diff --git a/BrachTraceExe/BrachTraceExe.vcxproj b/BrachTraceExe/BrachTraceExe.vcxproj new file mode 100644 index 0000000..1bdaca2 --- /dev/null +++ b/BrachTraceExe/BrachTraceExe.vcxproj @@ -0,0 +1,150 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + {8D95F0D0-2975-4A8B-9499-317C50E55264} + BrachTraceExe + 10.0 + + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + false + + + true + + + true + + + false + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + Console + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + Console + true + true + true + + + + + + + + + \ No newline at end of file diff --git a/BrachTraceExe/BrachTraceExe.vcxproj.filters b/BrachTraceExe/BrachTraceExe.vcxproj.filters new file mode 100644 index 0000000..93b404b --- /dev/null +++ b/BrachTraceExe/BrachTraceExe.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/BrachTraceExe/BrachTraceExe.vcxproj.user b/BrachTraceExe/BrachTraceExe.vcxproj.user new file mode 100644 index 0000000..cb74406 --- /dev/null +++ b/BrachTraceExe/BrachTraceExe.vcxproj.user @@ -0,0 +1,27 @@ + + + + WindowsRemoteDebugger + $(TargetPath) + 192.168.3.7 + RemoteWithoutAuthentication + + + $(TargetPath) + WindowsRemoteDebugger + 192.168.3.7 + RemoteWithoutAuthentication + + + $(TargetPath) + WindowsRemoteDebugger + 192.168.3.7 + RemoteWithoutAuthentication + + + $(TargetPath) + WindowsRemoteDebugger + 192.168.3.7 + RemoteWithoutAuthentication + + \ No newline at end of file diff --git a/BrachTraceExe/brach-trace-exe.cpp b/BrachTraceExe/brach-trace-exe.cpp new file mode 100644 index 0000000..de721ed --- /dev/null +++ b/BrachTraceExe/brach-trace-exe.cpp @@ -0,0 +1,87 @@ +#include +#include "..\BranchTracerSys\ioctls.h" +#include + + + +typedef struct _BTS_RECORD64 +{ + ULONG64 from; // ¼Ç¼·ÖÖ§µÄÔ´µØÖ· + ULONG64 to; // ¼Ç¼·ÖÖ§µÄÄ¿±êµØÖ· + ULONG64 branchPredicted; +}BTS_RECORD64, * PBTS_RECORD64; + + + +int main() { + HANDLE hDevice = CreateFileA("\\\\.\\Branch-Trace", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); + + ULONG ThreadId = 0; + printf("Enter thread id:"); + scanf_s("%d", &ThreadId); + + START_THREAD_TRACE_PARAM StartRequest = { 0 }; + StartRequest.ThreadId = ThreadId; + + DWORD BytesReturned = 0; + if (!DeviceIoControl(hDevice, IOCTL_START_THREAD_TRACE, + (LPVOID)&StartRequest, sizeof(StartRequest), + (LPVOID)&StartRequest, sizeof(StartRequest), + &BytesReturned, NULL)) + { + printf("Start Trace failed!\n"); + return -1; + } + + printf("Press Enter to conttinue\n"); + system("pause"); + +#define BIFFER_SIZE 0x2000 + PVOID Buffer = VirtualAlloc(NULL, BIFFER_SIZE, MEM_COMMIT, PAGE_READWRITE); + STOP_THREAD_TRACE_PARAM StopRequest = { 0 }; + StopRequest.ThreadId = ThreadId; + StopRequest.Buffer = Buffer; + StopRequest.BufferSize = BIFFER_SIZE; + StopRequest.FilterStart = 0x00400000; + StopRequest.FilterEnd = 0x00D4C000+0x4000; + + + if (!DeviceIoControl(hDevice, IOCTL_STOP_THREAD_TRACE, + (LPVOID)&StopRequest, sizeof(StopRequest), + (LPVOID)&StopRequest, sizeof(StopRequest), + &BytesReturned, NULL)) + { + printf("Stop Trace failed!\n"); + getchar(); + return -1; + } + + printf("Successful Buffer:%p ReadSize:%x\n", StopRequest.Buffer, StopRequest.ReadSize); + + + PBTS_RECORD64 RecordStart = (PBTS_RECORD64)Buffer; + PBTS_RECORD64 RecordEnd = (PBTS_RECORD64)((ULONG_PTR)Buffer + StopRequest.ReadSize); + + + // ÄæÅÅ, ´ÓÇý¶¯À­»ØÀ´µÄ¼Ç¼˳Ðò¸úÖ´ÐÐ˳ÐòµÄÏà·´. + for (PBTS_RECORD64 p1 = RecordStart, p2 = RecordEnd - 1; + p1 < p2; + p1++, p2--) + { + BTS_RECORD64 temp = *p1; + *p1 = *p2; + *p2 = temp; + } + + PBTS_RECORD64 pRecord = RecordStart; + while (pRecord < RecordEnd) + { + printf("%llx-> %llx\n", pRecord->from, pRecord->to); + pRecord++; + } + + system("pause"); + getchar(); + + +} \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.aps b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.aps new file mode 100644 index 0000000..1a98d2e Binary files /dev/null and b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.aps differ diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.rc b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.rc new file mode 100644 index 0000000..45ba1aa --- /dev/null +++ b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.rc @@ -0,0 +1,133 @@ +// Microsoft Visual C++ generated resource script. +// +#include "resource.h" + +#define APSTUDIO_READONLY_SYMBOLS +///////////////////////////////////////////////////////////////////////////// +// +// Generated from the TEXTINCLUDE 2 resource. +// +#include "winres.h" + +///////////////////////////////////////////////////////////////////////////// +#undef APSTUDIO_READONLY_SYMBOLS + +///////////////////////////////////////////////////////////////////////////// +// Chinese (Simplified, PRC) resources + +#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS) +LANGUAGE LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED +#pragma code_page(936) + +#ifdef APSTUDIO_INVOKED +///////////////////////////////////////////////////////////////////////////// +// +// TEXTINCLUDE +// + +1 TEXTINCLUDE +BEGIN + "resource.h\0" +END + +2 TEXTINCLUDE +BEGIN + "#include ""winres.h""\r\n" + "\0" +END + +3 TEXTINCLUDE +BEGIN + "\r\n" + "\0" +END + +#endif // APSTUDIO_INVOKED + + +///////////////////////////////////////////////////////////////////////////// +// +// PNG +// + +IDB_PNG_THREAD PNG "res\\Thread.png" + +IDB_PNG_TRACE PNG "res\\trace.png" + + +///////////////////////////////////////////////////////////////////////////// +// +// Dialog +// + +IDD_DIALOG_THREAD_TRACE DIALOGEX 0, 0, 319, 232 +STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU +CAPTION "Thread Trace" +FONT 8, "Consolas", 400, 0, 0x0 +BEGIN + COMBOBOX IDC_COMBO_THREAD,72,14,180,30,CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | WS_TABSTOP + PUSHBUTTON "Start Trace",IDC_BUTTON_STARTTRACE,257,14,55,14 + PUSHBUTTON "Reset",IDC_BUTTON_RESET,257,32,55,14,WS_DISABLED + LTEXT "Choose Thread",IDC_STATIC,14,17,53,8 + PUSHBUTTON "Prev",IDC_BUTTON_PREV,257,169,55,14,WS_DISABLED + PUSHBUTTON "Next(Into)",IDC_BUTTON_NEXTINTO,257,67,55,14,WS_DISABLED + PUSHBUTTON "Prev(Into)",IDC_BUTTON_PREVINTO,257,51,55,14,WS_DISABLED + PUSHBUTTON "&Next",IDC_BUTTON_NEXT,257,185,55,14,WS_DISABLED + LTEXT "Choose Module",IDC_STATIC,14,34,53,8 + COMBOBOX IDC_COMBO_MODULE,72,32,180,30,CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | WS_TABSTOP + CONTROL "",IDC_LIST1,"SysListView32",LVS_REPORT | LVS_ALIGNLEFT | WS_BORDER | WS_TABSTOP,14,51,238,174 + PUSHBUTTON "ProcStart",IDC_BUTTON_PROCSTART,257,91,55,14,WS_DISABLED + PUSHBUTTON "ProcEnd",IDC_BUTTON_PROCEND,257,107,55,14,WS_DISABLED + PUSHBUTTON "ToEnd",IDC_BUTTON_TOEND,257,211,55,14,WS_DISABLED + PUSHBUTTON "Prev Snippet",IDC_BUTTON_PREVSNIPPET,257,130,55,14,WS_DISABLED + PUSHBUTTON "Next Snippet",IDC_BUTTON_NEXTSNIPPET,257,146,55,14,WS_DISABLED +END + + +///////////////////////////////////////////////////////////////////////////// +// +// DESIGNINFO +// + +#ifdef APSTUDIO_INVOKED +GUIDELINES DESIGNINFO +BEGIN + IDD_DIALOG_THREAD_TRACE, DIALOG + BEGIN + LEFTMARGIN, 7 + RIGHTMARGIN, 312 + TOPMARGIN, 7 + BOTTOMMARGIN, 225 + HORZGUIDE, 22 + HORZGUIDE, 38 + HORZGUIDE, 51 + END +END +#endif // APSTUDIO_INVOKED + + +///////////////////////////////////////////////////////////////////////////// +// +// AFX_DIALOG_LAYOUT +// + +IDD_DIALOG_THREAD_TRACE AFX_DIALOG_LAYOUT +BEGIN + 0 +END + +#endif // Chinese (Simplified, PRC) resources +///////////////////////////////////////////////////////////////////////////// + + + +#ifndef APSTUDIO_INVOKED +///////////////////////////////////////////////////////////////////////////// +// +// Generated from the TEXTINCLUDE 3 resource. +// + + +///////////////////////////////////////////////////////////////////////////// +#endif // not APSTUDIO_INVOKED + diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj new file mode 100644 index 0000000..d543592 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj @@ -0,0 +1,219 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {e29237f6-bf51-4b3c-a9a7-5c988650686e} + BranchTracex64pluginwtl + 10.0 + + + + DynamicLibrary + true + v142 + MultiByte + + + DynamicLibrary + false + v142 + true + MultiByte + + + DynamicLibrary + true + v142 + MultiByte + + + DynamicLibrary + false + v142 + true + MultiByte + + + + + + + + + + + + + + + + + + + + + true + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + $(IncludePath);E:\third-lib\includes; + + + false + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + $(IncludePath);E:\third-lib\includes; + + + true + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + $(IncludePath);E:\third-lib\includes; + + + false + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + $(IncludePath);E:\third-lib\includes; + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + NotSet + true + kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);E:\third-lib\lib\$(Configuration)$(PlatformTarget)\Zydis.lib + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + NotSet + true + true + true + kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);E:\third-lib\lib\$(Configuration)$(PlatformTarget)\Zydis.lib; + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + NotSet + true + kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);E:\third-lib\lib\$(Configuration)$(PlatformTarget)\Zydis.lib; + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + NotSet + true + true + true + kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);E:\third-lib\lib\$(Configuration)$(PlatformTarget)\Zydis.lib; + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.filters b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.filters new file mode 100644 index 0000000..c4b729a --- /dev/null +++ b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.filters @@ -0,0 +1,177 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + {2e430117-686d-4410-a80c-cdc92ba350af} + + + {631d739d-396f-4d5d-b3e3-2cdae72c6524} + + + {f01f3db0-bd30-466f-a1af-f05619d18cb9} + + + {7191814d-618e-4bb6-b06e-999c73fa2915} + + + {f443bc61-3a33-4dfa-9385-e1cd6fabc425} + + + + + Source Files + + + Source Files + + + Source Files\ThreadTrace + + + Source Files\disassembler + + + Source Files\LDasm + + + Source Files\ThreadTrace + + + + + Source Files + + + Source Files + + + Header Files + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Source Files\ThreadTrace + + + Source Files + + + Header Files + + + Source Files\ThreadTrace + + + Source Files\disassembler + + + Source Files\LDasm + + + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + Header Files\pluginsdk + + + + + Resource Files + + + + + Resource Files + + + Resource Files + + + \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.user b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.user new file mode 100644 index 0000000..2e019c4 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/BranchTrace-x64plugin-wtl.vcxproj.user @@ -0,0 +1,38 @@ + + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsRemoteDebugger + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + 192.168.3.7 + RemoteWithoutAuthentication + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture) + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsRemoteDebugger + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + 192.168.3.7 + RemoteWithoutAuthentication + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture) + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsRemoteDebugger + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture) + 192.168.3.7 + RemoteWithoutAuthentication + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsRemoteDebugger + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture) + 192.168.3.7 + RemoteWithoutAuthentication + + + BranchTrace-x64plugin-wtl.rc + + \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/LDasm/LDasm.c b/BranchTrace-x64plugin-wtl/LDasm/LDasm.c new file mode 100644 index 0000000..8d91e51 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/LDasm/LDasm.c @@ -0,0 +1,863 @@ +/* +* +* Copyright (c) 2009-2011 +* vol4ok PGP KEY ID: 26EC143CCDC61C9D +* + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU General Public License as published by +the Free Software Foundation, either version 3 of the License, or +(at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program. If not, see . + +*/ + +#include "LDasm.h" + +/* + Instruction format: + + | prefix | REX | opcode | modR/M | SIB | disp8/16/32 | imm8/16/32/64 | + + */ + +#define OP_NONE 0x00 +#define OP_INVALID 0x80 + +#define OP_DATA_I8 0x01 +#define OP_DATA_I16 0x02 +#define OP_DATA_I16_I32 0x04 +#define OP_DATA_I16_I32_I64 0x08 +#define OP_EXTENDED 0x10 +#define OP_RELATIVE 0x20 +#define OP_MODRM 0x40 +#define OP_PREFIX 0x80 + + +static unsigned char flags_table[256] = +{ + /* 00 */ OP_MODRM, + /* 01 */ OP_MODRM, + /* 02 */ OP_MODRM, + /* 03 */ OP_MODRM, + /* 04 */ OP_DATA_I8, + /* 05 */ OP_DATA_I16_I32, + /* 06 */ OP_NONE, + /* 07 */ OP_NONE, + /* 08 */ OP_MODRM, + /* 09 */ OP_MODRM, + /* 0A */ OP_MODRM, + /* 0B */ OP_MODRM, + /* 0C */ OP_DATA_I8, + /* 0D */ OP_DATA_I16_I32, + /* 0E */ OP_NONE, + /* 0F */ OP_NONE, + + /* 10 */ OP_MODRM, + /* 11 */ OP_MODRM, + /* 12 */ OP_MODRM, + /* 13 */ OP_MODRM, + /* 14 */ OP_DATA_I8, + /* 15 */ OP_DATA_I16_I32, + /* 16 */ OP_NONE, + /* 17 */ OP_NONE, + /* 18 */ OP_MODRM, + /* 19 */ OP_MODRM, + /* 1A */ OP_MODRM, + /* 1B */ OP_MODRM, + /* 1C */ OP_DATA_I8, + /* 1D */ OP_DATA_I16_I32, + /* 1E */ OP_NONE, + /* 1F */ OP_NONE, + + /* 20 */ OP_MODRM, + /* 21 */ OP_MODRM, + /* 22 */ OP_MODRM, + /* 23 */ OP_MODRM, + /* 24 */ OP_DATA_I8, + /* 25 */ OP_DATA_I16_I32, + /* 26 */ OP_PREFIX, + /* 27 */ OP_NONE, + /* 28 */ OP_MODRM, + /* 29 */ OP_MODRM, + /* 2A */ OP_MODRM, + /* 2B */ OP_MODRM, + /* 2C */ OP_DATA_I8, + /* 2D */ OP_DATA_I16_I32, + /* 2E */ OP_PREFIX, + /* 2F */ OP_NONE, + + /* 30 */ OP_MODRM, + /* 31 */ OP_MODRM, + /* 32 */ OP_MODRM, + /* 33 */ OP_MODRM, + /* 34 */ OP_DATA_I8, + /* 35 */ OP_DATA_I16_I32, + /* 36 */ OP_PREFIX, + /* 37 */ OP_NONE, + /* 38 */ OP_MODRM, + /* 39 */ OP_MODRM, + /* 3A */ OP_MODRM, + /* 3B */ OP_MODRM, + /* 3C */ OP_DATA_I8, + /* 3D */ OP_DATA_I16_I32, + /* 3E */ OP_PREFIX, + /* 3F */ OP_NONE, + + /* 40 */ OP_NONE, + /* 41 */ OP_NONE, + /* 42 */ OP_NONE, + /* 43 */ OP_NONE, + /* 44 */ OP_NONE, + /* 45 */ OP_NONE, + /* 46 */ OP_NONE, + /* 47 */ OP_NONE, + /* 48 */ OP_NONE, + /* 49 */ OP_NONE, + /* 4A */ OP_NONE, + /* 4B */ OP_NONE, + /* 4C */ OP_NONE, + /* 4D */ OP_NONE, + /* 4E */ OP_NONE, + /* 4F */ OP_NONE, + + /* 50 */ OP_NONE, + /* 51 */ OP_NONE, + /* 52 */ OP_NONE, + /* 53 */ OP_NONE, + /* 54 */ OP_NONE, + /* 55 */ OP_NONE, + /* 56 */ OP_NONE, + /* 57 */ OP_NONE, + /* 58 */ OP_NONE, + /* 59 */ OP_NONE, + /* 5A */ OP_NONE, + /* 5B */ OP_NONE, + /* 5C */ OP_NONE, + /* 5D */ OP_NONE, + /* 5E */ OP_NONE, + /* 5F */ OP_NONE, + /* 60 */ OP_NONE, + + /* 61 */ OP_NONE, + /* 62 */ OP_MODRM, + /* 63 */ OP_MODRM, + /* 64 */ OP_PREFIX, + /* 65 */ OP_PREFIX, + /* 66 */ OP_PREFIX, + /* 67 */ OP_PREFIX, + /* 68 */ OP_DATA_I16_I32, + /* 69 */ OP_MODRM | OP_DATA_I16_I32, + /* 6A */ OP_DATA_I8, + /* 6B */ OP_MODRM | OP_DATA_I8, + /* 6C */ OP_NONE, + /* 6D */ OP_NONE, + /* 6E */ OP_NONE, + /* 6F */ OP_NONE, + + /* 70 */ OP_RELATIVE | OP_DATA_I8, + /* 71 */ OP_RELATIVE | OP_DATA_I8, + /* 72 */ OP_RELATIVE | OP_DATA_I8, + /* 73 */ OP_RELATIVE | OP_DATA_I8, + /* 74 */ OP_RELATIVE | OP_DATA_I8, + /* 75 */ OP_RELATIVE | OP_DATA_I8, + /* 76 */ OP_RELATIVE | OP_DATA_I8, + /* 77 */ OP_RELATIVE | OP_DATA_I8, + /* 78 */ OP_RELATIVE | OP_DATA_I8, + /* 79 */ OP_RELATIVE | OP_DATA_I8, + /* 7A */ OP_RELATIVE | OP_DATA_I8, + /* 7B */ OP_RELATIVE | OP_DATA_I8, + /* 7C */ OP_RELATIVE | OP_DATA_I8, + /* 7D */ OP_RELATIVE | OP_DATA_I8, + /* 7E */ OP_RELATIVE | OP_DATA_I8, + /* 7F */ OP_RELATIVE | OP_DATA_I8, + + /* 80 */ OP_MODRM | OP_DATA_I8, + /* 81 */ OP_MODRM | OP_DATA_I16_I32, + /* 82 */ OP_MODRM | OP_DATA_I8, + /* 83 */ OP_MODRM | OP_DATA_I8, + /* 84 */ OP_MODRM, + /* 85 */ OP_MODRM, + /* 86 */ OP_MODRM, + /* 87 */ OP_MODRM, + /* 88 */ OP_MODRM, + /* 89 */ OP_MODRM, + /* 8A */ OP_MODRM, + /* 8B */ OP_MODRM, + /* 8C */ OP_MODRM, + /* 8D */ OP_MODRM, + /* 8E */ OP_MODRM, + /* 8F */ OP_MODRM, + + /* 90 */ OP_NONE, + /* 91 */ OP_NONE, + /* 92 */ OP_NONE, + /* 93 */ OP_NONE, + /* 94 */ OP_NONE, + /* 95 */ OP_NONE, + /* 96 */ OP_NONE, + /* 97 */ OP_NONE, + /* 98 */ OP_NONE, + /* 99 */ OP_NONE, + /* 9A */ OP_DATA_I16 | OP_DATA_I16_I32, + /* 9B */ OP_NONE, + /* 9C */ OP_NONE, + /* 9D */ OP_NONE, + /* 9E */ OP_NONE, + /* 9F */ OP_NONE, + + /* A0 */ OP_DATA_I8, + /* A1 */ OP_DATA_I16_I32_I64, + /* A2 */ OP_DATA_I8, + /* A3 */ OP_DATA_I16_I32_I64, + /* A4 */ OP_NONE, + /* A5 */ OP_NONE, + /* A6 */ OP_NONE, + /* A7 */ OP_NONE, + /* A8 */ OP_DATA_I8, + /* A9 */ OP_DATA_I16_I32, + /* AA */ OP_NONE, + /* AB */ OP_NONE, + /* AC */ OP_NONE, + /* AD */ OP_NONE, + /* AE */ OP_NONE, + /* AF */ OP_NONE, + + /* B0 */ OP_DATA_I8, + /* B1 */ OP_DATA_I8, + /* B2 */ OP_DATA_I8, + /* B3 */ OP_DATA_I8, + /* B4 */ OP_DATA_I8, + /* B5 */ OP_DATA_I8, + /* B6 */ OP_DATA_I8, + /* B7 */ OP_DATA_I8, + /* B8 */ OP_DATA_I16_I32_I64, + /* B9 */ OP_DATA_I16_I32_I64, + /* BA */ OP_DATA_I16_I32_I64, + /* BB */ OP_DATA_I16_I32_I64, + /* BC */ OP_DATA_I16_I32_I64, + /* BD */ OP_DATA_I16_I32_I64, + /* BE */ OP_DATA_I16_I32_I64, + /* BF */ OP_DATA_I16_I32_I64, + + /* C0 */ OP_MODRM | OP_DATA_I8, + /* C1 */ OP_MODRM | OP_DATA_I8, + /* C2 */ OP_DATA_I16, + /* C3 */ OP_NONE, + /* C4 */ OP_MODRM, + /* C5 */ OP_MODRM, + /* C6 */ OP_MODRM | OP_DATA_I8, + /* C7 */ OP_MODRM | OP_DATA_I16_I32, + /* C8 */ OP_DATA_I8 | OP_DATA_I16, + /* C9 */ OP_NONE, + /* CA */ OP_DATA_I16, + /* CB */ OP_NONE, + /* CC */ OP_NONE, + /* CD */ OP_DATA_I8, + /* CE */ OP_NONE, + /* CF */ OP_NONE, + + /* D0 */ OP_MODRM, + /* D1 */ OP_MODRM, + /* D2 */ OP_MODRM, + /* D3 */ OP_MODRM, + /* D4 */ OP_DATA_I8, + /* D5 */ OP_DATA_I8, + /* D6 */ OP_NONE, + /* D7 */ OP_NONE, + /* D8 */ OP_MODRM, + /* D9 */ OP_MODRM, + /* DA */ OP_MODRM, + /* DB */ OP_MODRM, + /* DC */ OP_MODRM, + /* DD */ OP_MODRM, + /* DE */ OP_MODRM, + /* DF */ OP_MODRM, + + /* E0 */ OP_RELATIVE | OP_DATA_I8, + /* E1 */ OP_RELATIVE | OP_DATA_I8, + /* E2 */ OP_RELATIVE | OP_DATA_I8, + /* E3 */ OP_RELATIVE | OP_DATA_I8, + /* E4 */ OP_DATA_I8, + /* E5 */ OP_DATA_I8, + /* E6 */ OP_DATA_I8, + /* E7 */ OP_DATA_I8, + /* E8 */ OP_RELATIVE | OP_DATA_I16_I32, + /* E9 */ OP_RELATIVE | OP_DATA_I16_I32, + /* EA */ OP_DATA_I16 | OP_DATA_I16_I32, + /* EB */ OP_RELATIVE | OP_DATA_I8, + /* EC */ OP_NONE, + /* ED */ OP_NONE, + /* EE */ OP_NONE, + /* EF */ OP_NONE, + + /* F0 */ OP_PREFIX, + /* F1 */ OP_NONE, + /* F2 */ OP_PREFIX, + /* F3 */ OP_PREFIX, + /* F4 */ OP_NONE, + /* F5 */ OP_NONE, + /* F6 */ OP_MODRM, + /* F7 */ OP_MODRM, + /* F8 */ OP_NONE, + /* F9 */ OP_NONE, + /* FA */ OP_NONE, + /* FB */ OP_NONE, + /* FC */ OP_NONE, + /* FD */ OP_NONE, + /* FE */ OP_MODRM, + /* FF */ OP_MODRM +}; + +static unsigned char flags_table_ex[256] = +{ + /* 0F00 */ OP_MODRM, + /* 0F01 */ OP_MODRM, + /* 0F02 */ OP_MODRM, + /* 0F03 */ OP_MODRM, + /* 0F04 */ OP_INVALID, + /* 0F05 */ OP_NONE, + /* 0F06 */ OP_NONE, + /* 0F07 */ OP_NONE, + /* 0F08 */ OP_NONE, + /* 0F09 */ OP_NONE, + /* 0F0A */ OP_INVALID, + /* 0F0B */ OP_NONE, + /* 0F0C */ OP_INVALID, + /* 0F0D */ OP_MODRM, + /* 0F0E */ OP_INVALID, + /* 0F0F */ OP_MODRM | OP_DATA_I8, //3Dnow + + /* 0F10 */ OP_MODRM, + /* 0F11 */ OP_MODRM, + /* 0F12 */ OP_MODRM, + /* 0F13 */ OP_MODRM, + /* 0F14 */ OP_MODRM, + /* 0F15 */ OP_MODRM, + /* 0F16 */ OP_MODRM, + /* 0F17 */ OP_MODRM, + /* 0F18 */ OP_MODRM, + /* 0F19 */ OP_INVALID, + /* 0F1A */ OP_INVALID, + /* 0F1B */ OP_INVALID, + /* 0F1C */ OP_INVALID, + /* 0F1D */ OP_INVALID, + /* 0F1E */ OP_INVALID, + /* 0F1F */ OP_NONE, + + /* 0F20 */ OP_MODRM, + /* 0F21 */ OP_MODRM, + /* 0F22 */ OP_MODRM, + /* 0F23 */ OP_MODRM, + /* 0F24 */ OP_MODRM | OP_EXTENDED, //SSE5 + /* 0F25 */ OP_INVALID, + /* 0F26 */ OP_MODRM, + /* 0F27 */ OP_INVALID, + /* 0F28 */ OP_MODRM, + /* 0F29 */ OP_MODRM, + /* 0F2A */ OP_MODRM, + /* 0F2B */ OP_MODRM, + /* 0F2C */ OP_MODRM, + /* 0F2D */ OP_MODRM, + /* 0F2E */ OP_MODRM, + /* 0F2F */ OP_MODRM, + + /* 0F30 */ OP_NONE, + /* 0F31 */ OP_NONE, + /* 0F32 */ OP_NONE, + /* 0F33 */ OP_NONE, + /* 0F34 */ OP_NONE, + /* 0F35 */ OP_NONE, + /* 0F36 */ OP_INVALID, + /* 0F37 */ OP_NONE, + /* 0F38 */ OP_MODRM | OP_EXTENDED, + /* 0F39 */ OP_INVALID, + /* 0F3A */ OP_MODRM | OP_EXTENDED | OP_DATA_I8, + /* 0F3B */ OP_INVALID, + /* 0F3C */ OP_INVALID, + /* 0F3D */ OP_INVALID, + /* 0F3E */ OP_INVALID, + /* 0F3F */ OP_INVALID, + + /* 0F40 */ OP_MODRM, + /* 0F41 */ OP_MODRM, + /* 0F42 */ OP_MODRM, + /* 0F43 */ OP_MODRM, + /* 0F44 */ OP_MODRM, + /* 0F45 */ OP_MODRM, + /* 0F46 */ OP_MODRM, + /* 0F47 */ OP_MODRM, + /* 0F48 */ OP_MODRM, + /* 0F49 */ OP_MODRM, + /* 0F4A */ OP_MODRM, + /* 0F4B */ OP_MODRM, + /* 0F4C */ OP_MODRM, + /* 0F4D */ OP_MODRM, + /* 0F4E */ OP_MODRM, + /* 0F4F */ OP_MODRM, + + /* 0F50 */ OP_MODRM, + /* 0F51 */ OP_MODRM, + /* 0F52 */ OP_MODRM, + /* 0F53 */ OP_MODRM, + /* 0F54 */ OP_MODRM, + /* 0F55 */ OP_MODRM, + /* 0F56 */ OP_MODRM, + /* 0F57 */ OP_MODRM, + /* 0F58 */ OP_MODRM, + /* 0F59 */ OP_MODRM, + /* 0F5A */ OP_MODRM, + /* 0F5B */ OP_MODRM, + /* 0F5C */ OP_MODRM, + /* 0F5D */ OP_MODRM, + /* 0F5E */ OP_MODRM, + /* 0F5F */ OP_MODRM, + + /* 0F60 */ OP_MODRM, + /* 0F61 */ OP_MODRM, + /* 0F62 */ OP_MODRM, + /* 0F63 */ OP_MODRM, + /* 0F64 */ OP_MODRM, + /* 0F65 */ OP_MODRM, + /* 0F66 */ OP_MODRM, + /* 0F67 */ OP_MODRM, + /* 0F68 */ OP_MODRM, + /* 0F69 */ OP_MODRM, + /* 0F6A */ OP_MODRM, + /* 0F6B */ OP_MODRM, + /* 0F6C */ OP_MODRM, + /* 0F6D */ OP_MODRM, + /* 0F6E */ OP_MODRM, + /* 0F6F */ OP_MODRM, + + /* 0F70 */ OP_MODRM | OP_DATA_I8, + /* 0F71 */ OP_MODRM | OP_DATA_I8, + /* 0F72 */ OP_MODRM | OP_DATA_I8, + /* 0F73 */ OP_MODRM | OP_DATA_I8, + /* 0F74 */ OP_MODRM, + /* 0F75 */ OP_MODRM, + /* 0F76 */ OP_MODRM, + /* 0F77 */ OP_NONE, + /* 0F78 */ OP_MODRM, + /* 0F79 */ OP_MODRM, + /* 0F7A */ OP_INVALID, + /* 0F7B */ OP_INVALID, + /* 0F7C */ OP_MODRM, + /* 0F7D */ OP_MODRM, + /* 0F7E */ OP_MODRM, + /* 0F7F */ OP_MODRM, + + /* 0F80 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F81 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F82 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F83 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F84 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F85 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F86 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F87 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F88 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F89 */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8A */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8B */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8C */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8D */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8E */ OP_RELATIVE | OP_DATA_I16_I32, + /* 0F8F */ OP_RELATIVE | OP_DATA_I16_I32, + + /* 0F90 */ OP_MODRM, + /* 0F91 */ OP_MODRM, + /* 0F92 */ OP_MODRM, + /* 0F93 */ OP_MODRM, + /* 0F94 */ OP_MODRM, + /* 0F95 */ OP_MODRM, + /* 0F96 */ OP_MODRM, + /* 0F97 */ OP_MODRM, + /* 0F98 */ OP_MODRM, + /* 0F99 */ OP_MODRM, + /* 0F9A */ OP_MODRM, + /* 0F9B */ OP_MODRM, + /* 0F9C */ OP_MODRM, + /* 0F9D */ OP_MODRM, + /* 0F9E */ OP_MODRM, + /* 0F9F */ OP_MODRM, + + /* 0FA0 */ OP_NONE, + /* 0FA1 */ OP_NONE, + /* 0FA2 */ OP_NONE, + /* 0FA3 */ OP_MODRM, + /* 0FA4 */ OP_MODRM | OP_DATA_I8, + /* 0FA5 */ OP_MODRM, + /* 0FA6 */ OP_INVALID, + /* 0FA7 */ OP_INVALID, + /* 0FA8 */ OP_NONE, + /* 0FA9 */ OP_NONE, + /* 0FAA */ OP_NONE, + /* 0FAB */ OP_MODRM, + /* 0FAC */ OP_MODRM | OP_DATA_I8, + /* 0FAD */ OP_MODRM, + /* 0FAE */ OP_MODRM, + /* 0FAF */ OP_MODRM, + + /* 0FB0 */ OP_MODRM, + /* 0FB1 */ OP_MODRM, + /* 0FB2 */ OP_MODRM, + /* 0FB3 */ OP_MODRM, + /* 0FB4 */ OP_MODRM, + /* 0FB5 */ OP_MODRM, + /* 0FB6 */ OP_MODRM, + /* 0FB7 */ OP_MODRM, + /* 0FB8 */ OP_MODRM, + /* 0FB9 */ OP_MODRM, + /* 0FBA */ OP_MODRM | OP_DATA_I8, + /* 0FBB */ OP_MODRM, + /* 0FBC */ OP_MODRM, + /* 0FBD */ OP_MODRM, + /* 0FBE */ OP_MODRM, + /* 0FBF */ OP_MODRM, + + /* 0FC0 */ OP_MODRM, + /* 0FC1 */ OP_MODRM, + /* 0FC2 */ OP_MODRM | OP_DATA_I8, + /* 0FC3 */ OP_MODRM, + /* 0FC4 */ OP_MODRM | OP_DATA_I8, + /* 0FC5 */ OP_MODRM | OP_DATA_I8, + /* 0FC6 */ OP_MODRM | OP_DATA_I8, + /* 0FC7 */ OP_MODRM, + /* 0FC8 */ OP_NONE, + /* 0FC9 */ OP_NONE, + /* 0FCA */ OP_NONE, + /* 0FCB */ OP_NONE, + /* 0FCC */ OP_NONE, + /* 0FCD */ OP_NONE, + /* 0FCE */ OP_NONE, + /* 0FCF */ OP_NONE, + + /* 0FD0 */ OP_MODRM, + /* 0FD1 */ OP_MODRM, + /* 0FD2 */ OP_MODRM, + /* 0FD3 */ OP_MODRM, + /* 0FD4 */ OP_MODRM, + /* 0FD5 */ OP_MODRM, + /* 0FD6 */ OP_MODRM, + /* 0FD7 */ OP_MODRM, + /* 0FD8 */ OP_MODRM, + /* 0FD9 */ OP_MODRM, + /* 0FDA */ OP_MODRM, + /* 0FDB */ OP_MODRM, + /* 0FDC */ OP_MODRM, + /* 0FDD */ OP_MODRM, + /* 0FDE */ OP_MODRM, + /* 0FDF */ OP_MODRM, + + /* 0FE0 */ OP_MODRM, + /* 0FE1 */ OP_MODRM, + /* 0FE2 */ OP_MODRM, + /* 0FE3 */ OP_MODRM, + /* 0FE4 */ OP_MODRM, + /* 0FE5 */ OP_MODRM, + /* 0FE6 */ OP_MODRM, + /* 0FE7 */ OP_MODRM, + /* 0FE8 */ OP_MODRM, + /* 0FE9 */ OP_MODRM, + /* 0FEA */ OP_MODRM, + /* 0FEB */ OP_MODRM, + /* 0FEC */ OP_MODRM, + /* 0FED */ OP_MODRM, + /* 0FEE */ OP_MODRM, + /* 0FEF */ OP_MODRM, + + /* 0FF0 */ OP_MODRM, + /* 0FF1 */ OP_MODRM, + /* 0FF2 */ OP_MODRM, + /* 0FF3 */ OP_MODRM, + /* 0FF4 */ OP_MODRM, + /* 0FF5 */ OP_MODRM, + /* 0FF6 */ OP_MODRM, + /* 0FF7 */ OP_MODRM, + /* 0FF8 */ OP_MODRM, + /* 0FF9 */ OP_MODRM, + /* 0FFA */ OP_MODRM, + /* 0FFB */ OP_MODRM, + /* 0FFC */ OP_MODRM, + /* 0FFD */ OP_MODRM, + /* 0FFE */ OP_MODRM, + /* 0FFF */ OP_INVALID, +}; + +unsigned char cflags(UINT8 op) +{ + return flags_table[op]; +} + + +unsigned char cflags_ex(UINT8 op) +{ + return flags_table_ex[op]; +} + +unsigned int __fastcall PrevInstrLength(void* code, size_t bufferSize, UINT32 is64) +{ + void* buffer = malloc(bufferSize + 0x10); + if (buffer == NULL) { + return -1; + } + memset(buffer, 0x90, bufferSize + 0x10); + memcpy(buffer, code, bufferSize); + + int length = 0; + ldasm_data ld; + for (size_t i = 0; i < bufferSize; i++) + { + int len = ldasm_length((char*)buffer + i, is64); + if (i+len == bufferSize) { + length = len; + } + } + free(buffer); + return length; +} + +unsigned int __fastcall ldasm_length(void* code, UINT32 is64) +{ + ldasm_data ld; + return ldasm(code, &ld, 1); +} + +unsigned int __fastcall ldasm(void* code, ldasm_data* ld, UINT32 is64) +/* + Description: + Disassemble one instruction + + Arguments: + code - pointer to the code for disassemble + ld - pointer to structure ldasm_data + is64 - set this flag for 64-bit code, and clear for 32-bit + + Return: + length of instruction + */ +{ + UINT8* p = (UINT8*)code; + UINT8 s, op, f; + UINT8 rexw, pr_66, pr_67; + + s = rexw = pr_66 = pr_67 = 0; + + /* dummy check */ + if (!code || !ld) + return 0; + + /* init output data */ + memset(ld, 0, sizeof(ldasm_data)); + + /* phase 1: parse prefixies */ + while (cflags(*p) & OP_PREFIX) { + if (*p == 0x66) + pr_66 = 1; + if (*p == 0x67) + pr_67 = 1; + p++; + s++; + ld->flags |= F_PREFIX; + if (s == 15) { + ld->flags |= F_INVALID; + return s; + } + } + + /* parse REX prefix */ + if (is64 && *p >> 4 == 4) { + ld->rex = *p; + rexw = (ld->rex >> 3) & 1; + ld->flags |= F_REX; + p++; + s++; + } + + /* can be only one REX prefix */ + if (is64 && *p >> 4 == 4) { + ld->flags |= F_INVALID; + s++; + return s; + } + + /* phase 2: parse opcode */ + ld->opcd_offset = (UINT8)(p - (UINT8*)code); + ld->opcd_size = 1; + op = *p++; + s++; + + /* is 2 byte opcode? */ + if (op == 0x0F) { + op = *p++; + s++; + ld->opcd_size++; + f = cflags_ex(op); + if (f & OP_INVALID) { + ld->flags |= F_INVALID; + return s; + } + /* for SSE instructions */ + if (f & OP_EXTENDED) { + op = *p++; + s++; + ld->opcd_size++; + } + } + else { + f = cflags(op); + /* pr_66 = pr_67 for opcodes A0-A3 */ + if (op >= 0xA0 && op <= 0xA3) + pr_66 = pr_67; + } + + /* phase 3: parse ModR/M, SIB and DISP */ + if (f & OP_MODRM) { + UINT8 mod = (*p >> 6); + UINT8 ro = (*p & 0x38) >> 3; + UINT8 rm = (*p & 7); + + ld->modrm = *p++; + s++; + ld->flags |= F_MODRM; + + /* in F6,F7 opcodes immediate data present if R/O == 0 */ + if (op == 0xF6 && (ro == 0 || ro == 1)) + f |= OP_DATA_I8; + if (op == 0xF7 && (ro == 0 || ro == 1)) + f |= OP_DATA_I16_I32_I64; + + /* is SIB byte exist? */ + if (mod != 3 && rm == 4 && !(!is64 && pr_67)) { + ld->sib = *p++; + s++; + ld->flags |= F_SIB; + + /* if base == 5 and mod == 0 */ + if ((ld->sib & 7) == 5 && mod == 0) { + ld->disp_size = 4; + } + } + + switch (mod) { + case 0: + if (is64) { + if (rm == 5) { + ld->disp_size = 4; + if (is64) + ld->flags |= F_RELATIVE; + } + } + else if (pr_67) { + if (rm == 6) + ld->disp_size = 2; + } + else { + if (rm == 5) + ld->disp_size = 4; + } + break; + case 1: + ld->disp_size = 1; + break; + case 2: + if (is64) + ld->disp_size = 4; + else if (pr_67) + ld->disp_size = 2; + else + ld->disp_size = 4; + break; + } + + if (ld->disp_size) { + ld->disp_offset = (UINT8)(p - (UINT8*)code); + p += ld->disp_size; + s += ld->disp_size; + ld->flags |= F_DISP; + } + } + + /* phase 4: parse immediate data */ + if (rexw && f & OP_DATA_I16_I32_I64) + ld->imm_size = 8; + else if (f & OP_DATA_I16_I32 || f & OP_DATA_I16_I32_I64) + ld->imm_size = 4 - (pr_66 << 1); + + /* if exist, add OP_DATA_I16 and OP_DATA_I8 size */ + ld->imm_size += f & 3; + + if (ld->imm_size) { + s += ld->imm_size; + ld->imm_offset = (UINT8)(p - (UINT8*)code); + ld->flags |= F_IMM; + if (f & OP_RELATIVE) + ld->flags |= F_RELATIVE; + } + + /* instruction is too long */ + if (s > 15) + ld->flags |= F_INVALID; + + return s; +} + +// Get function size +unsigned long __fastcall SizeOfProc(void* Proc) +{ + UINT32 Length; + UINT8* pOpcode; + UINT32 Result = 0; + ldasm_data data = { 0 }; + + do { + Length = ldasm((UINT8*)Proc, &data, is_x64); + + pOpcode = (UINT8*)Proc + data.opcd_offset; + Result += Length; + + if (Length == 1) { + UCHAR opCode; + memcpy(&opCode, pOpcode, 1); + if (opCode == (UINT8)0xCC) { + break; + } + } + + /*if ((Length == 1) && (*pOpcode == 0xC3)) + break; + + if ((Length == 3) && (*pOpcode == 0xC2)) + break;*/ + + Proc = (void*)((size_t)Proc + Length); + } while (Length); + + return Result; +} + +// If function address is jmp - get jmp destination +void* __fastcall ResolveJmp(void* Proc) +{ + UINT32 Length; + UINT8* pOpcode; + ldasm_data data = { 0 }; + + Length = ldasm((UINT8*)Proc, &data, is_x64); + pOpcode = (UINT8*)Proc + data.opcd_offset; + + // Recursive unwind + if (Length == 5 && data.opcd_size == 1 && *pOpcode == 0xE9) { + UINT32 delta = *(INT32*)((uintptr_t)Proc + data.opcd_size); + return ResolveJmp((void*)((uintptr_t)Proc + delta + Length)); + } + + return Proc; +} diff --git a/BranchTrace-x64plugin-wtl/LDasm/LDasm.h b/BranchTrace-x64plugin-wtl/LDasm/LDasm.h new file mode 100644 index 0000000..5514989 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/LDasm/LDasm.h @@ -0,0 +1,51 @@ +#ifndef _LDASM_ +#define _LDASM_ + +#include + +#ifdef _WIN64 +#define is_x64 1 +#else +#define is_x64 0 +#endif//USE64 + +#ifdef __cplusplus +extern "C" +{ +#endif + +#define F_INVALID 0x01 +#define F_PREFIX 0x02 +#define F_REX 0x04 +#define F_MODRM 0x08 +#define F_SIB 0x10 +#define F_DISP 0x20 +#define F_IMM 0x40 +#define F_RELATIVE 0x80 + +typedef struct _ldasm_data +{ + UINT8 flags; + UINT8 rex; + UINT8 modrm; + UINT8 sib; + UINT8 opcd_offset; + UINT8 opcd_size; + UINT8 disp_offset; + UINT8 disp_size; + UINT8 imm_offset; + UINT8 imm_size; +} ldasm_data; + + +unsigned int __fastcall ldasm_length(void* code, UINT32 is64); +unsigned int __fastcall ldasm(void* code, ldasm_data* ld, UINT32 is64); +unsigned long __fastcall SizeOfProc(void* Proc); +unsigned int __fastcall PrevInstrLength(void* code, size_t bufferSize, UINT32 is64); +void* __fastcall ResolveJmp(void* Proc); + +#ifdef __cplusplus +} +#endif + +#endif//_LDASM_ diff --git a/BranchTrace-x64plugin-wtl/ThreadTraceCore.cpp b/BranchTrace-x64plugin-wtl/ThreadTraceCore.cpp new file mode 100644 index 0000000..3de4cd5 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/ThreadTraceCore.cpp @@ -0,0 +1,265 @@ +#include "ThreadTraceCore.h" +#include + + + +bool StartTrace(DWORD ThreadId) +{ + + HANDLE hDevice = CreateFileA("\\\\.\\Branch-Trace", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); + + START_THREAD_TRACE_PARAM StartRequest = { 0 }; + StartRequest.ThreadId = ThreadId; + + DWORD BytesReturned = 0; + if (!DeviceIoControl(hDevice, IOCTL_START_THREAD_TRACE, + (LPVOID)&StartRequest, sizeof(StartRequest), + (LPVOID)&StartRequest, sizeof(StartRequest), + &BytesReturned, NULL)) + { + return false; + } + + return true; +} + +bool StopTrace() +{ + HANDLE hDevice = CreateFileA("\\\\.\\Branch-Trace", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); + if (hDevice == INVALID_HANDLE_VALUE) { + return false; + } + DWORD BytesReturned = 0; + STOP_THREAD_TRACE_PARAM StopRequest = { 0 }; + StopRequest.ThreadId = NULL; + StopRequest.Buffer = NULL; + StopRequest.BufferSize = 0; + StopRequest.FilterStart = 0; + StopRequest.FilterEnd = 0; + + if (!DeviceIoControl(hDevice, IOCTL_STOP_THREAD_TRACE, + (LPVOID)&StopRequest, sizeof(StopRequest), + (LPVOID)&StopRequest, sizeof(StopRequest), + &BytesReturned, NULL)) + { + CloseHandle(hDevice); + return false; + } + + CloseHandle(hDevice); + return true; +} + +bool StopAndFetchTrace(DWORD ThreadId, ULONG64 filterStart, ULONG64 fileterEnd, DWORD Records, PBTS_RECORD64* lpRecordStart, PBTS_RECORD64* lpRecordEnd) +{ + if (Records <= 0 || lpRecordStart == NULL || lpRecordEnd == NULL) { + return false; + } + + HANDLE hDevice = CreateFileA("\\\\.\\Branch-Trace", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); + if (hDevice == INVALID_HANDLE_VALUE) { + return false; + } + + DWORD bufferSize = Records * sizeof(BTS_RECORD64); + PVOID Buffer = VirtualAlloc(NULL, bufferSize, MEM_COMMIT, PAGE_READWRITE); + if (Buffer == NULL) { + CloseHandle(hDevice); + return false; + } + + //STOP_THREAD_TRACE_PARAM StopRequest = { 0 }; + //StopRequest.ThreadId = ThreadId; + //StopRequest.Buffer = Buffer; + //StopRequest.BufferSize = bufferSize; + //StopRequest.FilterStart = (ULONG64)filterStart; + //StopRequest.FilterEnd = (ULONG64)fileterEnd; + + STOP_THREAD_TRACE_PARAM StopRequest = { 0 }; + StopRequest.ThreadId = ThreadId; + StopRequest.Buffer = Buffer; + StopRequest.BufferSize = 0x2000; + StopRequest.FilterStart = 0x00400000; + StopRequest.FilterEnd = 0x00D4C000 + 0x4000; + + DWORD BytesReturned = 0; + if (!DeviceIoControl(hDevice, IOCTL_STOP_THREAD_TRACE, + (LPVOID)&StopRequest, sizeof(StopRequest), + (LPVOID)&StopRequest, sizeof(StopRequest), + &BytesReturned, NULL)) + { + VirtualFree(Buffer, 0, MEM_RELEASE); + CloseHandle(hDevice); + return false; + } + + if (StopRequest.ReadSize == 0) { + VirtualFree(Buffer, 0, MEM_RELEASE); + CloseHandle(hDevice); + return false; + } + + + PBTS_RECORD64 RecordStart = (PBTS_RECORD64)Buffer; + PBTS_RECORD64 RecordEnd = (PBTS_RECORD64)((PUCHAR)Buffer + StopRequest.ReadSize); + + // ÄæÅÅ + for (PBTS_RECORD64 p1 = RecordStart, p2 = RecordEnd - 1; + p1 < p2; + p1++, p2--) + { + BTS_RECORD64 temp = *p1; + *p1 = *p2; + *p2 = temp; + } + + + + *lpRecordStart = RecordStart; + *lpRecordEnd = RecordEnd; + + CloseHandle(hDevice); + return true; +} + +bool TraceCursor::isAtTo() +{ + return pathIndex == 1; +} + +bool TraceCursor::isAtFrom() +{ + return pathIndex == 0; +} + +bool TraceCursor::toEndInstr() +{ + nodeIndex = nodes.size() - 1; + pathIndex = currentNode().paths.size() - 1; + return true; +} + +bool TraceCursor::toPrevInstrInto() +{ + if (pathIndex > 0) { + pathIndex--; + return true; + } + + if (nodeIndex > 0) { + nodeIndex--; + pathIndex = currentNode().paths.size() - 1; + return true; + } + + return false; +} + +bool TraceCursor::toNextInstrInto() +{ + if (pathIndex < currentNode().paths.size() - 1) { + pathIndex++; + return true; + } + + + //int pathSize = currentNode().paths.size(); + //if (pathSize > 0 && pathIndex < pathSize - 1) { + // pathIndex++; + // return true; + //} + + if (nodeIndex < nodes.size() - 1) { + nodeIndex++; + pathIndex = 0; + return true; + } + + return false; + + //int nodeSize = nodes.size(); + //if (nodeSize > 0 && nodeIndex < nodeSize - 1) + //{ + // nodeIndex++; + // pathIndex = 0; + // return true; + //} + + //return false; +} + +bool TraceCursor::toPrevInstr() +{ + if (pathIndex > 0) { + pathIndex--; + return true; + } + + if (currentNode().hasPrev) { + nodeIndex = currentNode().prevIndex; + pathIndex = currentNode().paths.size() - 1; + return true; + } + + //if (nodeIndex > 0) + //{ + // nodeIndex--; + // pathIndex = currentNode().paths.size() - 1; + // return true; + //} + + return false; +} + +bool TraceCursor::toNextInstr() +{ + if (pathIndex < currentNode().paths.size() - 1) { + pathIndex++; + return true; + } + + if (currentNode().hasNext) { + nodeIndex = currentNode().nextIndex; + pathIndex = 0; + return true; + } + + return false; +} + +bool TraceCursor::toProcStart() +{ + nodeIndex = currentNode().procStartIndex; + pathIndex = 0; + return true; +} + +bool TraceCursor::toProcEnd() +{ + if (currentNode().procSubIndex.size() > 0) { + nodeIndex = currentNode().procSubIndex.back(); + pathIndex = currentNode().paths.size() - 1; + return true; + } + + return false; +} + +bool TraceCursor::toProcPrevNode() +{ + if (currentNode().hasPrev) { + nodeIndex = currentNode().prevIndex; + } + pathIndex = 0; + return true; +} + +bool TraceCursor::toProcNextNode() +{ + if (currentNode().hasNext) { + nodeIndex = currentNode().nextIndex; + } + pathIndex = 0; + return true; +} + diff --git a/BranchTrace-x64plugin-wtl/ThreadTraceCore.h b/BranchTrace-x64plugin-wtl/ThreadTraceCore.h new file mode 100644 index 0000000..a6e611d --- /dev/null +++ b/BranchTrace-x64plugin-wtl/ThreadTraceCore.h @@ -0,0 +1,103 @@ +#pragma once +#include +#include "..\BranchTracerSys\ioctls.h" +#include +#include "pluginsdk\_scriptapi_flag.h" +//#include "LDasm/LDasm.h" + +#include "LDasm/LDasm.h" + +typedef struct _BTS_RECORD64 +{ + ULONG64 from; // ¼Ç¼·ÖÖ§µÄÔ´µØÖ· + ULONG64 to; // ¼Ç¼·ÖÖ§µÄÄ¿±êµØÖ· + union + { + ULONG64 branchPredicted; + ULONG64 branchType; + }; +}BTS_RECORD64, * PBTS_RECORD64; + + + +enum BRANCH_TYPE +{ + BRANCH_TYPE_UNKOWN, + BRANCH_TYPE_RET, + BRANCH_TYPE_JCC, + BRANCH_TYPE_CALL +}; +bool StartTrace(DWORD ThreadId); +bool StopTrace(); +bool StopAndFetchTrace(DWORD ThreadId, ULONG64 filterStart, ULONG64 fileterEnd, DWORD Records, PBTS_RECORD64* lpRecordStart, PBTS_RECORD64* lpRecordEnd); + + + +class TraceNode { + +public: + // pRecord.from + ULONG_PTR from; + // pRecord.to + ULONG_PTR to; + DWORD branchType; + + bool hasPrev; + bool hasNext; + int prevIndex; // Ìø¹ýÖмäµÄº¯Êýµ÷Óà + int nextIndex; + int procStartIndex; + std::vector procSubIndex; + + + // pRecord.to ~ nextRecord.from + std::vector paths; + + +}; + +class Proc +{ + std::vector nodes; +}; + + +class TraceCursor { +public: + int nodeIndex; + int pathIndex; + + std::vector nodes; + TraceNode& currentNode() { + return nodes[nodeIndex]; + } + + ULONG_PTR currentAddr() { + return nodes[nodeIndex].paths[pathIndex]; + } + DWORD branchType() { + return nodes[nodeIndex].branchType; + } + ULONG_PTR currentFrom() { + return nodes[nodeIndex].from; + } + ULONG_PTR currentTo() { + return nodes[nodeIndex].to; + } + + + bool isAtTo(); + bool isAtFrom(); + + bool toEndInstr(); + bool toPrevInstrInto(); + bool toNextInstrInto(); + bool toPrevInstr(); + bool toNextInstr(); + bool toProcStart(); + bool toProcEnd(); + bool toProcPrevNode(); + bool toProcNextNode(); +}; + + diff --git a/BranchTrace-x64plugin-wtl/ThreadTraceDialog.cpp b/BranchTrace-x64plugin-wtl/ThreadTraceDialog.cpp new file mode 100644 index 0000000..eb772af --- /dev/null +++ b/BranchTrace-x64plugin-wtl/ThreadTraceDialog.cpp @@ -0,0 +1,545 @@ +#include "ThreadTraceDialog.h" +#include "pluginsdk/bridgemain.h" +#include "pluginsdk/_scriptapi_memory.h" +#include "disassembler.h" +#include "pluginsdk/_scriptapi_gui.h" +#include "plugin_global.h" +#include "pluginsdk/_scriptapi_misc.h" +#include +#include + +ThreadTraceDialog::~ThreadTraceDialog() +{ + +} + +BOOL ThreadTraceDialog::OnInitDialog(CWindow wndFocus, LPARAM lInitParam) +{ + DoDataExchange(FALSE); + return TRUE; +} + + +void ThreadTraceDialog::OnCloseDialog() +{ + ShowWindow(SW_HIDE); + ResetAll(); +} + +LRESULT ThreadTraceDialog::OnDropdownComboboxThread(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + // TODO: Add your control notification handler code here + THREADLIST threadList; + DbgGetThreadList(&threadList); + + m_comboThread.ResetContent(); + + // ±éÀúËùÓÐÏ̳߳õʼ»¯Áбí + for (size_t i = 0; i < threadList.count; i++) + { + THREADALLINFO* thread = &threadList.list[i]; + + bool isMainThread = thread->BasicInfo.ThreadNumber == 0; + bool isCurrentThead = i == threadList.CurrentThread; + + CString str; + str.Format("[%d] thread-%x %s %s", i, thread->BasicInfo.ThreadId, isMainThread ? "[main]" : "", isCurrentThead ? "[current]" : ""); + m_comboThread.InsertString(i, str); + m_comboThread.SetItemData(i, thread->BasicInfo.ThreadId); + + if (isMainThread) { + m_comboThread.SetCurSel(i); + } + + } + return 1; +} + +LRESULT ThreadTraceDialog::OnDropdownComboboxModule(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + HANDLE processHandle = DbgGetProcessHandle(); + if (processHandle == NULL) { + return true; + } + + HANDLE Snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, DbgGetProcessId()); + if (Snapshot == INVALID_HANDLE_VALUE) + { + return true; + } + + CString str; + str = "mod.main()"; + duint mainModule = 0; + Script::Misc::ParseExpression(str.GetBuffer(), &mainModule); + + m_comboModule.ResetContent(); + MODULEENTRY32 ModuleInfo = { sizeof(MODULEENTRY32) }; + if (Module32First(Snapshot, &ModuleInfo)) + { + do { + + duint moduleSize = 0; + str.Format("mod.size(%p)", ModuleInfo.hModule); + Script::Misc::ParseExpression(str.GetBuffer(), &moduleSize); + + duint moduleEnd = (duint)ModuleInfo.hModule + moduleSize; + + bool isMainModule = mainModule == (duint)ModuleInfo.hModule; + duint isUserModule = false; + duint isSystemModule = false; + str.Format("mod.user(%p)", ModuleInfo.hModule); + Script::Misc::ParseExpression(str.GetBuffer(), &isUserModule); + str.Format("mod.system(%p)", ModuleInfo.hModule); + Script::Misc::ParseExpression(str.GetBuffer(), &isSystemModule); + + + str.Format("[%-4s][%p] %s\n", + isMainModule ? "main" : isUserModule ? "user" : isSystemModule ? "syst" : "", + ModuleInfo.hModule, ModuleInfo.szModule); + int index = m_comboModule.InsertString(m_comboModule.GetCount(), str); + m_comboModule.SetItemData(index, (ULONG_PTR)ModuleInfo.hModule); + + if (isMainModule) { + m_comboModule.SetCurSel(index); + } + + } while (Module32Next(Snapshot, &ModuleInfo)); + } + return true; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonStarttrace(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + // ¿ªÆô¸ú×Ù + int cursel = m_comboThread.GetCurSel(); + if (cursel == -1) { + MessageBox(TEXT("You must select a thread!")); + return TRUE; + } + + cursel = m_comboModule.GetCurSel(); + if (cursel == -1) { + MessageBox(TEXT("You must select a module!")); + return TRUE; + } + + +#ifdef DEBUG + +#else + if (!StartTrace(m_comboThread.GetItemData(cursel))) { + MessageBox(TEXT("Start Trace failed!")); + return FALSE; + } +#endif // DEBUG + + m_bTracingFlag = TRUE; + + // µ÷Õû½çÃæ + m_buttonStarttrace.EnableWindow(FALSE); + m_buttonReset.EnableWindow(TRUE); + m_comboThread.EnableWindow(FALSE); + m_comboModule.EnableWindow(FALSE); + + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonReset(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + ResetAll(); + return TRUE; +} + + + +LRESULT ThreadTraceDialog::OnBnClickedButtonPrevInto(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toPrevInstrInto(); + ULONG_PTR addr = cursor.currentAddr(); + GuiDisasmAt(addr, addr); + return TRUE; +} + + +LRESULT ThreadTraceDialog::OnBnClickedButtonNextInto(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toNextInstrInto(); + ULONG_PTR addr = cursor.currentAddr(); + GuiDisasmAt(addr, addr); + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonPrev(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + + // »ñÈ¡ÉÏÒ»ÌõÖ¸ÁîµÄµØÖ·. + cursor.toPrevInstr(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + + return TRUE; +} + + +LRESULT ThreadTraceDialog::OnBnClickedButtonNext(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + + // »ñÈ¡ÏÂÒ»ÌõÖ¸ÁîµÄµØÖ·. + cursor.toNextInstr(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonProcStart(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toProcStart(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + + + CString str; + TraceNode node = cursor.currentNode(); + + + for (size_t j = 0; j < node.paths.size(); j++) + { + str.Format("traceexecute %p", node.paths[j]); + DbgCmdExec(str.GetBuffer()); + } + + while (node.hasNext) + { + node = cursor.nodes[node.nextIndex]; + for (size_t j = 0; j < node.paths.size(); j++) + { + str.Format("traceexecute %p", node.paths[j]); + DbgCmdExec(str.GetBuffer()); + } + } + + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonProcEnd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toProcEnd(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonPrevSnippet(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toProcPrevNode(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonNextSnippet(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toProcNextNode(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + return TRUE; +} + +LRESULT ThreadTraceDialog::OnBnClickedButtonToEnd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) +{ + cursor.toEndInstr(); + ULONG_PTR addr = cursor.currentAddr(); + GuiDisasmAt(addr, addr); + + return TRUE; +} + +void ThreadTraceDialog::OnBreakDebugPoint() +{ + if (m_bTracingFlag != TRUE) { + return; + } + + int threadComboCursel = m_comboThread.GetCurSel(); + if (threadComboCursel == -1) { + return; + } + + int moduleComboCursel = m_comboModule.GetCurSel(); + if (moduleComboCursel == -1) { + return; + } + + + // ×·×ÙµÄÏß³ÌID + DWORD_PTR traceThreadId = m_comboThread.GetItemData(threadComboCursel); + DWORD_PTR moduleBase = m_comboModule.GetItemData(moduleComboCursel); + CString temp; + //duint moduleSize = 0; + //temp.Format("mem.size(%p)", moduleBase); + //Script::Misc::ParseExpression(temp.GetBuffer(), &moduleSize); + duint moduleSize = 0; + temp.Format("mod.size(%p)", moduleBase); + Script::Misc::ParseExpression(temp.GetBuffer(), &moduleSize); + DWORD_PTR moduleEnd = moduleBase + moduleSize; + + + + // »ñÈ¡±»ÖжϵÄÏß³ÌÐÅÏ¢ + THREADLIST threadList; + DbgGetThreadList(&threadList); + DWORD breakedThread = threadList.list[threadList.CurrentThread].BasicInfo.ThreadId; + + if (traceThreadId != breakedThread) { + return; + } + + // Í£Ö¹¼à¿Ø + if (!StopAndFetchTrace(traceThreadId, moduleBase, moduleEnd, 5000, &RecordStart, &RecordEnd)) { + MessageBox("Fetch trace record failed!"); + m_bTracingFlag = FALSE; + return; + } + + m_bTracingFlag = FALSE; + + + // ½âÎöÖ¸Áî + Disassembler* disasm = PluginGlobal::GetInstance()->disassembler; + Instruction instrction; + duint readSize; + unsigned char instrBuffer[0x10]; + PBTS_RECORD64 pRecord = RecordEnd - 1; + while (pRecord >= RecordStart) + { + Script::Memory::Read((duint)pRecord->from, instrBuffer, 0x10, &readSize); + + if (!disasm->Disasm(instrBuffer, readSize, &instrction)) { + _plugin_logprintf("BranchTrace Error: Disasm failed! codes:"); + for (duint i = 0; i < readSize; i++) { + _plugin_logprintf("%x ", instrBuffer[i]); + } + continue; + } + ZydisMnemonic mnemonic = instrction.zydisInstrction.mnemonic; + if (mnemonic == ZYDIS_MNEMONIC_RET) { + pRecord->branchType = BRANCH_TYPE_RET; + } + else if (ZYDIS_MNEMONIC_JB <= mnemonic && mnemonic <= ZYDIS_MNEMONIC_JZ) { + pRecord->branchType = BRANCH_TYPE_JCC; + } + else if (mnemonic == ZYDIS_MNEMONIC_CALL) { + pRecord->branchType = BRANCH_TYPE_CALL; + } + else { + // UNKOWN Instrction; + pRecord->branchType = BRANCH_TYPE_UNKOWN; + _plugin_logprintf("UNKOWN at : %p mnemonic:%d \n", pRecord->from, instrction.zydisInstrction.mnemonic); + } + + pRecord--; + } + + + + // ´æ´¢Êý¾Ý + cursor.nodes.clear(); + int instrCount = 0; + + std::map PrcoToMap;; + std::stack ProcStak; + + CString str; + pRecord = RecordStart; + + while (pRecord < RecordEnd) + { + int currentNodeIndex = cursor.nodes.size(); + // ¼ÓÈëÁбí + cursor.nodes.emplace_back(); + TraceNode& node = cursor.nodes.back(); + + node.from = pRecord->from; + node.to = pRecord->to; + node.branchType = pRecord->branchType; + + node.paths.push_back(pRecord->to); + instrCount++; + + // Ìî³ä´úÂë¿é + PBTS_RECORD64 pNextRecord = pRecord + 1; + + str.Format("dis.next(%p)", pRecord->to); + duint nextInstr = 0; + Script::Misc::ParseExpression(str.GetBuffer(), &nextInstr); + + if (pNextRecord < RecordEnd) + { + // ±ÜÃâÔàÊý¾Ý,´óÓÚ500×ֽڵĴúÂë¿éÖ±½ÓÌø¹ý + ULONG64 offset = pNextRecord->from - nextInstr; + while (nextInstr != 0 && nextInstr <= pNextRecord->from && offset < 500) + { + node.paths.push_back(nextInstr); + instrCount++; + + str.Format("dis.next(%p)", nextInstr); + nextInstr = 0; + Script::Misc::ParseExpression(str.GetBuffer(), &nextInstr); + } + + } + + // ±ê¼ÇprocStartIndex procSubNodeIndex + switch (node.branchType) + { + case BRANCH_TYPE_CALL: + ProcStak.push(currentNodeIndex); + node.procStartIndex = currentNodeIndex; + cursor.nodes[currentNodeIndex].procSubIndex.push_back(currentNodeIndex); + break; + + case BRANCH_TYPE_RET: + + if (!ProcStak.empty()) { + ProcStak.pop(); + } + + if (!ProcStak.empty()) { + node.procStartIndex = ProcStak.top(); + cursor.nodes[ProcStak.top()].procSubIndex.push_back(currentNodeIndex); + } + else { + node.procStartIndex = currentNodeIndex; + cursor.nodes[currentNodeIndex].procSubIndex.push_back(currentNodeIndex); + } + break; + + case BRANCH_TYPE_JCC: + if (!ProcStak.empty()) { + node.procStartIndex = ProcStak.top(); + cursor.nodes[ProcStak.top()].procSubIndex.push_back(currentNodeIndex); + + } + else { + node.procStartIndex = currentNodeIndex; + cursor.nodes[currentNodeIndex].procSubIndex.push_back(currentNodeIndex); + } + + break; + default: + break; + } + + // ±ê¼Ç PrcoÁ´ 1~2~3~4 + if (node.branchType == BRANCH_TYPE_CALL) { + + duint nextInstr = 0; + str.Format("dis.next(%p)", pRecord->from); + Script::Misc::ParseExpression(str.GetBuffer(), &nextInstr); + if (nextInstr != 0) { + PrcoToMap[nextInstr] = currentNodeIndex - 1; + } + + } + else if (node.branchType == BRANCH_TYPE_RET) + { + if (PrcoToMap.count(node.to) > 0) { + auto preIndex = PrcoToMap[node.to]; + auto curIndex = currentNodeIndex; + + cursor.nodes[preIndex].nextIndex = curIndex; + cursor.nodes[preIndex].hasNext = true; + cursor.nodes[curIndex].prevIndex = preIndex; + cursor.nodes[curIndex].hasPrev = true; + + PrcoToMap.erase(node.to); + } + } + else if (node.branchType == BRANCH_TYPE_JCC) + { + if (currentNodeIndex > 0) { + auto preIndex = currentNodeIndex - 1; + auto curIndex = currentNodeIndex; + cursor.nodes[preIndex].nextIndex = curIndex; + cursor.nodes[preIndex].hasNext = true; + cursor.nodes[curIndex].prevIndex = preIndex; + cursor.nodes[curIndex].hasPrev = true; + } + } + pRecord++; + } + + + + + + // ÉèÖÃÆðʼλÖà + cursor.toEndInstr(); + GuiDisasmAt(cursor.currentAddr(), cursor.currentAddr()); + + // ÉèÖÿؼþ״̬ + m_comboThread.EnableWindow(FALSE); + m_buttonPrevInto.EnableWindow(TRUE); + m_buttonNextInto.EnableWindow(TRUE); + m_buttonProcStart.EnableWindow(TRUE); + m_buttonProcEnd.EnableWindow(TRUE); + m_buttonPrevSnippet.EnableWindow(TRUE); + m_buttonNextSnippet.EnableWindow(TRUE); + m_buttonPrev.EnableWindow(TRUE); + m_buttonNext.EnableWindow(TRUE); + m_buttonToEnd.EnableWindow(TRUE); + + + CString note; + int count = RecordEnd - RecordStart; + note.Format(TEXT("Fetched Branch Records!