
|
}
|
||||||
|
|
||||||
DPRINT((0,"InitPICE(): trace step 9\n"));
|
DPRINT((0,"InitPICE(): trace step 9\n"));
|
||||||
|
|
||||||
// the loaded module list
|
// the loaded module list
|
||||||
ScanExports("module_list",(PULONG)&pmodule_list);
|
ScanExports("_NameSpaceRoot", (PULONG)pNameSpaceRoot);
|
||||||
if(!pmodule_list)
|
if(!pNameSpaceRoot)
|
||||||
{
|
{
|
||||||
Print(OUTPUT_WINDOW,"pICE: ABORT (couldn't retreive kernel module list)\n");
|
Print(OUTPUT_WINDOW,"pICE: ABORT (couldn't retreive name space root)\n");
|
||||||
Print(OUTPUT_WINDOW,"pICE: press any key to continue...\n");
|
Print(OUTPUT_WINDOW,"pICE: press any key to continue...\n");
|
||||||
while(!GetKeyPolled());
|
while(!GetKeyPolled());
|
||||||
UnloadExports();
|
UnloadExports();
|
||||||
|
@ -158,11 +163,12 @@ BOOLEAN InitPICE(void)
|
||||||
}
|
}
|
||||||
|
|
||||||
DPRINT((0,"InitPICE(): trace step 10\n"));
|
DPRINT((0,"InitPICE(): trace step 10\n"));
|
||||||
// setup a fake module struct for use by symbol routines
|
// setup a linked list for use in module parsing routines.
|
||||||
if(!InitFakeKernelModule())
|
if(!InitModuleList(&pdebug_module_head, 100))
|
||||||
{
|
{
|
||||||
Print(OUTPUT_WINDOW,"pICE: ABORT (couldn't initialize kernel module)\n");
|
Print(OUTPUT_WINDOW,"pICE: ABORT (couldn't initialize kernel module list)\n");
|
||||||
Print(OUTPUT_WINDOW,"pICE: press any key to continue...\n");
|
Print(OUTPUT_WINDOW,"pICE: press any key to continue...\n");
|
||||||
|
FreeModuleList( pdebug_module_head );
|
||||||
while(!GetKeyPolled());
|
while(!GetKeyPolled());
|
||||||
UnloadExports();
|
UnloadExports();
|
||||||
UnloadSymbols();
|
UnloadSymbols();
|
||||||
|
@ -170,6 +176,7 @@ BOOLEAN InitPICE(void)
|
||||||
LEAVE_FUNC();
|
LEAVE_FUNC();
|
||||||
return FALSE;
|
return FALSE;
|
||||||
}
|
}
|
||||||
|
pdebug_module_tail = pdebug_module_head;
|
||||||
|
|
||||||
DPRINT((0,"InitPICE(): trace step 11\n"));
|
DPRINT((0,"InitPICE(): trace step 11\n"));
|
||||||
// do a sanity check on exports
|
// do a sanity check on exports
|
||||||
|
|
|
@ -37,7 +37,7 @@ Copyright notice:
|
||||||
#include "remods.h"
|
#include "remods.h"
|
||||||
#include "precomp.h"
|
#include "precomp.h"
|
||||||
|
|
||||||
#include <asm/system.h>
|
//#include <asm/system.h>
|
||||||
|
|
||||||
#include <ddk/ntddkbd.h>
|
#include <ddk/ntddkbd.h>
|
||||||
#include <ddk/ntdd8042.h>
|
#include <ddk/ntdd8042.h>
|
||||||
|
|
|
@ -43,6 +43,16 @@ Copyright notice:
|
||||||
#include <asm/delay.h>
|
#include <asm/delay.h>
|
||||||
#include <linux/ctype.h>
|
#include <linux/ctype.h>
|
||||||
|
|
||||||
|
#include <ntdll/ldr.h>
|
||||||
|
#include <ntdll/rtl.h>
|
||||||
|
#include <internal/ps.h>
|
||||||
|
#include <internal/ob.h>
|
||||||
|
#include <internal/module.h>
|
||||||
|
|
||||||
|
#define NDEBUG
|
||||||
|
#include <debug.h>
|
||||||
|
|
||||||
|
|
||||||
PVOID pExports=0;
|
PVOID pExports=0;
|
||||||
ULONG ulExportLen=0;
|
ULONG ulExportLen=0;
|
||||||
|
|
||||||
|
@ -83,42 +93,193 @@ ULONG ulNumStructMembers;
|
||||||
|
|
||||||
BOOLEAN Expression(PVRET pvr);
|
BOOLEAN Expression(PVRET pvr);
|
||||||
|
|
||||||
//*************************************************************************
|
extern PDIRECTORY_OBJECT *pNameSpaceRoot;
|
||||||
// InitFakeKernelModule()
|
extern PDEBUG_MODULE pdebug_module_tail;
|
||||||
//
|
extern PDEBUG_MODULE pdebug_module_head;
|
||||||
//*************************************************************************
|
|
||||||
BOOLEAN InitFakeKernelModule(void)
|
|
||||||
|
PVOID HEADER_TO_BODY(POBJECT_HEADER obj)
|
||||||
{
|
{
|
||||||
struct module* pMod;
|
return(((void *)obj)+sizeof(OBJECT_HEADER)-sizeof(COMMON_BODY_HEADER));
|
||||||
|
}
|
||||||
|
|
||||||
|
POBJECT_HEADER BODY_TO_HEADER(PVOID body)
|
||||||
|
{
|
||||||
|
PCOMMON_BODY_HEADER chdr = (PCOMMON_BODY_HEADER)body;
|
||||||
|
return(CONTAINING_RECORD((&(chdr->Type)),OBJECT_HEADER,Type));
|
||||||
|
}
|
||||||
|
|
||||||
|
/*-----------------12/26/2001 7:59PM----------------
|
||||||
|
* FreeModuleList - free list allocated with InitModuleList. Must
|
||||||
|
* be called at passive irql.
