Windows kernel conditional breakpoint not evaluating - windows

I'm using the windows kernel debugger through visual studio 2013 and I'm trying to stop (break) in a function (nt!KiSwapContext) but only for a specific process (0x920).
The breakpoint works without a condition bp nt!KiSwapContext
I determined the Process ID for the current thread can be found with dt dword poi(gs:[188h])+3B8h
I've confirmed the following conditional works to see if I am on the right thread: ? poi(poi(gs:[188h])+3B8h)==0x920
However, when I try to set the conditional breakpoint it always breaks no matter what I put in the if/else . So I am guessing it thinks the expression is invalid and is just ignoring it. I've confirmed that if I do enter an invalid expression it just accepts it without warning or error and always stops on the breakpoint.
The expression I am using is: bp nt!KiSwapContext ".if (poi(poi(gs:[188h])+3B8h)==0x920) {} .else {gc}"
I also tried using the j conditional syntax to no avail.
Any ideas on what I am doing wrong?
[Edit] Oh, as a bonus, how can I do the conditional check with a dword instead of a qword on a 64 bit processor. ? poi(poi(gs:[188h])+3B8h) returns a qword value. I know I can use dd to get the value, but I can't seem to figure out how to add that into the conditional. Something like ? dword(poi(gs:[188h])+3B8h)==0x920 or ? {dd poi(gs:[188h])+3B8h}==0x920

windbg allows you to set process specific breakpoints with /p
you shouldn't be mucking with gs and fs registers
kd> bl
kd> !process 0 0 calc.exe
Failed to get VAD root
PROCESS 8113d528 SessionId: 0 Cid: 07a0 Peb: 7ffde000 ParentCid: 043c
DirBase: 03d27000 ObjectTable: e15ba240 HandleCount: 28.
Image: calc.exe
kd> bp /p 8113d528 nt!KiSwapContext "?? (char *)(#$proc->ImageFileName)"
kd> g
char * 0x8113d69c
"calc.exe"
nt!KiSwapContext:
804db828 83ec10 sub esp,10h
kd> g
char * 0x8113d69c
"calc.exe"
nt!KiSwapContext:
804db828 83ec10 sub esp,10h
use dwo() and qwo () as required to evaluate dword and qword
kd> ? qwo ( ffb9cda8 + 70)
Evaluate expression: -9142252815570161280 = 81203180`81203180
kd> ? dwo ( qwo ( ffb9cda8 + 70))
Evaluate expression: -4600296 = ffb9ce18
confirmation
kd> dd 81203180 l1
81203180 ffb9ce18
kd> dd ffb9cda8+70 l1
ffb9ce18 81203180
Edit
I cant access an x64 system atm so cant tell you what is the error in your expression
but in general you should avoid hardcoding unless it is absolutely necessary
in your case it is not necessary
windbg provides you pseudo registers to what you are hard coding
$thread to c++ Expression for CurrentThread * ie (nt!_ETHREAD *) .
so $thread->Cid.UniqueProcess is what you are evaluating with your gsexxxxx
with that in mind you can set a breakpoint like this
bp nt!KiSwapContext " r? $t0 = #$thread->Cid.UniqueProcess ;.if( #$t0 != 0x740 ) {? #$t0;?? (char * )#$proc->ImageFileName ;gc }"
this conditional will break only in calc.exe is the Current Process
kd> g
Evaluate expression: 404 = 00000194
char * 0x81105c84
"csrss.exe"
XXXXXXXXXXX
Evaluate expression: 4 = 00000004
char * 0x8129196c
"System"
xxxxxxxxxxxxxxxxxxxxxxxxxxx
Evaluate expression: 1404 = 0000057c
char * 0x8114a4bc
"vpcmap.exe"
Evaluate expression: 480 = 000001e0
char * 0x8112a98c
"services.exe"
Evaluate expression: 492 = 000001ec
char * 0x811cc9ac
"lsass.exe"
zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
Evaluate expression: 1116 = 0000045c
char * 0xffaf9da4
"explorer.exe"
Evaluate expression: 644 = 00000284
char * 0xffb74f14
"svchost.exe"
nt!KiSwapContext: <---------------------------Conditional broke here
804db828 83ec10 sub esp,10h
kd> ? #$t0;?? (char * )#$proc->ImageFileName
Evaluate expression: 1856 = 00000740
char * 0x8110e76c
"calc.exe"
keep in mind evaluating conditions in a very hot path will make you endure unbearable pain watching it crawl by
nt!kiSwapContext is called hundreds of times in few seconds
and you will be seeing a very noticeable performance degradation in your
Session
whenever possible use process specific or thread specific breakpoints
do not evaluate conditions
no i don't use any cheat sheet ( google says there are few available ) i prefer manual or in some cases online msdn documentation

