625 lines
18 KiB
Plaintext
625 lines
18 KiB
Plaintext
----------
|
|
void InitSymContext (PPROCESS_INFO pProcess)
|
|
|
|
----------
|
|
void DeferSymbolLoad (PIMAGE_INFO pImage)
|
|
|
|
----------
|
|
BOOLEAN CountLinenumbers(PIMAGE_INFO pImage)
|
|
|
|
----------
|
|
void LoadSymbols (PIMAGE_INFO pImage)
|
|
|
|
----------
|
|
void LoadSymbols (PIMAGE_INFO pImage)
|
|
|
|
----------
|
|
void PackAuxNameEntry (PUCHAR pPathname, ULONG auxcount)
|
|
|
|
----------
|
|
void UnloadSymbols (PIMAGE_INFO pImage)
|
|
|
|
----------
|
|
void EnsureModuleSymbolsLoaded (CHAR iModule)
|
|
|
|
----------
|
|
int EnsureOffsetSymbolsLoaded (ULONG offset)
|
|
|
|
----------
|
|
PUCHAR GetModuleName (PUCHAR pszPath)
|
|
|
|
----------
|
|
* parseExamine - parse and execute examine command
|
|
*
|
|
* Purpose:
|
|
* Parse the current command string and examine the symbol
|
|
* table to display the appropriate entries. The entries
|
|
* are displayed in increasing string order. This function
|
|
* accepts underscores, alphabetic, and numeric characters
|
|
* to match as well as the special characters '?' and '*'.
|
|
* The '?' character matches any other character while '*'
|
|
* matches any string of zero or more characters. If used,
|
|
* '*' must be the last character in the pattern.
|
|
*
|
|
* Input:
|
|
* pchCommand - pointer to current command string
|
|
*
|
|
* Output:
|
|
* offset and string name of symbols displayed
|
|
void parseExamine (void)
|
|
|
|
----------
|
|
PIMAGE_INFO ParseModuleIndex (void)
|
|
|
|
----------
|
|
PIMAGE_INFO GetModuleIndex (PUCHAR pszName)
|
|
|
|
----------
|
|
PIMAGE_INFO GetCurrentModuleIndex (void)
|
|
|
|
----------
|
|
void DumpModuleTable (BOOLEAN fLineInfo)
|
|
|
|
----------
|
|
* AccessNode - access and splay node
|
|
*
|
|
* Purpose:
|
|
* Search a tree for a node and splay it.
|
|
*
|
|
* Input:
|
|
* pSymContext - pointer to context of tree
|
|
* pNodeAccess - pointer to node with access value set
|
|
*
|
|
* Output:
|
|
* tree splayed with new node at its root
|
|
* Returns:
|
|
* value of success:
|
|
* 1 = root is smallest value larger than input value
|
|
* (not found, no lesser value)
|
|
* 0 = root is input value (value found in tree)
|
|
* -1 = root is largest value less than input value
|
|
* (not found in tree)
|
|
*
|
|
* Notes:
|
|
* splay is done with resulting root
|
|
* if root is less than input value, a secondary splay is done
|
|
* to make the next node the right child of the root
|
|
int AccessNode (PSYMCONTEXT pSymContext, PNODE pNodeAccess)
|
|
|
|
----------
|
|
* CompareSymbolOffset - comparison routine for symbol offsets
|
|
*
|
|
* Purpose:
|
|
* Compare two nodes in the offset tree. The ordering
|
|
* comparisons used are offset and string. The string
|
|
* comparison is done since and offset can have more than
|
|
* one string associated with it.
