776 lines
23 KiB
C
776 lines
23 KiB
C
|
/*++
|
||
|
|
|
||
|
|
Copyright (c) Microsoft Corporation. All rights reserved.
|
||
|
|
|
||
|
|
Module Name:
|
||
|
|
|
||
|
|
ntiodump.h
|
||
|
|
|
||
|
|
Abstract:
|
||
|
|
|
||
|
|
This is the include file that defines all constants and types for
|
||
|
|
accessing memory dump files.
|
||
|
|
|
||
|
|
Revision History:
|
||
|
|
|
||
|
|
|
||
|
|
--*/
|
||
|
|
|
||
|
|
#ifndef _NTIODUMP_
|
||
|
|
#define _NTIODUMP_
|
||
|
|
|
||
|
|
#if _MSC_VER > 1000
|
||
|
|
#pragma once
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#ifndef MIDL_PASS
|
||
|
|
#if _MSC_VER >= 1200
|
||
|
|
#pragma warning(push)
|
||
|
|
#endif
|
||
|
|
#pragma warning( disable : 4200 ) // nonstandard extension used : zero-sized array in struct/union
|
||
|
|
#endif // MIDL_PASS
|
||
|
|
|
||
|
|
#ifdef __cplusplus
|
||
|
|
extern "C" {
|
||
|
|
#endif
|
||
|
|
|
||
|
|
|
||
|
|
#define USERMODE_CRASHDUMP_SIGNATURE 'RESU'
|
||
|
|
#define USERMODE_CRASHDUMP_VALID_DUMP32 'PMUD'
|
||
|
|
#define USERMODE_CRASHDUMP_VALID_DUMP64 '46UD'
|
||
|
|
|
||
|
|
typedef struct _USERMODE_CRASHDUMP_HEADER {
|
||
|
|
ULONG Signature;
|
||
|
|
ULONG ValidDump;
|
||
|
|
ULONG MajorVersion;
|
||
|
|
ULONG MinorVersion;
|
||
|
|
ULONG MachineImageType;
|
||
|
|
ULONG ThreadCount;
|
||
|
|
ULONG ModuleCount;
|
||
|
|
ULONG MemoryRegionCount;
|
||
|
|
ULONG_PTR ThreadOffset;
|
||
|
|
ULONG_PTR ModuleOffset;
|
||
|
|
ULONG_PTR DataOffset;
|
||
|
|
ULONG_PTR MemoryRegionOffset;
|
||
|
|
ULONG_PTR DebugEventOffset;
|
||
|
|
ULONG_PTR ThreadStateOffset;
|
||
|
|
ULONG_PTR VersionInfoOffset;
|
||
|
|
ULONG_PTR Spare1;
|
||
|
|
} USERMODE_CRASHDUMP_HEADER, *PUSERMODE_CRASHDUMP_HEADER;
|
||
|
|
|
||
|
|
typedef struct _USERMODE_CRASHDUMP_HEADER32 {
|
||
|
|
ULONG Signature;
|
||
|
|
ULONG ValidDump;
|
||
|
|
ULONG MajorVersion;
|
||
|
|
ULONG MinorVersion;
|
||
|
|
ULONG MachineImageType;
|
||
|
|
ULONG ThreadCount;
|
||
|
|
ULONG ModuleCount;
|
||
|
|
ULONG MemoryRegionCount;
|
||
|
|
ULONG ThreadOffset;
|
||
|
|
ULONG ModuleOffset;
|
||
|
|
ULONG DataOffset;
|
||
|
|
ULONG MemoryRegionOffset;
|
||
|
|
ULONG DebugEventOffset;
|
||
|
|
ULONG ThreadStateOffset;
|
||
|
|
ULONG VersionInfoOffset;
|
||
|
|
ULONG Spare1;
|
||
|
|
} USERMODE_CRASHDUMP_HEADER32, *PUSERMODE_CRASHDUMP_HEADER32;
