#include <rz_types.h>
#include <rz_debug.h>
#include <rz_windows.h>
#include <tlhelp32.h>
#include <psapi.h>
#include <winternl.h>
#include <tchar.h>
#include <w32dbg_wrap.h>

Go to the source code of this file.

Classes
struct	_SYSTEM_HANDLE

struct	_SYSTEM_HANDLE_INFORMATION

struct	_OBJECT_TYPE_INFORMATION

struct	THREAD_ITEM

struct	LIB_ITEM

Macros
#define	XSTATE_GSSE 2

#define	XSTATE_LEGACY_SSE 1

#define	XSTATE_MASK_GSSE (1LLU << (XSTATE_GSSE))

#define	CONTEXT_XSTATE (0x00010040)

#define	XSTATE_AVX (XSTATE_GSSE)

#define	XSTATE_MASK_AVX (XSTATE_MASK_GSSE)

#define	CONTEXT_ALL 1048607

Typedefs
typedef struct _SYSTEM_HANDLE	SYSTEM_HANDLE

typedef struct _SYSTEM_HANDLE *	PSYSTEM_HANDLE

typedef struct _SYSTEM_HANDLE_INFORMATION	SYSTEM_HANDLE_INFORMATION

typedef struct _SYSTEM_HANDLE_INFORMATION *	PSYSTEM_HANDLE_INFORMATION

typedef enum _POOL_TYPE	POOL_TYPE

typedef enum _POOL_TYPE *	PPOOL_TYPE

typedef struct _OBJECT_TYPE_INFORMATION	OBJECT_TYPE_INFORMATION

typedef struct _OBJECT_TYPE_INFORMATION *	POBJECT_TYPE_INFORMATION

typedef struct THREAD_ITEM *	PTHREAD_ITEM

typedef struct LIB_ITEM *	PLIB_ITEM

Enumerations
enum	_POOL_TYPE { NonPagedPool , PagedPool , NonPagedPoolMustSucceed , DontUseThisType , NonPagedPoolCacheAligned , PagedPoolCacheAligned , NonPagedPoolCacheAlignedMustS }

Functions
	ut64 (WINAPI *w32_GetEnabledXStateFeatures)()

int	w32_init (RzDebug *dbg)

int	w32_reg_read (RzDebug dbg, int type, ut8 buf, int size)

int	w32_reg_write (RzDebug dbg, int type, const ut8 buf, int size)

int	w32_attach (RzDebug *dbg, int pid)

int	w32_detach (RzDebug *dbg, int pid)

int	w32_attach_new_process (RzDebug *dbg, int pid)

int	w32_select (RzDebug *dbg, int pid, int tid)

int	w32_kill (RzDebug *dbg, int pid, int tid, int sig)

void	w32_break_process (void *user)

int	w32_dbg_wait (RzDebug *dbg, int pid)

int	w32_step (RzDebug *dbg)

int	w32_continue (RzDebug *dbg, int pid, int tid, int sig)

RzDebugMap *	w32_map_alloc (RzDebug *dbg, ut64 addr, int size)

int	w32_map_dealloc (RzDebug *dbg, ut64 addr, int size)

int	w32_map_protect (RzDebug *dbg, ut64 addr, int size, int perms)

RzList *	w32_thread_list (RzDebug dbg, int pid, RzList list)

RzDebugInfo *	w32_info (RzDebug dbg, const char arg)

RzList *	w32_pid_list (RzDebug dbg, int pid, RzList list)

RzList *	w32_desc_list (int pid)

Variables
	DWORD

DWORD *	HANDLE

DWORD	LPWSTR

DWORD	PDWORD

	ULONG

	PVOID

	PULONG

	PHANDLE

	ACCESS_MASK

PCONTEXT	Context

PCONTEXT	PDWORD64

PCONTEXT	DWORD64

Macro Definition Documentation

◆ CONTEXT_ALL

#define CONTEXT_ALL 1048607

Definition at line 43 of file windows_debug.h.

◆ CONTEXT_XSTATE

#define CONTEXT_XSTATE (0x00010040)

Definition at line 38 of file windows_debug.h.

◆ XSTATE_AVX

#define XSTATE_AVX (XSTATE_GSSE)

Definition at line 40 of file windows_debug.h.

◆ XSTATE_GSSE

#define XSTATE_GSSE 2

Definition at line 23 of file windows_debug.h.

◆ XSTATE_LEGACY_SSE

#define XSTATE_LEGACY_SSE 1

Definition at line 27 of file windows_debug.h.

◆ XSTATE_MASK_AVX

#define XSTATE_MASK_AVX (XSTATE_MASK_GSSE)

Definition at line 41 of file windows_debug.h.

◆ XSTATE_MASK_GSSE

#define XSTATE_MASK_GSSE (1LLU << (XSTATE_GSSE))

Definition at line 31 of file windows_debug.h.

Typedef Documentation

◆ OBJECT_TYPE_INFORMATION

typedef struct _OBJECT_TYPE_INFORMATION OBJECT_TYPE_INFORMATION

◆ PLIB_ITEM

typedef struct LIB_ITEM * PLIB_ITEM

◆ POBJECT_TYPE_INFORMATION

typedef struct _OBJECT_TYPE_INFORMATION * POBJECT_TYPE_INFORMATION

◆ POOL_TYPE

typedef enum _POOL_TYPE POOL_TYPE

◆ PPOOL_TYPE

typedef enum _POOL_TYPE * PPOOL_TYPE

◆ PSYSTEM_HANDLE

typedef struct _SYSTEM_HANDLE * PSYSTEM_HANDLE

◆ PSYSTEM_HANDLE_INFORMATION

typedef struct _SYSTEM_HANDLE_INFORMATION * PSYSTEM_HANDLE_INFORMATION

◆ PTHREAD_ITEM

typedef struct THREAD_ITEM * PTHREAD_ITEM

◆ SYSTEM_HANDLE

typedef struct _SYSTEM_HANDLE SYSTEM_HANDLE

◆ SYSTEM_HANDLE_INFORMATION

typedef struct _SYSTEM_HANDLE_INFORMATION SYSTEM_HANDLE_INFORMATION

Enumeration Type Documentation

◆ _POOL_TYPE

enum _POOL_TYPE

Enumerator
NonPagedPool
PagedPool
NonPagedPoolMustSucceed
DontUseThisType
NonPagedPoolCacheAligned
PagedPoolCacheAligned
NonPagedPoolCacheAlignedMustS

Definition at line 60 of file windows_debug.h.

                         {
     NonPagedPool,
     PagedPool,
     NonPagedPoolMustSucceed,
     DontUseThisType,
     NonPagedPoolCacheAligned,
     PagedPoolCacheAligned,
     NonPagedPoolCacheAlignedMustS
 } POOL_TYPE,

Function Documentation

◆ ut64()

ut64 ( WINAPI * w32_GetEnabledXStateFeatures )

◆ w32_attach()

int w32_attach	(	RzDebug *	dbg,
		int	pid
	)

Definition at line 598 of file windows_debug.c.

