/// <summary> /// Gets the register value assuming a 64 bit processor /// </summary> /// <param name="register">The register.</param> /// <param name="registers">The registers.</param> /// <returns>System.Byte[].</returns> /// <exception cref="ApplicationException"></exception> internal virtual unsafe byte[] GetRegisterValue64(Register register, IDebugRegisters2 registers) { var ymms = new Register[] { Register.Ymm0, Register.Ymm1, Register.Ymm2, Register.Ymm3, Register.Ymm4, Register.Ymm5, Register.Ymm6, Register.Ymm7, Register.Ymm8, Register.Ymm9, Register.Ymm10, Register.Ymm11, Register.Ymm12, Register.Ymm13, Register.Ymm14, Register.Ymm15 }; if (ymms.Contains(register)) { return(GetYmmRegister64(register, registers)); } var bytes = new List <byte>(); var hr3 = registers.GetValue(register.X64Index.Value.ToUInt(), out var val); if (hr3 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr3}"); } for (var i = 0; i < register.X64NumBits.Value; i++) { bytes.Add(val.F128Bytes[i]); } return(bytes.Take(register.NumBits / 8 + Math.Min(register.NumBits % 8, 1)).ToArray()); }
/// <summary> /// Gets one of the 64 bit SIMD registers /// </summary> /// <param name="register">The register.</param> /// <param name="registers">The registers.</param> /// <returns>System.Byte[].</returns> /// <exception cref="ApplicationException"> /// </exception> private static unsafe byte[] GetYmmRegister64(Register register, IDebugRegisters2 registers) { var hr = registers.GetValue(register.X64Index.Value.ToUInt(), out var debugValue); if (hr != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr}"); } var hr2 = registers.GetValue(register.X64Index.Value.ToUInt(), out var value); if (hr2 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr2}"); } var list = new List <byte>(); for (var i = 0; i < 16; i++) { list.Add(value.F128Bytes[i]); } for (var i = 0; i < 16; i++) { list.Add(debugValue.F128Bytes[i]); } return(list.ToArray()); }
/// <summary> /// Gets the register value. /// </summary> /// <param name="threadId">The thread identifier.</param> /// <param name="register">The register.</param> /// <param name="registers">The registers.</param> /// <param name="debugEngine">The debug engine.</param> /// <returns>System.Byte[].</returns> /// <inheritdoc /> public byte[] GetRegisterValue(int threadId, Register register, IDebugRegisters2 registers, IDebugEngineProxy debugEngine) { var save = debugEngine.GetCurrentThreadId(); debugEngine.SwitchToThread(threadId); if (debugEngine.Is32Bit) { return(GetRegisterValue32(register, registers)); } debugEngine.SwitchToThread(save); return(GetRegisterValue64(register, registers)); }
/// <summary> /// Initializes a new instance of the <see cref="DebugEngineProxy" /> class. /// </summary> /// <param name="control">The control.</param> /// <param name="client">The client.</param> /// <param name="registers">The registers.</param> /// <param name="systemObjects">The system objects.</param> /// <param name="debugDataSpaces">The debug data spaces.</param> public DebugEngineProxy(IDebugControl6 control, IDebugClient5 client, IDebugRegisters2 registers, IDebugSystemObjects systemObjects, IDebugDataSpaces debugDataSpaces, IExecuteWrapper executeWrapper) { Control = control; Client = client; Registers = registers; Dataspaces = debugDataSpaces; ExecuteWrapper = executeWrapper; RegisterEngine = new RegisterEngine(); // todo: inject MemoryEngine = new MemoryEngine(); SystemObjects = systemObjects; Is32Bit = Regex.Match(ExecuteWrapper.Execute("!peb"), @"PEB at (?<peb>[a-fA-F0-9]+)").Groups["peb"].Value .Length == 8; }
/// <summary> /// Initializes the API. /// </summary> /// <param name="log">The log.</param> internal static void InitApi(ILog log = null) { LastHR = HRESULT.S_OK; if (client != null) { return; } try { log?.Debug("Client did not exist. Creating a new client and associated interfaces."); client = (IDebugClient5)CreateIDebugClient(); control = (IDebugControl6)client; registers = (IDebugRegisters2)client; symbols = (IDebugSymbols5)client; systemObjects = (IDebugSystemObjects)client; debugDataSpaces = (IDebugDataSpaces)client; } catch (Exception e) { log?.Fatal("Unable to create debug client. Are you missing DLLs?"); log?.Fatal(e); LastHR = HRESULT.E_UNEXPECTED; } }
