Beispiel #1
0
        internal unsafe int GetRegister(
            int index,
            out DEBUG_VALUE value)
        {
            value = new DEBUG_VALUE();

            if (index >= s_registerOffsets.Length)
            {
                return(E_INVALIDARG);
            }
            uint threadId = (uint)SOSHostContext.CurrentThreadId;

            // TODO: Support other architectures
            byte[] buffer = new byte[AMD64Context.Size];
            fixed(byte *ptr = buffer)
            {
                if (!DataReader.GetThreadContext(threadId, uint.MaxValue, (uint)AMD64Context.Size, new IntPtr(ptr)))
                {
                    return(E_FAIL);
                }
                int offset = s_registerOffsets[index];

                value.I64 = *((ulong *)(ptr + offset));
            }

            return(S_OK);
        }
Beispiel #2
0
        internal int GetValue(
            IntPtr self,
            uint register,
            out DEBUG_VALUE value)
        {
            int hr = GetRegister((int)register, out ulong offset);

            // SOS expects the DEBUG_VALUE field to be set based on the
            // processor architecture instead of the register size.
            switch (DataReader.GetPointerSize())
            {
            case 8:
                value = new DEBUG_VALUE {
                    Type = DEBUG_VALUE_TYPE.INT64,
                    I64  = offset
                };
                break;

            case 4:
                value = new DEBUG_VALUE {
                    Type = DEBUG_VALUE_TYPE.INT32,
                    I32  = (uint)offset
                };
                break;

            default:
                value = new DEBUG_VALUE();
                hr    = E_FAIL;
                break;
            }
            return(hr);
        }
            public int Breakpoint(IDebugBreakpoint2 Bp)
            {
                BreakpointHit = true;
                StateChanged  = true;

                if (Bp == pickUpWeaponBreakpoint)
                {
                    IDebugRegisters2Fixed registers = _control as IDebugRegisters2Fixed;
                    CheckHr(registers.GetIndexByName("edx", out uint edxIndex));
                    DEBUG_VALUE edxValue;
                    CheckHr(registers.GetValue(edxIndex, out edxValue));
                    edxValue.I32 = 17;
                    try {
                        CheckHr(registers.SetValue(edxIndex, ref edxValue));
                    } catch (Exception e) {
                        Console.WriteLine(e);
                        throw;
                    }


                    edxValue = new DEBUG_VALUE();
                    CheckHr(registers.GetValue(edxIndex, out edxValue));
                    edxValue.I32 = 17;
                    CheckHr(registers.SetValue(edxIndex, edxValue));

                    return((int)DEBUG_STATUS.GO);
                }

                //return (int) DEBUG_STATUS.NO_CHANGE;
                return((int)DEBUG_STATUS.BREAK);
            }
Beispiel #4
0
 internal int GetValue(
     IntPtr self,
     uint register,
     out DEBUG_VALUE value)
 {
     return(GetRegister((int)register, out value));
 }
Beispiel #5
0
        public Int32 Breakpoint([In, MarshalAs(UnmanagedType.Interface)] IDebugBreakpoint2 bp)
        {
            // Output.Output.Log(Output.LogLevel.Debug, "Breakpoint Hit");
            this.Control.SetExecutionStatus(DEBUG_STATUS.GO_HANDLED);

            CodeTraceInfo codeTraceInfo = new CodeTraceInfo();

            String[] registers;
            Boolean  isProcess32Bit = Processes.Default.IsOpenedProcess32Bit();

            if (isProcess32Bit)
            {
                registers = this.Registers32;
            }
            else
            {
                registers = this.Registers64;
            }

            // Prepare register indicies for DbgEng register value call call
            UInt32[] registerIndicies = new UInt32[registers.Length];

            for (Int32 index = 0; index < registers.Length; index++)
            {
                this.Registers.GetIndexByName(registers[index], out registerIndicies[index]);
            }

            // Get register values
            DEBUG_VALUE[] values = new DEBUG_VALUE[registers.Length];
            this.Registers.GetValues((UInt32)registers.Length, registerIndicies, 0, values);

            // Copy to code trace info
            for (Int32 index = 0; index < registers.Length; index++)
            {
                codeTraceInfo.IntRegisters.Add(registers[index], values[index].I64);
            }

            // Get the current instruction address
            UInt64 address;

            this.Registers.GetInstructionOffset(out address);

            // TEMP: Correct the traced address
            // TODO: Remove this once we figure out how to trigger breakpoint callbacks BEFORE EIP is updated
            address = this.CorrectAddress(address);

