public PipelineStateSubObjectTypeGeometryShader(ShaderBytecode bytecode)
{
_pad = default;
_type._type = PipelineStateSubObjectType.GeometryShader;
_type._inner = new ShaderBytecode.__Native();
bytecode.__MarshalTo(ref _type._inner);
}
public LinearSearchKernel(Snapshot boundsSnapshot, UInt32 maxOffset, PointerSize pointerSize)
{
this.BoundsSnapshot = boundsSnapshot;
this.MaxOffset = maxOffset;
this.LowerBounds = this.GetLowerBounds();
this.UpperBounds = this.GetUpperBounds();
}
public static unsafe void CreateBlob(PointerSize size, Blob blobOut)
{
IntPtr num = IntPtr.Zero;
Result result = (Result)D3DCommon.D3DCreateBlob_((void *)size, (void *)&num);
blobOut.NativePointer = num;
result.CheckError();
}
public unsafe InfoQueueFilter?GetStorageFilter()
{
PointerSize sizeFilter = PointerSize.Zero;
GetStorageFilter(IntPtr.Zero, ref sizeFilter);
if (sizeFilter == 0)
{
return(default);
public Pointer(
UInt64 baseAddress,
PointerSize pointerSize,
Int32[] offsets = null)
{
this.BaseAddress = baseAddress;
this.PointerSize = pointerSize;
this.Offsets = offsets;
}
/// <summary>
/// Converts a <see cref="PointerSize"/> to a 64-bit unsigned integer.
/// </summary>
/// <param name="ptr">The pointer to convert.</param>
/// <returns>An <c>unsigned long</c>.</returns>
public static ulong ToUInt64(this PointerSize ptr)
{
if (UIntPtr.Size == 8)
{
return((ulong)(long)ptr);
}
else
{
return((uint)(int)ptr);
}
}
/// <summary>
/// Initializes a new instance of the <see cref="PointerBag" /> class.
/// </summary>
internal PointerBag(IList <Level> levels, UInt32 maxOffset, PointerSize pointerSize)
{
this.MaxOffset = maxOffset;
this.PointerSize = pointerSize;
// Add levels, removing invalid ones
this.Levels = levels.TakeWhile(level => level.HeapPointers.ElementCount > 0).ToList();
if (this.Levels.Count > 0 && this.Levels.Last().StaticPointers.ElementCount <= 0)
{
this.Levels.Remove(this.Levels.Last());
}
}
public SpanSearchKernel(Snapshot boundsSnapshot, UInt32 maxOffset, PointerSize pointerSize)
{
this.BoundsSnapshot = boundsSnapshot;
this.MaxOffset = maxOffset;
this.LowerBounds = this.GetLowerBounds();
this.UpperBounds = this.GetUpperBounds();
this.LArray = new UInt32[Vectors.VectorSize / sizeof(UInt32)];
this.UArray = new UInt32[Vectors.VectorSize / sizeof(UInt32)];
this.Comparer = Comparer <UInt32> .Create((x, y) => 0);
}
public BinarySearchKernel(Snapshot boundsSnapshot, UInt32 maxOffset, PointerSize pointerSize)
{
this.BoundsSnapshot = boundsSnapshot;
this.MaxOffset = maxOffset;
this.PowerOf2Padding = this.Log2((UInt32)this.BoundsSnapshot.SnapshotRegions.Length) << 1;
this.LowerBounds = this.GetLowerBounds();
this.UpperBounds = this.GetUpperBounds();
this.LArray = new UInt32[Vectors.VectorSize / sizeof(UInt32)];
this.UArray = new UInt32[Vectors.VectorSize / sizeof(UInt32)];
}
public static Int32 ToSize(this PointerSize pointerSize)
{
switch (pointerSize)
{
case PointerSize.Byte4:
return(4);
case PointerSize.Byte8:
return(8);
default:
throw new ArgumentException("Unknown pointer size");
}
}
public static DataTypeBase ToDataType(this PointerSize pointerSize)
{
switch (pointerSize)
{
case PointerSize.Byte4:
return(DataTypeBase.UInt32);
case PointerSize.Byte8:
return(DataTypeBase.UInt64);
default:
throw new ArgumentException("Unknown pointer size");
}
}
/// <summary>
/// No documentation.