\r\n Branch count: %d\r\nInstrction count: %d"), count, instrCount); + MessageBox(note, TEXT("SUCCESS")); + + + + // ÊÍ·ÅÄÚ´æ + if (RecordStart) { + VirtualFree((PVOID)RecordStart, 0, MEM_RELEASE); + RecordStart = NULL; + RecordEnd = NULL; + } + +} + +void ThreadTraceDialog::ResetAll() +{ + // Í£Ö¹¼à¿Ø + StopTrace(); + m_bTracingFlag = FALSE; + + // ÖØÖÿؼþ + m_buttonStarttrace.EnableWindow(TRUE); + m_buttonReset.EnableWindow(FALSE); + m_buttonPrevInto.EnableWindow(FALSE); + m_buttonNextInto.EnableWindow(FALSE); + m_buttonProcStart.EnableWindow(FALSE); + m_buttonProcEnd.EnableWindow(FALSE); + m_buttonPrevSnippet.EnableWindow(FALSE); + m_buttonNextSnippet.EnableWindow(FALSE); + m_buttonPrev.EnableWindow(FALSE); + m_buttonNext.EnableWindow(FALSE); + m_buttonToEnd.EnableWindow(FALSE); + + m_comboThread.EnableWindow(TRUE); + m_comboThread.SetCurSel(-1); + m_comboModule.EnableWindow(TRUE); + m_comboModule.SetCurSel(-1); + + + +} + +void ThreadTraceDialog::HighlightTrace() +{ + //PBTS_RECORD64 pRecord = RecordCursor; + //CString str; + //str.Format("traceexecute %p", pRecord->to); + //DbgCmdExec(str.GetBuffer()); + //str.Format("traceexecute %p", pRecord->from); + //DbgCmdExec(str.GetBuffer()); + + return; +} + + diff --git a/BranchTrace-x64plugin-wtl/ThreadTraceDialog.h b/BranchTrace-x64plugin-wtl/ThreadTraceDialog.h new file mode 100644 index 0000000..5af39b5 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/ThreadTraceDialog.h @@ -0,0 +1,114 @@ +#pragma once +#include "stdafx.h" +#include "ThreadTraceCore.h" + + +class ThreadTraceDialog : public CDialogImpl, public CWinDataExchange +{ + +protected: + + // ¿Ø¼þ + CComboBoxImpl m_comboThread; + CComboBoxImpl m_comboModule; + CButtonImpl m_buttonStarttrace; + CButtonImpl m_buttonReset; + CButtonImpl m_buttonPrevInto; + CButtonImpl m_buttonNextInto; + CButtonImpl m_buttonProcStart; + CButtonImpl m_buttonProcEnd; + CButtonImpl m_buttonPrevSnippet; + CButtonImpl m_buttonNextSnippet; + CButtonImpl m_buttonPrev; + CButtonImpl m_buttonNext; + CButtonImpl m_buttonToEnd; + + + PBTS_RECORD64 RecordStart = NULL; + PBTS_RECORD64 RecordEnd = NULL; + PBTS_RECORD64 RecordCursor = NULL; + BOOL ToFromFlag = TRUE; + TraceCursor cursor; + + +#define AT_TO TRUE +#define AT_FROM FALSE + BOOL m_bTracingFlag; // AT_TO | AT_FROM + + +public: + ThreadTraceDialog() : RecordStart(NULL), RecordEnd(NULL), m_bTracingFlag(FALSE) {}; + ~ThreadTraceDialog(); + + + // msg handler + BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam); + void OnCloseDialog(); + + // command hander + LRESULT OnDropdownComboboxThread(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnDropdownComboboxModule(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonStarttrace(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonReset(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonPrevInto(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonNextInto(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonProcStart(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonProcEnd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonPrevSnippet(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonNextSnippet(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonPrev(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonNext(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnBnClickedButtonToEnd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + + void OnBreakDebugPoint(); + void ResetAll(); + void HighlightTrace(); + + +public: + enum { IDD = IDD_DIALOG_THREAD_TRACE }; + + BEGIN_MSG_MAP(ThreadTraceDialog) + // commands + MSG_WM_INITDIALOG(OnInitDialog) + MSG_WM_CLOSE(OnCloseDialog) + + // combo-box + COMMAND_HANDLER(IDC_COMBO_THREAD, CBN_DROPDOWN, OnDropdownComboboxThread) + COMMAND_HANDLER(IDC_COMBO_MODULE, CBN_DROPDOWN, OnDropdownComboboxModule) + + // buttons + COMMAND_ID_HANDLER(IDC_BUTTON_STARTTRACE, OnBnClickedButtonStarttrace) + COMMAND_ID_HANDLER(IDC_BUTTON_RESET, OnBnClickedButtonReset) + COMMAND_ID_HANDLER(IDC_BUTTON_PREVINTO, OnBnClickedButtonPrevInto) + COMMAND_ID_HANDLER(IDC_BUTTON_NEXTINTO, OnBnClickedButtonNextInto) + COMMAND_ID_HANDLER(IDC_BUTTON_PROCSTART, OnBnClickedButtonProcStart) + COMMAND_ID_HANDLER(IDC_BUTTON_PROCEND, OnBnClickedButtonProcEnd) + COMMAND_ID_HANDLER(IDC_BUTTON_PREVSNIPPET, OnBnClickedButtonPrevSnippet) + COMMAND_ID_HANDLER(IDC_BUTTON_NEXTSNIPPET, OnBnClickedButtonNextSnippet) + COMMAND_ID_HANDLER(IDC_BUTTON_PREV, OnBnClickedButtonPrev) + COMMAND_ID_HANDLER(IDC_BUTTON_NEXT, OnBnClickedButtonNext) + COMMAND_ID_HANDLER(IDC_BUTTON_TOEND, OnBnClickedButtonToEnd) + + END_MSG_MAP() + + + BEGIN_DDX_MAP(ThreadTraceDialog) + // controls + DDX_CONTROL(IDC_COMBO_THREAD, m_comboThread) + DDX_CONTROL(IDC_COMBO_MODULE, m_comboModule) + DDX_CONTROL(IDC_BUTTON_STARTTRACE, m_buttonStarttrace) + DDX_CONTROL(IDC_BUTTON_RESET, m_buttonReset) + DDX_CONTROL(IDC_BUTTON_PREVINTO, m_buttonPrevInto) + DDX_CONTROL(IDC_BUTTON_NEXTINTO, m_buttonNextInto) + DDX_CONTROL(IDC_BUTTON_PROCSTART, m_buttonProcStart) + DDX_CONTROL(IDC_BUTTON_PROCEND, m_buttonProcEnd) + DDX_CONTROL(IDC_BUTTON_PREVSNIPPET, m_buttonPrevSnippet) + DDX_CONTROL(IDC_BUTTON_NEXTSNIPPET, m_buttonNextSnippet) + + DDX_CONTROL(IDC_BUTTON_PREV, m_buttonPrev) + DDX_CONTROL(IDC_BUTTON_NEXT, m_buttonNext) + DDX_CONTROL(IDC_BUTTON_TOEND, m_buttonToEnd) + END_DDX_MAP() + +}; \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/disassembler.cpp b/BranchTrace-x64plugin-wtl/disassembler.cpp new file mode 100644 index 0000000..a606164 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/disassembler.cpp @@ -0,0 +1,321 @@ +#include "disassembler.h" +#include +#include + + +Disassembler::Disassembler() +{ +#ifdef _WIN64 + ZydisDecoderInit(&zydisDecoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64); +#else + ZydisDecoderInit(&zydisDecoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_ADDRESS_WIDTH_32); +#endif // _WIN64 +} + + +bool Disassembler::Disasm(unsigned char* code, size_t codesize, Instruction* instruction) +{ + return ZYAN_SUCCESS(ZydisDecoderDecodeBuffer(&zydisDecoder, code, codesize, &(instruction->zydisInstrction))); +} + +const char* Disassembler::FormatZydisRegister(ZydisRegister reg) +{ + switch (reg) + { + case ZYDIS_REGISTER_NONE: return ""; + case ZYDIS_REGISTER_AL: return "al"; + case ZYDIS_REGISTER_CL: return "cl"; + case ZYDIS_REGISTER_DL: return "dl"; + case ZYDIS_REGISTER_BL: return "bl"; + case ZYDIS_REGISTER_AH: return "ah"; + case ZYDIS_REGISTER_CH: return "ch"; + case ZYDIS_REGISTER_DH: return "dh"; + case ZYDIS_REGISTER_BH: return "bh"; + case ZYDIS_REGISTER_SPL: return "spl"; + case ZYDIS_REGISTER_BPL: return "bpl"; + case ZYDIS_REGISTER_SIL: return "sil"; + case ZYDIS_REGISTER_DIL: return "dil"; + case ZYDIS_REGISTER_R8B: return "r8b"; + case ZYDIS_REGISTER_R9B: return "r9b"; + case ZYDIS_REGISTER_R10B: return "r10b"; + case ZYDIS_REGISTER_R11B: return "r11b"; + case ZYDIS_REGISTER_R12B: return "r12b"; + case ZYDIS_REGISTER_R13B: return "r13b"; + case ZYDIS_REGISTER_R14B: return "r14b"; + case ZYDIS_REGISTER_R15B: return "r15b"; + case ZYDIS_REGISTER_AX: return "ax"; + case ZYDIS_REGISTER_CX: return "cx"; + case ZYDIS_REGISTER_DX: return "dx"; + case ZYDIS_REGISTER_BX: return "bx"; + case ZYDIS_REGISTER_SP: return "sp"; + case ZYDIS_REGISTER_BP: return "bp"; + case ZYDIS_REGISTER_SI: return "si"; + case ZYDIS_REGISTER_DI: return "di"; + case ZYDIS_REGISTER_R8W: return "r8w"; + case ZYDIS_REGISTER_R9W: return "r9w"; + case ZYDIS_REGISTER_R10W: return "r10w"; + case ZYDIS_REGISTER_R11W: return "r11w"; + case ZYDIS_REGISTER_R12W: return "r12w"; + case ZYDIS_REGISTER_R13W: return "r13w"; + case ZYDIS_REGISTER_R14W: return "r14w"; + case ZYDIS_REGISTER_R15W: return "r15w"; + case ZYDIS_REGISTER_EAX: return "eax"; + case ZYDIS_REGISTER_ECX: return "ecx"; + case ZYDIS_REGISTER_EDX: return "edx"; + case ZYDIS_REGISTER_EBX: return "ebx"; + case ZYDIS_REGISTER_ESP: return "esp"; + case ZYDIS_REGISTER_EBP: return "ebp"; + case ZYDIS_REGISTER_ESI: return "esi"; + case ZYDIS_REGISTER_EDI: return "edi"; + case ZYDIS_REGISTER_R8D: return "r8d"; + case ZYDIS_REGISTER_R9D: return "r9d"; + case ZYDIS_REGISTER_R10D: return "r10d"; + case ZYDIS_REGISTER_R11D: return "r11d"; + case ZYDIS_REGISTER_R12D: return "r12d"; + case ZYDIS_REGISTER_R13D: return "r13d"; + case ZYDIS_REGISTER_R14D: return "r14d"; + case ZYDIS_REGISTER_R15D: return "r15d"; + case ZYDIS_REGISTER_RAX: return "rax"; + case ZYDIS_REGISTER_RCX: return "rcx"; + case ZYDIS_REGISTER_RDX: return "rdx"; + case ZYDIS_REGISTER_RBX: return "rbx"; + case ZYDIS_REGISTER_RSP: return "rsp"; + case ZYDIS_REGISTER_RBP: return "rbp"; + case ZYDIS_REGISTER_RSI: return "rsi"; + case ZYDIS_REGISTER_RDI: return "rdi"; + case ZYDIS_REGISTER_R8: return "r8"; + case ZYDIS_REGISTER_R9: return "r9"; + case ZYDIS_REGISTER_R10: return "r10"; + case ZYDIS_REGISTER_R11: return "r11"; + case ZYDIS_REGISTER_R12: return "r12"; + case ZYDIS_REGISTER_R13: return "r13"; + case ZYDIS_REGISTER_R14: return "r14"; + case ZYDIS_REGISTER_R15: return "r15"; + case ZYDIS_REGISTER_ST0: return "st0"; + case ZYDIS_REGISTER_ST1: return "st1"; + case ZYDIS_REGISTER_ST2: return "st2"; + case ZYDIS_REGISTER_ST3: return "st3"; + case ZYDIS_REGISTER_ST4: return "st4"; + case ZYDIS_REGISTER_ST5: return "st5"; + case ZYDIS_REGISTER_ST6: return "st6"; + case ZYDIS_REGISTER_ST7: return "st7"; + case ZYDIS_REGISTER_X87CONTROL: return "x87control"; + case ZYDIS_REGISTER_X87STATUS: return "x87status"; + case ZYDIS_REGISTER_X87TAG: return "x87tag"; + case ZYDIS_REGISTER_MM0: return "mm0"; + case ZYDIS_REGISTER_MM1: return "mm1"; + case ZYDIS_REGISTER_MM2: return "mm2"; + case ZYDIS_REGISTER_MM3: return "mm3"; + case ZYDIS_REGISTER_MM4: return "mm4"; + case ZYDIS_REGISTER_MM5: return "mm5"; + case ZYDIS_REGISTER_MM6: return "mm6"; + case ZYDIS_REGISTER_MM7: return "mm7"; + case ZYDIS_REGISTER_XMM0: return "xmm0"; + case ZYDIS_REGISTER_XMM1: return "xmm1"; + case ZYDIS_REGISTER_XMM2: return "xmm2"; + case ZYDIS_REGISTER_XMM3: return "xmm3"; + case ZYDIS_REGISTER_XMM4: return "xmm4"; + case ZYDIS_REGISTER_XMM5: return "xmm5"; + case ZYDIS_REGISTER_XMM6: return "xmm6"; + case ZYDIS_REGISTER_XMM7: return "xmm7"; + case ZYDIS_REGISTER_XMM8: return "xmm8"; + case ZYDIS_REGISTER_XMM9: return "xmm9"; + case ZYDIS_REGISTER_XMM10: return "xmm10"; + case ZYDIS_REGISTER_XMM11: return "xmm11"; + case ZYDIS_REGISTER_XMM12: return "xmm12"; + case ZYDIS_REGISTER_XMM13: return "xmm13"; + case ZYDIS_REGISTER_XMM14: return "xmm14"; + case ZYDIS_REGISTER_XMM15: return "xmm15"; + case ZYDIS_REGISTER_XMM16: return "xmm16"; + case ZYDIS_REGISTER_XMM17: return "xmm17"; + case ZYDIS_REGISTER_XMM18: return "xmm18"; + case ZYDIS_REGISTER_XMM19: return "xmm19"; + case ZYDIS_REGISTER_XMM20: return "xmm20"; + case ZYDIS_REGISTER_XMM21: return "xmm21"; + case ZYDIS_REGISTER_XMM22: return "xmm22"; + case ZYDIS_REGISTER_XMM23: return "xmm23"; + case ZYDIS_REGISTER_XMM24: return "xmm24"; + case ZYDIS_REGISTER_XMM25: return "xmm25"; + case ZYDIS_REGISTER_XMM26: return "xmm26"; + case ZYDIS_REGISTER_XMM27: return "xmm27"; + case ZYDIS_REGISTER_XMM28: return "xmm28"; + case ZYDIS_REGISTER_XMM29: return "xmm29"; + case ZYDIS_REGISTER_XMM30: return "xmm30"; + case ZYDIS_REGISTER_XMM31: return "xmm31"; + case ZYDIS_REGISTER_YMM0: return "ymm0"; + case ZYDIS_REGISTER_YMM1: return "ymm1"; + case ZYDIS_REGISTER_YMM2: return "ymm2"; + case ZYDIS_REGISTER_YMM3: return "ymm3"; + case ZYDIS_REGISTER_YMM4: return "ymm4"; + case ZYDIS_REGISTER_YMM5: return "ymm5"; + case ZYDIS_REGISTER_YMM6: return "ymm6"; + case ZYDIS_REGISTER_YMM7: return "ymm7"; + case ZYDIS_REGISTER_YMM8: return "ymm8"; + case ZYDIS_REGISTER_YMM9: return "ymm9"; + case ZYDIS_REGISTER_YMM10: return "ymm10"; + case ZYDIS_REGISTER_YMM11: return "ymm11"; + case ZYDIS_REGISTER_YMM12: return "ymm12"; + case ZYDIS_REGISTER_YMM13: return "ymm13"; + case ZYDIS_REGISTER_YMM14: return "ymm14"; + case ZYDIS_REGISTER_YMM15: return "ymm15"; + case ZYDIS_REGISTER_YMM16: return "ymm16"; + case ZYDIS_REGISTER_YMM17: return "ymm17"; + case ZYDIS_REGISTER_YMM18: return "ymm18"; + case ZYDIS_REGISTER_YMM19: return "ymm19"; + case ZYDIS_REGISTER_YMM20: return "ymm20"; + case ZYDIS_REGISTER_YMM21: return "ymm21"; + case ZYDIS_REGISTER_YMM22: return "ymm22"; + case ZYDIS_REGISTER_YMM23: return "ymm23"; + case ZYDIS_REGISTER_YMM24: return "ymm24"; + case ZYDIS_REGISTER_YMM25: return "ymm25"; + case ZYDIS_REGISTER_YMM26: return "ymm26"; + case ZYDIS_REGISTER_YMM27: return "ymm27"; + case ZYDIS_REGISTER_YMM28: return "ymm28"; + case ZYDIS_REGISTER_YMM29: return "ymm29"; + case ZYDIS_REGISTER_YMM30: return "ymm30"; + case ZYDIS_REGISTER_YMM31: return "ymm31"; + case ZYDIS_REGISTER_ZMM0: return "zmm0"; + case ZYDIS_REGISTER_ZMM1: return "zmm1"; + case ZYDIS_REGISTER_ZMM2: return "zmm2"; + case ZYDIS_REGISTER_ZMM3: return "zmm3"; + case ZYDIS_REGISTER_ZMM4: return "zmm4"; + case ZYDIS_REGISTER_ZMM5: return "zmm5"; + case ZYDIS_REGISTER_ZMM6: return "zmm6"; + case ZYDIS_REGISTER_ZMM7: return "zmm7"; + case ZYDIS_REGISTER_ZMM8: return "zmm8"; + case ZYDIS_REGISTER_ZMM9: return "zmm9"; + case ZYDIS_REGISTER_ZMM10: return "zmm10"; + case ZYDIS_REGISTER_ZMM11: return "zmm11"; + case ZYDIS_REGISTER_ZMM12: return "zmm12"; + case ZYDIS_REGISTER_ZMM13: return "zmm13"; + case ZYDIS_REGISTER_ZMM14: return "zmm14"; + case ZYDIS_REGISTER_ZMM15: return "zmm15"; + case ZYDIS_REGISTER_ZMM16: return "zmm16"; + case ZYDIS_REGISTER_ZMM17: return "zmm17"; + case ZYDIS_REGISTER_ZMM18: return "zmm18"; + case ZYDIS_REGISTER_ZMM19: return "zmm19"; + case ZYDIS_REGISTER_ZMM20: return "zmm20"; + case ZYDIS_REGISTER_ZMM21: return "zmm21"; + case ZYDIS_REGISTER_ZMM22: return "zmm22"; + case ZYDIS_REGISTER_ZMM23: return "zmm23"; + case ZYDIS_REGISTER_ZMM24: return "zmm24"; + case ZYDIS_REGISTER_ZMM25: return "zmm25"; + case ZYDIS_REGISTER_ZMM26: return "zmm26"; + case ZYDIS_REGISTER_ZMM27: return "zmm27"; + case ZYDIS_REGISTER_ZMM28: return "zmm28"; + case ZYDIS_REGISTER_ZMM29: return "zmm29"; + case ZYDIS_REGISTER_ZMM30: return "zmm30"; + case ZYDIS_REGISTER_ZMM31: return "zmm31"; + case ZYDIS_REGISTER_FLAGS: return "flags"; + case ZYDIS_REGISTER_EFLAGS: return "eflags"; + case ZYDIS_REGISTER_RFLAGS: return "rflags"; + case ZYDIS_REGISTER_IP: return "ip"; + case ZYDIS_REGISTER_EIP: return "eip"; + case ZYDIS_REGISTER_RIP: return "rip"; + case ZYDIS_REGISTER_ES: return "es"; + case ZYDIS_REGISTER_CS: return "cs"; + case ZYDIS_REGISTER_SS: return "ss"; + case ZYDIS_REGISTER_DS: return "ds"; + case ZYDIS_REGISTER_FS: return "fs"; + case ZYDIS_REGISTER_GS: return "gs"; + case ZYDIS_REGISTER_GDTR: return "gdtr"; + case ZYDIS_REGISTER_LDTR: return "ldtr"; + case ZYDIS_REGISTER_IDTR: return "idtr"; + case ZYDIS_REGISTER_TR: return "tr"; + case ZYDIS_REGISTER_TR0: return "tr0"; + case ZYDIS_REGISTER_TR1: return "tr1"; + case ZYDIS_REGISTER_TR2: return "tr2"; + case ZYDIS_REGISTER_TR3: return "tr3"; + case ZYDIS_REGISTER_TR4: return "tr4"; + case ZYDIS_REGISTER_TR5: return "tr5"; + case ZYDIS_REGISTER_TR6: return "tr6"; + case ZYDIS_REGISTER_TR7: return "tr7"; + case ZYDIS_REGISTER_CR0: return "cr0"; + case ZYDIS_REGISTER_CR1: return "cr1"; + case ZYDIS_REGISTER_CR2: return "cr2"; + case ZYDIS_REGISTER_CR3: return "cr3"; + case ZYDIS_REGISTER_CR4: return "cr4"; + case ZYDIS_REGISTER_CR5: return "cr5"; + case ZYDIS_REGISTER_CR6: return "cr6"; + case ZYDIS_REGISTER_CR7: return "cr7"; + case ZYDIS_REGISTER_CR8: return "cr8"; + case ZYDIS_REGISTER_CR9: return "cr9"; + case ZYDIS_REGISTER_CR10: return "cr10"; + case ZYDIS_REGISTER_CR11: return "cr11"; + case ZYDIS_REGISTER_CR12: return "cr12"; + case ZYDIS_REGISTER_CR13: return "cr13"; + case ZYDIS_REGISTER_CR14: return "cr14"; + case ZYDIS_REGISTER_CR15: return "cr15"; + case ZYDIS_REGISTER_DR0: return "dr0"; + case ZYDIS_REGISTER_DR1: return "dr1"; + case ZYDIS_REGISTER_DR2: return "dr2"; + case ZYDIS_REGISTER_DR3: return "dr3"; + case ZYDIS_REGISTER_DR4: return "dr4"; + case ZYDIS_REGISTER_DR5: return "dr5"; + case ZYDIS_REGISTER_DR6: return "dr6"; + case ZYDIS_REGISTER_DR7: return "dr7"; + case ZYDIS_REGISTER_DR8: return "dr8"; + case ZYDIS_REGISTER_DR9: return "dr9"; + case ZYDIS_REGISTER_DR10: return "dr10"; + case ZYDIS_REGISTER_DR11: return "dr11"; + case ZYDIS_REGISTER_DR12: return "dr12"; + case ZYDIS_REGISTER_DR13: return "dr13"; + case ZYDIS_REGISTER_DR14: return "dr14"; + case ZYDIS_REGISTER_DR15: return "dr15"; + case ZYDIS_REGISTER_K0: return "k0"; + case ZYDIS_REGISTER_K1: return "k1"; + case ZYDIS_REGISTER_K2: return "k2"; + case ZYDIS_REGISTER_K3: return "k3"; + case ZYDIS_REGISTER_K4: return "k4"; + case ZYDIS_REGISTER_K5: return "k5"; + case ZYDIS_REGISTER_K6: return "k6"; + case ZYDIS_REGISTER_K7: return "k7"; + case ZYDIS_REGISTER_BND0: return "bnd0"; + case ZYDIS_REGISTER_BND1: return "bnd1"; + case ZYDIS_REGISTER_BND2: return "bnd2"; + case ZYDIS_REGISTER_BND3: return "bnd3"; + case ZYDIS_REGISTER_BNDCFG: return "bndcfg"; + case ZYDIS_REGISTER_BNDSTATUS: return "bndstatus"; + case ZYDIS_REGISTER_MXCSR: return "mxcsr"; + case ZYDIS_REGISTER_PKRU: return "pkru"; + case ZYDIS_REGISTER_XCR0: return "xcr0"; + } + return ""; +} + + +void Disassembler::loadPage(void* buffer, size_t pageAddr) +{ + if (m_pageInstrAddrMap.count(pageAddr) != 0) { + return; + } + + + std::vector addrList; + std::map indexMap; + + Instruction instr; + int index = 0; + size_t position = 0; + while (position < 0x1000) + { + if (Disasm((unsigned char*)buffer + position, 0x1000 - position, &instr) == false) { + break; + } + instr.zydisInstrction.length; + + addrList.push_back(pageAddr + position); + indexMap.insert(std::make_pair(pageAddr + position, index)); + + index++; + position += instr.zydisInstrction.length; + } + + m_pageInstrAddrMap.insert(std::make_pair(pageAddr, addrList)); + m_pageInstrAddrIndexMap.insert(std::make_pair(pageAddr, indexMap)); +} + +void Disassembler::Reset() +{ + +} diff --git a/BranchTrace-x64plugin-wtl/disassembler.h b/BranchTrace-x64plugin-wtl/disassembler.h new file mode 100644 index 0000000..044a2ad --- /dev/null +++ b/BranchTrace-x64plugin-wtl/disassembler.h @@ -0,0 +1,30 @@ +#pragma once +#pragma warning(disable 26812) +#include +#include +#include +#include + +struct Instruction { + ZydisDecodedInstruction zydisInstrction; +}; + +class Disassembler { + +private: + ZydisDecoder zydisDecoder; + std::map> m_pageInstrAddrMap; + std::map> m_pageInstrAddrIndexMap; + + + +public: + Disassembler(); + + bool Disasm(unsigned char* code, size_t codesize, Instruction* instrction); + const char* FormatZydisRegister(ZydisRegister reg); + + void loadPage(void* buffer, size_t pageAddr); + + void Reset(); +}; diff --git a/BranchTrace-x64plugin-wtl/dllmain.cpp b/BranchTrace-x64plugin-wtl/dllmain.cpp new file mode 100644 index 0000000..544bfae --- /dev/null +++ b/BranchTrace-x64plugin-wtl/dllmain.cpp @@ -0,0 +1,31 @@ +#include "dllmain.h" +#include "plugin_global.h" + +HMODULE g_hModule; +HANDLE g_hThread; + +BOOL APIENTRY DllMain(HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved +) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: + { + g_hModule = hModule; + + // µ÷ÓÃÒ»´ÎÈÃÕâ¸öÄ£¿éÔö¼ÓÒ»´ÎÒýÓüÆÊý. ·ñÕßжÔØdllʱ»á³ö´í, ÈÃÆä + HMODULE moudle; + GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, (LPSTR)DllMain, &moudle); + + break; + } + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: + break; + } + + return TRUE; +} diff --git a/BranchTrace-x64plugin-wtl/dllmain.h b/BranchTrace-x64plugin-wtl/dllmain.h new file mode 100644 index 0000000..26b4ac1 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/dllmain.h @@ -0,0 +1,5 @@ +#pragma once + +#include + +extern HMODULE g_hModule; \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/plugin.h b/BranchTrace-x64plugin-wtl/plugin.h new file mode 100644 index 0000000..3b924bc --- /dev/null +++ b/BranchTrace-x64plugin-wtl/plugin.h @@ -0,0 +1,49 @@ +#pragma once +#include "dllmain.h" + +#include "pluginsdk/_plugins.h" +#include "pluginsdk/bridgemain.h" + + +#ifndef DLL_EXPORT +#define DLL_EXPORT __declspec(dllexport) +#endif //DLL_EXPORT + + +#define PLUGIN_NAME "Branch Trace" +#define PLUGIN_VERSION 1 + +enum AS_MENU +{ + AS_MENU_THREAD_TRACE, + AS_MENU_TEST +}; + +#ifdef __cplusplus +extern "C" { +#endif +/* ²å¼þ³õʼ»¯³É¹¦ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct); + +/* ²å¼þ±»Ð¶Ôغó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT bool plugstop(); + +/*²å¼þ³õʼ»¯Ê±±»µ÷ÓÃ*/ +DLL_EXPORT bool pluginit(PLUG_INITSTRUCT* setupStruct); + +/* ²Ëµ¥±»µã»÷ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info); + +/* µ÷ÊÔÆ÷ÖжÏʱÓÉx64dbg´¥·¢*/ +void OnBreakPoint(CBTYPE cbType, void* callbackInfo); +void OnInitDebug(CBTYPE cbType, void* callbackInfo); +void OnStopDebug(CBTYPE cbType, void* callbackInfo); + +#ifdef __cplusplus +} +#endif + + +extern HMODULE g_hModul; +extern HWND hwndX64Dbg; + diff --git a/BranchTrace-x64plugin-wtl/plugin_global.h b/BranchTrace-x64plugin-wtl/plugin_global.h new file mode 100644 index 0000000..3f53600 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/plugin_global.h @@ -0,0 +1,45 @@ +#pragma once +#include "stdafx.h" +#include "ThreadTraceDialog.h" +#include "plugin.h" +#include "disassembler.h" + +class PluginGlobal { + +public: + ThreadTraceDialog* threadTraceDialog; + Disassembler* disassembler; + +private: + PluginGlobal() { + disassembler = new Disassembler(); + }; + +public: + ~PluginGlobal() { + CloseAll(); + } + +public: + static PluginGlobal* GetInstance() { + static PluginGlobal pluginGlobal; + return &pluginGlobal; + } + + void ShowDlgThreadTrace() { + if (threadTraceDialog == NULL) { + threadTraceDialog = new ThreadTraceDialog; + threadTraceDialog->Create(hwndX64Dbg); + } + + threadTraceDialog->ShowWindow(SW_SHOW); + threadTraceDialog->SetActiveWindow(); + }; + + void CloseAll() { + if (threadTraceDialog) { + CloseWindow(threadTraceDialog->m_hWnd); + DestroyWindow(threadTraceDialog->m_hWnd); + } + } +}; diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h new file mode 100644 index 0000000..8aac7c6 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver.h @@ -0,0 +1,22 @@ +#ifndef _DEVICENAMERESOLVER_H +#define _DEVICENAMERESOLVER_H + +#include + +#ifdef __cplusplus +extern "C" +{ +#endif + +__declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSizeInChars); +__declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSizeInChars); +__declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDevicePath, size_t nSizeInChars); +__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSizeInChars); +__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSizeInChars); +__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSizeInChars); + +#ifdef __cplusplus +} +#endif + +#endif // _DEVICENAMERESOLVER_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.a new file mode 100644 index 0000000..0d807fe Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.lib new file mode 100644 index 0000000..d70e415 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.a new file mode 100644 index 0000000..64bf6fa Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.lib new file mode 100644 index 0000000..b6d5cc5 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine.h b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine.h new file mode 100644 index 0000000..5b1a1f5 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine.h @@ -0,0 +1,1120 @@ +#ifndef TITANENGINE +#define TITANENGINE + +#define TITCALL + +#if _MSC_VER > 1000 +#pragma once +#endif + +#include +#include + +#pragma pack(push, 1) + +// Global.Constant.Structure.Declaration: +// Engine.External: +#define UE_STRUCT_PE32STRUCT 1 +#define UE_STRUCT_PE64STRUCT 2 +#define UE_STRUCT_PESTRUCT 3 +#define UE_STRUCT_IMPORTENUMDATA 4 +#define UE_STRUCT_THREAD_ITEM_DATA 5 +#define UE_STRUCT_LIBRARY_ITEM_DATA 6 +#define UE_STRUCT_LIBRARY_ITEM_DATAW 7 +#define UE_STRUCT_PROCESS_ITEM_DATA 8 +#define UE_STRUCT_HANDLERARRAY 9 +#define UE_STRUCT_PLUGININFORMATION 10 +#define UE_STRUCT_HOOK_ENTRY 11 +#define UE_STRUCT_FILE_STATUS_INFO 12 +#define UE_STRUCT_FILE_FIX_INFO 13 +#define UE_STRUCT_X87FPUREGISTER 14 +#define UE_STRUCT_X87FPU 15 +#define UE_STRUCT_TITAN_ENGINE_CONTEXT 16 + +#define UE_ACCESS_READ 0 +#define UE_ACCESS_WRITE 1 +#define UE_ACCESS_ALL 2 + +#define UE_HIDE_PEBONLY 0 +#define UE_HIDE_BASIC 1 + +#define UE_PLUGIN_CALL_REASON_PREDEBUG 1 +#define UE_PLUGIN_CALL_REASON_EXCEPTION 2 +#define UE_PLUGIN_CALL_REASON_POSTDEBUG 3 +#define UE_PLUGIN_CALL_REASON_UNHANDLEDEXCEPTION 4 + +#define TEE_HOOK_NRM_JUMP 1 +#define TEE_HOOK_NRM_CALL 3 +#define TEE_HOOK_IAT 5 + +#define UE_ENGINE_ALOW_MODULE_LOADING 1 +#define UE_ENGINE_AUTOFIX_FORWARDERS 2 +#define UE_ENGINE_PASS_ALL_EXCEPTIONS 3 +#define UE_ENGINE_NO_CONSOLE_WINDOW 4 +#define UE_ENGINE_BACKUP_FOR_CRITICAL_FUNCTIONS 5 +#define UE_ENGINE_CALL_PLUGIN_CALLBACK 6 +#define UE_ENGINE_RESET_CUSTOM_HANDLER 7 +#define UE_ENGINE_CALL_PLUGIN_DEBUG_CALLBACK 8 +#define UE_ENGINE_SET_DEBUG_PRIVILEGE 9 +#define UE_ENGINE_SAFE_ATTACH 10 + +#define UE_OPTION_REMOVEALL 1 +#define UE_OPTION_DISABLEALL 2 +#define UE_OPTION_REMOVEALLDISABLED 3 +#define UE_OPTION_REMOVEALLENABLED 4 + +#define UE_STATIC_DECRYPTOR_XOR 1 +#define UE_STATIC_DECRYPTOR_SUB 2 +#define UE_STATIC_DECRYPTOR_ADD 3 + +#define UE_STATIC_DECRYPTOR_FOREWARD 1 +#define UE_STATIC_DECRYPTOR_BACKWARD 2 + +#define UE_STATIC_KEY_SIZE_1 1 +#define UE_STATIC_KEY_SIZE_2 2 +#define UE_STATIC_KEY_SIZE_4 4 +#define UE_STATIC_KEY_SIZE_8 8 + +#define UE_STATIC_APLIB 1 +#define UE_STATIC_APLIB_DEPACK 2 +#define UE_STATIC_LZMA 3 + +#define UE_STATIC_HASH_MD5 1 +#define UE_STATIC_HASH_SHA1 2 +#define UE_STATIC_HASH_CRC32 3 + +#define UE_RESOURCE_LANGUAGE_ANY -1 + +#define UE_PE_OFFSET 0 +#define UE_IMAGEBASE 1 +#define UE_OEP 2 +#define UE_SIZEOFIMAGE 3 +#define UE_SIZEOFHEADERS 4 +#define UE_SIZEOFOPTIONALHEADER 5 +#define UE_SECTIONALIGNMENT 6 +#define UE_IMPORTTABLEADDRESS 7 +#define UE_IMPORTTABLESIZE 8 +#define UE_RESOURCETABLEADDRESS 9 +#define UE_RESOURCETABLESIZE 10 +#define UE_EXPORTTABLEADDRESS 11 +#define UE_EXPORTTABLESIZE 12 +#define UE_TLSTABLEADDRESS 13 +#define UE_TLSTABLESIZE 14 +#define UE_RELOCATIONTABLEADDRESS 15 +#define UE_RELOCATIONTABLESIZE 16 +#define UE_TIMEDATESTAMP 17 +#define UE_SECTIONNUMBER 18 +#define UE_CHECKSUM 19 +#define UE_SUBSYSTEM 20 +#define UE_CHARACTERISTICS 21 +#define UE_NUMBEROFRVAANDSIZES 22 +#define UE_BASEOFCODE 23 +#define UE_BASEOFDATA 24 +#define UE_DLLCHARACTERISTICS 25 +//leaving some enum space here for future additions +#define UE_SECTIONNAME 40 +#define UE_SECTIONVIRTUALOFFSET 41 +#define UE_SECTIONVIRTUALSIZE 42 +#define UE_SECTIONRAWOFFSET 43 +#define UE_SECTIONRAWSIZE 44 +#define UE_SECTIONFLAGS 45 + +#define UE_VANOTFOUND = -2; + +#define UE_CH_BREAKPOINT 1 +#define UE_CH_SINGLESTEP 2 +#define UE_CH_ACCESSVIOLATION 3 +#define UE_CH_ILLEGALINSTRUCTION 4 +#define UE_CH_NONCONTINUABLEEXCEPTION 5 +#define UE_CH_ARRAYBOUNDSEXCEPTION 6 +#define UE_CH_FLOATDENORMALOPERAND 7 +#define UE_CH_FLOATDEVIDEBYZERO 8 +#define UE_CH_INTEGERDEVIDEBYZERO 9 +#define UE_CH_INTEGEROVERFLOW 10 +#define UE_CH_PRIVILEGEDINSTRUCTION 11 +#define UE_CH_PAGEGUARD 12 +#define UE_CH_EVERYTHINGELSE 13 +#define UE_CH_CREATETHREAD 14 +#define UE_CH_EXITTHREAD 15 +#define UE_CH_CREATEPROCESS 16 +#define UE_CH_EXITPROCESS 17 +#define UE_CH_LOADDLL 18 +#define UE_CH_UNLOADDLL 19 +#define UE_CH_OUTPUTDEBUGSTRING 20 +#define UE_CH_AFTEREXCEPTIONPROCESSING 21 +#define UE_CH_SYSTEMBREAKPOINT 23 +#define UE_CH_UNHANDLEDEXCEPTION 24 +#define UE_CH_RIPEVENT 25 +#define UE_CH_DEBUGEVENT 26 + +#define UE_OPTION_HANDLER_RETURN_HANDLECOUNT 1 +#define UE_OPTION_HANDLER_RETURN_ACCESS 2 +#define UE_OPTION_HANDLER_RETURN_FLAGS 3 +#define UE_OPTION_HANDLER_RETURN_TYPENAME 4 + +#define UE_BREAKPOINT_INT3 1 +#define UE_BREAKPOINT_LONG_INT3 2 +#define UE_BREAKPOINT_UD2 3 + +#define UE_BPXREMOVED 0 +#define UE_BPXACTIVE 1 +#define UE_BPXINACTIVE 2 + +#define UE_BREAKPOINT 0 +#define UE_SINGLESHOOT 1 +#define UE_HARDWARE 2 +#define UE_MEMORY 3 +#define UE_MEMORY_READ 4 +#define UE_MEMORY_WRITE 5 +#define UE_MEMORY_EXECUTE 6 +#define UE_BREAKPOINT_TYPE_INT3 0x10000000 +#define UE_BREAKPOINT_TYPE_LONG_INT3 0x20000000 +#define UE_BREAKPOINT_TYPE_UD2 0x30000000 + +#define UE_HARDWARE_EXECUTE 4 +#define UE_HARDWARE_WRITE 5 +#define UE_HARDWARE_READWRITE 6 + +#define UE_HARDWARE_SIZE_1 7 +#define UE_HARDWARE_SIZE_2 8 +#define UE_HARDWARE_SIZE_4 9 +#define UE_HARDWARE_SIZE_8 10 + +#define UE_ON_LIB_LOAD 1 +#define UE_ON_LIB_UNLOAD 2 +#define UE_ON_LIB_ALL 3 + +#define UE_APISTART 0 +#define UE_APIEND 1 + +#define UE_PLATFORM_x86 1 +#define UE_PLATFORM_x64 2 +#define UE_PLATFORM_ALL 3 + +#define UE_FUNCTION_STDCALL 1 +#define UE_FUNCTION_CCALL 2 +#define UE_FUNCTION_FASTCALL 3 +#define UE_FUNCTION_STDCALL_RET 4 +#define UE_FUNCTION_CCALL_RET 5 +#define UE_FUNCTION_FASTCALL_RET 6 +#define UE_FUNCTION_STDCALL_CALL 7 +#define UE_FUNCTION_CCALL_CALL 8 +#define UE_FUNCTION_FASTCALL_CALL 9 +#define UE_PARAMETER_BYTE 0 +#define UE_PARAMETER_WORD 1 +#define UE_PARAMETER_DWORD 2 +#define UE_PARAMETER_QWORD 3 +#define UE_PARAMETER_PTR_BYTE 4 +#define UE_PARAMETER_PTR_WORD 5 +#define UE_PARAMETER_PTR_DWORD 6 +#define UE_PARAMETER_PTR_QWORD 7 +#define UE_PARAMETER_STRING 8 +#define UE_PARAMETER_UNICODE 9 + +#define UE_EAX 1 +#define UE_EBX 2 +#define UE_ECX 3 +#define UE_EDX 4 +#define UE_EDI 5 +#define UE_ESI 6 +#define UE_EBP 7 +#define UE_ESP 8 +#define UE_EIP 9 +#define UE_EFLAGS 10 +#define UE_DR0 11 +#define UE_DR1 12 +#define UE_DR2 13 +#define UE_DR3 14 +#define UE_DR6 15 +#define UE_DR7 16 +#define UE_RAX 17 +#define UE_RBX 18 +#define UE_RCX 19 +#define UE_RDX 20 +#define UE_RDI 21 +#define UE_RSI 22 +#define UE_RBP 23 +#define UE_RSP 24 +#define UE_RIP 25 +#define UE_RFLAGS 26 +#define UE_R8 27 +#define UE_R9 28 +#define UE_R10 29 +#define UE_R11 30 +#define UE_R12 31 +#define UE_R13 32 +#define UE_R14 33 +#define UE_R15 34 +#define UE_CIP 35 +#define UE_CSP 36 +#ifdef _WIN64 +#define UE_CFLAGS UE_RFLAGS +#else +#define UE_CFLAGS UE_EFLAGS +#endif +#define UE_SEG_GS 37 +#define UE_SEG_FS 38 +#define UE_SEG_ES 39 +#define UE_SEG_DS 40 +#define UE_SEG_CS 41 +#define UE_SEG_SS 42 +#define UE_x87_r0 43 +#define UE_x87_r1 44 +#define UE_x87_r2 45 +#define UE_x87_r3 46 +#define UE_x87_r4 47 +#define UE_x87_r5 48 +#define UE_x87_r6 49 +#define UE_x87_r7 50 +#define UE_X87_STATUSWORD 51 +#define UE_X87_CONTROLWORD 52 +#define UE_X87_TAGWORD 53 +#define UE_MXCSR 54 +#define UE_MMX0 55 +#define UE_MMX1 56 +#define UE_MMX2 57 +#define UE_MMX3 58 +#define UE_MMX4 59 +#define UE_MMX5 60 +#define UE_MMX6 61 +#define UE_MMX7 62 +#define UE_XMM0 63 +#define UE_XMM1 64 +#define UE_XMM2 65 +#define UE_XMM3 66 +#define UE_XMM4 67 +#define UE_XMM5 68 +#define UE_XMM6 69 +#define UE_XMM7 70 +#define UE_XMM8 71 +#define UE_XMM9 72 +#define UE_XMM10 73 +#define UE_XMM11 74 +#define UE_XMM12 75 +#define UE_XMM13 76 +#define UE_XMM14 77 +#define UE_XMM15 78 +#define UE_x87_ST0 79 +#define UE_x87_ST1 80 +#define UE_x87_ST2 81 +#define UE_x87_ST3 82 +#define UE_x87_ST4 83 +#define UE_x87_ST5 84 +#define UE_x87_ST6 85 +#define UE_x87_ST7 86 +#define UE_YMM0 87 +#define UE_YMM1 88 +#define UE_YMM2 89 +#define UE_YMM3 90 +#define UE_YMM4 91 +#define UE_YMM5 92 +#define UE_YMM6 93 +#define UE_YMM7 94 +#define UE_YMM8 95 +#define UE_YMM9 96 +#define UE_YMM10 97 +#define UE_YMM11 98 +#define UE_YMM12 99 +#define UE_YMM13 100 +#define UE_YMM14 101 +#define UE_YMM15 102 + +#ifndef CONTEXT_EXTENDED_REGISTERS +#define CONTEXT_EXTENDED_REGISTERS 0 +#endif + +typedef struct +{ + DWORD PE32Offset; + DWORD ImageBase; + DWORD OriginalEntryPoint; + DWORD BaseOfCode; + DWORD BaseOfData; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE32Struct, *PPE32Struct; + +typedef struct +{ + DWORD PE64Offset; + DWORD64 ImageBase; + DWORD OriginalEntryPoint; + DWORD BaseOfCode; + DWORD BaseOfData; + DWORD NtSizeOfImage; + DWORD NtSizeOfHeaders; + WORD SizeOfOptionalHeaders; + DWORD FileAlignment; + DWORD SectionAligment; + DWORD ImportTableAddress; + DWORD ImportTableSize; + DWORD ResourceTableAddress; + DWORD ResourceTableSize; + DWORD ExportTableAddress; + DWORD ExportTableSize; + DWORD TLSTableAddress; + DWORD TLSTableSize; + DWORD RelocationTableAddress; + DWORD RelocationTableSize; + DWORD TimeDateStamp; + WORD SectionNumber; + DWORD CheckSum; + WORD SubSystem; + WORD Characteristics; + DWORD NumberOfRvaAndSizes; +} PE64Struct, *PPE64Struct; + +#if defined(_WIN64) +typedef PE64Struct PEStruct; +#else +typedef PE32Struct PEStruct; +#endif + +typedef struct +{ + bool NewDll; + int NumberOfImports; + ULONG_PTR ImageBase; + ULONG_PTR BaseImportThunk; + ULONG_PTR ImportThunk; + char* APIName; + char* DLLName; +} ImportEnumData, *PImportEnumData; + +typedef struct +{ + HANDLE hThread; + DWORD dwThreadId; + void* ThreadStartAddress; + void* ThreadLocalBase; + void* TebAddress; + ULONG WaitTime; + LONG Priority; + LONG BasePriority; + ULONG ContextSwitches; + ULONG ThreadState; + ULONG WaitReason; +} THREAD_ITEM_DATA, *PTHREAD_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + char szLibraryPath[MAX_PATH]; + char szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATA, *PLIBRARY_ITEM_DATA; + +typedef struct +{ + HANDLE hFile; + void* BaseOfDll; + HANDLE hFileMapping; + void* hFileMappingView; + wchar_t szLibraryPath[MAX_PATH]; + wchar_t szLibraryName[MAX_PATH]; +} LIBRARY_ITEM_DATAW, *PLIBRARY_ITEM_DATAW; + +typedef struct +{ + HANDLE hProcess; + DWORD dwProcessId; + HANDLE hThread; + DWORD dwThreadId; + HANDLE hFile; + void* BaseOfImage; + void* ThreadStartAddress; + void* ThreadLocalBase; +} PROCESS_ITEM_DATA, *PPROCESS_ITEM_DATA; + +typedef struct +{ + ULONG ProcessId; + HANDLE hHandle; +} HandlerArray, *PHandlerArray; + +typedef struct +{ + char PluginName[64]; + DWORD PluginMajorVersion; + DWORD PluginMinorVersion; + HMODULE PluginBaseAddress; + void* TitanDebuggingCallBack; + void* TitanRegisterPlugin; + void* TitanReleasePlugin; + void* TitanResetPlugin; + bool PluginDisabled; +} PluginInformation, *PPluginInformation; + +#define TEE_MAXIMUM_HOOK_SIZE 14 +#define TEE_MAXIMUM_HOOK_RELOCS 7 +#if defined(_WIN64) +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 14 +#else +#define TEE_MAXIMUM_HOOK_INSERT_SIZE 5 +#endif + +typedef struct HOOK_ENTRY +{ + bool IATHook; + BYTE HookType; + DWORD HookSize; + void* HookAddress; + void* RedirectionAddress; + BYTE HookBytes[TEE_MAXIMUM_HOOK_SIZE]; + BYTE OriginalBytes[TEE_MAXIMUM_HOOK_SIZE]; + void* IATHookModuleBase; + DWORD IATHookNameHash; + bool HookIsEnabled; + bool HookIsRemote; + void* PatchedEntry; + DWORD RelocationInfo[TEE_MAXIMUM_HOOK_RELOCS]; + int RelocationCount; +} HOOK_ENTRY, *PHOOK_ENTRY; + +#define UE_DEPTH_SURFACE 0 +#define UE_DEPTH_DEEP 1 + +#define UE_UNPACKER_CONDITION_SEARCH_FROM_EP 1 + +#define UE_UNPACKER_CONDITION_LOADLIBRARY 1 +#define UE_UNPACKER_CONDITION_GETPROCADDRESS 2 +#define UE_UNPACKER_CONDITION_ENTRYPOINTBREAK 3 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT1 4 +#define UE_UNPACKER_CONDITION_RELOCSNAPSHOT2 5 + +#define UE_FIELD_OK 0 +#define UE_FIELD_BROKEN_NON_FIXABLE 1 +#define UE_FIELD_BROKEN_NON_CRITICAL 2 +#define UE_FIELD_BROKEN_FIXABLE_FOR_STATIC_USE 3 +#define UE_FIELD_BROKEN_BUT_CAN_BE_EMULATED 4 +#define UE_FIELD_FIXABLE_NON_CRITICAL 5 +#define UE_FIELD_FIXABLE_CRITICAL 6 +#define UE_FIELD_NOT_PRESET 7 +#define UE_FIELD_NOT_PRESET_WARNING 8 + +#define UE_RESULT_FILE_OK 10 +#define UE_RESULT_FILE_INVALID_BUT_FIXABLE 11 +#define UE_RESULT_FILE_INVALID_AND_NON_FIXABLE 12 +#define UE_RESULT_FILE_INVALID_FORMAT 13 + +typedef struct +{ + BYTE OveralEvaluation; + bool EvaluationTerminatedByException; + bool FileIs64Bit; + bool FileIsDLL; + bool FileIsConsole; + bool MissingDependencies; + bool MissingDeclaredAPIs; + BYTE SignatureMZ; + BYTE SignaturePE; + BYTE EntryPoint; + BYTE ImageBase; + BYTE SizeOfImage; + BYTE FileAlignment; + BYTE SectionAlignment; + BYTE ExportTable; + BYTE RelocationTable; + BYTE ImportTable; + BYTE ImportTableSection; + BYTE ImportTableData; + BYTE IATTable; + BYTE TLSTable; + BYTE LoadConfigTable; + BYTE BoundImportTable; + BYTE COMHeaderTable; + BYTE ResourceTable; + BYTE ResourceData; + BYTE SectionTable; +} FILE_STATUS_INFO, *PFILE_STATUS_INFO; + +typedef struct +{ + BYTE OveralEvaluation; + bool FixingTerminatedByException; + bool FileFixPerformed; + bool StrippedRelocation; + bool DontFixRelocations; + DWORD OriginalRelocationTableAddress; + DWORD OriginalRelocationTableSize; + bool StrippedExports; + bool DontFixExports; + DWORD OriginalExportTableAddress; + DWORD OriginalExportTableSize; + bool StrippedResources; + bool DontFixResources; + DWORD OriginalResourceTableAddress; + DWORD OriginalResourceTableSize; + bool StrippedTLS; + bool DontFixTLS; + DWORD OriginalTLSTableAddress; + DWORD OriginalTLSTableSize; + bool StrippedLoadConfig; + bool DontFixLoadConfig; + DWORD OriginalLoadConfigTableAddress; + DWORD OriginalLoadConfigTableSize; + bool StrippedBoundImports; + bool DontFixBoundImports; + DWORD OriginalBoundImportTableAddress; + DWORD OriginalBoundImportTableSize; + bool StrippedIAT; + bool DontFixIAT; + DWORD OriginalImportAddressTableAddress; + DWORD OriginalImportAddressTableSize; + bool StrippedCOM; + bool DontFixCOM; + DWORD OriginalCOMTableAddress; + DWORD OriginalCOMTableSize; +} FILE_FIX_INFO, *PFILE_FIX_INFO; + +typedef struct DECLSPEC_ALIGN(16) _XmmRegister_t +{ + ULONGLONG Low; + LONGLONG High; +} XmmRegister_t; + +typedef struct +{ + XmmRegister_t Low; //XMM/SSE part + XmmRegister_t High; //AVX part +} YmmRegister_t; + +typedef struct +{ + BYTE data[10]; + int st_value; + int tag; +} x87FPURegister_t; + +typedef struct +{ + WORD ControlWord; + WORD StatusWord; + WORD TagWord; + DWORD ErrorOffset; + DWORD ErrorSelector; + DWORD DataOffset; + DWORD DataSelector; + DWORD Cr0NpxState; +} x87FPU_t; + +typedef struct +{ + ULONG_PTR cax; + ULONG_PTR ccx; + ULONG_PTR cdx; + ULONG_PTR cbx; + ULONG_PTR csp; + ULONG_PTR cbp; + ULONG_PTR csi; + ULONG_PTR cdi; +#ifdef _WIN64 + ULONG_PTR r8; + ULONG_PTR r9; + ULONG_PTR r10; + ULONG_PTR r11; + ULONG_PTR r12; + ULONG_PTR r13; + ULONG_PTR r14; + ULONG_PTR r15; +#endif //_WIN64 + ULONG_PTR cip; + ULONG_PTR eflags; + unsigned short gs; + unsigned short fs; + unsigned short es; + unsigned short ds; + unsigned short cs; + unsigned short ss; + ULONG_PTR dr0; + ULONG_PTR dr1; + ULONG_PTR dr2; + ULONG_PTR dr3; + ULONG_PTR dr6; + ULONG_PTR dr7; + BYTE RegisterArea[80]; + x87FPU_t x87fpu; + DWORD MxCsr; +#ifdef _WIN64 + XmmRegister_t XmmRegisters[16]; + YmmRegister_t YmmRegisters[16]; +#else // x86 + XmmRegister_t XmmRegisters[8]; + YmmRegister_t YmmRegisters[8]; +#endif +} TITAN_ENGINE_CONTEXT_t; + +#ifdef __cplusplus +extern "C" +{ +#endif + +// Global.Function.Declaration: +// TitanEngine.Dumper.functions: +__declspec(dllexport) bool TITCALL DumpProcess(HANDLE hProcess, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessEx(DWORD ProcessId, LPVOID ImageBase, const char* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpProcessExW(DWORD ProcessId, LPVOID ImageBase, const wchar_t* szDumpFileName, ULONG_PTR EntryPoint); +__declspec(dllexport) bool TITCALL DumpMemory(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryW(HANDLE hProcess, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryEx(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpMemoryExW(DWORD ProcessId, LPVOID MemoryStart, ULONG_PTR MemorySize, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpRegions(HANDLE hProcess, const char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsW(HANDLE hProcess, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsEx(DWORD ProcessId, const char* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpRegionsExW(DWORD ProcessId, const wchar_t* szDumpFolder, bool DumpAboveImageBaseOnly); +__declspec(dllexport) bool TITCALL DumpModule(HANDLE hProcess, LPVOID ModuleBase, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleW(HANDLE hProcess, LPVOID ModuleBase, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleEx(DWORD ProcessId, LPVOID ModuleBase, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL DumpModuleExW(DWORD ProcessId, LPVOID ModuleBase, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL PastePEHeader(HANDLE hProcess, LPVOID ImageBase, const char* szDebuggedFileName); +__declspec(dllexport) bool TITCALL PastePEHeaderW(HANDLE hProcess, LPVOID ImageBase, const wchar_t* szDebuggedFileName); +__declspec(dllexport) bool TITCALL ExtractSection(const char* szFileName, const char* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ExtractSectionW(const wchar_t* szFileName, const wchar_t* szDumpFileName, DWORD SectionNumber); +__declspec(dllexport) bool TITCALL ResortFileSections(const char* szFileName); +__declspec(dllexport) bool TITCALL ResortFileSectionsW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL FindOverlay(const char* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL FindOverlayW(const wchar_t* szFileName, LPDWORD OverlayStart, LPDWORD OverlaySize); +__declspec(dllexport) bool TITCALL ExtractOverlay(const char* szFileName, const char* szExtactedFileName); +__declspec(dllexport) bool TITCALL ExtractOverlayW(const wchar_t* szFileName, const wchar_t* szExtactedFileName); +__declspec(dllexport) bool TITCALL AddOverlay(const char* szFileName, const char* szOverlayFileName); +__declspec(dllexport) bool TITCALL AddOverlayW(const wchar_t* szFileName, const wchar_t* szOverlayFileName); +__declspec(dllexport) bool TITCALL CopyOverlay(const char* szInFileName, const char* szOutFileName); +__declspec(dllexport) bool TITCALL CopyOverlayW(const wchar_t* szInFileName, const wchar_t* szOutFileName); +__declspec(dllexport) bool TITCALL RemoveOverlay(const char* szFileName); +__declspec(dllexport) bool TITCALL RemoveOverlayW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWE(const char* szFileName); +__declspec(dllexport) bool TITCALL MakeAllSectionsRWEW(const wchar_t* szFileName); +__declspec(dllexport) long TITCALL AddNewSectionEx(const char* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSectionExW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize, DWORD SectionAttributes, LPVOID SectionContent, DWORD ContentSize); +__declspec(dllexport) long TITCALL AddNewSection(const char* szFileName, const char* szSectionName, DWORD SectionSize); +__declspec(dllexport) long TITCALL AddNewSectionW(const wchar_t* szFileName, const char* szSectionName, DWORD SectionSize); +__declspec(dllexport) bool TITCALL ResizeLastSection(const char* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) bool TITCALL ResizeLastSectionW(const wchar_t* szFileName, DWORD NumberOfExpandBytes, bool AlignResizeData); +__declspec(dllexport) void TITCALL SetSharedOverlay(const char* szFileName); +__declspec(dllexport) void TITCALL SetSharedOverlayW(const wchar_t* szFileName); +__declspec(dllexport) char* TITCALL GetSharedOverlay(); +__declspec(dllexport) wchar_t* TITCALL GetSharedOverlayW(); +__declspec(dllexport) bool TITCALL DeleteLastSection(const char* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL DeleteLastSectionEx(const char* szFileName, DWORD NumberOfSections); +__declspec(dllexport) bool TITCALL DeleteLastSectionExW(const wchar_t* szFileName, DWORD NumberOfSections); +__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) ULONG_PTR TITCALL GetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) ULONG_PTR TITCALL GetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData); +__declspec(dllexport) bool TITCALL GetPE32DataFromMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataEx(const char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL GetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32Data(const char* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData, ULONG_PTR NewDataValue); +__declspec(dllexport) bool TITCALL SetPE32DataForMappedFileEx(ULONG_PTR FileMapVA, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataEx(const char* szFileName, LPVOID DataStorage); +__declspec(dllexport) bool TITCALL SetPE32DataExW(const wchar_t* szFileName, LPVOID DataStorage); +__declspec(dllexport) long TITCALL GetPE32SectionNumberFromVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert); +__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffset(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) ULONG_PTR TITCALL ConvertVAtoFileOffsetEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool AddressIsRVA, bool ReturnType); +__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVA(ULONG_PTR FileMapVA, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) ULONG_PTR TITCALL ConvertFileOffsetToVAEx(ULONG_PTR FileMapVA, DWORD FileSize, ULONG_PTR ImageBase, ULONG_PTR AddressToConvert, bool ReturnType); +__declspec(dllexport) bool TITCALL MemoryReadSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesRead); +__declspec(dllexport) bool TITCALL MemoryWriteSafe(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesWritten); +// TitanEngine.Realigner.functions: +__declspec(dllexport) bool TITCALL FixHeaderCheckSum(const char* szFileName); +__declspec(dllexport) bool TITCALL FixHeaderCheckSumW(const wchar_t* szFileName); +__declspec(dllexport) long TITCALL RealignPE(ULONG_PTR FileMapVA, DWORD FileSize, DWORD RealingMode); +__declspec(dllexport) long TITCALL RealignPEEx(const char* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) long TITCALL RealignPEExW(const wchar_t* szFileName, DWORD RealingFileSize, DWORD ForcedFileAlignment); +__declspec(dllexport) bool TITCALL WipeSection(const char* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL WipeSectionW(const wchar_t* szFileName, int WipeSectionNumber, bool RemovePhysically); +__declspec(dllexport) bool TITCALL IsPE32FileValidEx(const char* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL IsPE32FileValidExW(const wchar_t* szFileName, DWORD CheckDepth, LPVOID FileStatusInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileEx(const char* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL FixBrokenPE32FileExW(const wchar_t* szFileName, LPVOID FileStatusInfo, LPVOID FileFixInfo); +__declspec(dllexport) bool TITCALL IsFileDLL(const char* szFileName, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL IsFileDLLW(const wchar_t* szFileName, ULONG_PTR FileMapVA); +// TitanEngine.Hider.functions: +__declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess); +__declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess); +__declspec(dllexport) void* TITCALL GetTEBLocation(HANDLE hThread); +__declspec(dllexport) void* TITCALL GetTEBLocation64(HANDLE hThread); +__declspec(dllexport) bool TITCALL HideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +__declspec(dllexport) bool TITCALL UnHideDebugger(HANDLE hProcess, DWORD PatchAPILevel); +// TitanEngine.Relocater.functions: +__declspec(dllexport) void TITCALL RelocaterCleanup(); +__declspec(dllexport) void TITCALL RelocaterInit(DWORD MemorySize, ULONG_PTR OldImageBase, ULONG_PTR NewImageBase); +__declspec(dllexport) void TITCALL RelocaterAddNewRelocation(HANDLE hProcess, ULONG_PTR RelocateAddress, DWORD RelocateState); +__declspec(dllexport) long TITCALL RelocaterEstimatedSize(); +__declspec(dllexport) bool TITCALL RelocaterExportRelocation(ULONG_PTR StorePlace, DWORD StorePlaceRVA, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationEx(const char* szFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterExportRelocationExW(const wchar_t* szFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTable(HANDLE hProcess, ULONG_PTR MemoryStart, DWORD MemorySize); +__declspec(dllexport) bool TITCALL RelocaterGrabRelocationTableEx(HANDLE hProcess, ULONG_PTR MemoryStart, ULONG_PTR MemorySize, DWORD NtSizeOfImage); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshot(HANDLE hProcess, const char* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterMakeSnapshotW(HANDLE hProcess, const wchar_t* szSaveFileName, LPVOID MemoryStart, ULONG_PTR MemorySize); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshots(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const