Related

EBNF: prefix and suffix-like operator in assembly code production

I'm trying to write down 6809 assembly in EBNF to write a tree-sitter parser.
I'm stuck on one certain production. In 6809 assembly, you can use a register as an operand and additionally de- or increment it:
LDA 0,X+ ; loads A from X then bumps X by 1
LDD ,Y++ ; loads D from Y then bumps Y by 2
LDA 0,-U ; decrements U by 1 then loads A from address in U
LDU ,--S ; decrements S by 2 then loads U from address in S
Mind the "missing" first operand in the second line of code. Here are the productions I wrote:
instruction = opcode, [operand], ["," , register_exp];
...
register_exp = [{operator}], register | register, [{operator}];
register = "X" | "Y" | "U" | etc. ;
operator = "+" | "-";
The problem is register_exp = .... I feel like there could be a more elegant way to define this production. Also, what happens if only a register is given to register_exp?
You probably need
register_exp = [{operator}], register | register, [{operator}] | register;
to allow register names without operators. Why do you find it not so elegant? Quite descriptive.

Error in Parsing the postscript to pdf

I have a postscript file when i try to convert it into pdf or open it with postscript it gives the following error
undefined in execform
I am trying to fix this error. But there is no solution i found. Kindly Help me understand the issue.
This is postscript file
OK so a few observations to start;
The file is 8 pages long, uses many forms, and the first form it uses has nested forms. This really isn't suitable as an example file, you are expecting other programmers to dig through a lot of extraneous cruft to help you out. When you post an example, please try and reduce it to just the minimum required to reproduce the problem.
Have you actually tried to debug this problem yourself ? If so what did you do ? (and why didn't you start by reducing the file complexity ?)
I don't want to be offensive, but this is the third rather naive posting you've made recently, do you have much experience of PostScript programming ? Has anyone offered you any training in the language ? It appears you are working on behalf of a commercial organisation, you should talk to your line manager and try and arrange some training if you haven't already been given some.
The PostScript program does not give the error you stated
undefined in execform
In fact the error is a Ghostscript-specific error message:
Error: /undefined in --.execform1--
So that's the .execform1 operator (note the leading '.' to indicate a Ghostscript internal operator). That's only important because firstly its important to accurately quote error messages, and secondly because, for someone familiar with Ghostscript, it tells you that the error occurs while executing the form PaintProc, not while executing the execform operator.
After considerably reducing of the complexity of the file, the problem is absolutely nothing to do with the use of Forms. The offending Form executes code like this:
2 RM
0.459396 w
[(\0\1\0\2)]435.529999 -791.02002 T
(That's the first occurrence, and its where the error occurs)
That executes the procedure named T which is defined as:
/T{neg _LY add /_y ed _LX add /_x ed/_BLSY _y _BLY sub D/_BLX _x D/_BLY _y D _x _y TT}bd
Obviously that's using a number of other functions defined in the prolog, but the important point is that it executes TT which is defined as :
/TT{/_y ed/_x ed/_SX _x _LX sub D/_SY _y _LY sub D/_LX _x D/_LY _y D _x _y m 0 _rm eq{ dup type/stringtype eq{show}{{ dup type /stringtype eq{show}{ 0 rmoveto}?}forall}?} if
1 _rm eq {gsave 0 _scs eq { _sr setgray}if 1 _scs eq { _sr _sg _sb setrgbcolor}if 2 _scs eq { _sr _sg _sb _sk setcmykcolor} if dup type/stringtype eq{true charpath }{{dup type /stringtype eq{true charpath } { 0 rmoveto}?}forall}? S grestore} if
2 _rm eq {gsave 0 _fcs eq { _fr setgray}if 1 _fcs eq { _fr _fg _fb setrgbcolor}if 2 _fcs eq { _fr _fg _fb _fk setcmykcolor} if dup type/stringtype eq{true charpath }{{dup type /stringtype eq{true charpath } { 0 rmoveto}?}
forall}? gsave fill grestore 0 _scs eq { _sr setgray}if 1 _scs eq { _sr _sg _sb setrgbcolor}if 2 _scs eq { _sr _sg _sb _sk setcmykcolor}if S grestore} if
Under the conditions holding at the time TT is executed (RM sets _rm to 2), we go through this piece of code:
gsave 0 _fcs eq
However, _fcs is initially undefined, and only defined when the /fcs function is executed. Your program never executes /fcs so _fcs is undefined, leading to the error.
Is there a reason why you are defining each page in a PostScript Form ? This is not optimal, if the interpreter actually supports Forms then you are using up VM for no useful purpose (since you only execute each Form once).
If its because the original PDF input uses PDF Form XObjects I would recommend that you don't try and reproduce those in PostScript. Reuse of Form XObjects in PDF is rather rare (it does happen but non-reuse is much more common). The loss of efficiency due to describing PostScript Forms for each PDF Form XObject for all the files where the form isn't reused exceeds the benefit for the rare cases where it would actually be valuable.

