windows_debug.c File Reference

#include <ntstatus.h>
#include "windows_debug.h"
#include "../../common_windows.h"
#include <w32dbg_wrap.h>

Go to the source code of this file.

Macros
#define	WIN32_NO_STATUS
#define	SystemHandleInformation   16

Functions
bool	setup_debug_privileges (bool b)
int	w32_init (RzDebug *dbg)
static int	w32_findthread_cmp (int *tid, PTHREAD_ITEM th)
static PTHREAD_ITEM	find_thread (RzDebug *dbg, int tid)
static PTHREAD_ITEM	add_thread (RzDebug *dbg, DWORD pid, DWORD tid, HANDLE hThread, LPVOID lpThreadLocalBase, LPVOID lpStartAddress, BOOL bFinished)
static int	suspend_thread (HANDLE th)
static int	resume_thread (HANDLE th)
static void	continue_thread (HANDLE th)
static bool	is_thread_alive (RzDebug *dbg, int tid)
static bool	is_process_alive (HANDLE ph)
static int	set_thread_context (HANDLE th, const ut8 *buf, int size)
static int	get_thread_context (HANDLE th, ut8 *buf, int size, DWORD context_flags)
static void	transfer_drx (RzDebug *dbg, const ut8 *buf)
static void	print_fpu_context (HANDLE th, CONTEXT *buf)
int	w32_step (RzDebug *dbg)
static void	get_arm_hwbp_values (ut64 address, ut32 *control, ut64 *value)
static void	get_arm64_hwwp_values (ut64 address, int size, int rw, ut32 *control, ut64 *value)
static bool	is_watchpoint (RzBreakpointItem *b)
static bool	is_breakpoint (RzBreakpointItem *b)
int	w32_hwbp_arm_add (RzDebug *dbg, RzBreakpoint *bp, RzBreakpointItem *b)
int	w32_hwbp_arm_del (RzDebug *dbg, RzBreakpoint *bp, RzBreakpointItem *b)
static HANDLE	get_thread_handle_from_tid (RzDebug *dbg, int tid)
int	w32_reg_read (RzDebug *dbg, int type, ut8 *buf, int size)
int	w32_reg_write (RzDebug *dbg, int type, const ut8 *buf, int size)
static bool	already_attached (W32DbgWInst *wrap, int pid)
int	w32_attach (RzDebug *dbg, int pid)
int	w32_detach (RzDebug *dbg, int pid)
static char *	get_file_name_from_handle (HANDLE handle_file)
static char *	resolve_path (HANDLE ph, HANDLE mh)
static void	libfree (void *lib)
static int	findlibcmp (void *BaseOfDll, void *lib)
static void *	find_library (void *BaseOfDll)
static void	remove_library (PLIB_ITEM library)
static void	add_library (DWORD pid, LPVOID lpBaseOfDll, HANDLE hFile, char *dllname)
static void *	last_library (void)
int	w32_attach_new_process (RzDebug *dbg, int pid)
int	w32_select (RzDebug *dbg, int pid, int tid)
int	w32_kill (RzDebug *dbg, int pid, int tid, int sig)
void	w32_break_process (void *user)
int	w32_dbg_wait (RzDebug *dbg, int pid)
int	w32_continue (RzDebug *dbg, int pid, int tid, int sig)
RzDebugMap *	w32_map_alloc (RzDebug *dbg, ut64 addr, int size)
int	w32_map_dealloc (RzDebug *dbg, ut64 addr, int size)
static int	io_perms_to_prot (int io_perms)
int	w32_map_protect (RzDebug *dbg, ut64 addr, int size, int perms)
static ut64	pc_from_context (CONTEXT *ctx)
static char *	get_process_path (HANDLE ph, int pid)
RzList *	w32_thread_list (RzDebug *dbg, int pid, RzList *list)
static void	w32_info_user (RzDebug *dbg, RzDebugInfo *rdi)
static void	w32_info_exe (RzDebug *dbg, RzDebugInfo *rdi)
RzDebugInfo *	w32_info (RzDebug *dbg, const char *arg)
static RzDebugPid *	build_debug_pid (int pid, int ppid, HANDLE ph, const WCHAR *name)
RzList *	w32_pid_list (RzDebug *dbg, int pid, RzList *list)
RzList *	w32_desc_list (int pid)

Variables
const DWORD	wait_time = 1000
static RzList *	lib_list = NULL
static bool	breaked = false

Macro Definition Documentation

SystemHandleInformation

#define SystemHandleInformation   16

Definition at line 14 of file windows_debug.c.

WIN32_NO_STATUS

#define WIN32_NO_STATUS

Definition at line 5 of file windows_debug.c.

Function Documentation

add_library()

static void add_library ( DWORD  pid, LPVOID  lpBaseOfDll, HANDLE  hFile, char *  dllname  )

static

Definition at line 782 of file windows_debug.c.

                                                                                    {
    if (lib_list == NULL) {
        lib_list = rz_list_newf((RzListFree)libfree);
        if (!lib_list) {
            RZ_LOG_ERROR("Failed to allocate memory");
            return;
        }
    }
    RzListIter *it;
    PLIB_ITEM lib;
    rz_list_foreach (lib_list, it, lib) {
        if (lib->hFile == hFile && lib->BaseOfDll == lpBaseOfDll) {
            return;
        }
    }
    lib = RZ_NEW0(LIB_ITEM);
    if (!lib) {
        RZ_LOG_ERROR("Failed to allocate memory");
        return;
    }
    lib->pid = pid;
    lib->hFile = hFile;
    lib->BaseOfDll = lpBaseOfDll;
    lib->Path = strdup(dllname);
    lib->Name = strdup(rz_file_basename(dllname));
 
    (void)rz_list_append(lib_list, lib);
}

References LIB_ITEM::BaseOfDll, LIB_ITEM::hFile, lib_list, libfree(), LIB_ITEM::Name, NULL, LIB_ITEM::Path, LIB_ITEM::pid, pid, rz_file_basename(), rz_list_append(), rz_list_newf(), RZ_LOG_ERROR, RZ_NEW0, and strdup().

Referenced by w32_dbg_wait().

add_thread()

static PTHREAD_ITEM add_thread ( RzDebug *  dbg, DWORD  pid, DWORD  tid, HANDLE  hThread, LPVOID  lpThreadLocalBase, LPVOID  lpStartAddress, BOOL  bFinished  )

static

Definition at line 107 of file windows_debug.c.

                                                                                                                                                    {
    rz_return_val_if_fail(dbg, NULL);
    if (!dbg->threads) {
        dbg->threads = rz_list_newf(free);
    }
    if (!lpStartAddress) {
        w32_NtQueryInformationThread(hThread, 9, &lpStartAddress, sizeof(LPVOID), NULL);
    }
    THREAD_ITEM th = {
        pid,
        tid,
        bFinished,
        false,
        hThread,
        lpThreadLocalBase,
        lpStartAddress
    };
    PTHREAD_ITEM pthread = find_thread(dbg, tid);
    if (pthread) {
        *pthread = th;
        return NULL;
    }
    pthread = RZ_NEW0(THREAD_ITEM);
    if (!pthread) {
        RZ_LOG_ERROR("Memory allocation failed.\n");
        return NULL;
    }
    *pthread = th;
    rz_list_append(dbg->threads, pthread);
    return pthread;
}

References dbg, find_thread(), free(), NULL, pid, rz_list_append(), rz_list_newf(), RZ_LOG_ERROR, RZ_NEW0, rz_return_val_if_fail, and rz_debug_t::threads.

Referenced by w32_dbg_wait().

already_attached()

static bool already_attached ( W32DbgWInst *  wrap, int  pid  )

inlinestatic

Definition at line 594 of file windows_debug.c.

                                                                {
    return wrap->pi.hProcess && wrap->pi.dwProcessId == pid && wrap->pi.dwThreadId;
}

References W32DbgWInst::pi, and pid.

Referenced by w32_attach().

build_debug_pid()

static RzDebugPid* build_debug_pid ( int  pid, int  ppid, HANDLE  ph, const WCHAR *  name  )

static

Definition at line 1425 of file windows_debug.c.

                                                                                    {
    char *path = get_process_path(ph, pid);
    int uid = -1;
 
    DWORD sid;
    if (w32_ProcessIdToSessionId && w32_ProcessIdToSessionId(pid, &sid)) {
        uid = sid;
    }
    if (!path) {
        path = rz_utf16_to_utf8(name);
    }
    // it is possible to get pc for a non debugged process but the operation is expensive and might be risky
    RzDebugPid *ret = rz_debug_pid_new(path, pid, uid, 's', 0);
    ret->ppid = ppid;
    free(path);
    return ret;
}

References DWORD, free(), get_process_path(), path, ph, pid, rz_debug_pid_t::ppid, and rz_debug_pid_new().

Referenced by w32_pid_list().

continue_thread()

static void continue_thread ( HANDLE  th )

inlinestatic

Definition at line 155 of file windows_debug.c.

                                              {
    int ret;
    do {
        ret = resume_thread(th);
    } while (ret > 0);
}

References resume_thread().

Referenced by w32_continue().

find_library()

static void* find_library ( void *  BaseOfDll )

static

Definition at line 773 of file windows_debug.c.

                                           {
    RzListIter *it = rz_list_find(lib_list, BaseOfDll, (RzListComparator)findlibcmp);
    return it ? it->data : NULL;
}

References rz_list_iter_t::data, findlibcmp(), lib_list, NULL, and rz_list_find().