|
||||||
|
* --------------------------------------------------*/
|
||||||
|
VOID FreeModuleList( PDEBUG_MODULE pm )
|
||||||
|
{
|
||||||
|
PDEBUG_MODULE pNext = pm;
|
||||||
|
|
||||||
ENTER_FUNC();
|
ENTER_FUNC();
|
||||||
|
|
||||||
if(pmodule_list)
|
while( pNext ){
|
||||||
{
|
pNext = pm->next;
|
||||||
|
RtlFreeUnicodeString( &(pm->name) );
|
||||||
|
ExFreePool( pm );
|
||||||
|
}
|
||||||
|
LEAVE_FUNC();
|
||||||
|
}
|
||||||
|
|
||||||
DPRINT((0,"InitFakeKernelModule(): *pmodule_list = %x\n",(ULONG)*pmodule_list));
|
/*-----------------12/26/2001 7:58PM----------------
|
||||||
if(IsAddressValid((ULONG)*pmodule_list) )
|
* InitModuleList - creates linked list of length len for debugger. Can't be
|
||||||
|
* called at elevated IRQL
|
||||||
|
* --------------------------------------------------*/
|
||||||
|
BOOLEAN InitModuleList( PDEBUG_MODULE *ppmodule, ULONG len )
|
||||||
{
|
{
|
||||||
pMod = *pmodule_list;
|
ULONG i;
|
||||||
DPRINT((0,"InitFakeKernelModule(): start pMod = %x\n",(ULONG)pMod));
|
PDEBUG_MODULE pNext = NULL, pm = *ppmodule;
|
||||||
do
|
|
||||||
|
ENTER_FUNC();
|
||||||
|
|
||||||
|
assert(pm==NULL);
|
||||||
|
|
||||||
|
for(i=1;i<=len;i++){
|
||||||
|
pm = (PDEBUG_MODULE)ExAllocatePool( NonPagedPool, sizeof( DEBUG_MODULE ) );
|
||||||
|
if( !pm ){
|
||||||
|
FreeModuleList(pNext);
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
pm->next = pNext;
|
||||||
|
pm->size = 0;
|
||||||
|
pm->BaseAddress = NULL;
|
||||||
|
RtlCreateUnicodeString(&(pm->name), L" \0");
|
||||||
|
//DbgPrint("len1: %d\n", pm->name.Length);
|
||||||
|
pNext = pm;
|
||||||
|
}
|
||||||
|
*ppmodule = pm;
|
||||||
|
|
||||||
|
LEAVE_FUNC();
|
||||||
|
|
||||||
|
return TRUE;
|
||||||
|
}
|
||||||
|
|
||||||
|
BOOLEAN ListUserModules( PPEB peb )
|
||||||
{
|
{
|
||||||
if(!pMod->size)
|
PLIST_ENTRY ModuleListHead;
|
||||||
|
PLIST_ENTRY Entry;
|
||||||
|
PLDR_MODULE Module;
|
||||||
|
|
||||||
|
ENTER_FUNC();
|
||||||
|
|
||||||
|
ModuleListHead = &peb->Ldr->InLoadOrderModuleList;
|
||||||
|
Entry = ModuleListHead->Flink;
|
||||||
|
while (Entry != ModuleListHead)
|
||||||
{
|
{
|
||||||
DPRINT((0,"InitFakeKernelModule(): pMod = %x\n",(ULONG)pMod));
|
Module = CONTAINING_RECORD(Entry, LDR_MODULE, InLoadOrderModuleList);
|
||||||
fake_kernel_module = * pMod;
|
//DbgPrint("Module: %x, BaseAddress: %x\n", Module, Module->BaseAddress);
|
||||||
PICE_strcpy((LPSTR)(fake_kernel_module.name),"vmlinux");
|
|
||||||
fake_kernel_module.size = kernel_end - KERNEL_START;
|
DPRINT("FullName: %S, BaseName: %S, Length: %ld, EntryPoint: %x, BaseAddress: %x\n", Module->FullDllName.Buffer,
|
||||||
DPRINT((0,"InitFakeKernelModule(): SUCCESS\n"));
|
Module->BaseDllName.Buffer, Module->SizeOfImage, Module->EntryPoint, Module->BaseAddress );
|
||||||
|
|
||||||
|
pdebug_module_tail->size = Module->SizeOfImage;
|
||||||
|
pdebug_module_tail->BaseAddress = Module->BaseAddress;
|
||||||
|
pdebug_module_tail->EntryPoint = Module->EntryPoint;
|
||||||
|
RtlCopyUnicodeString( &(pdebug_module_tail->name), &(Module->BaseDllName));
|
||||||
|
pdebug_module_tail = pdebug_module_tail->next;
|
||||||
|
|
||||||
|
Entry = Entry->Flink;
|
||||||
|
}
|
||||||
|
|
||||||
LEAVE_FUNC();
|
LEAVE_FUNC();
|
||||||
return TRUE;
|
return TRUE;
|
||||||
}
|
}
|
||||||
}while((pMod = pMod->next));
|
|
||||||
|
POBJECT FindDriverObjectDirectory( void )
|
||||||
|
{
|
||||||
|
PLIST_ENTRY current;
|
||||||
|
POBJECT_HEADER current_obj;
|
||||||
|
PDIRECTORY_OBJECT pd;
|
||||||
|
|
||||||
|
ENTER_FUNC();
|
||||||
|
|
||||||
|
if( pNameSpaceRoot && *pNameSpaceRoot ){
|
||||||
|
current = (*pNameSpaceRoot)->head.Flink;
|
||||||
|
while (current!=(&((*pNameSpaceRoot)->head)))
|
||||||
|
{
|
||||||
|
current_obj = CONTAINING_RECORD(current,OBJECT_HEADER,Entry);
|
||||||
|
DPRINT("Scanning %S\n",current_obj->Name.Buffer);
|
||||||
|
if (_wcsicmp(current_obj->Name.Buffer, L"Modules")==0)
|
||||||
|
{
|
||||||
|
DPRINT("Found it %x\n",HEADER_TO_BODY(current_obj));
|
||||||
|
pd=HEADER_TO_BODY(current_obj);
|
||||||
|
return pd;
|
||||||
|
}
|
||||||
|
current = current->Flink;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
LEAVE_FUNC();
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
BOOLEAN ListDriverModules( void )
|
||||||
|
{
|
||||||
|
PLIST_ENTRY current;
|
||||||
|
POBJECT_HEADER current_obj;
|
||||||
|
PDIRECTORY_OBJECT pd;
|
||||||
|
PMODULE pm;
|
||||||
|
|
||||||
|
ENTER_FUNC();
|
||||||
|
|
||||||
|
if( pd = (PDIRECTORY_OBJECT) FindDriverObjectDirectory() ){
|
||||||
|
current = pd->head.Flink;
|
||||||
|
while (current!=(&(pd->head)))
