Microsoft/NT4
Microsoft/NT4
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
NT4/private/mvdm/bde/bdeutil.c
Microsoft ce47f986d8 First commit
2020-09-30 17:12:29 +02:00

615 lines
14 KiB
C
Raw Permalink Blame History

#include <precomp.h>
#pragma hdrstop
BOOL
WINAPI
ReadProcessMem(
HANDLE hProcess,
LPVOID lpBaseAddress,
LPVOID lpBuffer,
DWORD nSize,
LPDWORD lpNumberOfBytesRead
)
{
if ( fWinDbg ) {
return (*ReadProcessMemWinDbg)( (DWORD)lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead );
} else {
return ReadProcessMemory( hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead );
}
}
BOOL
WINAPI
WriteProcessMem(
HANDLE hProcess,
LPVOID lpBaseAddress,
LPVOID lpBuffer,
DWORD nSize,
LPDWORD lpNumberOfBytesWritten
)
{
if ( fWinDbg ) {
return (*WriteProcessMemWinDbg)( (DWORD)lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten );
} else {
return WriteProcessMemory( hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten );
}
}
#ifndef i386
ULONG
GetRegValue(
NT_CPU_REG reg,
BOOL bInNano,
ULONG UMask
)
{
if (bInNano) {
return(ReadDword(reg.nano_reg));
} else if (UMask & reg.universe_8bit_mask) {
return (ReadDword(reg.saved_reg) & 0xFFFFFF00 |
ReadDword(reg.reg) & 0xFF);
} else if (UMask & reg.universe_16bit_mask) {
return (ReadDword(reg.saved_reg) & 0xFFFF0000 |
ReadDword(reg.reg) & 0xFFFF);
} else {
return (ReadDword(reg.reg));
}
}
ULONG
GetEspValue(
NT_CPU_INFO nt_cpu_info,
BOOL bInNano
)
{
if (bInNano) {
return (ReadDword(nt_cpu_info.nano_esp));
} else {
if (ReadDword(nt_cpu_info.stack_is_big)) {
return (ReadDword(nt_cpu_info.host_sp) -
ReadDword(nt_cpu_info.ss_base));
} else {
return (ReadDword(nt_cpu_info.esp_sanctuary) & 0xFFFF0000 |
(ReadDword(nt_cpu_info.host_sp) -
ReadDword(nt_cpu_info.ss_base) & 0xFFFF));
}
}
}
#endif
int
GetContext(
VDMCONTEXT* lpContext
) {
#ifndef i386 //
int mode;
ULONG pTmp;
NT_CPU_INFO nt_cpu_info;
BOOL b;
BOOL bInNano;
ULONG UMask;
pTmp = (ULONG)EXPRESSION("ntvdm!nt_cpu_info");
if ( pTmp ) {
b = ReadProcessMem( hCurrentProcess,
(LPVOID) pTmp,
(LPVOID) &nt_cpu_info,
sizeof(NT_CPU_INFO),
NULL );
if ( !b ) {
PRINTF("Could not read IntelRegisters context out of process\n");
return( -1 );
}
bInNano = ReadDword((ULONG) nt_cpu_info.in_nano_cpu);
UMask = ReadDword((ULONG) nt_cpu_info.universe);
lpContext->Eax = GetRegValue(nt_cpu_info.eax, bInNano, UMask);
lpContext->Ecx = GetRegValue(nt_cpu_info.ecx, bInNano, UMask);
lpContext->Edx = GetRegValue(nt_cpu_info.edx, bInNano, UMask);
lpContext->Ebx = GetRegValue(nt_cpu_info.ebx, bInNano, UMask);
lpContext->Ebp = GetRegValue(nt_cpu_info.ebp, bInNano, UMask);
lpContext->Esi = GetRegValue(nt_cpu_info.esi, bInNano, UMask);
lpContext->Edi = GetRegValue(nt_cpu_info.edi, bInNano, UMask);
lpContext->Esp = GetEspValue(nt_cpu_info, bInNano);
lpContext->EFlags = ReadDword(nt_cpu_info.flags);
lpContext->Eip = ReadDword(nt_cpu_info.eip);
lpContext->SegEs = ReadWord(nt_cpu_info.es);
lpContext->SegCs = ReadWord(nt_cpu_info.cs);
lpContext->SegSs = ReadWord(nt_cpu_info.ss);
lpContext->SegDs = ReadWord(nt_cpu_info.ds);
lpContext->SegFs = ReadWord(nt_cpu_info.fs);
lpContext->SegGs = ReadWord(nt_cpu_info.gs);
} else {
PRINTF("Could not find the symbol 'ntvdm!nt_cpu_info'\n");
return( -1 );
}
if ( !(ReadDword(nt_cpu_info.cr0) & 1) ) {
mode = V86_MODE;
} else {
mode = PROT_MODE;
}
return( mode );
#else //
NTSTATUS rc;
BOOL b;
ULONG EFlags;
WORD cs;
int mode;
ULONG lpVdmTib;
lpContext->ContextFlags = CONTEXT_FULL;
rc = NtGetContextThread( hCurrentThread,
lpContext );
if ( NT_ERROR(rc) ) {
PRINTF( "bde.k: Could not get current threads context - status = %08lX\n", rc );
return( -1 );
}
/*
** Get the 16-bit registers from the context
*/
cs = (WORD)lpContext->SegCs;
EFlags = lpContext->EFlags;
if ( EFlags & V86_BITS ) {
/*
** V86 Mode
*/
mode = V86_MODE;
} else {
if ( (cs & RPL_MASK) != KGDT_R3_CODE ) {
mode = PROT_MODE;