char* szDumpFile1, const char* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterCompareTwoSnapshotsW(HANDLE hProcess, ULONG_PTR LoadedImageBase, ULONG_PTR NtSizeOfImage, const wchar_t* szDumpFile1, const wchar_t* szDumpFile2, ULONG_PTR MemStart); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBase(const char* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterChangeFileBaseW(const wchar_t* szFileName, ULONG_PTR NewImageBase); +__declspec(dllexport) bool TITCALL RelocaterRelocateMemoryBlock(ULONG_PTR FileMapVA, ULONG_PTR MemoryLocation, void* RelocateMemory, DWORD RelocateMemorySize, ULONG_PTR CurrentLoadedBase, ULONG_PTR RelocateBase); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTable(const char* szFileName); +__declspec(dllexport) bool TITCALL RelocaterWipeRelocationTableW(const wchar_t* szFileName); +// TitanEngine.Resourcer.functions: +__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUse(const char* szFileName); +__declspec(dllexport) ULONG_PTR TITCALL ResourcerLoadFileForResourceUseW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ResourcerFreeLoadedFile(LPVOID LoadedFileBase); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileEx(HMODULE hFile, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFile(const char* szFileName, const char* szResourceType, const char* szResourceName, const char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerExtractResourceFromFileW(const wchar_t* szFileName, char* szResourceType, const char* szResourceName, const char* szExtractedFileName); +__declspec(dllexport) bool TITCALL ResourcerFindResource(const char* szFileName, const char* szResourceType, DWORD ResourceType, const char* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceW(const wchar_t* szFileName, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) bool TITCALL ResourcerFindResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, const wchar_t* szResourceType, DWORD ResourceType, const wchar_t* szResourceName, DWORD ResourceName, DWORD ResourceLanguage, PULONG_PTR pResourceData, LPDWORD pResourceSize); +__declspec(dllexport) void TITCALL ResourcerEnumerateResource(const char* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceW(const wchar_t* szFileName, void* CallBack); +__declspec(dllexport) void TITCALL ResourcerEnumerateResourceEx(ULONG_PTR FileMapVA, DWORD FileSize, void* CallBack); +// TitanEngine.Threader.functions: +__declspec(dllexport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId); +__declspec(dllexport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId); +__declspec(dllexport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack); +__declspec(dllexport) bool TITCALL ThreaderPauseThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderResumeThread(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderTerminateThread(HANDLE hThread, DWORD ThreadExitCode); +__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning); +__declspec(dllexport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused); +__declspec(dllexport) bool TITCALL ThreaderPauseProcess(); +__declspec(dllexport) bool TITCALL ThreaderResumeProcess(); +__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) ULONG_PTR TITCALL ThreaderCreateRemoteThreadEx(HANDLE hProcess, ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCodeEx(HANDLE hProcess, LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize); +__declspec(dllexport) void TITCALL ThreaderSetCallBackForNextExitThreadEvent(LPVOID exitThreadCallBack); +__declspec(dllexport) bool TITCALL ThreaderIsThreadStillRunning(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread); +__declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive(); +__declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads(); +__declspec(dllexport) ULONG_PTR TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId); +__declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread(); +// TitanEngine.Debugger.functions: +__declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL StaticDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL DisassembleEx(HANDLE hProcess, LPVOID DisassmAddress, bool ReturnInstructionType); +__declspec(dllexport) void* TITCALL Disassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL StaticLengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassembleEx(HANDLE hProcess, LPVOID DisassmAddress); +__declspec(dllexport) long TITCALL LengthDisassemble(LPVOID DisassmAddress); +__declspec(dllexport) void* TITCALL InitDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitNativeDebug(char* szFileName, char* szCommandLine, char* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitNativeDebugW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder); +__declspec(dllexport) void* TITCALL InitDebugEx(const char* szFileName, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDebugExW(const wchar_t* szFileName, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebug(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) void* TITCALL InitDLLDebugW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL StopDebug(); +__declspec(dllexport) void TITCALL SetBPXOptions(long DefaultBreakPointType); +__declspec(dllexport) bool TITCALL IsBPXEnabled(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL EnableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL DisableBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetBPX(ULONG_PTR bpxAddress, DWORD bpxType, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SafeDeleteBPX(ULONG_PTR bpxAddress); +__declspec(dllexport) bool TITCALL SetAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxType, DWORD bpxPlace, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SafeDeleteAPIBreakPoint(const char* szDLLName, const char* szAPIName, DWORD bpxPlace); +__declspec(dllexport) bool TITCALL SetMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL SetMemoryBPXEx(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory, DWORD BreakPointType, bool RestoreOnHit, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL RemoveMemoryBPX(ULONG_PTR MemoryStart, SIZE_T SizeOfMemory); +__declspec(dllexport) bool TITCALL GetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) void TITCALL Getx87FPURegisters(x87FPURegister_t x87FPURegisters[8], TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) void TITCALL GetMMXRegisters(uint64_t mmx[8], TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) bool TITCALL GetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) bool TITCALL SetFullContextDataEx(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) ULONG_PTR TITCALL GetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister); +__declspec(dllexport) ULONG_PTR TITCALL GetContextData(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL SetContextFPUDataEx(HANDLE hActiveThread, void* FPUSaveArea); +__declspec(dllexport) bool TITCALL SetContextDataEx(HANDLE hActiveThread, DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) bool TITCALL SetContextData(DWORD IndexOfRegister, ULONG_PTR NewRegisterValue); +__declspec(dllexport) bool TITCALL GetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) bool TITCALL SetAVXContext(HANDLE hActiveThread, TITAN_ENGINE_CONTEXT_t* titcontext); +__declspec(dllexport) void TITCALL ClearExceptionNumber(); +__declspec(dllexport) long TITCALL CurrentExceptionNumber(); +__declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard); +__declspec(dllexport) ULONG_PTR TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +extern "C" __declspec(dllexport) ULONG_PTR TITCALL Find(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard); +__declspec(dllexport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte); +__declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP); +__declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard); +__declspec(dllexport) void* TITCALL GetDebugData(); +__declspec(dllexport) void* TITCALL GetTerminationData(); +__declspec(dllexport) long TITCALL GetExitCode(); +__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedDLLBaseAddress(); +__declspec(dllexport) ULONG_PTR TITCALL GetDebuggedFileBaseAddress(); +__declspec(dllexport) bool TITCALL GetRemoteString(HANDLE hProcess, LPVOID StringAddress, LPVOID StringStorage, int MaximumStringSize); +__declspec(dllexport) ULONG_PTR TITCALL GetFunctionParameter(HANDLE hProcess, DWORD FunctionType, DWORD ParameterNumber, DWORD ParameterType); +__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestinationEx(HANDLE hProcess, ULONG_PTR InstructionAddress, bool JustJumps); +__declspec(dllexport) ULONG_PTR TITCALL GetJumpDestination(HANDLE hProcess, ULONG_PTR InstructionAddress); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecuteEx(HANDLE hProcess, HANDLE hThread, ULONG_PTR InstructionAddress, ULONG_PTR RegFlags); +__declspec(dllexport) bool TITCALL IsJumpGoingToExecute(); +__declspec(dllexport) void TITCALL SetCustomHandler(DWORD ExceptionId, LPVOID CallBack); +__declspec(dllexport) void TITCALL ForceClose(); +__declspec(dllexport) void TITCALL StepInto(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL StepOver(LPVOID traceCallBack); +__declspec(dllexport) void TITCALL StepOut(LPVOID StepOut, bool StepFinal); +__declspec(dllexport) void TITCALL SingleStep(DWORD StepCount, LPVOID StepCallBack); +__declspec(dllexport) bool TITCALL GetUnusedHardwareBreakPointRegister(LPDWORD RegisterIndex); +__declspec(dllexport) bool TITCALL SetHardwareBreakPointEx(HANDLE hActiveThread, ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack, LPDWORD IndexOfSelectedRegister); +__declspec(dllexport) bool TITCALL SetHardwareBreakPoint(ULONG_PTR bpxAddress, DWORD IndexOfRegister, DWORD bpxType, DWORD bpxSize, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL DeleteHardwareBreakPoint(DWORD IndexOfRegister); +__declspec(dllexport) bool TITCALL RemoveAllBreakPoints(DWORD RemoveOption); +__declspec(dllexport) PROCESS_INFORMATION* TITCALL TitanGetProcessInformation(); +__declspec(dllexport) STARTUPINFOW* TITCALL TitanGetStartupInformation(); +__declspec(dllexport) void TITCALL DebugLoop(); +__declspec(dllexport) void TITCALL SetDebugLoopTimeOut(DWORD TimeOut); +__declspec(dllexport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode); +__declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnExit, LPVOID DebugInfo, LPVOID CallBack); +__declspec(dllexport) bool TITCALL DetachDebugger(DWORD ProcessId); +__declspec(dllexport) bool TITCALL DetachDebuggerEx(DWORD ProcessId); +__declspec(dllexport) void TITCALL DebugLoopEx(DWORD TimeOut); +__declspec(dllexport) void TITCALL AutoDebugEx(const char* szFileName, bool ReserveModuleBase, const char* szCommandLine, const char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) void TITCALL AutoDebugExW(const wchar_t* szFileName, bool ReserveModuleBase, const wchar_t* szCommandLine, const wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack); +__declspec(dllexport) bool TITCALL IsFileBeingDebugged(); +__declspec(dllexport) void TITCALL SetErrorModel(bool DisplayErrorMessages); +// TitanEngine.FindOEP.functions: +__declspec(dllexport) void TITCALL FindOEPInit(); +__declspec(dllexport) bool TITCALL FindOEPGenerically(const char* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +__declspec(dllexport) bool TITCALL FindOEPGenericallyW(const wchar_t* szFileName, LPVOID TraceInitCallBack, LPVOID CallBack); +// TitanEngine.Importer.functions: +__declspec(dllexport) void TITCALL ImporterAddNewDll(const char* szDLLName, ULONG_PTR FirstThunk); +__declspec(dllexport) void TITCALL ImporterAddNewAPI(const char* szAPIName, ULONG_PTR ThunkValue); +__declspec(dllexport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue); +__declspec(dllexport) long TITCALL ImporterGetAddedDllCount(); +__declspec(dllexport) long TITCALL ImporterGetAddedAPICount(); +__declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap); +__declspec(dllexport) long TITCALL ImporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ImporterExportIATEx(const char* szDumpFileName, const char* szExportFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterExportIATExW(const wchar_t* szDumpFileName, const wchar_t* szExportFileName, const wchar_t* szSectionName = L".RL!TEv2"); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIWriteLocation(const char* szAPIName); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) ULONG_PTR TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation); +__declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteAPIAddressEx(const char* szDLLName, const char* szAPIName); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) long TITCALL ImporterGetDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBase(HANDLE hProcess, HMODULE LocalModuleBase); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, const char* szModuleName); +__declspec(dllexport) void* TITCALL ImporterGetRemoteDLLBaseExW(HANDLE hProcess, const wchar_t* szModuleName); +__declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetForwardedDLLName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) long TITCALL ImporterGetForwardedDLLIndex(HANDLE hProcess, ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetForwardedAPIOrdinalNumber(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) ULONG_PTR TITCALL ImporterGetNearestAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetNearestAPIName(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIAT(const char* szOriginalFile, const char* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterCopyOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile); +__declspec(dllexport) bool TITCALL ImporterLoadImportTable(const char* szFileName); +__declspec(dllexport) bool TITCALL ImporterLoadImportTableW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIAT(const char* szOriginalFile, const char* szDumpFile, const char* szSectionName); +__declspec(dllexport) bool TITCALL ImporterMoveOriginalIATW(const wchar_t* szOriginalFile, const wchar_t* szDumpFile, const char* szSectionName); +__declspec(dllexport) void TITCALL ImporterAutoSearchIAT(DWORD ProcessId, const char* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATW(DWORD ProcessIds, const wchar_t* szFileName, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterAutoSearchIATEx(DWORD ProcessId, ULONG_PTR ImageBase, ULONG_PTR SearchStart, LPVOID pIATStart, LPVOID pIATSize); +__declspec(dllexport) void TITCALL ImporterEnumAddedData(LPVOID EnumCallBack); +__declspec(dllexport) long TITCALL ImporterAutoFixIATEx(DWORD ProcessId, const char* szDumpedFile, const char* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIATExW(DWORD ProcessId, const wchar_t* szDumpedFile, const wchar_t* szSectionName, bool DumpRunningProcess, bool RealignFile, ULONG_PTR EntryPointAddress, ULONG_PTR ImageBase, ULONG_PTR SearchStart, bool TryAutoFix, bool FixEliminations, LPVOID UnknownPointerFixCallback); +__declspec(dllexport) long TITCALL ImporterAutoFixIAT(DWORD ProcessId, const char* szDumpedFile, ULONG_PTR SearchStart); +__declspec(dllexport) long TITCALL ImporterAutoFixIATW(DWORD ProcessId, const wchar_t* szDumpedFile, ULONG_PTR SearchStart); +__declspec(dllexport) bool TITCALL ImporterDeleteAPI(DWORD_PTR apiAddr); +// Global.Engine.Hook.functions: +__declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart); +__declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress); +__declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress); +__declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, const char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(const char* szModuleName, const char* szHookFunction, LPVOID RedirectTo); +__declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(const char* szModuleName, const char* szHookFunction, bool RemoveAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksDisableIATRedirection(const char* szModuleName, const char* szHookFunction, bool DisableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll); +__declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase); +__declspec(dllexport) bool TITCALL HooksEnableIATRedirection(const char* szModuleName, const char* szHookFunction, bool EnableAll); +__declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack); +__declspec(dllexport) void TITCALL HooksScanEntireProcessMemoryEx(); +// TitanEngine.Tracer.functions: +__declspec(dllexport) void TITCALL TracerInit(); +__declspec(dllexport) ULONG_PTR TITCALL TracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) ULONG_PTR TITCALL HashTracerLevel1(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD InputNumberOfInstructions); +__declspec(dllexport) long TITCALL TracerDetectRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace); +__declspec(dllexport) ULONG_PTR TITCALL TracerFixKnownRedirection(HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD RedirectionId); +__declspec(dllexport) ULONG_PTR TITCALL TracerFixRedirectionViaModule(HMODULE hModuleHandle, HANDLE hProcess, ULONG_PTR AddressToTrace, DWORD IdParameter); +__declspec(dllexport) long TITCALL TracerFixRedirectionViaImpRecPlugin(HANDLE hProcess, const char* szPluginName, ULONG_PTR AddressToTrace); +// TitanEngine.Exporter.functions: +__declspec(dllexport) void TITCALL ExporterCleanup(); +__declspec(dllexport) void TITCALL ExporterSetImageBase(ULONG_PTR ImageBase); +__declspec(dllexport) void TITCALL ExporterInit(DWORD MemorySize, ULONG_PTR ImageBase, DWORD ExportOrdinalBase, const char* szExportModuleName); +__declspec(dllexport) bool TITCALL ExporterAddNewExport(const char* szExportName, DWORD ExportRelativeAddress); +__declspec(dllexport) bool TITCALL ExporterAddNewOrdinalExport(DWORD OrdinalNumber, DWORD ExportRelativeAddress); +__declspec(dllexport) long TITCALL ExporterGetAddedExportCount(); +__declspec(dllexport) long TITCALL ExporterEstimatedSize(); +__declspec(dllexport) bool TITCALL ExporterBuildExportTable(ULONG_PTR StorePlace, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableEx(const char* szExportFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterBuildExportTableExW(const wchar_t* szExportFileName, const char* szSectionName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTable(const char* szFileName); +__declspec(dllexport) bool TITCALL ExporterLoadExportTableW(const wchar_t* szFileName); +// TitanEngine.Librarian.functions: +__declspec(dllexport) bool TITCALL LibrarianSetBreakPoint(const char* szLibraryName, DWORD bpxType, bool SingleShoot, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL LibrarianRemoveBreakPoint(const char* szLibraryName, DWORD bpxType); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(const char* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoW(const wchar_t* szLibraryName); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoEx(void* BaseOfDll); +__declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfo(void* EnumCallBack); +__declspec(dllexport) void TITCALL LibrarianEnumLibraryInfoW(void* EnumCallBack); +// TitanEngine.Process.functions: +__declspec(dllexport) long TITCALL GetActiveProcessId(const char* szImageName); +__declspec(dllexport) long TITCALL GetActiveProcessIdW(const wchar_t* szImageName); +__declspec(dllexport) void TITCALL EnumProcessesWithLibrary(const char* szLibraryName, void* EnumFunction); +__declspec(dllexport) HANDLE TITCALL TitanOpenProcess(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwProcessId); +__declspec(dllexport) HANDLE TITCALL TitanOpenThread(DWORD dwDesiredAccess, bool bInheritHandle, DWORD dwThreadId); +// TitanEngine.TLSFixer.functions: +__declspec(dllexport) bool TITCALL TLSBreakOnCallBack(LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSGrabCallBackData(const char* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSGrabCallBackDataW(const wchar_t* szFileName, LPVOID ArrayOfCallBacks, LPDWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackEx(const char* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSBreakOnCallBackExW(const wchar_t* szFileName, LPVOID bpxCallBack); +__declspec(dllexport) bool TITCALL TLSRemoveCallback(const char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveCallbackW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTable(const char* szFileName); +__declspec(dllexport) bool TITCALL TLSRemoveTableW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupData(const char* szFileName); +__declspec(dllexport) bool TITCALL TLSBackupDataW(const wchar_t* szFileName); +__declspec(dllexport) bool TITCALL TLSRestoreData(); +__declspec(dllexport) bool TITCALL TLSBuildNewTable(ULONG_PTR FileMapVA, ULONG_PTR StorePlace, ULONG_PTR StorePlaceRVA, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableEx(const char* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +__declspec(dllexport) bool TITCALL TLSBuildNewTableExW(const wchar_t* szFileName, const char* szSectionName, LPVOID ArrayOfCallBacks, DWORD NumberOfCallBacks); +// TitanEngine.TranslateName.functions: +__declspec(dllexport) void* TITCALL TranslateNativeName(const char* szNativeName); +__declspec(dllexport) void* TITCALL TranslateNativeNameW(const wchar_t* szNativeName); +// TitanEngine.Handler.functions: +__declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId); +__declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle); +__declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName); +__declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) ULONG_PTR TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn); +__declspec(dllexport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLocked(const char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +__declspec(dllexport) bool TITCALL HandlerIsFileLockedW(const wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated); +// TitanEngine.Handler[Mutex].functions: +__declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount); +__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, const char* szMutexString); +__declspec(dllexport) ULONG_PTR TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, const wchar_t* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(const char* szMutexString); +__declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(const wchar_t* szMutexString); +// TitanEngine.Injector.functions: +__declspec(dllexport) bool TITCALL RemoteLoadLibrary(HANDLE hProcess, const char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteLoadLibraryW(HANDLE hProcess, const wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibrary(HANDLE hProcess, HMODULE hModule, const char* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE hModule, const wchar_t* szLibraryFile, bool WaitForThreadExit); +__declspec(dllexport) bool TITCALL RemoteExitProcess(HANDLE hProcess, DWORD ExitCode); +// TitanEngine.StaticUnpacker.functions: +__declspec(dllexport) bool TITCALL StaticFileLoad(const char* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileLoadW(const wchar_t* szFileName, DWORD DesiredAccess, bool SimulateLoad, LPHANDLE FileHandle, LPDWORD LoadedSize, LPHANDLE FileMap, PULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnload(const char* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileUnloadW(const wchar_t* szFileName, bool CommitChanges, HANDLE FileHandle, DWORD LoadedSize, HANDLE FileMap, ULONG_PTR FileMapVA); +__declspec(dllexport) bool TITCALL StaticFileOpen(const char* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileOpenW(const wchar_t* szFileName, DWORD DesiredAccess, LPHANDLE FileHandle, LPDWORD FileSizeLow, LPDWORD FileSizeHigh); +__declspec(dllexport) bool TITCALL StaticFileGetContent(HANDLE FileHandle, DWORD FilePositionLow, LPDWORD FilePositionHigh, void* Buffer, DWORD Size); +__declspec(dllexport) void TITCALL StaticFileClose(HANDLE FileHandle); +__declspec(dllexport) void TITCALL StaticMemoryDecrypt(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) void TITCALL StaticMemoryDecryptEx(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticMemoryDecryptSpecial(LPVOID MemoryStart, DWORD MemorySize, DWORD DecryptionKeySize, DWORD SpecDecryptionType, void* DecryptionCallBack); +__declspec(dllexport) void TITCALL StaticSectionDecrypt(ULONG_PTR FileMapVA, DWORD SectionNumber, bool SimulateLoad, DWORD DecryptionType, DWORD DecryptionKeySize, ULONG_PTR DecryptionKey); +__declspec(dllexport) bool TITCALL StaticMemoryDecompress(void* Source, DWORD SourceSize, void* Destination, DWORD DestinationSize, int Algorithm); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopy(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyW(HANDLE hFile, ULONG_PTR FileMapVA, ULONG_PTR VitualAddressToCopy, DWORD Size, bool AddressIsRVA, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyExW(HANDLE hFile, DWORD RawAddressToCopy, DWORD Size, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const char* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticRawMemoryCopyEx64W(HANDLE hFile, DWORD64 RawAddressToCopy, DWORD64 Size, const wchar_t* szDumpFileName); +__declspec(dllexport) bool TITCALL StaticHashMemory(void* MemoryToHash, DWORD SizeOfMemory, void* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFileW(const wchar_t* szFileName, char* HashDigest, bool OutputString, int Algorithm); +__declspec(dllexport) bool TITCALL StaticHashFile(const char* szFileName, char* HashDigest, bool OutputString, int Algorithm); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL EngineUnpackerInitialize(const char* szFileName, const char* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) void TITCALL EngineUnpackerInitializeW(const wchar_t* szFileName, const wchar_t* szUnpackedFileName, bool DoLogData, bool DoRealignFile, bool DoMoveOverlay, void* EntryCallBack); +__declspec(dllexport) bool TITCALL EngineUnpackerSetBreakCondition(void* SearchStart, DWORD SearchSize, void* SearchPattern, DWORD PatternSize, DWORD PatternDelta, ULONG_PTR BreakType, bool SingleBreak, DWORD Parameter1, DWORD Parameter2); +__declspec(dllexport) void TITCALL EngineUnpackerSetEntryPointAddress(ULONG_PTR UnpackedEntryPointAddress); +__declspec(dllexport) void TITCALL EngineUnpackerFinalizeUnpacking(); +// TitanEngine.Engine.functions: +__declspec(dllexport) void TITCALL SetEngineVariable(DWORD VariableId, bool VariableSet); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependencies(const char* szFileName, const char* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineCreateMissingDependenciesW(const wchar_t* szFileName, const wchar_t* szOutputFolder, bool LogCreatedFiles); +__declspec(dllexport) bool TITCALL EngineFakeMissingDependencies(HANDLE hProcess); +__declspec(dllexport) bool TITCALL EngineDeleteCreatedDependencies(); +__declspec(dllexport) bool TITCALL EngineCreateUnpackerWindow(const char* WindowUnpackerTitle, const char* WindowUnpackerLongTitle, const char* WindowUnpackerName, const char* WindowUnpackerAuthor, void* StartUnpackingCallBack); +__declspec(dllexport) void TITCALL EngineAddUnpackerWindowLogMessage(const char* szLogMessage); +__declspec(dllexport) bool TITCALL EngineCheckStructAlignment(DWORD StructureType, ULONG_PTR StructureSize); +// Global.Engine.Extension.Functions: +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginLoaded(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerIsPluginEnabled(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerDisableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerDisablePlugin(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerEnableAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerEnablePlugin(const char* szPluginName); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadAllPlugins(); +__declspec(dllexport) bool TITCALL ExtensionManagerUnloadPlugin(const char* szPluginName); +__declspec(dllexport) void* TITCALL ExtensionManagerGetPluginInfo(const char* szPluginName); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif /*TITANENGINE*/ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.a new file mode 100644 index 0000000..df8c0ea Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.lib new file mode 100644 index 0000000..ab454f9 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x64.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.a new file mode 100644 index 0000000..10f2d03 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.lib new file mode 100644 index 0000000..25af27d Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/TitanEngine/TitanEngine_x86.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse.h b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse.h new file mode 100644 index 0000000..7bdc1a5 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse.h @@ -0,0 +1,53 @@ +#ifndef _XEDPARSE_H +#define _XEDPARSE_H + +#include + +//XEDParse defines +#ifdef XEDPARSE_BUILD +#define XEDPARSE_EXPORT __declspec(dllexport) +#else +#define XEDPARSE_EXPORT __declspec(dllimport) +#endif //XEDPARSE_BUILD + +#define XEDPARSE_CALL //calling convention + +#define XEDPARSE_MAXBUFSIZE 256 +#define XEDPARSE_MAXASMSIZE 16 + +//typedefs +typedef bool (XEDPARSE_CALL* CBXEDPARSE_UNKNOWN)(const char* text, ULONGLONG* value); + +//XEDParse enums +enum XEDPARSE_STATUS +{ + XEDPARSE_ERROR = 0, + XEDPARSE_OK = 1 +}; + +//XEDParse structs +#pragma pack(push,8) +struct XEDPARSE +{ + bool x64; // use 64-bit instructions + ULONGLONG cip; //instruction pointer (for relative addressing) + unsigned int dest_size; //destination size (returned by XEDParse) + CBXEDPARSE_UNKNOWN cbUnknown; //unknown operand callback + unsigned char dest[XEDPARSE_MAXASMSIZE]; //destination buffer + char instr[XEDPARSE_MAXBUFSIZE]; //instruction text + char error[XEDPARSE_MAXBUFSIZE]; //error text (in case of an error) +}; +#pragma pack(pop) + +#ifdef __cplusplus +extern "C" +{ +#endif + +XEDPARSE_EXPORT XEDPARSE_STATUS XEDPARSE_CALL XEDParseAssemble(XEDPARSE* XEDParse); + +#ifdef __cplusplus +} +#endif + +#endif // _XEDPARSE_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.a new file mode 100644 index 0000000..c08940b Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.lib new file mode 100644 index 0000000..ed97902 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x64.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.a new file mode 100644 index 0000000..286630e Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.lib new file mode 100644 index 0000000..53e0a78 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/XEDParse/XEDParse_x86.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_dbgfunctions.h b/BranchTrace-x64plugin-wtl/pluginsdk/_dbgfunctions.h new file mode 100644 index 0000000..732ef94 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_dbgfunctions.h @@ -0,0 +1,297 @@ +#ifndef _DBGFUNCTIONS_H +#define _DBGFUNCTIONS_H + +#ifndef __cplusplus +#include +#endif + +typedef struct +{ + char mod[MAX_MODULE_SIZE]; + duint addr; + unsigned char oldbyte; + unsigned char newbyte; +} DBGPATCHINFO; + +typedef struct +{ + duint addr; + duint from; + duint to; + char comment[MAX_COMMENT_SIZE]; +} DBGCALLSTACKENTRY; + +typedef struct +{ + int total; + DBGCALLSTACKENTRY* entries; +} DBGCALLSTACK; + +typedef struct +{ + duint addr; + duint handler; +} DBGSEHRECORD; + +typedef struct +{ + duint total; + DBGSEHRECORD* records; +} DBGSEHCHAIN; + +typedef struct +{ + DWORD dwProcessId; + char szExeFile[MAX_PATH]; + char szExeMainWindowTitle[MAX_PATH]; + char szExeArgs[MAX_COMMAND_LINE_SIZE]; +} DBGPROCESSINFO; + +typedef struct +{ + DWORD rva; + BYTE type; + WORD size; +} DBGRELOCATIONINFO; + +typedef enum +{ + InstructionBody = 0, + InstructionHeading = 1, + InstructionTailing = 2, + InstructionOverlapped = 3, // The byte was executed with differing instruction base addresses + DataByte, // This and the following is not implemented yet. + DataWord, + DataDWord, + DataQWord, + DataFloat, + DataDouble, + DataLongDouble, + DataXMM, + DataYMM, + DataMMX, + DataMixed, //the byte is accessed in multiple ways + InstructionDataMixed //the byte is both executed and written +} TRACERECORDBYTETYPE; + +typedef enum +{ + TraceRecordNone, + TraceRecordBitExec, + TraceRecordByteWithExecTypeAndCounter, + TraceRecordWordWithExecTypeAndCounter +} TRACERECORDTYPE; + +typedef struct +{ + duint Handle; + unsigned char TypeNumber; + unsigned int GrantedAccess; +} HANDLEINFO; + +// The longest ip address is 1234:6789:1234:6789:1234:6789:123.567.901.345 (46 bytes) +#define TCP_ADDR_SIZE 50 + +typedef struct +{ + char RemoteAddress[TCP_ADDR_SIZE]; + unsigned short RemotePort; + char LocalAddress[TCP_ADDR_SIZE]; + unsigned short LocalPort; + char StateText[TCP_ADDR_SIZE]; + unsigned int State; +} TCPCONNECTIONINFO; + +typedef struct +{ + duint handle; + duint parent; + DWORD threadId; + DWORD style; + DWORD styleEx; + duint wndProc; + bool enabled; + RECT position; + char windowTitle[MAX_COMMENT_SIZE]; + char windowClass[MAX_COMMENT_SIZE]; +} WINDOW_INFO; + +typedef struct +{ + duint addr; + duint size; + duint flags; +} HEAPINFO; + +typedef struct +{ + const char* name; + duint value; +} CONSTANTINFO; + +typedef enum +{ + MODSYMUNLOADED = 0, + MODSYMLOADING, + MODSYMLOADED +} MODULESYMBOLSTATUS; + +typedef bool (*ASSEMBLEATEX)(duint addr, const char* instruction, char* error, bool fillnop); +typedef bool (*SECTIONFROMADDR)(duint addr, char* section); +typedef bool (*MODNAMEFROMADDR)(duint addr, char* modname, bool extension); +typedef duint(*MODBASEFROMADDR)(duint addr); +typedef duint(*MODBASEFROMNAME)(const char* modname); +typedef duint(*MODSIZEFROMADDR)(duint addr); +typedef bool (*ASSEMBLE)(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); +typedef bool (*PATCHGET)(duint addr); +typedef bool (*PATCHINRANGE)(duint start, duint end); +typedef bool (*MEMPATCH)(duint va, const unsigned char* src, duint size); +typedef void (*PATCHRESTORERANGE)(duint start, duint end); +typedef bool (*PATCHENUM)(DBGPATCHINFO* patchlist, size_t* cbsize); +typedef bool (*PATCHRESTORE)(duint addr); +typedef int (*PATCHFILE)(DBGPATCHINFO* patchlist, int count, const char* szFileName, char* error); +typedef int (*MODPATHFROMADDR)(duint addr, char* path, int size); +typedef int (*MODPATHFROMNAME)(const char* modname, char* path, int size); +typedef bool (*DISASMFAST)(const unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo); +typedef void (*MEMUPDATEMAP)(); +typedef void (*GETCALLSTACK)(DBGCALLSTACK* callstack); +typedef void (*GETSEHCHAIN)(DBGSEHCHAIN* sehchain); +typedef void (*SYMBOLDOWNLOADALLSYMBOLS)(const char* szSymbolStore); +typedef bool (*GETJIT)(char* jit, bool x64); +typedef bool (*GETJITAUTO)(bool* jitauto); +typedef bool (*GETDEFJIT)(char* defjit); +typedef bool (*GETPROCESSLIST)(DBGPROCESSINFO** entries, int* count); +typedef bool (*GETPAGERIGHTS)(duint addr, char* rights); +typedef bool (*SETPAGERIGHTS)(duint addr, const char* rights); +typedef bool (*PAGERIGHTSTOSTRING)(DWORD protect, char* rights); +typedef bool (*ISPROCESSELEVATED)(); +typedef bool (*GETCMDLINE)(char* cmdline, size_t* cbsize); +typedef bool (*SETCMDLINE)(const char* cmdline); +typedef duint(*FILEOFFSETTOVA)(const char* modname, duint offset); +typedef duint(*VATOFILEOFFSET)(duint va); +typedef duint(*GETADDRFROMLINE)(const char* szSourceFile, int line, duint* displacement); +typedef bool (*GETSOURCEFROMADDR)(duint addr, char* szSourceFile, int* line); +typedef bool (*VALFROMSTRING)(const char* string, duint* value); +typedef bool (*PATCHGETEX)(duint addr, DBGPATCHINFO* info); +typedef bool (*GETBRIDGEBP)(BPXTYPE type, duint addr, BRIDGEBP* bp); +typedef bool (*STRINGFORMATINLINE)(const char* format, size_t resultSize, char* result); +typedef void (*GETMNEMONICBRIEF)(const char* mnem, size_t resultSize, char* result); +typedef unsigned int (*GETTRACERECORDHITCOUNT)(duint address); +typedef TRACERECORDBYTETYPE(*GETTRACERECORDBYTETYPE)(duint address); +typedef bool (*SETTRACERECORDTYPE)(duint pageAddress, TRACERECORDTYPE type); +typedef TRACERECORDTYPE(*GETTRACERECORDTYPE)(duint pageAddress); +typedef bool (*ENUMHANDLES)(ListOf(HANDLEINFO) handles); +typedef bool (*GETHANDLENAME)(duint handle, char* name, size_t nameSize, char* typeName, size_t typeNameSize); +typedef bool (*ENUMTCPCONNECTIONS)(ListOf(TCPCONNECTIONINFO) connections); +typedef duint(*GETDBGEVENTS)(); +typedef MODULEPARTY(*MODGETPARTY)(duint base); +typedef void (*MODSETPARTY)(duint base, MODULEPARTY party); +typedef bool(*WATCHISWATCHDOGTRIGGERED)(unsigned int id); +typedef bool(*MEMISCODEPAGE)(duint addr, bool refresh); +typedef bool(*ANIMATECOMMAND)(const char* command); +typedef void(*DBGSETDEBUGGEEINITSCRIPT)(const char* fileName); +typedef const char* (*DBGGETDEBUGGEEINITSCRIPT)(); +typedef bool(*HANDLESENUMWINDOWS)(ListOf(WINDOW_INFO) windows); +typedef bool(*HANDLESENUMHEAPS)(ListOf(HEAPINFO) heaps); +typedef bool(*THREADGETNAME)(DWORD tid, char* name); +typedef bool(*ISDEPENABLED)(); +typedef void(*GETCALLSTACKEX)(DBGCALLSTACK* callstack, bool cache); +typedef bool(*GETUSERCOMMENT)(duint addr, char* comment); +typedef void(*ENUMCONSTANTS)(ListOf(CONSTANTINFO) constants); +typedef duint(*MEMBPSIZE)(duint addr); +typedef bool(*MODRELOCATIONSFROMADDR)(duint addr, ListOf(DBGRELOCATIONINFO) relocations); +typedef bool(*MODRELOCATIONATADDR)(duint addr, DBGRELOCATIONINFO* relocation); +typedef bool(*MODRELOCATIONSINRANGE)(duint addr, duint size, ListOf(DBGRELOCATIONINFO) relocations); +typedef duint(*DBGETHASH)(); +typedef int(*SYMAUTOCOMPLETE)(const char* Search, char** Buffer, int MaxSymbols); +typedef void(*REFRESHMODULELIST)(); +typedef duint(*GETADDRFROMLINEEX)(duint mod, const char* szSourceFile, int line); +typedef MODULESYMBOLSTATUS(*MODSYMBOLSTATUS)(duint mod); + +//The list of all the DbgFunctions() return value. +//WARNING: This list is append only. Do not insert things in the middle or plugins would break. +typedef struct DBGFUNCTIONS_ +{ + ASSEMBLEATEX AssembleAtEx; + SECTIONFROMADDR SectionFromAddr; + MODNAMEFROMADDR ModNameFromAddr; + MODBASEFROMADDR ModBaseFromAddr; + MODBASEFROMNAME ModBaseFromName; + MODSIZEFROMADDR ModSizeFromAddr; + ASSEMBLE Assemble; + PATCHGET PatchGet; + PATCHINRANGE PatchInRange; + MEMPATCH MemPatch; + PATCHRESTORERANGE PatchRestoreRange; + PATCHENUM PatchEnum; + PATCHRESTORE PatchRestore; + PATCHFILE PatchFile; + MODPATHFROMADDR ModPathFromAddr; + MODPATHFROMNAME ModPathFromName; + DISASMFAST DisasmFast; + MEMUPDATEMAP MemUpdateMap; + GETCALLSTACK GetCallStack; + GETSEHCHAIN GetSEHChain; + SYMBOLDOWNLOADALLSYMBOLS SymbolDownloadAllSymbols; + GETJITAUTO GetJitAuto; + GETJIT GetJit; + GETDEFJIT GetDefJit; + GETPROCESSLIST GetProcessList; + GETPAGERIGHTS GetPageRights; + SETPAGERIGHTS SetPageRights; + PAGERIGHTSTOSTRING PageRightsToString; + ISPROCESSELEVATED IsProcessElevated; + GETCMDLINE GetCmdline; + SETCMDLINE SetCmdline; + FILEOFFSETTOVA FileOffsetToVa; + VATOFILEOFFSET VaToFileOffset; + GETADDRFROMLINE GetAddrFromLine; + GETSOURCEFROMADDR GetSourceFromAddr; + VALFROMSTRING ValFromString; + PATCHGETEX PatchGetEx; + GETBRIDGEBP GetBridgeBp; + STRINGFORMATINLINE StringFormatInline; + GETMNEMONICBRIEF GetMnemonicBrief; + GETTRACERECORDHITCOUNT GetTraceRecordHitCount; + GETTRACERECORDBYTETYPE GetTraceRecordByteType; + SETTRACERECORDTYPE SetTraceRecordType; + GETTRACERECORDTYPE GetTraceRecordType; + ENUMHANDLES EnumHandles; + GETHANDLENAME GetHandleName; + ENUMTCPCONNECTIONS EnumTcpConnections; + GETDBGEVENTS GetDbgEvents; + MODGETPARTY ModGetParty; + MODSETPARTY ModSetParty; + WATCHISWATCHDOGTRIGGERED WatchIsWatchdogTriggered; + MEMISCODEPAGE MemIsCodePage; + ANIMATECOMMAND AnimateCommand; + DBGSETDEBUGGEEINITSCRIPT DbgSetDebuggeeInitScript; + DBGGETDEBUGGEEINITSCRIPT DbgGetDebuggeeInitScript; + HANDLESENUMWINDOWS EnumWindows; + HANDLESENUMHEAPS EnumHeaps; + THREADGETNAME ThreadGetName; + ISDEPENABLED IsDepEnabled; + GETCALLSTACKEX GetCallStackEx; + GETUSERCOMMENT GetUserComment; + ENUMCONSTANTS EnumConstants; + ENUMCONSTANTS EnumErrorCodes; + ENUMCONSTANTS EnumExceptions; + MEMBPSIZE MemBpSize; + MODRELOCATIONSFROMADDR ModRelocationsFromAddr; + MODRELOCATIONATADDR ModRelocationAtAddr; + MODRELOCATIONSINRANGE ModRelocationsInRange; + DBGETHASH DbGetHash; + SYMAUTOCOMPLETE SymAutoComplete; + REFRESHMODULELIST RefreshModuleList; + GETADDRFROMLINEEX GetAddrFromLineEx; + MODSYMBOLSTATUS ModSymbolStatus; +} DBGFUNCTIONS; + +#ifdef BUILD_DBG + +const DBGFUNCTIONS* dbgfunctionsget(); +void dbgfunctionsinit(); + +#endif //BUILD_DBG + +#endif //_DBGFUNCTIONS_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_plugin_types.h b/BranchTrace-x64plugin-wtl/pluginsdk/_plugin_types.h new file mode 100644 index 0000000..12277f7 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_plugin_types.h @@ -0,0 +1,34 @@ +#ifndef _PLUGIN_DATA_H +#define _PLUGIN_DATA_H + +#ifdef BUILD_DBG + +#include "_global.h" +#include "jansson/jansson.h" +#pragma warning(push) +#pragma warning(disable:4091) +#include +#pragma warning(pop) + +#else + +#ifdef __GNUC__ +#include "dbghelp/dbghelp.h" +#else +#pragma warning(push) +#pragma warning(disable:4091) +#include +#pragma warning(pop) +#endif // __GNUC__ + +#ifndef deflen +#define deflen 1024 +#endif // deflen + +#include "bridgemain.h" +#include "_dbgfunctions.h" +#include "jansson/jansson.h" + +#endif // BUILD_DBG + +#endif // _PLUGIN_DATA_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_plugins.h b/BranchTrace-x64plugin-wtl/pluginsdk/_plugins.h new file mode 100644 index 0000000..7b1d646 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_plugins.h @@ -0,0 +1,332 @@ +#ifndef _PLUGINS_H +#define _PLUGINS_H + +#ifndef __cplusplus +#include +#endif + +#ifndef PLUG_IMPEXP +#ifdef BUILD_DBG +#define PLUG_IMPEXP __declspec(dllexport) +#else +#define PLUG_IMPEXP __declspec(dllimport) +#endif //BUILD_DBG +#endif //PLUG_IMPEXP + +#include "_plugin_types.h" + +//default structure alignments forced +#ifdef _WIN64 +#pragma pack(push, 16) +#else //x86 +#pragma pack(push, 8) +#endif //_WIN64 + +//defines +#define PLUG_SDKVERSION 1 + +#define PLUG_DB_LOADSAVE_DATA 1 +#define PLUG_DB_LOADSAVE_ALL 2 + +//structures +typedef struct +{ + //provided by the debugger + int pluginHandle; + //provided by the pluginit function + int sdkVersion; + int pluginVersion; + char pluginName[256]; +} PLUG_INITSTRUCT; + +typedef struct +{ + //provided by the debugger + HWND hwndDlg; //gui window handle + int hMenu; //plugin menu handle + int hMenuDisasm; //plugin disasm menu handle + int hMenuDump; //plugin dump menu handle + int hMenuStack; //plugin stack menu handle + int hMenuGraph; //plugin graph menu handle + int hMenuMemmap; //plugin memory map menu handle + int hMenuSymmod; //plugin symbol module menu handle +} PLUG_SETUPSTRUCT; + +typedef struct +{ + void* data; //user data +} PLUG_SCRIPTSTRUCT; + +//callback structures +typedef struct +{ + const char* szFileName; +} PLUG_CB_INITDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_STOPDEBUG; + +typedef struct +{ + CREATE_PROCESS_DEBUG_INFO* CreateProcessInfo; + IMAGEHLP_MODULE64* modInfo; + const char* DebugFileName; + PROCESS_INFORMATION* fdProcessInfo; +} PLUG_CB_CREATEPROCESS; + +typedef struct +{ + EXIT_PROCESS_DEBUG_INFO* ExitProcess; +} PLUG_CB_EXITPROCESS; + +typedef struct +{ + CREATE_THREAD_DEBUG_INFO* CreateThread; + DWORD dwThreadId; +} PLUG_CB_CREATETHREAD; + +typedef struct +{ + EXIT_THREAD_DEBUG_INFO* ExitThread; + DWORD dwThreadId; +} PLUG_CB_EXITTHREAD; + +typedef struct +{ + void* reserved; +} PLUG_CB_SYSTEMBREAKPOINT; + +typedef struct +{ + LOAD_DLL_DEBUG_INFO* LoadDll; + IMAGEHLP_MODULE64* modInfo; + const char* modname; +} PLUG_CB_LOADDLL; + +typedef struct +{ + UNLOAD_DLL_DEBUG_INFO* UnloadDll; +} PLUG_CB_UNLOADDLL; + +typedef struct +{ + OUTPUT_DEBUG_STRING_INFO* DebugString; +} PLUG_CB_OUTPUTDEBUGSTRING; + +typedef struct +{ + EXCEPTION_DEBUG_INFO* Exception; +} PLUG_CB_EXCEPTION; + +typedef struct +{ + BRIDGEBP* breakpoint; +} PLUG_CB_BREAKPOINT; + +typedef struct +{ + void* reserved; +} PLUG_CB_PAUSEDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_RESUMEDEBUG; + +typedef struct +{ + void* reserved; +} PLUG_CB_STEPPED; + +typedef struct +{ + DWORD dwProcessId; +} PLUG_CB_ATTACH; + +typedef struct +{ + PROCESS_INFORMATION* fdProcessInfo; +} PLUG_CB_DETACH; + +typedef struct +{ + DEBUG_EVENT* DebugEvent; +} PLUG_CB_DEBUGEVENT; + +typedef struct +{ + int hEntry; +} PLUG_CB_MENUENTRY; + +typedef struct +{ + MSG* message; + long* result; + bool retval; +} PLUG_CB_WINEVENT; + +typedef struct +{ + MSG* message; + bool retval; +} PLUG_CB_WINEVENTGLOBAL; + +typedef struct +{ + json_t* root; + int loadSaveType; +} PLUG_CB_LOADSAVEDB; + +typedef struct +{ + const char* symbol; + bool retval; +} PLUG_CB_FILTERSYMBOL; + +typedef struct +{ + duint cip; + bool stop; +} PLUG_CB_TRACEEXECUTE; + +typedef struct +{ + int hWindow; + duint VA; +} PLUG_CB_SELCHANGED; + +typedef struct +{ + BridgeCFGraphList graph; +} PLUG_CB_ANALYZE; + +typedef struct +{ + duint addr; + BRIDGE_ADDRINFO* addrinfo; + bool retval; +} PLUG_CB_ADDRINFO; + +typedef struct +{ + const char* string; + duint value; + int* value_size; + bool* isvar; + bool* hexonly; + bool retval; +} PLUG_CB_VALFROMSTRING; + +typedef struct +{ + const char* string; + duint value; + bool retval; +} PLUG_CB_VALTOSTRING; + +typedef struct +{ + GUIMENUTYPE hMenu; +} PLUG_CB_MENUPREPARE; + +//enums +typedef enum +{ + CB_INITDEBUG, //PLUG_CB_INITDEBUG + CB_STOPDEBUG, //PLUG_CB_STOPDEBUG + CB_CREATEPROCESS, //PLUG_CB_CREATEPROCESS + CB_EXITPROCESS, //PLUG_CB_EXITPROCESS + CB_CREATETHREAD, //PLUG_CB_CREATETHREAD + CB_EXITTHREAD, //PLUG_CB_EXITTHREAD + CB_SYSTEMBREAKPOINT, //PLUG_CB_SYSTEMBREAKPOINT + CB_LOADDLL, //PLUG_CB_LOADDLL + CB_UNLOADDLL, //PLUG_CB_UNLOADDLL + CB_OUTPUTDEBUGSTRING, //PLUG_CB_OUTPUTDEBUGSTRING + CB_EXCEPTION, //PLUG_CB_EXCEPTION + CB_BREAKPOINT, //PLUG_CB_BREAKPOINT + CB_PAUSEDEBUG, //PLUG_CB_PAUSEDEBUG + CB_RESUMEDEBUG, //PLUG_CB_RESUMEDEBUG + CB_STEPPED, //PLUG_CB_STEPPED + CB_ATTACH, //PLUG_CB_ATTACHED (before attaching, after CB_INITDEBUG) + CB_DETACH, //PLUG_CB_DETACH (before detaching, before CB_STOPDEBUG) + CB_DEBUGEVENT, //PLUG_CB_DEBUGEVENT (called on any debug event) + CB_MENUENTRY, //PLUG_CB_MENUENTRY + CB_WINEVENT, //PLUG_CB_WINEVENT + CB_WINEVENTGLOBAL, //PLUG_CB_WINEVENTGLOBAL + CB_LOADDB, //PLUG_CB_LOADSAVEDB + CB_SAVEDB, //PLUG_CB_LOADSAVEDB + CB_FILTERSYMBOL, //PLUG_CB_FILTERSYMBOL + CB_TRACEEXECUTE, //PLUG_CB_TRACEEXECUTE + CB_SELCHANGED, //PLUG_CB_SELCHANGED + CB_ANALYZE, //PLUG_CB_ANALYZE + CB_ADDRINFO, //PLUG_CB_ADDRINFO + CB_VALFROMSTRING, //PLUG_CB_VALFROMSTRING + CB_VALTOSTRING, //PLUG_CB_VALTOSTRING + CB_MENUPREPARE, //PLUG_CB_MENUPREPARE + CB_LAST +} CBTYPE; + +typedef enum +{ + FORMAT_ERROR, //generic failure (no message) + FORMAT_SUCCESS, //success + FORMAT_ERROR_MESSAGE, //formatting failed but an error was put in the buffer (there are always at least 511 characters available). + FORMAT_BUFFER_TOO_SMALL //buffer too small (x64dbg will retry until the buffer is big enough) +} FORMATRESULT; + +//typedefs +typedef void (*CBPLUGIN)(CBTYPE cbType, void* callbackInfo); +typedef bool (*CBPLUGINCOMMAND)(int argc, char** argv); +typedef void (*CBPLUGINSCRIPT)(); +typedef duint(*CBPLUGINEXPRFUNCTION)(int argc, duint* argv, void* userdata); +typedef FORMATRESULT(*CBPLUGINFORMATFUNCTION)(char* dest, size_t destCount, int argc, char* argv[], duint value, void* userdata); +typedef bool (*CBPLUGINPREDICATE)(void* userdata); + +//exports +#ifdef __cplusplus +extern "C" +{ +#endif + +PLUG_IMPEXP void _plugin_registercallback(int pluginHandle, CBTYPE cbType, CBPLUGIN cbPlugin); +PLUG_IMPEXP bool _plugin_unregistercallback(int pluginHandle, CBTYPE cbType); +PLUG_IMPEXP bool _plugin_registercommand(int pluginHandle, const char* command, CBPLUGINCOMMAND cbCommand, bool debugonly); +PLUG_IMPEXP bool _plugin_unregistercommand(int pluginHandle, const char* command); +PLUG_IMPEXP void _plugin_logprintf(const char* format, ...); +PLUG_IMPEXP void _plugin_logputs(const char* text); +PLUG_IMPEXP void _plugin_logprint(const char* text); +PLUG_IMPEXP void _plugin_debugpause(); +PLUG_IMPEXP void _plugin_debugskipexceptions(bool skip); +PLUG_IMPEXP int _plugin_menuadd(int hMenu, const char* title); +PLUG_IMPEXP bool _plugin_menuaddentry(int hMenu, int hEntry, const char* title); +PLUG_IMPEXP bool _plugin_menuaddseparator(int hMenu); +PLUG_IMPEXP bool _plugin_menuclear(int hMenu); +PLUG_IMPEXP void _plugin_menuseticon(int hMenu, const ICONDATA* icon); +PLUG_IMPEXP void _plugin_menuentryseticon(int pluginHandle, int hEntry, const ICONDATA* icon); +PLUG_IMPEXP void _plugin_menuentrysetchecked(int pluginHandle, int hEntry, bool checked); +PLUG_IMPEXP void _plugin_menusetvisible(int pluginHandle, int hMenu, bool visible); +PLUG_IMPEXP void _plugin_menuentrysetvisible(int pluginHandle, int hEntry, bool visible); +PLUG_IMPEXP void _plugin_menusetname(int pluginHandle, int hMenu, const char* name); +PLUG_IMPEXP void _plugin_menuentrysetname(int pluginHandle, int hEntry, const char* name); +PLUG_IMPEXP void _plugin_menuentrysethotkey(int pluginHandle, int hEntry, const char* hotkey); +PLUG_IMPEXP bool _plugin_menuremove(int hMenu); +PLUG_IMPEXP bool _plugin_menuentryremove(int pluginHandle, int hEntry); +PLUG_IMPEXP void _plugin_startscript(CBPLUGINSCRIPT cbScript); +PLUG_IMPEXP bool _plugin_waituntilpaused(); +PLUG_IMPEXP bool _plugin_registerexprfunction(int pluginHandle, const char* name, int argc, CBPLUGINEXPRFUNCTION cbFunction, void* userdata); +PLUG_IMPEXP bool _plugin_unregisterexprfunction(int pluginHandle, const char* name); +PLUG_IMPEXP bool _plugin_unload(const char* pluginName); +PLUG_IMPEXP bool _plugin_load(const char* pluginName); +PLUG_IMPEXP duint _plugin_hash(const void* data, duint size); +PLUG_IMPEXP bool _plugin_registerformatfunction(int pluginHandle, const char* type, CBPLUGINFORMATFUNCTION cbFunction, void* userdata); +PLUG_IMPEXP bool _plugin_unregisterformatfunction(int pluginHandle, const char* type); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif // _PLUGINS_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi.h new file mode 100644 index 0000000..f6460d9 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi.h @@ -0,0 +1,8 @@ +#ifndef _SCRIPT_API_H +#define _SCRIPT_API_H + +#include "_plugins.h" + +#define SCRIPT_EXPORT PLUG_IMPEXP + +#endif //_SCRIPT_API_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_argument.