Referenced by w32_dbg_wait().

find_thread()

static PTHREAD_ITEM find_thread ( RzDebug *  dbg, int  tid  )

inlinestatic

Definition at line 99 of file windows_debug.c.

                                                              {
    if (!dbg->threads) {
        return NULL;
    }
    RzListIter *it = rz_list_find(dbg->threads, &tid, (RzListComparator)w32_findthread_cmp);
    return it ? it->data : NULL;
}

References rz_list_iter_t::data, dbg, NULL, rz_list_find(), rz_debug_t::threads, and w32_findthread_cmp().

Referenced by add_thread(), get_thread_handle_from_tid(), is_thread_alive(), uv_resident_set_memory(), w32_continue(), w32_dbg_wait(), w32_info(), w32_select(), and w32_thread_list().

findlibcmp()

static int findlibcmp ( void *  BaseOfDll, void *  lib  )

static

Definition at line 768 of file windows_debug.c.

                                                  {
    PLIB_ITEM lib_item = (PLIB_ITEM)lib;
    return !lib_item->hFile || lib_item->hFile == INVALID_HANDLE_VALUE || lib_item->BaseOfDll != BaseOfDll;
}

References LIB_ITEM::BaseOfDll, LIB_ITEM::hFile, and INVALID_HANDLE_VALUE.

Referenced by find_library().

get_arm64_hwwp_values()

static void get_arm64_hwwp_values ( ut64  address, int  size, int  rw, ut32 *  control, ut64 *  value  )

inlinestatic

Definition at line 409 of file windows_debug.c.

                                                                                                     {
    const unsigned int offset = address % 8;
    const ut32 byte_mask = ((1 << size) - 1) << offset;
    const ut32 priv = 1 << 2;
    const ut32 enable = 1;
    ut32 load_store = 0;
    switch (rw) {
    case RZ_PERM_R:
        load_store = 1;
        break;
    case RZ_PERM_W:
        load_store = 2;
        break;
    case RZ_PERM_RW:
        load_store = 3;
        break;
    }
    *control = byte_mask << 5 | load_store << 3 | priv | enable;
    *value = address - offset;
}

References control, RZ_PERM_R, RZ_PERM_RW, RZ_PERM_W, and value.

Referenced by w32_hwbp_arm_add(), and w32_hwbp_arm_del().

get_arm_hwbp_values()

static void get_arm_hwbp_values ( ut64  address, ut32 *  control, ut64 *  value  )

inlinestatic

Definition at line 400 of file windows_debug.c.

                                                                                 {
    const ut32 type = 0b0100 << 20; // match
    const ut32 bas = 0xF << 5; // match a64 and a32
    const ut32 priv = 1 << 2;
    const ut32 enable = 1;
    *control = type | bas | priv | enable;
    *value = address;
}

References control, type, and value.

Referenced by w32_hwbp_arm_add(), and w32_hwbp_arm_del().

get_file_name_from_handle()

static char* get_file_name_from_handle ( HANDLE  handle_file )

static

Definition at line 649 of file windows_debug.c.

                                                           {
    HANDLE handle_file_map = NULL;
    LPWSTR filename = NULL;
    DWORD file_size_high = 0;
    LPVOID map = NULL;
    DWORD file_size_low = GetFileSize(handle_file, &file_size_high);
 
    if (file_size_low == 0 && file_size_high == 0) {
        return NULL;
    }
    handle_file_map = CreateFileMappingW(handle_file, NULL, PAGE_READONLY, 0, 1, NULL);
    if (!handle_file_map) {
        goto err_get_file_name_from_handle;
    }
    filename = malloc((MAX_PATH + 1) * sizeof(WCHAR));
    if (!filename) {
        goto err_get_file_name_from_handle;
    }
    /* Create a file mapping to get the file name. */
    map = MapViewOfFile(handle_file_map, FILE_MAP_READ, 0, 0, 1);
    if (!map || !GetMappedFileNameW(GetCurrentProcess(), map, filename, MAX_PATH)) {
        RZ_FREE(filename);
        goto err_get_file_name_from_handle;
    }
    WCHAR temp_buffer[512];
    /* Translate path with device name to drive letters. */
    if (!GetLogicalDriveStringsW(_countof(temp_buffer) - 1, temp_buffer)) {
        goto err_get_file_name_from_handle;
    }
    WCHAR name[MAX_PATH];
    WCHAR drive[3] = L" :";
    LPWSTR cur_drive = temp_buffer;
    while (*cur_drive) {
        /* Look up each device name */
        *drive = *cur_drive;
        if (QueryDosDeviceW(drive, name, MAX_PATH)) {
            size_t name_length = wcslen(name);
 
            if (name_length < MAX_PATH) {
                if (wcsnicmp(filename, name, name_length) == 0 && *(filename + name_length) == L'\\') {
                    WCHAR temp_filename[MAX_PATH];
                    _snwprintf_s(temp_filename, MAX_PATH, _TRUNCATE, L"%s%s",
                        drive, filename + name_length);
                    wcsncpy(filename, temp_filename,
                        wcslen(temp_filename) + 1);
                    filename[MAX_PATH] = L'\0';
                    break;
                }
            }
        }
        cur_drive++;
    }
err_get_file_name_from_handle:
    if (map) {
        UnmapViewOfFile(map);
    }
    if (handle_file_map) {
        CloseHandle(handle_file_map);
    }
    if (filename) {
        char *ret = rz_sys_conv_win_to_utf8(filename);
        free(filename);
        return ret;
    }
    return NULL;
}

References DWORD, free(), HANDLE, L, LPWSTR, malloc(), map(), NULL, and RZ_FREE.

Referenced by resolve_path().

get_process_path()

static char* get_process_path ( HANDLE  ph, int  pid  )

static

Definition at line 1249 of file windows_debug.c.

                                                  {
    bool close_handle = false;
    char *path = NULL;
    if (!ph) {
        ph = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
        if (!ph) {
            ph = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);
            if (!ph) {
                ph = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
                if (!ph) {
                    return NULL;
                }
            }
        }
        close_handle = true;
    }
    if (w32_QueryFullProcessImageNameW) {
        WCHAR tmp[MAX_PATH + 1];
        DWORD sz = MAX_PATH;
        if (w32_QueryFullProcessImageNameW(ph, 0, tmp, &sz)) {
            path = rz_utf16_to_utf8(tmp);
        }
    } else {
        path = resolve_path(ph, NULL);
    }
    if (close_handle) {
        CloseHandle(ph);
    }
    return path;
}

References DWORD, FALSE, NULL, path, ph, pid, resolve_path(), and autogen_x86imm::tmp.

Referenced by build_debug_pid(), and w32_thread_list().

get_thread_context()

static int get_thread_context ( HANDLE  th, ut8 *  buf, int  size, DWORD  context_flags  )

static

Definition at line 199 of file windows_debug.c.

                                                                                  {
    int ret = 0;
    CONTEXT ctx = { 0 };
    // TODO: support various types?
    ctx.ContextFlags = context_flags;
    if (GetThreadContext(th, &ctx)) {
        if (size > sizeof(ctx)) {
            size = sizeof(ctx);
        }
        memcpy(buf, &ctx, size);
        ret = size;
    } else {
        if (is_process_alive(th)) {
            rz_sys_perror("GetThreadContext");
        }
    }
    return ret;
}

References is_process_alive(), memcpy(), and rz_sys_perror.

Referenced by w32_dbg_wait(), w32_hwbp_arm_add(), w32_hwbp_arm_del(), and w32_reg_read().

get_thread_handle_from_tid()

static HANDLE get_thread_handle_from_tid ( RzDebug *  dbg, int  tid  )

static

Definition at line 529 of file windows_debug.c.

                                                                {
    rz_return_val_if_fail(dbg, NULL);
    W32DbgWInst *wrap = dbg->plugin_data;
    HANDLE th = NULL;
    if (wrap->pi.dwThreadId == tid) {
        th = wrap->pi.hThread;
    } else {
        PTHREAD_ITEM thread = find_thread(dbg, tid);
        if (thread) {
            th = thread->hThread;
        }
    }
    return th;
}

References dbg, find_thread(), HANDLE, THREAD_ITEM::hThread, NULL, W32DbgWInst::pi, rz_debug_t::plugin_data, and rz_return_val_if_fail.

Referenced by w32_reg_read(), and w32_reg_write().

io_perms_to_prot()

static int io_perms_to_prot ( int  io_perms )

static

Definition at line 1206 of file windows_debug.c.

                                          {
    int prot_perms;
 
    if ((io_perms & RZ_PERM_RWX) == RZ_PERM_RWX) {
        prot_perms = PAGE_EXECUTE_READWRITE;
    } else if ((io_perms & (RZ_PERM_W | RZ_PERM_X)) == (RZ_PERM_W | RZ_PERM_X)) {
        prot_perms = PAGE_EXECUTE_READWRITE;
    } else if ((io_perms & (RZ_PERM_R | RZ_PERM_X)) == (RZ_PERM_R | RZ_PERM_X)) {
        prot_perms = PAGE_EXECUTE_READ;
    } else if ((io_perms & RZ_PERM_RW) == RZ_PERM_RW) {
        prot_perms = PAGE_READWRITE;
    } else if (io_perms & RZ_PERM_W) {
        prot_perms = PAGE_READWRITE;
    } else if (io_perms & RZ_PERM_X) {
        prot_perms = PAGE_EXECUTE;
    } else if (io_perms & RZ_PERM_R) {
        prot_perms = PAGE_READONLY;
    } else {
        prot_perms = PAGE_NOACCESS;
    }
    return prot_perms;
}

References RZ_PERM_R, RZ_PERM_RW, RZ_PERM_RWX, RZ_PERM_W, and RZ_PERM_X.

