示例#1
0
        public WindowsProcessDataReader(int processId, WindowsProcessDataReaderMode mode)
        {
            if (mode == WindowsProcessDataReaderMode.Snapshot)
            {
                _originalPid = processId;

                // Throws InvalidOperationException, which is similar to how Process.Start fails if it can't start the process.
                Process process = Process.GetProcessById(processId);
                int     hr      = PssCaptureSnapshot(process.Handle, PSS_CAPTURE_FLAGS.PSS_CAPTURE_VA_CLONE, IntPtr.Size == 8 ? 0x0010001F : 0x0001003F, out _snapshotHandle);
                if (hr != 0)
                {
                    throw new InvalidOperationException($"Could not create snapshot to process. Error {hr}.");
                }

                hr = PssQuerySnapshot(_snapshotHandle, PSS_QUERY_INFORMATION_CLASS.PSS_QUERY_VA_CLONE_INFORMATION, out _cloneHandle, IntPtr.Size);
                if (hr != 0)
                {
                    throw new InvalidOperationException($"Could not create snapshot to process. Error {hr}.");
                }

                ProcessId = GetProcessId(_cloneHandle);
            }
            else
            {
                ProcessId = processId;
            }

            _process = WindowsFunctions.NativeMethods.OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, ProcessId);

            if (_process == IntPtr.Zero)
            {
                if (!WindowsFunctions.IsProcessRunning(ProcessId))
                {
                    throw new ArgumentException($"Process {processId} is not running.");
                }

                int hr = Marshal.GetLastWin32Error();
                throw new ArgumentException($"Could not attach to process {processId}, error: {hr:x}");
            }

            using Process p = Process.GetCurrentProcess();
            if (DataTarget.PlatformFunctions.TryGetWow64(p.Handle, out bool wow64) &&
                DataTarget.PlatformFunctions.TryGetWow64(_process, out bool targetWow64) &&
                wow64 != targetWow64)
            {
                throw new InvalidOperationException("Mismatched architecture between this process and the target process.");
            }

            if (mode == WindowsProcessDataReaderMode.Suspend)
            {
                _suspension = new WindowsThreadSuspender(ProcessId);
            }
        }
示例#2
0
        public LiveDataReader(int processId, bool createSnapshot)
        {
            if (createSnapshot)
            {
                _originalPid = processId;

                // Throws
                Process process = Process.GetProcessById(processId);
                int     hr      = PssCaptureSnapshot(process.Handle, PSS_CAPTURE_FLAGS.PSS_CAPTURE_VA_CLONE, IntPtr.Size == 8 ? 0x0010001F : 0x0001003F, out _snapshotHandle);
                if (hr != 0)
                {
                    throw new ClrDiagnosticsException($"Could not create snapshot to process. Error {hr}.", ClrDiagnosticsExceptionKind.Unknown, hr);
                }

                hr = PssQuerySnapshot(_snapshotHandle, PSS_QUERY_INFORMATION_CLASS.PSS_QUERY_VA_CLONE_INFORMATION, out _cloneHandle, IntPtr.Size);
                if (hr != 0)
                {
                    throw new ClrDiagnosticsException($"Could not query the snapshot. Error {hr}.", ClrDiagnosticsExceptionKind.Unknown, hr);
                }

                _pid = GetProcessId(_cloneHandle);
            }
            else
            {
                _pid = processId;
            }

            _process = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, _pid);

            if (_process == IntPtr.Zero)
            {
                if (!WindowsFunctions.IsProcessRunning(_pid))
                {
                    throw new ArgumentException("The process is not running");
                }

                int hr = Marshal.GetLastWin32Error();
                throw new ClrDiagnosticsException($"Could not attach to process. Error {hr}.", ClrDiagnosticsExceptionKind.Unknown, hr);
            }

            using Process p = Process.GetCurrentProcess();
            if (DataTarget.PlatformFunctions.TryGetWow64(p.Handle, out bool wow64) &&
                DataTarget.PlatformFunctions.TryGetWow64(_process, out bool targetWow64) &&
                wow64 != targetWow64)
            {
                throw new ClrDiagnosticsException("Dac architecture mismatch!", ClrDiagnosticsExceptionKind.DacError);
            }
        }
示例#3
0
        public DbgEngDataReader(int processId, bool invasive, uint msecTimeout)
        {
            DisplayName = $"{processId:x}";

            IntPtr client = CreateIDebugClient();

            CreateClient(client);

            DebugAttach attach = invasive ? DebugAttach.Default : DebugAttach.NonInvasive;

            _control.AddEngineOptions(DebugControl.INITIAL_BREAK);

            HResult hr = _client.AttachProcess((uint)processId, attach);

            if (hr)
            {
                hr = _control.WaitForEvent(msecTimeout);
            }

            if (hr == HResult.S_FALSE)
            {
                throw new TimeoutException("Break in did not occur within the allotted timeout.");
            }

            if (hr != 0)
            {
                if ((uint)hr.Value == 0xd00000bb)
                {
                    throw new InvalidOperationException("Mismatched architecture between this process and the target process.");
                }

                if (!WindowsFunctions.IsProcessRunning(processId))
                {
                    throw new ArgumentException($"Process {processId} is not running.");
                }

                throw new ArgumentException($"Could not attach to process {processId}, HRESULT: 0x{hr:x}");
            }
        }