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_argument.h new file mode 100644 index 0000000..52f319f --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_argument.h @@ -0,0 +1,31 @@ +#ifndef _SCRIPTAPI_ARGUMENT_H +#define _SCRIPTAPI_ARGUMENT_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Argument + { + struct ArgumentInfo + { + char mod[MAX_MODULE_SIZE]; + duint rvaStart; + duint rvaEnd; + bool manual; + duint instructioncount; + }; + + SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0); + SCRIPT_EXPORT bool Add(const ArgumentInfo* info); + SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr); + SCRIPT_EXPORT bool GetInfo(duint addr, ArgumentInfo* info); + SCRIPT_EXPORT bool Overlaps(duint start, duint end); + SCRIPT_EXPORT bool Delete(duint address); + SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual = false); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(ArgumentInfo) list); //caller has the responsibility to free the list + }; //Argument +}; //Script + +#endif //_SCRIPTAPI_ARGUMENT_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_assembler.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_assembler.h new file mode 100644 index 0000000..33e8743 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_assembler.h @@ -0,0 +1,17 @@ +#ifndef _SCRIPTAPI_ASSEMBLER_H +#define _SCRIPTAPI_ASSEMBLER_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Assembler + { + SCRIPT_EXPORT bool Assemble(duint addr, unsigned char* dest, int* size, const char* instruction); //dest[16] + SCRIPT_EXPORT bool AssembleEx(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); //dest[16], error[MAX_ERROR_SIZE] + SCRIPT_EXPORT bool AssembleMem(duint addr, const char* instruction); + SCRIPT_EXPORT bool AssembleMemEx(duint addr, const char* instruction, int* size, char* error, bool fillnop); //error[MAX_ERROR_SIZE] + }; //Assembler +}; //Script + +#endif //_SCRIPTAPI_ASSEMBLER_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_bookmark.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_bookmark.h new file mode 100644 index 0000000..5f32388 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_bookmark.h @@ -0,0 +1,28 @@ +#ifndef _SCRIPTAPI_BOOKMARK_H +#define _SCRIPTAPI_BOOKMARK_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Bookmark + { + struct BookmarkInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + bool manual; + }; + + SCRIPT_EXPORT bool Set(duint addr, bool manual = false); + SCRIPT_EXPORT bool Set(const BookmarkInfo* info); + SCRIPT_EXPORT bool Get(duint addr); + SCRIPT_EXPORT bool GetInfo(duint addr, BookmarkInfo* info); + SCRIPT_EXPORT bool Delete(duint addr); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(BookmarkInfo) list); //caller has the responsibility to free the list + }; //Bookmark +}; //Script + +#endif //_SCRIPTAPI_BOOKMARK_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_comment.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_comment.h new file mode 100644 index 0000000..06ac5df --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_comment.h @@ -0,0 +1,29 @@ +#ifndef _SCRIPTAPI_COMMENT_H +#define _SCRIPTAPI_COMMENT_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Comment + { + struct CommentInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + char text[MAX_LABEL_SIZE]; + bool manual; + }; + + SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false); + SCRIPT_EXPORT bool Set(const CommentInfo* info); + SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_COMMENT_SIZE] + SCRIPT_EXPORT bool GetInfo(duint addr, CommentInfo* info); + SCRIPT_EXPORT bool Delete(duint addr); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(CommentInfo) list); //caller has the responsibility to free the list + }; //Comment +}; //Script + +#endif //_SCRIPTAPI_COMMENT_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_debug.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_debug.h new file mode 100644 index 0000000..1be789d --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_debug.h @@ -0,0 +1,32 @@ +#ifndef _SCRIPTAPI_DEBUG_H +#define _SCRIPTAPI_DEBUG_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Debug + { + enum HardwareType + { + HardwareAccess, + HardwareWrite, + HardwareExecute + }; + + SCRIPT_EXPORT void Wait(); + SCRIPT_EXPORT void Run(); + SCRIPT_EXPORT void Pause(); + SCRIPT_EXPORT void Stop(); + SCRIPT_EXPORT void StepIn(); + SCRIPT_EXPORT void StepOver(); + SCRIPT_EXPORT void StepOut(); + SCRIPT_EXPORT bool SetBreakpoint(duint address); + SCRIPT_EXPORT bool DeleteBreakpoint(duint address); + SCRIPT_EXPORT bool DisableBreakpoint(duint address); + SCRIPT_EXPORT bool SetHardwareBreakpoint(duint address, HardwareType type = HardwareExecute); + SCRIPT_EXPORT bool DeleteHardwareBreakpoint(duint address); + }; //Debug +}; //Script + +#endif //_SCRIPTAPI_DEBUG_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_flag.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_flag.h new file mode 100644 index 0000000..58a2dd2 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_flag.h @@ -0,0 +1,47 @@ +#ifndef _SCRIPTAPI_FLAG_H +#define _SCRIPTAPI_FLAG_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Flag + { + enum FlagEnum + { + ZF, + OF, + CF, + PF, + SF, + TF, + AF, + DF, + IF + }; + + SCRIPT_EXPORT bool Get(FlagEnum flag); + SCRIPT_EXPORT bool Set(FlagEnum flag, bool value); + + SCRIPT_EXPORT bool GetZF(); + SCRIPT_EXPORT bool SetZF(bool value); + SCRIPT_EXPORT bool GetOF(); + SCRIPT_EXPORT bool SetOF(bool value); + SCRIPT_EXPORT bool GetCF(); + SCRIPT_EXPORT bool SetCF(bool value); + SCRIPT_EXPORT bool GetPF(); + SCRIPT_EXPORT bool SetPF(bool value); + SCRIPT_EXPORT bool GetSF(); + SCRIPT_EXPORT bool SetSF(bool value); + SCRIPT_EXPORT bool GetTF(); + SCRIPT_EXPORT bool SetTF(bool value); + SCRIPT_EXPORT bool GetAF(); + SCRIPT_EXPORT bool SetAF(bool value); + SCRIPT_EXPORT bool GetDF(); + SCRIPT_EXPORT bool SetDF(bool value); + SCRIPT_EXPORT bool GetIF(); + SCRIPT_EXPORT bool SetIF(bool value); + }; +}; + +#endif //_SCRIPTAPI_FLAG_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_function.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_function.h new file mode 100644 index 0000000..31fdb7f --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_function.h @@ -0,0 +1,32 @@ +#ifndef _SCRIPTAPI_FUNCTION_H +#define _SCRIPTAPI_FUNCTION_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Function + { + struct FunctionInfo + { + char mod[MAX_MODULE_SIZE]; + duint rvaStart; + duint rvaEnd; + bool manual; + duint instructioncount; + }; + + SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0); + SCRIPT_EXPORT bool Add(const FunctionInfo* info); + SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr); + SCRIPT_EXPORT bool GetInfo(duint addr, FunctionInfo* info); + SCRIPT_EXPORT bool Overlaps(duint start, duint end); + SCRIPT_EXPORT bool Delete(duint address); + SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(FunctionInfo) list); //caller has the responsibility to free the list + }; //Function +}; //Script + +#endif //_SCRIPTAPI_FUNCTION_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_gui.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_gui.h new file mode 100644 index 0000000..bc19b16 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_gui.h @@ -0,0 +1,78 @@ +#ifndef _SCRIPTAPI_GUI_H +#define _SCRIPTAPI_GUI_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Gui + { + namespace Disassembly + { + SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(); + SCRIPT_EXPORT duint SelectionGetEnd(); + }; //Disassembly + + namespace Dump + { + SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(); + SCRIPT_EXPORT duint SelectionGetEnd(); + }; //Dump + + namespace Stack + { + SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(); + SCRIPT_EXPORT duint SelectionGetEnd(); + }; //Stack + + namespace Graph + { + SCRIPT_EXPORT duint SelectionGetStart(); + }; //Graph + + namespace MemMap + { + SCRIPT_EXPORT duint SelectionGetStart(); + }; //MemoryMap + + namespace SymMod + { + SCRIPT_EXPORT duint SelectionGetStart(); + }; //SymMod + }; //Gui + + namespace Gui + { + enum Window + { + DisassemblyWindow, + DumpWindow, + StackWindow, + GraphWindow, + MemMapWindow, + SymModWindow + }; + + SCRIPT_EXPORT bool SelectionGet(Window window, duint* start, duint* end); + SCRIPT_EXPORT bool SelectionSet(Window window, duint start, duint end); + SCRIPT_EXPORT duint SelectionGetStart(Window window); + SCRIPT_EXPORT duint SelectionGetEnd(Window window); + SCRIPT_EXPORT void Message(const char* message); + SCRIPT_EXPORT bool MessageYesNo(const char* message); + SCRIPT_EXPORT bool InputLine(const char* title, char* text); //text[GUI_MAX_LINE_SIZE] + SCRIPT_EXPORT bool InputValue(const char* title, duint* value); + SCRIPT_EXPORT void Refresh(); + SCRIPT_EXPORT void AddQWidgetTab(void* qWidget); + SCRIPT_EXPORT void ShowQWidgetTab(void* qWidget); + SCRIPT_EXPORT void CloseQWidgetTab(void* qWidget); + + }; //Gui +}; //Script + +#endif //_SCRIPTAPI_GUI_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_label.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_label.h new file mode 100644 index 0000000..7ee503b --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_label.h @@ -0,0 +1,30 @@ +#ifndef _SCRIPTAPI_LABEL_H +#define _SCRIPTAPI_LABEL_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Label + { + struct LabelInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + char text[MAX_LABEL_SIZE]; + bool manual; + }; + + SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false); + SCRIPT_EXPORT bool Set(const LabelInfo* info); + SCRIPT_EXPORT bool FromString(const char* label, duint* addr); + SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_LABEL_SIZE] + SCRIPT_EXPORT bool GetInfo(duint addr, LabelInfo* info); + SCRIPT_EXPORT bool Delete(duint addr); + SCRIPT_EXPORT void DeleteRange(duint start, duint end); + SCRIPT_EXPORT void Clear(); + SCRIPT_EXPORT bool GetList(ListOf(LabelInfo) list); //caller has the responsibility to free the list + }; //Label +}; //Script + +#endif //_SCRIPTAPI_LABEL_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_memory.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_memory.h new file mode 100644 index 0000000..f52e0e4 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_memory.h @@ -0,0 +1,32 @@ +#ifndef _SCRIPTAPI_MEMORY_H +#define _SCRIPTAPI_MEMORY_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Memory + { + SCRIPT_EXPORT bool Read(duint addr, void* data, duint size, duint* sizeRead); + SCRIPT_EXPORT bool Write(duint addr, const void* data, duint size, duint* sizeWritten); + SCRIPT_EXPORT bool IsValidPtr(duint addr); + SCRIPT_EXPORT duint RemoteAlloc(duint addr, duint size); + SCRIPT_EXPORT bool RemoteFree(duint addr); + SCRIPT_EXPORT unsigned int GetProtect(duint addr, bool reserved = false, bool cache = true); + SCRIPT_EXPORT duint GetBase(duint addr, bool reserved = false, bool cache = true); + SCRIPT_EXPORT duint GetSize(duint addr, bool reserved = false, bool cache = true); + + SCRIPT_EXPORT unsigned char ReadByte(duint addr); + SCRIPT_EXPORT bool WriteByte(duint addr, unsigned char data); + SCRIPT_EXPORT unsigned short ReadWord(duint addr); + SCRIPT_EXPORT bool WriteWord(duint addr, unsigned short data); + SCRIPT_EXPORT unsigned int ReadDword(duint addr); + SCRIPT_EXPORT bool WriteDword(duint addr, unsigned int data); + SCRIPT_EXPORT unsigned long long ReadQword(duint addr); + SCRIPT_EXPORT bool WriteQword(duint addr, unsigned long long data); + SCRIPT_EXPORT duint ReadPtr(duint addr); + SCRIPT_EXPORT bool WritePtr(duint addr, duint data); + }; //Memory +}; //Script + +#endif //_SCRIPTAPI_MEMORY_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_misc.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_misc.h new file mode 100644 index 0000000..aca9063 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_misc.h @@ -0,0 +1,65 @@ +#ifndef _SCRIPTAPI_MISC_H +#define _SCRIPTAPI_MISC_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Misc + { + /// + /// Evaluates an expression and returns the result. Analagous to using the Command field in x64dbg. + /// + /// Expressions can consist of memory locations, registers, flags, API names, labels, symbols, variables etc. + /// + /// Example: bool success = ParseExpression("[esp+8]", &val) + /// + /// The expression to evaluate. + /// The result of the expression. + /// True on success, False on failure. + SCRIPT_EXPORT bool ParseExpression(const char* expression, duint* value); + + /// + /// Returns the address of a function in the debuggee's memory space. + /// + /// Example: duint addr = RemoteGetProcAddress("kernel32.dll", "GetProcAddress") + /// + /// The name of the module. + /// The name of the function. + /// The address of the function in the debuggee. + SCRIPT_EXPORT duint RemoteGetProcAddress(const char* module, const char* api); + + /// + /// Returns the address for a label created in the disassembly window. + /// + /// Example: duint addr = ResolveLabel("sneaky_crypto") + /// + /// The name of the label to resolve. + /// The memory address for the label. + SCRIPT_EXPORT duint ResolveLabel(const char* label); + + /// + /// Allocates the requested number of bytes from x64dbg's default process heap. + /// + /// Note: this allocation is in the debugger, not the debuggee. + /// + /// Memory allocated using this function should be Free'd after use. + /// + /// Example: void* addr = Alloc(0x100000) + /// + /// Number of bytes to allocate. + /// A pointer to the newly allocated memory. + SCRIPT_EXPORT void* Alloc(duint size); + + /// + /// Frees memory previously allocated by Alloc. + /// + /// Example: Free(addr) + /// + /// Pointer returned by Alloc. + /// Nothing. + SCRIPT_EXPORT void Free(void* ptr); + }; //Misc +}; //Script + +#endif //_SCRIPTAPI_MISC_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_module.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_module.h new file mode 100644 index 0000000..cb7d751 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_module.h @@ -0,0 +1,78 @@ +#ifndef _SCRIPTAPI_MODULE_H +#define _SCRIPTAPI_MODULE_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Module + { + struct ModuleInfo + { + duint base; + duint size; + duint entry; + int sectionCount; + char name[MAX_MODULE_SIZE]; + char path[MAX_PATH]; + }; + + struct ModuleSectionInfo + { + duint addr; + duint size; + char name[MAX_SECTION_SIZE * 5]; + }; + + struct ModuleExport + { + duint ordinal; + duint rva; + duint va; + bool forwarded; + char forwardName[MAX_STRING_SIZE]; + char name[MAX_STRING_SIZE]; + char undecoratedName[MAX_STRING_SIZE]; + }; + + struct ModuleImport + { + duint iatRva; + duint iatVa; + duint ordinal; //equal to -1 if imported by name + char name[MAX_STRING_SIZE]; + char undecoratedName[MAX_STRING_SIZE]; + }; + + SCRIPT_EXPORT bool InfoFromAddr(duint addr, ModuleInfo* info); + SCRIPT_EXPORT bool InfoFromName(const char* name, ModuleInfo* info); + SCRIPT_EXPORT duint BaseFromAddr(duint addr); + SCRIPT_EXPORT duint BaseFromName(const char* name); + SCRIPT_EXPORT duint SizeFromAddr(duint addr); + SCRIPT_EXPORT duint SizeFromName(const char* name); + SCRIPT_EXPORT bool NameFromAddr(duint addr, char* name); //name[MAX_MODULE_SIZE] + SCRIPT_EXPORT bool PathFromAddr(duint addr, char* path); //path[MAX_PATH] + SCRIPT_EXPORT bool PathFromName(const char* name, char* path); //path[MAX_PATH] + SCRIPT_EXPORT duint EntryFromAddr(duint addr); + SCRIPT_EXPORT duint EntryFromName(const char* name); + SCRIPT_EXPORT int SectionCountFromAddr(duint addr); + SCRIPT_EXPORT int SectionCountFromName(const char* name); + SCRIPT_EXPORT bool SectionFromAddr(duint addr, int number, ModuleSectionInfo* section); + SCRIPT_EXPORT bool SectionFromName(const char* name, int number, ModuleSectionInfo* section); + SCRIPT_EXPORT bool SectionListFromAddr(duint addr, ListOf(ModuleSectionInfo) list); + SCRIPT_EXPORT bool SectionListFromName(const char* name, ListOf(ModuleSectionInfo) list); + SCRIPT_EXPORT bool GetMainModuleInfo(ModuleInfo* info); + SCRIPT_EXPORT duint GetMainModuleBase(); + SCRIPT_EXPORT duint GetMainModuleSize(); + SCRIPT_EXPORT duint GetMainModuleEntry(); + SCRIPT_EXPORT int GetMainModuleSectionCount(); + SCRIPT_EXPORT bool GetMainModuleName(char* name); //name[MAX_MODULE_SIZE] + SCRIPT_EXPORT bool GetMainModulePath(char* path); //path[MAX_PATH] + SCRIPT_EXPORT bool GetMainModuleSectionList(ListOf(ModuleSectionInfo) list); //caller has the responsibility to free the list + SCRIPT_EXPORT bool GetList(ListOf(ModuleInfo) list); //caller has the responsibility to free the list + SCRIPT_EXPORT bool GetExports(const ModuleInfo* mod, ListOf(ModuleExport) list); //caller has the responsibility to free the list + SCRIPT_EXPORT bool GetImports(const ModuleInfo* mod, ListOf(ModuleImport) list); //caller has the responsibility to free the list + }; //Module +}; //Script + +#endif //_SCRIPTAPI_MODULE_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_pattern.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_pattern.h new file mode 100644 index 0000000..ccf52ee --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_pattern.h @@ -0,0 +1,19 @@ +#ifndef _SCRIPTAPI_PATTERN_H +#define _SCRIPTAPI_PATTERN_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Pattern + { + SCRIPT_EXPORT duint Find(unsigned char* data, duint datasize, const char* pattern); + SCRIPT_EXPORT duint FindMem(duint start, duint size, const char* pattern); + SCRIPT_EXPORT void Write(unsigned char* data, duint datasize, const char* pattern); + SCRIPT_EXPORT void WriteMem(duint start, duint size, const char* pattern); + SCRIPT_EXPORT bool SearchAndReplace(unsigned char* data, duint datasize, const char* searchpattern, const char* replacepattern); + SCRIPT_EXPORT bool SearchAndReplaceMem(duint start, duint size, const char* searchpattern, const char* replacepattern); + }; +}; + +#endif //_SCRIPTAPI_FIND_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_register.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_register.h new file mode 100644 index 0000000..b5c8d74 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_register.h @@ -0,0 +1,289 @@ +#ifndef _SCRIPTAPI_REGISTER_H +#define _SCRIPTAPI_REGISTER_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Register + { + enum RegisterEnum + { + DR0, + DR1, + DR2, + DR3, + DR6, + DR7, + + EAX, + AX, + AH, + AL, + EBX, + BX, + BH, + BL, + ECX, + CX, + CH, + CL, + EDX, + DX, + DH, + DL, + EDI, + DI, + ESI, + SI, + EBP, + BP, + ESP, + SP, + EIP, + +#ifdef _WIN64 + RAX, + RBX, + RCX, + RDX, + RSI, + SIL, + RDI, + DIL, + RBP, + BPL, + RSP, + SPL, + RIP, + R8, + R8D, + R8W, + R8B, + R9, + R9D, + R9W, + R9B, + R10, + R10D, + R10W, + R10B, + R11, + R11D, + R11W, + R11B, + R12, + R12D, + R12W, + R12B, + R13, + R13D, + R13W, + R13B, + R14, + R14D, + R14W, + R14B, + R15, + R15D, + R15W, + R15B, +#endif //_WIN64 + + CIP, + CSP, + CAX, + CBX, + CCX, + CDX, + CDI, + CSI, + CBP, + CFLAGS + }; //RegisterEnum + + SCRIPT_EXPORT duint Get(RegisterEnum reg); + SCRIPT_EXPORT bool Set(RegisterEnum reg, duint value); + SCRIPT_EXPORT int Size(); //gets architecture register size in bytes + + SCRIPT_EXPORT duint GetDR0(); + SCRIPT_EXPORT bool SetDR0(duint value); + SCRIPT_EXPORT duint GetDR1(); + SCRIPT_EXPORT bool SetDR1(duint value); + SCRIPT_EXPORT duint GetDR2(); + SCRIPT_EXPORT bool SetDR2(duint value); + SCRIPT_EXPORT duint GetDR3(); + SCRIPT_EXPORT bool SetDR3(duint value); + SCRIPT_EXPORT duint GetDR6(); + SCRIPT_EXPORT bool SetDR6(duint value); + SCRIPT_EXPORT duint GetDR7(); + SCRIPT_EXPORT bool SetDR7(duint value); + + SCRIPT_EXPORT unsigned int GetEAX(); + SCRIPT_EXPORT bool SetEAX(unsigned int value); + SCRIPT_EXPORT unsigned short GetAX(); + SCRIPT_EXPORT bool SetAX(unsigned short value); + SCRIPT_EXPORT unsigned char GetAH(); + SCRIPT_EXPORT bool SetAH(unsigned char value); + SCRIPT_EXPORT unsigned char GetAL(); + SCRIPT_EXPORT bool SetAL(unsigned char value); + SCRIPT_EXPORT unsigned int GetEBX(); + SCRIPT_EXPORT bool SetEBX(unsigned int value); + SCRIPT_EXPORT unsigned short GetBX(); + SCRIPT_EXPORT bool SetBX(unsigned short value); + SCRIPT_EXPORT unsigned char GetBH(); + SCRIPT_EXPORT bool SetBH(unsigned char value); + SCRIPT_EXPORT unsigned char GetBL(); + SCRIPT_EXPORT bool SetBL(unsigned char value); + SCRIPT_EXPORT unsigned int GetECX(); + SCRIPT_EXPORT bool SetECX(unsigned int value); + SCRIPT_EXPORT unsigned short GetCX(); + SCRIPT_EXPORT bool SetCX(unsigned short value); + SCRIPT_EXPORT unsigned char GetCH(); + SCRIPT_EXPORT bool SetCH(unsigned char value); + SCRIPT_EXPORT unsigned char GetCL(); + SCRIPT_EXPORT bool SetCL(unsigned char value); + SCRIPT_EXPORT unsigned int GetEDX(); + SCRIPT_EXPORT bool SetEDX(unsigned int value); + SCRIPT_EXPORT unsigned short GetDX(); + SCRIPT_EXPORT bool SetDX(unsigned short value); + SCRIPT_EXPORT unsigned char GetDH(); + SCRIPT_EXPORT bool SetDH(unsigned char value); + SCRIPT_EXPORT unsigned char GetDL(); + SCRIPT_EXPORT bool SetDL(unsigned char value); + SCRIPT_EXPORT unsigned int GetEDI(); + SCRIPT_EXPORT bool SetEDI(unsigned int value); + SCRIPT_EXPORT unsigned short GetDI(); + SCRIPT_EXPORT bool SetDI(unsigned short value); + SCRIPT_EXPORT unsigned int GetESI(); + SCRIPT_EXPORT bool SetESI(unsigned int value); + SCRIPT_EXPORT unsigned short GetSI(); + SCRIPT_EXPORT bool SetSI(unsigned short value); + SCRIPT_EXPORT unsigned int GetEBP(); + SCRIPT_EXPORT bool SetEBP(unsigned int value); + SCRIPT_EXPORT unsigned short GetBP(); + SCRIPT_EXPORT bool SetBP(unsigned short value); + SCRIPT_EXPORT unsigned int GetESP(); + SCRIPT_EXPORT bool SetESP(unsigned int value); + SCRIPT_EXPORT unsigned short GetSP(); + SCRIPT_EXPORT bool SetSP(unsigned short value); + SCRIPT_EXPORT unsigned int GetEIP(); + SCRIPT_EXPORT bool SetEIP(unsigned int value); + +#ifdef _WIN64 + SCRIPT_EXPORT unsigned long long GetRAX(); + SCRIPT_EXPORT bool SetRAX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRBX(); + SCRIPT_EXPORT bool SetRBX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRCX(); + SCRIPT_EXPORT bool SetRCX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRDX(); + SCRIPT_EXPORT bool SetRDX(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetRSI(); + SCRIPT_EXPORT bool SetRSI(unsigned long long value); + SCRIPT_EXPORT unsigned char GetSIL(); + SCRIPT_EXPORT bool SetSIL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRDI(); + SCRIPT_EXPORT bool SetRDI(unsigned long long value); + SCRIPT_EXPORT unsigned char GetDIL(); + SCRIPT_EXPORT bool SetDIL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRBP(); + SCRIPT_EXPORT bool SetRBP(unsigned long long value); + SCRIPT_EXPORT unsigned char GetBPL(); + SCRIPT_EXPORT bool SetBPL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRSP(); + SCRIPT_EXPORT bool SetRSP(unsigned long long value); + SCRIPT_EXPORT unsigned char GetSPL(); + SCRIPT_EXPORT bool SetSPL(unsigned char value); + SCRIPT_EXPORT unsigned long long GetRIP(); + SCRIPT_EXPORT bool SetRIP(unsigned long long value); + SCRIPT_EXPORT unsigned long long GetR8(); + SCRIPT_EXPORT bool SetR8(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR8D(); + SCRIPT_EXPORT bool SetR8D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR8W(); + SCRIPT_EXPORT bool SetR8W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR8B(); + SCRIPT_EXPORT bool SetR8B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR9(); + SCRIPT_EXPORT bool SetR9(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR9D(); + SCRIPT_EXPORT bool SetR9D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR9W(); + SCRIPT_EXPORT bool SetR9W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR9B(); + SCRIPT_EXPORT bool SetR9B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR10(); + SCRIPT_EXPORT bool SetR10(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR10D(); + SCRIPT_EXPORT bool SetR10D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR10W(); + SCRIPT_EXPORT bool SetR10W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR10B(); + SCRIPT_EXPORT bool SetR10B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR11(); + SCRIPT_EXPORT bool SetR11(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR11D(); + SCRIPT_EXPORT bool SetR11D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR11W(); + SCRIPT_EXPORT bool SetR11W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR11B(); + SCRIPT_EXPORT bool SetR11B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR12(); + SCRIPT_EXPORT bool SetR12(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR12D(); + SCRIPT_EXPORT bool SetR12D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR12W(); + SCRIPT_EXPORT bool SetR12W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR12B(); + SCRIPT_EXPORT bool SetR12B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR13(); + SCRIPT_EXPORT bool SetR13(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR13D(); + SCRIPT_EXPORT bool SetR13D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR13W(); + SCRIPT_EXPORT bool SetR13W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR13B(); + SCRIPT_EXPORT bool SetR13B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR14(); + SCRIPT_EXPORT bool SetR14(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR14D(); + SCRIPT_EXPORT bool SetR14D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR14W(); + SCRIPT_EXPORT bool SetR14W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR14B(); + SCRIPT_EXPORT bool SetR14B(unsigned char value); + SCRIPT_EXPORT unsigned long long GetR15(); + SCRIPT_EXPORT bool SetR15(unsigned long long value); + SCRIPT_EXPORT unsigned int GetR15D(); + SCRIPT_EXPORT bool SetR15D(unsigned int value); + SCRIPT_EXPORT unsigned short GetR15W(); + SCRIPT_EXPORT bool SetR15W(unsigned short value); + SCRIPT_EXPORT unsigned char GetR15B(); + SCRIPT_EXPORT bool SetR15B(unsigned char value); +#endif //_WIN64 + + SCRIPT_EXPORT duint GetCAX(); + SCRIPT_EXPORT bool SetCAX(duint value); + SCRIPT_EXPORT duint GetCBX(); + SCRIPT_EXPORT bool SetCBX(duint value); + SCRIPT_EXPORT duint GetCCX(); + SCRIPT_EXPORT bool SetCCX(duint value); + SCRIPT_EXPORT duint GetCDX(); + SCRIPT_EXPORT bool SetCDX(duint value); + SCRIPT_EXPORT duint GetCDI(); + SCRIPT_EXPORT bool SetCDI(duint value); + SCRIPT_EXPORT duint GetCSI(); + SCRIPT_EXPORT bool SetCSI(duint value); + SCRIPT_EXPORT duint GetCBP(); + SCRIPT_EXPORT bool SetCBP(duint value); + SCRIPT_EXPORT duint GetCSP(); + SCRIPT_EXPORT bool SetCSP(duint value); + SCRIPT_EXPORT duint GetCIP(); + SCRIPT_EXPORT bool SetCIP(duint value); + SCRIPT_EXPORT duint GetCFLAGS(); + SCRIPT_EXPORT bool SetCFLAGS(duint value); + }; //Register +}; //Script + +#endif //_SCRIPTAPI_REGISTER_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_stack.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_stack.h new file mode 100644 index 0000000..55522b7 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_stack.h @@ -0,0 +1,16 @@ +#ifndef _SCRIPTAPI_STACK_H +#define _SCRIPTAPI_STACK_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Stack + { + SCRIPT_EXPORT duint Pop(); + SCRIPT_EXPORT duint Push(duint value); //returns the previous top, equal to Peek(1) + SCRIPT_EXPORT duint Peek(int offset = 0); //offset is in multiples of Register::Size(), for easy x32/x64 portability + }; //Stack +}; //Script + +#endif //_SCRIPTAPI_STACK_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_symbol.h b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_symbol.h new file mode 100644 index 0000000..9d51d42 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/_scriptapi_symbol.h @@ -0,0 +1,30 @@ +#ifndef _SCRIPTAPI_SYMBOL_H +#define _SCRIPTAPI_SYMBOL_H + +#include "_scriptapi.h" + +namespace Script +{ + namespace Symbol + { + enum SymbolType + { + Function, //user-defined function + Import, //IAT entry + Export //export + }; + + struct SymbolInfo + { + char mod[MAX_MODULE_SIZE]; + duint rva; + char name[MAX_LABEL_SIZE]; + bool manual; + SymbolType type; + }; + + SCRIPT_EXPORT bool GetList(ListOf(SymbolInfo) list); //caller has the responsibility to free the list + }; //Symbol +}; //Script + +#endif //_SCRIPTAPI_SYMBOL_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/bridgegraph.h b/BranchTrace-x64plugin-wtl/pluginsdk/bridgegraph.h new file mode 100644 index 0000000..7638aaf --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/bridgegraph.h @@ -0,0 +1,186 @@ +#ifndef _GRAPH_H +#define _GRAPH_H + +typedef struct +{ + duint addr; //virtual address of the instruction + unsigned char data[15]; //instruction bytes +} BridgeCFInstruction; + +typedef struct +{ + duint parentGraph; //function of which this node is a part + duint start; //start of the block + duint end; //end of the block (inclusive) + duint brtrue; //destination if condition is true + duint brfalse; //destination if condition is false + duint icount; //number of instructions in node + bool terminal; //node is a RET + bool split; //node is a split (brtrue points to the next node) + bool indirectcall; //node contains indirect calls (call reg, call [reg+X]) + void* userdata; //user data + ListInfo exits; //exits (including brtrue and brfalse, duint) + ListInfo instrs; //block instructions +} BridgeCFNodeList; + +typedef struct +{ + duint entryPoint; //graph entry point + void* userdata; //user data + ListInfo nodes; //graph nodes (BridgeCFNodeList) +} BridgeCFGraphList; + +#ifdef __cplusplus +#if _MSC_VER >= 1700 && !defined(NO_CPP11) + +#include +#include +#include +#include + +struct BridgeCFNode +{ + duint parentGraph = 0; //function of which this node is a part + duint start = 0; //va of the first instruction in the block + duint end = 0; //va of the last instruction in the block (inclusive) + duint brtrue = 0; //destination if condition is true + duint brfalse = 0; //destination if condition is false + duint icount = 0; //number of instructions in node + bool terminal = false; //node is a RET + bool split = false; //node is a split (brtrue points to the next node) + bool indirectcall = false; //node contains indirect calls (call reg, call [reg+X]) + void* userdata = nullptr; //user data + std::vector exits; //exits (including brtrue and brfalse) + std::vector instrs; //block instructions + + static void Free(const BridgeCFNodeList* nodeList) + { + if(!BridgeList::Free(&nodeList->exits)) + __debugbreak(); + if(!BridgeList::Free(&nodeList->instrs)) + __debugbreak(); + } + + BridgeCFNode() = default; + + BridgeCFNode(const BridgeCFNodeList* nodeList, bool freedata) + { + if(!nodeList) + __debugbreak(); + parentGraph = nodeList->parentGraph; + start = nodeList->start; + end = nodeList->end; + brtrue = nodeList->brtrue; + brfalse = nodeList->brfalse; + icount = nodeList->icount; + terminal = nodeList->terminal; + indirectcall = nodeList->indirectcall; + split = nodeList->split; + userdata = nodeList->userdata; + if(!BridgeList::ToVector(&nodeList->exits, exits, freedata)) + __debugbreak(); + if(!BridgeList::ToVector(&nodeList->instrs, instrs, freedata)) + __debugbreak(); + } + + BridgeCFNode(duint parentGraph, duint start, duint end) + : parentGraph(parentGraph), + start(start), + end(end) + { + } + + BridgeCFNodeList ToNodeList() const + { + BridgeCFNodeList out; + out.parentGraph = parentGraph; + out.start = start; + out.end = end; + out.brtrue = brtrue; + out.brfalse = brfalse; + out.icount = icount; + out.terminal = terminal; + out.indirectcall = indirectcall; + out.split = split; + out.userdata = userdata; + BridgeList::CopyData(&out.exits, exits); + BridgeList::CopyData(&out.instrs, instrs); + return std::move(out); + } +}; + +struct BridgeCFGraph +{ + duint entryPoint; //graph entry point + void* userdata; //user data + std::unordered_map nodes; //CFNode.start -> CFNode + std::unordered_map> parents; //CFNode.start -> parents + + static void Free(const BridgeCFGraphList* graphList) + { + if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList)) + __debugbreak(); + auto data = (BridgeCFNodeList*)graphList->nodes.data; + for(int i = 0; i < graphList->nodes.count; i++) + BridgeCFNode::Free(&data[i]); + BridgeFree(data); + } + + explicit BridgeCFGraph(const BridgeCFGraphList* graphList, bool freedata) + { + if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList)) + __debugbreak(); + entryPoint = graphList->entryPoint; + userdata = graphList->userdata; + auto data = (BridgeCFNodeList*)graphList->nodes.data; + for(int i = 0; i < graphList->nodes.count; i++) + AddNode(BridgeCFNode(&data[i], freedata)); + if(freedata && data) + BridgeFree(data); + } + + explicit BridgeCFGraph(duint entryPoint) + : entryPoint(entryPoint), + userdata(nullptr) + { + } + + void AddNode(const BridgeCFNode & node) + { + nodes[node.start] = node; + AddParent(node.start, node.brtrue); + AddParent(node.start, node.brfalse); + } + + void AddParent(duint child, duint parent) + { + if(!child || !parent) + return; + auto found = parents.find(child); + if(found == parents.end()) + { + parents[child] = std::unordered_set(); + parents[child].insert(parent); + } + else + found->second.insert(parent); + } + + BridgeCFGraphList ToGraphList() const + { + BridgeCFGraphList out; + out.entryPoint = entryPoint; + out.userdata = userdata; + std::vector nodeList; + nodeList.reserve(nodes.size()); + for(const auto & nodeIt : nodes) + nodeList.push_back(nodeIt.second.ToNodeList()); + BridgeList::CopyData(&out.nodes, nodeList); + return std::move(out); + } +}; + +#endif //_MSC_VER +#endif //__cplusplus + +#endif //_GRAPH_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/bridgelist.h b/BranchTrace-x64plugin-wtl/pluginsdk/bridgelist.h new file mode 100644 index 0000000..d71d203 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/bridgelist.h @@ -0,0 +1,149 @@ +#ifndef _LIST_H +#define _LIST_H + +typedef struct +{ + int count; //Number of element in the list. + size_t size; //Size of list in bytes (used for type checking). + void* data; //Pointer to the list contents. Must be deleted by the caller using BridgeFree (or BridgeList::Free). +} ListInfo; + +#define ListOf(Type) ListInfo* + +#ifdef __cplusplus + +#include + +/** +\brief A list object. This object is NOT thread safe. +\tparam Type BridgeList contents type. +*/ +template +class BridgeList +{ +public: + /** + \brief BridgeList constructor. + \param _freeData (Optional) the free function. + */ + explicit BridgeList() + { + memset(&_listInfo, 0, sizeof(_listInfo)); + } + + /** + \brief BridgeList destructor. + */ + ~BridgeList() + { + Cleanup(); + } + + /** + \brief Gets the list data. + \return Returns ListInfo->data. Can be null if the list was never initialized. Will be destroyed once this object goes out of scope! + */ + Type* Data() const + { + return reinterpret_cast(_listInfo.data); + } + + /** + \brief Gets the number of elements in the list. This will crash the program if the data is not consistent with the specified template argument. + \return The number of elements in the list. + */ + int Count() const + { + if(_listInfo.size != _listInfo.count * sizeof(Type)) //make sure the user is using the correct type. + __debugbreak(); + return _listInfo.count; + } + + /** + \brief Cleans up the list, freeing the list data when it is not null. + */ + void Cleanup() + { + if(_listInfo.data) + { + BridgeFree(_listInfo.data); + _listInfo.data = nullptr; + } + } + + /** + \brief Reference operator (cleans up the previous list) + \return Pointer to the ListInfo. + */ + ListInfo* operator&() + { + Cleanup(); + return &_listInfo; + } + + /** + \brief Array indexer operator. This will crash if you try to access out-of-bounds. + \param index Zero-based index of the item you want to get. + \return Reference to a value at that index. + */ + Type & operator[](size_t index) const + { + if(index >= size_t(Count())) //make sure the out-of-bounds access is caught as soon as possible. + __debugbreak(); + return Data()[index]; + } + + /** + \brief Copies data to a ListInfo structure.. + \param [out] listInfo If non-null, information describing the list. + \param listData Data to copy in the ListInfo structure. + \return true if it succeeds, false if it fails. + */ + static bool CopyData(ListInfo* listInfo, const std::vector & listData) + { + if(!listInfo) + return false; + listInfo->count = int(listData.size()); + listInfo->size = listInfo->count * sizeof(Type); + if(listInfo->count) + { + listInfo->data = BridgeAlloc(listInfo->size); + Type* curItem = reinterpret_cast(listInfo->data); + for(const auto & item : listData) + { + *curItem = item; + ++curItem; + } + } + else + listInfo->data = nullptr; + return true; + } + + static bool Free(const ListInfo* listInfo) + { + if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data)) + return false; + BridgeFree(listInfo->data); + return true; + } + + static bool ToVector(const ListInfo* listInfo, std::vector & listData, bool freedata = true) + { + if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data)) + return false; + listData.resize(listInfo->count); + for(int i = 0; i < listInfo->count; i++) + listData[i] = ((Type*)listInfo->data)[i]; + if(freedata && listInfo->data) + BridgeFree(listInfo->data); + return true; + } + +private: + ListInfo _listInfo; +}; + +#endif //__cplusplus + +#endif //_LIST_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/bridgemain.h b/BranchTrace-x64plugin-wtl/pluginsdk/bridgemain.h new file mode 100644 index 0000000..5be72e7 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/bridgemain.h @@ -0,0 +1,1388 @@ +#ifndef _BRIDGEMAIN_H_ +#define _BRIDGEMAIN_H_ + +#include + +#ifndef __cplusplus +#include +#define DEFAULT_PARAM(name, value) name +#else +#define DEFAULT_PARAM(name, value) name = value +#endif + +//default structure alignments forced +#ifdef _WIN64 +#pragma pack(push, 16) +#else //x86 +#pragma pack(push, 8) +#endif //_WIN64 + +#ifdef _WIN64 +typedef unsigned long long duint; +typedef signed long long dsint; +#else +typedef unsigned long duint; +typedef signed long dsint; +#endif //_WIN64 + +#ifndef BRIDGE_IMPEXP +#ifdef BUILD_BRIDGE +#define BRIDGE_IMPEXP __declspec(dllexport) +#else +#define BRIDGE_IMPEXP __declspec(dllimport) +#endif //BUILD_BRIDGE +#endif //BRIDGE_IMPEXP + +#ifdef __cplusplus +extern "C" +{ +#endif + +//Bridge defines +#define MAX_SETTING_SIZE 65536 +#define DBG_VERSION 25 + +//Bridge functions + +/// +/// Initialize the bridge. +/// +/// On error it returns a non-null error message. +BRIDGE_IMPEXP const wchar_t* BridgeInit(); + +/// +/// Start the bridge. +/// +/// On error it returns a non-null error message. +BRIDGE_IMPEXP const wchar_t* BridgeStart(); + +/// +/// Allocate buffer. Use BridgeFree to free the buffer. +/// +/// Size in bytes of the buffer to allocate. +/// A pointer to the allocated buffer. This function will trigger a crash dump if unsuccessful. +BRIDGE_IMPEXP void* BridgeAlloc(size_t size); + +/// +/// Free buffer allocated by BridgeAlloc. +/// +/// Buffer to free. +BRIDGE_IMPEXP void BridgeFree(void* ptr); + +/// +/// Get a string setting from the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Cannot be null. +/// Output buffer for the value. Should be of MAX_SETTING_SIZE. Cannot be null. +/// True if the setting was found and copied in the value parameter. +BRIDGE_IMPEXP bool BridgeSettingGet(const char* section, const char* key, char* value); + +/// +/// Get an integer setting from the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Cannot be null. +/// Output value. +/// True if the setting was found and successfully converted to an integer. +BRIDGE_IMPEXP bool BridgeSettingGetUint(const char* section, const char* key, duint* value); + +/// +/// Set a string setting in the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Set to null to clear the whole section. +/// New setting value. Set to null to remove the key from the section. +/// True if the operation was successful. +BRIDGE_IMPEXP bool BridgeSettingSet(const char* section, const char* key, const char* value); + +/// +/// Set an integer setting in the in-memory setting store. +/// +/// Section the setting is in. Cannot be null. +/// Setting key (name). Set to null to clear the whole section. +/// New setting value. +/// True if the operation was successful. +BRIDGE_IMPEXP bool BridgeSettingSetUint(const char* section, const char* key, duint value); + +/// +/// Flush the in-memory setting store to disk. +/// +/// +BRIDGE_IMPEXP bool BridgeSettingFlush(); + +/// +/// Read the in-memory setting store from disk. +/// +/// Line where the error occurred. Set to null to ignore this. +/// True if the setting were read and parsed correctly. +BRIDGE_IMPEXP bool BridgeSettingRead(int* errorLine); + +/// +/// Get the debugger version. +/// +/// 25 +BRIDGE_IMPEXP int BridgeGetDbgVersion(); + +/// +/// Checks if the current process is elevated. +/// +/// true if the process is elevated, false otherwise. +BRIDGE_IMPEXP bool BridgeIsProcessElevated(); + +#ifdef __cplusplus +} +#endif + +//list structure (and C++ wrapper) +#include "bridgelist.h" + +#include "bridgegraph.h" + +#ifdef __cplusplus +extern "C" +{ +#endif + +//Debugger defines +#define MAX_LABEL_SIZE 256 +#define MAX_COMMENT_SIZE 512 +#define MAX_MODULE_SIZE 256 +#define MAX_IMPORT_SIZE 65536 +#define MAX_BREAKPOINT_SIZE 256 +#define MAX_CONDITIONAL_EXPR_SIZE 256 +#define MAX_CONDITIONAL_TEXT_SIZE 256 +#define MAX_SCRIPT_LINE_SIZE 2048 +#define MAX_THREAD_NAME_SIZE 256 +#define MAX_WATCH_NAME_SIZE 256 +#define MAX_STRING_SIZE 512 +#define MAX_ERROR_SIZE 512 +#define RIGHTS_STRING_SIZE (sizeof("ERWCG") + 1) +#define MAX_SECTION_SIZE 10 +#define MAX_COMMAND_LINE_SIZE 256 +#define MAX_MNEMONIC_SIZE 64 +#define PAGE_SIZE 0x1000 + +//Debugger enums +typedef enum +{ + initialized, + paused, + running, + stopped +} DBGSTATE; + +typedef enum +{ + SEG_DEFAULT, + SEG_ES, + SEG_DS, + SEG_FS, + SEG_GS, + SEG_CS, + SEG_SS +} SEGMENTREG; + +typedef enum +{ + flagmodule = 0x1, + flaglabel = 0x2, + flagcomment = 0x4, + flagbookmark = 0x8, + flagfunction = 0x10, + flagloop = 0x20, + flagargs = 0x40, + flagNoFuncOffset = 0x80 +} ADDRINFOFLAGS; + +typedef enum +{ + bp_none = 0, + bp_normal = 1, + bp_hardware = 2, + bp_memory = 4, + bp_dll = 8, + bp_exception = 16 +} BPXTYPE; + +typedef enum +{ + FUNC_NONE, + FUNC_BEGIN, + FUNC_MIDDLE, + FUNC_END, + FUNC_SINGLE +} FUNCTYPE; + +typedef enum +{ + LOOP_NONE, + LOOP_BEGIN, + LOOP_MIDDLE, + LOOP_ENTRY, + LOOP_END, + LOOP_SINGLE +} LOOPTYPE; + +//order by most important type last +typedef enum +{ + XREF_NONE, + XREF_DATA, + XREF_JMP, + XREF_CALL +} XREFTYPE; + +typedef enum +{ + ARG_NONE, + ARG_BEGIN, + ARG_MIDDLE, + ARG_END, + ARG_SINGLE +} ARGTYPE; + +typedef enum +{ + DBG_SCRIPT_LOAD, // param1=const char* filename, param2=unused + DBG_SCRIPT_UNLOAD, // param1=unused, param2=unused + DBG_SCRIPT_RUN, // param1=int destline, param2=unused + DBG_SCRIPT_STEP, // param1=unused, param2=unused + DBG_SCRIPT_BPTOGGLE, // param1=int line, param2=unused + DBG_SCRIPT_BPGET, // param1=int line, param2=unused + DBG_SCRIPT_CMDEXEC, // param1=const char* command, param2=unused + DBG_SCRIPT_ABORT, // param1=unused, param2=unused + DBG_SCRIPT_GETLINETYPE, // param1=int line, param2=unused + DBG_SCRIPT_SETIP, // param1=int line, param2=unused + DBG_SCRIPT_GETBRANCHINFO, // param1=int line, param2=SCRIPTBRANCH* info + DBG_SYMBOL_ENUM, // param1=SYMBOLCBINFO* cbInfo, param2=unused + DBG_ASSEMBLE_AT, // param1=duint addr, param2=const char* instruction + DBG_MODBASE_FROM_NAME, // param1=const char* modname, param2=unused + DBG_DISASM_AT, // param1=duint addr, param2=DISASM_INSTR* instr + DBG_STACK_COMMENT_GET, // param1=duint addr, param2=STACK_COMMENT* comment + DBG_GET_THREAD_LIST, // param1=THREADALLINFO* list, param2=unused + DBG_SETTINGS_UPDATED, // param1=unused, param2=unused + DBG_DISASM_FAST_AT, // param1=duint addr, param2=BASIC_INSTRUCTION_INFO* basicinfo + DBG_MENU_ENTRY_CLICKED, // param1=int hEntry, param2=unused + DBG_FUNCTION_GET, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_FUNCTION_OVERLAPS, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_FUNCTION_ADD, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_FUNCTION_DEL, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_GET, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_OVERLAPS, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_ADD, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_LOOP_DEL, // param1=FUNCTION_LOOP_INFO* info, param2=unused + DBG_IS_RUN_LOCKED, // param1=unused, param2=unused + DBG_IS_BP_DISABLED, // param1=duint addr, param2=unused + DBG_SET_AUTO_COMMENT_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_COMMENT_RANGE, // param1=duint start, param2=duint end + DBG_SET_AUTO_LABEL_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_LABEL_RANGE, // param1=duint start, param2=duint end + DBG_SET_AUTO_BOOKMARK_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_BOOKMARK_RANGE, // param1=duint start, param2=duint end + DBG_SET_AUTO_FUNCTION_AT, // param1=duint addr, param2=const char* text + DBG_DELETE_AUTO_FUNCTION_RANGE, // param1=duint start, param2=duint end + DBG_GET_STRING_AT, // param1=duint addr, param2=unused + DBG_GET_FUNCTIONS, // param1=unused, param2=unused + DBG_WIN_EVENT, // param1=MSG* message, param2=long* result + DBG_WIN_EVENT_GLOBAL, // param1=MSG* message, param2=unused + DBG_INITIALIZE_LOCKS, // param1=unused, param2=unused + DBG_DEINITIALIZE_LOCKS, // param1=unused, param2=unused + DBG_GET_TIME_WASTED_COUNTER, // param1=unused, param2=unused + DBG_SYMBOL_ENUM_FROMCACHE, // param1=SYMBOLCBINFO* cbInfo, param2=unused + DBG_DELETE_COMMENT_RANGE, // param1=duint start, param2=duint end + DBG_DELETE_LABEL_RANGE, // param1=duint start, param2=duint end + DBG_DELETE_BOOKMARK_RANGE, // param1=duint start, param2=duint end + DBG_GET_XREF_COUNT_AT, // param1=duint addr, param2=unused + DBG_GET_XREF_TYPE_AT, // param1=duint addr, param2=unused + DBG_XREF_ADD, // param1=duint addr, param2=duint from + DBG_XREF_DEL_ALL, // param1=duint addr, param2=unused + DBG_XREF_GET, // param1=duint addr, param2=XREF_INFO* info + DBG_GET_ENCODE_TYPE_BUFFER, // param1=duint addr, param2=unused + DBG_ENCODE_TYPE_GET, // param1=duint addr, param2=duint size + DBG_DELETE_ENCODE_TYPE_RANGE, // param1=duint start, param2=duint end + DBG_ENCODE_SIZE_GET, // param1=duint addr, param2=duint codesize + DBG_DELETE_ENCODE_TYPE_SEG, // param1=duint addr, param2=unused + DBG_RELEASE_ENCODE_TYPE_BUFFER, // param1=void* buffer, param2=unused + DBG_ARGUMENT_GET, // param1=FUNCTION* info, param2=unused + DBG_ARGUMENT_OVERLAPS, // param1=FUNCTION* info, param2=unused + DBG_ARGUMENT_ADD, // param1=FUNCTION* info, param2=unused + DBG_ARGUMENT_DEL, // param1=FUNCTION* info, param2=unused + DBG_GET_WATCH_LIST, // param1=ListOf(WATCHINFO), param2=unused + DBG_SELCHANGED, // param1=hWindow, param2=VA + DBG_GET_PROCESS_HANDLE, // param1=unused, param2=unused + DBG_GET_THREAD_HANDLE, // param1=unused, param2=unused + DBG_GET_PROCESS_ID, // param1=unused, param2=unused + DBG_GET_THREAD_ID, // param1=unused, param2=unused + DBG_GET_PEB_ADDRESS, // param1=DWORD ProcessId, param2=unused + DBG_GET_TEB_ADDRESS, // param1=DWORD ThreadId, param2=unused + DBG_ANALYZE_FUNCTION, // param1=BridgeCFGraphList* graph, param2=duint entry + DBG_MENU_PREPARE, // param1=int hMenu, param2=unused + DBG_GET_SYMBOL_INFO, // param1=void* symbol, param2=SYMBOLINFO* info + DBG_GET_DEBUG_ENGINE, // param1=unused, param2-unused +} DBGMSG; + +typedef enum +{ + linecommand, + linebranch, + linelabel, + linecomment, + lineempty, +} SCRIPTLINETYPE; + +typedef enum +{ + scriptnobranch, + scriptjmp, + scriptjnejnz, + scriptjejz, + scriptjbjl, + scriptjajg, + scriptjbejle, + scriptjaejge, + scriptcall +} SCRIPTBRANCHTYPE; + +typedef enum +{ + instr_normal, + instr_branch, + instr_stack +} DISASM_INSTRTYPE; + +typedef enum +{ + arg_normal, + arg_memory +} DISASM_ARGTYPE; + +typedef enum +{ + str_none, + str_ascii, + str_unicode +} STRING_TYPE; + +typedef enum +{ + _PriorityIdle = -15, + _PriorityAboveNormal = 1, + _PriorityBelowNormal = -1, + _PriorityHighest = 2, + _PriorityLowest = -2, + _PriorityNormal = 0, + _PriorityTimeCritical = 15, + _PriorityUnknown = 0x7FFFFFFF +} THREADPRIORITY; + +typedef enum +{ + _Executive = 0, + _FreePage = 1, + _PageIn = 2, + _PoolAllocation = 3, + _DelayExecution = 4, + _Suspended = 5, + _UserRequest = 6, + _WrExecutive = 7, + _WrFreePage = 8, + _WrPageIn = 9, + _WrPoolAllocation = 10, + _WrDelayExecution = 11, + _WrSuspended = 12, + _WrUserRequest = 13, + _WrEventPair = 14, + _WrQueue = 15, + _WrLpcReceive = 16, + _WrLpcReply = 17, + _WrVirtualMemory = 18, + _WrPageOut = 19, + _WrRendezvous = 20, + _Spare2 = 21, + _Spare3 = 22, + _Spare4 = 23, + _Spare5 = 24, + _WrCalloutStack = 25, + _WrKernel = 26, + _WrResource = 27, + _WrPushLock = 28, + _WrMutex = 29, + _WrQuantumEnd = 30, + _WrDispatchInt = 31, + _WrPreempted = 32, + _WrYieldExecution = 33, + _WrFastMutex = 34, + _WrGuardedMutex = 35, + _WrRundown = 36, +} THREADWAITREASON; + +typedef enum +{ + size_byte = 1, + size_word = 2, + size_dword = 4, + size_qword = 8, + size_xmmword = 16, + size_ymmword = 32 +} MEMORY_SIZE; + +typedef enum +{ + enc_unknown, //must be 0 + enc_byte, //1 byte + enc_word, //2 bytes + enc_dword, //4 bytes + enc_fword, //6 bytes + enc_qword, //8 bytes + enc_tbyte, //10 bytes + enc_oword, //16 bytes + enc_mmword, //8 bytes + enc_xmmword, //16 bytes + enc_ymmword, //32 bytes + enc_zmmword, //64 bytes avx512 not supported + enc_real4, //4 byte float + enc_real8, //8 byte double + enc_real10, //10 byte decimal + enc_ascii, //ascii sequence + enc_unicode, //unicode sequence + enc_code, //start