|
||
|
|
|
||
|
|
typedef struct _USERMODE_CRASHDUMP_HEADER64 {
|
||
|
|
ULONG Signature;
|
||
|
|
ULONG ValidDump;
|
||
|
|
ULONG MajorVersion;
|
||
|
|
ULONG MinorVersion;
|
||
|
|
ULONG MachineImageType;
|
||
|
|
ULONG ThreadCount;
|
||
|
|
ULONG ModuleCount;
|
||
|
|
ULONG MemoryRegionCount;
|
||
|
|
ULONGLONG ThreadOffset;
|
||
|
|
ULONGLONG ModuleOffset;
|
||
|
|
ULONGLONG DataOffset;
|
||
|
|
ULONGLONG MemoryRegionOffset;
|
||
|
|
ULONGLONG DebugEventOffset;
|
||
|
|
ULONGLONG ThreadStateOffset;
|
||
|
|
ULONGLONG VersionInfoOffset;
|
||
|
|
ULONGLONG Spare1;
|
||
|
|
} USERMODE_CRASHDUMP_HEADER64, *PUSERMODE_CRASHDUMP_HEADER64;
|
||
|
|
|
||
|
|
typedef struct _CRASH_MODULE {
|
||
|
|
ULONG_PTR BaseOfImage;
|
||
|
|
ULONG SizeOfImage;
|
||
|
|
ULONG ImageNameLength;
|
||
|
|
CHAR ImageName[0];
|
||
|
|
} CRASH_MODULE, *PCRASH_MODULE;
|
||
|
|
|
||
|
|
typedef struct _CRASH_MODULE32 {
|
||
|
|
ULONG BaseOfImage;
|
||
|
|
ULONG SizeOfImage;
|
||
|
|
ULONG ImageNameLength;
|
||
|
|
CHAR ImageName[0];
|
||
|
|
} CRASH_MODULE32, *PCRASH_MODULE32;
|
||
|
|
|
||
|
|
typedef struct _CRASH_MODULE64 {
|
||
|
|
ULONGLONG BaseOfImage;
|
||
|
|
ULONG SizeOfImage;
|
||
|
|
ULONG ImageNameLength;
|
||
|
|
CHAR ImageName[0];
|
||
|
|
} CRASH_MODULE64, *PCRASH_MODULE64;
|
||
|
|
|
||
|
|
typedef struct _CRASH_THREAD {
|
||
|
|
ULONG ThreadId;
|
||
|
|
ULONG SuspendCount;
|
||
|
|
ULONG PriorityClass;
|
||
|
|
ULONG Priority;
|
||
|
|
ULONG_PTR Teb;
|
||
|
|
ULONG_PTR Spare0;
|
||
|
|
ULONG_PTR Spare1;
|
||
|
|
ULONG_PTR Spare2;
|
||
|
|
ULONG_PTR Spare3;
|
||
|
|
ULONG_PTR Spare4;
|
||
|
|
ULONG_PTR Spare5;
|
||
|
|
ULONG_PTR Spare6;
|
||
|
|
} CRASH_THREAD, *PCRASH_THREAD;
|
||
|
|
|
||
|
|
typedef struct _CRASH_THREAD32 {
|
||
|
|
ULONG ThreadId;
|
||
|
|
ULONG SuspendCount;
|
||
|
|
ULONG PriorityClass;
|
||
|
|
ULONG Priority;
|
||
|
|
ULONG Teb;
|
||
|
|
ULONG Spare0;
|
||
|
|
ULONG Spare1;
|
||
|
|
ULONG Spare2;
|
||
|
|
ULONG Spare3;
|
||
|
|
ULONG Spare4;
|
||
|
|
ULONG Spare5;
|
||
|
|
ULONG Spare6;
|
||
|
|
} CRASH_THREAD32, *PCRASH_THREAD32;
|
||
|
|
|
||
|
|
typedef struct _CRASH_THREAD64 {
|
||
|
|
ULONG ThreadId;
|
||
|
|
ULONG SuspendCount;
|
||
|
|
ULONG PriorityClass;
|
||
|
|
ULONG Priority;
|
||
|
|
ULONGLONG Teb;