/// </summary>
/// <param name="messageIndex">No documentation.</param>
/// <returns>No documentation.</returns>
/// <include file='.\..\Documentation\CodeComments.xml' path="/comments/comment[@id='ID3D11InfoQueue::GetMessageW']/*"/>
/// <unmanaged>HRESULT ID3D11InfoQueue::GetMessageW([In] unsigned longlong MessageIndex,[Out, Buffer, Optional] D3D11_MESSAGE* pMessage,[InOut] SIZE_T* pMessageByteLength)</unmanaged>
public unsafe Message GetMessage(long messageIndex)
{
PointerSize messageSize = 0;
GetMessage(messageIndex, IntPtr.Zero, ref messageSize);
var messagePtr = stackalloc byte[(int)messageSize];
GetMessage(messageIndex, new IntPtr(messagePtr), ref messageSize);
var message = new Message();
message.__MarshalFrom(ref *(Message.__Native *)messagePtr);
return(message);
}
/// <summary>
/// Gets a random pointer from the pointer collection.
/// </summary>
/// <returns>A random discovered pointer, or null if unable to find one.</returns>
public Pointer GetRandomPointer(Int32 levelIndex)
{
if (levelIndex >= this.Levels.Count || this.Levels[levelIndex].StaticPointers == null)
{
return(null);
}
Snapshot currentSnapshot = this.Levels[levelIndex].StaticPointers;
ExtractedPointer pointer = this.ExtractRandomPointer(currentSnapshot);
UInt64 pointerBase = pointer.BaseAddress;
List <Int32> offsets = new List <Int32>();
foreach (Level level in this.Levels.Take(levelIndex + 1).Reverse())
{
IEnumerable <Int32> shuffledOffsets = Enumerable.Range(-(Int32)this.MaxOffset, (Int32)(this.MaxOffset * 2) + 1).Shuffle();
Boolean found = false;
// Brute force all possible offsets in a random order to find the next path (this guarantees uniform path probabilities)
foreach (Int32 nextRandomOffset in shuffledOffsets)
{
UInt64 newDestination = nextRandomOffset < 0 ? pointer.Destination.Subtract(-nextRandomOffset, wrapAround: false) : pointer.Destination.Add(nextRandomOffset, wrapAround: false);
SnapshotRegion snapshotRegion = level.HeapPointers.SnapshotRegions.Select(x => x).Where(y => newDestination >= y.BaseAddress && newDestination <= y.EndAddress).FirstOrDefault();
if (snapshotRegion != null)
{
// We may have sampled an offset that results in a mis-aligned index, so just randomly take an element from this snapshot rather than using the random offset
SnapshotElementIndexer randomElement = snapshotRegion[Random.Next(0, snapshotRegion.GetElementCount(PointerSize.ToSize()))];
UInt64 baseAddress = randomElement.GetBaseAddress(PointerSize.ToSize());
Int32 alignedOffset = pointer.Destination >= baseAddress ? -((Int32)(pointer.Destination - baseAddress)) : ((Int32)(baseAddress - pointer.Destination));
pointer = this.ExtractPointerFromElement(randomElement);
offsets.Add(alignedOffset);
found = true;
break;
}
}
if (!found)
{
Logger.Log(LogLevel.Error, "Unable to collect a pointer, encountered dead end path");
return(null);
}
}
return(new Pointer(pointerBase, this.PointerSize, offsets.ToArray()));
}
public unsafe Message GetMessage(long messageIndex)
{
PointerSize messageSize = new PointerSize(0);
GetMessage(messageIndex, IntPtr.Zero, ref messageSize);
if (messageSize == 0)
{
return new Message();
}
var messagePtr = stackalloc byte[(int)messageSize];
GetMessage(messageIndex, new IntPtr(messagePtr), ref messageSize);
var message = new Message();
message.__MarshalFrom(ref *(Message.__Native*)messagePtr);
return message;
}
public EytzingerSearchKernel(Snapshot boundsSnapshot, UInt32 maxOffset, PointerSize pointerSize)
