mirror of
https://github.com/reactos/reactos.git
synced 2024-12-28 01:55:19 +00:00
Porting pice. Added coff symbol parsing to pice, and some other small things.
svn path=/trunk/; revision=2486
This commit is contained in:
parent
fae2e4844a
commit
fa8eafcb38
10 changed files with 591 additions and 463 deletions
|
@ -32,6 +32,7 @@ Copyright notice:
|
|||
///////////////////////////////////////////////////////////////////////////////////
|
||||
// includes
|
||||
#include "stdinc.h"
|
||||
#include <wchar.h>
|
||||
|
||||
///////////////////////////////////////////////////////////////////////////////////
|
||||
// constant defines
|
||||
|
@ -53,7 +54,7 @@ ULONG ulGlobalVerbose = 0;
|
|||
///////////////////////////////////////////////////////////////////////////////////
|
||||
void process_stabs(
|
||||
char* pExeName, // name of exe
|
||||
int fileout, // symbol file handle
|
||||
HANDLE fileout, // symbol file handle
|
||||
PIMAGE_SECTION_HEADER section, //Elf32_Shdr* pSHdr,
|
||||
int sectionHeadersSize, //int nSHdrSize,
|
||||
void* p, // ptr to memory where whole exe was read
|
||||
|
@ -74,6 +75,8 @@ void process_stabs(
|
|||
LPSTR pSlash,pDot;
|
||||
char temp[2048];
|
||||
char* pCopyExeName = temp;
|
||||
WCHAR tempstr[64];
|
||||
DWORD wrote;
|
||||
|
||||
//printf("LOADER: enter process_stabs()\n");
|
||||
|
||||
|
@ -91,7 +94,10 @@ void process_stabs(
|
|||
{
|
||||
pCopyExeName = pSlash+1;
|
||||
}
|
||||
strcpy(SymbolFileHeader.name,pCopyExeName);
|
||||
strLen = MultiByteToWideChar(CP_ACP, NULL, pCopyExeName, -1, tempstr, 64 );
|
||||
if( !strLen )
|
||||
printf("Cannot convert string to multibyte: %s\n", pCopyExeName );
|
||||
wcscpy(SymbolFileHeader.name,tempstr);
|
||||
|
||||
for(i=0;i<(nStabLen/sizeof(STAB_ENTRY));i++)
|
||||
{
|
||||
|
@ -219,22 +225,25 @@ void process_stabs(
|
|||
SymbolFileHeader.ulOffsetToSrcFiles = sizeof(PICE_SYMBOLFILE_HEADER)+sectionHeadersSize+nGlobalLen+nGlobalStrLen+nStabLen+nStrLen;
|
||||
SymbolFileHeader.ulNumberOfSrcFiles = ulCurrentSrcFile;
|
||||
|
||||
write(fileout,&SymbolFileHeader,sizeof(SymbolFileHeader));
|
||||
write(fileout,section,sectionHeadersSize);
|
||||
write(fileout,pGlobals,nGlobalLen);
|
||||
write(fileout,pGlobalsStr,nGlobalStrLen);
|
||||
write(fileout,pStab,nStabLen);
|
||||
write(fileout,pStr,nStrLen);
|
||||
printf("sectionHeaderSize: %ld, nGlobalLen: %ld, nGlobalStrLen: %ld, nStabLen: %ld,
|
||||
nStrLen: %ld, ulCurrentSrcFile: %ld, ulOffsetToStabs: %ld \n", sectionHeadersSize, nGlobalLen, nGlobalStrLen,
|
||||
nStabLen, nStrLen, ulCurrentSrcFile, SymbolFileHeader.ulOffsetToStabs);
|
||||
WriteFile(fileout,&SymbolFileHeader,sizeof(PICE_SYMBOLFILE_HEADER),&wrote, NULL);
|
||||
WriteFile(fileout,section,sectionHeadersSize,&wrote, NULL);
|
||||
WriteFile(fileout,pGlobals,nGlobalLen,&wrote, NULL);
|
||||
WriteFile(fileout,pGlobalsStr,nGlobalStrLen,&wrote, NULL);
|
||||
WriteFile(fileout,pStab,nStabLen,&wrote, NULL);
|
||||
WriteFile(fileout,pStr,nStrLen,&wrote, NULL);
|
||||
|
||||
for(i=0;i<ulCurrentSrcFile;i++)
|
||||
{
|
||||
int file;
|
||||
HANDLE file;
|
||||
int len;
|
||||
PVOID pFile;
|
||||
PICE_SYMBOLFILE_SOURCE pss;
|
||||
|
||||
file = _open(SrcFileNames[i],O_RDONLY);
|
||||
if( file <= 0 ){
|
||||
file = CreateFile(SrcFileNames[i],O_RDONLY, 0, NULL, OPEN_EXISTING, 0, 0);
|
||||
if( file == INVALID_HANDLE_VALUE ){
|
||||
//let's try win format drive:/file
|
||||
char srctmp[2048];
|
||||
strcpy(srctmp, SrcFileNames[i] );
|
||||
|
@ -242,19 +251,19 @@ void process_stabs(
|
|||
*(srctmp) = *(srctmp+2);
|
||||
*(srctmp+1) = ':';
|
||||
*(srctmp+2) = '/';
|
||||
file = _open(srctmp,O_RDONLY);
|
||||
if( file <= 0 )
|
||||
file = CreateFile(srctmp,O_RDONLY, 0, NULL, OPEN_EXISTING, 0, 0);
|
||||
if( file == INVALID_HANDLE_VALUE )
|
||||
printf("Can't open file: %s\n", srctmp );
|
||||
}
|
||||
}
|
||||
if(file>0)
|
||||
if(file != INVALID_HANDLE_VALUE)
|
||||
{
|
||||
//printf("LOADER: [%u] opened %s as FD %x\n",i,SrcFileNames[i],file);
|
||||
|
||||
len = _lseek(file,0,SEEK_END);
|
||||
len = SetFilePointer(file,0,NULL,FILE_END);
|
||||
//printf("LOADER: length = %x\n",(int)len);
|
||||
|
||||
_lseek(file,0,SEEK_SET);
|
||||
SetFilePointer(file,0,NULL,FILE_BEGIN);
|
||||
|
||||
strcpy(pss.filename,SrcFileNames[i]);
|
||||
pss.ulOffsetToNext = len+sizeof(PICE_SYMBOLFILE_SOURCE);
|
||||
|
@ -264,15 +273,15 @@ void process_stabs(
|
|||
if(pFile)
|
||||
{
|
||||
//printf("LOADER: reading file...\n");
|
||||
_read(file,pFile,len);
|
||||
ReadFile(file,pFile,len,&wrote,NULL);
|
||||
|
||||
_write(fileout,&pss,sizeof(PICE_SYMBOLFILE_SOURCE));
|
||||
WriteFile(fileout,&pss,sizeof(PICE_SYMBOLFILE_SOURCE),&wrote, NULL);
|
||||
//printf("LOADER: writing file...\n");
|
||||
_write(fileout,pFile,len);
|
||||
WriteFile(fileout,pFile,len,&wrote, NULL);
|
||||
free(pFile);
|
||||
}
|
||||
|
||||
_close(file);
|
||||
CloseHandle(file);
|
||||
}
|
||||
|
||||
}
|
||||
|
@ -329,7 +338,7 @@ int process_pe(char* filename,int file,void* p,int len)
|
|||
char* pSymTab;
|
||||
|
||||
char szSymName[2048];
|
||||
int fileout;
|
||||
HANDLE fileout;
|
||||
int nSymStrLen,nStabStrLen;
|
||||
int iRetVal = 0;
|
||||
|
||||
|
@ -346,9 +355,8 @@ int process_pe(char* filename,int file,void* p,int len)
|
|||
nSym = pNTHeaders->FileHeader.NumberOfSymbols;
|
||||
//string table follows immediately after symbol table. first 4 bytes give the length of the table
|
||||
//references to string table include the first 4 bytes.
