I wanna get some memory dump of a specific process.
I've found each windows process contain VadRoot in a EPROCESS.
I used windbg to get some information of this structure...
kd> dt nt!_MMVAD fffffa801b7011d0
+0x000 u1 : <unnamed-tag>
+0x008 LeftChild : (null)
+0x010 RightChild : (null)
+0x018 StartingVpn : 0x7fefe440
+0x020 EndingVpn : 0x7fefe4b0
+0x028 u : <unnamed-tag>
+0x030 PushLock : _EX_PUSH_LOCK
+0x038 u5 : <unnamed-tag>
+0x040 u2 : <unnamed-tag>
+0x048 Subsection : 0xfffffa80`19f62640 _SUBSECTION
+0x048 MappedSubsection : 0xfffffa80`19f62640 _MSUBSECTION
+0x050 FirstPrototypePte : 0xfffff8a0`00b3ac28 _MMPTE
+0x058 LastContiguousPte : 0xffffffff`fffffffc _MMPTE
+0x060 ViewLinks : _LIST_ENTRY [ 0xfffffa80`1b7a38c0 - 0xfffffa80`1aa6d6a0 ]
+0x070 VadsProcess : 0xfffffa80`1b7e8941 _EPROCESS
Its Win7 64bit.
I guess StartingVpn: 0x7fefe440 has contain the memory contents of this block.
But is that a virtual address? or physical address? i don't know
what it stands for...
Thanks.
locate process
lkd> !process 0 0 explorer.exe
PROCESS 8a1908d0 ...... Image: explorer.exe
set process context
lkd> .process /p /r 8a1908d0
view reqd module
lkd> lm m explorer
start end module name
01000000 010ff000 Explorer (deferred)
get the vadroot for a virtual address in the current process context
lkd> !vad explorer 1
VAD # 8a120ed0
Start VPN 1000 End VPN 10fe Control Area 8a81ab80
FirstProtoPte e23e9048 LastPte fffffffc Commit Charge 3 (3.)
Secured.Flink 0 Blink 0 Banked/Extend 0
File Offset 0
ImageMap ViewShare EXECUTE_WRITECOPY
ReadOnly
ControlArea # 8a81ab80
Segment e23e9008 Flink 00000000 Blink 00000000
Section Ref 1 Pfn Ref 4d Mapped Views 1
User Ref 2 WaitForDel 0 Flush Count 0
File Object 8ab28240 ModWriteCount 0 System Views 0
Flags (90000a0) Image File HadUserReference Accessed
\WINDOWS\explorer.exe
Segment # e23e9008
ControlArea 8a81ab80 BasedAddress 01000000
Total Ptes ff
WriteUserRef 0 SizeOfSegment ff000
Committed 0 PTE Template 8a81ac3000000420
Based Addr 1000000 Image Base 0
Image Commit 2 Image Info e23e9840
ProtoPtes e23e9048
Reload command: .reload explorer.exe=01000000,ff000
dump all the vads for a current process context
lkd> !vad 8a120ed0 0
VAD level start end commit
8a03b1d8 ( 3) e50 e51 0 Mapped READONLY Pagefile-backed section
8a6fe240 ( 4) e60 e6f 0 Mapped READWRITE Pagefile-backed section
................................
89c86600 ( 5) ff0 ff0 1 Private READWRITE
8a120ed0 ( 0) 1000 10fe 3 Mapped Exe EXECUTE_WRITECOPY \WINDOWS\explorer.exe
.................................
8a87bb18 ( 7) 26d0 2733 0 Mapped READWRITE \Documents and Settings\Admin\Local Settings\History\History.IE5\index.dat
8a74b420 ( 0) 3e1c0 3ec52 10 Mapped Exe EXECUTE_WRITECOPY \WINDOWS\system32\ieframe.dll
8abfa398 ( 1) 7ffde 7ffde 1 Private READWRITE
Total VADs: 1231, average level: 5, maximum depth: 4294967295
VAD is short for virtual address descriptor and VPN is short for virtual page number. So it's a virtual address, not a physical address.
It needs to be translated to a physical address using PTEs (page table entry).
Given a user mode address I found with a user mode debugging session:
0:032> !address
[...]
+ 7ff`fffdc000 7ff`fffde000 0`00002000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE TEB [~1; 13ec.10fc]
0:032> dd 7ff`fffde000 L8
000007ff`fffde000 00000000 00000000 00240000 00000000
000007ff`fffde010 0022b000 00000000 00000000 00000000
I can do this in a kernel debugging session using LiveKd (SysInternals):
0: kd> !process 0 0 explorer.exe
PROCESS fffffa8012ce5b10
SessionId: 1 Cid: 13ec Peb: 7fffffd6000 ParentCid: 13c0
DirBase: 3029e8000 ObjectTable: fffff8a006139d60 HandleCount: 1078.
Image: explorer.exe
0: kd> .process /p /r fffffa8012ce5b10
Implicit process is now fffffa80`12ce5b10
Loading User Symbols
[...]
0: kd> !vtop 0 7fffffde000
Amd64VtoP: Virt 000007ff`fffde000, pagedir 00000003`029e8000
Amd64VtoP: PML4E 00000003`029e8078
Amd64VtoP: PDPE 00000003`00ebcff8
Amd64VtoP: PDE 00000003`0203dff8
Amd64VtoP: PTE 00000003`01ebeef0
Amd64VtoP: Mapped phys 00000002`ff44f000
Virtual address 7fffffde000 translates to physical address 2ff44f000.
0: kd> dd /p 2ff44f000 L8
00000002`ff44f000 00000000 00000000 00240000 00000000
00000002`ff44f010 0022b000 00000000 00000000 00000000
Note how the content of the virtual address (dd) is identical to the physical address (dd /p).
Related
An Mbed code is throwing the crash dump below and I wish to find the line corresponding to the given PC. I'm on Windows though, so the simple "addr2line" is not available. I tried addr2line with Ubuntu shell on Windows, but it gives ??:?
What is the best tool on Windows 10 to perform address-to-line resolution from ARM ELF?
++ MbedOS Fault Handler ++
FaultType: HardFault
Context:
R0: 0
R1: 2000A0C8
R2: 1
R3: 14
R4: 20007854
R5: 2000A0
R6: 68
R7: 0
R8: 0
R9: 0
R10: 0
R11: 0
R12: 29FC1
SP : 2000A8B8
LR : 2C007
PC : 2000A0C8
xPSR : 0
PSP : 2000A898
MSP : 2003FFC0
CPUID: 410FC241
HFSR : 40000000
MMFSR: 0
BFSR : 0
UFSR : 2
DFSR : 0
AFSR : 0
Mode : Thread
Priv : Privileged
Stack: PSP
-- MbedOS Fault Handler --
Using WinDbg Preview or WinDbg from Windows 10 SDK, when launching 32-bit process on Windows 10 1909 (build 18363.815) setting a breakpoint on kernelbase!RegOpenKeyExW by name doesn't work.
