zjgcjy/pykd
1
0
Fork 0
mirror of https://github.com/ivellioscolin/pykd.git synced 2025-04-20 03:23:23 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[0.1.x] ~workitem:10473, read virtual memory (target - PE, loaded as dump)

Browse Source 
git-svn-id: https://pykd.svn.codeplex.com/svn@77970 9b283d60-5439-405e-af05-b73fd8c4d996
This commit is contained in:
SND\EreTIk_cp 2012-07-10 12:29:12 +00:00 committed by Mikhail I. Izmestev
parent 4fe043ffcc
commit cc27c3b20c
3 changed files with 50 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pykd/context.cpp
View File

@ -6,6 +6,7 @@
#include "context.h" #include "context.h"
#include "stkframe.h" #include "stkframe.h"
#include "dbgmem.h"
///////////////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////////////////
@ -228,7 +229,8 @@ ContextPtr ThreadContext::getWow64Context( IDebugClient4 *client )
ULONG64 cpuAreaAddress; ULONG64 cpuAreaAddress;
ULONG readedBytes; ULONG readedBytes;
hres = hres =
ptrContext->m_dataSpaces->ReadVirtual( readVirtual(
ptrContext->m_dataSpaces,
teb64Address + teb64ToTlsOffset + (sizeof(ULONG64) * WOW64_TLS_CPURESERVED), teb64Address + teb64ToTlsOffset + (sizeof(ULONG64) * WOW64_TLS_CPURESERVED),
&cpuAreaAddress, &cpuAreaAddress,
sizeof(cpuAreaAddress), sizeof(cpuAreaAddress),
@ -242,7 +244,8 @@ ContextPtr ThreadContext::getWow64Context( IDebugClient4 *client )
static const ULONG cpuAreaToWow64ContextOffset = sizeof(ULONG); static const ULONG cpuAreaToWow64ContextOffset = sizeof(ULONG);
WOW64_CONTEXT Context = {0}; WOW64_CONTEXT Context = {0};
hres = hres =
ptrContext->m_dataSpaces->ReadVirtual( readVirtual(
ptrContext->m_dataSpaces,
cpuAreaAddress + cpuAreaToWow64ContextOffset, cpuAreaAddress + cpuAreaToWow64ContextOffset,
&Context, &Context,
sizeof(Context), sizeof(Context),

35
pykd/dbgmem.cpp
View File

@ -107,16 +107,45 @@ bool isVaValid( ULONG64 addr )
///////////////////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////////////////////
void HRESULT readVirtual(
readMemory( IDebugDataSpaces4* dbgDataSpace, ULONG64 address, PVOID buffer, ULONG length, bool phyAddr = FALSE ) IDebugDataSpaces4 *dbgDataSpace,
ULONG64 address,
PVOID buffer,
ULONG length,
PULONG readed
)
{ {
HRESULT hres; HRESULT hres;
CComQIPtr<IDebugControl4> dbgControl(dbgDataSpace); CComQIPtr<IDebugControl4> dbgControl(dbgDataSpace);
address = addr64( dbgControl, address);
{
// workitem/10473 workaround
ULONG64 nextAddress;
hres =
dbgDataSpace->GetNextDifferentlyValidOffsetVirtual(
address,
&nextAddress);
DBG_UNREFERENCED_LOCAL_VARIABLE(nextAddress);
}
hres = dbgDataSpace->ReadVirtual( address, buffer, length, readed );
return hres;
}
/////////////////////////////////////////////////////////////////////////////////////
void
readMemory( IDebugDataSpaces4* dbgDataSpace, ULONG64 address, PVOID buffer, ULONG length, bool phyAddr = FALSE )
{
HRESULT hres;
if ( phyAddr == false ) if ( phyAddr == false )
{ {
hres = dbgDataSpace->ReadVirtual( addr64( dbgControl, address), buffer, length, NULL ); hres = readVirtual( dbgDataSpace, address, buffer, length, NULL );
} }
else else
{ {

10
pykd/dbgmem.h
View File

@ -12,6 +12,16 @@ isVaValid( ULONG64 addr );
/////////////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////////////
HRESULT readVirtual(
IDebugDataSpaces4 *dbgDataSpace,
ULONG64 address,
PVOID buffer,
ULONG length,
PULONG readed
);
///////////////////////////////////////////////////////////////////////////////////
void void
readMemory( IDebugDataSpaces4* dbgDataSpace, ULONG64 address, PVOID buffer, ULONG length, bool phyAddr = FALSE ); readMemory( IDebugDataSpaces4* dbgDataSpace, ULONG64 address, PVOID buffer, ULONG length, bool phyAddr = FALSE );