|
||||
pStrTab = (PIMAGE_SYMBOL)pSymTab + nSym;
|
||||
pStrTab = (char*)((PIMAGE_SYMBOL)pSymTab + nSym);
|
||||
nSymStrLen = *((DWORD*)pStrTab);
|
||||
|
||||
find_stab_sections(p,IMAGE_FIRST_SECTION(pNTHeaders),pNTHeaders->FileHeader.NumberOfSections,
|
||||
&pStab,&nStabLen,&pStr,&nStabStrLen);
|
||||
|
||||
|
@ -370,24 +378,32 @@ int process_pe(char* filename,int file,void* p,int len)
|
|||
//printf("LOADER: symbol file name = %s\n",szSymName);
|
||||
printf("LOADER: creating symbol file %s for %s\n",szSymName,filename);
|
||||
|
||||
fileout = _creat(szSymName, _S_IREAD | _S_IWRITE ); // make r/w
|
||||
if(fileout != -1)
|
||||
fileout = CreateFile(szSymName,
|
||||
GENERIC_READ | GENERIC_WRITE,
|
||||
0,
|
||||
NULL,
|
||||
CREATE_ALWAYS,
|
||||
0,
|
||||
0);
|
||||
|
||||
if(fileout != INVALID_HANDLE_VALUE)
|
||||
{
|
||||
printf("NumberOfSections: %d, size: %d\n", pNTHeaders->FileHeader.NumberOfSections,sizeof(IMAGE_SECTION_HEADER));
|
||||
process_stabs(szSymName,
|
||||
fileout,
|
||||
IMAGE_FIRST_SECTION(pNTHeaders),
|
||||
pNTHeaders->FileHeader.NumberOfSections*sizeof(PIMAGE_SECTION_HEADER),
|
||||
pNTHeaders->FileHeader.NumberOfSections*sizeof(IMAGE_SECTION_HEADER),
|
||||
p,
|
||||
pStab,
|
||||
nStabLen,
|
||||
pStr,
|
||||
nStabStrLen,
|
||||
(char*)pSymTab,
|
||||
nSym,
|
||||
nSym*sizeof(IMAGE_SYMBOL),
|
||||
pStrTab,
|
||||
nSymStrLen);
|
||||
|
||||
close(fileout);
|
||||
CloseHandle(fileout);
|
||||
}
|
||||
else
|
||||
{
|
||||
|
|
|
@ -1,15 +1,37 @@
|
|||
CC = gcc
|
||||
CFLAGS := -Wall -fomit-frame-pointer -O2 -DLINUX
|
||||
LDFLAGS := -dynamic
|
||||
#CC = gcc
|
||||
#CFLAGS := -g -Wall -fomit-frame-pointer -O2
|
||||
#LDFLAGS := -dynamic
|
||||
#-lncurses
|
||||
|
||||
OBJS = main.o terminal.o
|
||||
#OBJS = main.o terminal.o
|
||||
#
|
||||
|
||||
#loader: $(OBJS)
|
||||
# $(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^
|
||||
|
||||
#clean:
|
||||
# @echo deleting all intermediate files
|
||||
# @rm $(OBJS) loader -f
|
||||
# make
|
||||
|
||||
|
||||
loader: $(OBJS)
|
||||
$(CC) $(LDFLAGS) $(CFLAGS) -o $@ $^
|
||||
PATH_TO_TOP = ../../..
|
||||
|
||||
TARGET_NORC = yes
|
||||
|
||||
TARGET_TYPE = program
|
||||
|
||||
TARGET_APPTYPE = console
|
||||
|
||||
TARGET_NAME = loader
|
||||
|
||||
TARGET_CFLAGS = -g -fomit-frame-pointer
|
||||
|
||||
TARGET_SDKLIBS =
|
||||
|
||||
TARGET_OBJECTS = main.o terminal.o
|
||||
|
||||
include $(PATH_TO_TOP)/rules.mak
|
||||
|
||||
include $(TOOLS_PATH)/helper.mk
|
||||
|
||||
clean:
|
||||
@echo deleting all intermediate files
|
||||
@rm $(OBJS) loader -f
|
||||
make
|
||||
|
|
|
@ -2,9 +2,11 @@
|
|||
#include <string.h>
|
||||
#include <malloc.h>
|
||||
#include <io.h>
|
||||
|
||||
//#include <ddk/winnt.h>
|
||||
#include <windows.h>
|
||||
#include <winnt.h>
|
||||
|
||||
//#include <winnt.h>
|
||||
#include <sys/types.h>
|
||||
//#include <sys/wait.h>
|
||||
//#include <sys/ioctl.h>
|
||||
|
@ -15,7 +17,7 @@
|
|||
//#include <unistd.h>
|
||||
//#include <linux/unistd.h>
|
||||
|
||||
//#include "../../../include/pe.h"
|
||||
#include "../../../include/pe.h"
|
||||
#include "stab_gnu.h"
|
||||
//#include "retypes.h"
|
||||
//#include "terminal.h"
|
||||
|
|
|
@ -46,6 +46,10 @@ ULONG ulDoInitialBreak=1;
|
|||
char szBootParams[1024]="";
|
||||
char tempInit[256];
|
||||
|
||||
PDIRECTORY_OBJECT *pNameSpaceRoot = NULL;
|
||||
PDEBUG_MODULE pdebug_module_tail = NULL;
|
||||
PDEBUG_MODULE pdebug_module_head = NULL;
|
||||
|
||||
//*************************************************************************
|
||||
// InitPICE()
|
||||
//
|
||||
|
@ -143,11 +147,12 @@ BOOLEAN InitPICE(void)
|
|||
}
|
||||
|
||||
DPRINT((0,"InitPICE(): trace step 9\n"));
|
||||
|
||||
// the loaded module list
|
||||
ScanExports("module_list",(PULONG)&pmodule_list);
|
||||
if(!pmodule_list)
|
||||
ScanExports("_NameSpaceRoot", (PULONG)pNameSpaceRoot);
|
||||
if(!pNameSpaceRoot)
|
||||
{
|
||||
Print(OUTPUT_WINDOW,"pICE: ABORT (couldn't retreive kernel module list)\n");
|
||||
Print(OUTPUT_WINDOW,"pICE: ABORT (couldn't retreive name space root)\n");
|
||||
Print(OUTPUT_WINDOW,"pICE: press any key to continue...\n");
|
||||
while(!GetKeyPolled());
|
||||
UnloadExports();
|
||||
|
@ -158,11 +163,12 @@ BOOLEAN InitPICE(void)
|
|||
}
|
||||
|
||||
DPRINT((0,"InitPICE(): trace step 10\n"));
|
||||
// setup a fake module struct for use by symbol routines
|
||||
if(!InitFakeKernelModule())
|
||||
// setup a linked list for use in module parsing routines.