Example:
Launch C:\windows\syswow64\notepad.exe under WinDbg
.symfix C:\symbols
.reload
bp ntdll!NtOpenKeyEx
g
k
# ChildEBP RetAddr
00 0308f314 74bb5030 ntdll!NtOpenKeyEx
01 0308f3c4 74bb4b87 KERNELBASE!LocalBaseRegOpenKey+0x110
02 0308f42c 74bb4a3c KERNELBASE!RegOpenKeyExInternalW+0x137
03 0308f450 761c34b9 KERNELBASE!RegOpenKeyExW+0x1c
04 0308f488 761c345c combase!ComVerifierSettings::ReadBooleanFromOleKey+0x35 [onecore\com\combase\verifier\verify.cxx # 1046]
05 0308f4a4 76115745 combase!ComVerifierSettings::ComVerifierSettings+0x2f [onecore\com\combase\verifier\verify.cxx # 768]
06 0308f4a8 756a6cd7 combase!`dynamic initializer for 'ComVerifierSettings::s_singleton''+0x5 [onecore\com\combase\verifier\verify.cxx # 626]
07 0308f4c0 761e1801 ucrtbase!_initterm+0x37
08 0308f500 761e175d combase!dllmain_crt_process_attach+0x8c [vccrt\vcstartup\src\startup\dll_dllmain.cpp # 64]
09 0308f510 761e196a combase!dllmain_crt_dispatch+0x3d [vccrt\vcstartup\src\startup\dll_dllmain.cpp # 138]
0a 0308f550 761e1a6e combase!dllmain_dispatch+0x59 [vccrt\vcstartup\src\startup\dll_dllmain.cpp # 195]
0b 0308f564 77071de6 combase!_DllMainCRTStartup+0x1e [vccrt\vcstartup\src\startup\dll_dllmain.cpp # 253]
0c 0308f584 77035608 ntdll!LdrxCallInitRoutine+0x16
0d 0308f5d0 77043f8f ntdll!LdrpCallInitRoutine+0x51
0e 0308f658 77044836 ntdll!LdrpInitializeNode+0x133
0f 0308f67c 7704484d ntdll!LdrpInitializeGraphRecurse+0x5d
10 0308f6a4 770a9542 ntdll!LdrpInitializeGraphRecurse+0x74
11 0308f6b4 770a9382 ntdll!LdrpInitializeGraph+0x13
12 0308f914 77051dd1 ntdll!LdrpInitializeProcess+0x1cc2
13 0308f96c 77051cc1 ntdll!_LdrpInitialize+0xba
14 0308f978 00000000 ntdll!LdrInitializeThunk+0x11
.restart
bc *
bp KERNELBASE!RegOpenKeyExW
g
No breakpoint hit
.restart
bc *
x kernelbase!RegOpenKeyExW*
74bc64b0 KERNELBASE!RegOpenKeyExW (void)
74bb4a20 KERNELBASE!RegOpenKeyExW (_RegOpenKeyExW#20)
uf 74bc64b0
KERNELBASE!EventAccessControl:
74bc64b0 6a7f push 7Fh
74bc64b2 58 pop eax
74bc64b3 c21400 ret 14h
uf 74bb4a20
KERNELBASE!RegOpenKeyExW:
74bb4a20 8bff mov edi,edi
74bb4a22 55 push ebp
74bb4a23 8bec mov ebp,esp
74bb4a25 51 push ecx
74bb4a26 6a00 push 0
74bb4a28 ff7518 push dword ptr [ebp+18h]
74bb4a2b ff7514 push dword ptr [ebp+14h]
74bb4a2e ff7510 push dword ptr [ebp+10h]
74bb4a31 ff750c push dword ptr [ebp+0Ch]
74bb4a34 ff7508 push dword ptr [ebp+8]
74bb4a37 e814000000 call KERNELBASE!RegOpenKeyExInternalW (74bb4a50)
74bb4a3c 59 pop ecx
74bb4a3d 5d pop ebp
74bb4a3e c21400 ret 14h
bp 74bb4a20
g
Breakpoint hit - why do I have to use this address not name? Why the duplicate names?
Breakpoint 0 hit
eax=0308f478 ebx=00000000 ecx=760de820 edx=00000000 esi=760de820 edi=760c8d98
eip=74bb4a20 esp=0308f454 ebp=0308f488 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
KERNELBASE!RegOpenKeyExW:
74bb4a20 8bff mov edi,edi
Checking import table of process, the address referenced is 74bb4a20.
0:000> lmvm notepad
Browse full module list
start end module name
00fe0000 0100b000 notepad (deferred)
Image path: notepad.exe
Image name: notepad.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 93B4E8FA (This is a reproducible build file hash, not a timestamp)
CheckSum: 00032822
ImageSize: 0002B000
File version: 10.0.18362.693
Product version: 10.0.18362.693
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: Notepad
OriginalFilename: NOTEPAD.EXE
ProductVersion: 10.0.18362.693
FileVersion: 10.0.18362.693 (WinBuild.160101.0800)
FileDescription: Notepad
LegalCopyright: © Microsoft Corporation. All rights reserved.
0:000> !dh 00fe0000
File Type: EXECUTABLE IMAGE
FILE HEADER VALUES
14C machine (i386)
6 number of sections
93B4E8FA time date stamp
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
102 characteristics
Executable
32 bit word machine
OPTIONAL HEADER VALUES
10B magic #
14.15 linker version
1FC00 size of code
7400 size of initialized data
0 size of uninitialized data
1F8D0 address of entry point
1000 base of code
----- new -----
00fe0000 image base
1000 section alignment
200 file alignment
2 subsystem (Windows GUI)
10.00 operating system version
10.00 image version
10.00 subsystem version
2B000 size of image
400 size of headers
32822 checksum
00040000 size of stack reserve
00011000 size of stack commit
00100000 size of heap reserve
00001000 size of heap commit
C140 DLL characteristics
Dynamic base
NX compatible
Guard
Terminal server aware
0 [ 0] address [size] of Export Directory
234B8 [ 370] address [size] of Import Directory
27000 [ BE0] address [size] of Resource Directory
0 [ 0] address [size] of Exception Directory
0 [ 0] address [size] of Security Directory
28000 [ 21A8] address [size] of Base Relocation Directory
4A80 [ 54] address [size] of Debug Directory
0 [ 0] address [size] of Description Directory
0 [ 0] address [size] of Special Directory
13D4 [ 18] address [size] of Thread Storage Directory
1330 [ A4] address [size] of Load Configuration Directory
0 [ 0] address [size] of Bound Import Directory
23000 [ 4B4] address [size] of Import Address Table Directory
207A4 [ E0] address [size] of Delay Import Directory
0 [ 0] address [size] of COR20 Header Directory
0 [ 0] address [size] of Reserved Directory
SECTION HEADER #1
.text name
1FB50 virtual size
1000 virtual address
1FC00 size of raw data
400 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
60000020 flags
Code
(no align specified)
Execute Read
Debug Directories(3)
Type Size Address Pointer
cv 24 5078 4478 Format: RSDS, guid, 1, notepad.pdb
( 13) 3a4 509c 449c
( 16) 24 5440 4840
SECTION HEADER #2
.data name
1DB0 virtual size
21000 virtual address
800 size of raw data
20000 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
(no align specified)
Read Write
SECTION HEADER #3
.idata name
2472 virtual size
23000 virtual address
2600 size of raw data
20800 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
(no align specified)
Read Only
SECTION HEADER #4
.didat name
78 virtual size
26000 virtual address
200 size of raw data
22E00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0000040 flags
Initialized Data
(no align specified)
Read Write
SECTION HEADER #5
.rsrc name
BE0 virtual size
27000 virtual address
C00 size of raw data
23000 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
40000040 flags
Initialized Data
(no align specified)
Read Only
SECTION HEADER #6
.reloc name
21A8 virtual size
28000 virtual address
2200 size of raw data
23C00 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
42000040 flags
Initialized Data
Discardable
(no align specified)
Read Only
0:000> dps 00fe0000+23000 00fe0000+23000+4B4
01003000 639b5690 COMCTL32!CreateStatusWindowW