|
|
*
|
|
* Input:
|
|
* pNode1 - pointer to first node - usually the new one
|
|
* pNode2 - pointer to second node - usually in the tree searched
|
|
*
|
|
* Output:
|
|
* pfWeakCmp - always FALSE - comparisons are exact or they fail
|
|
*
|
|
* Returns:
|
|
* value of comparison result:
|
|
* -1 = value(pNode1) < value(pNode2)
|
|
* 0 = value(pNode1) == value(pNode2)
|
|
* 1 = value(pNode1) > value(pNode2)
|
|
int CompareSymbolOffset (PNODE pNode1, PNODE pNode2, PBOOLEAN pfWeakCmp)
|
|
|
|
----------
|
|
* CompareSymfileOffset - comparison routine for symbol file offsets
|
|
*
|
|
* Purpose:
|
|
* Compare two nodes in the symbol file offset tree. The ordering
|
|
* comparisons used are offset and string. The string
|
|
* comparison is done since and offset can have more than
|
|
* one string associated with it.
|
|
*
|
|
* Input:
|
|
* pNode1 - pointer to first node - usually the new one
|
|
* pNode2 - pointer to second node - usually in the tree searched
|
|
*
|
|
* Output:
|
|
* pfWeakCmp - always FALSE - comparisons are exact or they fail
|
|
*
|
|
* Returns:
|
|
* value of comparison result:
|
|
* -1 = value(pNode1) < value(pNode2)
|
|
* 0 = value(pNode1) == value(pNode2)
|
|
* 1 = value(pNode1) > value(pNode2)
|
|
int CompareSymfileOffset (PNODE pNode1, PNODE pNode2, PBOOLEAN pfWeakCmp)
|
|
|
|
----------
|
|
* CompareSymbolString - comparison routine for symbol strings
|
|
*
|
|
* Purpose:
|
|
* Compare two nodes in the string tree. The ordering
|
|
* comparisons used are case-insensitivity, underscore
|
|
* count, module ordering, and case-sensitivity.
|
|
*
|
|
* Input:
|
|
* pNode1 - pointer to first node - usually the new one
|
|
* pNode2 - pointer to second node - usually in the tree searched
|
|
*
|
|
* Output:
|
|
* pfWeakCmp - TRUE if case-insensitive and underscores match
|
|
* FALSE otherwise (defined only if cmp nonzero)
|
|
*
|
|
* Returns:
|
|
* value of comparison result:
|
|
* -1 = value(pNode1) < value(pNode2)
|
|
* 0 = value(pNode1) == value(pNode2)
|
|
* 1 = value(pNode1) > value(pNode2)
|
|
*
|
|
*************************************************************************/
|
|
|
|
int CompareSymbolString (PNODE pNode1, PNODE pNode2, PBOOLEAN pfWeakCmp)
|
|
----------
|
|
|
|
* CompareSymfileString - comparison routine for symbol file strings
|
|
*
|
|
* Purpose:
|
|
* Compare two nodes in the string tree. The ordering
|
|
* comparisons used are case-insensitivity, underscore
|
|
* count, module ordering, and case-sensitivity.
|
|
*
|
|
* Input:
|
|
* pNode1 - pointer to first node - usually the new one
|
|
* pNode2 - pointer to second node - usually in the tree searched
|
|
*
|
|
* Output:
|
|
* pfWeakCmp - TRUE if case-insensitive and underscores match
|
|
* FALSE otherwise (defined only if cmp nonzero)
|
|
*
|
|
* Returns:
|
|
* value of comparison result:
|
|
* -1 = value(pNode1) < value(pNode2)
|
|
* 0 = value(pNode1) == value(pNode2)
|
|
* 1 = value(pNode1) > value(pNode2)
|
|
int CompareSymfileString (PNODE pNode1, PNODE pNode2, PBOOLEAN pfWeakCmp)
|
|
|
|
----------
|
|
* InsertSymbol - insert offset and string into new symbol
|
|
*
|
|
* Purpose:
|
|
* external routine.
|
|
* Allocate and insert a new symbol into the offset and
|
|
* string trees.
|
|
*
|
|
* Input:
|
|
* insertvalue - offset value of new symbol
|
|
* pinsertstring - string value if new symbol
|
|
*
|
|
* Output:
|
|
* None.
|
|
*
|
|
* Notes:
|
|
* Uses the routine InsertNode for both offset and string
|
|
* through different contexts.