} else {
/*
** We are in flat 32-bit address space!
*/
lpVdmTib = (ULONG)EXPRESSION("ntvdm!VdmTib");
if ( !lpVdmTib ) {
PRINTF("Could not find the symbol 'VdmTib'\n");
return( -1 );
}
b = ReadProcessMem( hCurrentProcess,
(LPVOID) (lpVdmTib +
FIELD_OFFSET(VDM_TIB,VdmContext)),
lpContext,
sizeof(VDMCONTEXT),
NULL );
if ( !b ) {
PRINTF("Could not read IntelRegisters context out of process\n");
return( -1 );
}
EFlags = lpContext->EFlags;
if ( EFlags & V86_BITS ) {
mode = V86_MODE;
} else {
mode = PROT_MODE;
}
}
}
return( mode );
#endif
}
ULONG
GetIntelBase(
VOID
)
{
#ifndef i386
ULONG IntelBase;
BOOL b;
IntelBase = (ULONG)EXPRESSION("ntvdm!Start_of_M_area");
if ( IntelBase ) {
b = ReadProcessMem( hCurrentProcess,
(LPVOID) IntelBase, &IntelBase,
sizeof(ULONG), NULL );
if ( !b ) {
PRINTF("Could not read symbol 'ntvdm!Start_of_M_area\n");
return(0);
}
} else {
PRINTF("Could not find the symbol 'ntvdm!Start_of_M_area'\n");
}
return(IntelBase);
#else
return(0);
#endif
}
DWORD read_dword(
ULONG lpAddress,
BOOL bSafe
) {
BOOL b;
DWORD dword;
b = ReadProcessMem(
hCurrentProcess,
(LPVOID)lpAddress,
&dword,
sizeof(dword),
NULL
);
if ( !b ) {
if ( !bSafe ) {
PRINTF("Failure reading dword at memory location %08lX\n", lpAddress );
}
return( 0 );
}
return( dword );
}
WORD read_word(
ULONG lpAddress,
BOOL bSafe
) {
BOOL b;
WORD word;
b = ReadProcessMem(
hCurrentProcess,
(LPVOID)lpAddress,
&word,
sizeof(word),
NULL
);
if ( !b ) {
if ( !bSafe ) {
PRINTF("Failure reading word at memory location %08lX\n", lpAddress );
}
return( 0 );
}
return( word );
}
BYTE read_byte(
ULONG lpAddress,
BOOL bSafe
) {
BOOL b;
BYTE byte;
b = ReadProcessMem(
hCurrentProcess,
(LPVOID)lpAddress,
&byte,
sizeof(byte),
NULL
);
if ( !b ) {
if ( !bSafe ) {
PRINTF("Failure reading byte at memory location %08lX\n", lpAddress );
}
return( 0 );
}
return( byte );
}
BOOL read_gnode(
ULONG lpAddress,
PGNODE p,
BOOL bSafe
) {
BOOL b;
b = ReadProcessMem(
hCurrentProcess,
(LPVOID)lpAddress,
p,
sizeof(*p),
NULL
);
if ( !b ) {
if ( !bSafe ) {
PRINTF("Failure reading word at memory location %08lX\n", lpAddress );
}
return( 0 );
}
return( TRUE );
}
BOOL read_gnode32(
ULONG lpAddress,
PGNODE32 p,
BOOL bSafe
) {
BOOL b;
b = ReadProcessMem(
hCurrentProcess,
(LPVOID)lpAddress,
p,
sizeof(*p),
NULL
);
if ( !b ) {
if ( !bSafe ) {
PRINTF("Failure reading word at memory location %08lX\n", lpAddress );
}
return( 0 );
}
return( TRUE );
}
BOOL GetDescriptorData(
WORD selector,
LPVDMLDT_ENTRY pdte
)
{
#ifdef i386
NTSTATUS rc;
DESCRIPTOR_TABLE_ENTRY dte;
dte.Selector = selector;
rc = NtQueryInformationThread( hCurrentThread,
ThreadDescriptorTableEntry,
&dte,
sizeof(DESCRIPTOR_TABLE_ENTRY),
NULL );
if ( NT_ERROR(rc) ) {
return( FALSE );
}
pdte->HighWord = dte.Descriptor.HighWord;
pdte->BaseLow = dte.Descriptor.BaseLow;
pdte->LimitLow = dte.Descriptor.LimitLow;
return (TRUE);
#else
PVOID LdtAddress;
NTSTATUS Status;
ULONG BytesRead;
selector &= ~(SELECTOR_LDT | SELECTOR_RPL);
//
// Get address of Ldt
//
LdtAddress = (PVOID)EXPRESSION("ntvdm!Ldt");
Status = ReadProcessMem(
hCurrentProcess,
LdtAddress,
&LdtAddress,
sizeof(ULONG),
&BytesRead
);
if ((!Status) || (BytesRead != sizeof(ULONG))) {
return FALSE;
}