|
||
|
|
ULONGLONG Spare0;
|
||
|
|
ULONGLONG Spare1;
|
||
|
|
ULONGLONG Spare2;
|
||
|
|
ULONGLONG Spare3;
|
||
|
|
ULONGLONG Spare4;
|
||
|
|
ULONGLONG Spare5;
|
||
|
|
ULONGLONG Spare6;
|
||
|
|
} CRASH_THREAD64, *PCRASH_THREAD64;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _CRASHDUMP_VERSION_INFO {
|
||
|
|
int IgnoreGuardPages; // Whether we should ignore GuardPages or not
|
||
|
|
ULONG PointerSize; // 32, 64 bit pointers
|
||
|
|
} CRASHDUMP_VERSION_INFO, *PCRASHDUMP_VERSION_INFO;
|
||
|
|
|
||
|
|
//
|
||
|
|
// usermode crash dump data types
|
||
|
|
//
|
||
|
|
#define DMP_EXCEPTION 1 // obsolete
|
||
|
|
#define DMP_MEMORY_BASIC_INFORMATION 2
|
||
|
|
#define DMP_THREAD_CONTEXT 3
|
||
|
|
#define DMP_MODULE 4
|
||
|
|
#define DMP_MEMORY_DATA 5
|
||
|
|
#define DMP_DEBUG_EVENT 6
|
||
|
|
#define DMP_THREAD_STATE 7
|
||
|
|
#define DMP_DUMP_FILE_HANDLE 8
|
||
|
|
|
||
|
|
//
|
||
|
|
// usermode crashdump callback function
|
||
|
|
//
|
||
|
|
typedef int (__stdcall *PDMP_CREATE_DUMP_CALLBACK)(
|
||
|
|
ULONG DataType,
|
||
|
|
PVOID* DumpData,
|
||
|
|
PULONG DumpDataLength,
|
||
|
|
PVOID UserData
|
||
|
|
);
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Define the information required to process memory dumps.
|
||
|
|
//
|
||
|
|
|
||
|
|
|
||
|
|
typedef enum _DUMP_TYPES {
|
||
|
|
DUMP_TYPE_INVALID = -1,
|
||
|
|
DUMP_TYPE_UNKNOWN = 0,
|
||
|
|
DUMP_TYPE_FULL = 1,
|
||
|
|
DUMP_TYPE_SUMMARY = 2,
|
||
|
|
DUMP_TYPE_HEADER = 3,
|
||
|
|
DUMP_TYPE_TRIAGE = 4,
|
||
|
|
} DUMP_TYPE;
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Signature and Valid fields.
|
||
|
|
//
|
||
|
|
|
||
|
|
#define DUMP_SIGNATURE32 ('EGAP')
|
||
|
|
#define DUMP_VALID_DUMP32 ('PMUD')
|
||
|
|
|
||
|
|
#define DUMP_SIGNATURE64 ('EGAP')
|
||
|
|
#define DUMP_VALID_DUMP64 ('46UD')
|
||
|
|
|
||
|
|
#define DUMP_SUMMARY_SIGNATURE ('PMDS')
|
||
|
|
#define DUMP_SUMMARY_VALID ('PMUD')
|
||
|
|
|
||
|
|
#define DUMP_SUMMARY_VALID_KERNEL_VA (1)
|
||
|
|
#define DUMP_SUMMARY_VALID_CURRENT_USER_VA (2)
|
||
|
|
|
||
|
|
//
|
||
|
|
//
|
||
|
|
// NOTE: The definition of PHYISCAL_MEMORY_RUN and PHYSICAL_MEMORY_DESCRIPTOR
|
||
|
|
// MUST be the same as in mm.h. The kernel portion of crashdump will
|
||
|
|
// verify that these structs are the same.