|
|
PSYMBOL InsertSymbol (ULONG insertvalue, PUCHAR pinsertstring,
|
|
CHAR insertmod)
|
|
----------
|
|
PSTRUCT InsertStructure (ULONG insertvalue, PUCHAR pinsertstring,
|
|
CHAR insertmod)
|
|
----------
|
|
* InsertSymfile - insert new file line numbers into search tree
|
|
*
|
|
* Purpose:
|
|
* Allocate and insert a new files and its line numbers into the
|
|
* offset and filename string trees.
|
|
*
|
|
* Input:
|
|
* pPathname - pointer to pathname string
|
|
* pFilename - pointer to filename string
|
|
* pExtension - pointer to extension string
|
|
* pLineno - pointer to COFF line number entries
|
|
* cLineno - count of entries pointed by pLineno
|
|
* endingOffset - ending offset of file section
|
|
* index - module index for file section
|
|
*
|
|
* Output:
|
|
* None.
|
|
*
|
|
* Notes:
|
|
* Uses the routine InsertNode for both offset and filename
|
|
* string through different contexts.
|
|
PSYMFILE InsertSymfile (PUCHAR pPathname, PUCHAR pFilename,
|
|
PUCHAR pExtension,
|
|
PCOFF_LINENUMBER pLineno, USHORT cLineno,
|
|
ULONG startingOffset, ULONG endingOffset,
|
|
CHAR index)
|
|
|
|
----------
|
|
* InsertNode - insert new node into tree
|
|
*
|
|
* Purpose:
|
|
* Insert node into the tree of the specified context.
|
|
*
|
|
* Input:
|
|
* pSymContext - pointer to context to insert node
|
|
* pNodeNew - pointer to node to insert
|
|
*
|
|
* Returns:
|
|
* TRUE - node was inserted successfully
|
|
* FALSE - node already exists
|
|
*
|
|
* Notes:
|
|
* Both offset and string values of the node may be used
|
|
* in the ordering or duplication criteria.
|
|
BOOLEAN InsertNode (PSYMCONTEXT pSymContext, PNODE pNodeNew)
|
|
|
|
----------
|
|
* DeleteSymbol - delete specified symbol from splay tree
|
|
*
|
|
* Purpose:
|
|
* external routine.
|
|
* Delete the specified symbol object in both the
|
|
* offset and string trees and deallocate its space.
|
|
*
|
|
* Input:
|
|
* pSymbol - pointer to symbol object to delete
|
|
*
|
|
* Output:
|
|
* None.
|
|
void DeleteSymbol (PSYMBOL pSymbol)
|
|
|
|
----------
|
|
* DeleteNode - delete specified node from tree
|
|
*
|
|
* Purpose:
|
|
* Delete node from tree of the context specified.
|
|
*
|
|
* Input:
|
|
* pSymContext - pointer to context of deletion
|
|
* pNodeDelete - pointer to node to actually delete
|
|
*
|
|
* Output:
|
|
* None.
|
|
void DeleteNode (PSYMCONTEXT pSymContext, PNODE pNodeDelete)
|
|
|
|
----------
|
|
* JoinTree - join two trees into one
|
|
*
|
|
* Purpose:
|
|
* Join two trees into one where all nodes of the first
|
|
* tree have a lesser value than any of the second.
|
|
*
|
|
* Input:
|
|
* pSymContext - pointer to context containing the first tree
|
|
* pNodeRoot2 - pointer to root of second tree
|
|
*
|
|
* Output:
|
|
* pSymContext - pointer to context containing the joined tree
|
|
void JoinTree (PSYMCONTEXT pSymContext, PNODE pNodeRoot2)
|
|
|
|
----------
|
|
* SplitTree - split one tree into two
|
|
*
|
|
* Purpose:
|
|
* Split the given tree into two subtrees, the first
|
|
* having nodes less than specific value, and the
|
|
* second having nodes greater than or equal to that
|
|
* value.