of code + enc_junk, //junk code + enc_middle //middle of data +} ENCODETYPE; + +typedef enum +{ + TYPE_UINT, // unsigned integer + TYPE_INT, // signed integer + TYPE_FLOAT,// single precision floating point value + TYPE_ASCII, // ascii string + TYPE_UNICODE, // unicode string + TYPE_INVALID // invalid watch expression or data type +} WATCHVARTYPE; + +typedef enum +{ + MODE_DISABLED, // watchdog is disabled + MODE_ISTRUE, // alert if expression is not 0 + MODE_ISFALSE, // alert if expression is 0 + MODE_CHANGED, // alert if expression is changed + MODE_UNCHANGED // alert if expression is not changed +} WATCHDOGMODE; + +typedef enum +{ + hw_access, + hw_write, + hw_execute +} BPHWTYPE; + +typedef enum +{ + mem_access, + mem_read, + mem_write, + mem_execute +} BPMEMTYPE; + +typedef enum +{ + dll_load = 1, + dll_unload, + dll_all +} BPDLLTYPE; + +typedef enum +{ + ex_firstchance = 1, + ex_secondchance, + ex_all +} BPEXTYPE; + +typedef enum +{ + hw_byte, + hw_word, + hw_dword, + hw_qword +} BPHWSIZE; + +typedef enum +{ + sym_import, + sym_export, + sym_symbol +} SYMBOLTYPE; + +typedef enum +{ + mod_user, + mod_system +} MODULEPARTY; + +typedef enum +{ + DebugEngineTitanEngine, + DebugEngineGleeBug, + DebugEngineStaticEngine, +} DEBUG_ENGINE; + +//Debugger typedefs +typedef MEMORY_SIZE VALUE_SIZE; + +typedef struct DBGFUNCTIONS_ DBGFUNCTIONS; + +typedef bool (*CBSYMBOLENUM)(const struct SYMBOLPTR_* symbol, void* user); + +//Debugger structs +typedef struct +{ + MEMORY_BASIC_INFORMATION mbi; + char info[MAX_MODULE_SIZE]; +} MEMPAGE; + +typedef struct +{ + int count; + MEMPAGE* page; +} MEMMAP; + +typedef struct +{ + BPXTYPE type; + duint addr; + bool enabled; + bool singleshoot; + bool active; + char name[MAX_BREAKPOINT_SIZE]; + char mod[MAX_MODULE_SIZE]; + unsigned short slot; + // extended part + unsigned char typeEx; //BPHWTYPE/BPMEMTYPE/BPDLLTYPE/BPEXTYPE + unsigned char hwSize; //BPHWSIZE + unsigned int hitCount; + bool fastResume; + bool silent; + char breakCondition[MAX_CONDITIONAL_EXPR_SIZE]; + char logText[MAX_CONDITIONAL_TEXT_SIZE]; + char logCondition[MAX_CONDITIONAL_EXPR_SIZE]; + char commandText[MAX_CONDITIONAL_TEXT_SIZE]; + char commandCondition[MAX_CONDITIONAL_EXPR_SIZE]; +} BRIDGEBP; + +typedef struct +{ + int count; + BRIDGEBP* bp; +} BPMAP; + +typedef struct +{ + char WatchName[MAX_WATCH_NAME_SIZE]; + char Expression[MAX_CONDITIONAL_EXPR_SIZE]; + unsigned int window; + unsigned int id; + WATCHVARTYPE varType; + WATCHDOGMODE watchdogMode; + duint value; + bool watchdogTriggered; +} WATCHINFO; + +typedef struct +{ + duint start; //OUT + duint end; //OUT + duint instrcount; //OUT +} FUNCTION; + +typedef struct +{ + int depth; //IN + duint start; //OUT + duint end; //OUT + duint instrcount; //OUT +} LOOP; + +typedef struct +{ + int flags; //ADDRINFOFLAGS (IN) + char module[MAX_MODULE_SIZE]; //module the address is in + char label[MAX_LABEL_SIZE]; + char comment[MAX_COMMENT_SIZE]; + bool isbookmark; + FUNCTION function; + LOOP loop; + FUNCTION args; +} BRIDGE_ADDRINFO; + +typedef struct SYMBOLINFO_ +{ + duint addr; + char* decoratedSymbol; + char* undecoratedSymbol; + SYMBOLTYPE type; + bool freeDecorated; + bool freeUndecorated; + DWORD ordinal; +} SYMBOLINFO; + +typedef struct +{ + duint base; + char name[MAX_MODULE_SIZE]; +} SYMBOLMODULEINFO; + +typedef struct +{ + duint base; + CBSYMBOLENUM cbSymbolEnum; + void* user; +} SYMBOLCBINFO; + +typedef struct +{ + bool c; + bool p; + bool a; + bool z; + bool s; + bool t; + bool i; + bool d; + bool o; +} FLAGS; + +typedef struct +{ + bool FZ; + bool PM; + bool UM; + bool OM; + bool ZM; + bool IM; + bool DM; + bool DAZ; + bool PE; + bool UE; + bool OE; + bool ZE; + bool DE; + bool IE; + + unsigned short RC; +} MXCSRFIELDS; + +typedef struct +{ + bool B; + bool C3; + bool C2; + bool C1; + bool C0; + bool ES; + bool SF; + bool P; + bool U; + bool O; + bool Z; + bool D; + bool I; + + unsigned short TOP; + +} X87STATUSWORDFIELDS; + +typedef struct +{ + bool IC; + bool IEM; + bool PM; + bool UM; + bool OM; + bool ZM; + bool DM; + bool IM; + + unsigned short RC; + unsigned short PC; + +} X87CONTROLWORDFIELDS; + +typedef struct DECLSPEC_ALIGN(16) _XMMREGISTER +{ + ULONGLONG Low; + LONGLONG High; +} XMMREGISTER; + +typedef struct +{ + XMMREGISTER Low; //XMM/SSE part + XMMREGISTER High; //AVX part +} YMMREGISTER; + +typedef struct +{ + BYTE data[10]; + int st_value; + int tag; +} X87FPUREGISTER; + +typedef struct +{ + WORD ControlWord; + WORD StatusWord; + WORD TagWord; + DWORD ErrorOffset; + DWORD ErrorSelector; + DWORD DataOffset; + DWORD DataSelector; + DWORD Cr0NpxState; +} X87FPU; + +typedef struct +{ + ULONG_PTR cax; + ULONG_PTR ccx; + ULONG_PTR cdx; + ULONG_PTR cbx; + ULONG_PTR csp; + ULONG_PTR cbp; + ULONG_PTR csi; + ULONG_PTR cdi; +#ifdef _WIN64 + ULONG_PTR r8; + ULONG_PTR r9; + ULONG_PTR r10; + ULONG_PTR r11; + ULONG_PTR r12; + ULONG_PTR r13; + ULONG_PTR r14; + ULONG_PTR r15; +#endif //_WIN64 + ULONG_PTR cip; + ULONG_PTR eflags; + unsigned short gs; + unsigned short fs; + unsigned short es; + unsigned short ds; + unsigned short cs; + unsigned short ss; + ULONG_PTR dr0; + ULONG_PTR dr1; + ULONG_PTR dr2; + ULONG_PTR dr3; + ULONG_PTR dr6; + ULONG_PTR dr7; + BYTE RegisterArea[80]; + X87FPU x87fpu; + DWORD MxCsr; +#ifdef _WIN64 + XMMREGISTER XmmRegisters[16]; + YMMREGISTER YmmRegisters[16]; +#else // x86 + XMMREGISTER XmmRegisters[8]; + YMMREGISTER YmmRegisters[8]; +#endif +} REGISTERCONTEXT; + +typedef struct +{ + DWORD code; + char name[128]; +} LASTERROR; + +typedef struct +{ + DWORD code; + char name[128]; +} LASTSTATUS; + +typedef struct +{ + REGISTERCONTEXT regcontext; + FLAGS flags; + X87FPUREGISTER x87FPURegisters[8]; + unsigned long long mmx[8]; + MXCSRFIELDS MxCsrFields; + X87STATUSWORDFIELDS x87StatusWordFields; + X87CONTROLWORDFIELDS x87ControlWordFields; + LASTERROR lastError; + LASTSTATUS lastStatus; +} REGDUMP; + +typedef struct +{ + DISASM_ARGTYPE type; //normal/memory + SEGMENTREG segment; + char mnemonic[64]; + duint constant; //constant in the instruction (imm/disp) + duint value; //equal to constant or equal to the register value + duint memvalue; //memsize:[value] +} DISASM_ARG; + +typedef struct +{ + char instruction[64]; + DISASM_INSTRTYPE type; + int argcount; + int instr_size; + DISASM_ARG arg[3]; +} DISASM_INSTR; + +typedef struct +{ + char color[8]; //hex color-code + char comment[MAX_COMMENT_SIZE]; +} STACK_COMMENT; + +typedef struct +{ + int ThreadNumber; + HANDLE Handle; + DWORD ThreadId; + duint ThreadStartAddress; + duint ThreadLocalBase; + char threadName[MAX_THREAD_NAME_SIZE]; +} THREADINFO; + +typedef struct +{ + THREADINFO BasicInfo; + duint ThreadCip; + DWORD SuspendCount; + THREADPRIORITY Priority; + THREADWAITREASON WaitReason; + DWORD LastError; + FILETIME UserTime; + FILETIME KernelTime; + FILETIME CreationTime; + ULONG64 Cycles; // Windows Vista or greater +} THREADALLINFO; + +typedef struct +{ + int count; + THREADALLINFO* list; + int CurrentThread; +} THREADLIST; + +typedef struct +{ + duint value; //displacement / addrvalue (rip-relative) + MEMORY_SIZE size; //byte/word/dword/qword + char mnemonic[MAX_MNEMONIC_SIZE]; +} MEMORY_INFO; + +typedef struct +{ + duint value; + VALUE_SIZE size; +} VALUE_INFO; + +//definitions for BASIC_INSTRUCTION_INFO.type +#define TYPE_VALUE 1 +#define TYPE_MEMORY 2 +#define TYPE_ADDR 4 + +typedef struct +{ + DWORD type; //value|memory|addr + VALUE_INFO value; //immediat + MEMORY_INFO memory; + duint addr; //addrvalue (jumps + calls) + bool branch; //jumps/calls + bool call; //instruction is a call + int size; + char instruction[MAX_MNEMONIC_SIZE * 4]; +} BASIC_INSTRUCTION_INFO; + +typedef struct +{ + SCRIPTBRANCHTYPE type; + int dest; + char branchlabel[256]; +} SCRIPTBRANCH; + +typedef struct +{ + duint addr; + duint start; + duint end; + bool manual; + int depth; +} FUNCTION_LOOP_INFO; + +typedef struct +{ + duint addr; + XREFTYPE type; +} XREF_RECORD; + +typedef struct +{ + duint refcount; + XREF_RECORD* references; +} XREF_INFO; + +typedef struct SYMBOLPTR_ +{ + duint modbase; + const void* symbol; +} SYMBOLPTR; + +//Debugger functions +BRIDGE_IMPEXP const char* DbgInit(); +BRIDGE_IMPEXP void DbgExit(); +BRIDGE_IMPEXP bool DbgMemRead(duint va, void* dest, duint size); +BRIDGE_IMPEXP bool DbgMemWrite(duint va, const void* src, duint size); +BRIDGE_IMPEXP duint DbgMemGetPageSize(duint base); +BRIDGE_IMPEXP duint DbgMemFindBaseAddr(duint addr, duint* size); + +/// +/// Asynchronously execute a debugger command by adding it to the command queue. +/// Note: the command may not have completed before this call returns. Use this +/// function if you don't care when the command gets executed. +/// +/// Example: DbgCmdExec("ClearLog") +/// +/// The command to execute. +/// True if the command was successfully submitted to the command queue. False if the submission failed. +BRIDGE_IMPEXP bool DbgCmdExec(const char* cmd); + +/// +/// Performs synchronous execution of a debugger command. This function call only +/// returns after the command has completed. +/// +/// Example: DbgCmdExecDirect("loadlib advapi32.dll") +/// +/// The command to execute. +/// True if the command executed successfully, False if there was a problem. +BRIDGE_IMPEXP bool DbgCmdExecDirect(const char* cmd); +BRIDGE_IMPEXP bool DbgMemMap(MEMMAP* memmap); +BRIDGE_IMPEXP bool DbgIsValidExpression(const char* expression); +BRIDGE_IMPEXP bool DbgIsDebugging(); +BRIDGE_IMPEXP bool DbgIsJumpGoingToExecute(duint addr); +BRIDGE_IMPEXP bool DbgGetLabelAt(duint addr, SEGMENTREG segment, char* text); +BRIDGE_IMPEXP bool DbgSetLabelAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearLabelRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetCommentAt(duint addr, char* text); +BRIDGE_IMPEXP bool DbgSetCommentAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearCommentRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetBookmarkAt(duint addr); +BRIDGE_IMPEXP bool DbgSetBookmarkAt(duint addr, bool isbookmark); +BRIDGE_IMPEXP void DbgClearBookmarkRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetModuleAt(duint addr, char* text); +BRIDGE_IMPEXP BPXTYPE DbgGetBpxTypeAt(duint addr); +BRIDGE_IMPEXP duint DbgValFromString(const char* string); +BRIDGE_IMPEXP bool DbgGetRegDumpEx(REGDUMP* regdump, size_t size); +BRIDGE_IMPEXP bool DbgValToString(const char* string, duint value); +BRIDGE_IMPEXP bool DbgMemIsValidReadPtr(duint addr); +BRIDGE_IMPEXP int DbgGetBpList(BPXTYPE type, BPMAP* list); +BRIDGE_IMPEXP FUNCTYPE DbgGetFunctionTypeAt(duint addr); +BRIDGE_IMPEXP LOOPTYPE DbgGetLoopTypeAt(duint addr, int depth); +BRIDGE_IMPEXP duint DbgGetBranchDestination(duint addr); +BRIDGE_IMPEXP void DbgScriptLoad(const char* filename); +BRIDGE_IMPEXP void DbgScriptUnload(); +BRIDGE_IMPEXP void DbgScriptRun(int destline); +BRIDGE_IMPEXP void DbgScriptStep(); +BRIDGE_IMPEXP bool DbgScriptBpToggle(int line); +BRIDGE_IMPEXP bool DbgScriptBpGet(int line); +BRIDGE_IMPEXP bool DbgScriptCmdExec(const char* command); +BRIDGE_IMPEXP void DbgScriptAbort(); +BRIDGE_IMPEXP SCRIPTLINETYPE DbgScriptGetLineType(int line); +BRIDGE_IMPEXP void DbgScriptSetIp(int line); +BRIDGE_IMPEXP bool DbgScriptGetBranchInfo(int line, SCRIPTBRANCH* info); +BRIDGE_IMPEXP void DbgSymbolEnum(duint base, CBSYMBOLENUM cbSymbolEnum, void* user); +BRIDGE_IMPEXP void DbgSymbolEnumFromCache(duint base, CBSYMBOLENUM cbSymbolEnum, void* user); +BRIDGE_IMPEXP bool DbgAssembleAt(duint addr, const char* instruction); +BRIDGE_IMPEXP duint DbgModBaseFromName(const char* name); +BRIDGE_IMPEXP void DbgDisasmAt(duint addr, DISASM_INSTR* instr); +BRIDGE_IMPEXP bool DbgStackCommentGet(duint addr, STACK_COMMENT* comment); +BRIDGE_IMPEXP void DbgGetThreadList(THREADLIST* list); +BRIDGE_IMPEXP void DbgSettingsUpdated(); +BRIDGE_IMPEXP void DbgDisasmFastAt(duint addr, BASIC_INSTRUCTION_INFO* basicinfo); +BRIDGE_IMPEXP void DbgMenuEntryClicked(int hEntry); +BRIDGE_IMPEXP bool DbgFunctionGet(duint addr, duint* start, duint* end); +BRIDGE_IMPEXP bool DbgFunctionOverlaps(duint start, duint end); +BRIDGE_IMPEXP bool DbgFunctionAdd(duint start, duint end); +BRIDGE_IMPEXP bool DbgFunctionDel(duint addr); +BRIDGE_IMPEXP bool DbgArgumentGet(duint addr, duint* start, duint* end); +BRIDGE_IMPEXP bool DbgArgumentOverlaps(duint start, duint end); +BRIDGE_IMPEXP bool DbgArgumentAdd(duint start, duint end); +BRIDGE_IMPEXP bool DbgArgumentDel(duint addr); +BRIDGE_IMPEXP bool DbgLoopGet(int depth, duint addr, duint* start, duint* end); +BRIDGE_IMPEXP bool DbgLoopOverlaps(int depth, duint start, duint end); +BRIDGE_IMPEXP bool DbgLoopAdd(duint start, duint end); +BRIDGE_IMPEXP bool DbgLoopDel(int depth, duint addr); +BRIDGE_IMPEXP bool DbgXrefAdd(duint addr, duint from); +BRIDGE_IMPEXP bool DbgXrefDelAll(duint addr); +BRIDGE_IMPEXP bool DbgXrefGet(duint addr, XREF_INFO* info); +BRIDGE_IMPEXP size_t DbgGetXrefCountAt(duint addr); +BRIDGE_IMPEXP XREFTYPE DbgGetXrefTypeAt(duint addr); +BRIDGE_IMPEXP bool DbgIsRunLocked(); +BRIDGE_IMPEXP bool DbgIsBpDisabled(duint addr); +BRIDGE_IMPEXP bool DbgSetAutoCommentAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearAutoCommentRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgSetAutoLabelAt(duint addr, const char* text); +BRIDGE_IMPEXP void DbgClearAutoLabelRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgSetAutoBookmarkAt(duint addr); +BRIDGE_IMPEXP void DbgClearAutoBookmarkRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgSetAutoFunctionAt(duint start, duint end); +BRIDGE_IMPEXP void DbgClearAutoFunctionRange(duint start, duint end); +BRIDGE_IMPEXP bool DbgGetStringAt(duint addr, char* text); +BRIDGE_IMPEXP const DBGFUNCTIONS* DbgFunctions(); +BRIDGE_IMPEXP bool DbgWinEvent(MSG* message, long* result); +BRIDGE_IMPEXP bool DbgWinEventGlobal(MSG* message); +BRIDGE_IMPEXP bool DbgIsRunning(); +BRIDGE_IMPEXP duint DbgGetTimeWastedCounter(); +BRIDGE_IMPEXP ARGTYPE DbgGetArgTypeAt(duint addr); +BRIDGE_IMPEXP void* DbgGetEncodeTypeBuffer(duint addr, duint* size); +BRIDGE_IMPEXP void DbgReleaseEncodeTypeBuffer(void* buffer); +BRIDGE_IMPEXP ENCODETYPE DbgGetEncodeTypeAt(duint addr, duint size); +BRIDGE_IMPEXP duint DbgGetEncodeSizeAt(duint addr, duint codesize); +BRIDGE_IMPEXP bool DbgSetEncodeType(duint addr, duint size, ENCODETYPE type); +BRIDGE_IMPEXP void DbgDelEncodeTypeRange(duint start, duint end); +BRIDGE_IMPEXP void DbgDelEncodeTypeSegment(duint start); +BRIDGE_IMPEXP bool DbgGetWatchList(ListOf(WATCHINFO) list); +BRIDGE_IMPEXP void DbgSelChanged(int hWindow, duint VA); +BRIDGE_IMPEXP HANDLE DbgGetProcessHandle(); +BRIDGE_IMPEXP HANDLE DbgGetThreadHandle(); +BRIDGE_IMPEXP DWORD DbgGetProcessId(); +BRIDGE_IMPEXP DWORD DbgGetThreadId(); +BRIDGE_IMPEXP duint DbgGetPebAddress(DWORD ProcessId); +BRIDGE_IMPEXP duint DbgGetTebAddress(DWORD ThreadId); +BRIDGE_IMPEXP bool DbgAnalyzeFunction(duint entry, BridgeCFGraphList* graph); +BRIDGE_IMPEXP duint DbgEval(const char* expression, bool* DEFAULT_PARAM(success, nullptr)); +BRIDGE_IMPEXP void DbgGetSymbolInfo(const SYMBOLPTR* symbolptr, SYMBOLINFO* info); +BRIDGE_IMPEXP DEBUG_ENGINE DbgGetDebugEngine(); + +//Gui defines +typedef enum +{ + GUI_PLUGIN_MENU, + GUI_DISASM_MENU, + GUI_DUMP_MENU, + GUI_STACK_MENU, + GUI_GRAPH_MENU, + GUI_MEMMAP_MENU, + GUI_SYMMOD_MENU, +} GUIMENUTYPE; + +BRIDGE_IMPEXP void DbgMenuPrepare(GUIMENUTYPE hMenu); + +typedef enum +{ + GUI_DISASSEMBLY, + GUI_DUMP, + GUI_STACK, + GUI_GRAPH, + GUI_MEMMAP, + GUI_SYMMOD, +} GUISELECTIONTYPE; + +#define GUI_MAX_LINE_SIZE 65536 +#define GUI_MAX_DISASSEMBLY_SIZE 2048 + +//Gui enums +typedef enum +{ + GUI_DISASSEMBLE_AT, // param1=(duint)va, param2=(duint)cip + GUI_SET_DEBUG_STATE, // param1=(DBGSTATE)state, param2=unused + GUI_ADD_MSG_TO_LOG, // param1=(const char*)msg, param2=unused + GUI_CLEAR_LOG, // param1=unused, param2=unused + GUI_UPDATE_REGISTER_VIEW, // param1=unused, param2=unused + GUI_UPDATE_DISASSEMBLY_VIEW, // param1=unused, param2=unused + GUI_UPDATE_BREAKPOINTS_VIEW, // param1=unused, param2=unused + GUI_UPDATE_WINDOW_TITLE, // param1=(const char*)file, param2=unused + GUI_GET_WINDOW_HANDLE, // param1=unused, param2=unused + GUI_DUMP_AT, // param1=(duint)va param2=unused + GUI_SCRIPT_ADD, // param1=int count, param2=const char** lines + GUI_SCRIPT_CLEAR, // param1=unused, param2=unused + GUI_SCRIPT_SETIP, // param1=int line, param2=unused + GUI_SCRIPT_ERROR, // param1=int line, param2=const char* message + GUI_SCRIPT_SETTITLE, // param1=const char* title, param2=unused + GUI_SCRIPT_SETINFOLINE, // param1=int line, param2=const char* info + GUI_SCRIPT_MESSAGE, // param1=const char* message, param2=unused + GUI_SCRIPT_MSGYN, // param1=const char* message, param2=unused + GUI_SYMBOL_LOG_ADD, // param1(const char*)msg, param2=unused + GUI_SYMBOL_LOG_CLEAR, // param1=unused, param2=unused + GUI_SYMBOL_SET_PROGRESS, // param1=int percent param2=unused + GUI_SYMBOL_UPDATE_MODULE_LIST, // param1=int count, param2=SYMBOLMODULEINFO* modules + GUI_REF_ADDCOLUMN, // param1=int width, param2=(const char*)title + GUI_REF_SETROWCOUNT, // param1=int rows, param2=unused + GUI_REF_GETROWCOUNT, // param1=unused, param2=unused + GUI_REF_DELETEALLCOLUMNS, // param1=unused, param2=unused + GUI_REF_SETCELLCONTENT, // param1=(CELLINFO*)info, param2=unused + GUI_REF_GETCELLCONTENT, // param1=int row, param2=int col + GUI_REF_RELOADDATA, // param1=unused, param2=unused + GUI_REF_SETSINGLESELECTION, // param1=int index, param2=bool scroll + GUI_REF_SETPROGRESS, // param1=int progress, param2=unused + GUI_REF_SETCURRENTTASKPROGRESS, // param1=int progress, param2=const char* taskTitle + GUI_REF_SETSEARCHSTARTCOL, // param1=int col param2=unused + GUI_STACK_DUMP_AT, // param1=duint addr, param2=duint csp + GUI_UPDATE_DUMP_VIEW, // param1=unused, param2=unused + GUI_UPDATE_THREAD_VIEW, // param1=unused, param2=unused + GUI_ADD_RECENT_FILE, // param1=(const char*)file, param2=unused + GUI_SET_LAST_EXCEPTION, // param1=unsigned int code, param2=unused + GUI_GET_DISASSEMBLY, // param1=duint addr, param2=char* text + GUI_MENU_ADD, // param1=int hMenu, param2=const char* title + GUI_MENU_ADD_ENTRY, // param1=int hMenu, param2=const char* title + GUI_MENU_ADD_SEPARATOR, // param1=int hMenu, param2=unused + GUI_MENU_CLEAR, // param1=int hMenu, param2=unused + GUI_SELECTION_GET, // param1=GUISELECTIONTYPE, param2=SELECTIONDATA* selection + GUI_SELECTION_SET, // param1=GUISELECTIONTYPE, param2=const SELECTIONDATA* selection + GUI_GETLINE_WINDOW, // param1=const char* title, param2=char* text + GUI_AUTOCOMPLETE_ADDCMD, // param1=const char* cmd, param2=ununsed + GUI_AUTOCOMPLETE_DELCMD, // param1=const char* cmd, param2=ununsed + GUI_AUTOCOMPLETE_CLEARALL, // param1=unused, param2=unused + GUI_SCRIPT_ENABLEHIGHLIGHTING, // param1=bool enable, param2=unused + GUI_ADD_MSG_TO_STATUSBAR, // param1=const char* msg, param2=unused + GUI_UPDATE_SIDEBAR, // param1=unused, param2=unused + GUI_REPAINT_TABLE_VIEW, // param1=unused, param2=unused + GUI_UPDATE_PATCHES, // param1=unused, param2=unused + GUI_UPDATE_CALLSTACK, // param1=unused, param2=unused + GUI_UPDATE_SEHCHAIN, // param1=unused, param2=unused + GUI_SYMBOL_REFRESH_CURRENT, // param1=unused, param2=unused + GUI_UPDATE_MEMORY_VIEW, // param1=unused, param2=unused + GUI_REF_INITIALIZE, // param1=const char* name, param2=unused + GUI_LOAD_SOURCE_FILE, // param1=const char* path, param2=duint addr + GUI_MENU_SET_ICON, // param1=int hMenu, param2=ICONINFO* + GUI_MENU_SET_ENTRY_ICON, // param1=int hEntry, param2=ICONINFO* + GUI_SHOW_CPU, // param1=unused, param2=unused + GUI_ADD_QWIDGET_TAB, // param1=QWidget*, param2=unused + GUI_SHOW_QWIDGET_TAB, // param1=QWidget*, param2=unused + GUI_CLOSE_QWIDGET_TAB, // param1=QWidget*, param2=unused + GUI_EXECUTE_ON_GUI_THREAD, // param1=GUICALLBACKEX cb, param2=void* userdata + GUI_UPDATE_TIME_WASTED_COUNTER, // param1=unused, param2=unused + GUI_SET_GLOBAL_NOTES, // param1=const char* text, param2=unused + GUI_GET_GLOBAL_NOTES, // param1=char** text, param2=unused + GUI_SET_DEBUGGEE_NOTES, // param1=const char* text, param2=unused + GUI_GET_DEBUGGEE_NOTES, // param1=char** text, param2=unused + GUI_DUMP_AT_N, // param1=int index, param2=duint va + GUI_DISPLAY_WARNING, // param1=const char *text, param2=unused + GUI_REGISTER_SCRIPT_LANG, // param1=SCRIPTTYPEINFO* info, param2=unused + GUI_UNREGISTER_SCRIPT_LANG, // param1=int id, param2=unused + GUI_UPDATE_ARGUMENT_VIEW, // param1=unused, param2=unused + GUI_FOCUS_VIEW, // param1=int hWindow, param2=unused + GUI_UPDATE_WATCH_VIEW, // param1=unused, param2=unused + GUI_LOAD_GRAPH, // param1=BridgeCFGraphList* param2=unused + GUI_GRAPH_AT, // param1=duint addr param2=unused + GUI_UPDATE_GRAPH_VIEW, // param1=unused, param2=unused + GUI_SET_LOG_ENABLED, // param1=bool isEnabled param2=unused + GUI_ADD_FAVOURITE_TOOL, // param1=const char* name param2=const char* description + GUI_ADD_FAVOURITE_COMMAND, // param1=const char* command param2=const char* shortcut + GUI_SET_FAVOURITE_TOOL_SHORTCUT,// param1=const char* name param2=const char* shortcut + GUI_FOLD_DISASSEMBLY, // param1=duint startAddress param2=duint length + GUI_SELECT_IN_MEMORY_MAP, // param1=duint addr, param2=unused + GUI_GET_ACTIVE_VIEW, // param1=ACTIVEVIEW*, param2=unused + GUI_MENU_SET_ENTRY_CHECKED, // param1=int hEntry, param2=bool checked + GUI_ADD_INFO_LINE, // param1=const char* infoline, param2=unused + GUI_PROCESS_EVENTS, // param1=unused, param2=unused + GUI_TYPE_ADDNODE, // param1=void* parent, param2=TYPEDESCRIPTOR* type + GUI_TYPE_CLEAR, // param1=unused, param2=unused + GUI_UPDATE_TYPE_WIDGET, // param1=unused, param2=unused + GUI_CLOSE_APPLICATION, // param1=unused, param2=unused + GUI_MENU_SET_VISIBLE, // param1=int hMenu, param2=bool visible + GUI_MENU_SET_ENTRY_VISIBLE, // param1=int hEntry, param2=bool visible + GUI_MENU_SET_NAME, // param1=int hMenu, param2=const char* name + GUI_MENU_SET_ENTRY_NAME, // param1=int hEntry, param2=const char* name + GUI_FLUSH_LOG, // param1=unused, param2=unused + GUI_MENU_SET_ENTRY_HOTKEY, // param1=int hEntry, param2=const char* hack + GUI_REF_SEARCH_GETROWCOUNT, // param1=unused, param2=unused + GUI_REF_SEARCH_GETCELLCONTENT, // param1=int row, param2=int col + GUI_MENU_REMOVE, // param1=int hEntryMenu, param2=unused + GUI_REF_ADDCOMMAND, // param1=const char* title, param2=const char* command + GUI_OPEN_TRACE_FILE, // param1=const char* file name,param2=unused + GUI_UPDATE_TRACE_BROWSER, // param1=unused, param2=unused + GUI_INVALIDATE_SYMBOL_SOURCE, // param1=duint base, param2=unused + GUI_GET_CURRENT_GRAPH, // param1=BridgeCFGraphList*, param2=unused + GUI_SHOW_REF, // param1=unused, param2=unused +} GUIMSG; + +//GUI Typedefs +struct _TYPEDESCRIPTOR; + +typedef void (*GUICALLBACK)(); +typedef void (*GUICALLBACKEX)(void*); +typedef bool (*GUISCRIPTEXECUTE)(const char* text); +typedef void (*GUISCRIPTCOMPLETER)(const char* text, char** entries, int* entryCount); +typedef bool (*TYPETOSTRING)(const struct _TYPEDESCRIPTOR* type, char* dest, size_t* destCount); //don't change destCount for final failure + +//GUI structures +typedef struct +{ + int row; + int col; + const char* str; +} CELLINFO; + +typedef struct +{ + duint start; + duint end; +} SELECTIONDATA; + +typedef struct +{ + const void* data; + duint size; +} ICONDATA; + +typedef struct +{ + char name[64]; + int id; + GUISCRIPTEXECUTE execute; + GUISCRIPTCOMPLETER completeCommand; +} SCRIPTTYPEINFO; + +typedef struct +{ + void* titleHwnd; + void* classHwnd; + char title[MAX_STRING_SIZE]; + char className[MAX_STRING_SIZE]; +} ACTIVEVIEW; + +typedef struct _TYPEDESCRIPTOR +{ + bool expanded; //is the type node expanded? + bool reverse; //big endian? + const char* name; //type name (int b) + duint addr; //virtual address + duint offset; //offset to addr for the actual location + int id; //type id + int size; //sizeof(type) + TYPETOSTRING callback; //convert to string + void* userdata; //user data +} TYPEDESCRIPTOR; + +//GUI functions +//code page is utf8 +BRIDGE_IMPEXP const char* GuiTranslateText(const char* Source); +BRIDGE_IMPEXP void GuiDisasmAt(duint addr, duint cip); +BRIDGE_IMPEXP void GuiSetDebugState(DBGSTATE state); +BRIDGE_IMPEXP void GuiSetDebugStateFast(DBGSTATE state); +BRIDGE_IMPEXP void GuiAddLogMessage(const char* msg); +BRIDGE_IMPEXP void GuiLogClear(); +BRIDGE_IMPEXP void GuiUpdateAllViews(); +BRIDGE_IMPEXP void GuiUpdateRegisterView(); +BRIDGE_IMPEXP void GuiUpdateDisassemblyView(); +BRIDGE_IMPEXP void GuiUpdateBreakpointsView(); +BRIDGE_IMPEXP void GuiUpdateWindowTitle(const char* filename); +BRIDGE_IMPEXP HWND GuiGetWindowHandle(); +BRIDGE_IMPEXP void GuiDumpAt(duint va); +BRIDGE_IMPEXP void GuiScriptAdd(int count, const char** lines); +BRIDGE_IMPEXP void GuiScriptClear(); +BRIDGE_IMPEXP void GuiScriptSetIp(int line); +BRIDGE_IMPEXP void GuiScriptError(int line, const char* message); +BRIDGE_IMPEXP void GuiScriptSetTitle(const char* title); +BRIDGE_IMPEXP void GuiScriptSetInfoLine(int line, const char* info); +BRIDGE_IMPEXP void GuiScriptMessage(const char* message); +BRIDGE_IMPEXP int GuiScriptMsgyn(const char* message); +BRIDGE_IMPEXP void GuiScriptEnableHighlighting(bool enable); +BRIDGE_IMPEXP void GuiSymbolLogAdd(const char* message); +BRIDGE_IMPEXP void GuiSymbolLogClear(); +BRIDGE_IMPEXP void GuiSymbolSetProgress(int percent); +BRIDGE_IMPEXP void GuiSymbolUpdateModuleList(int count, SYMBOLMODULEINFO* modules); +BRIDGE_IMPEXP void GuiSymbolRefreshCurrent(); +BRIDGE_IMPEXP void GuiReferenceAddColumn(int width, const char* title); +BRIDGE_IMPEXP void GuiReferenceSetRowCount(int count); +BRIDGE_IMPEXP int GuiReferenceGetRowCount(); +BRIDGE_IMPEXP int GuiReferenceSearchGetRowCount(); +BRIDGE_IMPEXP void GuiReferenceDeleteAllColumns(); +BRIDGE_IMPEXP void GuiReferenceInitialize(const char* name); +BRIDGE_IMPEXP void GuiReferenceSetCellContent(int row, int col, const char* str); +BRIDGE_IMPEXP char* GuiReferenceGetCellContent(int row, int col); +BRIDGE_IMPEXP char* GuiReferenceSearchGetCellContent(int row, int col); +BRIDGE_IMPEXP void GuiReferenceReloadData(); +BRIDGE_IMPEXP void GuiReferenceSetSingleSelection(int index, bool scroll); +BRIDGE_IMPEXP void GuiReferenceSetProgress(int progress); +BRIDGE_IMPEXP void GuiReferenceSetCurrentTaskProgress(int progress, const char* taskTitle); +BRIDGE_IMPEXP void GuiReferenceSetSearchStartCol(int col); +BRIDGE_IMPEXP void GuiStackDumpAt(duint addr, duint csp); +BRIDGE_IMPEXP void GuiUpdateDumpView(); +BRIDGE_IMPEXP void GuiUpdateWatchView(); +BRIDGE_IMPEXP void GuiUpdateThreadView(); +BRIDGE_IMPEXP void GuiUpdateMemoryView(); +BRIDGE_IMPEXP void GuiAddRecentFile(const char* file); +BRIDGE_IMPEXP void GuiSetLastException(unsigned int exception); +BRIDGE_IMPEXP bool GuiGetDisassembly(duint addr, char* text); +BRIDGE_IMPEXP int GuiMenuAdd(int hMenu, const char* title); +BRIDGE_IMPEXP int GuiMenuAddEntry(int hMenu, const char* title); +BRIDGE_IMPEXP void GuiMenuAddSeparator(int hMenu); +BRIDGE_IMPEXP void GuiMenuClear(int hMenu); +BRIDGE_IMPEXP void GuiMenuRemove(int hEntryMenu); +BRIDGE_IMPEXP bool GuiSelectionGet(GUISELECTIONTYPE hWindow, SELECTIONDATA* selection); +BRIDGE_IMPEXP bool GuiSelectionSet(GUISELECTIONTYPE hWindow, const SELECTIONDATA* selection); +BRIDGE_IMPEXP bool GuiGetLineWindow(const char* title, char* text); +BRIDGE_IMPEXP void GuiAutoCompleteAddCmd(const char* cmd); +BRIDGE_IMPEXP void GuiAutoCompleteDelCmd(const char* cmd); +BRIDGE_IMPEXP void GuiAutoCompleteClearAll(); +BRIDGE_IMPEXP void GuiAddStatusBarMessage(const char* msg); +BRIDGE_IMPEXP void GuiUpdateSideBar(); +BRIDGE_IMPEXP void GuiRepaintTableView(); +BRIDGE_IMPEXP void GuiUpdatePatches(); +BRIDGE_IMPEXP void GuiUpdateCallStack(); +BRIDGE_IMPEXP void GuiUpdateSEHChain(); +BRIDGE_IMPEXP void GuiLoadSourceFileEx(const char* path, duint addr); +BRIDGE_IMPEXP void GuiMenuSetIcon(int hMenu, const ICONDATA* icon); +BRIDGE_IMPEXP void GuiMenuSetEntryIcon(int hEntry, const ICONDATA* icon); +BRIDGE_IMPEXP void GuiMenuSetEntryChecked(int hEntry, bool checked); +BRIDGE_IMPEXP void GuiMenuSetVisible(int hMenu, bool visible); +BRIDGE_IMPEXP void GuiMenuSetEntryVisible(int hEntry, bool visible); +BRIDGE_IMPEXP void GuiMenuSetName(int hMenu, const char* name); +BRIDGE_IMPEXP void GuiMenuSetEntryName(int hEntry, const char* name); +BRIDGE_IMPEXP void GuiMenuSetEntryHotkey(int hEntry, const char* hack); +BRIDGE_IMPEXP void GuiShowCpu(); +BRIDGE_IMPEXP void GuiAddQWidgetTab(void* qWidget); +BRIDGE_IMPEXP void GuiShowQWidgetTab(void* qWidget); +BRIDGE_IMPEXP void GuiCloseQWidgetTab(void* qWidget); +BRIDGE_IMPEXP void GuiExecuteOnGuiThread(GUICALLBACK cbGuiThread); +BRIDGE_IMPEXP void GuiUpdateTimeWastedCounter(); +BRIDGE_IMPEXP void GuiSetGlobalNotes(const char* text); +BRIDGE_IMPEXP void GuiGetGlobalNotes(char** text); +BRIDGE_IMPEXP void GuiSetDebuggeeNotes(const char* text); +BRIDGE_IMPEXP void GuiGetDebuggeeNotes(char** text); +BRIDGE_IMPEXP void GuiDumpAtN(duint va, int index); +BRIDGE_IMPEXP void GuiDisplayWarning(const char* title, const char* text); +BRIDGE_IMPEXP void GuiRegisterScriptLanguage(SCRIPTTYPEINFO* info); +BRIDGE_IMPEXP void GuiUnregisterScriptLanguage(int id); +BRIDGE_IMPEXP void GuiUpdateArgumentWidget(); +BRIDGE_IMPEXP void GuiFocusView(int hWindow); +BRIDGE_IMPEXP bool GuiIsUpdateDisabled(); +BRIDGE_IMPEXP void GuiUpdateEnable(bool updateNow); +BRIDGE_IMPEXP void GuiUpdateDisable(); +BRIDGE_IMPEXP bool GuiLoadGraph(BridgeCFGraphList* graph, duint addr); +BRIDGE_IMPEXP duint GuiGraphAt(duint addr); +BRIDGE_IMPEXP void GuiUpdateGraphView(); +BRIDGE_IMPEXP void GuiDisableLog(); +BRIDGE_IMPEXP void GuiEnableLog(); +BRIDGE_IMPEXP void GuiAddFavouriteTool(const char* name, const char* description); +BRIDGE_IMPEXP void GuiAddFavouriteCommand(const char* name, const char* shortcut); +BRIDGE_IMPEXP void GuiSetFavouriteToolShortcut(const char* name, const char* shortcut); +BRIDGE_IMPEXP void GuiFoldDisassembly(duint startAddress, duint length); +BRIDGE_IMPEXP void GuiSelectInMemoryMap(duint addr); +BRIDGE_IMPEXP void GuiGetActiveView(ACTIVEVIEW* activeView); +BRIDGE_IMPEXP void GuiAddInfoLine(const char* infoLine); +BRIDGE_IMPEXP void GuiProcessEvents(); +BRIDGE_IMPEXP void* GuiTypeAddNode(void* parent, const TYPEDESCRIPTOR* type); +BRIDGE_IMPEXP bool GuiTypeClear(); +BRIDGE_IMPEXP void GuiUpdateTypeWidget(); +BRIDGE_IMPEXP void GuiCloseApplication(); +BRIDGE_IMPEXP void GuiFlushLog(); +BRIDGE_IMPEXP void GuiReferenceAddCommand(const char* title, const char* command); +BRIDGE_IMPEXP void GuiUpdateTraceBrowser(); +BRIDGE_IMPEXP void GuiOpenTraceFile(const char* fileName); +BRIDGE_IMPEXP void GuiInvalidateSymbolSource(duint base); +BRIDGE_IMPEXP void GuiExecuteOnGuiThreadEx(GUICALLBACKEX cbGuiThread, void* userdata); +BRIDGE_IMPEXP void GuiGetCurrentGraph(BridgeCFGraphList* graphList); +BRIDGE_IMPEXP void GuiShowReferences(); + +#ifdef __cplusplus +} +#endif + +#pragma pack(pop) + +#endif // _BRIDGEMAIN_H_ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp.h b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp.h new file mode 100644 index 0000000..53c634a --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp.h @@ -0,0 +1,4677 @@ +#ifndef _DBGHELP_ +#define _DBGHELP_ + + +// As a general principal always call the 64 bit version +// of every API, if a choice exists. The 64 bit version +// works great on 32 bit platforms, and is forward +// compatible to 64 bit platforms. + +#ifdef _WIN64 +#ifndef _IMAGEHLP64 +#define _IMAGEHLP64 +#endif +#endif + +#pragma pack(push,8) + +// For those without specstrings.h +// Since there are different versions of this header, I need to +// individually test each item and define it if it is not around. + +#ifndef __in +#define __in +#endif +#ifndef __out +#define __out +#endif +#ifndef __inout +#define __inout +#endif +#ifndef __in_opt +#define __in_opt +#endif +#ifndef __out_opt +#define __out_opt +#endif +#ifndef __inout_opt +#define __inout_opt +#endif +#ifndef __in_ecount +#define __in_ecount(x) +#endif +#ifndef __out_ecount +#define __out_ecount(x) +#endif +#ifndef __inout_ecount +#define __inout_ecount(x) +#endif +#ifndef __in_bcount +#define __in_bcount(x) +#endif +#ifndef __out_bcount +#define __out_bcount(x) +#endif +#ifndef __inout_bcount +#define __inout_bcount(x) +#endif +#ifndef __out_xcount +#define __out_xcount(x) +#endif +#ifndef __deref_opt_out +#define __deref_opt_out +#endif +#ifndef __deref_out +#define __deref_out +#endif +#ifndef __out_ecount_opt +#define __out_ecount_opt(x) +#endif +#ifndef __in_bcount_opt +#define __in_bcount_opt(x) +#endif +#ifndef __out_bcount_opt +#define __out_bcount_opt(x) +#endif +#ifndef __deref_out_opt +#define __deref_out_opt +#endif + + +#ifdef __cplusplus +extern "C" { +#endif + +#ifdef _IMAGEHLP_SOURCE_ +#define IMAGEAPI __stdcall +#define DBHLP_DEPRECIATED +#else +#define IMAGEAPI DECLSPEC_IMPORT __stdcall +#if (_MSC_VER >= 1300) && !defined(MIDL_PASS) +#define DBHLP_DEPRECIATED __declspec(deprecated) +#else +#define DBHLP_DEPRECIATED +#endif +#endif + +#define DBHLPAPI IMAGEAPI + +#define IMAGE_SEPARATION (64*1024) + +// Observant readers may notice that 2 new fields, +// 'fReadOnly' and 'Version' have been added to +// the LOADED_IMAGE structure after 'fDOSImage'. +// This does not change the size of the structure +// from previous headers. That is because while +// 'fDOSImage' is a byte, it is padded by the +// compiler to 4 bytes. So the 2 new fields are +// slipped into the extra space. + +typedef struct _LOADED_IMAGE +{ + PSTR ModuleName; + HANDLE hFile; + PUCHAR MappedAddress; +#ifdef _IMAGEHLP64 + PIMAGE_NT_HEADERS64 FileHeader; +#else + PIMAGE_NT_HEADERS32 FileHeader; +#endif + PIMAGE_SECTION_HEADER LastRvaSection; + ULONG NumberOfSections; + PIMAGE_SECTION_HEADER Sections; + ULONG Characteristics; + BOOLEAN fSystemImage; + BOOLEAN fDOSImage; + BOOLEAN fReadOnly; + UCHAR Version; + LIST_ENTRY Links; + ULONG SizeOfImage; +} LOADED_IMAGE, *PLOADED_IMAGE; + +#define MAX_SYM_NAME 2000 + + +// Error codes set by dbghelp functions. Call GetLastError +// to see them. +// Dbghelp also sets error codes found in winerror.h + +#define ERROR_IMAGE_NOT_STRIPPED 0x8800 // the image is not stripped. No dbg file available. +#define ERROR_NO_DBG_POINTER 0x8801 // image is stripped but there is no pointer to a dbg file +#define ERROR_NO_PDB_POINTER 0x8802 // image does not point to a pdb file + +typedef BOOL +(CALLBACK* PFIND_DEBUG_FILE_CALLBACK)( + __in HANDLE FileHandle, + __in PCSTR FileName, + __in PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindDebugInfoFile( + __in HANDLE hProcess, + __in PCSTR FileName, + __out_ecount(MAX_PATH + 1) PSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACK Callback, + __in_opt PVOID CallerData +); + +typedef BOOL +(CALLBACK* PFIND_DEBUG_FILE_CALLBACKW)( + __in HANDLE FileHandle, + __in PCWSTR FileName, + __in PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindDebugInfoFileW( + __in HANDLE hProcess, + __in PCWSTR FileName, + __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +FindDebugInfoFile( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR DebugFilePath +); + +HANDLE +IMAGEAPI +FindDebugInfoFileEx( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACK Callback, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +FindDebugInfoFileExW( + __in PCWSTR FileName, + __in PCWSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PWSTR DebugFilePath, + __in_opt PFIND_DEBUG_FILE_CALLBACKW Callback, + __in_opt PVOID CallerData +); + +typedef BOOL +(CALLBACK* PFINDFILEINPATHCALLBACK)( + __in PCSTR filename, + __in PVOID context +); + +BOOL +IMAGEAPI +SymFindFileInPath( + __in HANDLE hprocess, + __in_opt PCSTR SearchPath, + __in PCSTR FileName, + __in_opt PVOID id, + __in DWORD two, + __in DWORD three, + __in DWORD flags, + __out_ecount(MAX_PATH + 1) PSTR FoundFile, + __in_opt PFINDFILEINPATHCALLBACK callback, + __in_opt PVOID context +); + +typedef BOOL +(CALLBACK* PFINDFILEINPATHCALLBACKW)( + __in PCWSTR filename, + __in PVOID context +); + +BOOL +IMAGEAPI +SymFindFileInPathW( + __in HANDLE hprocess, + __in_opt PCWSTR SearchPath, + __in PCWSTR FileName, + __in_opt PVOID id, + __in DWORD two, + __in DWORD three, + __in DWORD flags, + __out_ecount(MAX_PATH + 1) PWSTR FoundFile, + __in_opt PFINDFILEINPATHCALLBACKW callback, + __in_opt PVOID context +); + +typedef BOOL +(CALLBACK* PFIND_EXE_FILE_CALLBACK)( + __in HANDLE FileHandle, + __in PCSTR FileName, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindExecutableImage( + __in HANDLE hProcess, + __in PCSTR FileName, + __out_ecount(MAX_PATH + 1) PSTR ImageFilePath, + __in PFIND_EXE_FILE_CALLBACK Callback, + __in PVOID CallerData +); + +typedef BOOL +(CALLBACK* PFIND_EXE_FILE_CALLBACKW)( + __in HANDLE FileHandle, + __in PCWSTR FileName, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +SymFindExecutableImageW( + __in HANDLE hProcess, + __in PCWSTR FileName, + __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath, + __in PFIND_EXE_FILE_CALLBACKW Callback, + __in PVOID CallerData +); + +HANDLE +IMAGEAPI +FindExecutableImage( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR ImageFilePath +); + +HANDLE +IMAGEAPI +FindExecutableImageEx( + __in PCSTR FileName, + __in PCSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PSTR ImageFilePath, + __in_opt PFIND_EXE_FILE_CALLBACK Callback, + __in_opt PVOID CallerData +); + +HANDLE +IMAGEAPI +FindExecutableImageExW( + __in PCWSTR FileName, + __in PCWSTR SymbolPath, + __out_ecount(MAX_PATH + 1) PWSTR ImageFilePath, + __in_opt PFIND_EXE_FILE_CALLBACKW Callback, + __in PVOID CallerData +); + +PIMAGE_NT_HEADERS +IMAGEAPI +ImageNtHeader( + __in PVOID Base +); + +PVOID +IMAGEAPI +ImageDirectoryEntryToDataEx( + __in PVOID Base, + __in BOOLEAN MappedAsImage, + __in USHORT DirectoryEntry, + __out PULONG Size, + __out_opt PIMAGE_SECTION_HEADER* FoundHeader +); + +PVOID +IMAGEAPI +ImageDirectoryEntryToData( + __in PVOID Base, + __in BOOLEAN MappedAsImage, + __in USHORT DirectoryEntry, + __out PULONG Size +); + +PIMAGE_SECTION_HEADER +IMAGEAPI +ImageRvaToSection( + __in PIMAGE_NT_HEADERS NtHeaders, + __in PVOID Base, + __in ULONG Rva +); + +PVOID +IMAGEAPI +ImageRvaToVa( + __in PIMAGE_NT_HEADERS NtHeaders, + __in PVOID Base, + __in ULONG Rva, + __in_opt OUT PIMAGE_SECTION_HEADER* LastRvaSection +); + +#ifndef _WIN64 +// This api won't be ported to Win64 - Fix your code. + +typedef struct _IMAGE_DEBUG_INFORMATION +{ + LIST_ENTRY List; + DWORD ReservedSize; + PVOID ReservedMappedBase; + USHORT ReservedMachine; + USHORT ReservedCharacteristics; + DWORD ReservedCheckSum; + DWORD ImageBase; + DWORD SizeOfImage; + + DWORD ReservedNumberOfSections; + PIMAGE_SECTION_HEADER ReservedSections; + + DWORD ReservedExportedNamesSize; + PSTR ReservedExportedNames; + + DWORD ReservedNumberOfFunctionTableEntries; + PIMAGE_FUNCTION_ENTRY ReservedFunctionTableEntries; + DWORD ReservedLowestFunctionStartingAddress; + DWORD ReservedHighestFunctionEndingAddress; + + DWORD ReservedNumberOfFpoTableEntries; + PFPO_DATA ReservedFpoTableEntries; + + DWORD SizeOfCoffSymbols; + PIMAGE_COFF_SYMBOLS_HEADER CoffSymbols; + + DWORD ReservedSizeOfCodeViewSymbols; + PVOID ReservedCodeViewSymbols; + + PSTR ImageFilePath; + PSTR ImageFileName; + PSTR ReservedDebugFilePath; + + DWORD ReservedTimeDateStamp; + + BOOL ReservedRomImage; + PIMAGE_DEBUG_DIRECTORY ReservedDebugDirectory; + DWORD ReservedNumberOfDebugDirectories; + + DWORD ReservedOriginalFunctionTableBaseAddress; + + DWORD Reserved[ 2 ]; + +} IMAGE_DEBUG_INFORMATION, *PIMAGE_DEBUG_INFORMATION; + + +PIMAGE_DEBUG_INFORMATION +IMAGEAPI +MapDebugInformation( + __in_opt HANDLE FileHandle, + __in PCSTR FileName, + __in_opt PCSTR SymbolPath, + __in ULONG ImageBase +); + +BOOL +IMAGEAPI +UnmapDebugInformation( + __out_xcount(unknown) PIMAGE_DEBUG_INFORMATION DebugInfo +); + +#endif + +BOOL +IMAGEAPI +SearchTreeForFile( + __in PCSTR RootPath, + __in PCSTR InputPathName, + __out_ecount(MAX_PATH + 1) PSTR OutputPathBuffer +); + +BOOL +IMAGEAPI +SearchTreeForFileW( + __in PCWSTR RootPath, + __in PCWSTR InputPathName, + __out_ecount(MAX_PATH + 1) PWSTR OutputPathBuffer +); + +typedef BOOL +(CALLBACK* PENUMDIRTREE_CALLBACK)( + __in PCSTR FilePath, + __in_opt PVOID CallerData +); + +BOOL +IMAGEAPI +EnumDirTree( + __in_opt HANDLE hProcess, + __in PCSTR RootPath, + __in PCSTR InputPathName, + __out_ecount_opt(MAX_PATH + 1) PSTR OutputPathBuffer, + __in_opt PENUMDIRTREE_CALLBACK cb, + __in_opt PVOID data +); + +typedef BOOL +(CALLBACK* PENUMDIRTREE_CALLBACKW)( + __in PCWSTR FilePath, + __in_opt PVOID CallerData +); + +BOOL +IMAGEAPI +EnumDirTreeW( + __in_opt HANDLE hProcess, + __in PCWSTR RootPath, + __in PCWSTR InputPathName, + __out_ecount_opt(MAX_PATH + 1) PWSTR OutputPathBuffer, + __in_opt PENUMDIRTREE_CALLBACKW cb, + __in_opt PVOID data +); + +BOOL +IMAGEAPI +MakeSureDirectoryPathExists( + __in PCSTR DirPath +); + +// +// UnDecorateSymbolName Flags +// + +#define UNDNAME_COMPLETE (0x0000) // Enable full undecoration +#define UNDNAME_NO_LEADING_UNDERSCORES (0x0001) // Remove leading underscores from MS extended keywords +#define UNDNAME_NO_MS_KEYWORDS (0x0002) // Disable expansion of MS extended keywords +#define UNDNAME_NO_FUNCTION_RETURNS (0x0004) // Disable expansion of return type for primary declaration +#define UNDNAME_NO_ALLOCATION_MODEL (0x0008) // Disable expansion of the declaration model +#define UNDNAME_NO_ALLOCATION_LANGUAGE (0x0010) // Disable expansion of the declaration language specifier +#define UNDNAME_NO_MS_THISTYPE (0x0020) // NYI Disable expansion of MS keywords on the 'this' type for primary declaration +#define UNDNAME_NO_CV_THISTYPE (0x0040) // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration +#define UNDNAME_NO_THISTYPE (0x0060) // Disable all modifiers on the 'this' type +#define UNDNAME_NO_ACCESS_SPECIFIERS (0x0080) // Disable expansion of access specifiers for members +#define UNDNAME_NO_THROW_SIGNATURES (0x0100) // Disable expansion of 'throw-signatures' for functions and pointers to functions +#define UNDNAME_NO_MEMBER_TYPE (0x0200) // Disable expansion of 'static' or 'virtual'ness of members +#define UNDNAME_NO_RETURN_UDT_MODEL (0x0400) // Disable expansion of MS model for UDT returns +#define UNDNAME_32_BIT_DECODE (0x0800) // Undecorate 32-bit decorated names +#define UNDNAME_NAME_ONLY (0x1000) // Crack only the name for primary declaration; +// return just [scope::]name. Does expand template params +#define UNDNAME_NO_ARGUMENTS (0x2000) // Don't undecorate arguments to function +#define UNDNAME_NO_SPECIAL_SYMS (0x4000) // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc) + +DWORD +IMAGEAPI +WINAPI +UnDecorateSymbolName( + __in PCSTR name, + __out_ecount(maxStringLength) PSTR outputString, + __in DWORD maxStringLength, + __in DWORD flags +); + +DWORD +IMAGEAPI +WINAPI +UnDecorateSymbolNameW( + __in PCWSTR name, + __out_ecount(maxStringLength) PWSTR outputString, + __in DWORD maxStringLength, + __in DWORD flags +); + +// +// these values are used for synthesized file types +// that can be passed in as image headers instead of +// the standard ones from ntimage.h +// + +#define DBHHEADER_DEBUGDIRS 0x1 +#define DBHHEADER_CVMISC 0x2 +#define DBHHEADER_PDBGUID 0x3 +typedef struct _MODLOAD_DATA +{ + DWORD ssize; // size of this struct + DWORD ssig; // signature identifying the passed data + PVOID data; // pointer to passed data + DWORD size; // size of passed data + DWORD flags; // options +} MODLOAD_DATA, *PMODLOAD_DATA; + +typedef struct _MODLOAD_CVMISC +{ + DWORD oCV; // ofset to the codeview record + size_t cCV; // size of the codeview record + DWORD oMisc; // offset to the misc record + size_t cMisc; // size of the misc record + DWORD dtImage; // datetime stamp of the image + DWORD cImage; // size of the image +} MODLOAD_CVMISC, *PMODLOAD_CVMISC; + +typedef struct _MODLOAD_PDBGUID_PDBAGE +{ + GUID PdbGuid; // Pdb Guid + DWORD PdbAge; // Pdb Age +} MODLOAD_PDBGUID_PDBAGE, *PMODLOAD_PDBGUID_PDBAGE; + +// +// StackWalking API +// + +typedef enum +{ + AddrMode1616, + AddrMode1632, + AddrModeReal, + AddrModeFlat +} ADDRESS_MODE; + +typedef struct _tagADDRESS64 +{ + DWORD64 Offset; + WORD Segment; + ADDRESS_MODE Mode; +} ADDRESS64, *LPADDRESS64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define ADDRESS ADDRESS64 +#define LPADDRESS LPADDRESS64 +#else +typedef struct _tagADDRESS +{ + DWORD Offset; + WORD Segment; + ADDRESS_MODE Mode; +} ADDRESS, *LPADDRESS; + +__inline +void +Address32To64( + __in LPADDRESS a32, + __out LPADDRESS64 a64 +) +{ + a64->Offset = (ULONG64)(LONG64)(LONG)a32->Offset; + a64->Segment = a32->Segment; + a64->Mode = a32->Mode; +} + +__inline +void +Address64To32( + __in LPADDRESS64 a64, + __out LPADDRESS a32 +) +{ + a32->Offset = (ULONG)a64->Offset; + a32->Segment = a64->Segment; + a32->Mode = a64->Mode; +} +#endif + +// +// This structure is included in the STACKFRAME structure, +// and is used to trace through usermode callbacks in a thread's +// kernel stack. The values must be copied by the kernel debugger +// from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets. +// + +// +// New KDHELP structure for 64 bit system support. +// This structure is preferred in new code. +// +typedef struct _KDHELP64 +{ + + // + // address of kernel thread object, as provided in the + // WAIT_STATE_CHANGE packet. + // + DWORD64 Thread; + + // + // offset in thread object to pointer to the current callback frame + // in kernel stack. + // + DWORD ThCallbackStack; + + // + // offset in thread object to pointer to the current callback backing + // store frame in kernel stack. + // + DWORD ThCallbackBStore; + + // + // offsets to values in frame: + // + // address of next callback frame + DWORD NextCallback; + + // address of saved frame pointer (if applicable) + DWORD FramePointer; + + + // + // Address of the kernel function that calls out to user mode + // + DWORD64 KiCallUserMode; + + // + // Address of the user mode dispatcher function + // + DWORD64 KeUserCallbackDispatcher; + + // + // Lowest kernel mode address + // + DWORD64 SystemRangeStart; + + // + // Address of the user mode exception dispatcher function. + // Added in API version 10. + // + DWORD64 KiUserExceptionDispatcher; + + // + // Stack bounds, added in API version 11. + // + DWORD64 StackBase; + DWORD64 StackLimit; + + DWORD64 Reserved[5]; + +} KDHELP64, *PKDHELP64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define KDHELP KDHELP64 +#define PKDHELP PKDHELP64 +#else +typedef struct _KDHELP +{ + + // + // address of kernel thread object, as provided in the + // WAIT_STATE_CHANGE packet. + // + DWORD Thread; + + // + // offset in thread object to pointer to the current callback frame + // in kernel stack. + // + DWORD ThCallbackStack; + + // + // offsets to values in frame: + // + // address of next callback frame + DWORD NextCallback; + + // address of saved frame pointer (if applicable) + DWORD FramePointer; + + // + // Address of the kernel function that calls out to user mode + // + DWORD KiCallUserMode; + + // + // Address of the user mode dispatcher function + // + DWORD KeUserCallbackDispatcher; + + // + // Lowest kernel mode address + // + DWORD SystemRangeStart; + + // + // offset in thread object to pointer to the current callback backing + // store frame in kernel stack. + // + DWORD ThCallbackBStore; + + // + // Address of the user mode exception dispatcher function. + // Added in API version 10. + // + DWORD KiUserExceptionDispatcher; + + // + // Stack bounds, added in API version 11. + // + DWORD StackBase; + DWORD StackLimit; + + DWORD Reserved[5]; + +} KDHELP, *PKDHELP; + +__inline +void +KdHelp32To64( + __in PKDHELP p32, + __out PKDHELP64 p64 +) +{ + p64->Thread = p32->Thread; + p64->ThCallbackStack = p32->ThCallbackStack; + p64->NextCallback = p32->NextCallback; + p64->FramePointer = p32->FramePointer; + p64->KiCallUserMode = p32->KiCallUserMode; + p64->KeUserCallbackDispatcher = p32->KeUserCallbackDispatcher; + p64->SystemRangeStart = p32->SystemRangeStart; + p64->KiUserExceptionDispatcher = p32->KiUserExceptionDispatcher; + p64->StackBase = p32->StackBase; + p64->StackLimit = p32->StackLimit; +} +#endif + +typedef struct _tagSTACKFRAME64 +{ + ADDRESS64 AddrPC; // program counter + ADDRESS64 AddrReturn; // return address + ADDRESS64 AddrFrame; // frame pointer + ADDRESS64 AddrStack; // stack pointer + ADDRESS64 AddrBStore; // backing store pointer + PVOID FuncTableEntry; // pointer to pdata/fpo or NULL + DWORD64 Params[4]; // possible arguments to the function + BOOL Far; // WOW far call + BOOL Virtual; // is this a virtual frame? + DWORD64 Reserved[3]; + KDHELP64 KdHelp; +} STACKFRAME64, *LPSTACKFRAME64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define STACKFRAME STACKFRAME64 +#define LPSTACKFRAME LPSTACKFRAME64 +#else +typedef struct _tagSTACKFRAME +{ + ADDRESS AddrPC; // program counter + ADDRESS AddrReturn; // return address + ADDRESS AddrFrame; // frame pointer + ADDRESS AddrStack; // stack pointer + PVOID FuncTableEntry; // pointer to pdata/fpo or NULL + DWORD Params[4]; // possible arguments to the function + BOOL Far; // WOW far call + BOOL Virtual; // is this a virtual frame? + DWORD Reserved[3]; + KDHELP KdHelp; + ADDRESS AddrBStore; // backing store pointer +} STACKFRAME, *LPSTACKFRAME; +#endif + + +typedef +BOOL +(__stdcall* PREAD_PROCESS_MEMORY_ROUTINE64)( + __in HANDLE hProcess, + __in DWORD64 qwBaseAddress, + __out_bcount(nSize) PVOID lpBuffer, + __in DWORD nSize, + __out LPDWORD lpNumberOfBytesRead +); + +typedef +PVOID +(__stdcall* PFUNCTION_TABLE_ACCESS_ROUTINE64)( + __in HANDLE ahProcess, + __in DWORD64 AddrBase +); + +typedef +DWORD64 +(__stdcall* PGET_MODULE_BASE_ROUTINE64)( + __in HANDLE hProcess, + __in DWORD64 Address +); + +typedef +DWORD64 +(__stdcall* PTRANSLATE_ADDRESS_ROUTINE64)( + __in HANDLE hProcess, + __in HANDLE hThread, + __in LPADDRESS64 lpaddr +); + +BOOL +IMAGEAPI +StackWalk64( + __in DWORD MachineType, + __in HANDLE hProcess, + __in HANDLE hThread, + __inout LPSTACKFRAME64 StackFrame, + __inout