{
this.BoundsSnapshot = boundsSnapshot;
this.MaxOffset = maxOffset;
this.L = 1 + this.Log2(2 + this.BoundsSnapshot.SnapshotRegions.Length + 1); // Final +1 due to inversion
this.M = new Vector <UInt32>(unchecked ((UInt32)(~(2 * this.L))));
this.Length = 2 << (this.L + 2) - 1;
this.LowerBounds = this.GetInverseLowerBounds();
this.UpperBounds = this.GetInverseUpperBounds();
this.YArray = new UInt32[Vectors.VectorSize / sizeof(UInt32)];
this.LArray = new UInt32[Vectors.VectorSize / sizeof(UInt32)];
this.UArray = new UInt32[Vectors.VectorSize / sizeof(UInt32)];
}
public static Result D3DReflect <T>(byte[] shaderBytecode, out IntPtr nativePtr) where T : ComObject
{
var interfaceGuid = typeof(T).GUID;
Result result = Result.Fail;
fixed(void *shaderBytecodePtr = shaderBytecode)
{
PointerSize srcDataSize = shaderBytecode.Length;
fixed(IntPtr *ptr = &nativePtr)
{
result = D3DReflect(shaderBytecodePtr, srcDataSize, &interfaceGuid, ptr);
}
}
return(result);
}
public Result CreateVideoExtensionCommand <T>(
VideoExtensionCommandDescription description,
IntPtr creationParameters,
PointerSize creationParametersDataSizeInBytes,
ID3D12ProtectedResourceSession protectedResourceSession,
out T?videoExtensionCommand) where T : ID3D12VideoExtensionCommand
{
Result result = CreateVideoExtensionCommand(ref description, creationParameters, creationParametersDataSizeInBytes, protectedResourceSession, typeof(T).GUID, out IntPtr nativePtr);
if (result.Failure)
{
videoExtensionCommand = default;
return(result);
}
videoExtensionCommand = MarshallingHelpers.FromPointer <T>(nativePtr);
return(result);
}
/// <summary>
/// Starts the pointer value rescan.
/// </summary>
private void StartPointerRetargetScan()
{
try
{
PointerSize pointerSize = SessionManager.Session.OpenedProcess.Is32Bit() ? PointerSize.Byte4 : PointerSize.Byte8;
TrackableTask <PointerBag> pointerRetargetScanTask = PointerRetargetScan.Scan(
SessionManager.Session.OpenedProcess,
this.RetargetAddress,
pointerSize.ToSize(),
PointerScanResultsViewModel.GetInstance().DiscoveredPointers,
PointerScannerViewModel.PointerScanTaskIdentifier
);
TaskTrackerViewModel.GetInstance().TrackTask(pointerRetargetScanTask);
PointerScanResultsViewModel.GetInstance().DiscoveredPointers = pointerRetargetScanTask.Result;
}
catch (TaskConflictException)
{
}
}
public static Result Reflect <T>(byte[] shaderBytecode, out T reflection) where T : ComObject
{
var interfaceGuid = typeof(T).GUID;
fixed(void *shaderBytecodePtr = shaderBytecode)
{
PointerSize srcDataSize = shaderBytecode.Length;
var result = Reflect(new IntPtr(shaderBytecodePtr), srcDataSize, interfaceGuid, out var nativePtr);
if (result.Success)
{
reflection = CppObject.FromPointer <T>(nativePtr);
return(result);
}
reflection = null;
return(result);
}
}
public unsafe InfoQueueFilter GetRetrievalFilter()
{
PointerSize sizeFilter = PointerSize.Zero;
GetRetrievalFilter(IntPtr.Zero, ref sizeFilter);
if (sizeFilter == 0)
{
return(null);
}
byte *filter = stackalloc byte[(int)sizeFilter];
GetRetrievalFilter((IntPtr)filter, ref sizeFilter);
InfoQueueFilter queueNative = new InfoQueueFilter();
queueNative.__MarshalFrom(ref *(InfoQueueFilter.__Native *)filter);
return(queueNative);
}
public unsafe InfoQueueMessage GetMessage(Guid producer, long messageIndex)
{
PointerSize messageSize = 0;
GetMessage(producer, messageIndex, IntPtr.Zero, ref messageSize);
if (messageSize == 0)
{
return(new InfoQueueMessage());
