diff --git a/pykd/pymod.cpp b/pykd/pymod.cpp index 2a04015..45a2210 100644 --- a/pykd/pymod.cpp +++ b/pykd/pymod.cpp @@ -709,9 +709,9 @@ BOOST_PYTHON_MODULE( pykd ) // .def( "onModuleUnload", &EventHandlerWrap::OnModuleUnload, // "Triggered module unload event. Parameter are long: module base, string: module name\n" // "For ignore event method must return eventResult.noChange" ) - // .def( "onException", &EventHandlerWrap::OnException, - // "Triggered exception event. Parameter - exceptionInfo\n" - // "For ignore event method must return eventResult.noChange" ) + .def( "onException", &EventHandler::onException, + "Triggered exception event. Parameter - exceptionInfo\n" + "For ignore event method must return eventResult.noChange" ) .def( "onExecutionStatusChange", &EventHandler::onExecutionStatusChange, "Triggered execution status changed. Parameter - execution status.\n" "There is no return value" ) diff --git a/pykd/typedvar.h b/pykd/typedvar.h index 7a91029..d0daa50 100644 --- a/pykd/typedvar.h +++ b/pykd/typedvar.h @@ -17,12 +17,12 @@ struct TypedVarAdapter { } static kdlib::TypedVarPtr getTypedVarByTypeName( const std::wstring &name, kdlib::MEMOFFSET_64 addr ) { - return kdlib::loadTypedVar( name, addr, kdlib::SymbolPtr() ); + return kdlib::loadTypedVar( name, addr ); } static kdlib::TypedVarPtr getTypedVarByTypeInfo( const kdlib::TypeInfoPtr &typeInfo, kdlib::MEMOFFSET_64 addr ) { - return kdlib::loadTypedVar( typeInfo, addr, kdlib::SymbolPtr() ); + return kdlib::loadTypedVar( typeInfo, addr ); } static kdlib::MEMOFFSET_32 getFieldOffsetByName( kdlib::TypedVar& typedVar, const std::wstring &name ) { @@ -39,9 +39,10 @@ struct TypedVarAdapter { } static std::wstring print( kdlib::TypedVar& typedVar ) { - return L"TYPEDVAR STR"; + return typedVar.str(); } + static kdlib::TypedVarPtr containingRecordByName( kdlib::MEMOFFSET_64 offset, const std::wstring &typeName, const std::wstring &fieldName ) { return kdlib::containingRecord( offset, typeName, fieldName ); } diff --git a/pykd/typeinfo.h b/pykd/typeinfo.h index 60cc5d0..5db7578 100644 --- a/pykd/typeinfo.h +++ b/pykd/typeinfo.h @@ -14,20 +14,44 @@ struct TypeInfoAdapter : public kdlib::TypeInfo { static std::wstring findSymbol( kdlib::MEMOFFSET_64 offset, bool showDisplacement = true ) { kdlib::MEMDISPLACEMENT displacement = 0; - std::wstring symbolName = kdlib::findSymbol( offset, displacement ); - if ( !showDisplacement || displacement == 0 ) - return symbolName; + std::wstring symbolName; - std::wstringstream wsstr; + try { - wsstr << symbolName; + kdlib::ModulePtr mod = kdlib::loadModule( offset ); - if ( displacement > 0 ) - wsstr << L'+' << std::hex << displacement; - else - wsstr << L'-' << std::hex << -displacement; + try { + + symbolName = mod->findSymbol( offset, displacement ); + + std::wstringstream sstr; + + sstr << mod->getName() << L'!' << symbolName; + + if ( !showDisplacement || displacement == 0 ) + return sstr.str(); + + if ( displacement > 0 ) + sstr << L'+' << std::hex << displacement; + else + sstr << L'-' << std::hex << -displacement; + + return sstr.str(); + + } catch( kdlib::DbgException& ) + { + std::wstringstream sstr; + sstr << mod->getName() << '+' << std::hex << ( offset - mod->getBase() ); + return sstr.str(); + } + + } catch( kdlib::DbgException& ) + { + std::wstringstream sstr; + sstr << std::hex << offset; + return sstr.str(); + } - return wsstr.str(); } static kdlib::MEMOFFSET_32 getElementOffset( kdlib::TypeInfo &typeInfo, const std::wstring &name ) { diff --git a/samples/um/critlist.py b/samples/um/critlist.py new file mode 100644 index 0000000..d8f0465 --- /dev/null +++ b/samples/um/critlist.py @@ -0,0 +1,34 @@ +from pykd import * + +def main(): + pass + +def listCritSections(): + + ntdll = module("ntdll") + + dbglst = ntdll.typedVarList( ntdll.RtlCriticalSectionList, "_RTL_CRITICAL_SECTION_DEBUG", "ProcessLocksList" ) + + crtlst = [ ntdll.typedVar( "_RTL_CRITICAL_SECTION", x.CriticalSection ) for x in dbglst ] + + for crtsec in crtlst: + dprintln("") + dprintln( "CRITICAL SECTION address = %#x ( %s ) " % ( crtsec, findSymbol( crtsec ) ) ) + dprintln( " Owning thread = %x" % crtsec.OwningThread ) + dprintln( " Lock count = %d" % crtsec.LockCount ) + + +def run(): + + while True: + + if isKernelDebugging(): + dprintln( "not a user debugging" ) + break + + listCritSections() + + break + +if __name__ == "__main__": + run() \ No newline at end of file