|
||||||
|
{
|
||||||
|
current_obj = CONTAINING_RECORD(current,OBJECT_HEADER,Entry);
|
||||||
|
DPRINT("Modules %S\n",current_obj->Name.Buffer);
|
||||||
|
pm = HEADER_TO_BODY(current_obj);
|
||||||
|
DPRINT("FullName: %S, BaseName: %S, Length: %ld, EntryPoint: %x\n", pm->FullName.Buffer,
|
||||||
|
pm->BaseName.Buffer, pm->Length, pm->EntryPoint );
|
||||||
|
|
||||||
|
pdebug_module_tail->size = pm->Length;
|
||||||
|
pdebug_module_tail->BaseAddress = pm->Base;
|
||||||
|
pdebug_module_tail->EntryPoint = pm->EntryPoint;
|
||||||
|
RtlCopyUnicodeString( &(pdebug_module_tail->name), &(pm->BaseName));
|
||||||
|
pdebug_module_tail = pdebug_module_tail->next;
|
||||||
|
|
||||||
|
/*
|
||||||
|
if (_wcsicmp(current_obj->Name.Buffer, "Modules")==0)
|
||||||
|
{
|
||||||
|
DbgPrint("Found it %x\n",HEADER_TO_BODY(current_obj));
|
||||||
|
pd=HEADER_TO_BODY(current_obj);
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
current = current->Flink;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
LEAVE_FUNC();
|
||||||
|
return TRUE;
|
||||||
|
}
|
||||||
|
|
||||||
|
BOOLEAN BuildModuleList( void )
|
||||||
|
{
|
||||||
|
PPEB peb;
|
||||||
|
ENTER_FUNC();
|
||||||
|
|
||||||
|
pdebug_module_tail = pdebug_module_head;
|
||||||
|
|
||||||
|
peb = IoGetCurrentProcess()->Peb;
|
||||||
|
if( peb ){
|
||||||
|
if( !ListUserModules( peb ) ){
|
||||||
LEAVE_FUNC();
|
LEAVE_FUNC();
|
||||||
return FALSE;
|
return FALSE;
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
if( !ListDriverModules() ){
|
||||||
|
LEAVE_FUNC();
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
LEAVE_FUNC();
|
||||||
|
return TRUE;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
//*************************************************************************
|
//*************************************************************************
|
||||||
// ScanExports()
|
// ScanExports()
|
||||||
|
@ -260,27 +421,27 @@ BOOLEAN ValidityCheckSymbols(PICE_SYMBOLFILE_HEADER* pSymbols)
|
||||||
//*************************************************************************
|
//*************************************************************************
|
||||||
PICE_SYMBOLFILE_HEADER* FindModuleSymbols(ULONG addr)
|
PICE_SYMBOLFILE_HEADER* FindModuleSymbols(ULONG addr)
|
||||||
{
|
{
|
||||||
struct module* pMod;
|
|
||||||
ULONG start,end,i;
|
ULONG start,end,i;
|
||||||
|
PDEBUG_MODULE pd = pdebug_module_head;
|
||||||
|
|
||||||
DPRINT((0,"FindModuleSymbols(%x)\n",addr));
|
DPRINT((0,"FindModuleSymbols(%x)\n",addr));
|
||||||
if(pmodule_list)
|
if(BuildModuleList())
|
||||||
{
|
{
|
||||||
i=0;
|
i=0;
|
||||||
pMod = *pmodule_list;
|
pd = pdebug_module_head;
|
||||||
do
|
do
|
||||||
{
|
{
|
||||||
if(pMod->size)
|
if(pd->size)
|
||||||
{
|
{
|
||||||
start = (ULONG)pMod+sizeof(struct module);
|
start = (ULONG)pd->BaseAddress;
|
||||||
end = start + pMod->size-sizeof(struct module);
|
end = start + pd->size;
|
||||||
DPRINT((0,"FindModuleSymbols(): %s %x-%x\n",pMod->name,start,end));
|
DPRINT((0,"FindModuleSymbols(): %S %x-%x\n",pd->name,start,end));
|
||||||
if(addr>=start && addr<end)
|
if(addr>=start && addr<end)
|
||||||
{
|
{
|
||||||
DPRINT((0,"FindModuleSymbols(): address matches %s %x-%x\n",pMod->name,start,end));
|
DPRINT((0,"FindModuleSymbols(): address matches %S %x-%x\n",pd->name,start,end));
|
||||||
for(i=0;i<ulNumSymbolsLoaded;i++)
|
for(i=0;i<ulNumSymbolsLoaded;i++)
|
||||||
{
|
{
|
||||||
if(PICE_strcmpi((LPSTR)pMod->name,apSymbols[i]->name) == 0)
|
if(PICE_wcsicmp(pd->name.Buffer,apSymbols[i]->name) == 0)
|
||||||
{
|
{
|
||||||
if(ValidityCheckSymbols(apSymbols[i]))
|
if(ValidityCheckSymbols(apSymbols[i]))
|
||||||
return apSymbols[i];
|
return apSymbols[i];
|
||||||
|
@ -290,27 +451,7 @@ PICE_SYMBOLFILE_HEADER* FindModuleSymbols(ULONG addr)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
else
|
}while((pd = pd->next) != pdebug_module_tail);
|
||||||
{
|
|
||||||
start = (ULONG)KERNEL_START + sizeof(struct module);
|
|
||||||
end = start + fake_kernel_module.size-sizeof(struct module);
|
|
||||||
DPRINT((0,"FindModuleSymbols(): %s %x-%x\n",fake_kernel_module.name,start,end));
|
|
||||||
if(addr>=start && addr<end)
|
|
||||||
{
|
|
||||||
DPRINT((0,"FindModuleSymbols(): address matches %s %x-%x\n",fake_kernel_module.name,start,end));
|
|
||||||
for(i=0;i<ulNumSymbolsLoaded;i++)
|
|
||||||
{
|
|
||||||
if(PICE_strcmpi((LPSTR)fake_kernel_module.name,apSymbols[i]->name) == 0)
|
|
||||||
{
|
|
||||||
if(ValidityCheckSymbols(apSymbols[i]))
|
|
||||||
return apSymbols[i];
|
|
||||||
else