}
var messagePtr = stackalloc byte[messageSize];
GetMessage(producer, messageIndex, new IntPtr(messagePtr), ref messageSize);
var message = new InfoQueueMessage();
message.__MarshalFrom(ref *(InfoQueueMessage.__Native *)messagePtr);
return(message);
}
public unsafe InfoQueueFilter?GetStorageFilter(Guid producer)
{
PointerSize sizeFilter = PointerSize.Zero;
GetStorageFilter(producer, IntPtr.Zero, ref sizeFilter);
if (sizeFilter == 0)
{
return(null);
}
byte *filter = stackalloc byte[(int)sizeFilter];
GetStorageFilter(producer, (IntPtr)filter, ref sizeFilter);
var queueNative = new InfoQueueFilter();
queueNative.__MarshalFrom(ref *(InfoQueueFilter.__Native *)filter);
return(queueNative);
}
public void PointerSize()
{
var value = new PointerSize(20);
Assert.Equal(new PointerSize(20), NativeFunctions.PassThroughPointerSize(value));
}
public ShaderBytecode(IntPtr bytecode, PointerSize length)
{
Data = new byte[length];
UnsafeUtilities.Read(bytecode, Data);
}
public ShaderBytecode(IntPtr bytecode, PointerSize length)
{
Data = new byte[length];
Interop.Read(bytecode, Data);
}
/// <summary>
/// Performs a pointer scan for a given address.
/// </summary>
/// <param name="address">The address for which to perform a pointer scan.</param>
/// <param name="maxOffset">The maximum pointer offset.</param>
/// <param name="depth">The maximum pointer search depth.</param>
/// <param name="alignment">The pointer scan alignment.</param>
/// <returns>Atrackable task that returns the scan results.</returns>
public static TrackableTask <PointerBag> Scan(UInt64 address, UInt32 maxOffset, Int32 depth, Int32 alignment)
{
TrackableTask <PointerBag> pointerScanTask = TrackableTask <PointerBag> .Create(PointerScan.Name, out UpdateProgress updateProgress, out CancellationToken cancellationToken);
return(pointerScanTask.With(Task.Factory.StartNew <PointerBag>(() =>
{
try
{
cancellationToken.ThrowIfCancellationRequested();
PointerSize pointerSize = Processes.Default.IsOpenedProcess32Bit() ? PointerSize.Byte4 : PointerSize.Byte8;
Stopwatch stopwatch = new Stopwatch();
stopwatch.Start();
// Step 1) Create a snapshot of the target address
Snapshot targetAddress = new Snapshot(new SnapshotRegion[] { new SnapshotRegion(new ReadGroup(address, pointerSize.ToSize(), pointerSize.ToDataType(), alignment), 0, pointerSize.ToSize()) });
// Step 2) Collect static pointers
Snapshot staticPointers = SnapshotManager.GetSnapshot(Snapshot.SnapshotRetrievalMode.FromModules, pointerSize.ToDataType());
TrackableTask <Snapshot> valueCollector = ValueCollector.CollectValues(staticPointers);
staticPointers = valueCollector.Result;
// Step 3) Collect heap pointers
Snapshot heapPointers = SnapshotManager.GetSnapshot(Snapshot.SnapshotRetrievalMode.FromHeaps, pointerSize.ToDataType());
TrackableTask <Snapshot> heapValueCollector = ValueCollector.CollectValues(heapPointers);
heapPointers = heapValueCollector.Result;
// Step 3) Build levels
IList <Level> levels = new List <Level>();
if (depth > 0)
{
// Create 1st level with target address and static pointers
levels.Add(new Level(targetAddress, staticPointers));
// Initialize each level with all static addresses and all heap addresses
for (Int32 index = 0; index < depth - 1; index++)
{
levels.Add(new Level(heapPointers, staticPointers));
}
}
// Exit if canceled
cancellationToken.ThrowIfCancellationRequested();
// Step 4) Rebase to filter out unwanted pointers