01003004 63a48240 COMCTL32!TaskDialogIndirect
01003008 00000000
0100300c 76f04680 GDI32!SelectObject
01003010 76f07930 GDI32!GetTextFaceW
01003014 76f077a0 GDI32!EnumFontsW
01003018 76f079b0 GDI32!TextOutW
0100301c 76f06a80 GDI32!GetTextExtentPoint32WStub
01003020 76f05790 GDI32!SetMapModeStub
01003024 76f060e0 GDI32!SetViewportExtExStub
01003028 76f060a0 GDI32!SetWindowExtExStub
0100302c 76f05540 GDI32!LPtoDPStub
01003030 76f03660 GDI32!DeleteObject
01003034 76f07950 GDI32!GetTextMetricsW
01003038 76f06370 GDI32!EndPage
0100303c 76f0b990 GDI32!AbortDoc
01003040 76f068c0 GDI32!EndDoc
01003044 76f03290 GDI32!DeleteDC
01003048 76f0b000 GDI32!SetAbortProc
0100304c 76f06840 GDI32!StartDocW
01003050 76f06340 GDI32!StartPage
01003054 76f06c60 GDI32!CreateDCW
01003058 76f04940 GDI32!CreateFontIndirectW
0100305c 76f047f0 GDI32!SetBkMode
01003060 76f041e0 GDI32!GetDeviceCaps
01003064 00000000
01003068 75450180 USER32!SetThreadDpiAwarenessContext
0100306c 7543e3f0 USER32!PostMessageW
01003070 75474170 USER32!DialogBoxParamW
01003074 7543ea10 USER32!GetFocus
01003078 75491370 USER32!MessageBoxW
0100307c 75432fe0 USER32!GetMenu
01003080 75446e40 USER32!CheckMenuItem
01003084 75447a10 USER32!GetSubMenu
01003088 75445f90 USER32!EnableMenuItem
0100308c 75455bd0 USER32!NtUserShowWindow
01003090 7543e8b0 USER32!GetDC
01003094 7543e290 USER32!ReleaseDC
01003098 754544dc USER32!SetCursorStub
0100309c 75451760 USER32!GetDpiForWindow
010030a0 75455840 USER32!NtUserSetActiveWindow
010030a4 7543f580 USER32!LoadStringW
010030a8 770882e0 ntdll!NtdllDefWindowProc_W
010030ac 7543b6f0 USER32!IsIconic
010030b0 75455980 USER32!NtUserSetFocus
010030b4 754543c0 USER32!PostQuitMessage
010030b8 75454ae0 USER32!NtUserDestroyWindow
010030bc 7549f1b0 USER32!MessageBeep
010030c0 75455470 USER32!NtUserMoveWindow
010030c4 75431cb0 USER32!GetDlgCtrlID
010030c8 75455b70 USER32!NtUserSetWindowPos
010030cc 754556c0 USER32!NtUserRedrawWindow
010030d0 7543f040 USER32!GetKeyboardLayout
010030d4 75453dc0 USER32!CharNextWStub
010030d8 7543fd40 USER32!SetWinEventHook
010030dc 7543e730 USER32!GetMessageW
010030e0 7544b790 USER32!TranslateAcceleratorW
010030e4 75437fe0 USER32!IsDialogMessageW
010030e8 754383c0 USER32!TranslateMessage
010030ec 75433eb0 USER32!DispatchMessageW
010030f0 75455c80 USER32!NtUserUnhookWinEvent
010030f4 75430620 USER32!SetWindowTextW
010030f8 7544fbd0 USER32!OpenClipboard
010030fc 7544f420 USER32!IsClipboardFormatAvailableStub
01003100 75450e80 USER32!CloseClipboardStub
01003104 75451380 USER32!SetDlgItemTextW
01003108 75450cf0 USER32!GetDlgItemTextW
0100310c 75450630 USER32!EndDialog
01003110 75440720 USER32!SendDlgItemMessageW
01003114 75441400 USER32!SetScrollPos
01003118 75455300 USER32!NtUserInvalidateRect
0100311c 75432f60 USER32!UpdateWindow
01003120 754551a0 USER32!NtUserGetWindowPlacement
01003124 75455b60 USER32!NtUserSetWindowPlacement
01003128 7543fca0 USER32!CharUpperWStub
0100312c 754550b0 USER32!NtUserGetSystemMenu
01003130 75453020 USER32!LoadAcceleratorsW
01003134 75438800 USER32!SetWindowLongW
01003138 7542f6c0 USER32!CreateWindowExW
0100313c 754306f0 USER32!MonitorFromWindow
01003140 7543f5b0 USER32!RegisterWindowMessageW
01003144 754313a0 USER32!LoadCursorW
01003148 7542e4c0 USER32!RegisterClassExW
0100314c 75430680 USER32!GetWindowTextLengthW
01003150 75433470 USER32!GetWindowLongW
01003154 75439da0 USER32!PeekMessageW
01003158 754312c0 USER32!GetWindowTextW
0100315c 7543fc80 USER32!EnableWindow
01003160 75451400 USER32!CreateDialogParamW
01003164 754531f0 USER32!DrawTextExW
01003168 75433b50 USER32!GetClientRect
0100316c 754342e0 USER32!SendMessageW
01003170 75454e10 USER32!NtUserGetForegroundWindow
01003174 7542e440 USER32!LoadIconW
01003178 75453220 USER32!LoadImageW
0100317c 00000000
01003180 7604ded0 advapi32!IsTextUnicode
01003184 00000000
01003188 76177de0 combase!CoCreateFreeThreadedMarshaler [onecore\com\combase\dcomrem\ipmrshl.cxx # 201]
0100318c 761a79d0 combase!CoWaitForMultipleHandles [onecore\com\combase\dcomrem\sync.cxx # 87]
01003190 761534c0 combase!PropVariantClear [onecore\com\combase\util\propvar.cxx # 278]
01003194 76182860 combase!CoTaskMemAlloc [onecore\com\combase\class\memapi.cxx # 428]
01003198 761440a0 combase!CoCreateGuid [onecore\com\combase\class\cocrguid.cxx # 49]
0100319c 761829e0 combase!CoTaskMemFree [onecore\com\combase\class\memapi.cxx # 444]
010031a0 76159910 combase!CoCreateInstance [onecore\com\combase\objact\actapi.cxx # 109]
010031a4 76195f60 combase!CoInitializeEx [onecore\com\combase\class\compobj.cxx # 3792]
010031a8 76195fb0 combase!CoUninitialize [onecore\com\combase\class\compobj.cxx # 3851]
010031ac 00000000
010031b0 74bcb460 KERNELBASE!GetTimeFormatW
010031b4 74bcf0d0 KERNELBASE!GetDateFormatW
010031b8 00000000
010031bc 74bc4bb0 KERNELBASE!IsDebuggerPresent
010031c0 74c0e2d0 KERNELBASE!wil::details::DebugBreak
010031c4 74c524b0 KERNELBASE!OutputDebugStringW
010031c8 00000000
010031cc 74c4d510 KERNELBASE!DelayLoadFailureHook
010031d0 00000000
010031d4 74bc1630 KERNELBASE!ResolveDelayLoadedAPI
010031d8 00000000
010031dc 74bc43a0 KERNELBASE!RaiseException
010031e0 74ba27a0 KERNELBASE!GetLastError
010031e4 77060240 ntdll!RtlSetLastWin32Error
010031e8 74bc0640 KERNELBASE!SetUnhandledExceptionFilter
010031ec 74c5b8f0 KERNELBASE!UnhandledExceptionFilter
010031f0 00000000
010031f4 74bbf770 KERNELBASE!FindClose
010031f8 74bc48d0 KERNELBASE!SetEndOfFile
010031fc 74b9ffb0 KERNELBASE!DeleteFileW
01003200 74bbc2d0 KERNELBASE!GetFullPathNameW
01003204 74ba1540 KERNELBASE!WriteFile
01003208 74b9f9e0 KERNELBASE!FindFirstFileW
0100320c 74bc0c50 KERNELBASE!GetFileAttributesExW
01003210 74b9f860 KERNELBASE!GetFileAttributesW
01003214 74ba20b0 KERNELBASE!CreateFileW
01003218 74ba1ee0 KERNELBASE!ReadFile
0100321c 74bc1750 KERNELBASE!GetFileInformationByHandle
01003220 00000000
01003224 74ba26f0 KERNELBASE!CloseHandle
01003228 00000000
0100322c 74b9b0b0 KERNELBASE!GetProcessHeap
01003230 7703ae50 ntdll!RtlAllocateHeap
01003234 7703dc70 ntdll!RtlFreeHeap
01003238 74bc4d20 KERNELBASE!HeapSetInformation
0100323c 00000000
01003240 74ba5210 KERNELBASE!LocalFree
01003244 74bbf030 KERNELBASE!GlobalAlloc
01003248 74ba5340 KERNELBASE!LocalAlloc
0100324c 74bb7c50 KERNELBASE!LocalUnlock
01003250 74b9b760 KERNELBASE!LocalReAlloc
01003254 74bb7aa0 KERNELBASE!LocalLock
01003258 74bbf820 KERNELBASE!GlobalFree
0100325c 00000000
01003260 757b4050 KERNEL32!GlobalLock
01003264 757b7b00 KERNEL32!LocalSize
01003268 757b4740 KERNEL32!GlobalUnlock
0100326c 00000000
01003270 74be0d80 KERNELBASE!MulDiv
01003274 00000000
01003278 74ba0420 KERNELBASE!GetModuleHandleW
0100327c 74ba1700 KERNELBASE!LoadLibraryExW