Referenced by w32_map_protect().

is_breakpoint()

static bool is_breakpoint ( RzBreakpointItem *  b )

inlinestatic

Definition at line 434 of file windows_debug.c.

                                                      {
    return b->perm & RZ_PERM_X;
}

References b, and RZ_PERM_X.

Referenced by w32_hwbp_arm_add(), and w32_hwbp_arm_del().

is_process_alive()

static bool is_process_alive ( HANDLE  ph )

static

Definition at line 177 of file windows_debug.c.

                                        {
    if (ph) {
        DWORD code;
        if (!GetExitCodeProcess(ph, &code)) {
            GetExitCodeThread(ph, &code);
        }
        return code == STILL_ACTIVE;
    }
    return false;
}

References code, DWORD, and ph.

Referenced by get_thread_context().

is_thread_alive()

static bool is_thread_alive ( RzDebug *  dbg, int  tid  )

static

Definition at line 162 of file windows_debug.c.

                                                   {
    PTHREAD_ITEM th = find_thread(dbg, tid);
    if (!th) {
        return false;
    }
    if (!th->bFinished) {
        if (SuspendThread(th->hThread) != -1) {
            ResumeThread(th->hThread);
            return true;
        }
    }
    th->bFinished = true;
    return false;
}

References THREAD_ITEM::bFinished, dbg, find_thread(), and THREAD_ITEM::hThread.

Referenced by w32_dbg_wait(), w32_hwbp_arm_add(), w32_hwbp_arm_del(), w32_reg_read(), w32_reg_write(), and w32_select().

is_watchpoint()

static bool is_watchpoint ( RzBreakpointItem *  b )

inlinestatic

Definition at line 430 of file windows_debug.c.

                                                      {
    return b->perm & (RZ_PERM_RW | RZ_PERM_R | RZ_PERM_W);
}

References b, RZ_PERM_R, RZ_PERM_RW, and RZ_PERM_W.

Referenced by w32_hwbp_arm_add(), and w32_hwbp_arm_del().

last_library()

static void* last_library ( void  )

static

Definition at line 811 of file windows_debug.c.

                                {
    return rz_list_tail(lib_list) ? rz_list_tail(lib_list)->data : NULL;
}

References lib_list, and NULL.

Referenced by w32_info().

libfree()

static void libfree ( void *  lib )

static

Definition at line 758 of file windows_debug.c.

                               {
    PLIB_ITEM lib_item = (PLIB_ITEM)lib;
    free(lib_item->Name);
    free(lib_item->Path);
    if (lib_item->hFile && lib_item->hFile != INVALID_HANDLE_VALUE) {
        CloseHandle(lib_item->hFile);
    }
    free(lib_item);
}

References free(), LIB_ITEM::hFile, INVALID_HANDLE_VALUE, LIB_ITEM::Name, and LIB_ITEM::Path.

Referenced by add_library().

pc_from_context()

static ut64 pc_from_context ( CONTEXT *  ctx )

inlinestatic

Definition at line 1236 of file windows_debug.c.

                                                 {
#if __x86_64__
    return ctx->Rip;
#elif __arm__ || __arm64__
    return ctx->Pc;
#elif __i386__
    return ctx->Eip;
#else
#pragma warning("platform not supported")
    return 0;
#endif
}

Referenced by w32_thread_list().

print_fpu_context()

static void print_fpu_context ( HANDLE  th, CONTEXT *  buf  )

static

Definition at line 391 of file windows_debug.c.

                                                       {
    // TODO
}

Referenced by w32_reg_read().

remove_library()

static void remove_library ( PLIB_ITEM  library )

static

Definition at line 778 of file windows_debug.c.

                                              {
    rz_list_delete_data(lib_list, library);
}

References lib_list, and rz_list_delete_data().

Referenced by w32_dbg_wait().

resolve_path()

static char* resolve_path ( HANDLE  ph, HANDLE  mh  )

static

Definition at line 716 of file windows_debug.c.

                                                {
    // TODO: add maximum path length support
    const DWORD maxlength = MAX_PATH;
    WCHAR filename[MAX_PATH];
    DWORD length = GetModuleFileNameExW(ph, mh, filename, maxlength);
    if (length > 0) {
        return rz_utf16_to_utf8(filename);
    }
    char *name = get_file_name_from_handle(mh);
    if (name) {
        return name;
    }
    // Upon failure fallback to GetProcessImageFileName
    length = GetProcessImageFileNameW(mh, filename, maxlength);
    if (length == 0) {
        return NULL;
    }
    // Convert NT path to win32 path
    WCHAR *tmp = wcschr(filename + 1, L'\\');
    if (!tmp) {
        return NULL;
    }
    tmp = wcschr(tmp + 1, L'\\');
    if (!tmp) {
        return NULL;
    }
    length = tmp - filename;
    WCHAR device[MAX_PATH];
    char *ret = NULL;
    for (WCHAR drv[] = L"A:"; drv[0] <= L'Z'; drv[0]++) {
        if (QueryDosDeviceW(drv, device, maxlength) > 0) {
            if (!wcsncmp(filename, device, length)) {
                WCHAR path[MAX_PATH];
                _snwprintf(path, maxlength, L"%s%s", drv, tmp);
                ret = rz_utf16_to_utf8(path);
                break;
            }
        }
    }
    return ret;
}

References DWORD, get_file_name_from_handle(), L, length, name, NULL, path, ph, and autogen_x86imm::tmp.

Referenced by get_process_path(), w32_dbg_wait(), and w32_info_exe().

resume_thread()

static int resume_thread ( HANDLE  th )

static

Definition at line 147 of file windows_debug.c.

                                    {
    int ret;
    if ((ret = ResumeThread(th)) == -1) {
        rz_sys_perror("ResumeThread");
    }
    return ret;
}

References rz_sys_perror.

Referenced by continue_thread(), w32_dbg_wait(), w32_detach(), w32_hwbp_arm_add(), w32_hwbp_arm_del(), w32_reg_read(), and w32_reg_write().

set_thread_context()

static int set_thread_context ( HANDLE  th, const ut8 *  buf, int  size  )

static

Definition at line 188 of file windows_debug.c.

                                                                   {
    bool ret;
    CONTEXT ctx = { 0 };
    size = RZ_MIN(size, sizeof(ctx));
    memcpy(&ctx, buf, size);
    if (!(ret = SetThreadContext(th, &ctx))) {
        rz_sys_perror("SetThreadContext");
    }
    return ret;
}

References memcpy(), RZ_MIN, and rz_sys_perror.

Referenced by w32_hwbp_arm_add(), w32_hwbp_arm_del(), and w32_reg_write().

setup_debug_privileges()

bool setup_debug_privileges

(

bool

b

)

Definition at line 16 of file windows_debug.c.

                                    {
    HANDLE tok;
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &tok)) {
        return false;
    }
    bool ret = false;
    LUID luid;
    if (LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid)) {
        TOKEN_PRIVILEGES tp;
        tp.PrivilegeCount = 1;
        tp.Privileges[0].Luid = luid;
        tp.Privileges[0].Attributes = b ? SE_PRIVILEGE_ENABLED : 0;
        if (AdjustTokenPrivileges(tok, FALSE, &tp, 0, NULL, NULL)) {
            // TODO: handle ERROR_NOT_ALL_ASSIGNED
            ret = GetLastError() == ERROR_SUCCESS;
        }
    }
    CloseHandle(tok);
    return ret;
}

References b, FALSE, HANDLE, and NULL.

Referenced by w32_init().

suspend_thread()

static int suspend_thread ( HANDLE  th )

inlinestatic

Definition at line 139 of file windows_debug.c.

                                            {
    int ret;
    if ((ret = SuspendThread(th)) == -1) {
        rz_sys_perror("SuspendThread");
    }
    return ret;
}

References rz_sys_perror.

Referenced by w32_dbg_wait(), w32_hwbp_arm_add(), w32_hwbp_arm_del(), w32_reg_read(), w32_reg_write(), and w32_select().

transfer_drx()

static void transfer_drx ( RzDebug *  dbg, const ut8 *  buf  )

static

Definition at line 387 of file windows_debug.c.

                                                       {
    // Do nothing (not supported)
}

Referenced by w32_reg_write().

w32_attach()

int w32_attach	(	RzDebug *	dbg,
		int	pid
	)

Definition at line 598 of file windows_debug.c.

                                      {
    W32DbgWInst *wrap = dbg->plugin_data;
    if (already_attached(wrap, pid)) {
        return wrap->pi.dwThreadId;
    }
    if (wrap->pi.hProcess && wrap->pi.hProcess != INVALID_HANDLE_VALUE) {
        CloseHandle(wrap->pi.hProcess);
    }
    dbg->main_pid = pid;
    wrap->pi.dwProcessId = pid;
    wrap->params.type = W32_ATTACH;
    w32dbg_wrap_wait_ret(wrap);
    if (!wrap->params.ret) {
        w32dbgw_err(wrap);
        rz_sys_perror("DebugActiveProcess");
        wrap->pi.hProcess = NULL;
        wrap->pi.dwProcessId = 0;
        return -1;
    }
    dbg->cur->wait(dbg, pid);
    rz_debug_continue(dbg);
    return wrap->pi.dwThreadId;
}

References already_attached(), rz_debug_t::cur, dbg, INVALID_HANDLE_VALUE, rz_debug_t::main_pid, NULL, W32DbgWInst::params, W32DbgWInst::pi, pid, rz_debug_t::plugin_data, W32DbgWParams::ret, rz_debug_continue(), rz_sys_perror, W32DbgWParams::type, W32_ATTACH, w32dbg_wrap_wait_ret(), w32dbgw_err, and rz_debug_plugin_t::wait.