PointerBag newPointerBag = new PointerBag(levels, maxOffset, pointerSize);
TrackableTask <PointerBag> pointerRebaseTask = PointerRebase.Scan(newPointerBag, readMemory: false, performUnchangedScan: false);
PointerBag rebasedPointerBag = pointerRebaseTask.Result;
// Exit if canceled
cancellationToken.ThrowIfCancellationRequested();
stopwatch.Stop();
Logger.Log(LogLevel.Info, "Pointer scan complete in: " + stopwatch.Elapsed);
return rebasedPointerBag;
}
catch (OperationCanceledException ex)
{
Logger.Log(LogLevel.Warn, "Pointer scan canceled", ex);
}
catch (Exception ex)
{
Logger.Log(LogLevel.Error, "Error performing pointer scan", ex);
}
return null;
}, cancellationToken)));
}
private static RawBool DebugReport(DebugReportFlags flags, DebugReportObjectType objectType, ulong @object, PointerSize location, int messageCode, string layerPrefix, string message, IntPtr userData)
{
Debug.WriteLine($"{flags}: {message} ([{messageCode}] {layerPrefix})");
return(true);
}
public ShaderBytecode(IntPtr pointer, PointerSize size)
{
managedData = null;
Pointer = pointer;
Size = size;
}
/// <summary>
/// Gets the trace instruction offsets.
/// </summary>
/// <param name="isIncludingNonExecutableCode">if set to <c>true</c> [is including non executable code].</param>
/// <param name="startInstIndex">Start index of the instructions.</param>
/// <param name="numInsts">The number of instructions.</param>
/// <param name="totalInstsRef">The total instructions ref.</param>
/// <returns>An offset</returns>
/// <unmanaged>HRESULT D3DGetTraceInstructionOffsets([In, Buffer] const void* pSrcData,[In] SIZE_T SrcDataSize,[In] unsigned int Flags,[In] SIZE_T StartInstIndex,[In] SIZE_T NumInsts,[Out, Buffer, Optional] SIZE_T* pOffsets,[Out, Optional] SIZE_T* pTotalInsts)</unmanaged>
public unsafe PointerSize GetTraceInstructionOffsets(bool isIncludingNonExecutableCode, PointerSize startInstIndex, PointerSize numInsts, out SharpDX.PointerSize totalInstsRef)
{
fixed (void* bufferPtr = Data)
return D3D.GetTraceInstructionOffsets((IntPtr)bufferPtr, Data.Length, isIncludingNonExecutableCode ? 1 : 0, startInstIndex, numInsts, out totalInstsRef);
}
/// <summary>
/// Disassembles a region of a compiled HLSL code back into textual source.
/// </summary>
/// <param name="flags">The flags.</param>
/// <param name="comments">The comments.</param>
/// <param name="startByteOffset">The start byte offset.</param>
/// <param name="numberOfInstructions">The number of instructions.</param>
/// <param name="finishByteOffsetRef">The finish byte offset ref.</param>
/// <returns>The textual source of the shader or effect.</returns>
/// <unmanaged>HRESULT D3DDisassembleRegion([In, Buffer] const void* pSrcData,[In] SIZE_T SrcDataSize,[In] unsigned int Flags,[In, Optional] const char* szComments,[In] SIZE_T StartByteOffset,[In] SIZE_T NumInsts,[Out, Optional] SIZE_T* pFinishByteOffset,[Out] ID3D10Blob** ppDisassembly)</unmanaged>
public unsafe string DisassembleRegion(DisassemblyFlags flags, string comments, PointerSize startByteOffset, PointerSize numberOfInstructions, out SharpDX.PointerSize finishByteOffsetRef)
{
Blob output;
fixed (void* bufferPtr = Data)
D3D.DisassembleRegion((IntPtr)bufferPtr, Data.Length, (int)flags, comments, startByteOffset, numberOfInstructions, out finishByteOffsetRef, out output);
return Utilities.BlobToString(output);
}
/// <summary>
/// Initializes a new instance of the <see cref="Range"/> struct.
