zjgcjy/pykd
1
0
Fork 0
mirror of https://github.com/ivellioscolin/pykd.git synced 2025-04-20 03:23:23 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[~] align of sruct

Browse Source 
[+] view MIDL-generated server RPC-interface

git-svn-id: https://pykd.svn.codeplex.com/svn@69642 9b283d60-5439-405e-af05-b73fd8c4d996
This commit is contained in:
SND\EreTIk_cp 2011-09-08 17:53:36 +00:00
parent 4af5301232
commit b06f995200
4 changed files with 229 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pykd/dbgext.cpp
View File

@ -241,6 +241,8 @@ BOOST_PYTHON_MODULE( pykd )
"add new field for typeInfo" ) )
.def("offset", &TypeInfo::getFieldOffset,
"Return offset while type is part of the more complex type" )
.def("setAlignReq", &TypeInfo::setAlignReq,
"Set alignment requirement" )
.def("load", &TypeInfo::loadVar, loadOver( boost::python::args( "offset", "count"),
"Create instance of the typedVar class with this typeInfo" ) );

46
pykd/dbgtype.cpp
View File

@ -20,6 +20,8 @@ TypeInfo::TypeInfoMap TypeInfo::g_typeInfoCache;
///////////////////////////////////////////////////////////////////////////////////
TypeInfo::TypeInfo( const std::string &moduleName, const std::string &typeName )
: m_align(0)
, m_alignReq(1)
{
HRESULT hres;
bool baseType = checkBaseType(typeName);
@ -103,11 +105,11 @@ TypeInfo::TypeInfo( const std::string &moduleName, const std::string &typeName
if ( fieldTypeNameStr == "__unnamed"
|| fieldTypeNameStr.find("<unnamed-tag>") < fieldTypeNameStr.size() )
{
m_fields.push_back( TypeField( fieldName, TypeInfo( moduleName, moduleBase, fieldTypeId ), fieldSize, fieldOffset ) );
addField( fieldName, TypeInfo( moduleName, moduleBase, fieldTypeId ), fieldSize, fieldOffset );
}
else
{
m_fields.push_back( TypeField( fieldName, TypeInfo( moduleName, fieldTypeName ), fieldSize, fieldOffset ) );
addField( fieldName, TypeInfo( moduleName, fieldTypeName ), fieldSize, fieldOffset );
}
}
@ -121,6 +123,8 @@ TypeInfo::TypeInfo( const std::string &moduleName, const std::string &typeName
///////////////////////////////////////////////////////////////////////////////////
TypeInfo::TypeInfo( const std::string &moduleName, ULONG64 moduleBase, ULONG typeId )
: m_align(0)
, m_alignReq(1)
{
HRESULT hres;
@ -162,11 +166,11 @@ TypeInfo::TypeInfo( const std::string &moduleName, ULONG64 moduleBase, ULONG typ
if ( fieldTypeNameStr == "__unnamed"
|| fieldTypeNameStr.find("<unnamed-tag>") < fieldTypeNameStr.size() )
{
m_fields.push_back( TypeField( fieldName, TypeInfo( moduleName, moduleBase, fieldTypeId ), fieldSize, fieldOffset ) );
addField( fieldName, TypeInfo( moduleName, moduleBase, fieldTypeId ), fieldSize, fieldOffset );
}
else
{
m_fields.push_back( TypeField( fieldName, TypeInfo( moduleName, fieldTypeName ), fieldSize, fieldOffset ) );
addField( fieldName, TypeInfo( moduleName, fieldTypeName ), fieldSize, fieldOffset );
}
}
@ -343,14 +347,10 @@ TypeInfo::appendField( const TypeInfo &typeInfo, const std::string &fieldName, U
}
ULONG offset = m_size;
if ( typeInfo.isBaseType() )
{
offset += offset % min( typeInfo.size(), m_align );
}
offset += offset % ( m_align ? m_align : typeInfo.getAlignReq() );
const ULONG addSize = typeInfo.size() * count;
m_fields.push_back( TypeField( fieldName, typeInfo, addSize, offset ) );
addField( fieldName, typeInfo, addSize, offset );
m_size = offset + addSize;
m_arraySize = offset + addSize;
}
@ -1001,6 +1001,32 @@ TypedVar::print()
/////////////////////////////////////////////////////////////////////////////////////
ULONG TypeInfo::getAlignReq() const
{
if (isBaseType())
return size();
if (isPtr())
return ptrSize();
return m_alignReq;
}
/////////////////////////////////////////////////////////////////////////////////////
void TypeInfo::addField(
const std::string &name_,
const TypeInfo &type_,
ULONG size_,
ULONG offset_
)
{
m_alignReq = max(m_alignReq, type_.getAlignReq());
m_fields.push_back( TypeField( name_, type_, size_, offset_ ) );
}
/////////////////////////////////////////////////////////////////////////////////////
ULONG
sizeofType( const std::string &moduleName, const std::string &typeName )
{