                                       {
     W32DbgWInst *wrap = dbg->plugin_data;
     if (already_attached(wrap, pid)) {
         return wrap->pi.dwThreadId;
     }
     if (wrap->pi.hProcess && wrap->pi.hProcess != INVALID_HANDLE_VALUE) {
         CloseHandle(wrap->pi.hProcess);
     }
     dbg->main_pid = pid;
     wrap->pi.dwProcessId = pid;
     wrap->params.type = W32_ATTACH;
     w32dbg_wrap_wait_ret(wrap);
     if (!wrap->params.ret) {
         w32dbgw_err(wrap);
         rz_sys_perror("DebugActiveProcess");
         wrap->pi.hProcess = NULL;
         wrap->pi.dwProcessId = 0;
         return -1;
     }
     dbg->cur->wait(dbg, pid);
     rz_debug_continue(dbg);
     return wrap->pi.dwThreadId;
 }

References already_attached(), rz_debug_t::cur, dbg, INVALID_HANDLE_VALUE, rz_debug_t::main_pid, NULL, W32DbgWInst::params, W32DbgWInst::pi, pid, rz_debug_t::plugin_data, W32DbgWParams::ret, rz_debug_continue(), rz_sys_perror, W32DbgWParams::type, W32_ATTACH, w32dbg_wrap_wait_ret(), w32dbgw_err, and rz_debug_plugin_t::wait.

Referenced by w32_attach_new_process().

◆ w32_attach_new_process()

int w32_attach_new_process	(	RzDebug *	dbg,
		int	pid
	)

Definition at line 817 of file windows_debug.c.

                                                   {
     int tid = -1;
  
     if (!w32_detach(dbg, dbg->pid)) {
         eprintf("Failed to detach from (%d)\n", dbg->pid);
         return -1;
     }
  
     if ((tid = w32_attach(dbg, pid)) < 0) {
         eprintf("Failed to attach to (%d)\n", pid);
         return -1;
     }
  
     dbg->tid = tid;
     dbg->pid = pid;
     // Call select to sync the new pid's data
     rz_debug_select(dbg, pid, tid);
     return dbg->tid;
 }

References dbg, eprintf, rz_debug_t::pid, pid, rz_debug_select(), rz_debug_t::tid, w32_attach(), and w32_detach().

Referenced by w32_select().

◆ w32_break_process()

void w32_break_process ( void * user )

Definition at line 912 of file windows_debug.c.

                                    {
     RzDebug *dbg = (RzDebug *)user;
     W32DbgWInst *wrap = dbg->plugin_data;
     if (dbg->corebind.cfggeti(dbg->corebind.core, "dbg.threads")) {
         w32_select(dbg, wrap->pi.dwProcessId, -1); // Suspend all threads
     } else {
         if (!DebugBreakProcess(wrap->pi.hProcess)) {
             rz_sys_perror("DebugBreakProcess");
             eprintf("Could not interrupt program, attempt to press Ctrl-C in the program's console.\n");
         }
     }
  
     breaked = true;
 }

References breaked, rz_core_bind_t::cfggeti, rz_core_bind_t::core, rz_debug_t::corebind, dbg, eprintf, W32DbgWInst::pi, rz_debug_t::plugin_data, rz_sys_perror, and w32_select().

Referenced by w32_dbg_wait().

◆ w32_continue()

int w32_continue	(	RzDebug *	dbg,
		int	pid,
		int	tid,
		int	sig
	)

Definition at line 1144 of file windows_debug.c.

                                                           {
     if (tid != dbg->tid) {
         dbg->tid = w32_select(dbg, pid, tid);
     }
     // Don't continue with a thread that wasn't requested
     if (dbg->tid != tid) {
         return -1;
     }
  
     if (breaked) {
         breaked = false;
         return -1;
     }
  
     PTHREAD_ITEM th = find_thread(dbg, tid);
     if (th && th->hThread != INVALID_HANDLE_VALUE && th->bSuspended) {
         continue_thread(th->hThread);
         th->bSuspended = false;
     }
  
     W32DbgWInst *wrap = dbg->plugin_data;
     wrap->params.type = W32_CONTINUE;
  
     /* Honor the Windows-specific signal that instructs threads to process exceptions */
     wrap->params.continue_status = (sig == DBG_EXCEPTION_NOT_HANDLED)
         ? DBG_EXCEPTION_NOT_HANDLED
         : DBG_EXCEPTION_HANDLED;
  
     w32dbg_wrap_wait_ret(wrap);
     if (!w32dbgw_ret(wrap)) {
         w32dbgw_err(wrap);
         rz_sys_perror("ContinueDebugEvent");
         return -1;
     }
  
     if (th && th->bFinished) {
         rz_list_delete_data(dbg->threads, th);
     }
  
     return tid;
 }

References THREAD_ITEM::bFinished, breaked, THREAD_ITEM::bSuspended, W32DbgWParams::continue_status, continue_thread(), dbg, find_thread(), THREAD_ITEM::hThread, INVALID_HANDLE_VALUE, W32DbgWInst::params, pid, rz_debug_t::plugin_data, rz_list_delete_data(), rz_sys_perror, rz_debug_t::threads, rz_debug_t::tid, W32DbgWParams::type, W32_CONTINUE, w32_select(), w32dbg_wrap_wait_ret(), w32dbgw_err, and w32dbgw_ret.

Referenced by w32_dbg_wait().

◆ w32_dbg_wait()

int w32_dbg_wait	(	RzDebug *	dbg,
		int	pid
	)

Definition at line 927 of file windows_debug.c.

                                         {
     W32DbgWInst *wrap = dbg->plugin_data;
     DEBUG_EVENT de;
     int tid, next_event = 0;
     char *dllname = NULL;
     int ret = RZ_DEBUG_REASON_UNKNOWN;
     static int exited_already = 0;
  
     rz_cons_break_push(w32_break_process, dbg);
  
     /* handle debug events */
     do {
         /* do not continue when already exited but still open for examination */
         if (exited_already == pid) {
             return RZ_DEBUG_REASON_DEAD;
         }
         memset(&de, 0, sizeof(DEBUG_EVENT));
         do {
             wrap->params.type = W32_WAIT;
             wrap->params.wait.de = &de;
             wrap->params.wait.wait_time = wait_time;
             void *bed = rz_cons_sleep_begin();
             w32dbg_wrap_wait_ret(wrap);
             rz_cons_sleep_end(bed);
             if (!w32dbgw_ret(wrap)) {
                 if (w32dbgw_err(wrap) != ERROR_SEM_TIMEOUT) {
                     rz_sys_perror("WaitForDebugEvent");
                     ret = -1;
                     goto end;
                 }
                 if (!is_thread_alive(dbg, dbg->tid)) {
                     ret = w32_select(dbg, dbg->pid, dbg->tid);
                     if (ret == -1) {
                         ret = RZ_DEBUG_REASON_DEAD;
                         goto end;
                     }
                 }
             } else {
                 break;
             }
         } while (!breaked);
  
         if (breaked) {
             ret = RZ_DEBUG_REASON_USERSUSP;
             breaked = false;
         }
  
         dbg->tid = tid = de.dwThreadId;
         dbg->pid = pid = de.dwProcessId;
  