/// </summary>
/// <param name="begin">The offset, in bytes, denoting the beginning of a memory range.</param>
/// <param name="end">The offset, in bytes, denoting the end of a memory range. End is one-past-the-end.</param>
/// <remarks>
/// End is one-past-the-end. When Begin equals End, the range is empty. The size of the range is (End - Begin).
/// </remarks>
public Range(PointerSize begin, PointerSize end)
{
Begin = begin;
End = end;
}
private static RawBool DebugReport(DebugReportFlags flags, DebugReportObjectType objectType, ulong @object, PointerSize location, int messageCode, string layerPrefix, string message, IntPtr userData)
{
Debug.WriteLine($"{flags}: {message} ([{messageCode}] {layerPrefix})");
return true;
}
public ShaderBytecode(IntPtr bytecode, PointerSize length)
{
Data = new byte[length];
MemoryHelpers.Read(bytecode, Data, 0, Data.Length);
}
/// <summary>
/// Filters the given snapshot to find all values that are valid pointers.
/// </summary>
/// <param name="snapshot">The snapshot on which to perfrom the scan.</param>
/// <returns></returns>
public static TrackableTask <Snapshot> Filter(TrackableTask parentTask, Snapshot snapshot, IVectorSearchKernel searchKernel, PointerSize pointerSize, Snapshot DEBUG, UInt32 RADIUS_DEBUG)
{
return(TrackableTask <Snapshot>
.Create(PointerFilter.Name, out UpdateProgress updateProgress, out CancellationToken cancellationToken)
.With(Task <Snapshot> .Run(() =>
{
try
{
parentTask.CancellationToken.ThrowIfCancellationRequested();
ConcurrentBag <IList <SnapshotRegion> > regions = new ConcurrentBag <IList <SnapshotRegion> >();
ParallelOptions options = ParallelSettings.ParallelSettingsFastest.Clone();
options.CancellationToken = parentTask.CancellationToken;
// ISearchKernel DEBUG_KERNEL = new SpanSearchKernel(DEBUG, RADIUS_DEBUG);
Parallel.ForEach(
snapshot.OptimizedSnapshotRegions,
options,
(region) =>
{
// Check for canceled scan
parentTask.CancellationToken.ThrowIfCancellationRequested();
if (!region.ReadGroup.CanCompare(null))
{
return;
}
ScanConstraints constraints = new ScanConstraints(pointerSize.ToDataType(), null);
SnapshotElementVectorComparer vectorComparer = new SnapshotElementVectorComparer(region: region, constraints: constraints);
vectorComparer.SetCustomCompareAction(searchKernel.GetSearchKernel(vectorComparer));
// SnapshotElementVectorComparer DEBUG_COMPARER = new SnapshotElementVectorComparer(region: region);
// DEBUG_COMPARER.SetCustomCompareAction(DEBUG_KERNEL.GetSearchKernel(DEBUG_COMPARER));
IList <SnapshotRegion> results = vectorComparer.Compare();
// When debugging, these results should be the same as the results above
// IList<SnapshotRegion> DEBUG_RESULTS = vectorComparer.Compare();
if (!results.IsNullOrEmpty())
{
regions.Add(results);
}
});
// Exit if canceled
parentTask.CancellationToken.ThrowIfCancellationRequested();
snapshot = new Snapshot(PointerFilter.Name, regions.SelectMany(region => region));
}
catch (OperationCanceledException ex)
{
Logger.Log(LogLevel.Warn, "Pointer filtering canceled", ex);
throw ex;
}
catch (Exception ex)
{
Logger.Log(LogLevel.Error, "Error performing pointer filtering", ex);
return null;
}
return snapshot;
}, parentTask.CancellationToken)));
}
public static Blob CreateBlob(PointerSize size)
{
CreateBlob(size, out var blob).CheckError();
return(blob);
}