|
|
*
|
|
* Input:
|
|
* pSymContext - pointer to context containing tree to split
|
|
* pNodeNew - node with value used to specify split
|
|
*
|
|
* Output:
|
|
* pSymContext - pointer to context containing first tree
|
|
* *ppNodeRoot2 - pointer to pointer to root of second tree
|
|
*
|
|
* Returns:
|
|
* result of access:
|
|
* 1 = root is smallest value larger than input value
|
|
* (not found, no lesser value)
|
|
* 0 = root is input value (value found in tree)
|
|
* -1 = root is largest value less than input value
|
|
* (not found in tree)
|
|
int SplitTree (PSYMCONTEXT pSymContext, PNODE *ppNodeRoot2, PNODE pNodeNew)
|
|
|
|
----------
|
|
* SplayTree - splay tree with node specified
|
|
*
|
|
* Purpose:
|
|
* Perform rotations (splayings) on the specified tree
|
|
* until the node given is at the root.
|
|
*
|
|
* Input:
|
|
* pointer to node to splay to root
|
|
*
|
|
* Returns:
|
|
* pointer to node splayed
|
|
*
|
|
* Notes:
|
|
PNODE SplayTree (PNODE pNentry)
|
|
|
|
----------
|
|
* NextNode - return node with next key in tree
|
|
*
|
|
* Purpose:
|
|
* With the specified context and node, determine
|
|
* the node with the next larger value.
|
|
*
|
|
* Input:
|
|
* pSymContext - pointer to context to test
|
|
* pNode - pointer to node within context
|
|
* NULL to return the first node in the tree
|
|
*
|
|
* Returns:
|
|
* pointer to node of the next value
|
|
* NULL if largest node was input
|
|
PNODE NextNode (PSYMCONTEXT pSymContext, PNODE pNode)
|
|
|
|
----------
|
|
* OutputTree - output tree node in ascending order
|
|
*
|
|
* Purpose:
|
|
* Using the specified context, output the corresponding
|
|
* tree from lowest to highest values.
|
|
*
|
|
* Input:
|
|
* pSymContext - pointer to context whose tree to output
|
|
*
|
|
* Output:
|
|
* contents of tree nodes from low to high
|
|
void OutputTree (PSYMCONTEXT pSymContext)
|
|
|
|
----------
|
|
* GetOffsetFromSym - return offset from symbol specified
|
|
*
|
|
* Purpose:
|
|
* external routine.
|
|
* With the specified symbol, set the pointer to
|
|
* its offset. The variable chSymbolSuffix may
|
|
* be used to append a character to repeat the search
|
|
* if it first fails.
|
|
*
|
|
* Input:
|
|
* pString - pointer to input symbol
|
|
*
|
|
* Output:
|
|
* pOffset - pointer to offset to be set
|
|
*
|
|
* Returns:
|
|
* BOOLEAN value of success
|
|
BOOLEAN GetOffsetFromSym (PUCHAR pString, PULONG pOffset, CHAR iModule)
|
|
|
|
----------
|
|
* GetOffsetFromString - return offset from string specified
|
|
*
|
|
* Purpose:
|
|
* With the specified string, set the pointer to
|
|
* its offset.
|
|
*
|
|
* Input:
|
|
* pString - pointer to input string
|
|
*
|
|
* Output:
|
|
* pOffset - pointer to offset to be set
|
|
*
|
|
* Returns:
|
|
* BOOLEAN value of success
|
|
BOOLEAN GetOffsetFromString (PUCHAR pString, PULONG pOffset, CHAR iModule)
|
|
|
|
----------
|
|
* GetOffsetFromLineno - return offset from file:lineno specified
|
|
*
|
|
* Purpose:
|
|
* With the specified file and line number, return
|
|
* its offset.