PVOID ContextRecord, + __in_opt PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine, + __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine, + __in_opt PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine, + __in_opt PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) + +#define PREAD_PROCESS_MEMORY_ROUTINE PREAD_PROCESS_MEMORY_ROUTINE64 +#define PFUNCTION_TABLE_ACCESS_ROUTINE PFUNCTION_TABLE_ACCESS_ROUTINE64 +#define PGET_MODULE_BASE_ROUTINE PGET_MODULE_BASE_ROUTINE64 +#define PTRANSLATE_ADDRESS_ROUTINE PTRANSLATE_ADDRESS_ROUTINE64 + +#define StackWalk StackWalk64 + +#else + +typedef +BOOL +(__stdcall* PREAD_PROCESS_MEMORY_ROUTINE)( + __in HANDLE hProcess, + __in DWORD lpBaseAddress, + __out_bcount(nSize) PVOID lpBuffer, + __in DWORD nSize, + __out PDWORD lpNumberOfBytesRead +); + +typedef +PVOID +(__stdcall* PFUNCTION_TABLE_ACCESS_ROUTINE)( + __in HANDLE hProcess, + __in DWORD AddrBase +); + +typedef +DWORD +(__stdcall* PGET_MODULE_BASE_ROUTINE)( + __in HANDLE hProcess, + __in DWORD Address +); + +typedef +DWORD +(__stdcall* PTRANSLATE_ADDRESS_ROUTINE)( + __in HANDLE hProcess, + __in HANDLE hThread, + __out LPADDRESS lpaddr +); + +BOOL +IMAGEAPI +StackWalk( + DWORD MachineType, + __in HANDLE hProcess, + __in HANDLE hThread, + __inout LPSTACKFRAME StackFrame, + __inout PVOID ContextRecord, + __in_opt PREAD_PROCESS_MEMORY_ROUTINE ReadMemoryRoutine, + __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE FunctionTableAccessRoutine, + __in_opt PGET_MODULE_BASE_ROUTINE GetModuleBaseRoutine, + __in_opt PTRANSLATE_ADDRESS_ROUTINE TranslateAddress +); + +#endif + + +#define API_VERSION_NUMBER 11 + +typedef struct API_VERSION +{ + USHORT MajorVersion; + USHORT MinorVersion; + USHORT Revision; + USHORT Reserved; +} API_VERSION, *LPAPI_VERSION; + +LPAPI_VERSION +IMAGEAPI +ImagehlpApiVersion( + VOID +); + +LPAPI_VERSION +IMAGEAPI +ImagehlpApiVersionEx( + __in LPAPI_VERSION AppVersion +); + +DWORD +IMAGEAPI +GetTimestampForLoadedLibrary( + __in HMODULE Module +); + +// +// typedefs for function pointers +// +typedef BOOL +(CALLBACK* PSYM_ENUMMODULES_CALLBACK64)( + __in PCSTR ModuleName, + __in DWORD64 BaseOfDll, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMMODULES_CALLBACKW64)( + __in PCWSTR ModuleName, + __in DWORD64 BaseOfDll, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PENUMLOADED_MODULES_CALLBACK64)( + __in PCSTR ModuleName, + __in DWORD64 ModuleBase, + __in ULONG ModuleSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PENUMLOADED_MODULES_CALLBACKW64)( + __in PCWSTR ModuleName, + __in DWORD64 ModuleBase, + __in ULONG ModuleSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK64)( + __in PCSTR SymbolName, + __in DWORD64 SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK64W)( + __in PCWSTR SymbolName, + __in DWORD64 SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYMBOL_REGISTERED_CALLBACK64)( + __in HANDLE hProcess, + __in ULONG ActionCode, + __in_opt ULONG64 CallbackData, + __in_opt ULONG64 UserContext +); + +typedef +PVOID +(CALLBACK* PSYMBOL_FUNCENTRY_CALLBACK)( + __in HANDLE hProcess, + __in DWORD AddrBase, + __in_opt PVOID UserContext +); + +typedef +PVOID +(CALLBACK* PSYMBOL_FUNCENTRY_CALLBACK64)( + __in HANDLE hProcess, + __in ULONG64 AddrBase, + __in ULONG64 UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) + +#define PSYM_ENUMMODULES_CALLBACK PSYM_ENUMMODULES_CALLBACK64 +#define PSYM_ENUMSYMBOLS_CALLBACK PSYM_ENUMSYMBOLS_CALLBACK64 +#define PSYM_ENUMSYMBOLS_CALLBACKW PSYM_ENUMSYMBOLS_CALLBACK64W +#define PENUMLOADED_MODULES_CALLBACK PENUMLOADED_MODULES_CALLBACK64 +#define PSYMBOL_REGISTERED_CALLBACK PSYMBOL_REGISTERED_CALLBACK64 +#define PSYMBOL_FUNCENTRY_CALLBACK PSYMBOL_FUNCENTRY_CALLBACK64 + +#else + +typedef BOOL +(CALLBACK* PSYM_ENUMMODULES_CALLBACK)( + __in PCSTR ModuleName, + __in ULONG BaseOfDll, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACK)( + __in PCSTR SymbolName, + __in ULONG SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSYMBOLS_CALLBACKW)( + __in PCWSTR SymbolName, + __in ULONG SymbolAddress, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PENUMLOADED_MODULES_CALLBACK)( + __in PCSTR ModuleName, + __in ULONG ModuleBase, + __in ULONG ModuleSize, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYMBOL_REGISTERED_CALLBACK)( + __in HANDLE hProcess, + __in ULONG ActionCode, + __in_opt PVOID CallbackData, + __in_opt PVOID UserContext +); + +#endif + + +// values found in SYMBOL_INFO.Tag +// +// This was taken from cvconst.h and should +// not override any values found there. +// +// #define _NO_CVCONST_H_ if you don't +// have access to that file... + +#ifdef _NO_CVCONST_H + +// DIA enums + +enum SymTagEnum +{ + SymTagNull, + SymTagExe, + SymTagCompiland, + SymTagCompilandDetails, + SymTagCompilandEnv, + SymTagFunction, + SymTagBlock, + SymTagData, + SymTagAnnotation, + SymTagLabel, + SymTagPublicSymbol, + SymTagUDT, + SymTagEnum, + SymTagFunctionType, + SymTagPointerType, + SymTagArrayType, + SymTagBaseType, + SymTagTypedef, + SymTagBaseClass, + SymTagFriend, + SymTagFunctionArgType, + SymTagFuncDebugStart, + SymTagFuncDebugEnd, + SymTagUsingNamespace, + SymTagVTableShape, + SymTagVTable, + SymTagCustom, + SymTagThunk, + SymTagCustomType, + SymTagManagedType, + SymTagDimension, + SymTagMax +}; + +#endif + +// +// flags found in SYMBOL_INFO.Flags +// + +#define SYMFLAG_VALUEPRESENT 0x00000001 +#define SYMFLAG_REGISTER 0x00000008 +#define SYMFLAG_REGREL 0x00000010 +#define SYMFLAG_FRAMEREL 0x00000020 +#define SYMFLAG_PARAMETER 0x00000040 +#define SYMFLAG_LOCAL 0x00000080 +#define SYMFLAG_CONSTANT 0x00000100 +#define SYMFLAG_EXPORT 0x00000200 +#define SYMFLAG_FORWARDER 0x00000400 +#define SYMFLAG_FUNCTION 0x00000800 +#define SYMFLAG_VIRTUAL 0x00001000 +#define SYMFLAG_THUNK 0x00002000 +#define SYMFLAG_TLSREL 0x00004000 +#define SYMFLAG_SLOT 0x00008000 +#define SYMFLAG_ILREL 0x00010000 +#define SYMFLAG_METADATA 0x00020000 +#define SYMFLAG_CLR_TOKEN 0x00040000 + +// this resets SymNext/Prev to the beginning +// of the module passed in the address field + +#define SYMFLAG_RESET 0x80000000 + +// +// symbol type enumeration +// +typedef enum +{ + SymNone = 0, + SymCoff, + SymCv, + SymPdb, + SymExport, + SymDeferred, + SymSym, // .sym file + SymDia, + SymVirtual, + NumSymTypes +} SYM_TYPE; + +// +// symbol data structure +// + +typedef struct _IMAGEHLP_SYMBOL64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL64) + DWORD64 Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + CHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOL64, *PIMAGEHLP_SYMBOL64; + +typedef struct _IMAGEHLP_SYMBOL64_PACKAGE +{ + IMAGEHLP_SYMBOL64 sym; + CHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOL64_PACKAGE, *PIMAGEHLP_SYMBOL64_PACKAGE; + +typedef struct _IMAGEHLP_SYMBOLW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW64) + DWORD64 Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + WCHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOLW64, *PIMAGEHLP_SYMBOLW64; + +typedef struct _IMAGEHLP_SYMBOLW64_PACKAGE +{ + IMAGEHLP_SYMBOLW64 sym; + WCHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOLW64_PACKAGE, *PIMAGEHLP_SYMBOLW64_PACKAGE; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) + +#define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 +#define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 +#define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE +#define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE +#define IMAGEHLP_SYMBOLW IMAGEHLP_SYMBOLW64 +#define PIMAGEHLP_SYMBOLW PIMAGEHLP_SYMBOLW64 +#define IMAGEHLP_SYMBOLW_PACKAGE IMAGEHLP_SYMBOLW64_PACKAGE +#define PIMAGEHLP_SYMBOLW_PACKAGE PIMAGEHLP_SYMBOLW64_PACKAGE + +#else + +typedef struct _IMAGEHLP_SYMBOL +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOL) + DWORD Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + CHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; + +typedef struct _IMAGEHLP_SYMBOL_PACKAGE +{ + IMAGEHLP_SYMBOL sym; + CHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOL_PACKAGE, *PIMAGEHLP_SYMBOL_PACKAGE; + +typedef struct _IMAGEHLP_SYMBOLW +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_SYMBOLW) + DWORD Address; // virtual address including dll base address + DWORD Size; // estimated size of symbol, can be zero + DWORD Flags; // info about the symbols, see the SYMF defines + DWORD MaxNameLength; // maximum size of symbol name in 'Name' + WCHAR Name[1]; // symbol name (null terminated string) +} IMAGEHLP_SYMBOLW, *PIMAGEHLP_SYMBOLW; + +typedef struct _IMAGEHLP_SYMBOLW_PACKAGE +{ + IMAGEHLP_SYMBOLW sym; + WCHAR name[MAX_SYM_NAME + 1]; +} IMAGEHLP_SYMBOLW_PACKAGE, *PIMAGEHLP_SYMBOLW_PACKAGE; + +#endif + +// +// module data structure +// + +typedef struct _IMAGEHLP_MODULE64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64) + DWORD64 BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + CHAR ModuleName[32]; // module name + CHAR ImageName[256]; // image name + CHAR LoadedImageName[256]; // symbol file name + // new elements: 07-Jun-2002 + CHAR LoadedPdbName[256]; // pdb file name + DWORD CVSig; // Signature of the CV record in the debug directories + CHAR CVData[MAX_PATH * 3]; // Contents of the CV record + DWORD PdbSig; // Signature of PDB + GUID PdbSig70; // Signature of PDB (VC 7 and up) + DWORD PdbAge; // DBI age of pdb + BOOL PdbUnmatched; // loaded an unmatched pdb + BOOL DbgUnmatched; // loaded an unmatched dbg + BOOL LineNumbers; // we have line number information + BOOL GlobalSymbols; // we have internal symbol information + BOOL TypeInfo; // we have type information + // new elements: 17-Dec-2003 + BOOL SourceIndexed; // pdb supports source server + BOOL Publics; // contains public symbols +} IMAGEHLP_MODULE64, *PIMAGEHLP_MODULE64; + +typedef struct _IMAGEHLP_MODULEW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE64) + DWORD64 BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + WCHAR ModuleName[32]; // module name + WCHAR ImageName[256]; // image name + // new elements: 07-Jun-2002 + WCHAR LoadedImageName[256]; // symbol file name + WCHAR LoadedPdbName[256]; // pdb file name + DWORD CVSig; // Signature of the CV record in the debug directories + WCHAR CVData[MAX_PATH * 3]; // Contents of the CV record + DWORD PdbSig; // Signature of PDB + GUID PdbSig70; // Signature of PDB (VC 7 and up) + DWORD PdbAge; // DBI age of pdb + BOOL PdbUnmatched; // loaded an unmatched pdb + BOOL DbgUnmatched; // loaded an unmatched dbg + BOOL LineNumbers; // we have line number information + BOOL GlobalSymbols; // we have internal symbol information + BOOL TypeInfo; // we have type information + // new elements: 17-Dec-2003 + BOOL SourceIndexed; // pdb supports source server + BOOL Publics; // contains public symbols +} IMAGEHLP_MODULEW64, *PIMAGEHLP_MODULEW64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_MODULE IMAGEHLP_MODULE64 +#define PIMAGEHLP_MODULE PIMAGEHLP_MODULE64 +#define IMAGEHLP_MODULEW IMAGEHLP_MODULEW64 +#define PIMAGEHLP_MODULEW PIMAGEHLP_MODULEW64 +#else +typedef struct _IMAGEHLP_MODULE +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE) + DWORD BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + CHAR ModuleName[32]; // module name + CHAR ImageName[256]; // image name + CHAR LoadedImageName[256]; // symbol file name +} IMAGEHLP_MODULE, *PIMAGEHLP_MODULE; + +typedef struct _IMAGEHLP_MODULEW +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_MODULE) + DWORD BaseOfImage; // base load address of module + DWORD ImageSize; // virtual size of the loaded module + DWORD TimeDateStamp; // date/time stamp from pe header + DWORD CheckSum; // checksum from the pe header + DWORD NumSyms; // number of symbols in the symbol table + SYM_TYPE SymType; // type of symbols loaded + WCHAR ModuleName[32]; // module name + WCHAR ImageName[256]; // image name + WCHAR LoadedImageName[256]; // symbol file name +} IMAGEHLP_MODULEW, *PIMAGEHLP_MODULEW; +#endif + +// +// source file line data structure +// + +typedef struct _IMAGEHLP_LINE64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PCHAR FileName; // full filename + DWORD64 Address; // first instruction of line +} IMAGEHLP_LINE64, *PIMAGEHLP_LINE64; + +typedef struct _IMAGEHLP_LINEW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PWSTR FileName; // full filename + DWORD64 Address; // first instruction of line +} IMAGEHLP_LINEW64, *PIMAGEHLP_LINEW64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_LINE IMAGEHLP_LINE64 +#define PIMAGEHLP_LINE PIMAGEHLP_LINE64 +#else +typedef struct _IMAGEHLP_LINE +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PCHAR FileName; // full filename + DWORD Address; // first instruction of line +} IMAGEHLP_LINE, *PIMAGEHLP_LINE; + +typedef struct _IMAGEHLP_LINEW +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_LINE64) + PVOID Key; // internal + DWORD LineNumber; // line number in file + PCHAR FileName; // full filename + DWORD64 Address; // first instruction of line +} IMAGEHLP_LINEW, *PIMAGEHLP_LINEW; +#endif + +// +// source file structure +// + +typedef struct _SOURCEFILE +{ + DWORD64 ModBase; // base address of loaded module + PCHAR FileName; // full filename of source +} SOURCEFILE, *PSOURCEFILE; + +typedef struct _SOURCEFILEW +{ + DWORD64 ModBase; // base address of loaded module + PWSTR FileName; // full filename of source +} SOURCEFILEW, *PSOURCEFILEW; + +// +// data structures used for registered symbol callbacks +// + +#define CBA_DEFERRED_SYMBOL_LOAD_START 0x00000001 +#define CBA_DEFERRED_SYMBOL_LOAD_COMPLETE 0x00000002 +#define CBA_DEFERRED_SYMBOL_LOAD_FAILURE 0x00000003 +#define CBA_SYMBOLS_UNLOADED 0x00000004 +#define CBA_DUPLICATE_SYMBOL 0x00000005 +#define CBA_READ_MEMORY 0x00000006 +#define CBA_DEFERRED_SYMBOL_LOAD_CANCEL 0x00000007 +#define CBA_SET_OPTIONS 0x00000008 +#define CBA_EVENT 0x00000010 +#define CBA_DEFERRED_SYMBOL_LOAD_PARTIAL 0x00000020 +#define CBA_DEBUG_INFO 0x10000000 +#define CBA_SRCSRV_INFO 0x20000000 +#define CBA_SRCSRV_EVENT 0x40000000 + +typedef struct _IMAGEHLP_CBA_READ_MEMORY +{ + DWORD64 addr; // address to read from + PVOID buf; // buffer to read to + DWORD bytes; // amount of bytes to read + DWORD* bytesread; // pointer to store amount of bytes read +} IMAGEHLP_CBA_READ_MEMORY, *PIMAGEHLP_CBA_READ_MEMORY; + +enum +{ + sevInfo = 0, + sevProblem, + sevAttn, + sevFatal, + sevMax // unused +}; + +#define EVENT_SRCSPEW_START 100 +#define EVENT_SRCSPEW 100 +#define EVENT_SRCSPEW_END 199 + +typedef struct _IMAGEHLP_CBA_EVENT +{ + DWORD severity; // values from sevInfo to sevFatal + DWORD code; // numerical code IDs the error + PCHAR desc; // may contain a text description of the error + PVOID object; // value dependant upon the error code +} IMAGEHLP_CBA_EVENT, *PIMAGEHLP_CBA_EVENT; + +typedef struct _IMAGEHLP_CBA_EVENTW +{ + DWORD severity; // values from sevInfo to sevFatal + DWORD code; // numerical code IDs the error + PCWSTR desc; // may contain a text description of the error + PVOID object; // value dependant upon the error code +} IMAGEHLP_CBA_EVENTW, *PIMAGEHLP_CBA_EVENTW; + +typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64) + DWORD64 BaseOfImage; // base load address of module + DWORD CheckSum; // checksum from the pe header + DWORD TimeDateStamp; // date/time stamp from pe header + CHAR FileName[MAX_PATH]; // symbols file or image name + BOOLEAN Reparse; // load failure reparse + HANDLE hFile; // file handle, if passed + DWORD Flags; // +} IMAGEHLP_DEFERRED_SYMBOL_LOAD64, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD64; + +typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOADW64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOADW64) + DWORD64 BaseOfImage; // base load address of module + DWORD CheckSum; // checksum from the pe header + DWORD TimeDateStamp; // date/time stamp from pe header + WCHAR FileName[MAX_PATH + 1]; // symbols file or image name + BOOLEAN Reparse; // load failure reparse + HANDLE hFile; // file handle, if passed + DWORD Flags; // +} IMAGEHLP_DEFERRED_SYMBOL_LOADW64, *PIMAGEHLP_DEFERRED_SYMBOL_LOADW64; + +#define DSLFLAG_MISMATCHED_PDB 0x1 +#define DSLFLAG_MISMATCHED_DBG 0x2 + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64 +#define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 +#else +typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD) + DWORD BaseOfImage; // base load address of module + DWORD CheckSum; // checksum from the pe header + DWORD TimeDateStamp; // date/time stamp from pe header + CHAR FileName[MAX_PATH]; // symbols file or image name + BOOLEAN Reparse; // load failure reparse + HANDLE hFile; // file handle, if passed +} IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; +#endif + +typedef struct _IMAGEHLP_DUPLICATE_SYMBOL64 +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64) + DWORD NumberOfDups; // number of duplicates in the Symbol array + PIMAGEHLP_SYMBOL64 Symbol; // array of duplicate symbols + DWORD SelectedSymbol; // symbol selected (-1 to start) +} IMAGEHLP_DUPLICATE_SYMBOL64, *PIMAGEHLP_DUPLICATE_SYMBOL64; + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define IMAGEHLP_DUPLICATE_SYMBOL IMAGEHLP_DUPLICATE_SYMBOL64 +#define PIMAGEHLP_DUPLICATE_SYMBOL PIMAGEHLP_DUPLICATE_SYMBOL64 +#else +typedef struct _IMAGEHLP_DUPLICATE_SYMBOL +{ + DWORD SizeOfStruct; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL) + DWORD NumberOfDups; // number of duplicates in the Symbol array + PIMAGEHLP_SYMBOL Symbol; // array of duplicate symbols + DWORD SelectedSymbol; // symbol selected (-1 to start) +} IMAGEHLP_DUPLICATE_SYMBOL, *PIMAGEHLP_DUPLICATE_SYMBOL; +#endif + +// If dbghelp ever needs to display graphical UI, it will use this as the parent window. + +BOOL +IMAGEAPI +SymSetParentWindow( + __in HWND hwnd +); + +PCHAR +IMAGEAPI +SymSetHomeDirectory( + __in_opt HANDLE hProcess, + __in_opt PCSTR dir +); + +PWSTR +IMAGEAPI +SymSetHomeDirectoryW( + __in_opt HANDLE hProcess, + __in_opt PCWSTR dir +); + +PCHAR +IMAGEAPI +SymGetHomeDirectory( + __in DWORD type, + __out_ecount(size) PSTR dir, + __in size_t size +); + +PWSTR +IMAGEAPI +SymGetHomeDirectoryW( + __in DWORD type, + __out_ecount(size) PWSTR dir, + __in size_t size +); + +enum +{ + hdBase = 0, // root directory for dbghelp + hdSym, // where symbols are stored + hdSrc, // where source is stored + hdMax // end marker +}; + +typedef struct _OMAP +{ + ULONG rva; + ULONG rvaTo; +} OMAP, *POMAP; + +BOOL +IMAGEAPI +SymGetOmaps( + __in HANDLE hProcess, + __in DWORD64 BaseOfDll, + __out POMAP* OmapTo, + __out PDWORD64 cOmapTo, + __out POMAP* OmapFrom, + __out PDWORD64 cOmapFrom +); + +// +// options that are set/returned by SymSetOptions() & SymGetOptions() +// these are used as a mask +// +#define SYMOPT_CASE_INSENSITIVE 0x00000001 +#define SYMOPT_UNDNAME 0x00000002 +#define SYMOPT_DEFERRED_LOADS 0x00000004 +#define SYMOPT_NO_CPP 0x00000008 +#define SYMOPT_LOAD_LINES 0x00000010 +#define SYMOPT_OMAP_FIND_NEAREST 0x00000020 +#define SYMOPT_LOAD_ANYTHING 0x00000040 +#define SYMOPT_IGNORE_CVREC 0x00000080 +#define SYMOPT_NO_UNQUALIFIED_LOADS 0x00000100 +#define SYMOPT_FAIL_CRITICAL_ERRORS 0x00000200 +#define SYMOPT_EXACT_SYMBOLS 0x00000400 +#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800 +#define SYMOPT_IGNORE_NT_SYMPATH 0x00001000 +#define SYMOPT_INCLUDE_32BIT_MODULES 0x00002000 +#define SYMOPT_PUBLICS_ONLY 0x00004000 +#define SYMOPT_NO_PUBLICS 0x00008000 +#define SYMOPT_AUTO_PUBLICS 0x00010000 +#define SYMOPT_NO_IMAGE_SEARCH 0x00020000 +#define SYMOPT_SECURE 0x00040000 +#define SYMOPT_NO_PROMPTS 0x00080000 +#define SYMOPT_OVERWRITE 0x00100000 +#define SYMOPT_IGNORE_IMAGEDIR 0x00200000 +#define SYMOPT_FLAT_DIRECTORY 0x00400000 +#define SYMOPT_FAVOR_COMPRESSED 0x00800000 +#define SYMOPT_ALLOW_ZERO_ADDRESS 0x01000000 +#define SYMOPT_DISABLE_SYMSRV_AUTODETECT 0x02000000 + +#define SYMOPT_DEBUG 0x80000000 + +DWORD +IMAGEAPI +SymSetOptions( + __in DWORD SymOptions +); + +DWORD +IMAGEAPI +SymGetOptions( + VOID +); + +BOOL +IMAGEAPI +SymCleanup( + __in HANDLE hProcess +); + +BOOL +IMAGEAPI +SymMatchString( + __in PCSTR string, + __in PCSTR expression, + __in BOOL fCase +); + +BOOL +IMAGEAPI +SymMatchStringA( + __in PCSTR string, + __in PCSTR expression, + __in BOOL fCase +); + +BOOL +IMAGEAPI +SymMatchStringW( + __in PCWSTR string, + __in PCWSTR expression, + __in BOOL fCase +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSOURCEFILES_CALLBACK)( + __in PSOURCEFILE pSourceFile, + __in_opt PVOID UserContext +); + +// for backwards compatibility - don't use this +#define PSYM_ENUMSOURCFILES_CALLBACK PSYM_ENUMSOURCEFILES_CALLBACK + +BOOL +IMAGEAPI +SymEnumSourceFiles( + __in HANDLE hProcess, + __in ULONG64 ModBase, + __in_opt PCSTR Mask, + __in PSYM_ENUMSOURCEFILES_CALLBACK cbSrcFiles, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMSOURCEFILES_CALLBACKW)( + __in PSOURCEFILEW pSourceFile, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSourceFilesW( + __in HANDLE hProcess, + __in ULONG64 ModBase, + __in_opt PCWSTR Mask, + __in PSYM_ENUMSOURCEFILES_CALLBACKW cbSrcFiles, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumerateModules64( + __in HANDLE hProcess, + __in PSYM_ENUMMODULES_CALLBACK64 EnumModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumerateModulesW64( + __in HANDLE hProcess, + __in PSYM_ENUMMODULES_CALLBACKW64 EnumModulesCallback, + __in_opt PVOID UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymEnumerateModules SymEnumerateModules64 +#else +BOOL +IMAGEAPI +SymEnumerateModules( + __in HANDLE hProcess, + __in PSYM_ENUMMODULES_CALLBACK EnumModulesCallback, + __in_opt PVOID UserContext +); +#endif + +BOOL +IMAGEAPI +EnumerateLoadedModulesEx( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +EnumerateLoadedModulesExW( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +EnumerateLoadedModules64( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACK64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +EnumerateLoadedModulesW64( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACKW64 EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define EnumerateLoadedModules EnumerateLoadedModules64 +#else +BOOL +IMAGEAPI +EnumerateLoadedModules( + __in HANDLE hProcess, + __in PENUMLOADED_MODULES_CALLBACK EnumLoadedModulesCallback, + __in_opt PVOID UserContext +); +#endif + +PVOID +IMAGEAPI +SymFunctionTableAccess64( + __in HANDLE hProcess, + __in DWORD64 AddrBase +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymFunctionTableAccess SymFunctionTableAccess64 +#else +PVOID +IMAGEAPI +SymFunctionTableAccess( + __in HANDLE hProcess, + __in DWORD AddrBase +); +#endif + +BOOL +IMAGEAPI +SymGetUnwindInfo( + __in HANDLE hProcess, + __in DWORD64 Address, + __out_bcount_opt(*Size) PVOID Buffer, + __inout PULONG Size +); + +BOOL +IMAGEAPI +SymGetModuleInfo64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out PIMAGEHLP_MODULE64 ModuleInfo +); + +BOOL +IMAGEAPI +SymGetModuleInfoW64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out PIMAGEHLP_MODULEW64 ModuleInfo +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetModuleInfo SymGetModuleInfo64 +#define SymGetModuleInfoW SymGetModuleInfoW64 +#else +BOOL +IMAGEAPI +SymGetModuleInfo( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PIMAGEHLP_MODULE ModuleInfo +); + +BOOL +IMAGEAPI +SymGetModuleInfoW( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PIMAGEHLP_MODULEW ModuleInfo +); +#endif + +DWORD64 +IMAGEAPI +SymGetModuleBase64( + __in HANDLE hProcess, + __in DWORD64 qwAddr +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetModuleBase SymGetModuleBase64 +#else +DWORD +IMAGEAPI +SymGetModuleBase( + __in HANDLE hProcess, + __in DWORD dwAddr +); +#endif + +typedef struct _SRCCODEINFO +{ + DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO) + PVOID Key; // not used + DWORD64 ModBase; // base address of module this applies to + CHAR Obj[MAX_PATH + 1]; // the object file within the module + CHAR FileName[MAX_PATH + 1]; // full filename + DWORD LineNumber; // line number in file + DWORD64 Address; // first instruction of line +} SRCCODEINFO, *PSRCCODEINFO; + +typedef struct _SRCCODEINFOW +{ + DWORD SizeOfStruct; // set to sizeof(SRCCODEINFO) + PVOID Key; // not used + DWORD64 ModBase; // base address of module this applies to + WCHAR Obj[MAX_PATH + 1]; // the object file within the module + WCHAR FileName[MAX_PATH + 1]; // full filename + DWORD LineNumber; // line number in file + DWORD64 Address; // first instruction of line +} SRCCODEINFOW, *PSRCCODEINFOW; + +typedef BOOL +(CALLBACK* PSYM_ENUMLINES_CALLBACK)( + __in PSRCCODEINFO LineInfo, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumLines( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR Obj, + __in_opt PCSTR File, + __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMLINES_CALLBACKW)( + __in PSRCCODEINFOW LineInfo, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumLinesW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR Obj, + __in_opt PCWSTR File, + __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymGetLineFromAddr64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINE64 Line64 +); + +BOOL +IMAGEAPI +SymGetLineFromAddrW64( + __in HANDLE hProcess, + __in DWORD64 dwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINEW64 Line +); + +BOOL +IMAGEAPI +SymEnumSourceLines( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR Obj, + __in_opt PCSTR File, + __in_opt DWORD Line, + __in DWORD Flags, + __in PSYM_ENUMLINES_CALLBACK EnumLinesCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSourceLinesW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR Obj, + __in_opt PCWSTR File, + __in_opt DWORD Line, + __in DWORD Flags, + __in PSYM_ENUMLINES_CALLBACKW EnumLinesCallback, + __in_opt PVOID UserContext +); + +// flags for SymEnumSourceLines + +#define ESLFLAG_FULLPATH 0x1 +#define ESLFLAG_NEAREST 0x2 +#define ESLFLAG_PREV 0x4 +#define ESLFLAG_NEXT 0x8 + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLineFromAddr SymGetLineFromAddr64 +#define SymGetLineFromAddrW SymGetLineFromAddrW64 +#else +BOOL +IMAGEAPI +SymGetLineFromAddr( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINE Line +); + +BOOL +IMAGEAPI +SymGetLineFromAddrW( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out PDWORD pdwDisplacement, + __out PIMAGEHLP_LINEW Line +); +#endif + +BOOL +IMAGEAPI +SymGetLineFromName64( + __in HANDLE hProcess, + __in_opt PCSTR ModuleName, + __in_opt PCSTR FileName, + __in DWORD dwLineNumber, + __out PLONG plDisplacement, + __inout PIMAGEHLP_LINE64 Line +); + +BOOL +IMAGEAPI +SymGetLineFromNameW64( + __in HANDLE hProcess, + __in_opt PCWSTR ModuleName, + __in_opt PCWSTR FileName, + __in DWORD dwLineNumber, + __out PLONG plDisplacement, + __inout PIMAGEHLP_LINEW64 Line +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLineFromName SymGetLineFromName64 +#else +BOOL +IMAGEAPI +SymGetLineFromName( + __in HANDLE hProcess, + __in_opt PCSTR ModuleName, + __in_opt PCSTR FileName, + __in DWORD dwLineNumber, + __out PLONG plDisplacement, + __inout PIMAGEHLP_LINE Line +); +#endif + +BOOL +IMAGEAPI +SymGetLineNext64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE64 Line +); + +BOOL +IMAGEAPI +SymGetLineNextW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW64 Line +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLineNext SymGetLineNext64 +#else +BOOL +IMAGEAPI +SymGetLineNext( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE Line +); + +BOOL +IMAGEAPI +SymGetLineNextW( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW Line +); +#endif + +BOOL +IMAGEAPI +SymGetLinePrev64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE64 Line +); + +BOOL +IMAGEAPI +SymGetLinePrevW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW64 Line +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetLinePrev SymGetLinePrev64 +#else +BOOL +IMAGEAPI +SymGetLinePrev( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINE Line +); + +BOOL +IMAGEAPI +SymGetLinePrevW( + __in HANDLE hProcess, + __inout PIMAGEHLP_LINEW Line +); +#endif + +ULONG +IMAGEAPI +SymGetFileLineOffsets64( + __in HANDLE hProcess, + __in_opt PCSTR ModuleName, + __in PCSTR FileName, + __out_ecount(BufferLines) PDWORD64 Buffer, + __in ULONG BufferLines +); + +BOOL +IMAGEAPI +SymMatchFileName( + __in PCSTR FileName, + __in PCSTR Match, + __deref_opt_out PSTR* FileNameStop, + __deref_opt_out PSTR* MatchStop +); + +BOOL +IMAGEAPI +SymMatchFileNameW( + __in PCWSTR FileName, + __in PCWSTR Match, + __deref_opt_out PWSTR* FileNameStop, + __deref_opt_out PWSTR* MatchStop +); + +BOOL +IMAGEAPI +SymGetSourceFile( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR Params, + __in PCSTR FileSpec, + __out_ecount(Size) PSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceFileW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR Params, + __in PCWSTR FileSpec, + __out_ecount(Size) PWSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceFileToken( + __in HANDLE hProcess, + __in ULONG64 Base, + __in PCSTR FileSpec, + __deref_out PVOID* Token, + __out DWORD* Size +); + +BOOL +IMAGEAPI +SymGetSourceFileTokenW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in PCWSTR FileSpec, + __deref_out PVOID* Token, + __out DWORD* Size +); + +BOOL +IMAGEAPI +SymGetSourceFileFromToken( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCSTR Params, + __out_ecount(Size) PSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceFileFromTokenW( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCWSTR Params, + __out_ecount(Size) PWSTR FilePath, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceVarFromToken( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCSTR Params, + __in PCSTR VarName, + __out_ecount(Size) PSTR Value, + __in DWORD Size +); + +BOOL +IMAGEAPI +SymGetSourceVarFromTokenW( + __in HANDLE hProcess, + __in PVOID Token, + __in_opt PCWSTR Params, + __in PCWSTR VarName, + __out_ecount(Size) PWSTR Value, + __in DWORD Size +); + +typedef BOOL (CALLBACK* PENUMSOURCEFILETOKENSCALLBACK)(__in PVOID token, __in size_t size); + +BOOL +IMAGEAPI +SymEnumSourceFileTokens( + __in HANDLE hProcess, + __in ULONG64 Base, + __in PENUMSOURCEFILETOKENSCALLBACK Callback +); + +BOOL +IMAGEAPI +SymInitialize( + __in HANDLE hProcess, + __in_opt PCSTR UserSearchPath, + __in BOOL fInvadeProcess +); + +BOOL +IMAGEAPI +SymInitializeW( + __in HANDLE hProcess, + __in_opt PCWSTR UserSearchPath, + __in BOOL fInvadeProcess +); + +BOOL +IMAGEAPI +SymGetSearchPath( + __in HANDLE hProcess, + __out_ecount(SearchPathLength) PSTR SearchPath, + __in DWORD SearchPathLength +); + +BOOL +IMAGEAPI +SymGetSearchPathW( + __in HANDLE hProcess, + __out_ecount(SearchPathLength) PWSTR SearchPath, + __in DWORD SearchPathLength +); + +BOOL +IMAGEAPI +SymSetSearchPath( + __in HANDLE hProcess, + __in_opt PCSTR SearchPath +); + +BOOL +IMAGEAPI +SymSetSearchPathW( + __in HANDLE hProcess, + __in_opt PCWSTR SearchPath +); + +#define SLMFLAG_VIRTUAL 0x1 +#define SLMFLAG_ALT_INDEX 0x2 +#define SLMFLAG_NO_SYMBOLS 0x4 + +DWORD64 +IMAGEAPI +SymLoadModuleEx( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCSTR ImageName, + __in_opt PCSTR ModuleName, + __in DWORD64 BaseOfDll, + __in DWORD DllSize, + __in_opt PMODLOAD_DATA Data, + __in_opt DWORD Flags +); + +DWORD64 +IMAGEAPI +SymLoadModuleExW( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCWSTR ImageName, + __in_opt PCWSTR ModuleName, + __in DWORD64 BaseOfDll, + __in DWORD DllSize, + __in_opt PMODLOAD_DATA Data, + __in_opt DWORD Flags +); + +BOOL +IMAGEAPI +SymUnloadModule64( + __in HANDLE hProcess, + __in DWORD64 BaseOfDll +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymUnloadModule SymUnloadModule64 +#else +BOOL +IMAGEAPI +SymUnloadModule( + __in HANDLE hProcess, + __in DWORD BaseOfDll +); +#endif + +BOOL +IMAGEAPI +SymUnDName64( + __in PIMAGEHLP_SYMBOL64 sym, // Symbol to undecorate + __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in + __in DWORD UnDecNameLength // Size of the buffer +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymUnDName SymUnDName64 +#else +BOOL +IMAGEAPI +SymUnDName( + __in PIMAGEHLP_SYMBOL sym, // Symbol to undecorate + __out_ecount(UnDecNameLength) PSTR UnDecName, // Buffer to store undecorated name in + __in DWORD UnDecNameLength // Size of the buffer +); +#endif + +BOOL +IMAGEAPI +SymRegisterCallback64( + __in HANDLE hProcess, + __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction, + __in ULONG64 UserContext +); + +BOOL +IMAGEAPI +SymRegisterCallbackW64( + __in HANDLE hProcess, + __in PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction, + __in ULONG64 UserContext +); + +BOOL +IMAGEAPI +SymRegisterFunctionEntryCallback64( + __in HANDLE hProcess, + __in PSYMBOL_FUNCENTRY_CALLBACK64 CallbackFunction, + __in ULONG64 UserContext +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymRegisterCallback SymRegisterCallback64 +#define SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 +#else +BOOL +IMAGEAPI +SymRegisterCallback( + __in HANDLE hProcess, + __in PSYMBOL_REGISTERED_CALLBACK CallbackFunction, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymRegisterFunctionEntryCallback( + __in HANDLE hProcess, + __in PSYMBOL_FUNCENTRY_CALLBACK CallbackFunction, + __in_opt PVOID UserContext +); +#endif + + +typedef struct _IMAGEHLP_SYMBOL_SRC +{ + DWORD sizeofstruct; + DWORD type; + char file[MAX_PATH]; +} IMAGEHLP_SYMBOL_SRC, *PIMAGEHLP_SYMBOL_SRC; + +typedef struct _MODULE_TYPE_INFO // AKA TYPTYP +{ + USHORT dataLength; + USHORT leaf; + BYTE data[1]; +} MODULE_TYPE_INFO, *PMODULE_TYPE_INFO; + +typedef struct _SYMBOL_INFO +{ + ULONG SizeOfStruct; + ULONG TypeIndex; // Type Index of symbol + ULONG64 Reserved[2]; + ULONG Index; + ULONG Size; + ULONG64 ModBase; // Base Address of module comtaining this symbol + ULONG Flags; + ULONG64 Value; // Value of symbol, ValuePresent should be 1 + ULONG64 Address; // Address of symbol including base address of module + ULONG Register; // register holding value or pointer to value + ULONG Scope; // scope of the symbol + ULONG Tag; // pdb classification + ULONG NameLen; // Actual length of name + ULONG MaxNameLen; + CHAR Name[1]; // Name of symbol +} SYMBOL_INFO, *PSYMBOL_INFO; + +typedef struct _SYMBOL_INFO_PACKAGE +{ + SYMBOL_INFO si; + CHAR name[MAX_SYM_NAME + 1]; +} SYMBOL_INFO_PACKAGE, *PSYMBOL_INFO_PACKAGE; + +typedef struct _SYMBOL_INFOW +{ + ULONG SizeOfStruct; + ULONG TypeIndex; // Type Index of symbol + ULONG64 Reserved[2]; + ULONG Index; + ULONG Size; + ULONG64 ModBase; // Base Address of module comtaining this symbol + ULONG Flags; + ULONG64 Value; // Value of symbol, ValuePresent should be 1 + ULONG64 Address; // Address of symbol including base address of module + ULONG Register; // register holding value or pointer to value + ULONG Scope; // scope of the symbol + ULONG Tag; // pdb classification + ULONG NameLen; // Actual length of name + ULONG MaxNameLen; + WCHAR Name[1]; // Name of symbol +} SYMBOL_INFOW, *PSYMBOL_INFOW; + +typedef struct _SYMBOL_INFO_PACKAGEW +{ + SYMBOL_INFOW si; + WCHAR name[MAX_SYM_NAME + 1]; +} SYMBOL_INFO_PACKAGEW, *PSYMBOL_INFO_PACKAGEW; + +typedef struct _IMAGEHLP_STACK_FRAME +{ + ULONG64 InstructionOffset; + ULONG64 ReturnOffset; + ULONG64 FrameOffset; + ULONG64 StackOffset; + ULONG64 BackingStoreOffset; + ULONG64 FuncTableEntry; + ULONG64 Params[4]; + ULONG64 Reserved[5]; + BOOL Virtual; + ULONG Reserved2; +} IMAGEHLP_STACK_FRAME, *PIMAGEHLP_STACK_FRAME; + +typedef VOID IMAGEHLP_CONTEXT, *PIMAGEHLP_CONTEXT; + + +BOOL +IMAGEAPI +SymSetContext( + __in HANDLE hProcess, + __in PIMAGEHLP_STACK_FRAME StackFrame, + __in_opt PIMAGEHLP_CONTEXT Context +); + +BOOL +IMAGEAPI +SymSetScopeFromAddr( + __in HANDLE hProcess, + __in ULONG64 Address +); + +BOOL +IMAGEAPI +SymSetScopeFromIndex( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index +); + +typedef BOOL +(CALLBACK* PSYM_ENUMPROCESSES_CALLBACK)( + __in HANDLE hProcess, + __in PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumProcesses( + __in PSYM_ENUMPROCESSES_CALLBACK EnumProcessesCallback, + __in PVOID UserContext +); + +BOOL +IMAGEAPI +SymFromAddr( + __in HANDLE hProcess, + __in DWORD64 Address, + __out_opt PDWORD64 Displacement, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromAddrW( + __in HANDLE hProcess, + __in DWORD64 Address, + __out_opt PDWORD64 Displacement, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymFromToken( + __in HANDLE hProcess, + __in DWORD64 Base, + __in DWORD Token, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromTokenW( + __in HANDLE hProcess, + __in DWORD64 Base, + __in DWORD Token, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymNext( + __in HANDLE hProcess, + __inout PSYMBOL_INFO si +); + +BOOL +IMAGEAPI +SymNextW( + __in HANDLE hProcess, + __inout PSYMBOL_INFOW siw +); + +BOOL +IMAGEAPI +SymPrev( + __in HANDLE hProcess, + __inout PSYMBOL_INFO si +); + +BOOL +IMAGEAPI +SymPrevW( + __in HANDLE hProcess, + __inout PSYMBOL_INFOW siw +); + +// While SymFromName will provide a symbol from a name, +// SymEnumSymbols can provide the same matching information +// for ALL symbols with a matching name, even regular +// expressions. That way you can search across modules +// and differentiate between identically named symbols. + +BOOL +IMAGEAPI +SymFromName( + __in HANDLE hProcess, + __in PCSTR Name, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromNameW( + __in HANDLE hProcess, + __in PCWSTR Name, + __inout PSYMBOL_INFOW Symbol +); + +typedef BOOL +(CALLBACK* PSYM_ENUMERATESYMBOLS_CALLBACK)( + __in PSYMBOL_INFO pSymInfo, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbols( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCSTR Mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +typedef BOOL +(CALLBACK* PSYM_ENUMERATESYMBOLS_CALLBACKW)( + __in PSYMBOL_INFOW pSymInfo, + __in ULONG SymbolSize, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbolsW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCWSTR Mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbolsForAddr( + __in HANDLE hProcess, + __in DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumSymbolsForAddrW( + __in HANDLE hProcess, + __in DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +#define SYMSEARCH_MASKOBJS 0x01 // used internally to implement other APIs +#define SYMSEARCH_RECURSE 0X02 // recurse scopes +#define SYMSEARCH_GLOBALSONLY 0X04 // search only for global symbols +#define SYMSEARCH_ALLITEMS 0X08 // search for everything in the pdb, not just normal scoped symbols + +BOOL +IMAGEAPI +SymSearch( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt DWORD Index, + __in_opt DWORD SymTag, + __in_opt PCSTR Mask, + __in_opt DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext, + __in DWORD Options +); + +BOOL +IMAGEAPI +SymSearchW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt DWORD Index, + __in_opt DWORD SymTag, + __in_opt PCWSTR Mask, + __in_opt DWORD64 Address, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext, + __in DWORD Options +); + +BOOL +IMAGEAPI +SymGetScope( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymGetScopeW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymFromIndex( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymFromIndexW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in DWORD Index, + __inout PSYMBOL_INFOW Symbol +); + +typedef enum _IMAGEHLP_SYMBOL_TYPE_INFO +{ + TI_GET_SYMTAG, + TI_GET_SYMNAME, + TI_GET_LENGTH, + TI_GET_TYPE, + TI_GET_TYPEID, + TI_GET_BASETYPE, + TI_GET_ARRAYINDEXTYPEID, + TI_FINDCHILDREN, + TI_GET_DATAKIND, + TI_GET_ADDRESSOFFSET, + TI_GET_OFFSET, + TI_GET_VALUE, + TI_GET_COUNT, + TI_GET_CHILDRENCOUNT, + TI_GET_BITPOSITION, + TI_GET_VIRTUALBASECLASS, + TI_GET_VIRTUALTABLESHAPEID, + TI_GET_VIRTUALBASEPOINTEROFFSET, + TI_GET_CLASSPARENTID, + TI_GET_NESTED, + TI_GET_SYMINDEX, + TI_GET_LEXICALPARENT, + TI_GET_ADDRESS, + TI_GET_THISADJUST, + TI_GET_UDTKIND, + TI_IS_EQUIV_TO, + TI_GET_CALLING_CONVENTION, + TI_IS_CLOSE_EQUIV_TO, + TI_GTIEX_REQS_VALID, + TI_GET_VIRTUALBASEOFFSET, + TI_GET_VIRTUALBASEDISPINDEX, + TI_GET_IS_REFERENCE, + TI_GET_INDIRECTVIRTUALBASECLASS, + IMAGEHLP_SYMBOL_TYPE_INFO_MAX, +} IMAGEHLP_SYMBOL_TYPE_INFO; + +typedef struct _TI_FINDCHILDREN_PARAMS +{ + ULONG Count; + ULONG Start; + ULONG ChildId[1]; +} TI_FINDCHILDREN_PARAMS; + +BOOL +IMAGEAPI +SymGetTypeInfo( + __in HANDLE hProcess, + __in DWORD64 ModBase, + __in ULONG TypeId, + __in IMAGEHLP_SYMBOL_TYPE_INFO GetType, + __out PVOID pInfo +); + +#define IMAGEHLP_GET_TYPE_INFO_UNCACHED 0x00000001 +#define IMAGEHLP_GET_TYPE_INFO_CHILDREN 0x00000002 + +typedef struct _IMAGEHLP_GET_TYPE_INFO_PARAMS +{ + IN ULONG SizeOfStruct; + IN ULONG Flags; + IN ULONG NumIds; + IN PULONG TypeIds; + IN ULONG64 TagFilter; + IN ULONG NumReqs; + IN IMAGEHLP_SYMBOL_TYPE_INFO* ReqKinds; + IN PULONG_PTR ReqOffsets; + IN PULONG ReqSizes; + IN ULONG_PTR ReqStride; + IN ULONG_PTR BufferSize; + OUT PVOID Buffer; + OUT ULONG EntriesMatched; + OUT ULONG EntriesFilled; + OUT ULONG64 TagsFound; + OUT ULONG64 AllReqsValid; + IN ULONG NumReqsValid; + OUT PULONG64 ReqsValid OPTIONAL; +} IMAGEHLP_GET_TYPE_INFO_PARAMS, *PIMAGEHLP_GET_TYPE_INFO_PARAMS; + +BOOL +IMAGEAPI +SymGetTypeInfoEx( + __in HANDLE hProcess, + __in DWORD64 ModBase, + __inout PIMAGEHLP_GET_TYPE_INFO_PARAMS Params +); + +BOOL +IMAGEAPI +SymEnumTypes( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumTypesW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumTypesByName( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCSTR mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymEnumTypesByNameW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCWSTR mask, + __in PSYM_ENUMERATESYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +BOOL +IMAGEAPI +SymGetTypeFromName( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCSTR Name, + __inout PSYMBOL_INFO Symbol +); + +BOOL +IMAGEAPI +SymGetTypeFromNameW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCWSTR Name, + __inout PSYMBOL_INFOW Symbol +); + +BOOL +IMAGEAPI +SymAddSymbol( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCSTR Name, + __in DWORD64 Address, + __in DWORD Size, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymAddSymbolW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PCWSTR Name, + __in DWORD64 Address, + __in DWORD Size, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymDeleteSymbol( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCSTR Name, + __in DWORD64 Address, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymDeleteSymbolW( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in_opt PCWSTR Name, + __in DWORD64 Address, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymRefreshModuleList( + __in HANDLE hProcess +); + +BOOL +IMAGEAPI +SymAddSourceStream( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR StreamFile, + __in_bcount_opt(Size) PBYTE Buffer, + __in size_t Size +); + +typedef BOOL (WINAPI* SYMADDSOURCESTREAM)(HANDLE, ULONG64, PCSTR, PBYTE, size_t); + +BOOL +IMAGEAPI +SymAddSourceStreamA( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCSTR StreamFile, + __in_bcount_opt(Size) PBYTE Buffer, + __in size_t Size +); + +typedef BOOL (WINAPI* SYMADDSOURCESTREAMA)(HANDLE, ULONG64, PCSTR, PBYTE, size_t); + +BOOL +IMAGEAPI +SymAddSourceStreamW( + __in HANDLE hProcess, + __in ULONG64 Base, + __in_opt PCWSTR FileSpec, + __in_bcount_opt(Size) PBYTE Buffer, + __in size_t Size +); + +BOOL +IMAGEAPI +SymSrvIsStoreW( + __in_opt HANDLE hProcess, + __in PCWSTR path +); + +BOOL +IMAGEAPI +SymSrvIsStore( + __in_opt HANDLE hProcess, + __in PCSTR path +); + +PCSTR +IMAGEAPI +SymSrvDeltaName( + __in HANDLE hProcess, + __in_opt PCSTR SymPath, + __in PCSTR Type, + __in PCSTR File1, + __in PCSTR File2 +); + +PCWSTR +IMAGEAPI +SymSrvDeltaNameW( + __in HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR Type, + __in PCWSTR File1, + __in PCWSTR File2 +); + +PCSTR +IMAGEAPI +SymSrvGetSupplement( + __in HANDLE hProcess, + __in_opt PCSTR SymPath, + __in PCSTR Node, + __in PCSTR File +); + +PCWSTR +IMAGEAPI +SymSrvGetSupplementW( + __in HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR Node, + __in PCWSTR File +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexes( + __in PCSTR File, + __out GUID* Id, + __out PDWORD Val1, + __out_opt PDWORD Val2, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexesW( + __in PCWSTR File, + __out GUID* Id, + __out PDWORD Val1, + __out_opt PDWORD Val2, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexStringW( + __in HANDLE hProcess, + __in_opt PCWSTR SrvPath, + __in PCWSTR File, + __out_ecount(Size) PWSTR Index, + __in size_t Size, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexString( + __in HANDLE hProcess, + __in_opt PCSTR SrvPath, + __in PCSTR File, + __out_ecount(Size) PSTR Index, + __in size_t Size, + __in DWORD Flags +); + +typedef struct +{ + DWORD sizeofstruct; + char file[MAX_PATH + 1]; + BOOL stripped; + DWORD timestamp; + DWORD size; + char dbgfile[MAX_PATH + 1]; + char pdbfile[MAX_PATH + 1]; + GUID guid; + DWORD sig; + DWORD age; +} SYMSRV_INDEX_INFO, *PSYMSRV_INDEX_INFO; + +typedef struct +{ + DWORD sizeofstruct; + WCHAR file[MAX_PATH + 1]; + BOOL stripped; + DWORD timestamp; + DWORD size; + WCHAR dbgfile[MAX_PATH + 1]; + WCHAR pdbfile[MAX_PATH + 1]; + GUID guid; + DWORD sig; + DWORD age; +} SYMSRV_INDEX_INFOW, *PSYMSRV_INDEX_INFOW; + +BOOL +IMAGEAPI +SymSrvGetFileIndexInfo( + __in PCSTR File, + __out PSYMSRV_INDEX_INFO Info, + __in DWORD Flags +); + +BOOL +IMAGEAPI +SymSrvGetFileIndexInfoW( + __in PCWSTR File, + __out PSYMSRV_INDEX_INFOW Info, + __in DWORD Flags +); + +PCSTR +IMAGEAPI +SymSrvStoreSupplement( + __in HANDLE hProcess, + __in_opt PCSTR SrvPath, + __in PCSTR Node, + __in PCSTR File, + __in DWORD Flags +); + +PCWSTR +IMAGEAPI +SymSrvStoreSupplementW( + __in HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR Node, + __in PCWSTR File, + __in DWORD Flags +); + +PCSTR +IMAGEAPI +SymSrvStoreFile( + __in HANDLE hProcess, + __in_opt PCSTR SrvPath, + __in PCSTR File, + __in DWORD Flags +); + +PCWSTR +IMAGEAPI +SymSrvStoreFileW( + __in HANDLE hProcess, + __in_opt PCWSTR SrvPath, + __in PCWSTR File, + __in DWORD Flags +); + +// used by SymGetSymbolFile's "Type" parameter + +enum +{ + sfImage = 0, + sfDbg, + sfPdb, + sfMpd, + sfMax +}; + +BOOL +IMAGEAPI +SymGetSymbolFile( + __in_opt HANDLE hProcess, + __in_opt PCSTR SymPath, + __in PCSTR ImageFile, + __in DWORD Type, + __out_ecount(cSymbolFile) PSTR SymbolFile, + __in size_t cSymbolFile, + __out_ecount(cDbgFile) PSTR DbgFile, + __in size_t cDbgFile +); + +BOOL +IMAGEAPI +SymGetSymbolFileW( + __in_opt HANDLE hProcess, + __in_opt PCWSTR SymPath, + __in PCWSTR ImageFile, + __in DWORD Type, + __out_ecount(cSymbolFile) PWSTR SymbolFile, + __in size_t cSymbolFile, + __out_ecount(cDbgFile) PWSTR DbgFile, + __in size_t cDbgFile +); + +// +// Full user-mode dump creation. +// + +typedef BOOL (WINAPI* PDBGHELP_CREATE_USER_DUMP_CALLBACK)( + __in DWORD DataType, + __in PVOID* Data, + __out LPDWORD DataLength, + __in_opt PVOID UserData +); + +BOOL +WINAPI +DbgHelpCreateUserDump( + __in_opt LPCSTR FileName, + __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback, + __in_opt PVOID UserData +); + +BOOL +WINAPI +DbgHelpCreateUserDumpW( + __in_opt LPCWSTR FileName, + __in PDBGHELP_CREATE_USER_DUMP_CALLBACK Callback, + __in_opt PVOID UserData +); + +// ----------------------------------------------------------------- +// The following 4 legacy APIs are fully supported, but newer +// ones are recommended. SymFromName and SymFromAddr provide +// much more detailed info on the returned symbol. + +BOOL +IMAGEAPI +SymGetSymFromAddr64( + __in HANDLE hProcess, + __in DWORD64 qwAddr, + __out_opt PDWORD64 pdwDisplacement, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymFromAddr SymGetSymFromAddr64 +#else +BOOL +IMAGEAPI +SymGetSymFromAddr( + __in HANDLE hProcess, + __in DWORD dwAddr, + __out_opt PDWORD pdwDisplacement, + __inout PIMAGEHLP_SYMBOL Symbol +); +#endif + +// While following two APIs will provide a symbol from a name, +// SymEnumSymbols can provide the same matching information +// for ALL symbols with a matching name, even regular +// expressions. That way you can search across modules +// and differentiate between identically named symbols. + +BOOL +IMAGEAPI +SymGetSymFromName64( + __in HANDLE hProcess, + __in PCSTR Name, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymFromName SymGetSymFromName64 +#else +BOOL +IMAGEAPI +SymGetSymFromName( + __in HANDLE hProcess, + __in PCSTR Name, + __inout PIMAGEHLP_SYMBOL Symbol +); +#endif + + +// Symbol server exports + +typedef BOOL (WINAPI* PSYMBOLSERVERPROC)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPROCA)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPROCW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROC)(PCSTR, PCSTR, PCSTR, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCA)(PCSTR, PCSTR, PCSTR, PSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERBYINDEXPROCW)(PCWSTR, PCWSTR, PCWSTR, PWSTR); +typedef BOOL (WINAPI* PSYMBOLSERVEROPENPROC)(VOID); +typedef BOOL (WINAPI* PSYMBOLSERVERCLOSEPROC)(VOID); +typedef BOOL (WINAPI* PSYMBOLSERVERSETOPTIONSPROC)(UINT_PTR, ULONG64); +typedef BOOL (WINAPI* PSYMBOLSERVERSETOPTIONSWPROC)(UINT_PTR, ULONG64); +typedef BOOL (CALLBACK WINAPI* PSYMBOLSERVERCALLBACKPROC)(UINT_PTR action, ULONG64 data, ULONG64 context); +typedef UINT_PTR(WINAPI* PSYMBOLSERVERGETOPTIONSPROC)(); +typedef BOOL (WINAPI* PSYMBOLSERVERPINGPROC)(PCSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPINGPROCA)(PCSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERPINGPROCW)(PCWSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERGETVERSION)(LPAPI_VERSION); +typedef BOOL (WINAPI* PSYMBOLSERVERDELTANAME)(PCSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERDELTANAMEW)(PCWSTR, PVOID, DWORD, DWORD, PVOID, DWORD, DWORD, PWSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERGETSUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENT)(PCSTR, PCSTR, PCSTR, PSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERSTORESUPPLEMENTW)(PCWSTR, PCWSTR, PCWSTR, PWSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRING)(PVOID, DWORD, DWORD, PSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERGETINDEXSTRINGW)(PVOID, DWORD, DWORD, PWSTR, size_t); +typedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILE)(PCSTR, PCSTR, PVOID, DWORD, DWORD, PSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERSTOREFILEW)(PCWSTR, PCWSTR, PVOID, DWORD, DWORD, PWSTR, size_t, DWORD); +typedef BOOL (WINAPI* PSYMBOLSERVERISSTORE)(PCSTR); +typedef BOOL (WINAPI* PSYMBOLSERVERISSTOREW)(PCWSTR); +typedef DWORD (WINAPI* PSYMBOLSERVERVERSION)(); +typedef BOOL (CALLBACK WINAPI* PSYMBOLSERVERMESSAGEPROC)(UINT_PTR action, ULONG64 data, ULONG64 context); + +#define SYMSRV_VERSION 2 + +#define SSRVOPT_CALLBACK 0x00000001 +#define SSRVOPT_DWORD 0x00000002 +#define SSRVOPT_DWORDPTR 0x00000004 +#define SSRVOPT_GUIDPTR 0x00000008 +#define SSRVOPT_OLDGUIDPTR 0x00000010 +#define SSRVOPT_UNATTENDED 0x00000020 +#define SSRVOPT_NOCOPY 0x00000040 +#define SSRVOPT_GETPATH 0x00000040 +#define SSRVOPT_PARENTWIN 0x00000080 +#define SSRVOPT_PARAMTYPE 0x00000100 +#define SSRVOPT_SECURE 0x00000200 +#define SSRVOPT_TRACE 0x00000400 +#define SSRVOPT_SETCONTEXT 0x00000800 +#define SSRVOPT_PROXY 0x00001000 +#define SSRVOPT_DOWNSTREAM_STORE 0x00002000 +#define SSRVOPT_OVERWRITE 0x00004000 +#define SSRVOPT_RESETTOU 0x00008000 +#define SSRVOPT_CALLBACKW 0x00010000 +#define SSRVOPT_FLAT_DEFAULT_STORE 0x00020000 +#define SSRVOPT_PROXYW 0x00040000 +#define SSRVOPT_MESSAGE 0x00080000 +#define SSRVOPT_SERVICE 0x00100000 // deprecated +#define SSRVOPT_FAVOR_COMPRESSED 0x00200000 +#define SSRVOPT_STRING 0x00400000 +#define SSRVOPT_WINHTTP 0x00800000 +#define SSRVOPT_WININET 0x01000000 + +#define SSRVOPT_MAX 0x0100000 + +#define SSRVOPT_RESET ((ULONG_PTR)-1) + + +#define NUM_SSRVOPTS 30 + +#define SSRVACTION_TRACE 1 +#define SSRVACTION_QUERYCANCEL 2 +#define SSRVACTION_EVENT 3 +#define SSRVACTION_EVENTW 4 +#define SSRVACTION_SIZE 5 + +#define SYMSTOREOPT_COMPRESS 0x01 +#define SYMSTOREOPT_OVERWRITE 0x02 +#define SYMSTOREOPT_RETURNINDEX 0x04 +#define SYMSTOREOPT_POINTER 0x08 +#define SYMSTOREOPT_ALT_INDEX 0x10 +#define SYMSTOREOPT_UNICODE 0x20 +#define SYMSTOREOPT_PASS_IF_EXISTS 0x40 + +#ifdef DBGHELP_TRANSLATE_TCHAR +#define SymInitialize SymInitializeW +#define SymAddSymbol SymAddSymbolW +#define SymDeleteSymbol SymDeleteSymbolW +#define SearchTreeForFile SearchTreeForFileW +#define UnDecorateSymbolName UnDecorateSymbolNameW +#define SymGetLineFromName64 SymGetLineFromNameW64 +#define SymGetLineFromAddr64 SymGetLineFromAddrW64 +#define SymGetLineNext64 SymGetLineNextW64 +#define SymGetLinePrev64 SymGetLinePrevW64 +#define SymFromName SymFromNameW +#define SymFindExecutableImage SymFindExecutableImageW +#define FindExecutableImageEx FindExecutableImageExW +#define SymSearch SymSearchW +#define SymEnumLines SymEnumLinesW +#define SymEnumSourceLines SymEnumSourceLinesW +#define SymGetTypeFromName SymGetTypeFromNameW +#define SymEnumSymbolsForAddr SymEnumSymbolsForAddrW +#define SymFromAddr SymFromAddrW +#define SymMatchString SymMatchStringW +#define SymEnumSourceFiles SymEnumSourceFilesW +#define SymEnumSymbols SymEnumSymbolsW +#define SymLoadModuleEx SymLoadModuleExW +#define SymSetSearchPath SymSetSearchPathW +#define SymGetSearchPath SymGetSearchPathW +#define EnumDirTree EnumDirTreeW +#define SymFromToken SymFromTokenW +#define SymFromIndex SymFromIndexW +#define SymGetScope SymGetScopeW +#define SymNext SymNextW +#define SymPrev SymPrevW +#define SymEnumTypes SymEnumTypesW +#define SymEnumTypesByName SymEnumTypesByNameW +#define SymRegisterCallback64 SymRegisterCallbackW64 +#define SymFindDebugInfoFile SymFindDebugInfoFileW +#define FindDebugInfoFileEx FindDebugInfoFileExW +#define SymFindFileInPath SymFindFileInPathW +#define SymEnumerateModules64 SymEnumerateModulesW64 +#define SymSetHomeDirectory SymSetHomeDirectoryW +#define SymGetHomeDirectory SymGetHomeDirectoryW +#define SymGetSourceFile SymGetSourceFileW +#define SymGetSourceFileToken SymGetSourceFileTokenW +#define SymGetSourceFileFromToken SymGetSourceFileFromTokenW +#define SymGetSourceVarFromToken SymGetSourceVarFromTokenW +#define SymGetSourceFileToken SymGetSourceFileTokenW +#define SymGetFileLineOffsets64 SymGetFileLineOffsetsW64 +#define SymFindFileInPath SymFindFileInPathW +#define SymMatchFileName SymMatchFileNameW +#define SymGetSourceFileFromToken SymGetSourceFileFromTokenW +#define SymGetSourceVarFromToken SymGetSourceVarFromTokenW +#define SymGetModuleInfo64 SymGetModuleInfoW64 +#define SymSrvIsStore SymSrvIsStoreW +#define SymSrvDeltaName SymSrvDeltaNameW +#define SymSrvGetSupplement SymSrvGetSupplementW +#define SymSrvStoreSupplement SymSrvStoreSupplementW +#define SymSrvGetFileIndexes SymSrvGetFileIndexes +#define SymSrvGetFileIndexString SymSrvGetFileIndexStringW +#define SymSrvStoreFile SymSrvStoreFileW +#define SymGetSymbolFile SymGetSymbolFileW +#define EnumerateLoadedModules64 EnumerateLoadedModulesW64 +#define EnumerateLoadedModulesEx EnumerateLoadedModulesExW +#define SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW + +#define IMAGEHLP_LINE64 IMAGEHLP_LINEW64 +#define PIMAGEHLP_LINE64 PIMAGEHLP_LINEW64 +#define SYMBOL_INFO SYMBOL_INFOW +#define PSYMBOL_INFO PSYMBOL_INFOW +#define SYMBOL_INFO_PACKAGE SYMBOL_INFO_PACKAGEW +#define PSYMBOL_INFO_PACKAGE PSYMBOL_INFO_PACKAGEW +#define FIND_EXE_FILE_CALLBACK FIND_EXE_FILE_CALLBACKW +#define PFIND_EXE_FILE_CALLBACK PFIND_EXE_FILE_CALLBACKW +#define SYM_ENUMERATESYMBOLS_CALLBACK SYM_ENUMERATESYMBOLS_CALLBACKW +#define PSYM_ENUMERATESYMBOLS_CALLBACK PSYM_ENUMERATESYMBOLS_CALLBACKW +#define SRCCODEINFO SRCCODEINFOW +#define PSRCCODEINFO PSRCCODEINFOW +#define SOURCEFILE SOURCEFILEW +#define PSOURCEFILE PSOURCEFILEW +#define SYM_ENUMSOURECFILES_CALLBACK SYM_ENUMSOURCEFILES_CALLBACKW +#define PSYM_ENUMSOURCEFILES_CALLBACK PSYM_ENUMSOURECFILES_CALLBACKW +#define IMAGEHLP_CBA_EVENT IMAGEHLP_CBA_EVENTW +#define PIMAGEHLP_CBA_EVENT PIMAGEHLP_CBA_EVENTW +#define PENUMDIRTREE_CALLBACK PENUMDIRTREE_CALLBACKW +#define IMAGEHLP_DEFERRED_SYMBOL_LOAD64 IMAGEHLP_DEFERRED_SYMBOL_LOADW64 +#define PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 PIMAGEHLP_DEFERRED_SYMBOL_LOADW64 +#define PFIND_DEBUG_FILE_CALLBACK PFIND_DEBUG_FILE_CALLBACKW +#define PFINDFILEINPATHCALLBACK PFINDFILEINPATHCALLBACKW +#define IMAGEHLP_MODULE64 IMAGEHLP_MODULEW64 +#define PIMAGEHLP_MODULE64 PIMAGEHLP_MODULEW64 +#define SYMSRV_INDEX_INFO SYMSRV_INDEX_INFOW +#define PSYMSRV_INDEX_INFO PSYMSRV_INDEX_INFOW + +#define PSYMBOLSERVERPROC PSYMBOLSERVERPROCW +#define PSYMBOLSERVERPINGPROC PSYMBOLSERVERPINGPROCW +#endif + +// ----------------------------------------------------------------- +// The following APIs exist only for backwards compatibility +// with a pre-release version documented in an MSDN release. + +// You should use SymFindFileInPath if you want to maintain +// future compatibility. + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +FindFileInPath( + __in HANDLE hprocess, + __in PCSTR SearchPath, + __in PCSTR FileName, + __in PVOID id, + __in DWORD two, + __in DWORD three, + __in DWORD flags, + __out_ecount(MAX_PATH + 1) PSTR FilePath +); + +// You should use SymFindFileInPath if you want to maintain +// future compatibility. + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +FindFileInSearchPath( + __in HANDLE hprocess, + __in PCSTR SearchPath, + __in PCSTR FileName, + __in DWORD one, + __in DWORD two, + __in DWORD three, + __out_ecount(MAX_PATH + 1) PSTR FilePath +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumSym( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbols64( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACK64 EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbolsW64( + __in HANDLE hProcess, + __in ULONG64 BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACK64W EnumSymbolsCallback, + __in_opt PVOID UserContext +); + + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymEnumerateSymbols SymEnumerateSymbols64 +#define SymEnumerateSymbolsW SymEnumerateSymbolsW64 +#else +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbols( + __in HANDLE hProcess, + __in ULONG BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACK EnumSymbolsCallback, + __in_opt PVOID UserContext +); + +DBHLP_DEPRECIATED +BOOL +IMAGEAPI +SymEnumerateSymbolsW( + __in HANDLE hProcess, + __in ULONG BaseOfDll, + __in PSYM_ENUMSYMBOLS_CALLBACKW EnumSymbolsCallback, + __in_opt PVOID UserContext +); +#endif + +// use SymLoadModuleEx + +DWORD64 +IMAGEAPI +SymLoadModule64( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCSTR ImageName, + __in_opt PCSTR ModuleName, + __in DWORD64 BaseOfDll, + __in DWORD SizeOfDll +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymLoadModule SymLoadModule64 +#else +DWORD +IMAGEAPI +SymLoadModule( + __in HANDLE hProcess, + __in_opt HANDLE hFile, + __in_opt PCSTR ImageName, + __in_opt PCSTR ModuleName, + __in DWORD BaseOfDll, + __in DWORD SizeOfDll +); +#endif + +BOOL +IMAGEAPI +SymGetSymNext64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + +BOOL +IMAGEAPI +SymGetSymNextW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW64 Symbol +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymNext SymGetSymNext64 +#define SymGetSymNextW SymGetSymNextW64 +#else +BOOL +IMAGEAPI +SymGetSymNext( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL Symbol +); + +BOOL +IMAGEAPI +SymGetSymNextW( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW Symbol +); +#endif + +BOOL +IMAGEAPI +SymGetSymPrev64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL64 Symbol +); + +BOOL +IMAGEAPI +SymGetSymPrevW64( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW64 Symbol +); + +#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) +#define SymGetSymPrev SymGetSymPrev64 +#define SymGetSymPrevW SymGetSymPrevW64 +#else +BOOL +IMAGEAPI +SymGetSymPrev( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOL Symbol +); + +BOOL +IMAGEAPI +SymGetSymPrevW( + __in HANDLE hProcess, + __inout PIMAGEHLP_SYMBOLW Symbol +); +#endif + + +// These values should not be used. +// They have been replaced by SYMFLAG_ values. + +#define SYMF_OMAP_GENERATED 0x00000001 +#define SYMF_OMAP_MODIFIED 0x00000002 +#define SYMF_REGISTER 0x00000008 +#define SYMF_REGREL 0x00000010 +#define SYMF_FRAMEREL 0x00000020 +#define SYMF_PARAMETER 0x00000040 +#define SYMF_LOCAL 0x00000080 +#define SYMF_CONSTANT 0x00000100 +#define SYMF_EXPORT 0x00000200 +#define SYMF_FORWARDER 0x00000400 +#define SYMF_FUNCTION 0x00000800 +#define SYMF_VIRTUAL 0x00001000 +#define SYMF_THUNK 0x00002000 +#define SYMF_TLSREL 0x00004000 + +// These values should also not be used. +// They have been replaced by SYMFLAG_ values. + +#define IMAGEHLP_SYMBOL_INFO_VALUEPRESENT 1 +#define IMAGEHLP_SYMBOL_INFO_REGISTER SYMF_REGISTER // 0x0008 +#define IMAGEHLP_SYMBOL_INFO_REGRELATIVE SYMF_REGREL // 0x0010 +#define IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE SYMF_FRAMEREL // 0x0020 +#define IMAGEHLP_SYMBOL_INFO_PARAMETER SYMF_PARAMETER // 0x0040 +#define IMAGEHLP_SYMBOL_INFO_LOCAL SYMF_LOCAL // 0x0080 +#define IMAGEHLP_SYMBOL_INFO_CONSTANT SYMF_CONSTANT // 0x0100 +#define IMAGEHLP_SYMBOL_FUNCTION SYMF_FUNCTION // 0x0800 +#define IMAGEHLP_SYMBOL_VIRTUAL SYMF_VIRTUAL // 0x1000 +#define IMAGEHLP_SYMBOL_THUNK SYMF_THUNK // 0x2000 +#define IMAGEHLP_SYMBOL_INFO_TLSRELATIVE SYMF_TLSREL // 0x4000 + +#pragma pack(pop) + + +#pragma pack(push,4) + +#define MINIDUMP_SIGNATURE ('PMDM') +#define MINIDUMP_VERSION (42899) +typedef DWORD RVA; +typedef ULONG64 RVA64; + +typedef struct _MINIDUMP_LOCATION_DESCRIPTOR +{ + ULONG32 DataSize; + RVA Rva; +} MINIDUMP_LOCATION_DESCRIPTOR; + +typedef struct _MINIDUMP_LOCATION_DESCRIPTOR64 +{ + ULONG64 DataSize; + RVA64 Rva; +} MINIDUMP_LOCATION_DESCRIPTOR64; + + +typedef struct _MINIDUMP_MEMORY_DESCRIPTOR +{ + ULONG64 StartOfMemoryRange; + MINIDUMP_LOCATION_DESCRIPTOR Memory; +} MINIDUMP_MEMORY_DESCRIPTOR, *PMINIDUMP_MEMORY_DESCRIPTOR; + +// DESCRIPTOR64 is used for full-memory minidumps where +// all of the raw memory is laid out sequentially at the +// end of the dump. There is no need for individual RVAs +// as the RVA is the base RVA plus the sum of the preceeding +// data blocks. +typedef struct _MINIDUMP_MEMORY_DESCRIPTOR64 +{ + ULONG64 StartOfMemoryRange; + ULONG64 DataSize; +} MINIDUMP_MEMORY_DESCRIPTOR64, *PMINIDUMP_MEMORY_DESCRIPTOR64; + + +typedef struct _MINIDUMP_HEADER +{ + ULONG32 Signature; + ULONG32 Version; + ULONG32 NumberOfStreams; + RVA StreamDirectoryRva; + ULONG32 CheckSum; + union + { + ULONG32 Reserved; + ULONG32 TimeDateStamp; + }; + ULONG64 Flags; +} MINIDUMP_HEADER, *PMINIDUMP_HEADER; + +// +// The MINIDUMP_HEADER field StreamDirectoryRva points to +// an array of MINIDUMP_DIRECTORY structures. +// + +typedef struct _MINIDUMP_DIRECTORY +{ + ULONG32 StreamType; + MINIDUMP_LOCATION_DESCRIPTOR Location; +} MINIDUMP_DIRECTORY, *PMINIDUMP_DIRECTORY; + + +typedef struct _MINIDUMP_STRING +{ + ULONG32 Length; // Length in bytes of the string + WCHAR Buffer [0]; // Variable size buffer +} MINIDUMP_STRING, *PMINIDUMP_STRING; + + + +// +// The MINIDUMP_DIRECTORY field StreamType may be one of the following types. +// Types will be added in the future, so if a program reading the minidump +// header encounters a stream type it does not understand it should ignore +// the data altogether. Any tag above LastReservedStream will not be used by +// the system and is reserved for program-specific information. +// + +typedef enum _MINIDUMP_STREAM_TYPE +{ + + UnusedStream = 0, + ReservedStream0 = 1, + ReservedStream1 = 2, + ThreadListStream = 3, + ModuleListStream = 4, + MemoryListStream = 5, + ExceptionStream = 6, + SystemInfoStream = 7, + ThreadExListStream = 8, + Memory64ListStream = 9, + CommentStreamA = 10, + CommentStreamW = 11, + HandleDataStream = 12, + FunctionTableStream = 13, + UnloadedModuleListStream = 14, + MiscInfoStream = 15, + MemoryInfoListStream = 16, + ThreadInfoListStream = 17, + HandleOperationListStream = 18, + TokenStream = 19, + + ceStreamNull = 0x8000, + ceStreamSystemInfo = 0x8001, + ceStreamException = 0x8002, + ceStreamModuleList = 0x8003, + ceStreamProcessList = 0x8004, + ceStreamThreadList = 0x8005, + ceStreamThreadContextList = 0x8006, + ceStreamThreadCallStackList = 0x8007, + ceStreamMemoryVirtualList = 0x8008, + ceStreamMemoryPhysicalList = 0x8009, + ceStreamBucketParameters = 0x800A, + ceStreamProcessModuleMap = 0x800B, + ceStreamDiagnosisList = 0x800C, + + LastReservedStream = 0xffff + +} MINIDUMP_STREAM_TYPE; + + +// +// The minidump system information contains processor and +// Operating System specific information. +// + +// +// CPU information is obtained from one of two places. +// +// 1) On x86 computers, CPU_INFORMATION is obtained from the CPUID +// instruction. You must use the X86 portion of the union for X86 +// computers. +// +// 2) On non-x86 architectures, CPU_INFORMATION is obtained by calling +// IsProcessorFeatureSupported(). +// + +typedef union _CPU_INFORMATION +{ + + // + // X86 platforms use CPUID function to obtain processor information. + // + + struct + { + + // + // CPUID Subfunction 0, register EAX (VendorId [0]), + // EBX (VendorId [1]) and ECX (VendorId [2]). + // + + ULONG32 VendorId [ 3 ]; + + // + // CPUID Subfunction 1, register EAX + // + + ULONG32 VersionInformation; + + // + // CPUID Subfunction 1, register EDX + // + + ULONG32 FeatureInformation; + + + // + // CPUID, Subfunction 80000001, register EBX. This will only + // be obtained if the vendor id is "AuthenticAMD". + // + + ULONG32 AMDExtendedCpuFeatures; + + } X86CpuInfo; + + // + // Non-x86 platforms use processor feature flags. + // + + struct + { + + ULONG64 ProcessorFeatures [ 2 ]; + + } OtherCpuInfo; + +} CPU_INFORMATION, *PCPU_INFORMATION; + +typedef struct _MINIDUMP_SYSTEM_INFO +{ + + // + // ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all + // taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ). + // + + USHORT ProcessorArchitecture; + USHORT ProcessorLevel; + USHORT ProcessorRevision; + + union + { + USHORT Reserved0; + struct + { + UCHAR NumberOfProcessors; + UCHAR ProductType; + }; + }; + + // + // MajorVersion, MinorVersion, BuildNumber, PlatformId and + // CSDVersion are all taken from the OSVERSIONINFO structure + // returned by GetVersionEx( ). + // + + ULONG32 MajorVersion; + ULONG32 MinorVersion; + ULONG32 BuildNumber; + ULONG32 PlatformId; + + // + // RVA to a CSDVersion string in the string table. + // + + RVA CSDVersionRva; + + union + { + ULONG32 Reserved1; + struct + { + USHORT SuiteMask; + USHORT Reserved2; + }; + }; + + CPU_INFORMATION Cpu; + +} MINIDUMP_SYSTEM_INFO, *PMINIDUMP_SYSTEM_INFO; + + +// +// The minidump thread contains standard thread +// information plus an RVA to the memory for this +// thread and an RVA to the CONTEXT structure for +// this thread. +// + + +// +// ThreadId must be 4 bytes on all architectures. +// + +C_ASSERT(sizeof(((PPROCESS_INFORMATION)0)->dwThreadId) == 4); + +typedef struct _MINIDUMP_THREAD +{ + ULONG32 ThreadId; + ULONG32 SuspendCount; + ULONG32 PriorityClass; + ULONG32 Priority; + ULONG64 Teb; + MINIDUMP_MEMORY_DESCRIPTOR Stack; + MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; +} MINIDUMP_THREAD, *PMINIDUMP_THREAD; + +// +// The thread list is a container of threads. +// + +typedef struct _MINIDUMP_THREAD_LIST +{ + ULONG32 NumberOfThreads; + MINIDUMP_THREAD Threads [0]; +} MINIDUMP_THREAD_LIST, *PMINIDUMP_THREAD_LIST; + + +typedef struct _MINIDUMP_THREAD_EX +{ + ULONG32 ThreadId; + ULONG32 SuspendCount; + ULONG32 PriorityClass; + ULONG32 Priority; + ULONG64 Teb; + MINIDUMP_MEMORY_DESCRIPTOR Stack; + MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; + MINIDUMP_MEMORY_DESCRIPTOR BackingStore; +} MINIDUMP_THREAD_EX, *PMINIDUMP_THREAD_EX; + +// +// The thread list is a container of threads. +// + +typedef struct _MINIDUMP_THREAD_EX_LIST +{ + ULONG32 NumberOfThreads; + MINIDUMP_THREAD_EX Threads [0]; +} MINIDUMP_THREAD_EX_LIST, *PMINIDUMP_THREAD_EX_LIST; + + +// +// The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64. +// + +typedef struct _MINIDUMP_EXCEPTION +{ + ULONG32 ExceptionCode; + ULONG32 ExceptionFlags; + ULONG64 ExceptionRecord; + ULONG64 ExceptionAddress; + ULONG32 NumberParameters; + ULONG32 __unusedAlignment; + ULONG64 ExceptionInformation [ EXCEPTION_MAXIMUM_PARAMETERS ]; +} MINIDUMP_EXCEPTION, *PMINIDUMP_EXCEPTION; + + +// +// The exception information stream contains the id of the thread that caused +// the exception (ThreadId), the exception record for the exception +// (ExceptionRecord) and an RVA to the thread context where the exception +// occured. +// + +typedef struct MINIDUMP_EXCEPTION_STREAM +{ + ULONG32 ThreadId; + ULONG32 __alignment; + MINIDUMP_EXCEPTION ExceptionRecord; + MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; +} MINIDUMP_EXCEPTION_STREAM, *PMINIDUMP_EXCEPTION_STREAM; + + +// +// The MINIDUMP_MODULE contains information about a +// a specific module. It includes the CheckSum and +// the TimeDateStamp for the module so the module +// can be reloaded during the analysis phase. +// + +typedef struct _MINIDUMP_MODULE +{ + ULONG64 BaseOfImage; + ULONG32 SizeOfImage; + ULONG32 CheckSum; + ULONG32 TimeDateStamp; + RVA ModuleNameRva; + VS_FIXEDFILEINFO VersionInfo; + MINIDUMP_LOCATION_DESCRIPTOR CvRecord; + MINIDUMP_LOCATION_DESCRIPTOR MiscRecord; + ULONG64 Reserved0; // Reserved for future use. + ULONG64 Reserved1; // Reserved for future use. +} MINIDUMP_MODULE, *PMINIDUMP_MODULE; + + +// +// The minidump module list is a container for modules. +// + +typedef struct _MINIDUMP_MODULE_LIST +{ + ULONG32 NumberOfModules; + MINIDUMP_MODULE Modules [ 0 ]; +} MINIDUMP_MODULE_LIST, *PMINIDUMP_MODULE_LIST; + + +// +// Memory Ranges +// + +typedef struct _MINIDUMP_MEMORY_LIST +{ + ULONG32 NumberOfMemoryRanges; + MINIDUMP_MEMORY_DESCRIPTOR MemoryRanges [0]; +} MINIDUMP_MEMORY_LIST, *PMINIDUMP_MEMORY_LIST; + +typedef struct _MINIDUMP_MEMORY64_LIST +{ + ULONG64 NumberOfMemoryRanges; + RVA64 BaseRva; + MINIDUMP_MEMORY_DESCRIPTOR64 MemoryRanges [0]; +} MINIDUMP_MEMORY64_LIST, *PMINIDUMP_MEMORY64_LIST; + + +// +// Support for user supplied exception information. +// + +typedef struct _MINIDUMP_EXCEPTION_INFORMATION +{ + DWORD ThreadId; + PEXCEPTION_POINTERS ExceptionPointers; + BOOL ClientPointers; +} MINIDUMP_EXCEPTION_INFORMATION, *PMINIDUMP_EXCEPTION_INFORMATION; + +typedef struct _MINIDUMP_EXCEPTION_INFORMATION64 +{ + DWORD ThreadId; + ULONG64 ExceptionRecord; + ULONG64 ContextRecord; + BOOL ClientPointers; +} MINIDUMP_EXCEPTION_INFORMATION64, *PMINIDUMP_EXCEPTION_INFORMATION64; + + +// +// Support for capturing system handle state at the time of the dump. +// + +// Per-handle object information varies according to +// the OS, the OS version, the processor type and +// so on. The minidump gives a minidump identifier +// to each possible data format for identification +// purposes but does not control nor describe the actual data. +typedef enum _MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE +{ + MiniHandleObjectInformationNone, + MiniThreadInformation1, + MiniMutantInformation1, + MiniMutantInformation2, + MiniProcessInformation1, + MiniProcessInformation2, + MiniHandleObjectInformationTypeMax +} MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE; + +typedef struct _MINIDUMP_HANDLE_OBJECT_INFORMATION +{ + RVA NextInfoRva; + ULONG32 InfoType; + ULONG32 SizeOfInfo; + // Raw information follows. +} MINIDUMP_HANDLE_OBJECT_INFORMATION; + +typedef struct _MINIDUMP_HANDLE_DESCRIPTOR +{ + ULONG64 Handle; + RVA TypeNameRva; + RVA ObjectNameRva; + ULONG32 Attributes; + ULONG32 GrantedAccess; + ULONG32 HandleCount; + ULONG32 PointerCount; +} MINIDUMP_HANDLE_DESCRIPTOR, *PMINIDUMP_HANDLE_DESCRIPTOR; + +typedef struct _MINIDUMP_HANDLE_DESCRIPTOR_2 +{ + ULONG64 Handle; + RVA TypeNameRva; + RVA ObjectNameRva; + ULONG32 Attributes; + ULONG32 GrantedAccess; + ULONG32 HandleCount; + ULONG32 PointerCount; + RVA ObjectInfoRva; + ULONG32 Reserved0; +} MINIDUMP_HANDLE_DESCRIPTOR_2, *PMINIDUMP_HANDLE_DESCRIPTOR_2; + +// The latest MINIDUMP_HANDLE_DESCRIPTOR definition. +typedef MINIDUMP_HANDLE_DESCRIPTOR_2 MINIDUMP_HANDLE_DESCRIPTOR_N; +typedef MINIDUMP_HANDLE_DESCRIPTOR_N* PMINIDUMP_HANDLE_DESCRIPTOR_N; + +typedef struct _MINIDUMP_HANDLE_DATA_STREAM +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfDescriptor; + ULONG32 NumberOfDescriptors; + ULONG32 Reserved; +} MINIDUMP_HANDLE_DATA_STREAM, *PMINIDUMP_HANDLE_DATA_STREAM; + +// Some operating systems can track the last operations +// performed on a handle. For example, Application Verifier +// can enable this for some versions of Windows. The +// handle operation list collects handle operations +// known for the dump target. +// Each entry is an AVRF_HANDLE_OPERATION. +typedef struct _MINIDUMP_HANDLE_OPERATION_LIST +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfEntry; + ULONG32 NumberOfEntries; + ULONG32 Reserved; +} MINIDUMP_HANDLE_OPERATION_LIST, *PMINIDUMP_HANDLE_OPERATION_LIST; + + +// +// Support for capturing dynamic function table state at the time of the dump. +// + +typedef struct _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR +{ + ULONG64 MinimumAddress; + ULONG64 MaximumAddress; + ULONG64 BaseAddress; + ULONG32 EntryCount; + ULONG32 SizeOfAlignPad; +} MINIDUMP_FUNCTION_TABLE_DESCRIPTOR, *PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR; + +typedef struct _MINIDUMP_FUNCTION_TABLE_STREAM +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfDescriptor; + ULONG32 SizeOfNativeDescriptor; + ULONG32 SizeOfFunctionEntry; + ULONG32 NumberOfDescriptors; + ULONG32 SizeOfAlignPad; +} MINIDUMP_FUNCTION_TABLE_STREAM, *PMINIDUMP_FUNCTION_TABLE_STREAM; + + +// +// The MINIDUMP_UNLOADED_MODULE contains information about a +// a specific module that was previously loaded but no +// longer is. This can help with diagnosing problems where +// callers attempt to call code that is no longer loaded. +// + +typedef struct _MINIDUMP_UNLOADED_MODULE +{ + ULONG64 BaseOfImage; + ULONG32 SizeOfImage; + ULONG32 CheckSum; + ULONG32 TimeDateStamp; + RVA ModuleNameRva; +} MINIDUMP_UNLOADED_MODULE, *PMINIDUMP_UNLOADED_MODULE; + + +// +// The minidump unloaded module list is a container for unloaded modules. +// + +typedef struct _MINIDUMP_UNLOADED_MODULE_LIST +{ + ULONG32 SizeOfHeader; + ULONG32 SizeOfEntry; + ULONG32 NumberOfEntries; +} MINIDUMP_UNLOADED_MODULE_LIST, *PMINIDUMP_UNLOADED_MODULE_LIST; + + +// +// The miscellaneous information stream contains a variety +// of small pieces of information. A member is valid if +// it's within the available size and its corresponding +// bit is set. +// + +#define MINIDUMP_MISC1_PROCESS_ID 0x00000001 +#define MINIDUMP_MISC1_PROCESS_TIMES 0x00000002 +#define MINIDUMP_MISC1_PROCESSOR_POWER_INFO 0x00000004 +#define MINIDUMP_MISC3_PROCESS_INTEGRITY 0x00000010 +#define MINIDUMP_MISC3_PROCESS_EXECUTE_FLAGS 0x00000020 +#define MINIDUMP_MISC3_TIMEZONE 0x00000040 +#define MINIDUMP_MISC3_PROTECTED_PROCESS 0x00000080 + +typedef struct _MINIDUMP_MISC_INFO +{ + ULONG32 SizeOfInfo; + ULONG32 Flags1; + ULONG32 ProcessId; + ULONG32 ProcessCreateTime; + ULONG32 ProcessUserTime; + ULONG32 ProcessKernelTime; +} MINIDUMP_MISC_INFO, *PMINIDUMP_MISC_INFO; + +typedef struct _MINIDUMP_MISC_INFO_2 +{ + ULONG32 SizeOfInfo; + ULONG32 Flags1; + ULONG32 ProcessId; + ULONG32 ProcessCreateTime; + ULONG32 ProcessUserTime; + ULONG32 ProcessKernelTime; + ULONG32 ProcessorMaxMhz; + ULONG32 ProcessorCurrentMhz; + ULONG32 ProcessorMhzLimit; + ULONG32 ProcessorMaxIdleState; + ULONG32 ProcessorCurrentIdleState; +} MINIDUMP_MISC_INFO_2, *PMINIDUMP_MISC_INFO_2; + +typedef struct _MINIDUMP_MISC_INFO_3 +{ + ULONG32 SizeOfInfo; + ULONG32 Flags1; + ULONG32 ProcessId; + ULONG32 ProcessCreateTime; + ULONG32 ProcessUserTime; + ULONG32 ProcessKernelTime; + ULONG32 ProcessorMaxMhz; + ULONG32 ProcessorCurrentMhz; + ULONG32 ProcessorMhzLimit; + ULONG32 ProcessorMaxIdleState; + ULONG32 ProcessorCurrentIdleState; + ULONG32 ProcessIntegrityLevel; + ULONG32 ProcessExecuteFlags; + ULONG32 ProtectedProcess; + ULONG32 TimeZoneId; + TIME_ZONE_INFORMATION TimeZone; +} MINIDUMP_MISC_INFO_3, *PMINIDUMP_MISC_INFO_3; + +// The latest MINIDUMP_MISC_INFO definition. +typedef MINIDUMP_MISC_INFO_3 MINIDUMP_MISC_INFO_N; +typedef MINIDUMP_MISC_INFO_N* PMINIDUMP_MISC_INFO_N; + + +// +// The memory information stream contains memory region +// description information. This stream corresponds to +// what VirtualQuery would return for the process the +// dump was created for. +// + +typedef struct _MINIDUMP_MEMORY_INFO +{ + ULONG64 BaseAddress; + ULONG64 AllocationBase; + ULONG32 AllocationProtect; + ULONG32 __alignment1; + ULONG64 RegionSize; + ULONG32 State; + ULONG32 Protect; + ULONG32 Type; + ULONG32 __alignment2; +} MINIDUMP_MEMORY_INFO, *PMINIDUMP_MEMORY_INFO; + +typedef struct _MINIDUMP_MEMORY_INFO_LIST +{ + ULONG SizeOfHeader; + ULONG SizeOfEntry; + ULONG64 NumberOfEntries; +} MINIDUMP_MEMORY_INFO_LIST, *PMINIDUMP_MEMORY_INFO_LIST; + + +// +// The memory information stream contains memory region +// description information. This stream corresponds to +// what VirtualQuery would return for the process the +// dump was created for. +// + +// Thread dump writer status flags. +#define MINIDUMP_THREAD_INFO_ERROR_THREAD 0x00000001 +#define MINIDUMP_THREAD_INFO_WRITING_THREAD 0x00000002 +#define MINIDUMP_THREAD_INFO_EXITED_THREAD 0x00000004 +#define MINIDUMP_THREAD_INFO_INVALID_INFO 0x00000008 +#define MINIDUMP_THREAD_INFO_INVALID_CONTEXT 0x00000010 +#define MINIDUMP_THREAD_INFO_INVALID_TEB 0x00000020 + +typedef struct _MINIDUMP_THREAD_INFO +{ + ULONG32 ThreadId; + ULONG32 DumpFlags; + ULONG32 DumpError; + ULONG32 ExitStatus; + ULONG64 CreateTime; + ULONG64 ExitTime; + ULONG64 KernelTime; + ULONG64 UserTime; + ULONG64 StartAddress; + ULONG64 Affinity; +} MINIDUMP_THREAD_INFO, *PMINIDUMP_THREAD_INFO; + +typedef struct _MINIDUMP_THREAD_INFO_LIST +{ + ULONG SizeOfHeader; + ULONG SizeOfEntry; + ULONG NumberOfEntries; +} MINIDUMP_THREAD_INFO_LIST, *PMINIDUMP_THREAD_INFO_LIST; + +// +// Support for token information. +// +typedef struct _MINIDUMP_TOKEN_INFO_HEADER +{ + ULONG TokenSize; // The size of the token structure. + ULONG TokenId; // The PID in NtOpenProcessToken() call or TID in NtOpenThreadToken() call. + ULONG64 TokenHandle; // The handle value returned. +} MINIDUMP_TOKEN_INFO_HEADER, *PMINIDUMP_TOKEN_INFO_HEADER; + +typedef struct _MINIDUMP_TOKEN_INFO_LIST +{ + ULONG TokenListSize; + ULONG TokenListEntries; + ULONG ListHeaderSize; + ULONG ElementHeaderSize; +} MINIDUMP_TOKEN_INFO_LIST, *PMINIDUMP_TOKEN_INFO_LIST; + +// +// Support for arbitrary user-defined information. +// + +typedef struct _MINIDUMP_USER_RECORD +{ + ULONG32 Type; + MINIDUMP_LOCATION_DESCRIPTOR Memory; +} MINIDUMP_USER_RECORD, *PMINIDUMP_USER_RECORD; + + +typedef struct _MINIDUMP_USER_STREAM +{ + ULONG32 Type; + ULONG BufferSize; + PVOID Buffer; + +} MINIDUMP_USER_STREAM, *PMINIDUMP_USER_STREAM; + + +typedef struct _MINIDUMP_USER_STREAM_INFORMATION +{ + ULONG UserStreamCount; + PMINIDUMP_USER_STREAM UserStreamArray; +} MINIDUMP_USER_STREAM_INFORMATION, *PMINIDUMP_USER_STREAM_INFORMATION; + +// +// Callback support. +// + +typedef enum _MINIDUMP_CALLBACK_TYPE +{ + ModuleCallback, + ThreadCallback, + ThreadExCallback, + IncludeThreadCallback, + IncludeModuleCallback, + MemoryCallback, + CancelCallback, + WriteKernelMinidumpCallback, + KernelMinidumpStatusCallback, + RemoveMemoryCallback, + IncludeVmRegionCallback, + IoStartCallback, + IoWriteAllCallback, + IoFinishCallback, + ReadMemoryFailureCallback, + SecondaryFlagsCallback, +} MINIDUMP_CALLBACK_TYPE; + + +typedef struct _MINIDUMP_THREAD_CALLBACK +{ + ULONG ThreadId; + HANDLE ThreadHandle; + CONTEXT Context; + ULONG SizeOfContext; + ULONG64 StackBase; + ULONG64 StackEnd; +} MINIDUMP_THREAD_CALLBACK, *PMINIDUMP_THREAD_CALLBACK; + + +typedef struct _MINIDUMP_THREAD_EX_CALLBACK +{ + ULONG ThreadId; + HANDLE ThreadHandle; + CONTEXT Context; + ULONG SizeOfContext; + ULONG64 StackBase; + ULONG64 StackEnd; + ULONG64 BackingStoreBase; + ULONG64 BackingStoreEnd; +} MINIDUMP_THREAD_EX_CALLBACK, *PMINIDUMP_THREAD_EX_CALLBACK; + + +typedef struct _MINIDUMP_INCLUDE_THREAD_CALLBACK +{ + ULONG ThreadId; +} MINIDUMP_INCLUDE_THREAD_CALLBACK, *PMINIDUMP_INCLUDE_THREAD_CALLBACK; + + +typedef enum _THREAD_WRITE_FLAGS +{ + ThreadWriteThread = 0x0001, + ThreadWriteStack = 0x0002, + ThreadWriteContext = 0x0004, + ThreadWriteBackingStore = 0x0008, + ThreadWriteInstructionWindow = 0x0010, + ThreadWriteThreadData = 0x0020, + ThreadWriteThreadInfo = 0x0040, +} THREAD_WRITE_FLAGS; + +typedef struct _MINIDUMP_MODULE_CALLBACK +{ + PWCHAR FullPath; + ULONG64 BaseOfImage; + ULONG SizeOfImage; + ULONG CheckSum; + ULONG TimeDateStamp; + VS_FIXEDFILEINFO VersionInfo; + PVOID CvRecord; + ULONG SizeOfCvRecord; + PVOID MiscRecord; + ULONG SizeOfMiscRecord; +} MINIDUMP_MODULE_CALLBACK, *PMINIDUMP_MODULE_CALLBACK; + + +typedef struct _MINIDUMP_INCLUDE_MODULE_CALLBACK +{ + ULONG64 BaseOfImage; +} MINIDUMP_INCLUDE_MODULE_CALLBACK, *PMINIDUMP_INCLUDE_MODULE_CALLBACK; + + +typedef enum _MODULE_WRITE_FLAGS +{ + ModuleWriteModule = 0x0001, + ModuleWriteDataSeg = 0x0002, + ModuleWriteMiscRecord = 0x0004, + ModuleWriteCvRecord = 0x0008, + ModuleReferencedByMemory = 0x0010, + ModuleWriteTlsData = 0x0020, + ModuleWriteCodeSegs = 0x0040, +} MODULE_WRITE_FLAGS; + + +typedef struct _MINIDUMP_IO_CALLBACK +{ + HANDLE Handle; + ULONG64 Offset; + PVOID Buffer; + ULONG BufferBytes; +} MINIDUMP_IO_CALLBACK, *PMINIDUMP_IO_CALLBACK; + + +typedef struct _MINIDUMP_READ_MEMORY_FAILURE_CALLBACK +{ + ULONG64 Offset; + ULONG Bytes; + HRESULT FailureStatus; +} MINIDUMP_READ_MEMORY_FAILURE_CALLBACK, +*PMINIDUMP_READ_MEMORY_FAILURE_CALLBACK; + + +typedef struct _MINIDUMP_CALLBACK_INPUT +{ + ULONG ProcessId; + HANDLE ProcessHandle; + ULONG CallbackType; + union + { + HRESULT Status; + MINIDUMP_THREAD_CALLBACK Thread; + MINIDUMP_THREAD_EX_CALLBACK ThreadEx; + MINIDUMP_MODULE_CALLBACK Module; + MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread; + MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule; + MINIDUMP_IO_CALLBACK Io; + MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure; + ULONG SecondaryFlags; + }; +} MINIDUMP_CALLBACK_INPUT, *PMINIDUMP_CALLBACK_INPUT; + +typedef struct _MINIDUMP_CALLBACK_OUTPUT +{ + union + { + ULONG ModuleWriteFlags; + ULONG ThreadWriteFlags; + ULONG SecondaryFlags; + struct + { + ULONG64 MemoryBase; + ULONG MemorySize; + }; + struct + { + BOOL CheckCancel; + BOOL Cancel; + }; + HANDLE Handle; + struct + { + MINIDUMP_MEMORY_INFO VmRegion; + BOOL Continue; + }; + HRESULT Status; + }; +} MINIDUMP_CALLBACK_OUTPUT, *PMINIDUMP_CALLBACK_OUTPUT; + + +// +// A normal minidump contains just the information +// necessary to capture stack traces for all of the +// existing threads in a process. +// +// A minidump with data segments includes all of the data +// sections from loaded modules in order to capture +// global variable contents. This can make the dump much +// larger if many modules have global data. +// +// A minidump with full memory includes all of the accessible +// memory in the process and can be very large. A minidump +// with full memory always has the raw memory data at the end +// of the dump so that the initial structures in the dump can +// be mapped directly without having to include the raw +// memory information. +// +// Stack and backing store memory can be filtered to remove +// data unnecessary for stack walking. This can improve +// compression of stacks and also deletes data that may +// be private and should not be stored in a dump. +// Memory can also be scanned to see what modules are +// referenced by stack and backing store memory to allow +// omission of other modules to reduce dump size. +// In either of these modes the ModuleReferencedByMemory flag +// is set for all modules referenced before the base +// module callbacks occur. +// +// On some operating systems a list of modules that were +// recently unloaded is kept in addition to the currently +// loaded module list. This information can be saved in +// the dump if desired. +// +// Stack and backing store memory can be scanned for referenced +// pages in order to pick up data referenced by locals or other +// stack memory. This can increase the size of a dump significantly. +// +// Module paths may contain undesired information such as user names +// or other important directory names so they can be stripped. This +// option reduces the ability to locate the proper image later +// and should only be used in certain situations. +// +// Complete operating system per-process and per-thread information can +// be gathered and stored in the dump. +// +// The virtual address space can be scanned for various types +// of memory to be included in the dump. +// +// Code which is concerned with potentially private information +// getting into the minidump can set a flag that automatically +// modifies all existing and future flags to avoid placing +// unnecessary data in the dump. Basic data, such as stack +// information, will still be included but optional data, such +// as indirect memory, will not. +// +// When doing a full memory dump it's possible to store all +// of the enumerated memory region descriptive information +// in a memory information stream. +// +// Additional thread information beyond the basic thread +// structure can be collected if desired. +// +// A minidump with code segments includes all of the code +// and code-related sections from loaded modules in order +// to capture executable content. +// +// MiniDumpWithoutAuxiliaryState turns off any secondary, +// auxiliary-supported memory gathering. +// +// MiniDumpWithFullAuxiliaryState asks any present auxiliary +// data providers to include all of their state in the dump. +// The exact set of what is provided depends on the auxiliary. +// This can be quite large. +// + +typedef enum _MINIDUMP_TYPE +{ + MiniDumpNormal = 0x00000000, + MiniDumpWithDataSegs = 0x00000001, + MiniDumpWithFullMemory = 0x00000002, + MiniDumpWithHandleData = 0x00000004, + MiniDumpFilterMemory = 0x00000008, + MiniDumpScanMemory = 0x00000010, + MiniDumpWithUnloadedModules = 0x00000020, + MiniDumpWithIndirectlyReferencedMemory = 0x00000040, + MiniDumpFilterModulePaths = 0x00000080, + MiniDumpWithProcessThreadData = 0x00000100, + MiniDumpWithPrivateReadWriteMemory = 0x00000200, + MiniDumpWithoutOptionalData = 0x00000400, + MiniDumpWithFullMemoryInfo = 0x00000800, + MiniDumpWithThreadInfo = 0x00001000, + MiniDumpWithCodeSegs = 0x00002000, + MiniDumpWithoutAuxiliaryState = 0x00004000, + MiniDumpWithFullAuxiliaryState = 0x00008000, + MiniDumpWithPrivateWriteCopyMemory = 0x00010000, + MiniDumpIgnoreInaccessibleMemory = 0x00020000, + MiniDumpWithTokenInformation = 0x00040000, + MiniDumpValidTypeFlags = 0x0007ffff, +} MINIDUMP_TYPE; + +// +// In addition to the primary flags provided to +// MiniDumpWriteDump there are additional, less +// frequently used options queried via the secondary +// flags callback. +// +// MiniSecondaryWithoutPowerInfo suppresses the minidump +// query that retrieves processor power information for +// MINIDUMP_MISC_INFO. +// + +typedef enum _MINIDUMP_SECONDARY_FLAGS +{ + MiniSecondaryWithoutPowerInfo = 0x00000001, + + MiniSecondaryValidFlags = 0x00000001, +} MINIDUMP_SECONDARY_FLAGS; + + +// +// The minidump callback should modify the FieldsToWrite parameter to reflect +// what portions of the specified thread or module should be written to the +// file. +// + +typedef +BOOL +(WINAPI* MINIDUMP_CALLBACK_ROUTINE)( + __inout PVOID CallbackParam, + __in PMINIDUMP_CALLBACK_INPUT CallbackInput, + __inout PMINIDUMP_CALLBACK_OUTPUT CallbackOutput +); + +typedef struct _MINIDUMP_CALLBACK_INFORMATION +{ + MINIDUMP_CALLBACK_ROUTINE CallbackRoutine; + PVOID CallbackParam; +} MINIDUMP_CALLBACK_INFORMATION, *PMINIDUMP_CALLBACK_INFORMATION; + + + +//++ +// +// PVOID +// RVA_TO_ADDR( +// PVOID Mapping, +// ULONG Rva +// ) +// +// Routine Description: +// +// Map an RVA that is contained within a mapped file to it's associated +// flat address. +// +// Arguments: +// +// Mapping - Base address of mapped file containing the RVA. +// +// Rva - An Rva to fixup. +// +// Return Values: +// +// A pointer to the desired data. +// +//-- + +#define RVA_TO_ADDR(Mapping,Rva) ((PVOID)(((ULONG_PTR) (Mapping)) + (Rva))) + +BOOL +WINAPI +MiniDumpWriteDump( + __in HANDLE hProcess, + __in DWORD ProcessId, + __in HANDLE hFile, + __in MINIDUMP_TYPE DumpType, + __in_opt PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam, + __in_opt PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam, + __in_opt PMINIDUMP_CALLBACK_INFORMATION CallbackParam +); + +BOOL +WINAPI +MiniDumpReadDumpStream( + __in PVOID BaseOfDump, + __in ULONG StreamNumber, + __deref_out_opt PMINIDUMP_DIRECTORY* Dir, + __deref_out_opt PVOID* StreamPointer, + __out_opt ULONG* StreamSize +); + +#pragma pack(pop) + +#ifdef __cplusplus +} +#endif + + +#endif // _DBGHELP_ + diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.a new file mode 100644 index 0000000..feaab5e Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.lib new file mode 100644 index 0000000..3b41ad7 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x64.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.a new file mode 100644 index 0000000..b315933 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.lib new file mode 100644 index 0000000..40b3d7e Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/dbghelp/dbghelp_x86.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson.h b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson.h new file mode 100644 index 0000000..ff5254f --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson.h @@ -0,0 +1,315 @@ +/* + * Copyright (c) 2009-2016 Petri Lehtinen + * + * Jansson is free software; you can redistribute it and/or modify + * it under the terms of the MIT license. See LICENSE for details. + */ + +#ifndef JANSSON_H +#define JANSSON_H + +#include +#include /* for size_t */ +#include + +#include "jansson_config.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* version */ + +#define JANSSON_MAJOR_VERSION 2 +#define JANSSON_MINOR_VERSION 9 +#define JANSSON_MICRO_VERSION 0 + +/* Micro version is omitted if it's 0 */ +#define JANSSON_VERSION "2.9" + +/* Version as a 3-byte hex number, e.g. 0x010201 == 1.2.1. Use this + for numeric comparisons, e.g. #if JANSSON_VERSION_HEX >= ... */ +#define JANSSON_VERSION_HEX ((JANSSON_MAJOR_VERSION << 16) | \ + (JANSSON_MINOR_VERSION << 8) | \ + (JANSSON_MICRO_VERSION << 0)) + + +/* types */ + +typedef enum +{ + JSON_OBJECT, + JSON_ARRAY, + JSON_STRING, + JSON_INTEGER, + JSON_REAL, + JSON_TRUE, + JSON_FALSE, + JSON_NULL +} json_type; + +typedef struct json_t +{ + json_type type; + size_t refcount; +} json_t; + +#ifndef JANSSON_USING_CMAKE /* disabled if using cmake */ +#if JSON_INTEGER_IS_LONG_LONG +#ifdef _WIN32 +#define JSON_INTEGER_FORMAT "I64d" +#else +#define JSON_INTEGER_FORMAT "lld" +#endif +typedef long long json_int_t; +#else +#define JSON_INTEGER_FORMAT "ld" +typedef long json_int_t; +#endif /* JSON_INTEGER_IS_LONG_LONG */ +#endif + +#define json_typeof(json) ((json)->type) +#define json_is_object(json) ((json) && json_typeof(json) == JSON_OBJECT) +#define json_is_array(json) ((json) && json_typeof(json) == JSON_ARRAY) +#define json_is_string(json) ((json) && json_typeof(json) == JSON_STRING) +#define json_is_integer(json) ((json) && json_typeof(json) == JSON_INTEGER) +#define json_is_real(json) ((json) && json_typeof(json) == JSON_REAL) +#define json_is_number(json) (json_is_integer(json) || json_is_real(json)) +#define json_is_true(json) ((json) && json_typeof(json) == JSON_TRUE) +#define json_is_false(json) ((json) && json_typeof(json) == JSON_FALSE) +#define json_boolean_value json_is_true +#define json_is_boolean(json) (json_is_true(json) || json_is_false(json)) +#define json_is_null(json) ((json) && json_typeof(json) == JSON_NULL) + +/* construction, destruction, reference counting */ + +__declspec(dllimport) json_t* json_object(void); +__declspec(dllimport) json_t* json_array(void); +__declspec(dllimport) json_t* json_string(const char* value); +__declspec(dllimport) json_t* json_stringn(const char* value, size_t len); +__declspec(dllimport) json_t* json_string_nocheck(const char* value); +__declspec(dllimport) json_t* json_stringn_nocheck(const char* value, size_t len); +__declspec(dllimport) json_t* json_integer(json_int_t value); +__declspec(dllimport) json_t* json_real(double value); +__declspec(dllimport) json_t* json_true(void); +__declspec(dllimport) json_t* json_false(void); +#define json_boolean(val) ((val) ? json_true() : json_false()) +__declspec(dllimport) json_t* json_null(void); + +static JSON_INLINE +json_t* json_incref(json_t* json) +{ + if(json && json->refcount != (size_t) - 1) + ++json->refcount; + return json; +} + +/* do not call json_delete directly */ +__declspec(dllimport) void json_delete(json_t* json); + +static JSON_INLINE +void json_decref(json_t* json) +{ + if(json && json->refcount != (size_t) - 1 && --json->refcount == 0) + json_delete(json); +} + +#if defined(__GNUC__) || defined(__clang__) +static JSON_INLINE +void json_decrefp(json_t** json) +{ + if(json) + { + json_decref(*json); + *json = NULL; + } +} + +#define json_auto_t json_t __attribute__((cleanup(json_decrefp))) +#endif + + +/* error reporting */ + +#define JSON_ERROR_TEXT_LENGTH 160 +#define JSON_ERROR_SOURCE_LENGTH 80 + +typedef struct +{ + int line; + int column; + int position; + char source[JSON_ERROR_SOURCE_LENGTH]; + char text[JSON_ERROR_TEXT_LENGTH]; +} json_error_t; + + +/* getters, setters, manipulation */ + +__declspec(dllimport) void json_object_seed(size_t seed); +__declspec(dllimport) size_t json_object_size(const json_t* object); +__declspec(dllimport) json_t* json_object_get(const json_t* object, const char* key); +__declspec(dllimport) int json_object_set_new(json_t* object, const char* key, json_t* value); +__declspec(dllimport) int json_object_set_new_nocheck(json_t* object, const char* key, json_t* value); +__declspec(dllimport) int json_object_del(json_t* object, const char* key); +__declspec(dllimport) int json_object_clear(json_t* object); +__declspec(dllimport) int json_object_update(json_t* object, json_t* other); +__declspec(dllimport) int json_object_update_existing(json_t* object, json_t* other); +__declspec(dllimport) int json_object_update_missing(json_t* object, json_t* other); +__declspec(dllimport) void* json_object_iter(json_t* object); +__declspec(dllimport) void* json_object_iter_at(json_t* object, const char* key); +__declspec(dllimport) void* json_object_key_to_iter(const char* key); +__declspec(dllimport) void* json_object_iter_next(json_t* object, void* iter); +__declspec(dllimport) const char* json_object_iter_key(void* iter); +__declspec(dllimport) json_t* json_object_iter_value(void* iter); +__declspec(dllimport) int json_object_iter_set_new(json_t* object, void* iter, json_t* value); + +#define json_object_foreach(object, key, value) \ + for(key = json_object_iter_key(json_object_iter(object)); \ + key && (value = json_object_iter_value(json_object_key_to_iter(key))); \ + key = json_object_iter_key(json_object_iter_next(object, json_object_key_to_iter(key)))) + +#define json_object_foreach_safe(object, n, key, value) \ + for(key = json_object_iter_key(json_object_iter(object)), \ + n = json_object_iter_next(object, json_object_key_to_iter(key)); \ + key && (value = json_object_iter_value(json_object_key_to_iter(key))); \ + key = json_object_iter_key(n), \ + n = json_object_iter_next(object, json_object_key_to_iter(key))) + +#define json_array_foreach(array, index, value) \ + for(index = 0; \ + index < json_array_size(array) && (value = json_array_get(array, index)); \ + index++) + +static JSON_INLINE +int json_object_set(json_t* object, const char* key, json_t* value) +{ + return json_object_set_new(object, key, json_incref(value)); +} + +static JSON_INLINE +int json_object_set_nocheck(json_t* object, const char* key, json_t* value) +{ + return json_object_set_new_nocheck(object, key, json_incref(value)); +} + +static JSON_INLINE +int json_object_iter_set(json_t* object, void* iter, json_t* value) +{ + return json_object_iter_set_new(object, iter, json_incref(value)); +} + +__declspec(dllimport) size_t json_array_size(const json_t* array); +__declspec(dllimport) json_t* json_array_get(const json_t* array, size_t index); +__declspec(dllimport) int json_array_set_new(json_t* array, size_t index, json_t* value); +__declspec(dllimport) int json_array_append_new(json_t* array, json_t* value); +__declspec(dllimport) int json_array_insert_new(json_t* array, size_t index, json_t* value); +__declspec(dllimport) int json_array_remove(json_t* array, size_t index); +__declspec(dllimport) int json_array_clear(json_t* array); +__declspec(dllimport) int json_array_extend(json_t* array, json_t* other); + +static JSON_INLINE +int json_array_set(json_t* array, size_t ind, json_t* value) +{ + return json_array_set_new(array, ind, json_incref(value)); +} + +static JSON_INLINE +int json_array_append(json_t* array, json_t* value) +{ + return json_array_append_new(array, json_incref(value)); +} + +static JSON_INLINE +int json_array_insert(json_t* array, size_t ind, json_t* value) +{ + return json_array_insert_new(array, ind, json_incref(value)); +} + +__declspec(dllimport) const char* json_string_value(const json_t* string); +__declspec(dllimport) size_t json_string_length(const json_t* string); +__declspec(dllimport) json_int_t json_integer_value(const json_t* integer); +__declspec(dllimport) double json_real_value(const json_t* real); +__declspec(dllimport) double json_number_value(const json_t* json); + +__declspec(dllimport) int json_string_set(json_t* string, const char* value); +__declspec(dllimport) int json_string_setn(json_t* string, const char* value, size_t len); +__declspec(dllimport) int json_string_set_nocheck(json_t* string, const char* value); +__declspec(dllimport) int json_string_setn_nocheck(json_t* string, const char* value, size_t len); +__declspec(dllimport) int json_integer_set(json_t* integer, json_int_t value); +__declspec(dllimport) int json_real_set(json_t* real, double value); + +/* pack, unpack */ + +__declspec(dllimport) json_t* json_pack(const char* fmt, ...); +__declspec(dllimport) json_t* json_pack_ex(json_error_t* error, size_t flags, const char* fmt, ...); +__declspec(dllimport) json_t* json_vpack_ex(json_error_t* error, size_t flags, const char* fmt, va_list ap); + +#define JSON_VALIDATE_ONLY 0x1 +#define JSON_STRICT 0x2 + +__declspec(dllimport) int json_unpack(json_t* root, const char* fmt, ...); +__declspec(dllimport) int json_unpack_ex(json_t* root, json_error_t* error, size_t flags, const char* fmt, ...); +__declspec(dllimport) int json_vunpack_ex(json_t* root, json_error_t* error, size_t flags, const char* fmt, va_list ap); + + +/* equality */ + +__declspec(dllimport) int json_equal(json_t* value1, json_t* value2); + + +/* copying */ + +__declspec(dllimport) json_t* json_copy(json_t* value); +__declspec(dllimport) json_t* json_deep_copy(const json_t* value); + + +/* decoding */ + +#define JSON_REJECT_DUPLICATES 0x1 +#define JSON_DISABLE_EOF_CHECK 0x2 +#define JSON_DECODE_ANY 0x4 +#define JSON_DECODE_INT_AS_REAL 0x8 +#define JSON_ALLOW_NUL 0x10 + +typedef size_t (*json_load_callback_t)(void* buffer, size_t buflen, void* data); + +__declspec(dllimport) json_t* json_loads(const char* input, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_loadb(const char* buffer, size_t buflen, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_loadf(FILE* input, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_load_file(const char* path, size_t flags, json_error_t* error); +__declspec(dllimport) json_t* json_load_callback(json_load_callback_t callback, void* data, size_t flags, json_error_t* error); + + +/* encoding */ + +#define JSON_MAX_INDENT 0x1F +#define JSON_INDENT(n) ((n) & JSON_MAX_INDENT) +#define JSON_COMPACT 0x20 +#define JSON_ENSURE_ASCII 0x40 +#define JSON_SORT_KEYS 0x80 +#define JSON_PRESERVE_ORDER 0x100 +#define JSON_ENCODE_ANY 0x200 +#define JSON_ESCAPE_SLASH 0x400 +#define JSON_REAL_PRECISION(n) (((n) & 0x1F) << 11) + +typedef int (*json_dump_callback_t)(const char* buffer, size_t size, void* data); + +__declspec(dllimport) char* json_dumps(const json_t* json, size_t flags); +__declspec(dllimport) int json_dumpf(const json_t* json, FILE* output, size_t flags); +__declspec(dllimport) int json_dump_file(const json_t* json, const char* path, size_t flags); +__declspec(dllimport) int json_dump_callback(const json_t* json, json_dump_callback_t callback, void* data, size_t flags); + +/* custom memory allocation */ + +typedef void* (*json_malloc_t)(size_t); +typedef void (*json_free_t)(void*); + +__declspec(dllimport) void json_set_alloc_funcs(json_malloc_t malloc_fn, json_free_t free_fn); +__declspec(dllimport) void json_get_alloc_funcs(json_malloc_t* malloc_fn, json_free_t* free_fn); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_config.h b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_config.h new file mode 100644 index 0000000..0d8cd11 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_config.h @@ -0,0 +1,68 @@ +/* + * Copyright (c) 2010-2016 Petri Lehtinen + * + * Jansson is free software; you can redistribute it and/or modify + * it under the terms of the MIT license. See LICENSE for details. + * + * + * This file specifies a part of the site-specific configuration for + * Jansson, namely those things that affect the public API in + * jansson.h. + * + * The CMake system will generate the jansson_config.h file and + * copy it to the build and install directories. + */ + +#ifndef JANSSON_CONFIG_H +#define JANSSON_CONFIG_H + +/* Define this so that we can disable scattered automake configuration in source files */ +#ifndef JANSSON_USING_CMAKE +#define JANSSON_USING_CMAKE +#endif + +/* Note: when using cmake, JSON_INTEGER_IS_LONG_LONG is not defined nor used, + * as we will also check for __int64 etc types. + * (the definition was used in the automake system) */ + +/* Bring in the cmake-detected defines */ +#define HAVE_STDINT_H 1 +/* #undef HAVE_INTTYPES_H */ +/* #undef HAVE_SYS_TYPES_H */ + +/* Include our standard type header for the integer typedef */ + +#if defined(HAVE_STDINT_H) +# include +#elif defined(HAVE_INTTYPES_H) +# include +#elif defined(HAVE_SYS_TYPES_H) +# include +#endif + + +/* If your compiler supports the inline keyword in C, JSON_INLINE is + defined to `inline', otherwise empty. In C++, the inline is always + supported. */ +#ifdef __cplusplus +#define JSON_INLINE inline +#else +#define JSON_INLINE __inline +#endif + + +#define json_int_t long long +#define json_strtoint strtoll +#define JSON_INTEGER_FORMAT "I64d" + + +/* If locale.h and localeconv() are available, define to 1, otherwise to 0. */ +#define JSON_HAVE_LOCALECONV 1 + + +/* Maximum recursion depth for parsing JSON input. + This limits the depth of e.g. array-within-array constructions. */ +#define JSON_PARSER_MAX_DEPTH 2048 + + +#endif diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.a new file mode 100644 index 0000000..a2b6376 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.lib new file mode 100644 index 0000000..aa6194b Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64dbg.h b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64dbg.h new file mode 100644 index 0000000..2415bb4 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x64dbg.h @@ -0,0 +1,25 @@ +#pragma once + +#include "jansson.h" + +typedef json_t* JSON; + +static JSON_INLINE +json_t* json_hex(unsigned json_int_t value) +{ + char hexvalue[20]; + sprintf_s(hexvalue, "0x%llX", value); + return json_string(hexvalue); +} + +static JSON_INLINE +unsigned json_int_t json_hex_value(const json_t* hex) +{ + unsigned json_int_t ret = 0; + const char* hexvalue; + hexvalue = json_string_value(hex); + if(!hexvalue) + return 0; + sscanf_s(hexvalue, "0x%llX", &ret); + return ret; +} diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.a new file mode 100644 index 0000000..daf6b8d Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.lib new file mode 100644 index 0000000..c9bfb56 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/jansson/jansson_x86.