            // Disassemble instruction
            Byte[] bytes = Memory.Reader.Default.ReadBytes(address, 15, out _);
            codeTraceInfo.Instruction = Engine.Architecture.Disassembler.Default.Disassemble(bytes, isProcess32Bit, address).FirstOrDefault();

            // Invoke callbacks
            this.ReadCallback?.Invoke(codeTraceInfo);
            this.WriteCallback?.Invoke(codeTraceInfo);
            this.AccessCallback?.Invoke(codeTraceInfo);

            // Output.Output.Log(Output.LogLevel.Debug, "Breakpoint Hit: " + codeTraceInfo.Address);
            return((Int32)DEBUG_STATUS.BREAK);
        }
Beispiel #6
0
        } // end property Value


        public DbgRegisterInfo(DbgEngDebugger debugger,
                               string name,
                               DEBUG_VALUE rawVal,
                               DEBUG_REGISTER_DESCRIPTION description,
                               uint dbgEngIndex)
            : base(debugger, name, rawVal, dbgEngIndex)
        {
            Description = description;
        } // end constructor
Beispiel #7
0
        } // end property Value


        public DbgPseudoRegisterInfo(DbgEngDebugger debugger,
                                     string name,
                                     DEBUG_VALUE rawVal,
                                     ulong typeMod,
                                     uint typeId,
                                     uint dbgEngIndex)
            : base(debugger, name, rawVal, dbgEngIndex)
        {
            TypeModule = typeMod;
            TypeId     = typeId;
        } // end constructor
Beispiel #8
0
        } // end GetColorizedValueString()

        protected DbgRegisterInfoBase(DbgEngDebugger debugger,
                                      string name,
                                      DEBUG_VALUE rawVal,
                                      uint dbgEngIndex)
            : base(debugger)
        {
            if (String.IsNullOrEmpty(name))
            {
                throw new ArgumentException("You must supply a register name.", "name");
            }

            Name        = name;
            DEBUG_VALUE = rawVal;
            DbgEngIndex = dbgEngIndex;
        } // end constructor
Beispiel #9
0
        protected object GetValueFromRawValue()
        {
            switch (DEBUG_VALUE.Type)
            {
            case DEBUG_VALUE_TYPE.INVALID:
                Util.Fail("I don't think we should actually see DEBUG_VALUE_TYPE.INVALID.");
                return(null);

            case DEBUG_VALUE_TYPE.INT8:
                return(DEBUG_VALUE.I8);

            case DEBUG_VALUE_TYPE.INT16:
                return(DEBUG_VALUE.I16);

            case DEBUG_VALUE_TYPE.INT32:
                return(DEBUG_VALUE.I32);

            case DEBUG_VALUE_TYPE.INT64:
                return(DEBUG_VALUE.I64);

            case DEBUG_VALUE_TYPE.FLOAT32:
                return(DEBUG_VALUE.F32);

            case DEBUG_VALUE_TYPE.FLOAT64:
                return(DEBUG_VALUE.F64);

            case DEBUG_VALUE_TYPE.FLOAT80:
                // TODO: Figure out how to get the data into a Decimal?
                throw new NotImplementedException("Haven't dealt with weird precision types yet.");

            case DEBUG_VALUE_TYPE.FLOAT82:
                // TODO: Figure out how to get the data into a Decimal?
                throw new NotImplementedException("Haven't dealt with weird precision types yet.");

            case DEBUG_VALUE_TYPE.FLOAT128:
                // TODO: Figure out how to get the data into a Decimal?
                throw new NotImplementedException("Haven't dealt with weird precision types yet.");

            case DEBUG_VALUE_TYPE.VECTOR64:
                unsafe
                {
                    DEBUG_VALUE dv   = DEBUG_VALUE;   // have to copy this to a local var to access the pointer
                    IntPtr      src  = new IntPtr(dv.VI8);
                    byte[]      dest = new byte[8];
                    Marshal.Copy(src, dest, 0, dest.Length);
                    return(dest);
                }

            case DEBUG_VALUE_TYPE.VECTOR128:
                unsafe
                {
                    DEBUG_VALUE dv   = DEBUG_VALUE;   // have to copy this to a local var to access the pointer
                    IntPtr      src  = new IntPtr(dv.VI8);
                    byte[]      dest = new byte[16];
                    Marshal.Copy(src, dest, 0, dest.Length);
                    return(dest);
                }

            default:
                var msg = Util.Sprintf("Unexpected DEBUG_VALUE_TYPE: {0}.", DEBUG_VALUE.Type);
                Util.Fail(msg);
                throw new NotSupportedException(msg);
            }
        } // end GetValueFromRawValue()