public ulong GetModuleAddress(uint processId, string moduleName) { return(ExecuteOnDkmInitializedThread(() => { DkmProcess process = GetProcess(processId); moduleName = moduleName.ToLower(); return process.GetRuntimeInstances().SelectMany(r => r.GetModuleInstances()).Where(m => GetModuleName(m).ToLower() == moduleName).Single().BaseAddress; })); }
private static IEnumerable <DkmClrModuleInstance> GetModulesInAppDomain(this DkmProcess process, DkmClrAppDomain appDomain) { var appDomainId = appDomain.Id; return(process.GetRuntimeInstances(). OfType <DkmClrRuntimeInstance>(). SelectMany(runtime => runtime.GetModuleInstances()). Cast <DkmClrModuleInstance>(). Where(module => module.AppDomain.Id == appDomainId)); }
public Tuple <uint, ulong>[] GetProcessModules(uint processId) { return(ExecuteOnDkmInitializedThread(() => { DkmProcess process = GetProcess(processId); var modules = process.GetRuntimeInstances().SelectMany(r => r.GetModuleInstances()); List <Tuple <uint, ulong> > result = new List <Tuple <uint, ulong> >(); lock (this.modules) { foreach (var module in modules) { result.Add(Tuple.Create((uint)this.modules.Count, module.BaseAddress)); this.modules.Add(module); } } return result.ToArray(); })); }
void IDkmInstructionAddressProvider.GetInstructionAddress(DkmProcess process, DkmWorkList workList, ulong instructionPointer, DkmCompletionRoutine <DkmGetInstructionAddressAsyncResult> completionRoutine) { var processData = DebugHelpers.GetOrCreateDataItem <NullcModuleDataItem>(process); if (!processData.nullcIsMissing && processData.moduleBase == 0) { processData.moduleBase = DebugHelpers.ReadPointerVariable(process, "nullcModuleStartAddress").GetValueOrDefault(0); processData.moduleSize = (uint)(DebugHelpers.ReadPointerVariable(process, "nullcModuleEndAddress").GetValueOrDefault(0) - processData.moduleBase); processData.nullcIsMissing = processData.moduleBase == 0; } if (processData.moduleBase != 0) { if (instructionPointer >= processData.moduleBase && instructionPointer < processData.moduleBase + processData.moduleSize) { DkmInstructionAddress address; if (DebugHelpers.useNativeInterfaces) { var nullcNativeRuntime = DebugHelpers.useDefaultRuntimeInstance ? process.GetNativeRuntimeInstance() : process.GetRuntimeInstances().OfType <DkmNativeRuntimeInstance>().FirstOrDefault(el => el.Id.RuntimeType == DebugHelpers.NullcRuntimeGuid); var nullcModuleInstance = nullcNativeRuntime.GetModuleInstances().OfType <DkmNativeModuleInstance>().FirstOrDefault(el => el.Module != null && el.Module.CompilerId.VendorId == DebugHelpers.NullcCompilerGuid); address = DkmNativeInstructionAddress.Create(nullcNativeRuntime, nullcModuleInstance, (uint)(instructionPointer - processData.moduleBase), new DkmInstructionAddress.CPUInstruction(instructionPointer)); } else { var nullcNativeRuntime = process.GetRuntimeInstances().OfType <DkmCustomRuntimeInstance>().FirstOrDefault(el => el.Id.RuntimeType == DebugHelpers.NullcRuntimeGuid); var nullcModuleInstance = nullcNativeRuntime.GetModuleInstances().OfType <DkmCustomModuleInstance>().FirstOrDefault(el => el.Module != null && el.Module.CompilerId.VendorId == DebugHelpers.NullcCompilerGuid); address = DkmCustomInstructionAddress.Create(nullcNativeRuntime, nullcModuleInstance, null, instructionPointer, null, new DkmInstructionAddress.CPUInstruction(instructionPointer)); } completionRoutine(new DkmGetInstructionAddressAsyncResult(address, true)); return; } } process.GetInstructionAddress(workList, instructionPointer, completionRoutine); }
public static DkmCustomRuntimeInstance GetPythonRuntimeInstance(this DkmProcess process) { return((DkmCustomRuntimeInstance)process.GetRuntimeInstances().FirstOrDefault(rti => rti.Id.RuntimeType == Guids.PythonRuntimeTypeGuid)); }