|
||||
if(!InitModuleList(&pdebug_module_head, 100))
|
||||
{
|
||||
Print(OUTPUT_WINDOW,"pICE: ABORT (couldn't initialize kernel module)\n");
|
||||
Print(OUTPUT_WINDOW,"pICE: ABORT (couldn't initialize kernel module list)\n");
|
||||
Print(OUTPUT_WINDOW,"pICE: press any key to continue...\n");
|
||||
FreeModuleList( pdebug_module_head );
|
||||
while(!GetKeyPolled());
|
||||
UnloadExports();
|
||||
UnloadSymbols();
|
||||
|
@ -170,6 +176,7 @@ BOOLEAN InitPICE(void)
|
|||
LEAVE_FUNC();
|
||||
return FALSE;
|
||||
}
|
||||
pdebug_module_tail = pdebug_module_head;
|
||||
|
||||
DPRINT((0,"InitPICE(): trace step 11\n"));
|
||||
// do a sanity check on exports
|
||||
|
|
|
@ -37,7 +37,7 @@ Copyright notice:
|
|||
#include "remods.h"
|
||||
#include "precomp.h"
|
||||
|
||||
#include <asm/system.h>
|
||||
//#include <asm/system.h>
|
||||
|
||||
#include <ddk/ntddkbd.h>
|
||||
#include <ddk/ntdd8042.h>
|
||||
|
|
|
@ -43,6 +43,16 @@ Copyright notice:
|
|||
#include <asm/delay.h>
|
||||
#include <linux/ctype.h>
|
||||
|
||||
#include <ntdll/ldr.h>
|
||||
#include <ntdll/rtl.h>
|
||||
#include <internal/ps.h>
|
||||
#include <internal/ob.h>
|
||||
#include <internal/module.h>
|
||||
|
||||
#define NDEBUG
|
||||
#include <debug.h>
|
||||
|
||||
|
||||
PVOID pExports=0;
|
||||
ULONG ulExportLen=0;
|
||||
|
||||
|
@ -83,42 +93,193 @@ ULONG ulNumStructMembers;
|
|||
|
||||
BOOLEAN Expression(PVRET pvr);
|
||||
|
||||
//*************************************************************************
|
||||
// InitFakeKernelModule()
|
||||
//
|
||||
//*************************************************************************
|
||||
BOOLEAN InitFakeKernelModule(void)
|
||||
extern PDIRECTORY_OBJECT *pNameSpaceRoot;
|
||||
extern PDEBUG_MODULE pdebug_module_tail;
|
||||
extern PDEBUG_MODULE pdebug_module_head;
|
||||
|
||||
|
||||
PVOID HEADER_TO_BODY(POBJECT_HEADER obj)
|
||||
{
|
||||
struct module* pMod;
|
||||
return(((void *)obj)+sizeof(OBJECT_HEADER)-sizeof(COMMON_BODY_HEADER));
|
||||
}
|
||||
|
||||
POBJECT_HEADER BODY_TO_HEADER(PVOID body)
|
||||
{
|
||||
PCOMMON_BODY_HEADER chdr = (PCOMMON_BODY_HEADER)body;
|
||||
return(CONTAINING_RECORD((&(chdr->Type)),OBJECT_HEADER,Type));
|
||||
}
|
||||
|
||||
/*-----------------12/26/2001 7:59PM----------------
|
||||
* FreeModuleList - free list allocated with InitModuleList. Must
|
||||
* be called at passive irql.
|
||||
* --------------------------------------------------*/
|
||||
VOID FreeModuleList( PDEBUG_MODULE pm )
|
||||
{
|
||||
PDEBUG_MODULE pNext = pm;
|
||||
|
||||
ENTER_FUNC();
|
||||
|
||||
if(pmodule_list)
|
||||
{
|
||||
while( pNext ){
|
||||
pNext = pm->next;
|
||||
RtlFreeUnicodeString( &(pm->name) );
|
||||
ExFreePool( pm );
|
||||
}
|
||||
LEAVE_FUNC();
|
||||
}
|
||||
|
||||
DPRINT((0,"InitFakeKernelModule(): *pmodule_list = %x\n",(ULONG)*pmodule_list));
|
||||
if(IsAddressValid((ULONG)*pmodule_list) )
|
||||
/*-----------------12/26/2001 7:58PM----------------
|
||||
* InitModuleList - creates linked list of length len for debugger. Can't be
|
||||
* called at elevated IRQL
|
||||
* --------------------------------------------------*/
|
||||
BOOLEAN InitModuleList( PDEBUG_MODULE *ppmodule, ULONG len )
|
||||
{
|
||||
pMod = *pmodule_list;
|
||||
DPRINT((0,"InitFakeKernelModule(): start pMod = %x\n",(ULONG)pMod));
|
||||
do
|
||||
ULONG i;
|
||||
PDEBUG_MODULE pNext = NULL, pm = *ppmodule;
|
||||
|
||||
ENTER_FUNC();
|
||||
|
||||
assert(pm==NULL);
|
||||
|
||||
for(i=1;i<=len;i++){
|
||||
pm = (PDEBUG_MODULE)ExAllocatePool( NonPagedPool, sizeof( DEBUG_MODULE ) );
|
||||
if( !pm ){
|
||||
FreeModuleList(pNext);
|
||||
return FALSE;
|
||||
}
|
||||
pm->next = pNext;
|
||||
pm->size = 0;
|
||||
pm->BaseAddress = NULL;
|
||||
RtlCreateUnicodeString(&(pm->name), L" \0");
|
||||
//DbgPrint("len1: %d\n", pm->name.Length);
|
||||
pNext = pm;
|
||||
}
|
||||
*ppmodule = pm;
|
||||
|
||||
LEAVE_FUNC();
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
BOOLEAN ListUserModules( PPEB peb )
|
||||
{
|
||||
if(!pMod->size)
|
||||
PLIST_ENTRY ModuleListHead;
|
||||
PLIST_ENTRY Entry;
|
||||
PLDR_MODULE Module;
|
||||
|
||||
ENTER_FUNC();
|
||||
|
||||
ModuleListHead = &peb->Ldr->InLoadOrderModuleList;
|
||||
Entry = ModuleListHead->Flink;
|
||||
while (Entry != ModuleListHead)
|
||||
{
|
||||
DPRINT((0,"InitFakeKernelModule(): pMod = %x\n",(ULONG)pMod));
|
||||
fake_kernel_module = * pMod;
|
||||
PICE_strcpy((LPSTR)(fake_kernel_module.name),"vmlinux");
|
||||
fake_kernel_module.size = kernel_end - KERNEL_START;
|
||||
DPRINT((0,"InitFakeKernelModule(): SUCCESS\n"));
|
||||
Module = CONTAINING_RECORD(Entry, LDR_MODULE, InLoadOrderModuleList);
|
||||
//DbgPrint("Module: %x, BaseAddress: %x\n", Module, Module->BaseAddress);
|
||||
|
||||
DPRINT("FullName: %S, BaseName: %S, Length: %ld, EntryPoint: %x, BaseAddress: %x\n", Module->FullDllName.Buffer,
|
||||
Module->BaseDllName.Buffer, Module->SizeOfImage, Module->EntryPoint, Module->BaseAddress );