|
||
|
|
//
|
||
|
|
|
||
|
|
typedef struct _PHYSICAL_MEMORY_RUN32 {
|
||
|
|
ULONG BasePage;
|
||
|
|
ULONG PageCount;
|
||
|
|
} PHYSICAL_MEMORY_RUN32, *PPHYSICAL_MEMORY_RUN32;
|
||
|
|
|
||
|
|
typedef struct _PHYSICAL_MEMORY_DESCRIPTOR32 {
|
||
|
|
ULONG NumberOfRuns;
|
||
|
|
ULONG NumberOfPages;
|
||
|
|
PHYSICAL_MEMORY_RUN32 Run[1];
|
||
|
|
} PHYSICAL_MEMORY_DESCRIPTOR32, *PPHYSICAL_MEMORY_DESCRIPTOR32;
|
||
|
|
|
||
|
|
typedef struct _PHYSICAL_MEMORY_RUN64 {
|
||
|
|
ULONG64 BasePage;
|
||
|
|
ULONG64 PageCount;
|
||
|
|
} PHYSICAL_MEMORY_RUN64, *PPHYSICAL_MEMORY_RUN64;
|
||
|
|
|
||
|
|
typedef struct _PHYSICAL_MEMORY_DESCRIPTOR64 {
|
||
|
|
ULONG NumberOfRuns;
|
||
|
|
ULONG64 NumberOfPages;
|
||
|
|
PHYSICAL_MEMORY_RUN64 Run[1];
|
||
|
|
} PHYSICAL_MEMORY_DESCRIPTOR64, *PPHYSICAL_MEMORY_DESCRIPTOR64;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _UNLOADED_DRIVERS32 {
|
||
|
|
UNICODE_STRING32 Name;
|
||
|
|
ULONG StartAddress;
|
||
|
|
ULONG EndAddress;
|
||
|
|
LARGE_INTEGER CurrentTime;
|
||
|
|
} UNLOADED_DRIVERS32, *PUNLOADED_DRIVERS32;
|
||
|
|
|
||
|
|
typedef struct _UNLOADED_DRIVERS64 {
|
||
|
|
UNICODE_STRING64 Name;
|
||
|
|
ULONG64 StartAddress;
|
||
|
|
ULONG64 EndAddress;
|
||
|
|
LARGE_INTEGER CurrentTime;
|
||
|
|
} UNLOADED_DRIVERS64, *PUNLOADED_DRIVERS64;
|
||
|
|
|
||
|
|
#define MAX_UNLOADED_NAME_LENGTH 24
|
||
|
|
|
||
|
|
typedef struct _DUMP_UNLOADED_DRIVERS32
|
||
|
|
{
|
||
|
|
UNICODE_STRING32 Name;
|
||
|
|
WCHAR DriverName[MAX_UNLOADED_NAME_LENGTH / sizeof (WCHAR)];
|
||
|
|
ULONG StartAddress;
|
||
|
|
ULONG EndAddress;
|
||
|
|
} DUMP_UNLOADED_DRIVERS32, *PDUMP_UNLOADED_DRIVERS32;
|
||
|
|
|
||
|
|
typedef struct _DUMP_UNLOADED_DRIVERS64
|
||
|
|
{
|
||
|
|
UNICODE_STRING64 Name;
|
||
|
|
WCHAR DriverName[MAX_UNLOADED_NAME_LENGTH / sizeof (WCHAR)];
|
||
|
|
ULONG64 StartAddress;
|
||
|
|
ULONG64 EndAddress;
|
||
|
|
} DUMP_UNLOADED_DRIVERS64, *PDUMP_UNLOADED_DRIVERS64;
|
||
|
|
|
||
|
|
typedef struct _DUMP_MM_STORAGE32
|
||
|
|
{
|
||
|
|
ULONG Version;
|
||
|
|
ULONG Size;
|
||
|
|
ULONG MmSpecialPoolTag;
|
||
|
|
ULONG MiTriageActionTaken;
|
||
|
|
|
||
|
|
ULONG MmVerifyDriverLevel;
|
||
|
|
ULONG KernelVerifier;
|
||
|
|
ULONG MmMaximumNonPagedPool;
|
||
|
|
ULONG MmAllocatedNonPagedPool;
|
||
|
|
|
||
|
|
ULONG PagedPoolMaximum;
|
||
|
|
ULONG PagedPoolAllocated;
|
||
|
|
|
||
|
|
ULONG CommittedPages;
|
||
|
|
ULONG CommittedPagesPeak;
|
||
|
|
ULONG CommitLimitMaximum;
|
||
|
|
} DUMP_MM_STORAGE32, *PDUMP_MM_STORAGE32;
|
||
|
|
|
||
|
|
typedef struct _DUMP_MM_STORAGE64
|
||
|
|
{
|
||
|
|
ULONG Version;
|
||
|
|
ULONG Size;
|
||
|
|
ULONG MmSpecialPoolTag;
|
||
|
|
ULONG MiTriageActionTaken;
|
||
|
|
|
||
|
|
ULONG MmVerifyDriverLevel;
|
||
|
|
ULONG KernelVerifier;
|
||
|
|
ULONG64 MmMaximumNonPagedPool;
|
||
|
|
ULONG64 MmAllocatedNonPagedPool;
|
||
|
|
|
||
|
|
ULONG64 PagedPoolMaximum;
|
||
|
|
ULONG64 PagedPoolAllocated;
|
||
|
|
|
||
|
|
ULONG64 CommittedPages;
|
||
|
|
ULONG64 CommittedPagesPeak;
|
||
|
|
ULONG64 CommitLimitMaximum;
|
||
|
|
} DUMP_MM_STORAGE64, *PDUMP_MM_STORAGE64;
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Define the dump header structure. You cannot change these
|
||
|
|
// defines without breaking the debuggers, so don't.