Referenced by w32_attach_new_process().

w32_attach_new_process()

int w32_attach_new_process	(	RzDebug *	dbg,
		int	pid
	)

Definition at line 817 of file windows_debug.c.

                                                  {
    int tid = -1;
 
    if (!w32_detach(dbg, dbg->pid)) {
        eprintf("Failed to detach from (%d)\n", dbg->pid);
        return -1;
    }
 
    if ((tid = w32_attach(dbg, pid)) < 0) {
        eprintf("Failed to attach to (%d)\n", pid);
        return -1;
    }
 
    dbg->tid = tid;
    dbg->pid = pid;
    // Call select to sync the new pid's data
    rz_debug_select(dbg, pid, tid);
    return dbg->tid;
}

References dbg, eprintf, rz_debug_t::pid, pid, rz_debug_select(), rz_debug_t::tid, w32_attach(), and w32_detach().

Referenced by w32_select().

w32_break_process()

void w32_break_process

(

void *

user

)

Definition at line 912 of file windows_debug.c.

                                   {
    RzDebug *dbg = (RzDebug *)user;
    W32DbgWInst *wrap = dbg->plugin_data;
    if (dbg->corebind.cfggeti(dbg->corebind.core, "dbg.threads")) {
        w32_select(dbg, wrap->pi.dwProcessId, -1); // Suspend all threads
    } else {
        if (!DebugBreakProcess(wrap->pi.hProcess)) {
            rz_sys_perror("DebugBreakProcess");
            eprintf("Could not interrupt program, attempt to press Ctrl-C in the program's console.\n");
        }
    }
 
    breaked = true;
}

References breaked, rz_core_bind_t::cfggeti, rz_core_bind_t::core, rz_debug_t::corebind, dbg, eprintf, W32DbgWInst::pi, rz_debug_t::plugin_data, rz_sys_perror, and w32_select().

Referenced by w32_dbg_wait().

w32_continue()

int w32_continue	(	RzDebug *	dbg,
		int	pid,
		int	tid,
		int	sig
	)

Definition at line 1144 of file windows_debug.c.

                                                          {
    if (tid != dbg->tid) {
        dbg->tid = w32_select(dbg, pid, tid);
    }
    // Don't continue with a thread that wasn't requested
    if (dbg->tid != tid) {
        return -1;
    }
 
    if (breaked) {
        breaked = false;
        return -1;
    }
 
    PTHREAD_ITEM th = find_thread(dbg, tid);
    if (th && th->hThread != INVALID_HANDLE_VALUE && th->bSuspended) {
        continue_thread(th->hThread);
        th->bSuspended = false;
    }
 
    W32DbgWInst *wrap = dbg->plugin_data;
    wrap->params.type = W32_CONTINUE;
 
    /* Honor the Windows-specific signal that instructs threads to process exceptions */
    wrap->params.continue_status = (sig == DBG_EXCEPTION_NOT_HANDLED)
        ? DBG_EXCEPTION_NOT_HANDLED
        : DBG_EXCEPTION_HANDLED;
 
    w32dbg_wrap_wait_ret(wrap);
    if (!w32dbgw_ret(wrap)) {
        w32dbgw_err(wrap);
        rz_sys_perror("ContinueDebugEvent");
        return -1;
    }
 
    if (th && th->bFinished) {
        rz_list_delete_data(dbg->threads, th);
    }
 
    return tid;
}

References THREAD_ITEM::bFinished, breaked, THREAD_ITEM::bSuspended, W32DbgWParams::continue_status, continue_thread(), dbg, find_thread(), THREAD_ITEM::hThread, INVALID_HANDLE_VALUE, W32DbgWInst::params, pid, rz_debug_t::plugin_data, rz_list_delete_data(), rz_sys_perror, rz_debug_t::threads, rz_debug_t::tid, W32DbgWParams::type, W32_CONTINUE, w32_select(), w32dbg_wrap_wait_ret(), w32dbgw_err, and w32dbgw_ret.

Referenced by w32_dbg_wait().

w32_dbg_wait()

int w32_dbg_wait	(	RzDebug *	dbg,
		int	pid
	)

Definition at line 927 of file windows_debug.c.

                                        {
    W32DbgWInst *wrap = dbg->plugin_data;
    DEBUG_EVENT de;
    int tid, next_event = 0;
    char *dllname = NULL;
    int ret = RZ_DEBUG_REASON_UNKNOWN;
    static int exited_already = 0;
 
    rz_cons_break_push(w32_break_process, dbg);
 
    /* handle debug events */
    do {
        /* do not continue when already exited but still open for examination */
        if (exited_already == pid) {
            return RZ_DEBUG_REASON_DEAD;
        }
        memset(&de, 0, sizeof(DEBUG_EVENT));
        do {
            wrap->params.type = W32_WAIT;
            wrap->params.wait.de = &de;
            wrap->params.wait.wait_time = wait_time;
            void *bed = rz_cons_sleep_begin();
            w32dbg_wrap_wait_ret(wrap);
            rz_cons_sleep_end(bed);
            if (!w32dbgw_ret(wrap)) {
                if (w32dbgw_err(wrap) != ERROR_SEM_TIMEOUT) {
                    rz_sys_perror("WaitForDebugEvent");
                    ret = -1;
                    goto end;
                }
                if (!is_thread_alive(dbg, dbg->tid)) {
                    ret = w32_select(dbg, dbg->pid, dbg->tid);
                    if (ret == -1) {
                        ret = RZ_DEBUG_REASON_DEAD;
                        goto end;
                    }
                }
            } else {
                break;
            }
        } while (!breaked);
 
        if (breaked) {
            ret = RZ_DEBUG_REASON_USERSUSP;
            breaked = false;
        }
 
        dbg->tid = tid = de.dwThreadId;
        dbg->pid = pid = de.dwProcessId;
 
        /* TODO: DEBUG_CONTROL_C */
        switch (de.dwDebugEventCode) {
        case CREATE_PROCESS_DEBUG_EVENT:
            CloseHandle(de.u.CreateProcessInfo.hFile);
            add_thread(dbg, pid, tid, de.u.CreateProcessInfo.hThread, de.u.CreateProcessInfo.lpThreadLocalBase, de.u.CreateProcessInfo.lpStartAddress, FALSE);
            wrap->pi.hProcess = de.u.CreateProcessInfo.hProcess;
            wrap->pi.hThread = de.u.CreateProcessInfo.hThread;
            wrap->winbase = (ULONG_PTR)de.u.CreateProcessInfo.lpBaseOfImage;
            ret = RZ_DEBUG_REASON_NEW_PID;
            next_event = 0;
            break;
        case CREATE_THREAD_DEBUG_EVENT:
            add_thread(dbg, pid, tid, de.u.CreateThread.hThread, de.u.CreateThread.lpThreadLocalBase, de.u.CreateThread.lpStartAddress, FALSE);
            if (ret != RZ_DEBUG_REASON_USERSUSP) {
                ret = RZ_DEBUG_REASON_NEW_TID;
            }
            dbg->corebind.cmdf(dbg->corebind.core, "f teb.%d @ 0x%p", tid, de.u.CreateThread.lpThreadLocalBase);
            next_event = 0;
            break;
        case EXIT_PROCESS_DEBUG_EVENT:
        case EXIT_THREAD_DEBUG_EVENT: {
            PTHREAD_ITEM th = find_thread(dbg, tid);
            if (th) {
                th->bFinished = TRUE;
                th->dwExitCode = de.u.ExitThread.dwExitCode;
            } else {
                rz_warn_if_reached();
            }
            dbg->corebind.cmdf(dbg->corebind.core, "f- teb.%d", tid);
            if (de.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT) {
                exited_already = pid;
                w32_continue(dbg, pid, tid, DBG_CONTINUE);
                ret = pid == dbg->main_pid ? RZ_DEBUG_REASON_DEAD : RZ_DEBUG_REASON_EXIT_PID;
            } else {
                ret = RZ_DEBUG_REASON_EXIT_TID;
            }
            next_event = 0;
            break;
        }
        case LOAD_DLL_DEBUG_EVENT:
            dllname = resolve_path(wrap->pi.hProcess, de.u.LoadDll.hFile);
            if (dllname) {
                add_library(pid, de.u.LoadDll.lpBaseOfDll, de.u.LoadDll.hFile, dllname);
                free(dllname);
            }
            ret = RZ_DEBUG_REASON_NEW_LIB;
            next_event = 0;
            break;
        case UNLOAD_DLL_DEBUG_EVENT: {
            PLIB_ITEM lib = (PLIB_ITEM)find_library(de.u.UnloadDll.lpBaseOfDll);
            if (lib) {
                remove_library(lib);
            }
            ret = RZ_DEBUG_REASON_EXIT_LIB;
            next_event = 0;
            break;
        }
        case OUTPUT_DEBUG_STRING_EVENT: {
            char *str = calloc(de.u.DebugString.nDebugStringLength, sizeof(WCHAR));
            ReadProcessMemory(wrap->pi.hProcess, de.u.DebugString.lpDebugStringData, str, de.u.DebugString.nDebugStringLength, NULL);
            char *tmp = de.u.DebugString.fUnicode
                ? rz_utf16_to_utf8((wchar_t *)str)
                : rz_acp_to_utf8(str);
            if (tmp) {
                free(str);
                str = tmp;
            }
            eprintf("(%d) Debug string: %s\n", pid, str);
            free(str);
            w32_continue(dbg, pid, tid, DBG_EXCEPTION_NOT_HANDLED);
            next_event = 1;
            break;
        }
        case RIP_EVENT:
            eprintf("(%d) RIP event\n", pid);
            w32_continue(dbg, pid, tid, -1);
            next_event = 1;
            // XXX unknown ret = RZ_DEBUG_REASON_TRAP;
            break;
        case EXCEPTION_DEBUG_EVENT:
            dbg->reason.signum = DBG_EXCEPTION_NOT_HANDLED;
            switch (de.u.Exception.ExceptionRecord.ExceptionCode) {
            case DBG_CONTROL_C:
                eprintf("Received CTRL+C, suspending execution\n");
                ret = RZ_DEBUG_REASON_SIGNAL;
                next_event = 0;
                break;
#if _WIN64
            case 0x4000001f: /* STATUS_WX86_BREAKPOINT */
#endif
            case EXCEPTION_BREAKPOINT:
                ret = RZ_DEBUG_REASON_BREAKPOINT;
                next_event = 0;
                break;
#if _WIN64
            case 0x4000001e: /* STATUS_WX86_SINGLE_STEP */
#endif
            case EXCEPTION_SINGLE_STEP:
                ret = RZ_DEBUG_REASON_STEP;
                next_event = 0;
                break;
            default:
                if (rz_bp_get_at(dbg->bp, (size_t)de.u.Exception.ExceptionRecord.ExceptionAddress)) {
                    ret = RZ_DEBUG_REASON_BREAKPOINT;
                    next_event = 0;
                    break;
                }
                EXCEPTION_DEBUG_INFO *exp = &de.u.Exception;
                windows_print_exception_event(de.dwProcessId, de.dwThreadId, exp->ExceptionRecord.ExceptionCode, exp->dwFirstChance);
                if (windows_is_exception_fatal(de.u.Exception.ExceptionRecord.ExceptionCode)) {
                    next_event = 0;
                    dbg->reason.type = windows_exception_to_reason(de.u.Exception.ExceptionRecord.ExceptionCode);
                    dbg->reason.tid = de.dwThreadId;
                    dbg->reason.addr = (size_t)de.u.Exception.ExceptionRecord.ExceptionAddress;
                    dbg->reason.timestamp = rz_time_now();
                    ret = dbg->reason.type;
                } else {
                    w32_continue(dbg, pid, tid, DBG_EXCEPTION_NOT_HANDLED);
                    next_event = 1;
                }
            }
            break;
        default:
            // This case might be reached if break doesn't trigger an event
            if (ret != RZ_DEBUG_REASON_USERSUSP) {
                eprintf("(%d) unknown event: %lu\n", pid, de.dwDebugEventCode);
                ret = -1;
            }
            next_event = 0;
        }
    } while (next_event);
 