01003280 74b9ea60 KERNELBASE!GetProcAddress
01003284 74ba0320 KERNELBASE!FreeLibrary
01003288 74bbe8b0 KERNELBASE!GetModuleFileNameW
0100328c 74bbe7c0 KERNELBASE!GetModuleFileNameA
01003290 74b9f3b0 KERNELBASE!GetModuleHandleExW
01003294 00000000
01003298 74ba9a60 KERNELBASE!GetACP
0100329c 74b9b450 KERNELBASE!FormatMessageW
010032a0 74ba36e0 KERNELBASE!GetLocaleInfoW
010032a4 74c109a0 KERNELBASE!FindNLSString
010032a8 00000000
010032ac 74bbde70 KERNELBASE!GetUserDefaultUILanguage
010032b0 00000000
010032b4 74bbf740 KERNELBASE!UnmapViewOfFile
010032b8 74bbe6f0 KERNELBASE!MapViewOfFile
010032bc 74ba0910 KERNELBASE!CreateFileMappingW
010032c0 00000000
010032c4 74bc5000 KERNELBASE!GetCommandLineW
010032c8 00000000
010032cc 757b1a60 KERNEL32!GetCurrentThreadId
010032d0 757c3bf0 KERNEL32!GetCurrentProcess
010032d4 74bbf520 KERNELBASE!OpenProcessToken
010032d8 757c3c00 KERNEL32!GetCurrentProcessId
010032dc 757b9aa0 KERNEL32!GetStartupInfoWStub
010032e0 757bf420 KERNEL32!TerminateProcessStub
010032e4 00000000
010032e8 74bc0940 KERNELBASE!GetProcessMitigationPolicy
010032ec 00000000
010032f0 77060550 ntdll!RtlQueryPerformanceCounter
010032f4 00000000
010032f8 74bb4a20 KERNELBASE!RegOpenKeyExW
010032fc 74bb5800 KERNELBASE!RegCloseKey
01003300 74bb4460 KERNELBASE!RegQueryValueExW
01003304 74bd4530 KERNELBASE!RegSetValueExW
01003308 00000000
0100330c 7604efe0 advapi32!RegCreateKeyW
01003310 00000000
01003314 74b9f2c0 KERNELBASE!PathFileExistsW
01003318 74bd25a0 KERNELBASE!PathIsFileSpecW
0100331c 74bbebd0 KERNELBASE!PathFindExtensionW
01003320 00000000
01003324 74bb1de0 KERNELBASE!WideCharToMultiByte
01003328 74bd1490 KERNELBASE!FoldStringW
0100332c 74bb0390 KERNELBASE!CompareStringOrdinal
01003330 74ba6350 KERNELBASE!MultiByteToWideChar
01003334 00000000
01003338 757b7740 KERNEL32!lstrcmpiWStub
0100333c 00000000
01003340 770360b0 ntdll!RtlEnterCriticalSection
01003344 7705c380 ntdll!RtlDeleteCriticalSection
01003348 74ba0cb0 KERNELBASE!CreateMutexExW
0100334c 74bbeba0 KERNELBASE!SetEvent
01003350 77058680 ntdll!RtlLeaveCriticalSection
01003354 77053b40 ntdll!RtlReleaseSRWLockShared
01003358 74bbeac0 KERNELBASE!InitializeCriticalSectionEx
0100335c 74b9d850 KERNELBASE!OpenSemaphoreW
01003360 74bc1720 KERNELBASE!ReleaseSemaphore
01003364 74baef90 KERNELBASE!WaitForSingleObject
01003368 770384a0 ntdll!RtlAcquireSRWLockExclusive
0100336c 74baef10 KERNELBASE!ReleaseMutex
01003370 74b9f320 KERNELBASE!CreateSemaphoreExW
01003374 7703ec20 ntdll!RtlReleaseSRWLockExclusive
01003378 74baefb0 KERNELBASE!WaitForSingleObjectEx
0100337c 74bbe9c0 KERNELBASE!CreateEventExW
01003380 77053c10 ntdll!RtlAcquireSRWLockShared
01003384 00000000
01003388 74bbf590 KERNELBASE!Sleep
0100338c 77068e00 ntdll!RtlWakeAllConditionVariable
01003390 74bc3f70 KERNELBASE!SleepConditionVariableSRW
01003394 00000000
01003398 74bbe020 KERNELBASE!GetLocalTime
0100339c 74bbc6a0 KERNELBASE!GetSystemTimeAsFileTime
010033a0 74bb1a20 KERNELBASE!GetTickCount
010033a4 00000000
010033a8 77053ee0 ntdll!TpSetTimer
010033ac 77052580 ntdll!TpWaitForTimer
010033b0 770524f0 ntdll!TpReleaseTimer
010033b4 74bc3350 KERNELBASE!CreateThreadpoolTimer
010033b8 00000000
010033bc 761d39b0 combase!SetRestrictedErrorInfo [onecore\com\combase\winrt\error\restrictederror.cpp # 125]
010033c0 00000000
010033c4 761ddef0 combase!RoGetMatchingRestrictedErrorInfo [onecore\com\combase\winrt\error\restrictederror.cpp # 205]
010033c8 00000000
010033cc 7615ec90 combase!RoGetActivationFactory [onecore\com\combase\winrtbase\winrtbase.cpp # 1062]
010033d0 761d1b80 combase!RoInitialize [onecore\com\combase\winrtbase\winrtbase.cpp # 329]
010033d4 761db3e0 combase!RoUninitialize [onecore\com\combase\winrtbase\winrtbase.cpp # 454]
010033d8 00000000
010033dc 761626a0 combase!WindowsCreateStringReference [onecore\com\combase\winrt\string\string.cpp # 70]
010033e0 761bcf30 combase!WindowsDeleteString [onecore\com\combase\winrt\string\string.cpp # 146]
010033e4 7619c530 combase!WindowsGetStringRawBuffer [onecore\com\combase\winrt\string\string.cpp # 226]
010033e8 7614b690 combase!WindowsCreateString [onecore\com\combase\winrt\string\string.cpp # 30]
010033ec 00000000
010033f0 77044d10 ntdll!EtwEventUnregister
010033f4 77065d70 ntdll!EtwEventWriteTransfer
010033f8 7705e180 ntdll!EtwEventSetInformation
010033fc 7705f800 ntdll!EtwEventRegister
01003400 00000000
01003404 74ba10d0 KERNELBASE!GetTokenInformation
01003408 00000000
0100340c 756095b0 shcore!SHStrDupW
01003410 00000000
01003414 755ffea0 shcore!PathIsNetworkPathW
01003418 00000000
0100341c 75618a90 shcore!GetDpiForMonitor
01003420 00000000
01003424 74a46dd0 msvcrt!__dllonexit
01003428 74a373a0 msvcrt!free
0100342c 74a216c0 msvcrt!iswdigit
01003430 74aa5ba0 msvcrt!_acmdln
01003434 74a566f0 msvcrt!exit
01003438 74a88540 msvcrt!__setusermatherr
0100343c 74a56fe0 msvcrt!_unlock
01003440 74a25c50 msvcrt!__getmainargs
01003444 74a56e30 msvcrt!_lock
01003448 74a46eb0 msvcrt!_onexit
0100344c 74a561b0 msvcrt!_amsg_exit
01003450 74a7ab30 msvcrt!wcsnlen
01003454 74a3eb40 msvcrt!_ismbblead
01003458 74a47600 msvcrt!__set_app_type
0100345c 74a56230 msvcrt!_cexit
01003460 74a25d60 msvcrt!__p__commode
01003464 74a56110 msvcrt!_exit
01003468 74a44c40 msvcrt!_XcptFilter
0100346c 74a564c0 msvcrt!_initterm
01003470 74a77f60 msvcrt!_wcsicmp
01003474 74a23db0 msvcrt!_wtol
01003478 74a79910 msvcrt!memmove_s
0100347c 74a48bc0 msvcrt!_purecall
01003480 74a79500 msvcrt!memcpy_s
01003484 74a66ef0 msvcrt!_vsnwprintf
01003488 74a2b000 msvcrt!__CxxFrameHandler
0100348c 74a89fc0 msvcrt!_controlfp
01003490 74a2a670 msvcrt!terminate
01003494 74a48370 msvcrt!_except_handler4_common
01003498 74a25db0 msvcrt!__p__fmode
0100349c 74a37580 msvcrt!malloc
010034a0 74a34d70 msvcrt!_callnewh
010034a4 74a79130 msvcrt!memcmp
010034a8 74a79190 msvcrt!memcpy
010034ac 74a79970 msvcrt!memset
010034b0 00000000
010034b4 77088cb0 ntdll!LdrpValidateUserCallTarget
Reloading symbols made no difference:
0:007> .reload /f kernelbase.dll
SYMSRV: BYINDEX: 0x49
C:\symbols*https://msdl.microsoft.com/download/symbols
wkernelbase.pdb
017FA9C5278235B7E6BFBA74A9A5AAD91
SYMSRV: PATH: C:\symbols\wkernelbase.pdb\017FA9C5278235B7E6BFBA74A9A5AAD91\wkernelbase.pdb
SYMSRV: RESULT: 0x00000000
DBGHELP: KERNELBASE - public symbols
C:\symbols\wkernelbase.pdb\017FA9C5278235B7E6BFBA74A9A5AAD91\wkernelbase.pdb
I can set breakpoint via bm using wildcard, but in the past I have never had to do this:
0:000> bm kernelbase!RegOpenKeyExW*
1: 74bc64b0 #!"KERNELBASE!RegOpenKeyExW"
2: 74bb4a20 #!"KERNELBASE!RegOpenKeyExW"
Wondering if there is any specific change causing this, or is problem with symbols, etc?
