diff --git a/pykd/dbgext.cpp b/pykd/dbgext.cpp index 5df7720..08ae421 100644 --- a/pykd/dbgext.cpp +++ b/pykd/dbgext.cpp @@ -135,6 +135,8 @@ BOOST_PYTHON_MODULE( pykd ) boost::python::def( "getImplicitThread", &getImplicitThread ); boost::python::def( "setImplicitThread", &setImplicitThread ); boost::python::def( "getThreadList", &getThreadList ); + boost::python::def( "getCurrentProcess", &getCurrentProcess ); + boost::python::def( "setCurrentProcess", &setCurrentProcess ); boost::python::def( "getProcessorMode", &getProcessorMode ); boost::python::def( "setProcessorMode", &setProcessorMode ); boost::python::class_<typedVarClass>( "typedVarClass" ) diff --git a/pykd/dbgprocess.cpp b/pykd/dbgprocess.cpp index b60c0c4..53c836d 100644 --- a/pykd/dbgprocess.cpp +++ b/pykd/dbgprocess.cpp @@ -251,4 +251,56 @@ setProcessorMode( } } +///////////////////////////////////////////////////////////////////////////////// + +ULONG64 +getCurrentProcess() +{ + HRESULT hres; + + try { + + ULONG64 processAddr = 0; + hres = dbgExt->system2->GetImplicitProcessDataOffset( &processAddr ); + if ( FAILED( hres ) ) + throw DbgException( "IDebugSystemObjects2::GetImplicitProcessDataOffset failed" ); + + return processAddr; + } + catch( std::exception &e ) + { + dbgExt->control->Output( DEBUG_OUTPUT_ERROR, "pykd error: %s\n", e.what() ); + } + catch(...) + { + dbgExt->control->Output( DEBUG_OUTPUT_ERROR, "pykd unexpected error\n" ); + } + + return 0; +} + +///////////////////////////////////////////////////////////////////////////////// + +VOID +setCurrentProcess( + ULONG64 processAddr ) +{ + HRESULT hres; + + try { + + hres = dbgExt->system2->SetImplicitProcessDataOffset( processAddr ); + if ( FAILED( hres ) ) + throw DbgException( "IDebugSystemObjects2::SetImplicitProcessDataOffset failed" ); + } + catch( std::exception &e ) + { + dbgExt->control->Output( DEBUG_OUTPUT_ERROR, "pykd error: %s\n", e.what() ); + } + catch(...) + { + dbgExt->control->Output( DEBUG_OUTPUT_ERROR, "pykd unexpected error\n" ); + } +} + ///////////////////////////////////////////////////////////////////////////////// \ No newline at end of file diff --git a/pykd/dbgprocess.h b/pykd/dbgprocess.h index bb3884a..b40771f 100644 --- a/pykd/dbgprocess.h +++ b/pykd/dbgprocess.h @@ -16,7 +16,6 @@ setImplicitThread( ULONG64 getImplicitThread(); - boost::python::object getCurrentStack(); @@ -41,5 +40,12 @@ getProcessorMode(); void setProcessorMode( const std::string &mode ); + +ULONG64 +getCurrentProcess(); + +VOID +setCurrentProcess( + ULONG64 processAddr ); ///////////////////////////////////////////////////////////////////////////////// \ No newline at end of file diff --git a/samples/stacks.py b/samples/stacks.py index 348b869..b5fcd79 100644 --- a/samples/stacks.py +++ b/samples/stacks.py @@ -2,22 +2,56 @@ import sys from pykd import * -def printStack(): +def printStack(): - threadList = getThreadList() - oldMode = getProcessorMode() + def printThreadStack( threadPtr ): - if oldMode == "X64" and loadModule( "wow64" ) != None: - setProcessorMode("X86") - - for threadPtr in threadList: setImplicitThread( threadPtr ) stackFrames = getCurrentStack() for frame in stackFrames: dprintln( findSymbol( frame.instructionOffset ) + " (%x)" % frame.instructionOffset ) - dprintln("") + dprintln("") + + + + def printUserStack(): + + threadList = getThreadList() + + oldMode = getProcessorMode() + + if oldMode == "X64" and loadModule( "wow64" ) != None: + setProcessorMode("X86") + + for threadPtr in threadList: + printThreadStack( threadPtr ) + + setProcessorMode(oldMode) + + + + def printKernelStack(): + + process = typedVar( "nt", "_EPROCESS", getCurrentProcess() ) + + threadList = typedVarList( process.ThreadListHead.getAddress(), "nt", "_ETHREAD", "ThreadListEntry" ) + + oldMode = getProcessorMode() + + if is64bitSystem() and process.Wow64Process != 0: + setProcessorMode("X86") + + for thread in threadList: + printThreadStack( thread.getAddress() ) + + setProcessorMode(oldMode) + + + if isKernelDebugging(): + printKernelStack() + else: + printUserStack() - setProcessorMode(oldMode) if __name__ == "__main__":