    if (ret != RZ_DEBUG_REASON_DEAD) {
        PTHREAD_ITEM th = find_thread(dbg, tid);
        if (th) {
            wrap->pi.hThread = th->hThread;
        } else {
            rz_warn_if_reached();
        }
    }
#if __arm__ || __arm64__
    if (ret != RZ_DEBUG_REASON_EXIT_TID) {
        CONTEXT ctx;
        suspend_thread(wrap->pi.hThread);
        get_thread_context(wrap->pi.hThread, (ut8 *)&ctx, sizeof(ctx), CONTEXT_CONTROL);
        resume_thread(wrap->pi.hThread);
        if (ctx.Cpsr & 0x20) {
            dbg->bits = RZ_SYS_BITS_16;
        } else {
#if __arm__
            dbg->bits = RZ_SYS_BITS_32;
#else
            dbg->bits = RZ_SYS_BITS_64;
#endif
        }
    }
#endif
end:
    if (ret == RZ_DEBUG_REASON_DEAD) {
        w32_detach(dbg, dbg->pid);
        rz_list_purge(dbg->threads);
        rz_list_purge(lib_list);
    }
    rz_cons_break_pop();
    return ret;
}

References add_library(), add_thread(), rz_debug_reason_t::addr, THREAD_ITEM::bFinished, rz_debug_t::bits, rz_debug_t::bp, breaked, calloc(), rz_core_bind_t::cmdf, rz_core_bind_t::core, rz_debug_t::corebind, dbg, THREAD_ITEM::dwExitCode, test_evm::end, eprintf, EXCEPTION_BREAKPOINT, EXCEPTION_SINGLE_STEP, FALSE, find_library(), find_thread(), free(), get_thread_context(), THREAD_ITEM::hThread, is_thread_alive(), lib_list, rz_debug_t::main_pid, memset(), NULL, W32DbgWInst::params, W32DbgWInst::pi, rz_debug_t::pid, pid, rz_debug_t::plugin_data, rz_debug_t::reason, remove_library(), resolve_path(), resume_thread(), rz_bp_get_at(), rz_cons_break_pop(), rz_cons_break_push(), rz_cons_sleep_begin(), rz_cons_sleep_end(), RZ_DEBUG_REASON_BREAKPOINT, RZ_DEBUG_REASON_DEAD, RZ_DEBUG_REASON_EXIT_LIB, RZ_DEBUG_REASON_EXIT_PID, RZ_DEBUG_REASON_EXIT_TID, RZ_DEBUG_REASON_NEW_LIB, RZ_DEBUG_REASON_NEW_PID, RZ_DEBUG_REASON_NEW_TID, RZ_DEBUG_REASON_SIGNAL, RZ_DEBUG_REASON_STEP, RZ_DEBUG_REASON_UNKNOWN, RZ_DEBUG_REASON_USERSUSP, rz_list_purge(), RZ_SYS_BITS_16, RZ_SYS_BITS_32, RZ_SYS_BITS_64, rz_sys_perror, rz_time_now(), rz_warn_if_reached, rz_debug_reason_t::signum, cmd_descs_generate::str, suspend_thread(), rz_debug_t::threads, rz_debug_reason_t::tid, rz_debug_t::tid, rz_debug_reason_t::timestamp, autogen_x86imm::tmp, TRUE, rz_debug_reason_t::type, W32DbgWParams::type, w32_break_process(), w32_continue(), w32_detach(), w32_select(), W32_WAIT, w32dbg_wrap_wait_ret(), w32dbgw_err, w32dbgw_ret, W32DbgWParams::wait, wait_time, W32DbgWInst::winbase, windows_exception_to_reason(), windows_is_exception_fatal(), and windows_print_exception_event().

w32_desc_list()

RzList* w32_desc_list

(

int

pid

)

Definition at line 1471 of file windows_debug.c.

                               {
    HANDLE ph;
    if (!(ph = OpenProcess(PROCESS_DUP_HANDLE, FALSE, pid))) {
        return NULL;
    }
    ULONG handleInfoSize = 0x10000;
    POBJECT_TYPE_INFORMATION objectTypeInfo = malloc(0x1000);
    if (!objectTypeInfo) {
        CloseHandle(ph);
        return NULL;
    }
    RzDebugDesc *desc;
    NTSTATUS status;
    PSYSTEM_HANDLE_INFORMATION handleInfo = NULL;
    PVOID objectNameInfo = NULL;
    RzList *ret = rz_list_newf((RzListFree)rz_debug_desc_free);
    if (!ret) {
        goto beach;
    }
    handleInfo = (PSYSTEM_HANDLE_INFORMATION)malloc(handleInfoSize);
    while ((status = w32_NtQuerySystemInformation(SystemHandleInformation, handleInfo, handleInfoSize, NULL)) == STATUS_INFO_LENGTH_MISMATCH) {
        handleInfoSize *= 2;
        void *tmp = realloc(handleInfo, (size_t)handleInfoSize);
        if (tmp) {
            handleInfo = (PSYSTEM_HANDLE_INFORMATION)tmp;
        } else {
            goto beach;
        }
    }
    if (status) {
        rz_sys_perror("NtQuerySystemInformation");
        goto beach;
    }
    size_t objectNameInfo_sz = 0x1000;
    objectNameInfo = malloc(objectNameInfo_sz);
    if (!objectNameInfo) {
        goto beach;
    }
    int i;
    for (i = 0; i < handleInfo->HandleCount; i++) {
        SYSTEM_HANDLE handle = handleInfo->Handles[i];
        HANDLE dupHandle = NULL;
        ULONG returnLength;
        int perms = 0;
        if (handle.ProcessId != pid) {
            continue;
        }
        if (w32_NtDuplicateObject(ph, (HANDLE)(size_t)handle.Handle, GetCurrentProcess(), &dupHandle, 0, 0, 0)) {
            continue;
        }
        if (w32_NtQueryObject(dupHandle, 2, objectTypeInfo, 0x1000, NULL)) {
            CloseHandle(dupHandle);
            continue;
        }
        if (wcscmp(objectTypeInfo->Name.Buffer, L"File")) {
            CloseHandle(dupHandle);
            continue;
        }
        GENERIC_MAPPING *gm = &objectTypeInfo->GenericMapping;
        if ((handle.GrantedAccess & gm->GenericRead) == gm->GenericRead) {
            perms |= RZ_PERM_R;
        }
        if ((handle.GrantedAccess & gm->GenericWrite) == gm->GenericWrite) {
            perms |= RZ_PERM_W;
        }
        if ((handle.GrantedAccess & gm->GenericExecute) == gm->GenericExecute) {
            perms |= RZ_PERM_X;
        }
        if (w32_NtQueryObject(dupHandle, 1, objectNameInfo, objectNameInfo_sz, &returnLength)) {
            void *tmp = realloc(objectNameInfo, returnLength);
            if (tmp) {
                objectNameInfo = tmp;
                objectNameInfo_sz = returnLength;
            }
            if (w32_NtQueryObject(dupHandle, 1, objectNameInfo, objectNameInfo_sz, NULL)) {
                CloseHandle(dupHandle);
                continue;
            }
        }
        PUNICODE_STRING objectName = objectNameInfo;
        if (objectName->Length) {
            char *name = rz_utf16_to_utf8_l(objectName->Buffer, objectName->Length / 2);
            desc = rz_debug_desc_new(handle.Handle, name, perms, '?', 0);
            if (!desc) {
                free(name);
                break;
            }
            rz_list_append(ret, desc);
            free(name);
        } else {
            char *name = rz_utf16_to_utf8_l(objectTypeInfo->Name.Buffer, objectTypeInfo->Name.Length / 2);
            desc = rz_debug_desc_new(handle.Handle, name, perms, '?', 0);
            if (!desc) {
                free(name);
                break;
            }
            rz_list_append(ret, desc);
            free(name);
        }
        CloseHandle(dupHandle);
    }
beach:
    free(objectNameInfo);
    free(objectTypeInfo);
    free(handleInfo);
    CloseHandle(ph);
    return ret;
}