         /* TODO: DEBUG_CONTROL_C */
         switch (de.dwDebugEventCode) {
         case CREATE_PROCESS_DEBUG_EVENT:
             CloseHandle(de.u.CreateProcessInfo.hFile);
             add_thread(dbg, pid, tid, de.u.CreateProcessInfo.hThread, de.u.CreateProcessInfo.lpThreadLocalBase, de.u.CreateProcessInfo.lpStartAddress, FALSE);
             wrap->pi.hProcess = de.u.CreateProcessInfo.hProcess;
             wrap->pi.hThread = de.u.CreateProcessInfo.hThread;
             wrap->winbase = (ULONG_PTR)de.u.CreateProcessInfo.lpBaseOfImage;
             ret = RZ_DEBUG_REASON_NEW_PID;
             next_event = 0;
             break;
         case CREATE_THREAD_DEBUG_EVENT:
             add_thread(dbg, pid, tid, de.u.CreateThread.hThread, de.u.CreateThread.lpThreadLocalBase, de.u.CreateThread.lpStartAddress, FALSE);
             if (ret != RZ_DEBUG_REASON_USERSUSP) {
                 ret = RZ_DEBUG_REASON_NEW_TID;
             }
             dbg->corebind.cmdf(dbg->corebind.core, "f teb.%d @ 0x%p", tid, de.u.CreateThread.lpThreadLocalBase);
             next_event = 0;
             break;
         case EXIT_PROCESS_DEBUG_EVENT:
         case EXIT_THREAD_DEBUG_EVENT: {
             PTHREAD_ITEM th = find_thread(dbg, tid);
             if (th) {
                 th->bFinished = TRUE;
                 th->dwExitCode = de.u.ExitThread.dwExitCode;
             } else {
                 rz_warn_if_reached();
             }
             dbg->corebind.cmdf(dbg->corebind.core, "f- teb.%d", tid);
             if (de.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT) {
                 exited_already = pid;
                 w32_continue(dbg, pid, tid, DBG_CONTINUE);
                 ret = pid == dbg->main_pid ? RZ_DEBUG_REASON_DEAD : RZ_DEBUG_REASON_EXIT_PID;
             } else {
                 ret = RZ_DEBUG_REASON_EXIT_TID;
             }
             next_event = 0;
             break;
         }
         case LOAD_DLL_DEBUG_EVENT:
             dllname = resolve_path(wrap->pi.hProcess, de.u.LoadDll.hFile);
             if (dllname) {
                 add_library(pid, de.u.LoadDll.lpBaseOfDll, de.u.LoadDll.hFile, dllname);
                 free(dllname);
             }
             ret = RZ_DEBUG_REASON_NEW_LIB;
             next_event = 0;
             break;
         case UNLOAD_DLL_DEBUG_EVENT: {
             PLIB_ITEM lib = (PLIB_ITEM)find_library(de.u.UnloadDll.lpBaseOfDll);
             if (lib) {
                 remove_library(lib);
             }
             ret = RZ_DEBUG_REASON_EXIT_LIB;
             next_event = 0;
             break;
         }
         case OUTPUT_DEBUG_STRING_EVENT: {
             char *str = calloc(de.u.DebugString.nDebugStringLength, sizeof(WCHAR));
             ReadProcessMemory(wrap->pi.hProcess, de.u.DebugString.lpDebugStringData, str, de.u.DebugString.nDebugStringLength, NULL);
             char *tmp = de.u.DebugString.fUnicode
                 ? rz_utf16_to_utf8((wchar_t *)str)
                 : rz_acp_to_utf8(str);
             if (tmp) {
                 free(str);
                 str = tmp;
             }
             eprintf("(%d) Debug string: %s\n", pid, str);
             free(str);
             w32_continue(dbg, pid, tid, DBG_EXCEPTION_NOT_HANDLED);
             next_event = 1;
             break;
         }
         case RIP_EVENT:
             eprintf("(%d) RIP event\n", pid);
             w32_continue(dbg, pid, tid, -1);
             next_event = 1;
             // XXX unknown ret = RZ_DEBUG_REASON_TRAP;
             break;
         case EXCEPTION_DEBUG_EVENT:
             dbg->reason.signum = DBG_EXCEPTION_NOT_HANDLED;
             switch (de.u.Exception.ExceptionRecord.ExceptionCode) {
             case DBG_CONTROL_C:
                 eprintf("Received CTRL+C, suspending execution\n");
                 ret = RZ_DEBUG_REASON_SIGNAL;
                 next_event = 0;
                 break;
 #if _WIN64
             case 0x4000001f: /* STATUS_WX86_BREAKPOINT */
 #endif
             case EXCEPTION_BREAKPOINT:
                 ret = RZ_DEBUG_REASON_BREAKPOINT;
                 next_event = 0;
                 break;
 #if _WIN64
             case 0x4000001e: /* STATUS_WX86_SINGLE_STEP */
 #endif
             case EXCEPTION_SINGLE_STEP:
                 ret = RZ_DEBUG_REASON_STEP;
                 next_event = 0;
                 break;
             default:
                 if (rz_bp_get_at(dbg->bp, (size_t)de.u.Exception.ExceptionRecord.ExceptionAddress)) {
                     ret = RZ_DEBUG_REASON_BREAKPOINT;
                     next_event = 0;
                     break;
                 }
                 EXCEPTION_DEBUG_INFO *exp = &de.u.Exception;
                 windows_print_exception_event(de.dwProcessId, de.dwThreadId, exp->ExceptionRecord.ExceptionCode, exp->dwFirstChance);
                 if (windows_is_exception_fatal(de.u.Exception.ExceptionRecord.ExceptionCode)) {
                     next_event = 0;
                     dbg->reason.type = windows_exception_to_reason(de.u.Exception.ExceptionRecord.ExceptionCode);
                     dbg->reason.tid = de.dwThreadId;
                     dbg->reason.addr = (size_t)de.u.Exception.ExceptionRecord.ExceptionAddress;
                     dbg->reason.timestamp = rz_time_now();
                     ret = dbg->reason.type;
                 } else {
                     w32_continue(dbg, pid, tid, DBG_EXCEPTION_NOT_HANDLED);
                     next_event = 1;
                 }
             }
             break;
         default:
             // This case might be reached if break doesn't trigger an event
             if (ret != RZ_DEBUG_REASON_USERSUSP) {
                 eprintf("(%d) unknown event: %lu\n", pid, de.dwDebugEventCode);
                 ret = -1;
             }
             next_event = 0;
         }
     } while (next_event);
  
     if (ret != RZ_DEBUG_REASON_DEAD) {
         PTHREAD_ITEM th = find_thread(dbg, tid);
         if (th) {
             wrap->pi.hThread = th->hThread;
         } else {
             rz_warn_if_reached();
         }
     }
 #if __arm__ || __arm64__
     if (ret != RZ_DEBUG_REASON_EXIT_TID) {
         CONTEXT ctx;
         suspend_thread(wrap->pi.hThread);
         get_thread_context(wrap->pi.hThread, (ut8 *)&ctx, sizeof(ctx), CONTEXT_CONTROL);
         resume_thread(wrap->pi.hThread);
         if (ctx.Cpsr & 0x20) {
             dbg->bits = RZ_SYS_BITS_16;
         } else {
 #if __arm__
             dbg->bits = RZ_SYS_BITS_32;
 #else
             dbg->bits = RZ_SYS_BITS_64;
 #endif
         }
     }
 #endif
 end:
     if (ret == RZ_DEBUG_REASON_DEAD) {
         w32_detach(dbg, dbg->pid);
         rz_list_purge(dbg->threads);
         rz_list_purge(lib_list);
     }
     rz_cons_break_pop();
     return ret;
 }