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}while((pMod = pMod->next));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return NULL;
|
return NULL;
|
||||||
|
@ -320,41 +461,29 @@ PICE_SYMBOLFILE_HEADER* FindModuleSymbols(ULONG addr)
|
||||||
// FindModuleFromAddress()
|
// FindModuleFromAddress()
|
||||||
//
|
//
|
||||||
//*************************************************************************
|
//*************************************************************************
|
||||||
struct module* FindModuleFromAddress(ULONG addr)
|
PDEBUG_MODULE FindModuleFromAddress(ULONG addr)
|
||||||
{
|
{
|
||||||
struct module* pMod;
|
PDEBUG_MODULE pd;
|
||||||
ULONG start,end;
|
ULONG start,end;
|
||||||
|
|
||||||
DPRINT((0,"FindModuleFromAddress()\n"));
|
DPRINT((0,"FindModuleFromAddress()\n"));
|
||||||
if(pmodule_list)
|
if(BuildModuleList())
|
||||||
{
|
{
|
||||||
pMod = *pmodule_list;
|
pd = pdebug_module_head;
|
||||||
do
|
do
|
||||||
{
|
{
|
||||||
if(pMod->size)
|
if(pd->size)
|
||||||
{
|
{
|
||||||
start = (ULONG)pMod+sizeof(struct module);
|
start = (ULONG)pd->BaseAddress;
|
||||||
end = start + pMod->size-sizeof(struct module);
|
end = start + pMod->size;
|
||||||
DPRINT((0,"FindModuleFromAddress(): %s %x-%x\n",pMod->name,start,end));
|
DPRINT((0,"FindModuleFromAddress(): %S %x-%x\n",pd->name,start,end));
|
||||||
if(addr>=start && addr<end)
|
if(addr>=start && addr<end)
|
||||||
{
|
{
|
||||||
DPRINT((0,"FindModuleFromAddress(): found %s\n",pMod->name));
|
DPRINT((0,"FindModuleFromAddress(): found %S\n",pd->name));
|
||||||
return pMod;
|
return pd;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
// must be the kernel
|
}while((pd = pd->next)!=pdebug_module_tail);
|
||||||
else
|
|
||||||
{
|
|
||||||
start = (ULONG)KERNEL_START + sizeof(struct module);
|
|
||||||
end = start + fake_kernel_module.size-sizeof(struct module);
|
|
||||||
DPRINT((0,"FindModuleFromAddress(): %s %x-%x\n",fake_kernel_module.name,start,end));
|
|
||||||
if(addr>=start && addr<end)
|
|
||||||
{
|
|
||||||
DPRINT((0,"FindModuleFromAddress(): found %s\n",fake_kernel_module.name));
|
|
||||||
return &fake_kernel_module;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}while((pMod = pMod->next));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return NULL;
|
return NULL;
|
||||||
|
@ -364,33 +493,32 @@ struct module* FindModuleFromAddress(ULONG addr)
|
||||||
// FindModuleByName()
|
// FindModuleByName()
|
||||||
//
|
//
|
||||||
//*************************************************************************
|
//*************************************************************************
|
||||||
struct module* FindModuleByName(LPSTR modname)
|
PDEBUG_MODULE FindModuleByName(LPSTR modname)
|
||||||
{
|
{
|
||||||
struct module* pMod;
|
PDEBUG_MODULE pd;
|
||||||
|
WCHAR tempstr[64];
|
||||||
|
|
||||||
DPRINT((0,"FindModuleFromAddress()\n"));
|
DPRINT((0,"FindModuleFromAddress()\n"));
|
||||||
if(pmodule_list)
|
if( !MultiByteToWideChar(CP_ACP, NULL, modname, -1, tempstr, 64 ) )
|
||||||
{
|
{
|
||||||
pMod = *pmodule_list;
|
DPRINT((0,"Can't convert module name.\n"));
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
if(BuildModuleList())
|
||||||
|
{
|
||||||
|
pd = pdebug_module_head;
|
||||||
do
|
do
|
||||||
{
|
{
|
||||||
if(pMod->size)
|
if(pd->size)
|
||||||
{
|
{
|
||||||
if(PICE_strcmpi(modname,(LPSTR)pMod->name) == 0)
|
if(PICE_wcsicmp(tempstr,pMod->name) == 0)
|
||||||
{
|
{
|
||||||
DPRINT((0,"FindModuleByName(): found %s\n",pMod->name));
|
DPRINT((0,"FindModuleByName(): found %S\n",pd->name));
|
||||||
return pMod;
|
return pd;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
else
|
}while((pd = pd->next) != pdebug_module_tail);
|
||||||
{
|
|
||||||
if(PICE_strcmpi(modname,(LPSTR)fake_kernel_module.name) == 0)
|
|
||||||
{
|
|
||||||
DPRINT((0,"FindModuleByName(): found %s\n",fake_kernel_module.name));
|
|
||||||
return &fake_kernel_module;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}while((pMod = pMod->next));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return NULL;
|
return NULL;
|
||||||
|
@ -403,11 +531,18 @@ struct module* FindModuleByName(LPSTR modname)
|
||||||
PICE_SYMBOLFILE_HEADER* FindModuleSymbolsByModuleName(LPSTR modname)
|
PICE_SYMBOLFILE_HEADER* FindModuleSymbolsByModuleName(LPSTR modname)
|
||||||
{
|
{
|
||||||
ULONG i;
|
ULONG i;
|
||||||
|
WCHAR tempstr[64];
|
||||||
|
|
||||||
DPRINT((0,"FindModuleSymbols()\n"));
|
DPRINT((0,"FindModuleSymbols()\n"));
|
||||||
|
if( !MultiByteToWideChar(CP_ACP, NULL, modname, -1, tempstr, 64 ) )
|
||||||
|
{
|
||||||
|