25
pykd/dbgtype.h
View File

@ -23,10 +23,11 @@ public:
m_size(0),
m_arraySize( 0 ),
m_parentOffset( 0 ),
m_align( ptrSize() ),
m_align( 0 ),
m_isFreezed( false ),
m_isBaseType( false ),
m_isPointer( false )
m_isPointer( false ),
m_alignReq(1)
{}
TypeInfo( const std::string customName, ULONG align = 0) :
@ -35,9 +36,10 @@ public:
m_arraySize( 0 ),
m_parentOffset( 0 ),
m_isFreezed( false ),
m_align( align == 0 ? ptrSize() : align ),
m_align( align ),
m_isBaseType( false ),
m_isPointer( false )
m_isPointer( false ),
m_alignReq(1)
{}
TypeInfo( const std::string &moduleName, const std::string &typeName );
@ -123,6 +125,10 @@ public:
boost::python::object
loadVar( ULONG64 targetOffset, ULONG count = 1) const;
void setAlignReq(ULONG alignReq) {
m_alignReq = alignReq;
}
public:
typedef std::map< std::pair<std::string, std::string>, TypeInfo> TypeInfoMap;
@ -154,6 +160,15 @@ public:
private:
ULONG getAlignReq() const;
void addField(
const std::string &name_,
const TypeInfo &type_,
ULONG size_,
ULONG offset_
);
typedef
boost::python::object
(*basicTypeLoader)( void* address, size_t size );
@ -190,6 +205,8 @@ private:
ULONG m_align;
ULONG m_alignReq;
ULONG m_parentOffset;
static bool checkBaseType( const std::string &typeName );