References add_library(), add_thread(), rz_debug_reason_t::addr, THREAD_ITEM::bFinished, rz_debug_t::bits, rz_debug_t::bp, breaked, calloc(), rz_core_bind_t::cmdf, rz_core_bind_t::core, rz_debug_t::corebind, dbg, THREAD_ITEM::dwExitCode, test_evm::end, eprintf, EXCEPTION_BREAKPOINT, EXCEPTION_SINGLE_STEP, FALSE, find_library(), find_thread(), free(), get_thread_context(), THREAD_ITEM::hThread, is_thread_alive(), lib_list, rz_debug_t::main_pid, memset(), NULL, W32DbgWInst::params, W32DbgWInst::pi, rz_debug_t::pid, pid, rz_debug_t::plugin_data, rz_debug_t::reason, remove_library(), resolve_path(), resume_thread(), rz_bp_get_at(), rz_cons_break_pop(), rz_cons_break_push(), rz_cons_sleep_begin(), rz_cons_sleep_end(), RZ_DEBUG_REASON_BREAKPOINT, RZ_DEBUG_REASON_DEAD, RZ_DEBUG_REASON_EXIT_LIB, RZ_DEBUG_REASON_EXIT_PID, RZ_DEBUG_REASON_EXIT_TID, RZ_DEBUG_REASON_NEW_LIB, RZ_DEBUG_REASON_NEW_PID, RZ_DEBUG_REASON_NEW_TID, RZ_DEBUG_REASON_SIGNAL, RZ_DEBUG_REASON_STEP, RZ_DEBUG_REASON_UNKNOWN, RZ_DEBUG_REASON_USERSUSP, rz_list_purge(), RZ_SYS_BITS_16, RZ_SYS_BITS_32, RZ_SYS_BITS_64, rz_sys_perror, rz_time_now(), rz_warn_if_reached, rz_debug_reason_t::signum, cmd_descs_generate::str, suspend_thread(), rz_debug_t::threads, rz_debug_reason_t::tid, rz_debug_t::tid, rz_debug_reason_t::timestamp, autogen_x86imm::tmp, TRUE, rz_debug_reason_t::type, W32DbgWParams::type, w32_break_process(), w32_continue(), w32_detach(), w32_select(), W32_WAIT, w32dbg_wrap_wait_ret(), w32dbgw_err, w32dbgw_ret, W32DbgWParams::wait, wait_time, W32DbgWInst::winbase, windows_exception_to_reason(), windows_is_exception_fatal(), and windows_print_exception_event().

◆ w32_desc_list()

RzList* w32_desc_list ( int pid )

Definition at line 1471 of file windows_debug.c.

                                {
     HANDLE ph;
     if (!(ph = OpenProcess(PROCESS_DUP_HANDLE, FALSE, pid))) {
         return NULL;
     }
     ULONG handleInfoSize = 0x10000;
     POBJECT_TYPE_INFORMATION objectTypeInfo = malloc(0x1000);
     if (!objectTypeInfo) {
         CloseHandle(ph);
         return NULL;
     }
     RzDebugDesc *desc;
     NTSTATUS status;
     PSYSTEM_HANDLE_INFORMATION handleInfo = NULL;
     PVOID objectNameInfo = NULL;
     RzList *ret = rz_list_newf((RzListFree)rz_debug_desc_free);
     if (!ret) {
         goto beach;
     }
     handleInfo = (PSYSTEM_HANDLE_INFORMATION)malloc(handleInfoSize);
     while ((status = w32_NtQuerySystemInformation(SystemHandleInformation, handleInfo, handleInfoSize, NULL)) == STATUS_INFO_LENGTH_MISMATCH) {
         handleInfoSize *= 2;
         void *tmp = realloc(handleInfo, (size_t)handleInfoSize);
         if (tmp) {
             handleInfo = (PSYSTEM_HANDLE_INFORMATION)tmp;
         } else {
             goto beach;
         }
     }
     if (status) {
         rz_sys_perror("NtQuerySystemInformation");
         goto beach;
     }
     size_t objectNameInfo_sz = 0x1000;
     objectNameInfo = malloc(objectNameInfo_sz);
     if (!objectNameInfo) {
         goto beach;
     }
     int i;
     for (i = 0; i < handleInfo->HandleCount; i++) {
         SYSTEM_HANDLE handle = handleInfo->Handles[i];
         HANDLE dupHandle = NULL;
         ULONG returnLength;
         int perms = 0;
         if (handle.ProcessId != pid) {
             continue;
         }
         if (w32_NtDuplicateObject(ph, (HANDLE)(size_t)handle.Handle, GetCurrentProcess(), &dupHandle, 0, 0, 0)) {
             continue;
         }
         if (w32_NtQueryObject(dupHandle, 2, objectTypeInfo, 0x1000, NULL)) {
             CloseHandle(dupHandle);
             continue;
         }
         if (wcscmp(objectTypeInfo->Name.Buffer, L"File")) {
             CloseHandle(dupHandle);
             continue;
         }
         GENERIC_MAPPING *gm = &objectTypeInfo->GenericMapping;
         if ((handle.GrantedAccess & gm->GenericRead) == gm->GenericRead) {
             perms |= RZ_PERM_R;
         }
         if ((handle.GrantedAccess & gm->GenericWrite) == gm->GenericWrite) {
             perms |= RZ_PERM_W;
         }
         if ((handle.GrantedAccess & gm->GenericExecute) == gm->GenericExecute) {
             perms |= RZ_PERM_X;
         }
         if (w32_NtQueryObject(dupHandle, 1, objectNameInfo, objectNameInfo_sz, &returnLength)) {
             void *tmp = realloc(objectNameInfo, returnLength);
             if (tmp) {
                 objectNameInfo = tmp;
                 objectNameInfo_sz = returnLength;
             }
             if (w32_NtQueryObject(dupHandle, 1, objectNameInfo, objectNameInfo_sz, NULL)) {
                 CloseHandle(dupHandle);
                 continue;
             }
         }
         PUNICODE_STRING objectName = objectNameInfo;
         if (objectName->Length) {
             char *name = rz_utf16_to_utf8_l(objectName->Buffer, objectName->Length / 2);
             desc = rz_debug_desc_new(handle.Handle, name, perms, '?', 0);
             if (!desc) {
                 free(name);
                 break;
             }
             rz_list_append(ret, desc);
             free(name);
         } else {
             char *name = rz_utf16_to_utf8_l(objectTypeInfo->Name.Buffer, objectTypeInfo->Name.Length / 2);
             desc = rz_debug_desc_new(handle.Handle, name, perms, '?', 0);
             if (!desc) {
                 free(name);
                 break;
             }
             rz_list_append(ret, desc);
             free(name);
         }
         CloseHandle(dupHandle);
     }
 beach:
     free(objectNameInfo);
     free(objectTypeInfo);
     free(handleInfo);
     CloseHandle(ph);
     return ret;
 }

References _UNICODE_STRING::Buffer, desc, FALSE, free(), _OBJECT_TYPE_INFORMATION::GenericMapping, handle, HANDLE, _SYSTEM_HANDLE_INFORMATION::HandleCount, _SYSTEM_HANDLE_INFORMATION::Handles, i, L, _UNICODE_STRING::Length, malloc(), _OBJECT_TYPE_INFORMATION::Name, NULL, ph, pid, PVOID, realloc(), rz_debug_desc_free(), rz_debug_desc_new(), rz_list_append(), rz_list_newf(), RZ_PERM_R, RZ_PERM_W, RZ_PERM_X, rz_sys_perror, status, STATUS_INFO_LENGTH_MISMATCH, SystemHandleInformation, autogen_x86imm::tmp, and ULONG.

◆ w32_detach()

int w32_detach	(	RzDebug *	dbg,
		int	pid
	)

Definition at line 622 of file windows_debug.c.