well one is CLRTYPE private symbol I don't know how it crept in but iirc there are few more symbols like this
use .symopt+4000 to load only public symbols
then your breakpoint will be set correctly
0:000> .symopt
Symbol options are 0x30337:
0x00000001 - SYMOPT_CASE_INSENSITIVE
0x00000002 - SYMOPT_UNDNAME
0x00000004 - SYMOPT_DEFERRED_LOADS
0x00000010 - SYMOPT_LOAD_LINES
0x00000020 - SYMOPT_OMAP_FIND_NEAREST
0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS
0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS
0x00010000 - SYMOPT_AUTO_PUBLICS
0x00020000 - SYMOPT_NO_IMAGE_SEARCH
0:000> x /v /f /t kernelbase!RegOpenKeyExW*
prv func 00007fff`582a3120 6 <CLR type> KERNELBASE!RegOpenKeyExW (void)
pub func 00007fff`58248c60 0 <NoType> KERNELBASE!RegOpenKeyExW (<no parameter info>)
0:000> .symopt+4000
Symbol options are 0x34337:
0x00000001 - SYMOPT_CASE_INSENSITIVE
0x00000002 - SYMOPT_UNDNAME
0x00000004 - SYMOPT_DEFERRED_LOADS
0x00000010 - SYMOPT_LOAD_LINES
0x00000020 - SYMOPT_OMAP_FIND_NEAREST
0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS
0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS
0x00004000 - SYMOPT_PUBLICS_ONLY
0x00010000 - SYMOPT_AUTO_PUBLICS
0x00020000 - SYMOPT_NO_IMAGE_SEARCH
0:000> x /v /f /t kernelbase!RegOpenKeyExW*
pub func 00007fff`58248c60 0 <NoType> KERNELBASE!RegOpenKeyExW (<no parameter info>)
0:000> bp KERNELBASE!RegOpenKeyExW
0:000> bl
0 e Disable Clear 00007fff`58248c60 0001 (0001) 0:**** KERNELBASE!RegOpenKeyExW
0:000> g
ModLoad: 00007fff`59140000 00007fff`5916e000 C:\WINDOWS\System32\IMM32.DLL
Breakpoint 0 hit
KERNELBASE!RegOpenKeyExW:
00007fff`58248c60 4883ec38 sub rsp,38h
0:000> uf .
KERNELBASE!RegOpenKeyExW:
00007fff`58248c60 4883ec38 sub rsp,38h
00007fff`58248c64 488b442460 mov rax,qword ptr [rsp+60h]
00007fff`58248c69 488364242800 and qword ptr [rsp+28h],0
00007fff`58248c6f 4889442420 mov qword ptr [rsp+20h],rax
00007fff`58248c74 e817000000 call KERNELBASE!RegOpenKeyExInternalW (00007fff`58248c90)
00007fff`58248c79 4883c438 add rsp,38h
00007fff`58248c7d c3 ret
As stated there are quiet a few symbols that all point to this Address
windbg -c ".logopen d:\syms.txt;x /v /t kernelbase!*
;.logclose;q" windbg
D:\>wc -l syms.txt
41405 syms.txt
D:\>grep -i RegOpenKeyExW syms.txt
prv func 00007fff`582a3120 6 <CLR type> KERNELBASE!RegOpenKeyExW (void)
pub func 00007fff`58248c60 0 <NoType> KERNELBASE!RegOpenKeyExW (<no parameter info>)
D:\>grep -i 00007fff`582a3120 syms.txt | wc -l
1935
D:\>grep -i prv.*00007fff`582a3120 syms.txt | wc -l
1935
D:\>grep -i pub.*00007fff`582a3120 syms.txt | wc -l
0
I'm trying to track down issues with a 3thParty application. The path currently being investigated is to look into a Section object that get's created in each process: rpsPdf10.mutex.
If the name of the object is any indication for it's intended usage, I'm not sure why they choose a Section object and use it as a Mutex but that's likely largely irrelevant.
Using LiveKd I've issued following command's trying to get detailed info of the Section object
0: kd>!process 0 0 3thParty.exe
...
PROCESS fffffa800ea80060
SessionId: 0 Cid: 0a00 Peb: fffdf000 ParentCid: 014c
DirBase: 99349000 ObjectTable: fffff8a004448bf0 HandleCount: 338.
Image: 3thParty.exe
...
0: kd> !handle 0 7 fffffa800ea80060
...
08 fffff8a012e26710 Section rpsPdf10.mutex
...
0: kd> !object fffff8a012e26710
Object: fffff8a012e26710 Type: (fffffa800cd7cea0) Section
ObjectHeader: fffff8a012e266e0 (new version)
HandleCount: 38 PointerCount: 39
Directory Object: fffff8a00a980080 Name: rpsPdf10.mutex
0: kd> dt nt!_FILE_OBJECT fffff8a012e26710
+0x000 Type : 0n256
+0x002 Size : 0n0
+0x008 DeviceObject : 0x000000000008dfb0 _DEVICE_OBJECT
+0x010 Vpb : 0xfffffa80c0000001 _VPB
+0x018 FsContext : (null)
+0x020 FsContext2 : 0xfffffa8000000034 Void
+0x028 SectionObjectPointer : 0xfffff8a0102d7820 _SECTION_OBJECT_POINTERS
+0x030 PrivateCacheMap : 0x0000000000001000 Void
+0x038 FinalStatus : 0n73728
+0x040 RelatedFileObject : 0x63536153030a040c _FILE_OBJECT
+0x048 LockOperation : 0x74 't'
+0x049 DeletePending : 0 ''
+0x04a ReadAccess : 0x65 'e'
+0x04b WriteAccess : 0 ''
+0x04c DeleteAccess : 0x73 's'
+0x04d SharedRead : 0 ''
+0x04e SharedWrite : 0x74 't'
The string 't' 'e' 's' 't' in the output definitely sticks out so
either I'm following a wrong path -> tx to Blabb, this is certain. It's not a fileobject but the question remains how to find out more information about the Section object. It's still curious and/or a rather unfortunate coincidence that following the section and control area pointers I derived from the fileobject info do seem correct?!
or there's something wrong with the Section object
or ... ?
tldr;
Following the _SECTION_OBJECT_POINTERS of the _FILE_OBJECT structure above, I arrive at a
NumberOfMappedViews of 0x26 (= HandleCount: 38)
NumberOfUserReferences of 0x27 (= PointerCount: 39)
so for the moment I assume the path I've followed is correct.