DPRINT((0,"Can't convert module name in FindModuleSymbols.\n"));
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
for(i=0;i<ulNumSymbolsLoaded;i++)
|
for(i=0;i<ulNumSymbolsLoaded;i++)
|
||||||
{
|
{
|
||||||
if(PICE_strcmpi(modname,apSymbols[i]->name) == 0)
|
if(PICE_wcsicmp(tempstr,apSymbols[i]->name) == 0)
|
||||||
return apSymbols[i];
|
return apSymbols[i];
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -425,141 +560,118 @@ BOOLEAN ScanExportsByAddress(LPSTR *pFind,ULONG ulValue)
|
||||||
LPSTR p,pStartOfLine,pSymbolName=NULL;
|
LPSTR p,pStartOfLine,pSymbolName=NULL;
|
||||||
ULONG ulCurrentValue=0,i;
|
ULONG ulCurrentValue=0,i;
|
||||||
BOOLEAN bResult = FALSE;
|
BOOLEAN bResult = FALSE;
|
||||||
struct module *pMod;
|
PDEBUG_MODULE pd;
|
||||||
ULONG ulMinValue = -1;
|
ULONG ulMinValue = -1;
|
||||||
Elf32_Sym* pElfSym;
|
PIMAGE_SYMBOL pSym,pSymEnd; //running pointer to symbols and end of sym talbe
|
||||||
LPSTR pElfStr;
|
PIMAGE_SYMBOL pFoundSym = NULL; //current best symbol match
|
||||||
Elf32_Shdr* pElfShdr;
|
ULONG ulAddr = 0x0; //address of the best match
|
||||||
|
LPSTR pStr;
|
||||||
|
PIMAGE_SECTION_HEADER pShdr;
|
||||||
PICE_SYMBOLFILE_HEADER* pSymbols;
|
PICE_SYMBOLFILE_HEADER* pSymbols;
|
||||||
|
ULONG ulSectionSize;
|
||||||
|
LPSTR pName;
|
||||||
|
|
||||||
ENTER_FUNC();
|
ENTER_FUNC();
|
||||||
|
|
||||||
if(ulValue < TASK_SIZE)
|
|
||||||
{
|
|
||||||
LEAVE_FUNC();
|
|
||||||
return FALSE;
|
|
||||||
}
|
|
||||||
|
|
||||||
pSymbols = FindModuleSymbols(ulValue);
|
pSymbols = FindModuleSymbols(ulValue);
|
||||||
if(pSymbols && pmodule_list)
|
if(pSymbols && pdebug_module_head)
|
||||||
{
|
{
|
||||||
struct module* pModTemp;
|
PDEBUG_MODULE pdTemp;
|
||||||
|
|
||||||
DPRINT((0,"looking up symbols\n"));
|
DPRINT((0,"looking up symbols\n"));
|
||||||
pMod = *pmodule_list;
|
pd = pdebug_module_head;
|
||||||
do
|
do
|
||||||
{
|
{
|
||||||
if(!pMod->size)
|
assert(pd->size);
|
||||||
pModTemp = &fake_kernel_module;
|
|
||||||
else
|
|
||||||
pModTemp = pMod;
|
|
||||||
|
|
||||||
if(ulValue>=((ULONG)pModTemp+sizeof(struct module)) && ulValue<((ULONG)pModTemp+pModTemp->size-sizeof(struct module)))
|
pdTemp = pd;
|
||||||
|
|
||||||
|
if(ulValue>=((ULONG)pdTemp->BaseAddress) && ulValue<((ULONG)pdTemp+pdTemp->size))
|
||||||
{
|
{
|
||||||
if(PICE_strcmpi((LPSTR)pModTemp->name,pSymbols->name) == 0)
|
if(PICE_wcsicmp(pdTemp->name,pSymbols->name) == 0)
|
||||||
{
|
{
|
||||||
DPRINT((0,"ScanExportsByAddress(): found symbols for module %s @ \n",pModTemp->name,(ULONG)pSymbols));
|
DPRINT((0,"ScanExportsByAddress(): found symbols for module %S @ %x \n",pdTemp->name,(ULONG)pSymbols));
|
||||||
|
|
||||||
pElfSym = (Elf32_Sym*)((ULONG)pSymbols+pSymbols->ulOffsetToGlobals);
|
pSym = (PIMAGE_SYMBOL)((ULONG)pSymbols+pSymbols->ulOffsetToGlobals);
|
||||||
pElfStr = (LPSTR)((ULONG)pSymbols+pSymbols->ulOffsetToGlobalsStrings);
|
pSymEnd = (PIMAGE_SYMBOL)((ULONG)pSym+pSymbols->ulSizeOfGlobals);
|
||||||
pElfShdr = (Elf32_Shdr*)((ULONG)pSymbols+pSymbols->ulOffsetToHeaders);
|
pStr = (LPSTR)((ULONG)pSymbols+pSymbols->ulOffsetToGlobalsStrings);
|
||||||
|
pShdr = (PIMAGE_SECTION_HEADER)((ULONG)pSymbols+pSymbols->ulOffsetToHeaders);
|
||||||
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): pElfSym = %x\n",pElfSym));
|
if(!IsRangeValid((ULONG)pSym,sizeof(IMAGE_SYMBOL) ) ) //should we actually check all the symbols here?
|
||||||
DPRINT((0,"ScanExportsByAddress(): pElfStr = %x\n",pElfStr));
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): pElfShdr = %x\n",pElfShdr));
|
|
||||||
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): %s has %u symbols\n",pSymbols->name,pSymbols->ulSizeOfGlobals/sizeof(Elf32_Sym)));
|
|
||||||
|
|
||||||
for(i=0;i<(pSymbols->ulSizeOfGlobals/sizeof(Elf32_Sym));i++)
|
|
||||||
{
|
{
|
||||||
if((ELF32_ST_BIND(pElfSym->st_info)==STB_GLOBAL || ELF32_ST_BIND(pElfSym->st_info)==STB_LOCAL || ELF32_ST_BIND(pElfSym->st_info)==STB_WEAK) &&
|
DPRINT((0,"ScanExportsByAddress(): pSym = %x is not a valid pointer\n",(ULONG)pSym));
|
||||||
(ELF32_ST_TYPE(pElfSym->st_info)==STT_OBJECT || ELF32_ST_TYPE(pElfSym->st_info)==STT_FUNC) &&
|
return FALSE;
|
||||||
(pElfSym->st_shndx<SHN_LORESERVE || pElfSym->st_shndx==SHN_ABS || pElfSym->st_shndx==SHN_COMMON))
|
}
|
||||||
|
|
||||||
|
DPRINT((0,"ScanExportsByAddress(): pSym = %x\n",pSym));
|
||||||
|
DPRINT((0,"ScanExportsByAddress(): pStr = %x\n",pStr));
|
||||||
|
DPRINT((0,"ScanExportsByAddress(): pShdr = %x\n",pShdr));
|
||||||
|
|
||||||
|
DPRINT((0,"ScanExportsByAddress(): %s has %u symbols\n",pSymbols->name,pSymbols->ulSizeOfGlobals/sizeof(IMAGE_SYMBOL)));