|
||||
|
||||
pdebug_module_tail->size = Module->SizeOfImage;
|
||||
pdebug_module_tail->BaseAddress = Module->BaseAddress;
|
||||
pdebug_module_tail->EntryPoint = Module->EntryPoint;
|
||||
RtlCopyUnicodeString( &(pdebug_module_tail->name), &(Module->BaseDllName));
|
||||
pdebug_module_tail = pdebug_module_tail->next;
|
||||
|
||||
Entry = Entry->Flink;
|
||||
}
|
||||
|
||||
LEAVE_FUNC();
|
||||
return TRUE;
|
||||
}
|
||||
}while((pMod = pMod->next));
|
||||
|
||||
POBJECT FindDriverObjectDirectory( void )
|
||||
{
|
||||
PLIST_ENTRY current;
|
||||
POBJECT_HEADER current_obj;
|
||||
PDIRECTORY_OBJECT pd;
|
||||
|
||||
ENTER_FUNC();
|
||||
|
||||
if( pNameSpaceRoot && *pNameSpaceRoot ){
|
||||
current = (*pNameSpaceRoot)->head.Flink;
|
||||
while (current!=(&((*pNameSpaceRoot)->head)))
|
||||
{
|
||||
current_obj = CONTAINING_RECORD(current,OBJECT_HEADER,Entry);
|
||||
DPRINT("Scanning %S\n",current_obj->Name.Buffer);
|
||||
if (_wcsicmp(current_obj->Name.Buffer, L"Modules")==0)
|
||||
{
|
||||
DPRINT("Found it %x\n",HEADER_TO_BODY(current_obj));
|
||||
pd=HEADER_TO_BODY(current_obj);
|
||||
return pd;
|
||||
}
|
||||
current = current->Flink;
|
||||
}
|
||||
}
|
||||
LEAVE_FUNC();
|
||||
return NULL;
|
||||
}
|
||||
|
||||
BOOLEAN ListDriverModules( void )
|
||||
{
|
||||
PLIST_ENTRY current;
|
||||
POBJECT_HEADER current_obj;
|
||||
PDIRECTORY_OBJECT pd;
|
||||
PMODULE pm;
|
||||
|
||||
ENTER_FUNC();
|
||||
|
||||
if( pd = (PDIRECTORY_OBJECT) FindDriverObjectDirectory() ){
|
||||
current = pd->head.Flink;
|
||||
while (current!=(&(pd->head)))
|
||||
{
|
||||
current_obj = CONTAINING_RECORD(current,OBJECT_HEADER,Entry);
|
||||
DPRINT("Modules %S\n",current_obj->Name.Buffer);
|
||||
pm = HEADER_TO_BODY(current_obj);
|
||||
DPRINT("FullName: %S, BaseName: %S, Length: %ld, EntryPoint: %x\n", pm->FullName.Buffer,
|
||||
pm->BaseName.Buffer, pm->Length, pm->EntryPoint );
|
||||
|
||||
pdebug_module_tail->size = pm->Length;
|
||||
pdebug_module_tail->BaseAddress = pm->Base;
|
||||
pdebug_module_tail->EntryPoint = pm->EntryPoint;
|
||||
RtlCopyUnicodeString( &(pdebug_module_tail->name), &(pm->BaseName));
|
||||
pdebug_module_tail = pdebug_module_tail->next;
|
||||
|
||||
/*
|
||||
if (_wcsicmp(current_obj->Name.Buffer, "Modules")==0)
|
||||
{
|
||||
DbgPrint("Found it %x\n",HEADER_TO_BODY(current_obj));
|
||||
pd=HEADER_TO_BODY(current_obj);
|
||||
}
|
||||
*/
|
||||
current = current->Flink;
|
||||
}
|
||||
}
|
||||
|
||||
LEAVE_FUNC();
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
BOOLEAN BuildModuleList( void )
|
||||
{
|
||||
PPEB peb;
|
||||
ENTER_FUNC();
|
||||
|
||||
pdebug_module_tail = pdebug_module_head;
|
||||
|
||||
peb = IoGetCurrentProcess()->Peb;
|
||||
if( peb ){
|
||||
if( !ListUserModules( peb ) ){
|
||||
LEAVE_FUNC();
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
if( !ListDriverModules() ){
|
||||
LEAVE_FUNC();
|
||||
return FALSE;
|
||||
}
|
||||
LEAVE_FUNC();
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
|
||||
//*************************************************************************
|
||||
// ScanExports()
|
||||
|
@ -260,27 +421,27 @@ BOOLEAN ValidityCheckSymbols(PICE_SYMBOLFILE_HEADER* pSymbols)
|
|||
//*************************************************************************
|
||||
PICE_SYMBOLFILE_HEADER* FindModuleSymbols(ULONG addr)
|
||||
{
|
||||
struct module* pMod;
|
||||
ULONG start,end,i;
|
||||
PDEBUG_MODULE pd = pdebug_module_head;
|
||||
|
||||
DPRINT((0,"FindModuleSymbols(%x)\n",addr));
|
||||
if(pmodule_list)
|
||||
if(BuildModuleList())
|
||||
{
|
||||
i=0;
|
||||
pMod = *pmodule_list;
|
||||
pd = pdebug_module_head;
|
||||
do
|
||||
{
|
||||
if(pMod->size)
|
||||
if(pd->size)
|
||||
{
|
||||
start = (ULONG)pMod+sizeof(struct module);
|
||||
end = start + pMod->size-sizeof(struct module);
|
||||
DPRINT((0,"FindModuleSymbols(): %s %x-%x\n",pMod->name,start,end));
|
||||
start = (ULONG)pd->BaseAddress;
|
||||
end = start + pd->size;
|
||||
DPRINT((0,"FindModuleSymbols(): %S %x-%x\n",pd->name,start,end));
|
||||
if(addr>=start && addr<end)
|
||||
{
|
||||
DPRINT((0,"FindModuleSymbols(): address matches %s %x-%x\n",pMod->name,start,end));
|
||||
DPRINT((0,"FindModuleSymbols(): address matches %S %x-%x\n",pd->name,start,end));
|
||||
for(i=0;i<ulNumSymbolsLoaded;i++)
|
||||
{
|
||||
if(PICE_strcmpi((LPSTR)pMod->name,apSymbols[i]->name) == 0)
|
||||
if(PICE_wcsicmp(pd->name.Buffer,apSymbols[i]->name) == 0)
|
||||
{
|
||||
if(ValidityCheckSymbols(apSymbols[i]))
|
||||
return apSymbols[i];
|
||||
|
@ -290,27 +451,7 @@ PICE_SYMBOLFILE_HEADER* FindModuleSymbols(ULONG addr)
|
|||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
start = (ULONG)KERNEL_START + sizeof(struct module);
|
||||
end = start + fake_kernel_module.size-sizeof(struct module);
|
||||
DPRINT((0,"FindModuleSymbols(): %s %x-%x\n",fake_kernel_module.name,start,end));
|
||||
if(addr>=start && addr<end)
|
||||
{
|
||||