0: kd> dt nt!_SECTION_OBJECT_POINTERS 0xfffff8a0102d7820
+0x000 DataSectionObject : 0xfffffa800fbed900 Void
+0x008 SharedCacheMap : 0x0008000000000001 Void
+0x010 ImageSectionObject : 0x0000000000000001 Void
0: kd> dt nt!_CONTROL_AREA 0xfffffa800fbed900
+0x000 Segment : 0xfffff8a0102d7820 _SEGMENT
+0x008 DereferenceList : _LIST_ENTRY [ 0x0000000000000000 - 0x0000000000000000 ]
+0x018 NumberOfSectionReferences : 1
+0x020 NumberOfPfnReferences : 0
+0x028 NumberOfMappedViews : 0x26
+0x030 NumberOfUserReferences : 0x27
Edit
The object header looks like this
0: kd> dt nt!_OBJECT_HEADER fffff8a012e266e0
+0x000 PointerCount : 0n39
+0x008 HandleCount : 0n38
+0x008 NextToFree : 0x00000000`00000026 Void
+0x010 Lock : _EX_PUSH_LOCK
+0x018 TypeIndex : 0x21 '!'
+0x019 TraceFlags : 0 ''
+0x01a InfoMask : 0xa ''
+0x01b Flags : 0 ''
+0x020 ObjectCreateInfo : 0xfffffa80`0e505140 _OBJECT_CREATE_INFORMATION
+0x020 QuotaBlockCharged : 0xfffffa80`0e505140 Void
+0x028 SecurityDescriptor : 0xfffff8a0`1ba076a8 Void
+0x030 Body : _QUAD
Edit 2
following #blabb's answer adjusting for architecture
0: kd> ? #$proc
Evaluate expression: -6047068061600 = fffffa80`0ea80060
0: kd> dx (char *)#$proc->ImageFileName
(char *)#$proc->ImageFileName : 0xfffffa800ea80340 : [Type: char *] : "3thParty.exe"
0: kd> !handle 0 0 #$proc section
...
0474: Object: fffff8a012e26710 GrantedAccess: 000f0007
...
0: kd> !object fffff8a012e26710
Object: fffff8a012e26710 Type: (fffffa800cd7cea0) Section
ObjectHeader: fffff8a012e266e0 (new version)
HandleCount: 38 PointerCount: 39
Directory Object: fffff8a00a980080 Name: rpsPdf10.mutex
0: kd> ?? (unsigned long) (#FIELD_OFFSET(nt!_OBJECT_HEADER, Body))
unsigned long 0x30
0: kd> dt nt!_object_header 0xfffff8a012e26710-0x30
+0x000 PointerCount : 0n39
+0x008 HandleCount : 0n38
+0x008 NextToFree : 0x00000000`00000026 Void
+0x010 Lock : _EX_PUSH_LOCK
+0x018 TypeIndex : 0x21 '!'
+0x019 TraceFlags : 0 ''
+0x01a InfoMask : 0xa ''
+0x01b Flags : 0 ''
+0x020 ObjectCreateInfo : 0xfffffa80`0e505140 _OBJECT_CREATE_INFORMATION
+0x020 QuotaBlockCharged : 0xfffffa80`0e505140 Void
+0x028 SecurityDescriptor : 0xfffff8a0`1ba076a8 Void
+0x030 Body : _QUAD
0: kd> x nt!ObTypeIndexTable
fffff800`01a70c00 nt!ObTypeIndexTable = <no type information>
0: kd> dt -r1 nt!_SECTION_OBJECT 0xfffff8a012e26710
+0x000 StartingVa : 0x00000022`00000100 Void
+0x008 EndingVa : 0x00000000`0008dfb0 Void
+0x010 Parent : 0xfffffa80`c0000001 Void
+0x018 LeftChild : (null)
+0x020 RightChild : 0xfffffa80`00000034 Void
+0x028 Segment : 0xfffff8a0`102d7820 _SEGMENT_OBJECT
+0x000 BaseAddress : 0xfffffa80`0fbed900 Void
+0x008 TotalNumberOfPtes : 1
+0x010 SizeOfSegment : _LARGE_INTEGER 0x1
+0x018 NonExtendedPtes : 0x1000
+0x01c ImageCommitment : 0
+0x020 ControlArea : (null)
+0x028 Subsection : (null)
+0x030 MmSectionFlags : 0xfffffa80`10987b10 _MMSECTION_FLAGS
+0x038 MmSubSectionFlags : 0x00000000`03400000 _MMSUBSECTION_FLAGS
0: kd> dc 0xfffff8a012e26710-0x30-0x50
fffff8a0`12e26690 030c0408 f4636553 0e1a02e0 fffffa80 ....Sec.........
fffff8a0`12e266a0 00000048 000000b8 0000001c fffffa80 H...............
fffff8a0`12e266b0 0e505140 fffffa80 00000000 00000000 #QP.............
fffff8a0`12e266c0 0a980080 fffff8a0 001c001c 00000000 ................
fffff8a0`12e266d0 10eb8770 fffff8a0 00000000 00000008 p...............
fffff8a0`12e266e0 00000027 00000000 00000026 00000000 '.......&.......
fffff8a0`12e266f0 00000000 00000000 000a0021 fffff8a0 ........!.......
fffff8a0`12e26700 0e505140 fffffa80 1ba076a8 fffff8a0 #QP......v......
0: kd> !pool 0xfffff8a012e26710-0x30-0x50 2
Pool page fffff8a012e26690 region is Paged pool
*fffff8a012e26690 size: c0 previous size: 80 (Allocated) *Sect (Protected)
Pooltag Sect : Section objects
This is a 32 bit machine running windows 7
Commands used are architecture agnostic but pointer arithmetic are arch dependent
Current process
kd> ? #$proc
Evaluate expression: -2061895528 = 8519f898
Process Name From EPROCESS->ImageFileName
kd> dx (char *)#$proc->ImageFileName
(char *)#$proc->ImageFileName : 0xffffffff8519fa04 : "windbg.exe" [Type: char *]
lets Search For Some Section Handles in this process
the TypeName is CaseSensitive
kd> !handle 0 3 #$proc Section
Searching for handles of type Section
PROCESS 8519f898 SessionId: 1 Cid: 0138 Peb: 7ffd8000 ParentCid: 0d04
DirBase: 7e257560 ObjectTable: b91a3520 HandleCount: 254.
Image: windbg.exe
Handle table at b91a3520 with 254 entries in use
00c0: Object: 9a10bc58 GrantedAccess: 00000004 Entry: 9945b180
Object: 9a10bc58 Type: (84eb6040) Section
ObjectHeader: 9a10bc40 (new version)
HandleCount: 6 PointerCount: 6
!handle 0 3 flag dumps object specific information which can be reverified using !object {object address}
kd> !object 9a10bc58
Object: 9a10bc58 Type: (84eb6040) Section
ObjectHeader: 9a10bc40 (new version)
HandleCount: 6 PointerCount: 6
each object has an objectheader in 32 bit it is 18 bytes prior to object address that is sizeof(nt!_OBJECT_HEADER- sizeof(obheader->Body)) body is embedded in HEADER as the last member and is variable sized
kd> ?? (unsigned long ) (#FIELD_OFFSET(nt!_OBJECT_HEADER , Body))
unsigned long 0x18
_OBJECT_HEADER is as follows (though sizes haven't changed there are differences between new version header and old version header)
kd> dt nt!_object_header 9a10bc58-0x18
+0x000 PointerCount : 0n6
+0x004 HandleCount : 0n6
+0x004 NextToFree : 0x00000006 Void
+0x008 Lock : _EX_PUSH_LOCK
+0x00c TypeIndex : 0x21 '!'