                                       {
     if (pid == -1 || dbg->pid != pid) {
         return false;
     }
  
     // Resume suspended threads
     RzListIter *it;
     PTHREAD_ITEM th;
     rz_list_foreach (dbg->threads, it, th) {
         if (th->bSuspended && !th->bFinished) {
             resume_thread(th->hThread);
         }
     }
     rz_list_purge(dbg->threads);
     if (lib_list) {
         rz_list_purge(lib_list);
     }
     W32DbgWInst *wrap = dbg->plugin_data;
     bool ret = false;
     wrap->pi.dwProcessId = pid;
     wrap->params.type = W32_DETACH;
     w32dbg_wrap_wait_ret(wrap);
     ret = wrap->params.ret;
     memset(&wrap->pi, 0, sizeof(wrap->pi));
     return ret;
 }

References THREAD_ITEM::bFinished, THREAD_ITEM::bSuspended, dbg, THREAD_ITEM::hThread, lib_list, memset(), W32DbgWInst::params, W32DbgWInst::pi, rz_debug_t::pid, pid, rz_debug_t::plugin_data, resume_thread(), W32DbgWParams::ret, rz_list_purge(), rz_debug_t::threads, W32DbgWParams::type, W32_DETACH, and w32dbg_wrap_wait_ret().

Referenced by w32_attach_new_process(), and w32_dbg_wait().

◆ w32_info()

RzDebugInfo* w32_info	(	RzDebug *	dbg,
		const char *	arg
	)

Definition at line 1404 of file windows_debug.c.

                                                      {
     RzDebugInfo *rdi = RZ_NEW0(RzDebugInfo);
     if (!rdi) {
         return NULL;
     }
     rdi->status = RZ_DBG_PROC_SLEEP; // TODO: Fix this
     rdi->pid = dbg->pid;
     rdi->tid = dbg->tid;
     rdi->lib = last_library();
     rdi->thread = find_thread(dbg, dbg->tid);
     rdi->uid = -1;
     rdi->gid = -1;
     rdi->cwd = NULL;
     rdi->exe = NULL;
     rdi->cmdline = NULL;
     rdi->libname = NULL;
     w32_info_user(dbg, rdi);
     w32_info_exe(dbg, rdi);
     return rdi;
 }

References dbg, find_thread(), last_library(), NULL, rz_debug_t::pid, rdi, RZ_DBG_PROC_SLEEP, RZ_NEW0, rz_debug_t::tid, w32_info_exe(), and w32_info_user().

◆ w32_init()

int w32_init ( RzDebug * dbg )

Definition at line 37 of file windows_debug.c.

                            {
     if (!dbg->plugin_data) {
         dbg->plugin_data = dbg->iob.get_w32dbg_wrap(dbg->iob.io);
         if (!dbg->plugin_data) {
             return 0;
         }
     }
     // escalate privs (required for win7/vista)
     setup_debug_privileges(true);
  
     HMODULE lib = GetModuleHandleW(L"kernel32"); // Always loaded
     if (!lib) {
         return false;
     }
     // lookup function pointers for portability
     // only windows vista :(
     w32_ProcessIdToSessionId = (BOOL(WINAPI *)(DWORD, DWORD *))
         GetProcAddress(lib, "ProcessIdToSessionId");
  
     w32_QueryFullProcessImageNameW = (BOOL(WINAPI *)(HANDLE, DWORD, LPWSTR, PDWORD))
         GetProcAddress(lib, "QueryFullProcessImageNameW");
  
     // api to retrieve YMM from w7 sp1
     w32_GetEnabledXStateFeatures = (ut64(WINAPI *)())
         GetProcAddress(lib, "GetEnabledXStateFeatures");
  
     w32_InitializeContext = (BOOL(WINAPI *)(PVOID, DWORD, PCONTEXT *, PDWORD))
         GetProcAddress(lib, "InitializeContext");
  
     w32_GetXStateFeaturesMask = (BOOL(WINAPI *)(PCONTEXT Context, PDWORD64))
         GetProcAddress(lib, "GetXStateFeaturesMask");
  
     w32_LocateXStateFeature = (PVOID(WINAPI *)(PCONTEXT Context, DWORD, PDWORD))
         GetProcAddress(lib, "LocateXStateFeature");
  
     w32_SetXStateFeaturesMask = (BOOL(WINAPI *)(PCONTEXT Context, DWORD64))
         GetProcAddress(lib, "SetXStateFeaturesMask");
  
     lib = GetModuleHandleW(L"ntdll.dll");
     if (!lib) {
         eprintf("Cannot load ntdll.dll. Aborting\n");
         return false;
     }
     w32_NtQuerySystemInformation = (NTSTATUS(WINAPI *)(ULONG, PVOID, ULONG, PULONG))
         GetProcAddress(lib, "NtQuerySystemInformation");
  
     w32_NtDuplicateObject = (NTSTATUS(WINAPI *)(HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG))
         GetProcAddress(lib, "NtDuplicateObject");
  
     w32_NtQueryObject = (NTSTATUS(WINAPI *)(HANDLE, ULONG, PVOID, ULONG, PULONG))
         GetProcAddress(lib, "NtQueryObject");
  
     w32_NtQueryInformationThread = (NTSTATUS(WINAPI *)(HANDLE, ULONG, PVOID, ULONG, PULONG))
         GetProcAddress(lib, "NtQueryInformationThread");
  
     return true;
 }

References ACCESS_MASK, dbg, DWORD, DWORD64, eprintf, HANDLE, rz_io_bind_t::io, rz_debug_t::iob, L, LPWSTR, PDWORD, PDWORD64, PHANDLE, rz_debug_t::plugin_data, PULONG, PVOID, setup_debug_privileges(), ULONG, and ut64().

◆ w32_kill()

int w32_kill	(	RzDebug *	dbg,
		int	pid,
		int	tid,
		int	sig
	)

Definition at line 890 of file windows_debug.c.

                                                       {
     W32DbgWInst *wrap = dbg->plugin_data;
  
     if (sig == 0) {
         if (rz_list_empty(dbg->threads)) {
             if (lib_list) {
                 rz_list_purge(lib_list);
             }
             return false;
         }
         return true;
     }
  
     bool ret = false;
     if (TerminateProcess(wrap->pi.hProcess, 1)) {
         ret = true;
     }
     wrap->pi.hProcess = NULL;
     wrap->pi.hThread = NULL;
     return ret;
 }

References dbg, lib_list, NULL, W32DbgWInst::pi, rz_debug_t::plugin_data, rz_list_purge(), and rz_debug_t::threads.

◆ w32_map_alloc()

RzDebugMap* w32_map_alloc	(	RzDebug *	dbg,
		ut64	addr,
		int	size
	)

Definition at line 1186 of file windows_debug.c.

                                                              {
     W32DbgWInst *wrap = dbg->plugin_data;
     LPVOID base = VirtualAllocEx(wrap->pi.hProcess, (LPVOID)addr, (SIZE_T)size, MEM_COMMIT, PAGE_READWRITE);
     if (!base) {
         rz_sys_perror("VirtualAllocEx");
         return NULL;
     }
     rz_debug_map_sync(dbg);
     return rz_debug_map_get(dbg, (ut64)base);
 }

References addr, dbg, NULL, W32DbgWInst::pi, rz_debug_t::plugin_data, rz_debug_map_get(), rz_debug_map_sync(), rz_sys_perror, and ut64().