(PUCHAR)LdtAddress += selector;
Status = ReadProcessMem(
hCurrentProcess,
LdtAddress,
pdte,
sizeof(VDMLDT_ENTRY),
&BytesRead
);
return TRUE;
#endif
}
ULONG GetInfoFromSelector(
WORD selector,
int mode,
SELECTORINFO *si
) {
ULONG base;
ULONG type;
#ifdef i386
BYTE byte;
BOOL b;
#endif
VDMLDT_ENTRY dte;
switch( mode ) {
case V86_MODE:
base = (ULONG)selector << 4;
if ( si ) {
si->Limit = 0xFFFFL;
si->bCode = FALSE;
}
break;
case PROT_MODE:
#ifdef i386
if ( (selector & 0xFF78) < KGDT_LDT ) {
return( (ULONG)-1 );
}
#endif
if ( !GetDescriptorData(selector, &dte) ) {
return( (ULONG)-1 );
}
base = ((ULONG)dte.HighWord.Bytes.BaseHi << 24)
+ ((ULONG)dte.HighWord.Bytes.BaseMid << 16)
+ ((ULONG)dte.BaseLow);
if ( si ) {
si->Limit = (ULONG)dte.LimitLow
+ ((ULONG)dte.HighWord.Bits.LimitHi << 16);
if ( dte.HighWord.Bits.Granularity ) {
si->Limit <<= 12;
si->Limit += 0xFFF;
}
si->Base = base;
type = dte.HighWord.Bits.Type;
si->bSystem = !(BOOL) (type & 0x10);
if (!si->bSystem) {
si->bCode = (BOOL) (type & 8);
}
si->bAccessed = (BOOL) (type & 1);
si->bWrite = (BOOL) (type & 2);
if (si->bCode) {
si->bWrite = !si->bWrite;
}
si->bPresent = (BOOL) dte.HighWord.Bits.Pres;
si->bBig = (BOOL) dte.HighWord.Bits.Default_Big;
}
if ( base == 0 ) {
return( (ULONG)-1 );
}
#ifdef i386
b = ReadProcessMem(
hCurrentProcess,
(LPVOID)base,
&byte,
sizeof(byte),
NULL
);
if ( !b ) {
return( (ULONG)-1 );
}
#endif
break;
case FLAT_MODE:
PRINTF("Unsupported determination of base address in flat mode\n");
base = 0;
break;
}
return( base );
}
//****************************************************************************
//
// Command line parsing routines
//
//****************************************************************************
BOOL
SkipToNextWhiteSpace(
VOID
)
{
char ch;
while ( (ch = *lpArgumentString) != '\0' ) {
if ( ch == ' ' || ch == '\t' || ch == '\r' || ch == '\n' ) {
return TRUE;
}
lpArgumentString++;
}
return FALSE;
}
BOOL
GetNextToken(
VOID
)
{
char ch;
while ( (ch = *lpArgumentString) != '\0' ) {
if ( ch != ' ' && ch != '\t' && ch != '\r' && ch != '\n' ) {
return TRUE;
}
lpArgumentString++;
}
return FALSE;
}
BOOL
ParseIntelAddress(
int *pMode,
WORD *pSelector,
PULONG pOffset
)
{
char sel_text[128], off_text[128];
char *colon;
char *mode_prefix;
colon = strchr( lpArgumentString, ':' );
if ( colon == NULL ) {
PRINTF("Please specify an address in the form 'seg:offset'\n");
return FALSE;
}
mode_prefix = strchr( lpArgumentString, '&' );
if ( mode_prefix == NULL ) {
mode_prefix = strchr( lpArgumentString, '#' );
if ( mode_prefix != NULL ) {
if ( mode_prefix != lpArgumentString ) {
PRINTF("Address must have '&' symbol as the first character\n");
return FALSE;
}
*pMode = PROT_MODE;
lpArgumentString = mode_prefix+1;
}
} else {
if ( mode_prefix != lpArgumentString ) {
PRINTF("Address must have '#' symbol as the first character\n");
return FALSE;
}
*pMode = V86_MODE;
lpArgumentString = mode_prefix+1;
}
*colon = '\0';
strcpy( sel_text, lpArgumentString );
*colon = ':';
strcpy( off_text, colon+1 );
*pSelector = (WORD) EXPRESSION( sel_text );
*pOffset = (ULONG) EXPRESSION( off_text );
SkipToNextWhiteSpace();
return TRUE;
}
Reference in New Issue View Git Blame Copy Permalink