|
||||||
|
|
||||||
|
/* go through all the global symbols and find the one with
|
||||||
|
the largest address which is less than ulValue */
|
||||||
|
while(pSym < pSymEnd)
|
||||||
|
{ //it seems only 0x0 and 0x20 are used for type and External or Static storage classes
|
||||||
|
if(((pSym->Type == 0x0) || (pSym->Type == 0x20) ) &&
|
||||||
|
((pSym->StorageClass == IMAGE_SYM_CLASS_EXTERNAL) || (pSym->StorageClass==IMAGE_SYM_CLASS_STATIC)) &&
|
||||||
|
(pSym->SectionNumber > 0 ))
|
||||||
{
|
{
|
||||||
LPSTR pName = &pElfStr[pElfSym->st_name];
|
ULONG ulCurrAddr;
|
||||||
ULONG start,end;
|
PIMAGE_SECTION_HEADER pShdrThis = (PIMAGE_SECTION_HEADER)pShdr + pSym->SectionNumber;
|
||||||
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): pName = %x\n",(ULONG)pName));
|
|
||||||
|
|
||||||
|
DPRINT((0,"ScanExportsByAddress(): pShdr[%x] = %x\n",pSym->SectionNumber,(ULONG)pShdrThis));
|
||||||
|
|
||||||
|
if(!IsRangeValid((ULONG)pShdrThis,sizeof(IMAGE_SECTION_HEADER)) )
|
||||||
|
{
|
||||||
|
DPRINT((0,"ScanExportsByAddress(): pElfShdr[%x] = %x is not a valid pointer\n",pSym->SectionNumber,(ULONG)pShdrThis));
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
//to get address in the memory we base address of the module and
|
||||||
|
//add offset of the section and then add offset of the symbol from
|
||||||
|
//the begining of the section
|
||||||
|
ulCurrAddr = ((ULONG)pdTemp->BaseAddress+pShdrThis->VirtualAddress+pSym->Value);
|
||||||
|
DPRINT((0,"ScanExportsByAddress(): CurrAddr [1] = %x\n",ulCurrAddr));
|
||||||
|
|
||||||
|
if(ulCurrAddr<=ulValue && ulCurrAddr>ulAddr)
|
||||||
|
{
|
||||||
|
ulAddr = ulCurrAddr;
|
||||||
|
pFoundSym = pSym;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
//skip the auxiliary symbols and get the next symbol
|
||||||
|
pSym += pSym->NumberOfAuxSymbols + 1;
|
||||||
|
}
|
||||||
|
*pFind = temp3;
|
||||||
|
{
|
||||||
|
PIMAGE_SECTION_HEADER pShdrThis = (PIMAGE_SECTION_HEADER)pShdr + pFoundSym->SectionNumber;
|
||||||
|
//check that ulValue is below the limit for the section where best match is found
|
||||||
|
assert(ulValue < ((ULONG)pdTemp->BaseAddress+pShdrThis->SizeOfRawData));
|
||||||
|
}
|
||||||
|
if( !(pFoundSym->Name.Short) ){
|
||||||
|
pName = pFoundSym->ShortName; //name is in the header
|
||||||
|
PICE_sprintf(temp3,"%s!%.8s",pdTemp->name,pName); //if name is in the header it may be nonzero terminated
|
||||||
|
}
|
||||||
|
else{
|
||||||
|
assert(pFoundSym->Name.Long<=pSymbols->ulSizeOfGlobalsStrings); //sanity check
|
||||||
|
pName = pStr[pFoundSym->Name.Long];
|
||||||
if(!IsAddressValid((ULONG)pName))
|
if(!IsAddressValid((ULONG)pName))
|
||||||
{
|
{
|
||||||
DPRINT((0,"ScanExportsByAddress(): pName is not a valid pointer\n"));
|
DPRINT((0,"ScanExportsByAddress(): pName = %x is not a valid pointer\n",pName));
|
||||||
return FALSE;
|
return FALSE;
|
||||||
}
|
}
|
||||||
|
PICE_sprintf(temp3,"%s!%s",pdTemp->name,pName);
|
||||||
DPRINT((0,"ScanExportsByAddress(): pName = %s\n",pName));
|
|
||||||
|
|
||||||
if(!IsRangeValid((ULONG)pElfSym,sizeof(Elf32_Sym) ) )
|
|
||||||
{
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): pElfSym = %x is not a valid pointer\n",(ULONG)pElfSym));
|
|
||||||
return FALSE;
|
|
||||||
}
|
}
|
||||||
|
DPRINT((0,"ScanExportsByAddress(): pName = %x\n",(ULONG)pName));
|
||||||
DPRINT((0,"ScanExportsByAddress(): pModTemp = %x\n",(ULONG)pModTemp));
|
|
||||||
if(pModTemp != &fake_kernel_module)
|
|
||||||
{
|
|
||||||
Elf32_Shdr* pElfShdrThis = (Elf32_Shdr*)pElfShdr + pElfSym->st_shndx;
|
|
||||||
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): module is not kernel\n"));
|
|
||||||
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): pElfShdr[%x] = %x\n",pElfSym->st_shndx,(ULONG)pElfShdrThis));
|
|
||||||
|
|
||||||
if(!IsRangeValid((ULONG)pElfShdrThis,sizeof(Elf32_Shdr)) )
|
|
||||||
{
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): pElfShdr[%x] = %x is not a valid pointer\n",pElfSym->st_shndx,pElfShdrThis));
|
|
||||||
return FALSE;
|
|
||||||
}
|
|
||||||
|
|
||||||
start = ((ULONG)pModTemp+pElfShdrThis->sh_offset);
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): start [1] = %x\n",start));
|
|
||||||
|
|
||||||
start = (start+pElfShdrThis->sh_addralign)&~(pElfShdrThis->sh_addralign-1);
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): start [2] = %x\n",start));
|
|
||||||
|
|
||||||
start += pElfSym->st_value;
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): start [3] = %x\n",start));
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): module is kernel\n"));