109
samples/rpcSrvIf.py Normal file
View File

@ -0,0 +1,109 @@
"""
Prase first param RpcServerRegisterIf[Xxx]
"""
import sys
from pykd import *
def rpcSrvIf(ifSpec):
"""
Prase RPC server interface specification
Usage example:
kd> ba e 1 rpcrt4!RPC_SERVER::RegisterInterface
kd> gc
And analyze first parameter
for x86:
kd> !py rpcSrvIf poi(@esp+@$ptrsize)
or for x64:
kd> !py rpcSrvIf @rdx
P.S. RPC_SERVER::RegisterInterface called from: RpcServerRegisterIf,
RpcServerRegisterIf2 and RpcServerRegisterIfEx
"""
def formatSintaxId(synId):
def formatGuid(guid):
part1 = "%08x-%04x-%04x" % (guid.data1, guid.data2, guid.data3)
part2 = "".join( ["%02x" % _byte for _byte in guid.data4] )
part3 = "".join( ["%02x" % _byte for _byte in guid.data5] )
return part1 + "-" + part2 + "-" + part3
def formatRpcVer(prcVer):
return "v.%d.%d" % (prcVer.MajorVersion, prcVer.MinorVersion)
return formatGuid(synId.SyntaxGUID) + " " + formatRpcVer(synId.SyntaxVersion)
# prepare structures for parsing
commGuid = typeInfo("rpcSrvIf~_GUID")
commGuid.append(ulong_t, "data1")
commGuid.append(ushort_t, "data2")
commGuid.append(ushort_t, "data3")
commGuid.append(uchar_t, "data4", 2)
commGuid.append(uchar_t, "data5", 6)
# print commGuid
rpcVersion = typeInfo("rpcSrvIf~_RPC_VERSION")
rpcVersion.append(ushort_t, "MajorVersion")
rpcVersion.append(ushort_t, "MinorVersion")
# print rpcVersion
rpcSintaxIdentifier = typeInfo("rpcSrvIf~_RPC_SYNTAX_IDENTIFIER")
rpcSintaxIdentifier.append(commGuid, "SyntaxGUID")
rpcSintaxIdentifier.append(rpcVersion, "SyntaxVersion")
# print rpcSintaxIdentifier
prcDispatchTable = typeInfo("rpcSrvIf~_RPC_DISPATCH_TABLE")
prcDispatchTable.append(uint_t, "DispatchTableCount")
prcDispatchTable.append(ptr_t, "DispatchTable")
prcDispatchTable.append(ptr_t, "Reserved")
# print prcDispatchTable
midlServerInfoHeader = typeInfo("rpcSrvIf~_MIDL_SERVER_INFO_hdr")
midlServerInfoHeader.append(ptr_t, "pStubDesc")
midlServerInfoHeader.append(ptr_t, "DispatchTable")
# print midlServerInfoHeader
rpcServerInterface = typeInfo("rpcSrvIf~_RPC_SERVER_INTERFACE")
rpcServerInterface.append(uint_t, "Length")
rpcServerInterface.append(rpcSintaxIdentifier, "InterfaceId")
rpcServerInterface.append(rpcSintaxIdentifier, "TransferSyntax")
rpcServerInterface.append(ptr_t, "DispatchTable") # -> prcDispatchTable
rpcServerInterface.append(uint_t, "RpcProtseqEndpointCount")
rpcServerInterface.append(ptr_t, "RpcProtseqEndpoint")
rpcServerInterface.append(ptr_t, "DefaultManagerEpv")
rpcServerInterface.append(ptr_t, "InterpreterInfo") # -> midlServerInfoHeader
rpcServerInterface.append(uint_t, "Flags")
# print rpcServerInterface
# get and print interface header
srvIf = rpcServerInterface.load( ifSpec )
dprintln("Interface ID : " + formatSintaxId(srvIf.InterfaceId) )
dprintln("Transfer Syntax : " + formatSintaxId(srvIf.TransferSyntax) )
dprintln("Endpoint count : %d" % srvIf.RpcProtseqEndpointCount )
if srvIf.RpcProtseqEndpointCount:
protoseqEndp = srvIf.RpcProtseqEndpoint
for i in range(0, srvIf.RpcProtseqEndpointCount):
dprintln("\t[%02d] protocol is `" % i + loadCStr( ptrPtr(protoseqEndp) ) + "'" )
protoseqEndp += ptrSize()
dprintln("\t[%02d] endpoint is `" % i + loadCStr( ptrPtr(protoseqEndp) ) + "'" )
protoseqEndp += ptrSize()
dprintln("")
# query dispatch routines table
dspTableSize = prcDispatchTable.load(srvIf.DispatchTable).DispatchTableCount
dspTable = midlServerInfoHeader.load(srvIf.InterpreterInfo).DispatchTable
dprintln('<exec cmd="dps 0x%x L 0x%x">Routine Table 0x%x, count %d (0x%02x)</exec>\n' %
(dspTable, dspTableSize, dspTable, dspTableSize, dspTableSize) ,True)
if __name__ == "__main__":
if len(sys.argv) == 2:
rpcSrvIf( expr(sys.argv[1]) )
else:
dprintln(rpcSrvIf.__doc__)