Windbg conditional breakpoints ignore condition itself

I'm debugging an app without sources, i use IDA PRO + Windbg as the debugger. I'm trting to catch calls to CloseHandle with the specific handle value, for example handle=0x14
I put a conditional breakpoint like so:
bp kernel32!CloseHandle "j (poi(#esp+4)=0x00000014) ''; 'gc'"
The breakpoints sets normally, but it breaks on every call to CloseHandle, contrary to what i'm trying, to break only if the first argument equals 0x14
you have a missing = the conditional equals operator needs two == not a single =
0:000> bp kernel32!CloseHandle ".if(poi(#esp+4)!=0xcc) {? dwo(#esp+4);gc}.else{? dwo(#esp+4);.echo our handle;gc}"
0:000> g
Evaluate expression: 60 = 0000003c
Evaluate expression: 56 = 00000038
Evaluate expression: 204 = 000000cc <------
our handle <-------------
Evaluate expression: 200 = 000000c8
Evaluate expression: 256 = 00000100
Evaluate expression: 272 = 00000110
Evaluate expression: 280 = 00000118
Evaluate expression: 308 = 00000134
Evaluate expression: 312 = 00000138
Evaluate expression: 308 = 00000134
Evaluate expression: 324 = 00000144
Evaluate expression: 328 = 00000148
Evaluate expression: 324 = 00000144

Why am I getting extra characters?