◆ w32_map_dealloc()

int w32_map_dealloc	(	RzDebug *	dbg,
		ut64	addr,
		int	size
	)

Definition at line 1197 of file windows_debug.c.

                                                        {
     W32DbgWInst *wrap = dbg->plugin_data;
     if (!VirtualFreeEx(wrap->pi.hProcess, (LPVOID)addr, 0, MEM_RELEASE)) {
         rz_sys_perror("VirtualFreeEx");
         return false;
     }
     return true;
 }

References addr, dbg, W32DbgWInst::pi, rz_debug_t::plugin_data, and rz_sys_perror.

◆ w32_map_protect()

int w32_map_protect	(	RzDebug *	dbg,
		ut64	addr,
		int	size,
		int	perms
	)

Definition at line 1229 of file windows_debug.c.

                                                                   {
     DWORD old;
     W32DbgWInst *wrap = dbg->plugin_data;
     return VirtualProtectEx(wrap->pi.hProcess, (LPVOID)(size_t)addr,
         size, io_perms_to_prot(perms), &old);
 }

References addr, dbg, DWORD, io_perms_to_prot(), W32DbgWInst::pi, and rz_debug_t::plugin_data.

◆ w32_pid_list()

RzList* w32_pid_list	(	RzDebug *	dbg,
		int	pid,
		RzList *	list
	)

Definition at line 1443 of file windows_debug.c.

                                                           {
     W32DbgWInst *wrap = dbg->plugin_data;
     HANDLE sh = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, pid);
     if (sh == INVALID_HANDLE_VALUE) {
         rz_sys_perror("CreateToolhelp32Snapshot");
         return list;
     }
     PROCESSENTRY32W pe;
     pe.dwSize = sizeof(pe);
     if (Process32FirstW(sh, &pe)) {
         bool all = pid == 0;
         do {
             if (all || pe.th32ProcessID == pid || pe.th32ParentProcessID == pid) {
                 // Returns NULL if process is inaccessible unless if its a child process of debugged process
                 RzDebugPid *dbg_pid = build_debug_pid(pe.th32ProcessID, pe.th32ParentProcessID,
                     dbg->pid == pe.th32ProcessID ? wrap->pi.hProcess : NULL, pe.szExeFile);
                 if (dbg_pid) {
                     rz_list_append(list, dbg_pid);
                 }
             }
         } while (Process32NextW(sh, &pe));
     } else {
         rz_sys_perror("Process32First");
     }
     CloseHandle(sh);
     return list;
 }

References test_group_name::all, build_debug_pid(), dbg, HANDLE, INVALID_HANDLE_VALUE, list(), NULL, W32DbgWInst::pi, rz_debug_t::pid, pid, rz_debug_t::plugin_data, rz_list_append(), and rz_sys_perror.

◆ w32_reg_read()

int w32_reg_read	(	RzDebug *	dbg,
		int	type,
		ut8 *	buf,
		int	size
	)

Definition at line 544 of file windows_debug.c.

                                                              {
     bool showfpu = false;
     if (type < -1) {
         showfpu = true; // hack for debugging
         type = -type;
     }
     bool alive = is_thread_alive(dbg, dbg->tid);
     HANDLE th = get_thread_handle_from_tid(dbg, dbg->tid);
     if (!th || th == INVALID_HANDLE_VALUE) {
         return 0;
     }
     // Always suspend
     if (alive && suspend_thread(th) == -1) {
         return 0;
     }
     size = get_thread_context(th, buf, size, CONTEXT_ALL);
     if (showfpu) {
         print_fpu_context(th, (CONTEXT *)buf);
     }
     // Always resume
     if (alive && resume_thread(th) == -1) {
         size = 0;
     }
     return size;
 }

References CONTEXT_ALL, dbg, get_thread_context(), get_thread_handle_from_tid(), HANDLE, INVALID_HANDLE_VALUE, is_thread_alive(), print_fpu_context(), resume_thread(), suspend_thread(), rz_debug_t::tid, and type.

Referenced by w32_thread_list().

◆ w32_reg_write()

int w32_reg_write	(	RzDebug *	dbg,
		int	type,
		const ut8 *	buf,
		int	size
	)

Definition at line 570 of file windows_debug.c.

                                                                     {
     bool alive = is_thread_alive(dbg, dbg->tid);
     if (!alive) {
         return false;
     }
     HANDLE th = get_thread_handle_from_tid(dbg, dbg->tid);
     if (!th || th == INVALID_HANDLE_VALUE) {
         return 0;
     }
     // Always suspend
     if (suspend_thread(th) == -1) {
         return false;
     }
     if (type == RZ_REG_TYPE_DRX) {
         transfer_drx(dbg, buf);
     }
     bool ret = set_thread_context(th, buf, size);
     // Always resume
     if (resume_thread(th) == -1) {
         ret = false;
     }
     return ret;
 }

References dbg, get_thread_handle_from_tid(), HANDLE, INVALID_HANDLE_VALUE, is_thread_alive(), resume_thread(), RZ_REG_TYPE_DRX, set_thread_context(), suspend_thread(), rz_debug_t::tid, transfer_drx(), and type.

◆ w32_select()

int w32_select	(	RzDebug *	dbg,
		int	pid,
		int	tid
	)

Definition at line 837 of file windows_debug.c.

                                                {
     RzListIter *it;
     W32DbgWInst *wrap = dbg->plugin_data;
  
     // Re-attach to a different pid
     if (dbg->pid > -1 && dbg->pid != pid) {
         return w32_attach_new_process(dbg, pid);
     }
  
     if (dbg->tid == -1) {
         return tid;
     }
  
     if (!dbg->threads) {
         dbg->threads = rz_list_newf(free);
         return tid;
     }
  
     if (rz_list_empty(dbg->threads)) {
         return tid;
     }
  
     PTHREAD_ITEM th = find_thread(dbg, tid);
  
     int selected = 0;
     if (th && is_thread_alive(dbg, th->tid)) {
         wrap->pi.hThread = th->hThread;
         selected = tid;
     } else if (tid) {
         // If thread is dead, search for another one
         rz_list_foreach (dbg->threads, it, th) {
             if (!is_thread_alive(dbg, th->tid)) {
                 continue;
             }
             wrap->pi.hThread = th->hThread;
             selected = th->tid;
             break;
         }
     }
  
     if (dbg->corebind.cfggeti(dbg->corebind.core, "dbg.threads")) {
         // Suspend all other threads
         rz_list_foreach (dbg->threads, it, th) {
             if (!th->bFinished && !th->bSuspended && th->tid != selected) {
                 suspend_thread(th->hThread);
                 th->bSuspended = true;
             }
         }
     }
  
     return selected;
 }

References THREAD_ITEM::bFinished, THREAD_ITEM::bSuspended, rz_core_bind_t::cfggeti, rz_core_bind_t::core, rz_debug_t::corebind, dbg, find_thread(), free(), THREAD_ITEM::hThread, is_thread_alive(), W32DbgWInst::pi, rz_debug_t::pid, pid, rz_debug_t::plugin_data, rz_list_newf(), suspend_thread(), rz_debug_t::threads, THREAD_ITEM::tid, rz_debug_t::tid, and w32_attach_new_process().

Referenced by w32_break_process(), w32_continue(), and w32_dbg_wait().

◆ w32_step()

int w32_step ( RzDebug * dbg )

Definition at line 395 of file windows_debug.c.