|
|
||||||
start = pElfSym->st_value;
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): start [1] = %x\n",start));
|
|
||||||
}
|
|
||||||
|
|
||||||
end = start+pElfSym->st_size;
|
|
||||||
DPRINT((0,"ScanExportsByAddress(): end = %x\n",end));
|
|
||||||
|
|
||||||
if(ulValue>=start && ulValue<end)
|
|
||||||
{
|
|
||||||
DPRINT((0,"[%u] %.8X %.8X %.8X %.8X %.8X %.8X %.8X\n",
|
|
||||||
pElfSym->st_shndx,
|
|
||||||
((ULONG)pModTemp+pElfShdr[pElfSym->st_shndx].sh_offset),
|
|
||||||
pElfShdr[pElfSym->st_shndx].sh_addr,
|
|
||||||
pElfShdr[pElfSym->st_shndx].sh_offset,
|
|
||||||
pElfShdr[pElfSym->st_shndx].sh_size,
|
|
||||||
pElfShdr[pElfSym->st_shndx].sh_type,
|
|
||||||
pElfShdr[pElfSym->st_shndx].sh_link,
|
|
||||||
pElfShdr[pElfSym->st_shndx].sh_addralign));
|
|
||||||
DPRINT((0,"in section [%u] %8x value = %x module struct %x (%x)\n",pElfSym->st_shndx,pElfShdr[pElfSym->st_shndx].sh_offset,ulValue,sizeof(struct module),((sizeof(struct module)+0x10)&~0x0F)));
|
|
||||||
DPRINT((0,"[%u] %32s %.8X %.8X %.8X %.8X %.8X %.8X\n",i,pName,pElfSym->st_name,pElfSym->st_value,pElfSym->st_info,pElfSym->st_other,pElfSym->st_size,pElfSym->st_shndx));
|
|
||||||
DPRINT((0,"start %x end %x\n",start,end));
|
|
||||||
*pFind = temp3;
|
|
||||||
if(ulValue-start)
|
|
||||||
PICE_sprintf(temp3,"%s!%s+%x",pModTemp->name,pName,ulValue-start);
|
|
||||||
else
|
|
||||||
PICE_sprintf(temp3,"%s!%s",pModTemp->name,pName);
|
|
||||||
return TRUE;
|
return TRUE;
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
|
||||||
pElfSym++;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}while((pMod = pMod->next));
|
}while((pMod = pMod->next));
|
||||||
}
|
}
|
||||||
|
// if haven't found in the symbols try ntoskrnl exports. (note: check that this is needed since we
|
||||||
if(pExports && ulValue >= TASK_SIZE && ulValue < kernel_end)
|
// already checked ntoskrnl coff symbol table)
|
||||||
|
if(pExports && ulValue >= TASK_SIZE /*&& ulValue < kernel_end*/)
|
||||||
{
|
{
|
||||||
p = pExports;
|
p = pExports;
|
||||||
// while we bound in System.map
|
// while we bound in System.map
|
||||||
|
@ -594,82 +706,13 @@ BOOLEAN ScanExportsByAddress(LPSTR *pFind,ULONG ulValue)
|
||||||
temp[i] = 0;
|
temp[i] = 0;
|
||||||
// decide if we need to append an offset
|
// decide if we need to append an offset
|
||||||
if(ulMinValue)
|
if(ulMinValue)
|
||||||
PICE_sprintf(temp3,"vmlinux!%s+%.8X",temp,ulMinValue);
|
PICE_sprintf(temp3,"ntoskrnl!%s+%.8X",temp,ulMinValue);
|
||||||
else
|
else
|
||||||
PICE_sprintf(temp3,"vmlinux!%s",temp);
|
PICE_sprintf(temp3,"ntoskrnl!%s",temp);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if(pmodule_list && ulMinValue!=0)
|
|
||||||
{
|
|
||||||
pMod = *pmodule_list;
|
|
||||||
do
|
|
||||||
{
|
|
||||||
if(ulValue>=((ULONG)pMod+sizeof(struct module)) && ulValue<((ULONG)pMod+pMod->size-sizeof(struct module)))
|
|
||||||
{
|
|
||||||
if(pMod->syms)
|
|
||||||
{
|
|
||||||
for(i=0;i<pMod->nsyms;i++)
|
|
||||||
{
|
|
||||||
ulCurrentValue = pMod->syms[i].value;
|
|
||||||
if(ulValue>=ulCurrentValue && (LONG)(ulValue-ulCurrentValue)<ulMinValue)
|
|
||||||
{
|
|
||||||
ulMinValue = ulValue-ulCurrentValue;
|
|
||||||
|
|
||||||
if(ulValue-ulCurrentValue)
|
|
||||||
PICE_sprintf(temp3,"%s!%s+%.8X",pMod->name,pMod->syms[i].name,ulValue-ulCurrentValue);
|
|
||||||
else
|
|
||||||
PICE_sprintf(temp3,"%s!%s",pMod->name,pMod->syms[i].name);
|
|
||||||
bResult = TRUE;
|
|
||||||
*pFind = temp3;
|
|
||||||
if(ulMinValue == 0)
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// this could be near entry and cleanup of a module
|
|
||||||
ulCurrentValue = (ULONG)pMod->init;
|
|
||||||
if(ulCurrentValue)
|
|
||||||
{
|
|
||||||
if(ulValue>=ulCurrentValue && (LONG)(ulValue-ulCurrentValue)<ulMinValue)
|
|
||||||
{
|
|
||||||
ulMinValue = ulValue-ulCurrentValue;
|
|
||||||
|
|
||||||
if(ulValue-ulCurrentValue)
|
|
||||||
PICE_sprintf(temp3,"%s!init_module+%.8X",pMod->name,ulValue-ulCurrentValue);
|
|
||||||
else
|
|
||||||
PICE_sprintf(temp3,"%s!init_module",pMod->name);
|
|
||||||
bResult = TRUE;
|
|
||||||
*pFind = temp3;
|
|
||||||
if(ulMinValue == 0)
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
ulCurrentValue = (ULONG)pMod->cleanup;
|
|
||||||
if(ulCurrentValue)
|
|
||||||
{
|
|
||||||
if(ulValue>=ulCurrentValue && (LONG)(ulValue-ulCurrentValue)<ulMinValue)
|
|
||||||
{
|
|
||||||
ulMinValue = ulValue-ulCurrentValue;
|
|
||||||
|
|
||||||
if(ulValue-ulCurrentValue)
|
|
||||||
PICE_sprintf(temp3,"%s!cleanup_module+%.8X",pMod->name,ulValue-ulCurrentValue);
|
|
||||||
else
|