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4.h b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4.h new file mode 100644 index 0000000..bf8aa8d --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4.h @@ -0,0 +1,252 @@ +/* + LZ4 - Fast LZ compression algorithm + Header File + Copyright (C) 2011-2014, Yann Collet. + BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php) + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following disclaimer + in the documentation and/or other materials provided with the + distribution. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + You can contact the author at : + - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html + - LZ4 source repository : http://code.google.com/p/lz4/ +*/ +#ifndef _LZ4_H +#define _LZ4_H + +#if defined (__cplusplus) +extern "C" +{ +#endif + + +/************************************** + Version +**************************************/ +#define LZ4_VERSION_MAJOR 1 /* for major interface/format changes */ +#define LZ4_VERSION_MINOR 1 /* for minor interface/format changes */ +#define LZ4_VERSION_RELEASE 3 /* for tweaks, bug-fixes, or development */ + + +/************************************** + Compiler Options +**************************************/ +#if (defined(__GNUC__) && defined(__STRICT_ANSI__)) || (defined(_MSC_VER) && !defined(__cplusplus)) /* Visual Studio */ +# define inline __inline /* Visual C is not C99, but supports some kind of inline */ +#endif + + +/************************************** + Simple Functions +**************************************/ + +__declspec(dllimport) int LZ4_compress(const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_decompress_safe(const char* source, char* dest, int inputSize, int maxOutputSize); + +/* +LZ4_compress() : + Compresses 'inputSize' bytes from 'source' into 'dest'. + Destination buffer must be already allocated, + and must be sized to handle worst cases situations (input data not compressible) + Worst case size evaluation is provided by function LZ4_compressBound() + inputSize : Max supported value is LZ4_MAX_INPUT_VALUE + return : the number of bytes written in buffer dest + or 0 if the compression fails + +LZ4_decompress_safe() : + maxOutputSize : is the size of the destination buffer (which must be already allocated) + return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize) + If the source stream is detected malformed, the function will stop decoding and return a negative result. + This function is protected against buffer overflow exploits (never writes outside of output buffer, and never reads outside of input buffer). Therefore, it is protected against malicious data packets +*/ + + +/************************************** + Advanced Functions +**************************************/ +#define LZ4_MAX_INPUT_SIZE 0x7E000000 /* 2 113 929 216 bytes */ +#define LZ4_COMPRESSBOUND(isize) ((unsigned int)(isize) > (unsigned int)LZ4_MAX_INPUT_SIZE ? 0 : (isize) + ((isize)/255) + 16) + +/* +LZ4_compressBound() : + Provides the maximum size that LZ4 may output in a "worst case" scenario (input data not compressible) + primarily useful for memory allocation of output buffer. + inline function is recommended for the general case, + macro is also provided when result needs to be evaluated at compilation (such as stack memory allocation). + + isize : is the input size. Max supported value is LZ4_MAX_INPUT_SIZE + return : maximum output size in a "worst case" scenario + or 0, if input size is too large ( > LZ4_MAX_INPUT_SIZE) +*/ +__declspec(dllimport) int LZ4_compressBound(int isize); + + +/* +LZ4_compress_limitedOutput() : + Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'. + If it cannot achieve it, compression will stop, and result of the function will be zero. + This function never writes outside of provided output buffer. + + inputSize : Max supported value is LZ4_MAX_INPUT_VALUE + maxOutputSize : is the size of the destination buffer (which must be already allocated) + return : the number of bytes written in buffer 'dest' + or 0 if the compression fails +*/ +__declspec(dllimport) int LZ4_compress_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize); + + +/* +LZ4_decompress_fast() : + originalSize : is the original and therefore uncompressed size + return : the number of bytes read from the source buffer (in other words, the compressed size) + If the source stream is malformed, the function will stop decoding and return a negative result. + note : This function is a bit faster than LZ4_decompress_safe() + This function never writes outside of output buffers, but may read beyond input buffer in case of malicious data packet. + Use this function preferably into a trusted environment (data to decode comes from a trusted source). + Destination buffer must be already allocated. Its size must be a minimum of 'outputSize' bytes. +*/ +__declspec(dllimport) int LZ4_decompress_fast(const char* source, char* dest, int originalSize); + + +/* +LZ4_decompress_safe_partial() : + This function decompress a compressed block of size 'inputSize' at position 'source' + into output buffer 'dest' of size 'maxOutputSize'. + The function tries to stop decompressing operation as soon as 'targetOutputSize' has been reached, + reducing decompression time. + return : the number of bytes decoded in the destination buffer (necessarily <= maxOutputSize) + Note : this number can be < 'targetOutputSize' should the compressed block to decode be smaller. + Always control how many bytes were decoded. + If the source stream is detected malformed, the function will stop decoding and return a negative result. + This function never writes outside of output buffer, and never reads outside of input buffer. It is therefore protected against malicious data packets +*/ +__declspec(dllimport) int LZ4_decompress_safe_partial(const char* source, char* dest, int inputSize, int targetOutputSize, int maxOutputSize); + + +/* +These functions are provided should you prefer to allocate memory for compression tables with your own allocation methods. +To know how much memory must be allocated for the compression tables, use : +int LZ4_sizeofState(); + +Note that tables must be aligned on 4-bytes boundaries, otherwise compression will fail (return code 0). + +The allocated memory can be provided to the compressions functions using 'void* state' parameter. +LZ4_compress_withState() and LZ4_compress_limitedOutput_withState() are equivalent to previously described functions. +They just use the externally allocated memory area instead of allocating their own (on stack, or on heap). +*/ +__declspec(dllimport) int LZ4_sizeofState(void); +__declspec(dllimport) int LZ4_compress_withState(void* state, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compress_limitedOutput_withState(void* state, const char* source, char* dest, int inputSize, int maxOutputSize); + + +/************************************** + Streaming Functions +**************************************/ +__declspec(dllimport) void* LZ4_create(const char* inputBuffer); +__declspec(dllimport) int LZ4_compress_continue(void* LZ4_Data, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compress_limitedOutput_continue(void* LZ4_Data, const char* source, char* dest, int inputSize, int maxOutputSize); +__declspec(dllimport) char* LZ4_slideInputBuffer(void* LZ4_Data); +__declspec(dllimport) int LZ4_free(void* LZ4_Data); + +/* +These functions allow the compression of dependent blocks, where each block benefits from prior 64 KB within preceding blocks. +In order to achieve this, it is necessary to start creating the LZ4 Data Structure, thanks to the function : + +void* LZ4_create (const char* inputBuffer); +The result of the function is the (void*) pointer on the LZ4 Data Structure. +This pointer will be needed in all other functions. +If the pointer returned is NULL, then the allocation has failed, and compression must be aborted. +The only parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +All blocks are expected to lay next to each other within the input buffer, starting from 'inputBuffer'. +To compress each block, use either LZ4_compress_continue() or LZ4_compress_limitedOutput_continue(). +Their behavior are identical to LZ4_compress() or LZ4_compress_limitedOutput(), +but require the LZ4 Data Structure as their first argument, and check that each block starts right after the previous one. +If next block does not begin immediately after the previous one, the compression will fail (return 0). + +When it's no longer possible to lay the next block after the previous one (not enough space left into input buffer), a call to : +char* LZ4_slideInputBuffer(void* LZ4_Data); +must be performed. It will typically copy the latest 64KB of input at the beginning of input buffer. +Note that, for this function to work properly, minimum size of an input buffer must be 192KB. +==> The memory position where the next input data block must start is provided as the result of the function. + +Compression can then resume, using LZ4_compress_continue() or LZ4_compress_limitedOutput_continue(), as usual. + +When compression is completed, a call to LZ4_free() will release the memory used by the LZ4 Data Structure. +*/ + + +__declspec(dllimport) int LZ4_sizeofStreamState(void); +__declspec(dllimport) int LZ4_resetStreamState(void* state, const char* inputBuffer); + +/* +These functions achieve the same result as : +void* LZ4_create (const char* inputBuffer); + +They are provided here to allow the user program to allocate memory using its own routines. + +To know how much space must be allocated, use LZ4_sizeofStreamState(); +Note also that space must be 4-bytes aligned. + +Once space is allocated, you must initialize it using : LZ4_resetStreamState(void* state, const char* inputBuffer); +void* state is a pointer to the space allocated. +It must be aligned on 4-bytes boundaries, and be large enough. +The parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +The same space can be re-used multiple times, just by initializing it each time with LZ4_resetStreamState(). +return value of LZ4_resetStreamState() must be 0 is OK. +Any other value means there was an error (typically, pointer is not aligned on 4-bytes boundaries). +*/ + + +__declspec(dllimport) int LZ4_decompress_safe_withPrefix64k(const char* source, char* dest, int inputSize, int maxOutputSize); +__declspec(dllimport) int LZ4_decompress_fast_withPrefix64k(const char* source, char* dest, int outputSize); + +/* +*_withPrefix64k() : + These decoding functions work the same as their "normal name" versions, + but can use up to 64KB of data in front of 'char* dest'. + These functions are necessary to decode inter-dependant blocks. +*/ + + +/************************************** + Obsolete Functions +**************************************/ +/* +These functions are deprecated and should no longer be used. +They are provided here for compatibility with existing user programs. +*/ +__declspec(dllimport) int LZ4_uncompress(const char* source, char* dest, int outputSize); +__declspec(dllimport) int LZ4_uncompress_unknownOutputSize(const char* source, char* dest, int isize, int maxOutputSize); + + +#if defined (__cplusplus) +} +#endif + +#endif //_LZ4_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.a b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.a new file mode 100644 index 0000000..6d38e9b Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.lib b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.lib new file mode 100644 index 0000000..8734cb0 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x64.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.a b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.a new file mode 100644 index 0000000..b712e28 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.a differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.lib b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.lib new file mode 100644 index 0000000..aa96026 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4_x86.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4file.h b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4file.h new file mode 100644 index 0000000..d2a0627 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4file.h @@ -0,0 +1,28 @@ +#ifndef _LZ4FILE_H +#define _LZ4FILE_H + +typedef enum _LZ4_STATUS +{ + LZ4_SUCCESS, + LZ4_FAILED_OPEN_INPUT, + LZ4_FAILED_OPEN_OUTPUT, + LZ4_NOT_ENOUGH_MEMORY, + LZ4_INVALID_ARCHIVE, + LZ4_CORRUPTED_ARCHIVE +} LZ4_STATUS; + +#if defined (__cplusplus) +extern "C" +{ +#endif + +__declspec(dllimport) LZ4_STATUS LZ4_compress_file(const char* input_filename, const char* output_filename); +__declspec(dllimport) LZ4_STATUS LZ4_compress_fileW(const wchar_t* input_filename, const wchar_t* output_filename); +__declspec(dllimport) LZ4_STATUS LZ4_decompress_file(const char* input_filename, const char* output_filename); +__declspec(dllimport) LZ4_STATUS LZ4_decompress_fileW(const wchar_t* input_filename, const wchar_t* output_filename); + +#if defined (__cplusplus) +} +#endif + +#endif //_LZ4FILE_H \ No newline at end of file diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4hc.h b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4hc.h new file mode 100644 index 0000000..08ddb3a --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pluginsdk/lz4/lz4hc.h @@ -0,0 +1,175 @@ +/* + LZ4 HC - High Compression Mode of LZ4 + Header File + Copyright (C) 2011-2014, Yann Collet. + BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php) + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following disclaimer + in the documentation and/or other materials provided with the + distribution. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + You can contact the author at : + - LZ4 homepage : http://fastcompression.blogspot.com/p/lz4.html + - LZ4 source repository : http://code.google.com/p/lz4/ +*/ +#ifndef _LZ4HC_H +#define _LZ4HC_H + +#if defined (__cplusplus) +extern "C" +{ +#endif + + +__declspec(dllimport) int LZ4_compressHC(const char* source, char* dest, int inputSize); +/* +LZ4_compressHC : + return : the number of bytes in compressed buffer dest + or 0 if compression fails. + note : destination buffer must be already allocated. + To avoid any problem, size it to handle worst cases situations (input data not compressible) + Worst case size evaluation is provided by function LZ4_compressBound() (see "lz4.h") +*/ + +__declspec(dllimport) int LZ4_compressHC_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize); +/* +LZ4_compress_limitedOutput() : + Compress 'inputSize' bytes from 'source' into an output buffer 'dest' of maximum size 'maxOutputSize'. + If it cannot achieve it, compression will stop, and result of the function will be zero. + This function never writes outside of provided output buffer. + + inputSize : Max supported value is 1 GB + maxOutputSize : is maximum allowed size into the destination buffer (which must be already allocated) + return : the number of output bytes written in buffer 'dest' + or 0 if compression fails. +*/ + + +__declspec(dllimport) int LZ4_compressHC2(const char* source, char* dest, int inputSize, int compressionLevel); +__declspec(dllimport) int LZ4_compressHC2_limitedOutput(const char* source, char* dest, int inputSize, int maxOutputSize, int compressionLevel); +/* + Same functions as above, but with programmable 'compressionLevel'. + Recommended values are between 4 and 9, although any value between 0 and 16 will work. + 'compressionLevel'==0 means use default 'compressionLevel' value. + Values above 16 behave the same as 16. + Equivalent variants exist for all other compression functions below. +*/ + +/* Note : +Decompression functions are provided within LZ4 source code (see "lz4.h") (BSD license) +*/ + + +/************************************** + Using an external allocation +**************************************/ +__declspec(dllimport) int LZ4_sizeofStateHC(void); +__declspec(dllimport) int LZ4_compressHC_withStateHC(void* state, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compressHC_limitedOutput_withStateHC(void* state, const char* source, char* dest, int inputSize, int maxOutputSize); + +__declspec(dllimport) int LZ4_compressHC2_withStateHC(void* state, const char* source, char* dest, int inputSize, int compressionLevel); +__declspec(dllimport) int LZ4_compressHC2_limitedOutput_withStateHC(void* state, const char* source, char* dest, int inputSize, int maxOutputSize, int compressionLevel); + +/* +These functions are provided should you prefer to allocate memory for compression tables with your own allocation methods. +To know how much memory must be allocated for the compression tables, use : +int LZ4_sizeofStateHC(); + +Note that tables must be aligned for pointer (32 or 64 bits), otherwise compression will fail (return code 0). + +The allocated memory can be provided to the compressions functions using 'void* state' parameter. +LZ4_compress_withStateHC() and LZ4_compress_limitedOutput_withStateHC() are equivalent to previously described functions. +They just use the externally allocated memory area instead of allocating their own (on stack, or on heap). +*/ + + +/************************************** + Streaming Functions +**************************************/ +__declspec(dllimport) void* LZ4_createHC(const char* inputBuffer); +__declspec(dllimport) int LZ4_compressHC_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize); +__declspec(dllimport) int LZ4_compressHC_limitedOutput_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize, int maxOutputSize); +__declspec(dllimport) char* LZ4_slideInputBufferHC(void* LZ4HC_Data); +__declspec(dllimport) int LZ4_freeHC(void* LZ4HC_Data); + +__declspec(dllimport) int LZ4_compressHC2_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize, int compressionLevel); +__declspec(dllimport) int LZ4_compressHC2_limitedOutput_continue(void* LZ4HC_Data, const char* source, char* dest, int inputSize, int maxOutputSize, int compressionLevel); + +/* +These functions allow the compression of dependent blocks, where each block benefits from prior 64 KB within preceding blocks. +In order to achieve this, it is necessary to start creating the LZ4HC Data Structure, thanks to the function : + +void* LZ4_createHC (const char* inputBuffer); +The result of the function is the (void*) pointer on the LZ4HC Data Structure. +This pointer will be needed in all other functions. +If the pointer returned is NULL, then the allocation has failed, and compression must be aborted. +The only parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +All blocks are expected to lay next to each other within the input buffer, starting from 'inputBuffer'. +To compress each block, use either LZ4_compressHC_continue() or LZ4_compressHC_limitedOutput_continue(). +Their behavior are identical to LZ4_compressHC() or LZ4_compressHC_limitedOutput(), +but require the LZ4HC Data Structure as their first argument, and check that each block starts right after the previous one. +If next block does not begin immediately after the previous one, the compression will fail (return 0). + +When it's no longer possible to lay the next block after the previous one (not enough space left into input buffer), a call to : +char* LZ4_slideInputBufferHC(void* LZ4HC_Data); +must be performed. It will typically copy the latest 64KB of input at the beginning of input buffer. +Note that, for this function to work properly, minimum size of an input buffer must be 192KB. +==> The memory position where the next input data block must start is provided as the result of the function. + +Compression can then resume, using LZ4_compressHC_continue() or LZ4_compressHC_limitedOutput_continue(), as usual. + +When compression is completed, a call to LZ4_freeHC() will release the memory used by the LZ4HC Data Structure. +*/ + +__declspec(dllimport) int LZ4_sizeofStreamStateHC(void); +__declspec(dllimport) int LZ4_resetStreamStateHC(void* state, const char* inputBuffer); + +/* +These functions achieve the same result as : +void* LZ4_createHC (const char* inputBuffer); + +They are provided here to allow the user program to allocate memory using its own routines. + +To know how much space must be allocated, use LZ4_sizeofStreamStateHC(); +Note also that space must be aligned for pointers (32 or 64 bits). + +Once space is allocated, you must initialize it using : LZ4_resetStreamStateHC(void* state, const char* inputBuffer); +void* state is a pointer to the space allocated. +It must be aligned for pointers (32 or 64 bits), and be large enough. +The parameter 'const char* inputBuffer' must, obviously, point at the beginning of input buffer. +The input buffer must be already allocated, and size at least 192KB. +'inputBuffer' will also be the 'const char* source' of the first block. + +The same space can be re-used multiple times, just by initializing it each time with LZ4_resetStreamState(). +return value of LZ4_resetStreamStateHC() must be 0 is OK. +Any other value means there was an error (typically, state is not aligned for pointers (32 or 64 bits)). +*/ + + +#if defined (__cplusplus) +} +#endif + +#endif //_LZ4HC_H diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/x32bridge.lib b/BranchTrace-x64plugin-wtl/pluginsdk/x32bridge.lib new file mode 100644 index 0000000..ddf73f8 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/x32bridge.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/x32dbg.lib b/BranchTrace-x64plugin-wtl/pluginsdk/x32dbg.lib new file mode 100644 index 0000000..3d24acf Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/x32dbg.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/x64bridge.lib b/BranchTrace-x64plugin-wtl/pluginsdk/x64bridge.lib new file mode 100644 index 0000000..210f153 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/x64bridge.lib differ diff --git a/BranchTrace-x64plugin-wtl/pluginsdk/x64dbg.lib b/BranchTrace-x64plugin-wtl/pluginsdk/x64dbg.lib new file mode 100644 index 0000000..f8448fd Binary files /dev/null and b/BranchTrace-x64plugin-wtl/pluginsdk/x64dbg.lib differ diff --git a/BranchTrace-x64plugin-wtl/pulgin.cpp b/BranchTrace-x64plugin-wtl/pulgin.cpp new file mode 100644 index 0000000..329d829 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/pulgin.cpp @@ -0,0 +1,123 @@ +#include "plugin.h" +#include "dllmain.h" +#include "stdafx.h" +#include "plugin_global.h" +HWND hwndX64Dbg; +int hMenu; +int hMenuDump; +int pluginHandle; + +/*²å¼þ³õʼ»¯Ê±±»µ÷ÓÃ*/ +DLL_EXPORT bool pluginit(PLUG_INITSTRUCT* initStruct) +{ + pluginHandle = initStruct->pluginHandle; + initStruct->sdkVersion = PLUG_SDKVERSION; + initStruct->pluginVersion = PLUGIN_VERSION; + strcpy_s(initStruct->pluginName, PLUGIN_NAME); + _plugin_registercommand(pluginHandle, PLUGIN_NAME, NULL, false); + return true; +} + + +/* ²å¼þ³õʼ»¯³É¹¦ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct) +{ + hwndX64Dbg = setupStruct->hwndDlg; + hMenu = setupStruct->hMenu; + hMenuDump = setupStruct->hMenuDump; + bool result = true; + + // ×¢²áʼþ»Øµ÷ + _plugin_registercallback(pluginHandle, CB_BREAKPOINT, OnBreakPoint); + _plugin_registercallback(pluginHandle, CB_INITDEBUG, OnInitDebug); + _plugin_registercallback(pluginHandle, CB_STOPDEBUG, OnStopDebug); + + + // ×¢²á²Ëµ¥À¸ + _plugin_menuaddentry(hMenu, AS_MENU_THREAD_TRACE, "Branch Trace"); + _plugin_menuaddentry(hMenu, AS_MENU_TEST, "TEST"); + + // ÉèÖÃͼ±ê + ICONDATA icon; + HRSRC hResPng; + HGLOBAL hResLoad; + + + // ÉèÖÃÒ»¼¶Ö÷²Ëµ¥Í¼±ê + hResPng = FindResource(g_hModule, MAKEINTRESOURCE(IDB_PNG_TRACE), TEXT("PNG")); + hResLoad = LoadResource(g_hModule, hResPng); + icon.data = LockResource(hResLoad); + icon.size = SizeofResource(g_hModule, hResPng); + _plugin_menuseticon(hMenu, (const ICONDATA*)&icon); + + // ÉèÖöþ¼¶²Ëµ¥Í¼±ê + hResPng = FindResource(g_hModule, MAKEINTRESOURCE(IDB_PNG_THREAD), TEXT("PNG")); + hResLoad = LoadResource(g_hModule, hResPng); + icon.data = LockResource(hResLoad); + icon.size = SizeofResource(g_hModule, hResPng); + _plugin_menuentryseticon(pluginHandle, AS_MENU_THREAD_TRACE, &icon); +} + +/* ²å¼þ±»Ð¶Ôغó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT bool plugstop() +{ + _plugin_menuentryremove(pluginHandle, AS_MENU_THREAD_TRACE); + + PluginGlobal* instance = PluginGlobal::GetInstance(); + instance->CloseAll(); + + return true; +} + +/* ²Ëµ¥±»µã»÷ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info) +{ + unsigned char buf[0x10] = { 0 }; + switch (info->hEntry) + { + case AS_MENU_THREAD_TRACE: + { + if (DbgIsDebugging()) { + PluginGlobal* instance = PluginGlobal::GetInstance(); + instance->ShowDlgThreadTrace(); + } + else + { + MessageBox(hwndX64Dbg, TEXT("Not Debugging..."), TEXT("Error"), MB_OK); + + } + break; + } + + case AS_MENU_TEST: + { + PluginGlobal* instance = PluginGlobal::GetInstance(); + if (instance->threadTraceDialog) { + instance->threadTraceDialog->OnBreakDebugPoint(); + } + break; + } + default: + break; + } +} + + +void OnBreakPoint(CBTYPE cbType, void* callbackInfo) { + //BRIDGEBP* breakpointInfo = ((PLUG_CB_BREAKPOINT*)callbackInfo)->breakpoint; + PluginGlobal* instance = PluginGlobal::GetInstance(); + if (instance->threadTraceDialog) { + instance->threadTraceDialog->OnBreakDebugPoint(); + } + +} + +void OnInitDebug(CBTYPE cbType, void* callbackInfo) { + + +} + +void OnStopDebug(CBTYPE cbType, void* callbackInfo) { + + PluginGlobal::GetInstance()->disassembler->Reset(); +} diff --git a/BranchTrace-x64plugin-wtl/res/Thread.png b/BranchTrace-x64plugin-wtl/res/Thread.png new file mode 100644 index 0000000..6dddc0b Binary files /dev/null and b/BranchTrace-x64plugin-wtl/res/Thread.png differ diff --git a/BranchTrace-x64plugin-wtl/res/trace.png b/BranchTrace-x64plugin-wtl/res/trace.png new file mode 100644 index 0000000..12e87e8 Binary files /dev/null and b/BranchTrace-x64plugin-wtl/res/trace.png differ diff --git a/BranchTrace-x64plugin-wtl/resource.h b/BranchTrace-x64plugin-wtl/resource.h new file mode 100644 index 0000000..168fd72 --- /dev/null +++ b/BranchTrace-x64plugin-wtl/resource.h @@ -0,0 +1,41 @@ +//{{NO_DEPENDENCIES}} +// Microsoft Visual C++ generated include file. +// Used by BranchTrace-x64plugin-wtl.rc +// +#define IDB_PNG_THREAD 101 +#define IDB_PNG_TRACE 102 +#define IDD_DIALOG_THREAD_TRACE1 105 +#define IDD_DIALOG_THREAD_TRACE 105 +#define IDC_COMBO1 1002 +#define IDC_COMBO_THREAD 1002 +#define IDC_BUTTON1 1003 +#define IDC_BUTTON_STARTTRACE 1003 +#define IDC_BUTTON2 1004 +#define IDC_BUTTON_RESET 1004 +#define IDC_BUTTON3 1005 +#define IDC_BUTTON_PREV 1005 +#define IDC_BUTTON4 1006 +#define IDC_BUTTON_NEXTINTO 1006 +#define IDC_BUTTON5 1007 +#define IDC_BUTTON_PREVINTO 1007 +#define IDC_SLIDER1 1008 +#define IDC_BUTTON_NEXT 1008 +#define IDC_LIST1 1013 +#define IDC_COMBO_MODULE 1014 +#define IDC_BUTTON_PROCSTART 1017 +#define IDC_BUTTON_PROCEND 1018 +#define IDC_BUTTON_TOEND 1019 +#define IDC_BUTTON_PREV_SNIPPET 1030 +#define IDC_BUTTON_PREVSNIPPET 1030 +#define IDC_BUTTON_NEXTSNIPPET 1031 + +// Next default values for new objects +// +#ifdef APSTUDIO_INVOKED +#ifndef APSTUDIO_READONLY_SYMBOLS +#define _APS_NEXT_RESOURCE_VALUE 111 +#define _APS_NEXT_COMMAND_VALUE 40001 +#define _APS_NEXT_CONTROL_VALUE 1014 +#define _APS_NEXT_SYMED_VALUE 101 +#endif +#endif diff --git a/BranchTrace-x64plugin-wtl/stdafx.h b/BranchTrace-x64plugin-wtl/stdafx.h new file mode 100644 index 0000000..7e203eb --- /dev/null +++ b/BranchTrace-x64plugin-wtl/stdafx.h @@ -0,0 +1,45 @@ +#pragma once + +#define _ATL_USE_CSTRING + +#include +#include +extern CAppModule _Module; +#include +#include +#include +#include +#include + + +#include "resource.h" + + +class CEditImpl : public CWindowImpl +{ + BEGIN_MSG_MAP(CEditImpl) + END_MSG_MAP() +}; + +class CComboBoxImpl : public CWindowImpl +{ + BEGIN_MSG_MAP(CComboBoxImpl) + END_MSG_MAP() +}; + +class CListViewImpl : public CWindowImpl +{ + BEGIN_MSG_MAP(CListViewImpl) + END_MSG_MAP() +}; + +class CButtonImpl :public CWindowImpl +{ + BEGIN_MSG_MAP(CButtonImpl) + END_MSG_MAP() +}; + +class CTrackBarCtrlImpl : public CWindowImpl< CTrackBarCtrlImpl, CTrackBarCtrl> { + BEGIN_MSG_MAP(CTrackBarCtrlImpl) + END_MSG_MAP() +}; diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.aps b/BranchTrace-x64plugin/BranchTrace-x64plugin.aps new file mode 100644 index 0000000..41cba76 Binary files /dev/null and b/BranchTrace-x64plugin/BranchTrace-x64plugin.aps differ diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.cpp b/BranchTrace-x64plugin/BranchTrace-x64plugin.cpp new file mode 100644 index 0000000..53738bd --- /dev/null +++ b/BranchTrace-x64plugin/BranchTrace-x64plugin.cpp @@ -0,0 +1,68 @@ +// BranchTrace-x64plugin.cpp : Defines the initialization routines for the DLL. +// + +#include "pch.h" +#include "framework.h" +#include "BranchTrace-x64plugin.h" +#include "plugin.h" +#include "ThreadTraceDialog.h" + +#ifdef _DEBUG +#define new DEBUG_NEW +#endif + +// +//TODO: If this DLL is dynamically linked against the MFC DLLs, +// any functions exported from this DLL which call into +// MFC must have the AFX_MANAGE_STATE macro added at the +// very beginning of the function. +// +// For example: +// +// extern "C" BOOL PASCAL EXPORT ExportedFunction() +// { +// AFX_MANAGE_STATE(AfxGetStaticModuleState()); +// // normal function body here +// } +// +// It is very important that this macro appear in each +// function, prior to any calls into MFC. This means that +// it must appear as the first statement within the +// function, even before any object variable declarations +// as their constructors may generate calls into the MFC +// DLL. +// +// Please see MFC Technical Notes 33 and 58 for additional +// details. +// + +// CBranchTracex64pluginApp + +BEGIN_MESSAGE_MAP(CBranchTracex64pluginApp, CWinApp) +END_MESSAGE_MAP() + + +// CBranchTracex64pluginApp construction + +CBranchTracex64pluginApp::CBranchTracex64pluginApp() +{ + // TODO: add construction code here, + // Place all significant initialization in InitInstance +} + + +// The one and only CBranchTracex64pluginApp object + +CBranchTracex64pluginApp theApp; + + +// CBranchTracex64pluginApp initialization + +HMODULE g_hModule; +BOOL CBranchTracex64pluginApp::InitInstance() +{ + CWinApp::InitInstance(); + g_hModule =this->m_hInstance; + + return TRUE; +} diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.h b/BranchTrace-x64plugin/BranchTrace-x64plugin.h new file mode 100644 index 0000000..77df12d --- /dev/null +++ b/BranchTrace-x64plugin/BranchTrace-x64plugin.h @@ -0,0 +1,27 @@ +// BranchTrace-x64plugin.h : main header file for the BranchTrace-x64plugin DLL +// + +#pragma once + +#ifndef __AFXWIN_H__ + #error "include 'pch.h' before including this file for PCH" +#endif + +#include "resource.h" // main symbols + + +// CBranchTracex64pluginApp +// See BranchTrace-x64plugin.cpp for the implementation of this class +// + +class CBranchTracex64pluginApp : public CWinApp +{ +public: + CBranchTracex64pluginApp(); + +// Overrides +public: + virtual BOOL InitInstance(); + + DECLARE_MESSAGE_MAP() +}; diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.rc b/BranchTrace-x64plugin/BranchTrace-x64plugin.rc new file mode 100644 index 0000000..6f66668 Binary files /dev/null and b/BranchTrace-x64plugin/BranchTrace-x64plugin.rc differ diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj new file mode 100644 index 0000000..5345910 --- /dev/null +++ b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj @@ -0,0 +1,263 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + {DB6AC0A0-15F8-46A2-B4F5-27F4181EE447} + MFCDLLProj + BranchTracex64plugin + 10.0 + BranchTrace-x64plugin-mfc + + + + DynamicLibrary + true + v142 + MultiByte + Dynamic + + + DynamicLibrary + false + v142 + true + MultiByte + Dynamic + + + DynamicLibrary + true + v142 + MultiByte + Dynamic + + + DynamicLibrary + false + v142 + true + MultiByte + Dynamic + + + + + + + + + + + + + + + + + + + + + false + .dp$(PlatformArchitecture) + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + + + true + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + .dp$(PlatformArchitecture) + + + true + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + .dp$(PlatformArchitecture) + + + false + ..\..\..\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\plugins + .dp$(PlatformArchitecture) + + + + NotUsing + Level3 + true + true + true + _WINDOWS;NDEBUG;_USRDLL;%(PreprocessorDefinitions) + pch.h + + + Windows + true + true + + + + + false + NDEBUG;%(PreprocessorDefinitions) + + + 0x0409 + NDEBUG;%(PreprocessorDefinitions) + $(IntDir);%(AdditionalIncludeDirectories) + + + + + NotUsing + Level3 + true + WIN32;_WINDOWS;_DEBUG;_USRDLL;%(PreprocessorDefinitions) + pch.h + MultiThreadedDebugDLL + Default + EditAndContinue + + + Windows + + + false + + + false + _DEBUG;%(PreprocessorDefinitions) + + + 0x0409 + _DEBUG;%(PreprocessorDefinitions) + $(IntDir);%(AdditionalIncludeDirectories) + + + + + NotUsing + Level3 + true + _WINDOWS;_DEBUG;_USRDLL;%(PreprocessorDefinitions) + pch.h + MultiThreadedDebugDLL + Default + EditAndContinue + + + Windows + + + false + + + false + _DEBUG;%(PreprocessorDefinitions) + + + 0x0409 + _DEBUG;%(PreprocessorDefinitions) + $(IntDir);%(AdditionalIncludeDirectories) + + + + + NotUsing + Level3 + true + true + true + WIN32;_WINDOWS;NDEBUG;_USRDLL;%(PreprocessorDefinitions) + pch.h + + + Windows + true + true + + + + + false + NDEBUG;%(PreprocessorDefinitions) + + + 0x0409 + NDEBUG;%(PreprocessorDefinitions) + $(IntDir);%(AdditionalIncludeDirectories) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.filters b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.filters new file mode 100644 index 0000000..a5fc392 --- /dev/null +++ b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.filters @@ -0,0 +1,161 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + {5c791c3b-b861-42ea-b0ec-3ab5ca302fe4} + + + {c829ae2a-30e2-4106-be41-66a306087b66} + + + + + Resource Files + + + + + Resource Files + + + mfc + + + mfc + + + mfc + + + mfc + + + Source Files + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files + + + Source Files + + + + + Resource Files + + + + + mfc + + + Source Files + + + Source Files + + + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + Source Files\pluginsdk + + + + + Resource Files + + + Resource Files + + + \ No newline at end of file diff --git a/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.user b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.user new file mode 100644 index 0000000..a184711 --- /dev/null +++ b/BranchTrace-x64plugin/BranchTrace-x64plugin.vcxproj.user @@ -0,0 +1,22 @@ + + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsLocalDebugger + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsLocalDebugger + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsLocalDebugger + + + E:\Projects\x64dbg_plugins\x64dbg\x$(PlatformArchitecture)\x$(PlatformArchitecture)dbg.exe + WindowsLocalDebugger + + + BranchTrace-x64plugin.rc + + \ No newline at end of file diff --git a/BranchTrace-x64plugin/ThreadTraceDialog.cpp b/BranchTrace-x64plugin/ThreadTraceDialog.cpp new file mode 100644 index 0000000..e0f507a --- /dev/null +++ b/BranchTrace-x64plugin/ThreadTraceDialog.cpp @@ -0,0 +1,66 @@ +// ThreadTraceDialog.cpp : implementation file +// + +#include "pch.h" +#include "BranchTrace-x64plugin.h" +#include "ThreadTraceDialog.h" +#include "afxdialogex.h" +#include "pluginsdk/bridgemain.h" +#include "pluginsdk/_plugins.h" + + +// ThreadTraceDialog dialog + +IMPLEMENT_DYNAMIC(CThreadTraceDialog, CDialog) + +CThreadTraceDialog::CThreadTraceDialog(CWnd* pParent /*=nullptr*/) + : CDialog(IDD_DIALOG_THREAD_TRACE, pParent) +{ + +} + +CThreadTraceDialog::~CThreadTraceDialog() +{ +} + +void CThreadTraceDialog::DoDataExchange(CDataExchange* pDX) +{ + CDialog::DoDataExchange(pDX); + DDX_Control(pDX, IDC_COMBO_THREAD, threadCombo); +} + + +BEGIN_MESSAGE_MAP(CThreadTraceDialog, CDialog) + ON_CBN_DROPDOWN(IDC_COMBO_THREAD, &CThreadTraceDialog::OnCbnDropdownComboThread) +END_MESSAGE_MAP() + + +// ThreadTraceDialog message handlers + + +void CThreadTraceDialog::OnCbnDropdownComboThread() +{ + // TODO: Add your control notification handler code here + THREADLIST threadList; + DbgGetThreadList(&threadList); + + threadCombo.ResetContent(); + + for (size_t i = 0; i < threadList.count; i++) + { + THREADALLINFO* thread = &threadList.list[i]; + + bool isMainThread = thread->BasicInfo.ThreadNumber == 0; + bool isCurrentThead = i == threadList.CurrentThread; + + CString str; + str.Format("[%d] thread-%x %s %s", i, thread->BasicInfo.ThreadId, isMainThread ? "[main]" : "", isCurrentThead ? "[current]" : ""); + threadCombo.InsertString(i, str); + threadCombo.SetItemData(i, thread->BasicInfo.ThreadId); + + if (isMainThread) { + threadCombo.SetCurSel(i); + } + + } +} diff --git a/BranchTrace-x64plugin/ThreadTraceDialog.h b/BranchTrace-x64plugin/ThreadTraceDialog.h new file mode 100644 index 0000000..771c962 --- /dev/null +++ b/BranchTrace-x64plugin/ThreadTraceDialog.h @@ -0,0 +1,26 @@ +#pragma once + + +// ThreadTraceDialog dialog + +class CThreadTraceDialog : public CDialog +{ + DECLARE_DYNAMIC(CThreadTraceDialog) + +public: + CThreadTraceDialog(CWnd* pParent = nullptr); // standard constructor + virtual ~CThreadTraceDialog(); + +// Dialog Data +#ifdef AFX_DESIGN_TIME + enum { IDD = IDD_DIALOG_THREAD_TRACE }; +#endif + +protected: + virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV support + + DECLARE_MESSAGE_MAP() +public: + CComboBox threadCombo; + afx_msg void OnCbnDropdownComboThread(); +}; diff --git a/BranchTrace-x64plugin/framework.h b/BranchTrace-x64plugin/framework.h new file mode 100644 index 0000000..5175c5a --- /dev/null +++ b/BranchTrace-x64plugin/framework.h @@ -0,0 +1,35 @@ +#pragma once + +#ifndef VC_EXTRALEAN +#define VC_EXTRALEAN // Exclude rarely-used stuff from Windows headers +#endif + +#include "targetver.h" + +#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // some CString constructors will be explicit + +#include // MFC core and standard components +#include // MFC extensions + +#ifndef _AFX_NO_OLE_SUPPORT +#include // MFC OLE classes +#include // MFC OLE dialog classes +#include // MFC Automation classes +#endif // _AFX_NO_OLE_SUPPORT + +#ifndef _AFX_NO_DB_SUPPORT +#include // MFC ODBC database classes +#endif // _AFX_NO_DB_SUPPORT + +#ifndef _AFX_NO_DAO_SUPPORT +#include // MFC DAO database classes +#endif // _AFX_NO_DAO_SUPPORT + +#ifndef _AFX_NO_OLE_SUPPORT +#include // MFC support for Internet Explorer 4 Common Controls +#endif +#ifndef _AFX_NO_AFXCMN_SUPPORT +#include // MFC support for Windows Common Controls +#endif // _AFX_NO_AFXCMN_SUPPORT + + diff --git a/BranchTrace-x64plugin/pch.h b/BranchTrace-x64plugin/pch.h new file mode 100644 index 0000000..885d5d6 --- /dev/null +++ b/BranchTrace-x64plugin/pch.h @@ -0,0 +1,13 @@ +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H diff --git a/BranchTrace-x64plugin/plugin.cpp b/BranchTrace-x64plugin/plugin.cpp new file mode 100644 index 0000000..a981e5a --- /dev/null +++ b/BranchTrace-x64plugin/plugin.cpp @@ -0,0 +1,96 @@ +#include "pch.h" +#include "plugin.h" +#include "Resource.h" +#include "plugin_global.h" + +//#include "resource.h" +//#include "plugin_global.h" + +int hMenu; +int hMenuDump; +int pluginHandle; +HWND g_hwndX64Dbg; + +//HANDLE hBatchCommandThread; +//BatchCommandDlg* dlg; + +void MenuOffsetSearch(); +void ShowDialogThreadTrace(); + + +///*²å¼þ³õʼ»¯Ê±±»µ÷ÓÃ*/ +DLL_EXPORT bool pluginit(PLUG_INITSTRUCT* initStruct) +{ + pluginHandle = initStruct->pluginHandle; + initStruct->sdkVersion = PLUG_SDKVERSION; + initStruct->pluginVersion = PLUGIN_VERSION; + strcpy_s(initStruct->pluginName, PLUGIN_NAME); + _plugin_registercommand(pluginHandle, PLUGIN_NAME, NULL, false); + + //_plugin_registercallback(pluginHandle, CB_INITDEBUG, OnInitDebug); + //_plugin_registercallback(pluginHandle, CB_BREAKPOINT, OnBreakPoint); + + return true; +} + +/* ²å¼þ³õʼ»¯³É¹¦ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct) +{ + g_hwndX64Dbg = setupStruct->hwndDlg; + hMenu = setupStruct->hMenu; + hMenuDump = setupStruct->hMenuDump; + bool result = true; + + + // ×¢²á²Ëµ¥À¸ + _plugin_menuaddentry(hMenu, MENU_THREAD_TRACE, "Thread Trace"); + //_plugin_menuaddentry(hMenu, MENU_POINTER_SCANNER, "Pointer Scanner"); + + // ÉèÖÃͼ±ê + ICONDATA icon; + HRSRC hResPng; + HGLOBAL hResLoad; + + // ÉèÖÃÒ»¼¶Ö÷²Ëµ¥Í¼±ê + hResPng = FindResource(g_hModule, MAKEINTRESOURCE(IDB_PNG_TRACE), TEXT("PNG")); + hResLoad = LoadResource(g_hModule, hResPng); + icon.data = LockResource(hResLoad); + icon.size = SizeofResource(g_hModule, hResPng); + _plugin_menuseticon(hMenu, (const ICONDATA*)&icon); + + // ÉèÖöþ¼¶²Ëµ¥Í¼±ê + hResPng = FindResource(g_hModule, MAKEINTRESOURCE(IDB_PNG_THREAD), TEXT("PNG")); + hResLoad = LoadResource(g_hModule, hResPng); + icon.data = LockResource(hResLoad); + icon.size = SizeofResource(g_hModule, hResPng); + _plugin_menuentryseticon(pluginHandle, MENU_THREAD_TRACE, &icon); + +} + +/* ²å¼þ±»Ð¶Ôغó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT bool plugstop() +{ + _plugin_menuentryremove(pluginHandle, MENU_THREAD_TRACE); + return true; +} + + +/* ²Ëµ¥±»µã»÷ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info) +{ + switch (info->hEntry) + { + case MENU_THREAD_TRACE: + { + ShowDialogThreadTrace(); + break; + } + default: + break; + } +} + +void ShowDialogThreadTrace() +{ + PluginGlobal::GetInstance()->ShowDlgThreadTrace(); +} diff --git a/BranchTrace-x64plugin/plugin.h b/BranchTrace-x64plugin/plugin.h new file mode 100644 index 0000000..ef7eba0 --- /dev/null +++ b/BranchTrace-x64plugin/plugin.h @@ -0,0 +1,38 @@ +#pragma once + +#include +#include "pluginsdk/_plugins.h" +#include "pluginsdk/bridgemain.h" + + +#define PLUGIN_NAME "Branch Trace" +#define PLUGIN_VERSION 1 + +#ifndef DLL_EXPORT +#define DLL_EXPORT __declspec(dllexport) +#endif //DLL_EXPORT + + +enum PLUGIN_MENUS +{ + MENU_THREAD_TRACE +}; + +EXTERN_C_START + +/* ²å¼þ³õʼ»¯³É¹¦ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct); +/* ²å¼þ±»Ð¶Ôغó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT bool plugstop(); +/* ²Ëµ¥±»µã»÷ºó¸Ãº¯Êý»á±»µ÷Óà */ +DLL_EXPORT void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info); +/*²å¼þ³õʼ»¯Ê±±»µ÷ÓÃ*/ +DLL_EXPORT bool pluginit(PLUG_INITSTRUCT* setupStruct); + +EXTERN_C_END + +extern HMODULE g_hModule; +extern HWND g_hwndX64Dbg; + + + diff --git a/BranchTrace-x64plugin/plugin_global.h b/BranchTrace-x64plugin/plugin_global.h new file mode 100644 index 0000000..d328dc7 --- /dev/null +++ b/BranchTrace-x64plugin/plugin_global.h @@ -0,0 +1,45 @@ +#pragma once +#include "pch.h" +#include "ThreadTraceDialog.h" + +class PluginGlobal { + +public: + CThreadTraceDialog* threadTraceDialog; + +private: + PluginGlobal() :threadTraceDialog(NULL) { + AFX_MANAGE_STATE(AfxGetStaticModuleState()); + threadTraceDialog = new CThreadTraceDialog(); + }; + +public: + ~PluginGlobal() { + CloseAll(); + } + +public: + static PluginGlobal* GetInstance() { + static PluginGlobal pluginGlobal; + return &pluginGlobal; + } + + void ShowDlgThreadTrace() { + auto showdlg = [](LPVOID data) -> DWORD { + AFX_MANAGE_STATE(AfxGetStaticModuleState()); + PluginGlobal* pluginglobal = (PluginGlobal*)data; + pluginglobal->threadTraceDialog->DoModal(); + return 0; + }; + + AFX_MANAGE_STATE(AfxGetStaticModuleState()); + HANDLE thread = CreateThread(NULL, 0, showdlg, this, 0, NULL); + if (thread != NULL) { + CloseHandle(thread); + } + }; + + void CloseAll() { + SendMessage(threadTraceDialog->m_hWnd, WM_CLOSE, 0, 0); + } +}; diff --git a/BranchTrace-x64plugin/res/BranchTrace-x64plugin.rc2 b/BranchTrace-x64plugin/res/BranchTrace-x64plugin.rc2 new file mode 100644 index 0000000..0341d2a Binary files /dev/null and b/BranchTrace-x64plugin/res/BranchTrace-x64plugin.rc2 differ diff --git a/BranchTrace-x64plugin/res/Thread.png b/BranchTrace-x64plugin/res/Thread.png new file mode 100644 index 0000000..6dddc0b Binary files /dev/null and b/BranchTrace-x64plugin/res/Thread.png differ diff --git a/BranchTrace-x64plugin/res/trace.png b/BranchTrace-x64plugin/res/trace.png new file mode 100644 index 0000000..12e87e8 Binary files /dev/null and b/BranchTrace-x64plugin/res/trace.png differ diff --git a/BranchTrace-x64plugin/resource.h b/BranchTrace-x64plugin/resource.h new file mode 100644 index 0000000..6fb8a93 --- /dev/null +++ b/BranchTrace-x64plugin/resource.h @@ -0,0 +1,22 @@ +//{{NO_DEPENDENCIES}} +// Microsoft Visual C++ generated include file. +// Used by BranchTrace-x64plugin.rc +// +#define IDB_PNG1 1000 +#define IDB_PNG_TRACE 1000 +#define IDC_COMBO_THREAD 1000 +#define IDB_PNG_THREAD 1001 +#define IDC_BUTTON1 1001 +#define IDD_DIALOG_THREAD_TRACE 1002 +#define IDC_BUTTON3 1003 + +// Next default values for new objects +// +#ifdef APSTUDIO_INVOKED +#ifndef APSTUDIO_READONLY_SYMBOLS +#define _APS_NEXT_RESOURCE_VALUE 1004 +#define _APS_NEXT_COMMAND_VALUE 32771 +#define _APS_NEXT_CONTROL_VALUE 1010 +#define _APS_NEXT_SYMED_VALUE 1000 +#endif +#endif diff --git a/BranchTrace-x64plugin/targetver.h b/BranchTrace-x64plugin/targetver.h new file mode 100644 index 0000000..87c0086 --- /dev/null +++ b/BranchTrace-x64plugin/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// Including SDKDDKVer.h defines the highest available Windows platform. + +// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and +// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. + +#include