DPRINT((0,"FindModuleSymbols(): address matches %s %x-%x\n",fake_kernel_module.name,start,end));
|
||||
for(i=0;i<ulNumSymbolsLoaded;i++)
|
||||
{
|
||||
if(PICE_strcmpi((LPSTR)fake_kernel_module.name,apSymbols[i]->name) == 0)
|
||||
{
|
||||
if(ValidityCheckSymbols(apSymbols[i]))
|
||||
return apSymbols[i];
|
||||
else
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}while((pMod = pMod->next));
|
||||
}while((pd = pd->next) != pdebug_module_tail);
|
||||
}
|
||||
|
||||
return NULL;
|
||||
|
@ -320,41 +461,29 @@ PICE_SYMBOLFILE_HEADER* FindModuleSymbols(ULONG addr)
|
|||
// FindModuleFromAddress()
|
||||
//
|
||||
//*************************************************************************
|
||||
struct module* FindModuleFromAddress(ULONG addr)
|
||||
PDEBUG_MODULE FindModuleFromAddress(ULONG addr)
|
||||
{
|
||||
struct module* pMod;
|
||||
PDEBUG_MODULE pd;
|
||||
ULONG start,end;
|
||||
|
||||
DPRINT((0,"FindModuleFromAddress()\n"));
|
||||
if(pmodule_list)
|
||||
if(BuildModuleList())
|
||||
{
|
||||
pMod = *pmodule_list;
|
||||
pd = pdebug_module_head;
|
||||
do
|
||||
{
|
||||
if(pMod->size)
|
||||
if(pd->size)
|
||||
{
|
||||
start = (ULONG)pMod+sizeof(struct module);
|
||||
end = start + pMod->size-sizeof(struct module);
|
||||
DPRINT((0,"FindModuleFromAddress(): %s %x-%x\n",pMod->name,start,end));
|
||||
start = (ULONG)pd->BaseAddress;
|
||||
end = start + pMod->size;
|
||||
DPRINT((0,"FindModuleFromAddress(): %S %x-%x\n",pd->name,start,end));
|
||||
if(addr>=start && addr<end)
|
||||
{
|
||||
DPRINT((0,"FindModuleFromAddress(): found %s\n",pMod->name));
|
||||
return pMod;
|
||||
DPRINT((0,"FindModuleFromAddress(): found %S\n",pd->name));
|
||||
return pd;
|
||||
}
|
||||
}
|
||||
// must be the kernel
|
||||
else
|
||||
{
|
||||
start = (ULONG)KERNEL_START + sizeof(struct module);
|
||||
end = start + fake_kernel_module.size-sizeof(struct module);
|
||||
DPRINT((0,"FindModuleFromAddress(): %s %x-%x\n",fake_kernel_module.name,start,end));
|
||||
if(addr>=start && addr<end)
|
||||
{
|
||||
DPRINT((0,"FindModuleFromAddress(): found %s\n",fake_kernel_module.name));
|
||||
return &fake_kernel_module;
|
||||
}
|
||||
}
|
||||
}while((pMod = pMod->next));
|
||||
}while((pd = pd->next)!=pdebug_module_tail);
|
||||
}
|
||||
|
||||
return NULL;
|
||||
|
@ -364,33 +493,32 @@ struct module* FindModuleFromAddress(ULONG addr)
|
|||
// FindModuleByName()
|
||||
//
|
||||
//*************************************************************************
|
||||
struct module* FindModuleByName(LPSTR modname)
|
||||
PDEBUG_MODULE FindModuleByName(LPSTR modname)
|
||||
{
|
||||
struct module* pMod;
|
||||
PDEBUG_MODULE pd;
|
||||
WCHAR tempstr[64];
|
||||
|
||||
DPRINT((0,"FindModuleFromAddress()\n"));
|
||||
if(pmodule_list)
|
||||
if( !MultiByteToWideChar(CP_ACP, NULL, modname, -1, tempstr, 64 ) )
|
||||
{
|
||||
pMod = *pmodule_list;
|
||||
DPRINT((0,"Can't convert module name.\n"));
|
||||
return NULL;
|
||||
}
|
||||
|
||||
if(BuildModuleList())
|
||||
{
|
||||
pd = pdebug_module_head;
|
||||
do
|
||||
{
|
||||
if(pMod->size)
|
||||
if(pd->size)
|
||||
{
|
||||
if(PICE_strcmpi(modname,(LPSTR)pMod->name) == 0)
|
||||
if(PICE_wcsicmp(tempstr,pMod->name) == 0)
|
||||
{
|
||||
DPRINT((0,"FindModuleByName(): found %s\n",pMod->name));
|
||||
return pMod;
|
||||
DPRINT((0,"FindModuleByName(): found %S\n",pd->name));
|
||||
return pd;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
if(PICE_strcmpi(modname,(LPSTR)fake_kernel_module.name) == 0)
|
||||
{
|
||||
DPRINT((0,"FindModuleByName(): found %s\n",fake_kernel_module.name));
|
||||
return &fake_kernel_module;
|
||||
}
|
||||
}
|
||||
}while((pMod = pMod->next));
|
||||
}while((pd = pd->next) != pdebug_module_tail);
|
||||
}
|
||||
|
||||
return NULL;
|
||||
|
@ -403,11 +531,18 @@ struct module* FindModuleByName(LPSTR modname)
|
|||
PICE_SYMBOLFILE_HEADER* FindModuleSymbolsByModuleName(LPSTR modname)
|
||||
{
|
||||
ULONG i;
|
||||
WCHAR tempstr[64];
|
||||
|
||||
DPRINT((0,"FindModuleSymbols()\n"));
|
||||
if( !MultiByteToWideChar(CP_ACP, NULL, modname, -1, tempstr, 64 ) )
|
||||
{
|
||||
DPRINT((0,"Can't convert module name in FindModuleSymbols.\n"));
|
||||
return NULL;
|
||||
}
|
||||
|
||||
for(i=0;i<ulNumSymbolsLoaded;i++)
|
||||
{
|
||||
if(PICE_strcmpi(modname,apSymbols[i]->name) == 0)
|
||||
if(PICE_wcsicmp(tempstr,apSymbols[i]->name) == 0)
|
||||
return apSymbols[i];
|
||||
}
|
||||
|
||||
|
@ -425,141 +560,118 @@ BOOLEAN ScanExportsByAddress(LPSTR *pFind,ULONG ulValue)
|
|||
LPSTR p,pStartOfLine,pSymbolName=NULL;
|
||||
ULONG ulCurrentValue=0,i;
|
||||
BOOLEAN bResult = FALSE;
|
||||
struct module *pMod;
|
||||
PDEBUG_MODULE pd;
|
||||
ULONG ulMinValue = -1;
|
||||
Elf32_Sym* pElfSym;
|
||||
LPSTR pElfStr;
|
||||
Elf32_Shdr* pElfShdr;
|
||||
PIMAGE_SYMBOL pSym,pSymEnd; //running pointer to symbols and end of sym talbe
|
||||
PIMAGE_SYMBOL pFoundSym = NULL; //current best symbol match
|
||||