/// <summary> /// Gets the register value32. /// </summary> /// <param name="register">The register.</param> /// <param name="registers">The registers.</param> /// <returns>System.Byte[].</returns> /// <exception cref="System.ApplicationException"> /// </exception> private unsafe byte[] GetRegisterValue32(Register register, IDebugRegisters2 registers) { if (register == Register.Ymm0) { var hr = registers.GetValue(Register.Ymm0.X86Index.Value.ToUInt(), out var ymm0); if (hr != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr}"); } var hr2 = registers.GetValue(Register.Xmm0.X86Index.Value.ToUInt(), out var xmm0); if (hr2 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr2}"); } var list = new List <byte>(); for (var i = 0; i < 16; i++) { list.Add(xmm0.F128Bytes[i]); } for (var i = 0; i < 16; i++) { list.Add(ymm0.F128Bytes[i]); } return(list.ToArray()); } if (register == Register.Ymm1) { var hr = registers.GetValue(Register.Ymm1.X86Index.Value.ToUInt(), out var ymm1); if (hr != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr}"); } var hr2 = registers.GetValue(Register.Xmm1.X86Index.Value.ToUInt(), out var xmm1); if (hr2 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr2}"); } var list = new List <byte>(); for (var i = 0; i < 16; i++) { list.Add(xmm1.F128Bytes[i]); } for (var i = 0; i < 16; i++) { list.Add(ymm1.F128Bytes[i]); } return(list.ToArray()); } if (register == Register.Ymm2) { var hr = registers.GetValue(Register.Ymm2.X86Index.Value.ToUInt(), out var ymm2); if (hr != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr}"); } var hr2 = registers.GetValue(Register.Xmm2.X86Index.Value.ToUInt(), out var xmm2); if (hr2 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr2}"); } var list = new List <byte>(); for (var i = 0; i < 16; i++) { list.Add(xmm2.F128Bytes[i]); } for (var i = 0; i < 16; i++) { list.Add(ymm2.F128Bytes[i]); } return(list.ToArray()); } if (register == Register.Ymm3) { var hr = registers.GetValue(Register.Ymm3.X86Index.Value.ToUInt(), out var ymm3); if (hr != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr}"); } var hr2 = registers.GetValue(Register.Xmm3.X86Index.Value.ToUInt(), out var xmm3); if (hr2 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr2}"); } var list = new List <byte>(); for (var i = 0; i < 16; i++) { list.Add(xmm3.F128Bytes[i]); } for (var i = 0; i < 16; i++) { list.Add(ymm3.F128Bytes[i]); } return(list.ToArray()); } if (register == Register.Ymm4) { var hr = registers.GetValue(Register.Ymm4.X86Index.Value.ToUInt(), out var ymm4); if (hr != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr}"); } var hr2 = registers.GetValue(Register.Xmm4.X86Index.Value.ToUInt(), out var xmm4); if (hr2 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr2}"); } var list = new List <byte>(); for (var i = 0; i < 16; i++) { list.Add(xmm4.F128Bytes[i]); } for (var i = 0; i < 16; i++) { list.Add(ymm4.F128Bytes[i]); } return(list.ToArray()); } if (register == Register.Ymm5) { var hr = registers.GetValue(Register.Ymm5.X86Index.Value.ToUInt(), out var ymm5); if (hr != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr}"); } var hr2 = registers.GetValue(Register.Xmm5.X86Index.Value.ToUInt(), out var xmm5); if (hr2 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr2}"); } var list = new List <byte>(); for (var i = 0; i < 16; i++) { list.Add(xmm5.F128Bytes[i]); } for (var i = 0; i < 16; i++) { list.Add(ymm5.F128Bytes[i]); } return(list.ToArray()); } if (register == Register.Ymm6) { var hr = registers.GetValue(Register.Ymm6.X86Index.Value.ToUInt(), out var ymm6); if (hr != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr}"); } var hr2 = registers.GetValue(Register.Xmm6.X86Index.Value.ToUInt(), out var xmm6); if (hr2 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr2}"); } var list = new List <byte>(); for (var i = 0; i < 16; i++) { list.Add(xmm6.F128Bytes[i]); } for (var i = 0; i < 16; i++) { list.Add(ymm6.F128Bytes[i]); } return(list.ToArray()); } if (register == Register.Ymm7) { var hr = registers.GetValue(Register.Ymm7.X86Index.Value.ToUInt(), out var ymm7); if (hr != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr}"); } var hr2 = registers.GetValue(Register.Xmm7.X86Index.Value.ToUInt(), out var xmm7); if (hr2 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr2}"); } var list = new List <byte>(); for (var i = 0; i < 16; i++) { list.Add(xmm7.F128Bytes[i]); } for (var i = 0; i < 16; i++) { list.Add(ymm7.F128Bytes[i]); } return(list.ToArray()); } var bytes = new List <byte>(); var hr3 = registers.GetValue(register.X86Index.Value.ToUInt(), out var val); if (hr3 != 0) { throw new ApplicationException( $"Unable to get register value for register {register.Name}, error code is {hr3}"); } for (var i = 0; i < register.X86NumBits.Value; i++) { bytes.Add(val.F128Bytes[i]); } return(bytes.Take(register.NumBits / 8 + Math.Min(register.NumBits % 8, 1)).ToArray()); }