zjgcjy/pykd
1
0
Fork 0
mirror of https://github.com/ivellioscolin/pykd.git synced 2025-04-21 04:13:22 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[0.2.x] fixed: getting wow64 context

Browse Source 
git-svn-id: https://pykd.svn.codeplex.com/svn@81922 9b283d60-5439-405e-af05-b73fd8c4d996
This commit is contained in:
SND\kernelnet_cp 2012-12-20 07:19:08 +00:00 committed by Mikhail I. Izmestev
parent b0a49c7ed4
commit d143a0633b
1 changed files with 44 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
pykd/win/dbgeng.cpp
View File

@ -779,10 +779,51 @@ static void ReadWow64Context(WOW64_CONTEXT &Context)
// http://www.nynaeve.net/Code/GetThreadWow64Context.cpp // http://www.nynaeve.net/Code/GetThreadWow64Context.cpp
// //
HRESULT hres;
ULONG debugClass, debugQualifier;
hres = g_dbgEng->control->GetDebuggeeType( &debugClass, &debugQualifier );
if ( FAILED( hres ) )
throw DbgException( "IDebugControl::GetDebuggeeType failed" );
ULONG64 teb64Address; ULONG64 teb64Address;
HRESULT hres = g_dbgEng->system->GetCurrentThreadTeb(&teb64Address);
if ( debugClass == DEBUG_CLASS_KERNEL )
{
DEBUG_VALUE debugValue = {};
ULONG remainderIndex = 0;
hres = g_dbgEng->control->EvaluateWide(
L"@@C++(#FIELD_OFFSET(nt!_KTHREAD, Teb))",
DEBUG_VALUE_INT64,
&debugValue,
&remainderIndex );
if ( FAILED( hres ) )
throw DbgException( "IDebugControl::Evaluate failed" );
ULONG64 tebOffset = debugValue.I64;
hres = g_dbgEng->system->GetImplicitThreadDataOffset(&teb64Address);
if (S_OK != hres) if (S_OK != hres)
throw DbgException( "IDebugSystemObjects::GetCurrentThreadTeb", hres); throw DbgException( "IDebugSystemObjects::GetImplicitThreadDataOffset", hres);
ULONG readedBytes;
readMemoryUnsafeNoSafe(
teb64Address + tebOffset,
&teb64Address,
sizeof(teb64Address),
false,
&readedBytes);
}
else
{
hres = g_dbgEng->system->GetImplicitThreadDataOffset(&teb64Address);
if (S_OK != hres)
throw DbgException( "IDebugSystemObjects::GetImplicitThreadDataOffset", hres);
}
// ? @@C++(#FIELD_OFFSET(nt!_TEB64, TlsSlots)) // ? @@C++(#FIELD_OFFSET(nt!_TEB64, TlsSlots))
// hardcoded in !wow64exts.r (6.2.8250.0) // hardcoded in !wow64exts.r (6.2.8250.0)