ULONG ulAddr = 0x0; //address of the best match
|
||||
LPSTR pStr;
|
||||
PIMAGE_SECTION_HEADER pShdr;
|
||||
PICE_SYMBOLFILE_HEADER* pSymbols;
|
||||
ULONG ulSectionSize;
|
||||
LPSTR pName;
|
||||
|
||||
ENTER_FUNC();
|
||||
|
||||
if(ulValue < TASK_SIZE)
|
||||
{
|
||||
LEAVE_FUNC();
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
pSymbols = FindModuleSymbols(ulValue);
|
||||
if(pSymbols && pmodule_list)
|
||||
if(pSymbols && pdebug_module_head)
|
||||
{
|
||||
struct module* pModTemp;
|
||||
PDEBUG_MODULE pdTemp;
|
||||
|
||||
DPRINT((0,"looking up symbols\n"));
|
||||
pMod = *pmodule_list;
|
||||
pd = pdebug_module_head;
|
||||
do
|
||||
{
|
||||
if(!pMod->size)
|
||||
pModTemp = &fake_kernel_module;
|
||||
else
|
||||
pModTemp = pMod;
|
||||
assert(pd->size);
|
||||
|
||||
if(ulValue>=((ULONG)pModTemp+sizeof(struct module)) && ulValue<((ULONG)pModTemp+pModTemp->size-sizeof(struct module)))
|
||||
pdTemp = pd;
|
||||
|
||||
if(ulValue>=((ULONG)pdTemp->BaseAddress) && ulValue<((ULONG)pdTemp+pdTemp->size))
|
||||
{
|
||||
if(PICE_strcmpi((LPSTR)pModTemp->name,pSymbols->name) == 0)
|
||||
if(PICE_wcsicmp(pdTemp->name,pSymbols->name) == 0)
|
||||
{
|
||||
DPRINT((0,"ScanExportsByAddress(): found symbols for module %s @ \n",pModTemp->name,(ULONG)pSymbols));
|
||||
DPRINT((0,"ScanExportsByAddress(): found symbols for module %S @ %x \n",pdTemp->name,(ULONG)pSymbols));
|
||||
|
||||
pElfSym = (Elf32_Sym*)((ULONG)pSymbols+pSymbols->ulOffsetToGlobals);
|
||||
pElfStr = (LPSTR)((ULONG)pSymbols+pSymbols->ulOffsetToGlobalsStrings);
|
||||
pElfShdr = (Elf32_Shdr*)((ULONG)pSymbols+pSymbols->ulOffsetToHeaders);
|
||||
pSym = (PIMAGE_SYMBOL)((ULONG)pSymbols+pSymbols->ulOffsetToGlobals);
|
||||
pSymEnd = (PIMAGE_SYMBOL)((ULONG)pSym+pSymbols->ulSizeOfGlobals);
|
||||
pStr = (LPSTR)((ULONG)pSymbols+pSymbols->ulOffsetToGlobalsStrings);
|
||||
pShdr = (PIMAGE_SECTION_HEADER)((ULONG)pSymbols+pSymbols->ulOffsetToHeaders);
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): pElfSym = %x\n",pElfSym));
|
||||
DPRINT((0,"ScanExportsByAddress(): pElfStr = %x\n",pElfStr));
|
||||
DPRINT((0,"ScanExportsByAddress(): pElfShdr = %x\n",pElfShdr));
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): %s has %u symbols\n",pSymbols->name,pSymbols->ulSizeOfGlobals/sizeof(Elf32_Sym)));
|
||||
|
||||
for(i=0;i<(pSymbols->ulSizeOfGlobals/sizeof(Elf32_Sym));i++)
|
||||
if(!IsRangeValid((ULONG)pSym,sizeof(IMAGE_SYMBOL) ) ) //should we actually check all the symbols here?
|
||||
{
|
||||
if((ELF32_ST_BIND(pElfSym->st_info)==STB_GLOBAL || ELF32_ST_BIND(pElfSym->st_info)==STB_LOCAL || ELF32_ST_BIND(pElfSym->st_info)==STB_WEAK) &&
|
||||
(ELF32_ST_TYPE(pElfSym->st_info)==STT_OBJECT || ELF32_ST_TYPE(pElfSym->st_info)==STT_FUNC) &&
|
||||
(pElfSym->st_shndx<SHN_LORESERVE || pElfSym->st_shndx==SHN_ABS || pElfSym->st_shndx==SHN_COMMON))
|
||||
DPRINT((0,"ScanExportsByAddress(): pSym = %x is not a valid pointer\n",(ULONG)pSym));
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): pSym = %x\n",pSym));
|
||||
DPRINT((0,"ScanExportsByAddress(): pStr = %x\n",pStr));
|
||||
DPRINT((0,"ScanExportsByAddress(): pShdr = %x\n",pShdr));
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): %s has %u symbols\n",pSymbols->name,pSymbols->ulSizeOfGlobals/sizeof(IMAGE_SYMBOL)));
|
||||
|
||||
/* go through all the global symbols and find the one with
|
||||
the largest address which is less than ulValue */
|
||||
while(pSym < pSymEnd)
|
||||
{ //it seems only 0x0 and 0x20 are used for type and External or Static storage classes
|
||||
if(((pSym->Type == 0x0) || (pSym->Type == 0x20) ) &&
|
||||
((pSym->StorageClass == IMAGE_SYM_CLASS_EXTERNAL) || (pSym->StorageClass==IMAGE_SYM_CLASS_STATIC)) &&
|
||||
(pSym->SectionNumber > 0 ))
|
||||
{
|
||||
LPSTR pName = &pElfStr[pElfSym->st_name];
|
||||
ULONG start,end;
|
||||
ULONG ulCurrAddr;
|
||||
PIMAGE_SECTION_HEADER pShdrThis = (PIMAGE_SECTION_HEADER)pShdr + pSym->SectionNumber;
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): pName = %x\n",(ULONG)pName));
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): pShdr[%x] = %x\n",pSym->SectionNumber,(ULONG)pShdrThis));
|
||||
|
||||
if(!IsRangeValid((ULONG)pShdrThis,sizeof(IMAGE_SECTION_HEADER)) )
|
||||
{
|
||||
DPRINT((0,"ScanExportsByAddress(): pElfShdr[%x] = %x is not a valid pointer\n",pSym->SectionNumber,(ULONG)pShdrThis));
|
||||
return FALSE;
|
||||
}
|
||||
//to get address in the memory we base address of the module and
|
||||
//add offset of the section and then add offset of the symbol from
|
||||
//the begining of the section
|
||||
ulCurrAddr = ((ULONG)pdTemp->BaseAddress+pShdrThis->VirtualAddress+pSym->Value);
|
||||
DPRINT((0,"ScanExportsByAddress(): CurrAddr [1] = %x\n",ulCurrAddr));
|
||||
|
||||
if(ulCurrAddr<=ulValue && ulCurrAddr>ulAddr)
|
||||
{
|
||||
ulAddr = ulCurrAddr;
|
||||
pFoundSym = pSym;
|
||||
}
|
||||
}
|
||||
//skip the auxiliary symbols and get the next symbol
|
||||
