/* WaitForSingleObject * * 1st: RCX (handle) * 000007fe`fd24102b 488bf9 mov rdi,rcx * 2nd - RDX (Timeout) * 000007fe`fd241029 8bf2 mov esi,edx */ /* EnterCriticalSection * * 1st: RCX (CRITICAL_SECTION ptr) * 00007ffd`b57310cb 488bf9 mov rdi,rcx */ internal override Params GetWaitForMultipleObjectsParams(UnifiedStackFrame frame) { Params result = new Params(); //1st: RCX (Wait Objects count) //00007ffd`b57312e5 8bd9 mov ebx,ecx result.First = frame.ThreadContext.Context_amd64.Rbx; if (result.First > Kernel32.Const.MAXIMUM_WAIT_OBJECTS) { throw new ArgumentOutOfRangeException($"Cannot await for more then : {Kernel32.Const.MAXIMUM_WAIT_OBJECTS}, given value { result.First}"); } //2nd - RDX (Array ptr) //00007ffd`b57312e2 4c8bea mov r13,rdx result.Second = frame.ThreadContext.Context_amd64.R13; //3rd - R8: WaitAll (BOOLEAN) //00007ffa`d7653a90 4489442444 mov dword ptr [rsp+44h],r8d var rspPtr = frame.StackPointer + 68; result.Third = base.ReadBoolean(rspPtr); //4th - R9: Timeout (DWORD) //00007ffa`d7653a8d 458be1 mov r12d,r9d var waitTime = frame.ThreadContext.Context_amd64.R12; result.Fourth = waitTime; return result; }
/* WaitForSingleObject * * 1st: RCX (handle) * 000007fe`fd24102b 488bf9 mov rdi,rcx * 2nd - RDX (Timeout) * 000007fe`fd241029 8bf2 mov esi,edx */ /* EnterCriticalSection * * 1st: RCX (CRITICAL_SECTION ptr) * 00007ffd`b57310cb 488bf9 mov rdi,rcx */ internal override Params GetWaitForMultipleObjectsParams(UnifiedStackFrame frame) { Params result = new Params(); //RCX, RDX, R8, and R9 //RCX //00007ffd`b57312e5 8bd9 mov ebx,ecx var handlesCount = frame.ThreadContext.Context_amd64.Rbx; if (handlesCount > Kernel32.Const.MAXIMUM_WAIT_OBJECTS) { throw new ArgumentOutOfRangeException($"Cannot await for more then : {Kernel32.Const.MAXIMUM_WAIT_OBJECTS}, given value :{handlesCount}"); } result.First = handlesCount; //RDX //00007ffd`b57312e2 4c8bea mov r13,rdx var hArrayPtr = frame.ThreadContext.Context_amd64.R13; result.Second = hArrayPtr; //3rd - R8: WaitAll (BOOLEAN) //00007ffd`b57312ca 4489442418 mov dword ptr[rsp + 18h],r8d var rspPtr = frame.StackPointer + 24; result.Third = base.ReadBoolean(rspPtr); //R9 ////00007ffd`b57312df 458bf1 mov r14d,r9d var waitTime = frame.ThreadContext.Context_amd64.R14; result.Fourth = waitTime; return result; }
internal virtual Params GetWaitForSingleObjectParams(UnifiedStackFrame frame) { Params result = new Params(); result.First = frame.ThreadContext.Context_amd64.Rdi; result.Second = frame.ThreadContext.Context_amd64.Rsi; return result; }
/* WaitForSingleObject * * 1st: RCX (handle) * 000007fe`fd24102b 488bf9 mov rdi,rcx * 2nd - RDX (Timeout) * 000007fe`fd241029 8bf2 mov esi,edx */ /* EnterCriticalSection * * 1st: RCX (CRITICAL_SECTION ptr) * 00007ffd`b57310cb 488bf9 mov rdi,rcx */ internal override Params GetWaitForMultipleObjectsParams(UnifiedStackFrame frame) { throw new NotImplementedException(); Params result = new Params(); //1st: RCX (Wait Objects count) //000007fe`fd24155a 48894c2408 mov qword ptr [rsp+8],rcx var rspPtr = frame.StackPointer + 8; result.Third = base.ReadULong(rspPtr); //2nd - RDX (Array ptr) //3rd - R8: WaitAll (BOOLEAN) //4th - R9: Timeout (DWORD) return result; }
internal virtual Params GetEnterCriticalSectionParam(UnifiedStackFrame frame) { Params result = new Params(); result.First = frame.ThreadContext.Context_amd64.Rdi; return result; }