+0x00d TraceFlags : 0 ''
+0x00e InfoMask : 0x8 ''
+0x00f Flags : 0 ''
+0x010 ObjectCreateInfo : 0x82f7aa00 _OBJECT_CREATE_INFORMATION
+0x010 QuotaBlockCharged : 0x82f7aa00 Void
+0x014 SecurityDescriptor : (null)
+0x018 Body : _QUAD
the old version header had _OBJECT_TYPE directly in the header
the new version is an index into an array
here the type index is 0x21
the array of Type is at
kd> x nt!ObTypeIndexTable
82f88580 nt!ObTypeIndexTable = <no type information>
you can write a script like this to dump all the types
function log(instr)
{
host.diagnostics.debugLog(instr + "\n");
}
function exec (cmdstr)
{
return host.namespace.Debugger.Utility.Control.ExecuteCommand(cmdstr);
}
function dumptypeindex()
{
var cpob = host.createPointerObject
var titab = exec("x nt!ObTypeIndexTable").First().substr(0,8)
var obtype = cpob(host.parseInt64(titab , 16),"nt","_OBJECT_TYPE **")
var i = 2
while(obtype[i] !=0 )
{
log("index = "+i+"\t"+ host.memory.readWideString(obtype[i].Name.Buffer))
i++
}
}
executing this script would yield the types as follows
kd> .scriptload c:\wdscr\dumptypeindex.js
JavaScript script successfully loaded from 'c:\dumptypeindex.js'
kd> dx #$scriptContents.dumptypeindex()
index = 2 Type
index = 3 Directory
index = 4 SymbolicLink
index = 5 Token
index = 6 Job
index = 7 Process
index = 8 Thread
index = 9 UserApcReserve
index = 10 IoCompletionReserve
index = 11 DebugObject
index = 12 Event
index = 13 EventPair
index = 14 Mutant
index = 15 Callback
index = 16 Semaphore
index = 17 Timer
index = 18 Profile
index = 19 KeyedEvent
index = 20 WindowStation
index = 21 Desktop
index = 22 TpWorkerFactory
index = 23 Adapter
index = 24 Controller
index = 25 Device
index = 26 Driver
index = 27 IoCompletion
index = 28 File
index = 29 TmTm
index = 30 TmTxȂ扏楄
index = 31 TmRm
index = 32 TmEn
index = 33 Section
index = 34 Session
index = 35 Key
index = 36 ALPC Port
index = 37 PowerRequest
index = 38 WmiGuid
index = 39 EtwRegistration
index = 40 EtwConsumer
index = 41 FilterConnectionPort
index = 42 FilterCommunicationPort
index = 43 PcwObject
notice 0x21 = 0n33 = Section
given that we have a Section
we can dump the Section Object
kd> dt -r1 nt!_SECTION_OBJECT 9a10bc58
+0x000 StartingVa : 0x90f87b44 Void
+0x004 EndingVa : 0x82efb58a Void
+0x008 Parent : 0xc0802000 Void
+0x00c LeftChild : (null)
+0x010 RightChild : 0xc0c0a280 Void
+0x014 Segment : 0x995ed8d8 _SEGMENT_OBJECT
+0x000 BaseAddress : 0x86b65740 Void
+0x004 TotalNumberOfPtes : 0xdf
+0x008 SizeOfSegment : _LARGE_INTEGER 0x000000df`00080000
+0x010 NonExtendedPtes : 0xdf000
+0x014 ImageCommitment : 0
+0x018 ControlArea : (null)
+0x01c Subsection : (null)
+0x020 MmSectionFlags : 0x869f52a8 _MMSECTION_FLAGS
+0x024 MmSubSectionFlags : 0x02ea0000 _MMSUBSECTION_FLAGS
an object is preceded by object header which is preceded by the pool_header
kd> dc 9a10bc58-0x18-0x18
9a10bc28 060b0204 f4636553 00000720 00000070 ....Sec. ...p...
9a10bc38 00000000 00000000 00000006 00000006 ................
9a10bc48 00000000 00080021 82f7aa00 00000000 ....!...........
9a10bc58 90f87b44 82efb58a c0802000 00000000 D{....... ......
9a10bc68 c0c0a280 995ed8d8 000df000 00000000 ......^.........
9a10bc78 00012000 00000004 0670020b 6666744e . ........p.Ntff
9a10bc88 00f00702 00000a48 0000c0fe 00020000 ....H...........
9a10bc98 00000000 00000002 00000000 00000000 ................
notice the Sec tag Sect is used by SectionObjects
d> !pool 9a10bc58-0x18-0x18 2
Pool page 9a10bc28 region is Paged pool
*9a10bc28 size: 58 previous size: 20 (Allocated) *Sect (Protected)
Pooltag Sect : Section objects
I have two programs, one is custom bootloader which will be located in BANK A and the other one is the main program which will be located in external spifi flash.
Both programs I load and debug from eclipse.
Currently I can jump from the bootloader to the main program, I can start debug with jtag from the reset handler in the main program but sometimes is continues to main and sometimes it breaks after the first step.
From the bootloader I do the following for jumping to main program:
halInit(); // init my hal functions
chSysInit(); // init my OS
chThdSleepMilliseconds(1000);
flashInit(); // init the spifi driver
uint32_t NewAddressOfNewVectorTable = 0x14000000;
__disable_irq();
/** Load new Vector Table **/
SCB->VTOR = AddressOfNewVectorTable;
__set_MSP(*(uint32_t*)(AddressOfNewVectorTable));
LPC_CREG->M4MEMMAP = AddressOfNewVectorTable;
/**
* Jump to Reset Vector of new Vector Table
* -> thats the second word (hence fourth byte).
*/
((user_code_pointer_t)(*((uint32_t*)(AddressOfNewVectorTable + 4))))();
This seems to work alright and it jumps to the 0x14000000 address.
Then when I start to debug with JTAG the app, it will come first in the reset handler.
I firstly had to disable __early_init() for the main app which configures the clocks, this would make all crash.
Is this correct?
Then sometimes I can step through all into the main() function.
But also regularly it crashes after doing the first step with JTAG with the following output:
SEGGER J-Link GDB Server V5.02l Command Line Version
JLinkARM.dll V5.02l (DLL compiled Nov 24 2015 09:36:30)
-----GDB Server start settings-----
GDBInit file: none
GDB Server Listening port: 2331
SWO raw output listening port: 2332
Terminal I/O port: 2333
Accept remote connection: localhost only
Generate logfile: off
Verify download: on
Init regs on start: on
Silent mode: off
Single run mode: on
Target connection timeout: 0 ms
------J-Link related settings------
J-Link Host interface: USB
J-Link script: none
J-Link settings file: none
------Target related settings------
Target device: LPC4357_M4
Target interface: SWD
Target interface speed: 1000kHz
Target endian: little
Connecting to J-Link...
J-Link is connected.
Firmware: J-Link V9 compiled Oct 9 2015 20:34:47
Hardware: V9.30
S/N: 269301849
OEM: SEGGER-EDU
Feature(s): FlashBP, GDB
Checking target voltage...
Target voltage: 3.31 V
Listening on TCP/IP port 2331
Connecting to target...Connected to target
Waiting for GDB connection...Connected to 127.0.0.1
Reading all registers
WARNING: Failed to read memory # address 0x00000000
Target interface speed set to 1000 kHz
Resetting target
Halting target CPU...
...Target halted (PC = 0x1A000140)
R0 = 1A000000, R1 = 1A000000, R2 = 400F1FC0, R3 = 12345678
R4 = 40045000, R5 = 1008000C, R6 = 00000000, R7 = 00000000
R8 = 00000000, R9 = 00000000, R10= 00000000, R11= 00000000
R12= 00000000, R13= 10000200, MSP= 10000200, PSP= 00000000
R14(LR) = 10405B25, R15(PC) = 1A000140
XPSR 41000000, APSR 40000000, EPSR 01000000, IPSR 00000000
CFBP 00000000, CONTROL 00, FAULTMASK 00, BASEPRI 00, PRIMASK 00
Reading all registers
Select auto target interface speed (2000 kHz)
Flash breakpoints enabled
Semi-hosting enabled (Handle on BKPT)
Semihosting I/O set to TELNET Client
SWO disabled succesfully.
