Пример #1
0
        public void OnModuleLoaded(DebuggerModule Module)
        {
            MainProcess.Modules.Add(Module);

            AddressLookup.Add((uint)Module.ImageBase);
            AddressLookup.Sort();
        }
Пример #2
0
        private void DebugBreakpoint(DebuggerModule Module, uint Address)
        {
            Invoke(new MethodInvoker(delegate()
            {
                SuspendedOnBp = true;

                bool auto_resume = true;
                if (cbBreakpointAll.Checked == false)
                {
                    // Ignore all submodule breakpoints
                    // (effectively triggers from Cxbx.exe and default.xbe)

                    if (cbBreakpointCxbx.Checked)
                    {
                        auto_resume = (!Module.Core);
                    }
                }

                if (auto_resume)
                {
                    Resume();
                }
                else
                {
                    string module_name = Path.GetFileName(Module.Path);
                    Suspend(string.Format("Breakpoint hit in {0} at 0x{1:x}", module_name, Address));

                    // Forces a refresh at the breakpoint address (not the callstack trace)
                    DumpDisassembly(Address);
                }
            }));
        }
Пример #3
0
        private void HandleCreateProcess(WinDebug.DEBUG_EVENT DebugEvent)
        {
            var DebugInfo = DebugEvent.CreateProcessInfo;

            var Process = new DebuggerProcess();

            Process.Core      = true;
            Process.Handle    = DebugInfo.hProcess;
            Process.ProcessID = WinLowLevel.GetProcessId(Process.Handle);
            Process.Path      = ResolveProcessPath(DebugInfo.hFile);

            // Skip over allocated Xbox memory
            Process.ImageBase = DebugInfo.lpBaseOfImage + VM_PLACEHOLDER_SIZE;

            var MainThread = new DebuggerThread(Process);

            MainThread.Handle     = DebugInfo.hThread;
            MainThread.ThreadID   = NativeMethods.GetThreadId(DebugInfo.hThread);
            MainThread.ThreadBase = DebugInfo.lpThreadLocalBase;

            // Setup as the main thread
            // TODO Check that we need to treat this as a special case
            Process.MainThread = MainThread;

            DebugInstance = new DebuggerInstance(Process);
            RegisterEventInterfaces(DebugInstance);

            foreach (IDebuggerProcessEvents Event in ProcessEvents)
            {
                Event.OnProcessCreate(Process);
            }

            foreach (IDebuggerThreadEvents Event in ThreadEvents)
            {
                Event.OnThreadCreate(MainThread);
            }

            var XboxModule = new DebuggerModule();

            XboxModule.Path      = Target;
            XboxModule.ImageBase = DebugInfo.lpBaseOfImage;
            XboxModule.Core      = true;

            foreach (IDebuggerModuleEvents Event in ModuleEvents)
            {
                Event.OnModuleLoaded(XboxModule);
            }
        }
Пример #4
0
        private void HandleLoadDll(WinDebug.DEBUG_EVENT DebugEvent)
        {
            var DebugInfo = DebugEvent.LoadDll;

            if ((uint)DebugEvent.dwProcessId != DebugInstance.MainProcess.ProcessID)
            {
                throw new Exception("Handling event for unknown process");
            }

            var Module = new DebuggerModule();

            Module.Path      = ResolveProcessPath(DebugInfo.hFile);
            Module.ImageBase = DebugInfo.lpBaseOfDll;

            Parallel.ForEach(ModuleEvents, Event => Event.OnModuleLoaded(Module));
        }
 public void OnModuleUnloaded(DebuggerModule Module)
 {
 }
 public void OnModuleLoaded(DebuggerModule Module)
 {
     // TODO: apply pending patches
 }
Пример #7
0
 public void OnModuleUnloaded(DebuggerModule Module)
 {
     frm.DebugLog(string.Format("Unloaded module \"{0}\"", Module.Path));
     frm.DebugModules.Remove(Module);
 }
Пример #8
0
 public void OnModuleLoaded(DebuggerModule Module)
 {
     frm.DebugLog(string.Format("Loaded module \"{0}\"", Module.Path));
     frm.DebugModules.Add(Module);
 }
Пример #9
0
        private void DebugBreakpoint(DebuggerThread Thread, DebuggerModule Module, uint Address)
        {
            Invoke(new MethodInvoker(delegate()
            {
                SuspendedOnBp = true;

                bool auto_resume = true;
                if (cbBreakpointAll.Checked == false)
                {
                    // Ignore all submodule breakpoints
                    // (effectively triggers from Cxbx.exe and default.xbe)

                    if (cbBreakpointCxbx.Checked)
                    {
                        auto_resume = (!Module.Core);
                    }
                }

                if (auto_resume)
                {
                    Resume();
                }
                else
                {
                    DebuggerInst.Trace();

                    var stackFrame = Thread.CallstackCache.StackFrames[0];
                    var currentIp  = stackFrame.eip;

                    currentIp -= 1; // Size of the 0xcc instruction
                    Thread.ModifyPC(currentIp);

                    var patch = patchMan.DataPatches.FirstOrDefault(x => x.Offset == currentIp);
                    if (patch == null)
                    {
                        throw new Exception($"Failed to find breakpoint patch for address {currentIp}");
                    }

                    if (patch.Original == null)
                    {
                        throw new Exception($"Original memory is missing for breakpoint patch at address {currentIp}");
                    }

                    // write back the single byte
                    // note: original should not also be a breakpoint - or this will endlessly loop
                    Thread.OwningProcess.WriteMemoryBlock(new IntPtr(currentIp), patch.Original);

                    // Sets a single-step trap
                    Thread.SetSingleStepTrap(true);

                    // Save this patch instance - note how this isn's thread safe at all
                    applyBreakpointOnStep = patch;

                    if (userScript.IsValid)
                    {
                        MainProcess.ContextThread = Thread;
                        userScript.OnBreakpoint(new DebuggerTest(this), currentIp);
                    }

                    Resume();
                }
            }));
        }
Пример #10
0
 public void OnModuleUnloaded(DebuggerModule Module)
 {
     frm.DebugLog($"Unloaded module \"{Module.Path}\"");
     frm.DebugModules.Remove(Module);
 }
Пример #11
0
 public void OnModuleLoaded(DebuggerModule Module)
 {
     frm.DebugLog($"Loaded module \"{Module.Path}\"");
     frm.DebugModules.Add(Module);
 }
Пример #12
0
        public void OnModuleUnloaded(DebuggerModule Module)
        {
            MainProcess.Modules.Remove(Module);

            AddressLookup.Remove((uint)Module.ImageBase);
        }