References _UNICODE_STRING::Buffer, desc, FALSE, free(), _OBJECT_TYPE_INFORMATION::GenericMapping, handle, HANDLE, _SYSTEM_HANDLE_INFORMATION::HandleCount, _SYSTEM_HANDLE_INFORMATION::Handles, i, L, _UNICODE_STRING::Length, malloc(), _OBJECT_TYPE_INFORMATION::Name, NULL, ph, pid, PVOID, realloc(), rz_debug_desc_free(), rz_debug_desc_new(), rz_list_append(), rz_list_newf(), RZ_PERM_R, RZ_PERM_W, RZ_PERM_X, rz_sys_perror, status, STATUS_INFO_LENGTH_MISMATCH, SystemHandleInformation, autogen_x86imm::tmp, and ULONG.

w32_detach()

int w32_detach	(	RzDebug *	dbg,
		int	pid
	)

Definition at line 622 of file windows_debug.c.

                                      {
    if (pid == -1 || dbg->pid != pid) {
        return false;
    }
 
    // Resume suspended threads
    RzListIter *it;
    PTHREAD_ITEM th;
    rz_list_foreach (dbg->threads, it, th) {
        if (th->bSuspended && !th->bFinished) {
            resume_thread(th->hThread);
        }
    }
    rz_list_purge(dbg->threads);
    if (lib_list) {
        rz_list_purge(lib_list);
    }
    W32DbgWInst *wrap = dbg->plugin_data;
    bool ret = false;
    wrap->pi.dwProcessId = pid;
    wrap->params.type = W32_DETACH;
    w32dbg_wrap_wait_ret(wrap);
    ret = wrap->params.ret;
    memset(&wrap->pi, 0, sizeof(wrap->pi));
    return ret;
}

References THREAD_ITEM::bFinished, THREAD_ITEM::bSuspended, dbg, THREAD_ITEM::hThread, lib_list, memset(), W32DbgWInst::params, W32DbgWInst::pi, rz_debug_t::pid, pid, rz_debug_t::plugin_data, resume_thread(), W32DbgWParams::ret, rz_list_purge(), rz_debug_t::threads, W32DbgWParams::type, W32_DETACH, and w32dbg_wrap_wait_ret().

Referenced by w32_attach_new_process(), and w32_dbg_wait().

w32_findthread_cmp()

static int w32_findthread_cmp ( int *  tid, PTHREAD_ITEM  th  )

static

Definition at line 95 of file windows_debug.c.

                                                         {
    return (int)!(*tid == th->tid);
}

References THREAD_ITEM::tid.

Referenced by find_thread().

w32_hwbp_arm_add()

int w32_hwbp_arm_add	(	RzDebug *	dbg,
		RzBreakpoint *	bp,
		RzBreakpointItem *	b
	)

Definition at line 438 of file windows_debug.c.

                                                                          {
    rz_return_val_if_fail(dbg && bp && b, 0);
    W32DbgWInst *wrap = dbg->plugin_data;
    CONTEXT ctx;
    const bool alive = is_thread_alive(dbg, wrap->pi.dwThreadId);
    if (alive && suspend_thread(wrap->pi.hThread) == -1) {
        return 0;
    }
    get_thread_context(wrap->pi.hThread, (ut8 *)&ctx, sizeof(CONTEXT), CONTEXT_DEBUG_REGISTERS);
    ut32 control;
    ut64 value;
    int i;
    if (is_watchpoint(b)) {
        get_arm64_hwwp_values(b->addr, b->size, b->perm, &control, &value);
        for (i = 0; i < ARM64_MAX_WATCHPOINTS; i++) {
            if (!ctx.Wvr[i] || ctx.Wvr[i] == value) {
                break;
            }
        }
        if (i < ARM64_MAX_WATCHPOINTS) {
            ctx.Wcr[i] = control;
            ctx.Wvr[i] = value;
        } else {
            eprintf("Too many hardware watchpoints\n");
        }
    }
    if (is_breakpoint(b)) {
        get_arm_hwbp_values(b->addr, &control, &value);
        for (i = 0; i < ARM64_MAX_BREAKPOINTS; i++) {
            if (!ctx.Bvr[i] || ctx.Bvr[i] == value) {
                break;
            }
        }
        if (i < ARM64_MAX_BREAKPOINTS) {
            ctx.Bcr[i] = control;
            ctx.Bvr[i] = value;
        } else {
            eprintf("Too many hardware breakpoints\n");
        }
    }
    set_thread_context(wrap->pi.hThread, (ut8 *)&ctx, sizeof(CONTEXT));
    if (alive && resume_thread(wrap->pi.hThread) == -1) {
        return 0;
    }
    return 1;
}

References ARM64_MAX_BREAKPOINTS, ARM64_MAX_WATCHPOINTS, b, control, dbg, eprintf, get_arm64_hwwp_values(), get_arm_hwbp_values(), get_thread_context(), i, is_breakpoint(), is_thread_alive(), is_watchpoint(), W32DbgWInst::pi, rz_debug_t::plugin_data, resume_thread(), rz_return_val_if_fail, set_thread_context(), suspend_thread(), ut64(), and value.

w32_hwbp_arm_del()

int w32_hwbp_arm_del	(	RzDebug *	dbg,
		RzBreakpoint *	bp,
		RzBreakpointItem *	b
	)

Definition at line 485 of file windows_debug.c.

                                                                          {
    W32DbgWInst *wrap = dbg->plugin_data;
    CONTEXT ctx;
    const bool alive = is_thread_alive(dbg, wrap->pi.dwThreadId);
    if (alive && suspend_thread(wrap->pi.hThread) == -1) {
        return 0;
    }
    get_thread_context(wrap->pi.hThread, (ut8 *)&ctx, sizeof(CONTEXT), CONTEXT_DEBUG_REGISTERS);
    ut32 control;
    ut64 value;
    int i;
    if (is_watchpoint(b)) {
        get_arm64_hwwp_values(b->addr, b->size, b->perm, &control, &value);
        for (i = 0; i < ARM64_MAX_WATCHPOINTS; i++) {
            if (ctx.Wcr[i] == control && ctx.Wvr[i] == value) {
                break;
            }
        }
        if (i < ARM64_MAX_WATCHPOINTS) {
            ctx.Wcr[i] = 0;
            ctx.Wvr[i] = 0;
        }
    }
    if (is_breakpoint(b)) {
        get_arm_hwbp_values(b->addr, &control, &value);
        for (i = 0; i < ARM64_MAX_BREAKPOINTS; i++) {
            if (ctx.Bvr[i] == value) {
                break;
            }
        }
        if (i < ARM64_MAX_BREAKPOINTS) {
            ctx.Bcr[i] = 0;
            ctx.Bvr[i] = 0;
        }
    }
    set_thread_context(wrap->pi.hThread, (ut8 *)&ctx, sizeof(CONTEXT));
    if (alive && resume_thread(wrap->pi.hThread, dbg->bits) == -1) {
        return 0;
    }
    return 1;
}

References ARM64_MAX_BREAKPOINTS, ARM64_MAX_WATCHPOINTS, b, rz_debug_t::bits, control, dbg, get_arm64_hwwp_values(), get_arm_hwbp_values(), get_thread_context(), i, is_breakpoint(), is_thread_alive(), is_watchpoint(), W32DbgWInst::pi, rz_debug_t::plugin_data, resume_thread(), set_thread_context(), suspend_thread(), ut64(), and value.

w32_info()

RzDebugInfo* w32_info	(	RzDebug *	dbg,
		const char *	arg
	)

Definition at line 1404 of file windows_debug.c.

                                                     {
    RzDebugInfo *rdi = RZ_NEW0(RzDebugInfo);
    if (!rdi) {
        return NULL;
    }
    rdi->status = RZ_DBG_PROC_SLEEP; // TODO: Fix this
    rdi->pid = dbg->pid;
    rdi->tid = dbg->tid;
    rdi->lib = last_library();
    rdi->thread = find_thread(dbg, dbg->tid);
    rdi->uid = -1;
    rdi->gid = -1;
    rdi->cwd = NULL;
    rdi->exe = NULL;
    rdi->cmdline = NULL;
    rdi->libname = NULL;
    w32_info_user(dbg, rdi);
    w32_info_exe(dbg, rdi);
    return rdi;
}

References dbg, find_thread(), last_library(), NULL, rz_debug_t::pid, rdi, RZ_DBG_PROC_SLEEP, RZ_NEW0, rz_debug_t::tid, w32_info_exe(), and w32_info_user().

w32_info_exe()

static void w32_info_exe ( RzDebug *  dbg, RzDebugInfo *  rdi  )

static

Definition at line 1396 of file windows_debug.c.