SWO enabled succesfully.
Downloading 276 bytes # address 0x14000000 - Verified OK
Downloading 16192 bytes # address 0x14000120 - Verified OK
Downloading 16080 bytes # address 0x14004060 - Verified OK
Downloading 16176 bytes # address 0x14007F30 - Verified OK
Downloading 16064 bytes # address 0x1400BE60 - Verified OK
Downloading 16096 bytes # address 0x1400FD20 - Verified OK
Downloading 16096 bytes # address 0x14013C00 - Verified OK
Downloading 16112 bytes # address 0x14017AE0 - Verified OK
Downloading 8492 bytes # address 0x1401B9D0 - Verified OK
Downloading 8 bytes # address 0x1401DAFC - Verified OK
Downloading 2308 bytes # address 0x1401DB08 - Verified OK
Comparing flash [....................] Done.
Verifying flash [....................] Done.
Writing register (PC = 0x14000120)
Read 4 bytes # address 0x14000120 (Data = 0x4100F081)
Read 2 bytes # address 0x14015764 (Data = 0x2300)
Read 2 bytes # address 0x140157C8 (Data = 0x2300)
Read 2 bytes # address 0x140166D8 (Data = 0x2300)
Read 2 bytes # address 0x140166DC (Data = 0x4818)
Read 2 bytes # address 0x14001370 (Data = 0xB672)
Read 2 bytes # address 0x140013E8 (Data = 0xF015)
Read 2 bytes # address 0x140166D8 (Data = 0x2300)
Read 2 bytes # address 0x1401670E (Data = 0xAB03)
Read 2 bytes # address 0x14001370 (Data = 0xB672)
Read 2 bytes # address 0x14001370 (Data = 0xB672)
Read 2 bytes # address 0x14016764 (Data = 0xF7EC)
Read 2 bytes # address 0x14016764 (Data = 0xF7EC)
Read 2 bytes # address 0x14001370 (Data = 0xB672)
Read 2 bytes # address 0x140013D4 (Data = 0xF7FF)
Read 2 bytes # address 0x14015764 (Data = 0x2300)
Read 2 bytes # address 0x140157BA (Data = 0x4850)
Read 2 bytes # address 0x1400ACB8 (Data = 0x4806)
Read 2 bytes # address 0x1400ACBA (Data = 0x4907)
Read 2 bytes # address 0x1400ACC4 (Data = 0x4B05)
Resetting target
Halting target CPU...
...Target halted (PC = 0x1A000140)
Read 2 bytes # address 0x14016764 (Data = 0xF7EC)
Read 2 bytes # address 0x14016764 (Data = 0xF7EC)
Read 2 bytes # address 0x14016764 (Data = 0xF7EC)
R0 = 1A000000, R1 = 1A000000, R2 = 400F1FC0, R3 = 12345678
R4 = 40045000, R5 = 1008000C, R6 = 00000000, R7 = 00000000
R8 = 00000000, R9 = 00000000, R10= 00000000, R11= 00000000
R12= 00000000, R13= 10000200, MSP= 10000200, PSP= 00000000
R14(LR) = 10405B25, R15(PC) = 1A000140
XPSR 41000000, APSR 40000000, EPSR 01000000, IPSR 00000000
CFBP 00000000, CONTROL 00, FAULTMASK 00, BASEPRI 00, PRIMASK 00
Reading all registers
Read 4 bytes # address 0x1A000140 (Data = 0x4C24B672)
Setting breakpoint # address 0x14001370, Size = 2, BPHandle = 0x0001
Setting breakpoint # address 0x140013D4, Size = 2, BPHandle = 0x0002
Setting breakpoint # address 0x140013E8, Size = 2, BPHandle = 0x0003
Setting breakpoint # address 0x1400ACC4, Size = 2, BPHandle = 0x0004
Setting breakpoint # address 0x140166DC, Size = 2, BPHandle = 0x0005
Setting breakpoint # address 0x1401670E, Size = 2, BPHandle = 0x0006
Setting breakpoint # address 0x14016764, Size = 2, BPHandle = 0x0007
Starting target CPU...
Erasing flash [....................] Done.
Programming flash [....................] Done.
Verifying flash [....................] Done.
...Breakpoint reached # address 0x14001370
Reading all registers
Removing breakpoint # address 0x14001370, Size = 2
Removing breakpoint # address 0x140013D4, Size = 2
Removing breakpoint # address 0x140013E8, Size = 2
Removing breakpoint # address 0x1400ACC4, Size = 2
Removing breakpoint # address 0x140166DC, Size = 2
Removing breakpoint # address 0x1401670E, Size = 2
Removing breakpoint # address 0x14016764, Size = 2
Read 4 bytes # address 0x14001370 (Data = 0x4C23B672)
Read 4 bytes # address 0x1A0025B4 (Data = 0xF8D39B03)
Read 4 bytes # address 0x1A0025B4 (Data = 0xF8D39B03)
Performing single step...
...Target halted (PC = 0xFFFFFFFE)
Reading all registers
WARNING: Failed to read memory # address 0xFFFFFFFE
Read 4 bytes # address 0x1000041C (Data = 0x00000000)
Reading 64 bytes # address 0x10000400
Read 4 bytes # address 0x00000000 (Data = 0x10000400)
Read 4 bytes # address 0x00000000 (Data = 0x10000400)
Am I missing something that is needed after the jump to external flash?
Or can anyone give me a pointer why this is not functioning properly all the time?
I am writing an extension for Windbg, and at a particular point I need to get the permissions for a memory offset, much like how !address addr would provide in Windbg. I have had a look at the available functions of the Debugger Engine API here at:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff551059%28v=vs.85%29.aspx
However I have failed to find such a function that would return the section/permissions information against a memory offset. Basically I would like to get what section the address lies in, data section, text section etc, what permissions it has and so on.
The closest sounding function I have found is GetOffsetInformation in the IDebugDataSpaces4 interface. However as per the documentation, it doesn't provide anything from what I am looking for:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff548055(v=vs.85).aspx
I could always run the !address command and have its output parsed, but I was looking for a cleaner way where I could get this information directly, by using the API.
Am I missing something? Is there a documented/undocumented way I could achieve this with?
Doesnt QueryVirtual Work ?
#include <engextcpp.hpp>
class EXT_CLASS : public ExtExtension
{
public:
EXT_COMMAND_METHOD(getoffinfo);
};
EXT_DECLARE_GLOBALS();
EXT_COMMAND( getoffinfo, "", "{;e,d=0;getoffinfo;simulates !address <address>}" )
{
ULONG64 Offset = GetUnnamedArgU64(0);
if (Offset == 0)
{
Out( "usage !getoffinfo <address>\n");
}
else
{
MEMORY_BASIC_INFORMATION64 meminfo;
memset(&meminfo,0,sizeof(MEMORY_BASIC_INFORMATION64 ));
m_Data2->QueryVirtual(Offset,&meminfo);
Out("Allocation Base : %x\n",meminfo.AllocationBase);
Out("Base Address : %x\n",meminfo.BaseAddress);
Out("End Address : %x\n",meminfo.AllocationBase + meminfo.RegionSize);
Out("RegionSize : %x\n",meminfo.RegionSize);
Out("Type : %x\n",meminfo.Type);
Out("State : %x\n",meminfo.State);
}
}
result as follows
0:000> !address windbg
Usage: Image
Allocation Base: 01000000
Base Address: 01000000
End Address: 01001000
Region Size: 00001000
Type: 01000000 MEM_IMAGE
State: 00001000 MEM_COMMIT
Protect: 00000002 PAGE_READONLY
More info: lmv m windbg
More info: !lmi windbg
More info: ln 0x1000000
0:000> .load getoffinfo
0:000> !getoffinfo
usage !getoffinfo <address>
0:000> !getoffinfo windbg
Allocation Base : 1000000
Base Address : 1000000
End Address : 1001000
RegionSize : 1000
Type : 1000000
State : 1000