                            {
     // Do nothing (not supported)
     return 0;
 }

◆ w32_thread_list()

RzList* w32_thread_list	(	RzDebug *	dbg,
		int	pid,
		RzList *	list
	)

Definition at line 1280 of file windows_debug.c.

                                                              {
     // pid is not respected for TH32CS_SNAPTHREAD flag
     HANDLE th = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
     if (th == INVALID_HANDLE_VALUE) {
         rz_sys_perror("CreateToolhelp32Snapshot");
         return list;
     }
     THREADENTRY32 te;
     te.dwSize = sizeof(te);
     HANDLE ph = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
     if (Thread32First(th, &te)) {
         // TODO: export this code to its own function?
         char *path = NULL;
         int uid = -1;
         if (!te.th32ThreadID) {
             path = get_process_path(ph, pid);
             DWORD sid;
             if (w32_ProcessIdToSessionId && w32_ProcessIdToSessionId(pid, &sid)) {
                 uid = sid;
             }
         }
         if (!path) {
             // TODO: enum processes to get binary's name
             path = strdup("???");
         }
         int saved_tid = dbg->tid;
         do {
             char status = RZ_DBG_PROC_SLEEP;
             if (te.th32OwnerProcessID == pid) {
                 ut64 pc = 0;
                 if (dbg->pid == pid) {
                     CONTEXT ctx = { 0 };
                     dbg->tid = te.th32ThreadID;
                     w32_reg_read(dbg, RZ_REG_TYPE_GPR, (ut8 *)&ctx, sizeof(ctx));
                     // TODO: is needed check context for x32 and x64??
                     pc = pc_from_context(&ctx);
                     PTHREAD_ITEM pthread = find_thread(dbg, te.th32ThreadID);
                     if (pthread) {
                         if (pthread->bFinished) {
                             status = RZ_DBG_PROC_DEAD;
                         } else if (pthread->bSuspended) {
                             status = RZ_DBG_PROC_SLEEP;
                         } else {
                             status = RZ_DBG_PROC_RUN; // TODO: Get more precise thread status
                         }
                     }
                 }
                 rz_list_append(list, rz_debug_pid_new(path, te.th32ThreadID, uid, status, pc));
             }
         } while (Thread32Next(th, &te));
         dbg->tid = saved_tid;
         free(path);
     } else {
         rz_sys_perror("Thread32First");
     }
     CloseHandle(th);
     return list;
 }

References THREAD_ITEM::bFinished, THREAD_ITEM::bSuspended, dbg, DWORD, FALSE, find_thread(), free(), get_process_path(), HANDLE, INVALID_HANDLE_VALUE, list(), NULL, path, pc, pc_from_context(), ph, rz_debug_t::pid, pid, RZ_DBG_PROC_DEAD, RZ_DBG_PROC_RUN, RZ_DBG_PROC_SLEEP, rz_debug_pid_new(), rz_list_append(), RZ_REG_TYPE_GPR, rz_sys_perror, status, strdup(), rz_debug_t::tid, ut64(), and w32_reg_read().

Variable Documentation

◆ ACCESS_MASK

ACCESS_MASK

Definition at line 128 of file windows_debug.h.

Referenced by w32_init().

◆ Context

PCONTEXT Context

Definition at line 136 of file windows_debug.h.

◆ DWORD

PCONTEXT DWORD

Definition at line 119 of file windows_debug.h.

Referenced by __lfh_segment_loop(), _zip_win32_named_op_commit_write(), _zip_win32_named_op_create_temp_output(), _zip_win32_named_op_stat(), _zip_win32_named_op_write(), _zip_win32_op_read(), _zip_win32_op_seek(), backtrace_windows(), bochs_cmd_stop(), bochs_send_cmd(), bochs_wait(), build_debug_pid(), DecodeLFHEntry(), fs__access(), fs__capture_path(), fs__create_junction(), fs__ftruncate(), fs__link(), fs__mkdtemp_func(), fs__mkstemp_func(), fs__open(), fs__read(), fs__readlink_handle(), fs__realpath_handle(), fs__stat_impl(), fs__stat_impl_from_path(), fs__statfs(), fs__unlink(), fs__utime_impl(), fs__utime_impl_from_path(), fs__write(), get_file_name_from_handle(), get_process_path(), get_windows(), GetMsecSincePerfCounter(), GetSingleBlock(), GetSingleSegmentBlock(), GetSystemModules(), initialize_windows_ntdll_query_api_functions(), is_process_alive(), lang_pipe_run(), main(), make_program_args(), make_program_env(), MySetFilePointerEx(), pipe_connect_thread_proc(), proc_mem_map(), ReadKernelMemory(), resolve_path(), rz_cons_enable_mouse(), rz_cons_set_raw(), rz_cons_show_cursor(), rz_file_tmpdir(), rz_heap_blocks_list(), rz_mem_protect(), rz_path_realpath(), rz_sys_getenv(), rz_sys_info(), rz_sys_open(), rz_sys_perror_str(), rz_sys_pid_to_path(), rz_test_main(), rz_w32_add_winmsg_breakpoint(), rz_w32_dbg_modules(), rzpipe_read(), rzpipe_write(), search_path_join_test(), sp_blocking_read(), sp_blocking_write(), sp_open(), uv__cancel_read_console(), uv__convert_utf16_to_utf8(), uv__create_stdio_pipe_pair(), uv__determine_vterm_state(), uv__dlerror(), uv__fast_poll_process_poll_req(), uv__getpwuid_r(), uv__kill(), uv__once_inner(), uv__pipe_get_ipc_remote_pid(), uv__pipe_read_data(), uv__pipe_read_exactly(), uv__pipe_read_ipc(), uv__pipe_write_data(), uv__poll(), uv__poll_wine(), uv__send(), uv__slow_poll_thread_proc(), uv__stdio_create(), uv__tcp_try_write(), uv__tty_console_resize_message_loop_thread(), uv__tty_try_write(), uv__udp_init_ex(), uv__udp_try_send(), uv_cond_timedwait(), uv_cpu_info(), uv_cwd(), uv_fs_event_start(), uv_get_extension_function(), uv_guess_handle(), uv_if_indextoname(), uv_msafd_poll(), uv_ntstatus_to_winsock_error(), uv_os_getenv(), uv_os_getppid(), uv_os_tmpdir(), uv_os_uname(), uv_pipe_connect(), uv_pipe_endgame(), uv_pipe_open(), uv_pipe_writefile_thread_proc(), uv_pipe_zero_readfile_thread_proc(), uv_poll_close(), uv_poll_init_socket(), uv_process_fs_event_req(), uv_process_pipe_read_req(), uv_process_proc_exit(), uv_process_tcp_read_req(), uv_process_tty_read_line_req(), uv_process_tty_read_raw_req(), uv_process_udp_recv_req(), uv_run(), uv_rwlock_rdlock(), uv_rwlock_tryrdlock(), uv_rwlock_trywrlock(), uv_rwlock_wrlock(), uv_sem_trywait(), uv_set_pipe_handle(), uv_spawn(), uv_split_path(), uv_tcp_init_ex(), uv_tcp_queue_accept(), uv_tcp_queue_read(), uv_tcp_set_socket(), uv_tcp_try_bind(), uv_tcp_try_cancel_io(), uv_tcp_try_connect(), uv_tcp_write(), uv_tty_clear(), uv_tty_emit_text(), uv_tty_init(), uv_tty_line_read_thread(), uv_tty_read_stop(), uv_tty_reset(), uv_tty_set_mode(), uv_tty_write(), uv_tty_write_bufs(), uv_udp_maybe_bind(), uv_udp_queue_recv(), uv_udp_set_socket(), uv_uptime(), uv_wsarecv_workaround(), uv_wsarecvfrom_workaround(), w32_info_user(), w32_init(), w32_list_heaps_blocks(), w32_map_protect(), w32_thread_list(), win32_named_open(), win32_open64_file_func(), win32_open64_file_funcA(), win32_open64_file_funcW(), win32_open_file_func(), win32_read_file_func(), win32_seek64_file_func(), win32_seek_file_func(), win32_tell64_file_func(), win32_tell_file_func(), win32_write_file_func(), windbg_open(), windbg_reg_read(), and WriteKernelMemory().