|
|
*
|
|
* Input:
|
|
* pString - pointer to input string for filename
|
|
* lineno - line number of filename specified
|
|
*
|
|
* Output:
|
|
* pOffset - pointer to offset to be set
|
|
*
|
|
* Returns:
|
|
* BOOLEAN value of success
|
|
PLINENO GetLinenoFromFilename (PUCHAR pString, PPSYMFILE ppSymfile,
|
|
USHORT lineNum, CHAR iModule)
|
|
|
|
----------
|
|
void GetLinenoString (PUCHAR pchBuffer, ULONG offset)
|
|
|
|
----------
|
|
void GetCurrentMemoryOffsets (PULONG pMemoryLow, PULONG pMemoryHigh)
|
|
|
|
----------
|
|
PLINENO GetCurrentLineno (PPSYMFILE ppSymfile)
|
|
|
|
----------
|
|
PLINENO GetLastLineno (PPSYMFILE ppSymfile, PUSHORT pLineNum)
|
|
|
|
----------
|
|
BOOLEAN GetLocalFromString(PUCHAR pszLocal, PULONG pValue)
|
|
|
|
----------
|
|
PSYMBOL GetFunctionFromOffset (PPSYMFILE ppSymfile, ULONG offset)
|
|
|
|
----------
|
|
PSTRUCT GetStructFromValue(ULONG value, LONG base)
|
|
|
|
----------
|
|
ULONG GetLocalValue(LONG value, USHORT type, BOOLEAN fPrint)
|
|
|
|
----------
|
|
void GetBytesFromFrame(PUCHAR pcb, LONG offset, USHORT cb)
|
|
|
|
----------
|
|
void AddFieldToStructure(PSTRUCT pStruct, PUCHAR pszFieldName, ULONG value,
|
|
USHORT type, ULONG auxValue)
|
|
|
|
----------
|
|
void AddLocalToFunction(PSYMBOL pFunction, PUCHAR pszLocalName, ULONG value,
|
|
USHORT type, ULONG auxValue)
|
|
|
|
----------
|
|
PSYMBOL InsertFunction(PUCHAR lpFunctionName, ULONG offset) //, PSYMBOL pS)
|
|
|
|
----------
|
|
PLINENO GetLinenoFromOffset (PPSYMFILE ppSymfile, ULONG offset)
|
|
|
|
----------
|
|
* GetSymbol - get symbol name from offset specified
|
|
*
|
|
* Purpose:
|
|
* external routine.
|
|
* With the specified offset, return the nearest symbol string
|
|
* previous or equal to the offset and its displacement
|
|
*
|
|
* Input:
|
|
* offset - input offset to search
|
|
* offsetSymMax - maximum offset of a symbol (global value)
|
|
*
|
|
* Output:
|
|
* pchBuffer - pointer to buffer to fill with string
|
|
* pDisplacement - pointer to offset displacement
|
|
*
|
|
* Notes:
|
|
* if offset if less than any defined symbol, the NULL value
|
|
* is returned and the displacement is set to the offset
|
|
void GetSymbol (ULONG offset, PUCHAR pchBuffer, PULONG pDisplacement)
|
|
|
|
----------
|
|
* AllocSymbol - build and allocate symbol
|
|
*
|
|
* Purpose:
|
|
* Allocate space for symbol structure.
|
|
*
|
|
* Input:
|
|
* offset - offset of symbol to be allocated
|
|
* pString - pointer to string of symbol to be allocated
|
|
*
|
|
* Returns:
|
|
* pointer to filled symbol structure
|
|
*
|
|
* Exceptions:
|
|
*
|
|
* Notes:
|
|
* space allocated is: sizeof(SYMBOL) -- nonstring info and 3 UCHAR's
|
|
* + strlen(pString) -- size of string
|
|
* + 1 -- space for terminating NULL
|
|
* the sum is rounded up using the 3 UCHAR's and and'ing with ~3
|
|
PSYMBOL AllocSymbol (ULONG offset, PUCHAR pString, CHAR iModule)
|
|
|
|
----------
|
|
* AllocSymfile - build and allocate symbol file structure
|
|
*
|
|
* Purpose:
|
|
* Allocate space for symbol file structure.