                                                         {
    W32DbgWInst *wrap = dbg->plugin_data;
    if (!wrap) {
        return;
    }
    rdi->exe = resolve_path(wrap->pi.hProcess, NULL);
}

References dbg, NULL, W32DbgWInst::pi, rz_debug_t::plugin_data, rdi, and resolve_path().

Referenced by w32_info().

w32_info_user()

static void w32_info_user ( RzDebug *  dbg, RzDebugInfo *  rdi  )

static

Definition at line 1339 of file windows_debug.c.

                                                          {
    HANDLE h_tok = NULL;
    DWORD tok_len = 0;
    PTOKEN_USER tok_usr = NULL;
    LPWSTR usr = NULL, usr_dom = NULL;
    DWORD usr_len = 512;
    DWORD usr_dom_len = 512;
    SID_NAME_USE snu = { 0 };
    W32DbgWInst *wrap = dbg->plugin_data;
 
    if (!wrap || !wrap->pi.hProcess) {
        return;
    }
    if (!OpenProcessToken(wrap->pi.hProcess, TOKEN_QUERY, &h_tok)) {
        rz_sys_perror("OpenProcessToken");
        goto err_w32_info_user;
    }
    if (!GetTokenInformation(h_tok, TokenUser, (LPVOID)&tok_usr, 0, &tok_len) && GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
        rz_sys_perror("GetTokenInformation");
        goto err_w32_info_user;
    }
    tok_usr = (PTOKEN_USER)malloc(tok_len);
    if (!tok_usr) {
        goto err_w32_info_user;
    }
    if (!GetTokenInformation(h_tok, TokenUser, (LPVOID)tok_usr, tok_len, &tok_len)) {
        rz_sys_perror("GetTokenInformation");
        goto err_w32_info_user;
    }
    usr = (LPWSTR)malloc(usr_len * sizeof(WCHAR));
    if (!usr) {
        goto err_w32_info_user;
    }
    *usr = '\0';
    usr_dom = (LPWSTR)malloc(usr_dom_len * sizeof(WCHAR));
    if (!usr_dom) {
        goto err_w32_info_user;
    }
    *usr_dom = '\0';
    if (!LookupAccountSidW(NULL, tok_usr->User.Sid, usr, &usr_len, usr_dom, &usr_dom_len, &snu)) {
        rz_sys_perror("LookupAccountSid");
        goto err_w32_info_user;
    }
    if (*usr_dom) {
        rdi->usr = rz_str_newf("%S\\%S", usr_dom, usr);
    } else {
        rdi->usr = rz_utf16_to_utf8(usr);
    }
err_w32_info_user:
    if (h_tok) {
        CloseHandle(h_tok);
    }
    free(usr);
    free(usr_dom);
    free(tok_usr);
}

References dbg, DWORD, free(), HANDLE, LPWSTR, malloc(), NULL, W32DbgWInst::pi, rz_debug_t::plugin_data, rdi, rz_str_newf(), and rz_sys_perror.

Referenced by w32_info().

w32_init()

int w32_init

(

RzDebug *

dbg

)

Definition at line 37 of file windows_debug.c.

                           {
    if (!dbg->plugin_data) {
        dbg->plugin_data = dbg->iob.get_w32dbg_wrap(dbg->iob.io);
        if (!dbg->plugin_data) {
            return 0;
        }
    }
    // escalate privs (required for win7/vista)
    setup_debug_privileges(true);
 
    HMODULE lib = GetModuleHandleW(L"kernel32"); // Always loaded
    if (!lib) {
        return false;
    }
    // lookup function pointers for portability
    // only windows vista :(
    w32_ProcessIdToSessionId = (BOOL(WINAPI *)(DWORD, DWORD *))
        GetProcAddress(lib, "ProcessIdToSessionId");
 
    w32_QueryFullProcessImageNameW = (BOOL(WINAPI *)(HANDLE, DWORD, LPWSTR, PDWORD))
        GetProcAddress(lib, "QueryFullProcessImageNameW");
 
    // api to retrieve YMM from w7 sp1
    w32_GetEnabledXStateFeatures = (ut64(WINAPI *)())
        GetProcAddress(lib, "GetEnabledXStateFeatures");
 
    w32_InitializeContext = (BOOL(WINAPI *)(PVOID, DWORD, PCONTEXT *, PDWORD))
        GetProcAddress(lib, "InitializeContext");
 
    w32_GetXStateFeaturesMask = (BOOL(WINAPI *)(PCONTEXT Context, PDWORD64))
        GetProcAddress(lib, "GetXStateFeaturesMask");
 
    w32_LocateXStateFeature = (PVOID(WINAPI *)(PCONTEXT Context, DWORD, PDWORD))
        GetProcAddress(lib, "LocateXStateFeature");
 
    w32_SetXStateFeaturesMask = (BOOL(WINAPI *)(PCONTEXT Context, DWORD64))
        GetProcAddress(lib, "SetXStateFeaturesMask");
 
    lib = GetModuleHandleW(L"ntdll.dll");
    if (!lib) {
        eprintf("Cannot load ntdll.dll. Aborting\n");
        return false;
    }
    w32_NtQuerySystemInformation = (NTSTATUS(WINAPI *)(ULONG, PVOID, ULONG, PULONG))
        GetProcAddress(lib, "NtQuerySystemInformation");
 
    w32_NtDuplicateObject = (NTSTATUS(WINAPI *)(HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG))
        GetProcAddress(lib, "NtDuplicateObject");
 
    w32_NtQueryObject = (NTSTATUS(WINAPI *)(HANDLE, ULONG, PVOID, ULONG, PULONG))
        GetProcAddress(lib, "NtQueryObject");
 
    w32_NtQueryInformationThread = (NTSTATUS(WINAPI *)(HANDLE, ULONG, PVOID, ULONG, PULONG))
        GetProcAddress(lib, "NtQueryInformationThread");
 
    return true;
}

References ACCESS_MASK, dbg, DWORD, DWORD64, eprintf, HANDLE, rz_io_bind_t::io, rz_debug_t::iob, L, LPWSTR, PDWORD, PDWORD64, PHANDLE, rz_debug_t::plugin_data, PULONG, PVOID, setup_debug_privileges(), ULONG, and ut64().

w32_kill()

int w32_kill	(	RzDebug *	dbg,
		int	pid,
		int	tid,
		int	sig
	)

Definition at line 890 of file windows_debug.c.

                                                      {
    W32DbgWInst *wrap = dbg->plugin_data;
 
    if (sig == 0) {
        if (rz_list_empty(dbg->threads)) {
            if (lib_list) {
                rz_list_purge(lib_list);
            }
            return false;
        }
        return true;
    }
 
    bool ret = false;
    if (TerminateProcess(wrap->pi.hProcess, 1)) {
        ret = true;
    }
    wrap->pi.hProcess = NULL;
    wrap->pi.hThread = NULL;
    return ret;
}

References dbg, lib_list, NULL, W32DbgWInst::pi, rz_debug_t::plugin_data, rz_list_purge(), and rz_debug_t::threads.

w32_map_alloc()

RzDebugMap* w32_map_alloc	(	RzDebug *	dbg,
		ut64	addr,
		int	size
	)

Definition at line 1186 of file windows_debug.c.

                                                             {
    W32DbgWInst *wrap = dbg->plugin_data;
    LPVOID base = VirtualAllocEx(wrap->pi.hProcess, (LPVOID)addr, (SIZE_T)size, MEM_COMMIT, PAGE_READWRITE);
    if (!base) {
        rz_sys_perror("VirtualAllocEx");
        return NULL;
    }
    rz_debug_map_sync(dbg);
    return rz_debug_map_get(dbg, (ut64)base);
}

References addr, dbg, NULL, W32DbgWInst::pi, rz_debug_t::plugin_data, rz_debug_map_get(), rz_debug_map_sync(), rz_sys_perror, and ut64().

w32_map_dealloc()

int w32_map_dealloc	(	RzDebug *	dbg,
		ut64	addr,
		int	size
	)

Definition at line 1197 of file windows_debug.c.

                                                       {
    W32DbgWInst *wrap = dbg->plugin_data;
    if (!VirtualFreeEx(wrap->pi.hProcess, (LPVOID)addr, 0, MEM_RELEASE)) {
        rz_sys_perror("VirtualFreeEx");
        return false;
    }
    return true;
}

References addr, dbg, W32DbgWInst::pi, rz_debug_t::plugin_data, and rz_sys_perror.

w32_map_protect()

int w32_map_protect	(	RzDebug *	dbg,
		ut64	addr,
		int	size,
		int	perms
	)

Definition at line 1229 of file windows_debug.c.

                                                                  {
    DWORD old;
    W32DbgWInst *wrap = dbg->plugin_data;
    return VirtualProtectEx(wrap->pi.hProcess, (LPVOID)(size_t)addr,
        size, io_perms_to_prot(perms), &old);
}

References addr, dbg, DWORD, io_perms_to_prot(), W32DbgWInst::pi, and rz_debug_t::plugin_data.

w32_pid_list()

RzList* w32_pid_list	(	RzDebug *	dbg,
		int	pid,
		RzList *	list
	)

Definition at line 1443 of file windows_debug.c.