Program Description
I used .BLKW to allocate 20 locations for each character that the user inputs and for now, I just want to display the string the user typed at the first prompt. (This will be a pig latin translator, hence the second prompt; but right now I just want to see if I can print out the user input)
The Problem
The problem is that when I run it, I get extra characters at the end.
For example:
English Word: apple
Pig-Latin Word: apple
English Word: at
Pig-Latin Word: atple
English Word: set
Pig-Latin Word: setle
My Program
.ORIG x3000
START ST R1,SAVER1
ST R2,SAVER2
ST R3,SAVER3
LD R5,ENTER
REPEAT LEA R0,PROMPT ; loading the starting address of prompt
PUTS ; displays PROMPT on screen
LEA R4,ENGLWORD ; sets aside memory locations for typed characters
INPUT GETC ; now that user has typed, read char into R0
ADD R6,R5,R0 ; adds the negative value of the ASCII enter key code to the input character
BRz PIGPROMPT ; if the sum of the ASCII codes from step before is 0, that means user pressed enter so go to PIGPROMPT
OUT ; write char in R0 to console
STR R0,R4,#0 ; store typed character into memory location
ADD R4,R4,#1 ; increment memory location so you write next character to the next location
BRnzp INPUT ; break no matter what to the INPUT step to receive next typed character
PIGPROMPT LEA R0,PIG ; loads starting address of pig latin prompt
PUTS ; displays pig latin prompt on screen
LEA R0,ENGLWORD
PUTS
BRnzp REPEAT
LD R1,SAVER1 ; restore R1 to original value
LD R2,SAVER2 ; restore R2 to original value
LD R3,SAVER3 ; restore R3 to original value
HALT
SAVER1 .BLKW 1 ; allocates 1 memory location for SAVER1
SAVER2 .BLKW 1 ; allocates 1 memory location for SAVER2
SAVER3 .BLKW 1 ; allocates 1 memory location for SAVER3
ENGLWORD .BLKW #20
ENTER .FILL xFFF6 ; the negative value of the ASCII code for the enter key
NEWLINE .FILL x000A
PROMPT .STRINGZ "\nEnglish Word: " ; initializes a sequence of stringLength+1 memory locations to hold string
PIG .STRINGZ "\nPig-Latin Word: "
DSR .FILL xFE04
DDR .FILL xFE06
KBSR .FILL xFE00
KBDR .FILL xFE02
.END
Attempted Solution
I was thinking that the problem was that R4 holds the string of the first user input throughout the whole program. So for a solution, I thought about clearing R4 after it is displayed so that it's ready to take the next user input. Does anyone know how I would do that?
The key here is how PUTS works -- it prints all the characters starting at the address in R0 until it reaches a 0 ('\0' not '0').
The first time you run it, the memory will contain ['A','P','P','L','E'], followed by zeroes if you didn't randomize memory contents when you loaded the program. This means that a PUTS call will return "APPLE". When you enter the new word, it doesn't clear out that memory, so entering "at" will result in ['A','T','P','L','E'], and your print routine will print "ATPLE".
In order to properly finish the word, you need to add a '\0' (a.k.a. 0) to the element after the last character to print. In other words, if your memory contains ['A','T','\0','L','E'], your print routine will print "AT".
Aqua's right, the PUTs command is looking for a zero to stop printing characters to the screen. I've added two lines of code just after PIGPROMPT and it seems to be working as intended.
Revised:
.ORIG x3000
START ST R1,SAVER1
ST R2,SAVER2
ST R3,SAVER3
LD R5,ENTER
REPEAT LEA R0,PROMPT ; loading the starting address of prompt
PUTS ; displays PROMPT on screen
LEA R4,ENGLWORD ; sets aside memory locations for typed characters
INPUT GETC ; now that user has typed, read char into R0
ADD R6,R5,R0 ; adds the negative value of the ASCII enter keycode to the input character
BRz PIGPROMPT ; if the sum of the ASCII codes from step before is 0, that means user pressed enter so go to PIGPROMPT
OUT ; write char in R0 to console
STR R0,R4,#0 ; store typed character into memory location
ADD R4,R4,#1 ; increment memory location so you write next character to the next location
BRnzp INPUT ; break no matter what to the INPUT step to receive next typed character
PIGPROMPT AND R0, R0, #0 ; clear R0
STR R0,R4,#0 ; store typed character into memory location
LEA R0,PIG ; loads starting address of pig latin prompt
PUTS ; displays pig latin prompt on screen
LEA R0,ENGLWORD
PUTS
BRnzp REPEAT
LD R1,SAVER1 ; restore R1 to original value
LD R2,SAVER2 ; restore R2 to original value
LD R3,SAVER3 ; restore R3 to original value
HALT
SAVER1 .BLKW 1 ; allocates 1 memory location for SAVER1
SAVER2 .BLKW 1 ; allocates 1 memory location for SAVER2
SAVER3 .BLKW 1 ; allocates 1 memory location for SAVER3
ENGLWORD .BLKW #20
ENTER .FILL xFFF6 ; the negative value of the ASCII code for the enter key
NEWLINE .FILL x000A
PROMPT .STRINGZ "\nEnglish Word: " ; initializes a sequence of stringLength+1 memory locations to hold string
PIG .STRINGZ "\nPig-Latin Word: "
DSR .FILL xFE04
DDR .FILL xFE06
KBSR .FILL xFE00
KBDR .FILL xFE02
.END
All I did was store a '0' value at the end of the user's string, that way when PUTs is called it will stop at the zero value.

lldb - How to display float with decimals using "type format add"

I have a variable of type float. Xcode displays it using scientific notation (i.e. 3.37626e+07). I'm trying to get it to display using dot notation (i.e. 33762616.00).
I've tried every format provided by lldb, but none displays the float using decimals. I read other posts and watched the WWDC2012 session 415 (as suggested here), but I must be too close the forest to see the trees. Any help would be greatly appreciated!
Try adding a custom data formatter in your ~/.lldbinit file for type float. e.g.
Process 13204 stopped
* thread #1: tid = 0xb6f8d, 0x0000000100000f33 a.out`main + 35 at a.c:5, stop reason = step over
#0: 0x0000000100000f33 a.out`main + 35 at a.c:5
2 int main ()
3 {
4 float f = 33762616.0;
-> 5 printf ("%f\n", f);
6 }
(lldb) p f
(float) $0 = 3.37626e+07
(lldb) type summ add -v -o "return '%f' % valobj.GetData().GetFloat(lldb.SBError(), 0)" float
(lldb) p f
(float) $1 = 33762616.000000
(lldb)
The default set of formatters provided by lldb can't do this, but dropping into Python allows you a lot of flexibility.

Resources