pSym += pSym->NumberOfAuxSymbols + 1;
|
||||
}
|
||||
*pFind = temp3;
|
||||
{
|
||||
PIMAGE_SECTION_HEADER pShdrThis = (PIMAGE_SECTION_HEADER)pShdr + pFoundSym->SectionNumber;
|
||||
//check that ulValue is below the limit for the section where best match is found
|
||||
assert(ulValue < ((ULONG)pdTemp->BaseAddress+pShdrThis->SizeOfRawData));
|
||||
}
|
||||
if( !(pFoundSym->Name.Short) ){
|
||||
pName = pFoundSym->ShortName; //name is in the header
|
||||
PICE_sprintf(temp3,"%s!%.8s",pdTemp->name,pName); //if name is in the header it may be nonzero terminated
|
||||
}
|
||||
else{
|
||||
assert(pFoundSym->Name.Long<=pSymbols->ulSizeOfGlobalsStrings); //sanity check
|
||||
pName = pStr[pFoundSym->Name.Long];
|
||||
if(!IsAddressValid((ULONG)pName))
|
||||
{
|
||||
DPRINT((0,"ScanExportsByAddress(): pName is not a valid pointer\n"));
|
||||
DPRINT((0,"ScanExportsByAddress(): pName = %x is not a valid pointer\n",pName));
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): pName = %s\n",pName));
|
||||
|
||||
if(!IsRangeValid((ULONG)pElfSym,sizeof(Elf32_Sym) ) )
|
||||
{
|
||||
DPRINT((0,"ScanExportsByAddress(): pElfSym = %x is not a valid pointer\n",(ULONG)pElfSym));
|
||||
return FALSE;
|
||||
PICE_sprintf(temp3,"%s!%s",pdTemp->name,pName);
|
||||
}
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): pModTemp = %x\n",(ULONG)pModTemp));
|
||||
if(pModTemp != &fake_kernel_module)
|
||||
{
|
||||
Elf32_Shdr* pElfShdrThis = (Elf32_Shdr*)pElfShdr + pElfSym->st_shndx;
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): module is not kernel\n"));
|
||||
|
||||
DPRINT((0,"ScanExportsByAddress(): pElfShdr[%x] = %x\n",pElfSym->st_shndx,(ULONG)pElfShdrThis));
|
||||
|
||||
if(!IsRangeValid((ULONG)pElfShdrThis,sizeof(Elf32_Shdr)) )
|
||||
{
|
||||
DPRINT((0,"ScanExportsByAddress(): pElfShdr[%x] = %x is not a valid pointer\n",pElfSym->st_shndx,pElfShdrThis));
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
start = ((ULONG)pModTemp+pElfShdrThis->sh_offset);
|
||||
DPRINT((0,"ScanExportsByAddress(): start [1] = %x\n",start));
|
||||
|
||||
start = (start+pElfShdrThis->sh_addralign)&~(pElfShdrThis->sh_addralign-1);
|
||||
DPRINT((0,"ScanExportsByAddress(): start [2] = %x\n",start));
|
||||
|
||||
start += pElfSym->st_value;
|
||||
DPRINT((0,"ScanExportsByAddress(): start [3] = %x\n",start));
|
||||
}
|
||||
else
|
||||
{
|
||||
DPRINT((0,"ScanExportsByAddress(): module is kernel\n"));
|
||||
start = pElfSym->st_value;
|
||||
DPRINT((0,"ScanExportsByAddress(): start [1] = %x\n",start));
|
||||
}
|
||||
|
||||
end = start+pElfSym->st_size;
|
||||
DPRINT((0,"ScanExportsByAddress(): end = %x\n",end));
|
||||
|
||||
if(ulValue>=start && ulValue<end)
|
||||
{
|
||||
DPRINT((0,"[%u] %.8X %.8X %.8X %.8X %.8X %.8X %.8X\n",
|
||||
pElfSym->st_shndx,
|
||||
((ULONG)pModTemp+pElfShdr[pElfSym->st_shndx].sh_offset),
|
||||
pElfShdr[pElfSym->st_shndx].sh_addr,
|
||||
pElfShdr[pElfSym->st_shndx].sh_offset,
|
||||
pElfShdr[pElfSym->st_shndx].sh_size,
|
||||
pElfShdr[pElfSym->st_shndx].sh_type,
|
||||
pElfShdr[pElfSym->st_shndx].sh_link,
|
||||
pElfShdr[pElfSym->st_shndx].sh_addralign));
|
||||
DPRINT((0,"in section [%u] %8x value = %x module struct %x (%x)\n",pElfSym->st_shndx,pElfShdr[pElfSym->st_shndx].sh_offset,ulValue,sizeof(struct module),((sizeof(struct module)+0x10)&~0x0F)));
|
||||
DPRINT((0,"[%u] %32s %.8X %.8X %.8X %.8X %.8X %.8X\n",i,pName,pElfSym->st_name,pElfSym->st_value,pElfSym->st_info,pElfSym->st_other,pElfSym->st_size,pElfSym->st_shndx));
|
||||
DPRINT((0,"start %x end %x\n",start,end));
|
||||
*pFind = temp3;
|
||||
if(ulValue-start)
|
||||
PICE_sprintf(temp3,"%s!%s+%x",pModTemp->name,pName,ulValue-start);
|
||||
else
|
||||
PICE_sprintf(temp3,"%s!%s",pModTemp->name,pName);
|
||||
DPRINT((0,"ScanExportsByAddress(): pName = %x\n",(ULONG)pName));
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
}
|
||||
pElfSym++;
|
||||
}
|
||||
}
|
||||
}
|
||||
}while((pMod = pMod->next));
|
||||
}
|
||||
|
||||
if(pExports && ulValue >= TASK_SIZE && ulValue < kernel_end)
|
||||
// if haven't found in the symbols try ntoskrnl exports. (note: check that this is needed since we
|
||||
// already checked ntoskrnl coff symbol table)
|
||||
if(pExports && ulValue >= TASK_SIZE /*&& ulValue < kernel_end*/)
|
||||
{
|
||||
p = pExports;
|
||||
// while we bound in System.map
|
||||
|
@ -594,82 +706,13 @@ BOOLEAN ScanExportsByAddress(LPSTR *pFind,ULONG ulValue)
|
|||
temp[i] = 0;
|
||||
// decide if we need to append an offset
|
||||
if(ulMinValue)
|
||||
PICE_sprintf(temp3,"vmlinux!%s+%.8X",temp,ulMinValue);
|
||||
PICE_sprintf(temp3,"ntoskrnl!%s+%.8X",temp,ulMinValue);
|
||||
else
|
||||
PICE_sprintf(temp3,"vmlinux!%s",temp);
|
||||
PICE_sprintf(temp3,"ntoskrnl!%s",temp);
|
||||
}
|
||||
}
|
||||
|
||||
if(pmodule_list && ulMinValue!=0)
|
||||
{
|
||||
pMod = *pmodule_list;
|
||||
do
|
||||
{
|
||||
if(ulValue>=((ULONG)pMod+sizeof(struct module)) && ulValue<((ULONG)pMod+pMod->size-sizeof(struct module)))