                                                          {
    W32DbgWInst *wrap = dbg->plugin_data;
    HANDLE sh = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, pid);
    if (sh == INVALID_HANDLE_VALUE) {
        rz_sys_perror("CreateToolhelp32Snapshot");
        return list;
    }
    PROCESSENTRY32W pe;
    pe.dwSize = sizeof(pe);
    if (Process32FirstW(sh, &pe)) {
        bool all = pid == 0;
        do {
            if (all || pe.th32ProcessID == pid || pe.th32ParentProcessID == pid) {
                // Returns NULL if process is inaccessible unless if its a child process of debugged process
                RzDebugPid *dbg_pid = build_debug_pid(pe.th32ProcessID, pe.th32ParentProcessID,
                    dbg->pid == pe.th32ProcessID ? wrap->pi.hProcess : NULL, pe.szExeFile);
                if (dbg_pid) {
                    rz_list_append(list, dbg_pid);
                }
            }
        } while (Process32NextW(sh, &pe));
    } else {
        rz_sys_perror("Process32First");
    }
    CloseHandle(sh);
    return list;
}

References test_group_name::all, build_debug_pid(), dbg, HANDLE, INVALID_HANDLE_VALUE, list(), NULL, W32DbgWInst::pi, rz_debug_t::pid, pid, rz_debug_t::plugin_data, rz_list_append(), and rz_sys_perror.

w32_reg_read()

int w32_reg_read	(	RzDebug *	dbg,
		int	type,
		ut8 *	buf,
		int	size
	)

Definition at line 544 of file windows_debug.c.

                                                             {
    bool showfpu = false;
    if (type < -1) {
        showfpu = true; // hack for debugging
        type = -type;
    }
    bool alive = is_thread_alive(dbg, dbg->tid);
    HANDLE th = get_thread_handle_from_tid(dbg, dbg->tid);
    if (!th || th == INVALID_HANDLE_VALUE) {
        return 0;
    }
    // Always suspend
    if (alive && suspend_thread(th) == -1) {
        return 0;
    }
    size = get_thread_context(th, buf, size, CONTEXT_ALL);
    if (showfpu) {
        print_fpu_context(th, (CONTEXT *)buf);
    }
    // Always resume
    if (alive && resume_thread(th) == -1) {
        size = 0;
    }
    return size;
}

References CONTEXT_ALL, dbg, get_thread_context(), get_thread_handle_from_tid(), HANDLE, INVALID_HANDLE_VALUE, is_thread_alive(), print_fpu_context(), resume_thread(), suspend_thread(), rz_debug_t::tid, and type.

Referenced by w32_thread_list().

w32_reg_write()

int w32_reg_write	(	RzDebug *	dbg,
		int	type,
		const ut8 *	buf,
		int	size
	)

Definition at line 570 of file windows_debug.c.

                                                                    {
    bool alive = is_thread_alive(dbg, dbg->tid);
    if (!alive) {
        return false;
    }
    HANDLE th = get_thread_handle_from_tid(dbg, dbg->tid);
    if (!th || th == INVALID_HANDLE_VALUE) {
        return 0;
    }
    // Always suspend
    if (suspend_thread(th) == -1) {
        return false;
    }
    if (type == RZ_REG_TYPE_DRX) {
        transfer_drx(dbg, buf);
    }
    bool ret = set_thread_context(th, buf, size);
    // Always resume
    if (resume_thread(th) == -1) {
        ret = false;
    }
    return ret;
}

References dbg, get_thread_handle_from_tid(), HANDLE, INVALID_HANDLE_VALUE, is_thread_alive(), resume_thread(), RZ_REG_TYPE_DRX, set_thread_context(), suspend_thread(), rz_debug_t::tid, transfer_drx(), and type.

w32_select()

int w32_select	(	RzDebug *	dbg,
		int	pid,
		int	tid
	)

Definition at line 837 of file windows_debug.c.

                                               {
    RzListIter *it;
    W32DbgWInst *wrap = dbg->plugin_data;
 
    // Re-attach to a different pid
    if (dbg->pid > -1 && dbg->pid != pid) {
        return w32_attach_new_process(dbg, pid);
    }
 
    if (dbg->tid == -1) {
        return tid;
    }
 
    if (!dbg->threads) {
        dbg->threads = rz_list_newf(free);
        return tid;
    }
 
    if (rz_list_empty(dbg->threads)) {
        return tid;
    }
 
    PTHREAD_ITEM th = find_thread(dbg, tid);
 
    int selected = 0;
    if (th && is_thread_alive(dbg, th->tid)) {
        wrap->pi.hThread = th->hThread;
        selected = tid;
    } else if (tid) {
        // If thread is dead, search for another one
        rz_list_foreach (dbg->threads, it, th) {
            if (!is_thread_alive(dbg, th->tid)) {
                continue;
            }
            wrap->pi.hThread = th->hThread;
            selected = th->tid;
            break;
        }
    }
 
    if (dbg->corebind.cfggeti(dbg->corebind.core, "dbg.threads")) {
        // Suspend all other threads
        rz_list_foreach (dbg->threads, it, th) {
            if (!th->bFinished && !th->bSuspended && th->tid != selected) {
                suspend_thread(th->hThread);
                th->bSuspended = true;
            }
        }
    }
 
    return selected;
}

References THREAD_ITEM::bFinished, THREAD_ITEM::bSuspended, rz_core_bind_t::cfggeti, rz_core_bind_t::core, rz_debug_t::corebind, dbg, find_thread(), free(), THREAD_ITEM::hThread, is_thread_alive(), W32DbgWInst::pi, rz_debug_t::pid, pid, rz_debug_t::plugin_data, rz_list_newf(), suspend_thread(), rz_debug_t::threads, THREAD_ITEM::tid, rz_debug_t::tid, and w32_attach_new_process().

Referenced by w32_break_process(), w32_continue(), and w32_dbg_wait().

w32_step()

int w32_step

(

RzDebug *

dbg

)

Definition at line 395 of file windows_debug.c.

                           {
    // Do nothing (not supported)
    return 0;
}

w32_thread_list()

RzList* w32_thread_list	(	RzDebug *	dbg,
		int	pid,
		RzList *	list
	)

Definition at line 1280 of file windows_debug.c.

                                                             {
    // pid is not respected for TH32CS_SNAPTHREAD flag
    HANDLE th = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (th == INVALID_HANDLE_VALUE) {
        rz_sys_perror("CreateToolhelp32Snapshot");
        return list;
    }
    THREADENTRY32 te;
    te.dwSize = sizeof(te);
    HANDLE ph = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
    if (Thread32First(th, &te)) {
        // TODO: export this code to its own function?
        char *path = NULL;
        int uid = -1;
        if (!te.th32ThreadID) {
            path = get_process_path(ph, pid);
            DWORD sid;
            if (w32_ProcessIdToSessionId && w32_ProcessIdToSessionId(pid, &sid)) {
                uid = sid;
            }
        }
        if (!path) {
            // TODO: enum processes to get binary's name
            path = strdup("???");
        }
        int saved_tid = dbg->tid;
        do {
            char status = RZ_DBG_PROC_SLEEP;
            if (te.th32OwnerProcessID == pid) {
                ut64 pc = 0;
                if (dbg->pid == pid) {
                    CONTEXT ctx = { 0 };
                    dbg->tid = te.th32ThreadID;
                    w32_reg_read(dbg, RZ_REG_TYPE_GPR, (ut8 *)&ctx, sizeof(ctx));
                    // TODO: is needed check context for x32 and x64??
                    pc = pc_from_context(&ctx);
                    PTHREAD_ITEM pthread = find_thread(dbg, te.th32ThreadID);
                    if (pthread) {
                        if (pthread->bFinished) {
                            status = RZ_DBG_PROC_DEAD;
                        } else if (pthread->bSuspended) {
                            status = RZ_DBG_PROC_SLEEP;
                        } else {
                            status = RZ_DBG_PROC_RUN; // TODO: Get more precise thread status
                        }
                    }
                }
                rz_list_append(list, rz_debug_pid_new(path, te.th32ThreadID, uid, status, pc));
            }
        } while (Thread32Next(th, &te));
        dbg->tid = saved_tid;
        free(path);
    } else {
        rz_sys_perror("Thread32First");
    }
    CloseHandle(th);
    return list;
}

References THREAD_ITEM::bFinished, THREAD_ITEM::bSuspended, dbg, DWORD, FALSE, find_thread(), free(), get_process_path(), HANDLE, INVALID_HANDLE_VALUE, list(), NULL, path, pc, pc_from_context(), ph, rz_debug_t::pid, pid, RZ_DBG_PROC_DEAD, RZ_DBG_PROC_RUN, RZ_DBG_PROC_SLEEP, rz_debug_pid_new(), rz_list_append(), RZ_REG_TYPE_GPR, rz_sys_perror, status, strdup(), rz_debug_t::tid, ut64(), and w32_reg_read().

Variable Documentation

breaked

bool breaked = false

static

Definition at line 815 of file windows_debug.c.

Referenced by rz_analysis_block_recurse(), rz_analysis_block_recurse_depth_first(), rz_analysis_block_recurse_followthrough(), rz_cons_break_clear(), rz_cons_break_end(), rz_cons_is_breaked(), rz_cons_memcat(), w32_break_process(), w32_continue(), and w32_dbg_wait().

lib_list

RzList* lib_list = NULL

static

Definition at line 12 of file windows_debug.c.

Referenced by add_library(), find_library(), last_library(), remove_library(), w32_dbg_wait(), w32_detach(), and w32_kill().

wait_time

const DWORD wait_time = 1000

Definition at line 11 of file windows_debug.c.

Referenced by w32_dbg_wait().