|
|
*
|
|
* Input:
|
|
* offset - offset of symbol to be allocated
|
|
* pString - pointer to string of symbol to be allocated
|
|
*
|
|
* Returns:
|
|
* pointer to filled symbol structure
|
|
PSYMFILE AllocSymfile (PUCHAR pPathname, PUCHAR pFilename,
|
|
PUCHAR pExtension,
|
|
PCOFF_LINENUMBER pCoffLineno, USHORT cLineno,
|
|
ULONG startingOffset, ULONG endingOffset,
|
|
CHAR modIndex)
|
|
|
|
----------
|
|
* DeallocSymbol - release symbol space
|
|
*
|
|
* Purpose:
|
|
* Deallocate the symbol space given by the pointer
|
|
*
|
|
* Input:
|
|
* pSymbolReturn - pointer to symbol to return
|
|
*
|
|
* Output:
|
|
* None.
|
|
void DeallocSymbol (PSYMBOL pSymbolReturn)
|
|
|
|
----------
|
|
* DeleteSymfile - delete specified symbol file from splay tree
|
|
*
|
|
* Purpose:
|
|
* external routine.
|
|
* Delete the specified symbol file object in both the
|
|
* offset and string trees and deallocate its space.
|
|
*
|
|
* Input:
|
|
* pSymfile - pointer to symfile object to delete
|
|
*
|
|
* Output:
|
|
* None.
|
|
void DeleteSymfile (PSYMFILE pSymfile)
|
|
|
|
----------
|
|
* DeallocSymfile - release symbol file space
|
|
*
|
|
* Purpose:
|
|
* Deallocate the symbol file space given by the pointer
|
|
*
|
|
* Input:
|
|
* pSymfileReturn - pointer to symbol file to return
|
|
*
|
|
* Output:
|
|
* None.
|
|
void DeallocSymfile (PSYMFILE pSymfile)
|
|
|
|
----------
|
|
* ntsdstricmp - case-insensitive string compare
|
|
*
|
|
* Purpose:
|
|
* Compare two strings, but map upper case to lower
|
|
*
|
|
* Input:
|
|
* pchDst - pointer to first string
|
|
* pchSrc - pointer to second string
|
|
*
|
|
* Output:
|
|
* -1 if value(pchDst) < value(pchSrc)
|
|
* 0 if value(pchDst) = value(pchSrc)
|
|
* 1 if value(pchDst) > value(pchSrc)
|
|
int ntsdstricmp (PUCHAR pchDst, PUCHAR pchSrc)
|
|
|
|
----------
|
|
* fnListNear - function to list symbols near an address
|
|
*
|
|
* Purpose:
|
|
* from the address specified, access the symbol table to
|
|
* find the closest symbolic addresses both before and after
|
|
* it. output these on one line (if spaces permits).
|
|
*
|
|
* Input:
|
|
* addrstart - address to base listing
|
|
*
|
|
* Output:
|
|
* symbolic and absolute addresses of variable on or before
|
|
* and after the specified address
|
|
void fnListNear (ULONG addrStart)
|
|
|
|
----------
|
|
void SortSrcLinePointers (PSYMFILE pSymfile)
|
|
|
|
----------
|
|
void UpdateLineno (PSYMFILE pSymfile, PLINENO pLineno)
|
|
|
|
----------
|
|
FILE * LocateTextInSource (PSYMFILE pSymfile, PLINENO pLineno)
|
|
|
|
----------
|
|
void OutputSourceLines (PSYMFILE pSymfile, USHORT startLineNum, USHORT count)
|
|
|
|
----------
|
|
BOOLEAN OutputSourceFromOffset (ULONG offset, BOOLEAN fMatch)
|
|
|
|
----------
|
|
BOOLEAN OutputLines (PSYMFILE pSymfile, PLINENO pLineno, USHORT startLineNum,
|
|
USHORT count)
|
|
|
|
----------
|
|
PVOID FetchImageDirectoryEntry(int Handle, USHORT DirectoryEntry,
|
|
PULONG Size, PULONG Base)
|
|
|