◆ DWORD64

PCONTEXT DWORD64

Definition at line 140 of file windows_debug.h.

Referenced by w32_init().

◆ HANDLE

HANDLE

Definition at line 121 of file windows_debug.h.

Referenced by _zip_win32_named_op_commit_write(), _zip_win32_named_op_create_temp_output(), _zip_win32_named_op_open(), _zip_win32_named_op_rollback_write(), _zip_win32_named_op_write(), _zip_win32_op_close(), _zip_win32_op_read(), _zip_win32_op_seek(), _zip_win32_op_stat(), _zip_win32_op_tell(), apprentice_load(), change_file_date(), fs__create_junction(), fs__fchmod(), fs__fstat(), fs__ftruncate(), fs__futime(), fs__mkstemp_func(), fs__open(), fs__read(), fs__readlink(), fs__realpath(), fs__scandir(), fs__stat_impl_from_path(), fs__unlink(), fs__utime_impl_from_path(), fs__write(), get_file_name_from_handle(), get_thread_handle_from_tid(), GetHeapBlocks(), GetSingleBlock(), InitHeapInfo(), initialize_windows_ntdll_query_api_functions(), InstallService(), lang_pipe_run(), open_named_pipe(), pipe_connect_thread_proc(), RemoveService(), rz_cons_enable_mouse(), rz_cons_isatty(), rz_cons_set_raw(), rz_cons_show_cursor(), rz_lib_opendir(), rz_line_readline_cb(), rz_sys_dir(), rz_sys_open(), rz_sys_pid_to_path(), rz_test_main(), rz_w32_dbg_modules(), setfiletime(), setup_debug_privileges(), StartStopService(), uv__cancel_read_console(), uv__create_nul_handle(), uv__create_stdio_pipe_pair(), uv__duplicate_fd(), uv__duplicate_handle(), uv__fast_poll_create_peer_socket(), uv__fast_poll_submit_poll_req(), uv__get_osfhandle(), uv__getpwuid_r(), uv__init_overlapped_dummy(), uv__once_inner(), uv__pipe_interrupt_read(), uv__pipe_write_data(), uv__stdio_create(), uv__stdio_destroy(), uv__stdio_noinherit(), uv_disable_stdio_inheritance(), uv_guess_handle(), uv_kill(), uv_msafd_poll(), uv_os_getppid(), uv_os_getpriority(), uv_os_setpriority(), uv_pipe_cleanup(), uv_pipe_connect(), uv_pipe_open(), uv_pipe_queue_read(), uv_pipe_zero_readfile_thread_proc(), uv_poll_close(), uv_resident_set_memory(), uv_rwlock_init(), uv_stdio_pipe_server(), uv_tcp_queue_accept(), uv_tcp_queue_read(), uv_tcp_set_socket(), uv_tcp_try_cancel_io(), uv_tcp_write(), uv_thread_create_ex(), uv_tty_init(), uv_tty_line_read_thread(), uv_udp_set_socket(), uv_wsarecv_workaround(), uv_wsarecvfrom_workaround(), w32_desc_list(), w32_info_user(), w32_init(), w32_pid_list(), w32_reg_read(), w32_reg_write(), w32_thread_list(), win32_close_file_func(), win32_named_open(), win32_open64_file_func(), win32_open64_file_funcA(), win32_open64_file_funcW(), win32_open_file_func(), win32_read_file_func(), win32_seek64_file_func(), win32_seek_file_func(), win32_tell64_file_func(), win32_tell_file_func(), win32_write_file_func(), and windbg_init().

◆ LPWSTR

DWORD LPWSTR

Definition at line 121 of file windows_debug.h.

Referenced by create_remote_context(), get_file_name_from_handle(), rz_file_mkstemp(), rz_file_rm(), rz_file_tmpdir(), rz_sys_setenv(), w32_info_user(), and w32_init().

◆ PDWORD

PCONTEXT PDWORD

Definition at line 121 of file windows_debug.h.

Referenced by w32_init().

◆ PDWORD64

PCONTEXT PDWORD64

Definition at line 136 of file windows_debug.h.

Referenced by w32_init().

◆ PHANDLE

PHANDLE

Definition at line 128 of file windows_debug.h.

Referenced by w32_init().

◆ PULONG

PULONG

Definition at line 124 of file windows_debug.h.

Referenced by initialize_windows_ntdll_query_api_functions(), w32_init(), windbg_breakpoint(), windbg_threads(), and windbg_wait().

◆ PVOID

PVOID

Definition at line 124 of file windows_debug.h.

Referenced by create_context(), create_remote_context(), GetHeapBlocks(), GetLFHKey(), GetListOfHeaps(), GetSegmentHeapBlocks(), GetSingleBlock(), GetSingleSegmentBlock(), initialize_windows_ntdll_query_api_functions(), uv_os_uname(), w32_desc_list(), w32_init(), windbg_map_get(), windbg_read(), windbg_reg_read(), windbg_reg_write(), and windbg_write().

Classes

Macros

Typedefs

Enumerations

Functions

Variables

Macro Definition Documentation

◆ CONTEXT_ALL

◆ CONTEXT_XSTATE

◆ XSTATE_AVX

◆ XSTATE_GSSE

◆ XSTATE_LEGACY_SSE

◆ XSTATE_MASK_AVX

◆ XSTATE_MASK_GSSE

Typedef Documentation

◆ OBJECT_TYPE_INFORMATION

◆ PLIB_ITEM

◆ POBJECT_TYPE_INFORMATION

◆ POOL_TYPE

◆ PPOOL_TYPE

◆ PSYSTEM_HANDLE

◆ PSYSTEM_HANDLE_INFORMATION

◆ PTHREAD_ITEM

◆ SYSTEM_HANDLE

◆ SYSTEM_HANDLE_INFORMATION

Enumeration Type Documentation

◆ _POOL_TYPE

Function Documentation

◆ ut64()

◆ w32_attach()

◆ w32_attach_new_process()

◆ w32_break_process()

◆ w32_continue()

◆ w32_dbg_wait()

◆ w32_desc_list()

◆ w32_detach()

◆ w32_info()

◆ w32_init()

◆ w32_kill()

◆ w32_map_alloc()

◆ w32_map_dealloc()

◆ w32_map_protect()

◆ w32_pid_list()

◆ w32_reg_read()

◆ w32_reg_write()

◆ w32_select()

◆ w32_step()

◆ w32_thread_list()

Variable Documentation

◆ ACCESS_MASK

◆ Context

◆ DWORD

◆ DWORD64

◆ HANDLE

◆ LPWSTR

◆ PDWORD

◆ PDWORD64

◆ PHANDLE

◆ PULONG

◆ PVOID

◆ ULONG