|
||||||
PICE_sprintf(temp3,"%s!cleanup_module",pMod->name);
|
|
||||||
bResult = TRUE;
|
|
||||||
*pFind = temp3;
|
|
||||||
if(ulMinValue == 0)
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}while((pMod = pMod->next));
|
|
||||||
}
|
|
||||||
|
|
||||||
LEAVE_FUNC();
|
LEAVE_FUNC();
|
||||||
|
|
||||||
return bResult;
|
return bResult;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1829,7 +1872,7 @@ BOOLEAN LoadExports(void)
|
||||||
|
|
||||||
if(hf)
|
if(hf)
|
||||||
{
|
{
|
||||||
mm_segment_t oldfs;
|
//mm_segment_t oldfs;
|
||||||
size_t len;
|
size_t len;
|
||||||
|
|
||||||
len = PICE_len(hf);
|
len = PICE_len(hf);
|
||||||
|
|
|
@ -30,6 +30,8 @@ Copyright notice:
|
||||||
--*/
|
--*/
|
||||||
|
|
||||||
// constant defines
|
// constant defines
|
||||||
|
#define FIELD_OFFSET(Type,Field) (LONG)(&(((Type *)(0))->Field))
|
||||||
|
#define CONTAINING_RECORD(Address,Type,Field) (Type *)(((LONG)Address) - FIELD_OFFSET(Type,Field))
|
||||||
|
|
||||||
typedef struct _LOCAL_VARIABLE
|
typedef struct _LOCAL_VARIABLE
|
||||||
{
|
{
|
||||||
|
@ -39,6 +41,22 @@ typedef struct _LOCAL_VARIABLE
|
||||||
BOOLEAN bRegister;
|
BOOLEAN bRegister;
|
||||||
}LOCAL_VARIABLE,*PLOCAL_VARIABLE;
|
}LOCAL_VARIABLE,*PLOCAL_VARIABLE;
|
||||||
|
|
||||||
|
struct _DEBUG_MODULE_SYMBOL_
|
||||||
|
{
|
||||||
|
ULONG value;
|
||||||
|
char* name;
|
||||||
|
};
|
||||||
|
|
||||||
|
typedef struct _DEBUG_MODULE_
|
||||||
|
{
|
||||||
|
struct _DEBUG_MODULE_ *next;
|
||||||
|
ULONG size;
|
||||||
|
PVOID BaseAddress;
|
||||||
|
PVOID EntryPoint;
|
||||||
|
UNICODE_STRING name;
|
||||||
|
struct _DEBUG_MODULE_SYMBOL_ syms;
|
||||||
|
}DEBUG_MODULE, *PDEBUG_MODULE;
|
||||||
|
|
||||||
BOOLEAN InitFakeKernelModule(void);
|
BOOLEAN InitFakeKernelModule(void);
|
||||||
BOOLEAN LoadExports(void);
|
BOOLEAN LoadExports(void);
|
||||||
BOOLEAN SanityCheckExports(void);
|
BOOLEAN SanityCheckExports(void);
|
||||||
|
@ -64,8 +82,9 @@ void Evaluate(PICE_SYMBOLFILE_HEADER* pSymbols,LPSTR p);
|
||||||
LONG ExtractNumber(LPSTR p);
|
LONG ExtractNumber(LPSTR p);
|
||||||
LPSTR ExtractTypeName(LPSTR p);
|
LPSTR ExtractTypeName(LPSTR p);
|
||||||
|
|
||||||
extern ULONG kernel_end;
|
//extern ULONG kernel_end;
|
||||||
extern PICE_SYMBOLFILE_HEADER* apSymbols[32];
|
extern PICE_SYMBOLFILE_HEADER* apSymbols[32];
|
||||||
|
|
||||||
extern struct module fake_kernel_module;
|
//extern struct module fake_kernel_module;
|
||||||
#define KERNEL_START (0xc0100000)
|
#define KERNEL_START (0xc0000000)
|
||||||
|
|
||||||
|
|
|
@ -291,6 +291,25 @@ ULONG result=1;
|
||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
ULONG PICE_wcsicmp(WCHAR* s1, WCHAR* s2)
|
||||||
|
{
|
||||||
|
ULONG result=1;
|
||||||
|
|
||||||
|
while(IsAddressValid((ULONG)s1) && *s1 && // not end of string
|
||||||
|
IsAddressValid((ULONG)s2) && *s2 && // not end of string
|
||||||
|
towlower(*s1)==towlower(*s2) ) // char are the same except case
|
||||||
|
{
|
||||||
|
s1++;
|
||||||
|
s2++;
|
||||||
|
}
|
||||||
|
// strings same length
|
||||||
|
if(*s1==0 && *s2==0)
|
||||||
|
result=0;
|
||||||
|
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
//*************************************************************************
|
//*************************************************************************
|
||||||
// PICE_strrev()
|
// PICE_strrev()
|
||||||
//
|
//
|
||||||
|
|
|
@ -36,7 +36,7 @@ Copyright notice:
|
||||||
#include "precomp.h"
|
#include "precomp.h"
|
||||||
|
|
||||||
//#include <asm/io.h>
|
//#include <asm/io.h>
|
||||||
#include <linux/ctype.h>
|
//#include <linux/ctype.h>
|
||||||
|
|
||||||
|
|
||||||
////////////////////////////////////////////////////
|
////////////////////////////////////////////////////
|
||||||
|
|
|
@ -36,7 +36,7 @@ Copyright notice:
|
||||||
--*/
|
--*/
|
||||||
|
|
||||||
//#include <ddk/ntddk.h>
|
//#include <ddk/ntddk.h>
|
||||||
#include <winnt.h>
|
//#include <winnt.h>
|
||||||
|
|
||||||
|
|
||||||
//temporary
|
//temporary
|
||||||
|
@ -80,7 +80,7 @@ typedef struct _DEBUGGER_STATUS_BLOCK
|
||||||
typedef struct _PICE_SYMBOLFILE_HEADER
|
typedef struct _PICE_SYMBOLFILE_HEADER
|
||||||
{
|
{
|
||||||
ULONG magic;
|
ULONG magic;
|
||||||
char name[32];
|
WCHAR name[64];
|
||||||
ULONG ulOffsetToHeaders,ulSizeOfHeader;
|
ULONG ulOffsetToHeaders,ulSizeOfHeader;
|
||||||
ULONG ulOffsetToGlobals,ulSizeOfGlobals;
|
ULONG ulOffsetToGlobals,ulSizeOfGlobals;
|
||||||
ULONG ulOffsetToGlobalsStrings,ulSizeOfGlobalsStrings;
|
ULONG ulOffsetToGlobalsStrings,ulSizeOfGlobalsStrings;
|
||||||
|
|
Loading…
Reference in a new issue