private IpcCircularBuffer(Section section, string sectionName, Semaphore readSemaphore, Semaphore writeSemaphore)
        {
            BufferHeader header;

            _section = section;

            _sectionView = section.MapView(Marshal.SizeOf(typeof(BufferHeader)));
            header       = _sectionView.ReadStruct <BufferHeader>();
            _sectionView.Dispose();

            if (readSemaphore == null || writeSemaphore == null)
            {
                _readSemaphore  = new Semaphore(sectionName + "_" + header.ReadSemaphoreId.ToString("x"));
                _writeSemaphore = new Semaphore(sectionName + "_" + header.WriteSemaphoreId.ToString("x"));
            }
            else
            {
                _readSemaphore  = readSemaphore;
                _writeSemaphore = writeSemaphore;
            }

            _sectionView = _section.MapView(header.BlockSize * header.NumberOfBlocks);
            _header      = (BufferHeader *)_sectionView.Memory;
            _data        = &_header->Data;
        }
Esempio n. 2
0
 protected override void DisposeObject(bool disposing)
 {
     if (_view != null)
     {
         _view.Dispose(disposing);
     }
 }
Esempio n. 3
0
        public MainWindow()
        {
            InitializeComponent();

            Win32.LoadLibrary("C:\\Program Files\\Debugging Tools for Windows (x86)\\dbghelp.dll");

            SymbolProvider symbols = new SymbolProvider(ProcessHandle.Current);

            SymbolProvider.Options |= SymbolOptions.PublicsOnly;

            IntPtr     ntdllBase       = Loader.GetDllHandle("ntdll.dll");
            FileHandle ntdllFileHandle = null;
            Section    section         = null;

            ProcessHandle.Current.EnumModules((module) =>
            {
                if (module.BaseName.Equals("ntdll.dll", StringComparison.InvariantCultureIgnoreCase))
                {
                    section             = new Section(
                        ntdllFileHandle = new FileHandle(@"\??\" + module.FileName,
                                                         FileShareMode.ReadWrite,
                                                         FileAccess.GenericExecute | FileAccess.GenericRead
                                                         ),
                        true,
                        MemoryProtection.ExecuteRead
                        );

                    symbols.LoadModule(module.FileName, module.BaseAddress, module.Size);
                    return(false);
                }

                return(true);
            });

            SectionView view = section.MapView((int)ntdllFileHandle.GetSize());

            ntdllFileHandle.Dispose();

            symbols.EnumSymbols("ntdll!Zw*", (symbol) =>
            {
                int number = Marshal.ReadInt32(
                    (symbol.Address.ToIntPtr().Decrement(ntdllBase)).Increment(view.Memory).Increment(1));

                _sysCallNames.Add(
                    number,
                    "Nt" + symbol.Name.Substring(2)
                    );
                _reverseSysCallNames.Add(
                    "Nt" + symbol.Name.Substring(2),
                    number
                    );

                return(true);
            });

            view.Dispose();
            section.Dispose();

            symbols.Dispose();

            KProcessHacker.Instance = new KProcessHacker();

            _logger = new SsLogger(4096, false);
            _logger.EventBlockReceived    += new EventBlockReceivedDelegate(logger_EventBlockReceived);
            _logger.ArgumentBlockReceived += new ArgumentBlockReceivedDelegate(logger_ArgumentBlockReceived);
            _logger.AddProcessIdRule(FilterType.Exclude, ProcessHandle.GetCurrentId());
            _logger.AddPreviousModeRule(FilterType.Include, KProcessorMode.UserMode);
            //_logger.Start();

            listEvents.SetDoubleBuffered(true);
        }