|
||||
{
|
||||
if(pMod->syms)
|
||||
{
|
||||
for(i=0;i<pMod->nsyms;i++)
|
||||
{
|
||||
ulCurrentValue = pMod->syms[i].value;
|
||||
if(ulValue>=ulCurrentValue && (LONG)(ulValue-ulCurrentValue)<ulMinValue)
|
||||
{
|
||||
ulMinValue = ulValue-ulCurrentValue;
|
||||
|
||||
if(ulValue-ulCurrentValue)
|
||||
PICE_sprintf(temp3,"%s!%s+%.8X",pMod->name,pMod->syms[i].name,ulValue-ulCurrentValue);
|
||||
else
|
||||
PICE_sprintf(temp3,"%s!%s",pMod->name,pMod->syms[i].name);
|
||||
bResult = TRUE;
|
||||
*pFind = temp3;
|
||||
if(ulMinValue == 0)
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// this could be near entry and cleanup of a module
|
||||
ulCurrentValue = (ULONG)pMod->init;
|
||||
if(ulCurrentValue)
|
||||
{
|
||||
if(ulValue>=ulCurrentValue && (LONG)(ulValue-ulCurrentValue)<ulMinValue)
|
||||
{
|
||||
ulMinValue = ulValue-ulCurrentValue;
|
||||
|
||||
if(ulValue-ulCurrentValue)
|
||||
PICE_sprintf(temp3,"%s!init_module+%.8X",pMod->name,ulValue-ulCurrentValue);
|
||||
else
|
||||
PICE_sprintf(temp3,"%s!init_module",pMod->name);
|
||||
bResult = TRUE;
|
||||
*pFind = temp3;
|
||||
if(ulMinValue == 0)
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
ulCurrentValue = (ULONG)pMod->cleanup;
|
||||
if(ulCurrentValue)
|
||||
{
|
||||
if(ulValue>=ulCurrentValue && (LONG)(ulValue-ulCurrentValue)<ulMinValue)
|
||||
{
|
||||
ulMinValue = ulValue-ulCurrentValue;
|
||||
|
||||
if(ulValue-ulCurrentValue)
|
||||
PICE_sprintf(temp3,"%s!cleanup_module+%.8X",pMod->name,ulValue-ulCurrentValue);
|
||||
else
|
||||
PICE_sprintf(temp3,"%s!cleanup_module",pMod->name);
|
||||
bResult = TRUE;
|
||||
*pFind = temp3;
|
||||
if(ulMinValue == 0)
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}while((pMod = pMod->next));
|
||||
}
|
||||
|
||||
LEAVE_FUNC();
|
||||
|
||||
return bResult;
|
||||
}
|
||||
|
||||
|
@ -1829,7 +1872,7 @@ BOOLEAN LoadExports(void)
|
|||
|
||||
if(hf)
|
||||
{
|
||||
mm_segment_t oldfs;
|
||||
//mm_segment_t oldfs;
|
||||
size_t len;
|
||||
|
||||
len = PICE_len(hf);
|
||||
|
|
|
@ -30,6 +30,8 @@ Copyright notice:
|
|||
--*/
|
||||
|
||||
// constant defines
|
||||
#define FIELD_OFFSET(Type,Field) (LONG)(&(((Type *)(0))->Field))
|
||||
#define CONTAINING_RECORD(Address,Type,Field) (Type *)(((LONG)Address) - FIELD_OFFSET(Type,Field))
|
||||
|
||||
typedef struct _LOCAL_VARIABLE
|
||||
{
|
||||
|
@ -39,6 +41,22 @@ typedef struct _LOCAL_VARIABLE
|
|||
BOOLEAN bRegister;
|
||||
}LOCAL_VARIABLE,*PLOCAL_VARIABLE;
|
||||
|
||||
struct _DEBUG_MODULE_SYMBOL_
|
||||
{
|
||||
ULONG value;
|
||||
char* name;
|
||||
};
|
||||
|
||||
typedef struct _DEBUG_MODULE_
|
||||
{
|
||||
struct _DEBUG_MODULE_ *next;
|
||||
ULONG size;
|
||||
PVOID BaseAddress;
|
||||
PVOID EntryPoint;
|
||||
UNICODE_STRING name;
|
||||
struct _DEBUG_MODULE_SYMBOL_ syms;
|
||||
}DEBUG_MODULE, *PDEBUG_MODULE;
|
||||
|
||||
BOOLEAN InitFakeKernelModule(void);
|
||||
BOOLEAN LoadExports(void);
|
||||
BOOLEAN SanityCheckExports(void);
|
||||
|
@ -64,8 +82,9 @@ void Evaluate(PICE_SYMBOLFILE_HEADER* pSymbols,LPSTR p);
|
|||
LONG ExtractNumber(LPSTR p);
|
||||
LPSTR ExtractTypeName(LPSTR p);
|
||||
|
||||
extern ULONG kernel_end;
|
||||
//extern ULONG kernel_end;
|
||||
extern PICE_SYMBOLFILE_HEADER* apSymbols[32];
|
||||
|
||||
extern struct module fake_kernel_module;
|
||||
#define KERNEL_START (0xc0100000)
|
||||
//extern struct module fake_kernel_module;
|
||||
#define KERNEL_START (0xc0000000)
|
||||
|
||||
|
|
|
@ -291,6 +291,25 @@ ULONG result=1;
|
|||
return result;
|
||||
}
|
||||
|
||||
ULONG PICE_wcsicmp(WCHAR* s1, WCHAR* s2)
|
||||
{
|
||||
ULONG result=1;
|
||||
|
||||
while(IsAddressValid((ULONG)s1) && *s1 && // not end of string
|
||||
IsAddressValid((ULONG)s2) && *s2 && // not end of string
|
||||
towlower(*s1)==towlower(*s2) ) // char are the same except case
|
||||
{
|
||||
s1++;
|
||||
s2++;
|
||||
}
|
||||
// strings same length
|
||||
if(*s1==0 && *s2==0)
|
||||
result=0;
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
}
|
||||
//*************************************************************************
|
||||
// PICE_strrev()
|
||||
//
|
||||
|
|
|
@ -36,7 +36,7 @@ Copyright notice:
|
|||
#include "precomp.h"
|
||||
|
||||
//#include <asm/io.h>
|
||||
#include <linux/ctype.h>
|
||||
//#include <linux/ctype.h>
|
||||
|
||||
|
||||
////////////////////////////////////////////////////
|
||||
|
|
|
@ -36,7 +36,7 @@ Copyright notice:
|
|||
--*/
|
||||
|
||||
//#include <ddk/ntddk.h>
|
||||
#include <winnt.h>
|
||||
//#include <winnt.h>
|
||||
|
||||
|
||||
//temporary
|
||||
|
@ -80,7 +80,7 @@ typedef struct _DEBUGGER_STATUS_BLOCK
|
|||
typedef struct _PICE_SYMBOLFILE_HEADER
|
||||
{
|
||||
ULONG magic;
|
||||
char name[32];
|
||||
WCHAR name[64];
|
||||
ULONG ulOffsetToHeaders,ulSizeOfHeader;
|
||||
ULONG ulOffsetToGlobals,ulSizeOfGlobals;
|
||||
ULONG ulOffsetToGlobalsStrings,ulSizeOfGlobalsStrings;
|
||||
|
|
Loading…
Reference in a new issue