|
||
|
|
//
|
||
|
|
|
||
|
|
#define DMP_PHYSICAL_MEMORY_BLOCK_SIZE_32 (700)
|
||
|
|
#define DMP_CONTEXT_RECORD_SIZE_32 (1200)
|
||
|
|
#define DMP_RESERVED_0_SIZE_32 (1768)
|
||
|
|
#define DMP_RESERVED_2_SIZE_32 (16)
|
||
|
|
#define DMP_RESERVED_3_SIZE_32 (56)
|
||
|
|
|
||
|
|
#define DMP_PHYSICAL_MEMORY_BLOCK_SIZE_64 (700)
|
||
|
|
#define DMP_CONTEXT_RECORD_SIZE_64 (3000)
|
||
|
|
#define DMP_RESERVED_0_SIZE_64 (4020)
|
||
|
|
|
||
|
|
#define DMP_HEADER_COMMENT_SIZE (128)
|
||
|
|
|
||
|
|
// Unset WriterStatus value from the header fill.
|
||
|
|
#define DUMP_WRITER_STATUS_UNINITIALIZED DUMP_SIGNATURE32
|
||
|
|
|
||
|
|
// WriterStatus codes for the dbgeng.dll dump writers.
|
||
|
|
enum
|
||
|
|
{
|
||
|
|
DUMP_DBGENG_SUCCESS,
|
||
|
|
DUMP_DBGENG_NO_MODULE_LIST,
|
||
|
|
DUMP_DBGENG_CORRUPT_MODULE_LIST,
|
||
|
|
};
|
||
|
|
|
||
|
|
//
|
||
|
|
// The 32-bit memory dump structure requires 4-byte alignment.
|
||
|
|
//
|
||
|
|
|
||
|
|
#include <pshpack4.h>
|
||
|
|
|
||
|
|
typedef struct _DUMP_HEADER32 {
|
||
|
|
ULONG Signature;
|
||
|
|
ULONG ValidDump;
|
||
|
|
ULONG MajorVersion;
|
||
|
|
ULONG MinorVersion;
|
||
|
|
ULONG DirectoryTableBase;
|
||
|
|
ULONG PfnDataBase;
|
||
|
|
ULONG PsLoadedModuleList;
|
||
|
|
ULONG PsActiveProcessHead;
|
||
|
|
ULONG MachineImageType;
|
||
|
|
ULONG NumberProcessors;
|
||
|
|
ULONG BugCheckCode;
|
||
|
|
ULONG BugCheckParameter1;
|
||
|
|
ULONG BugCheckParameter2;
|
||
|
|
ULONG BugCheckParameter3;
|
||
|
|
ULONG BugCheckParameter4;
|
||
|
|
CHAR VersionUser[32];
|
||
|
|
UCHAR PaeEnabled; // Present only for Win2k and better
|
||
|
|
UCHAR Spare3[3];
|
||
|
|
ULONG KdDebuggerDataBlock; // Present only for Win2k SP1 and better.
|
||
|
|
|
||
|
|
union {
|
||
|
|
PHYSICAL_MEMORY_DESCRIPTOR32 PhysicalMemoryBlock;
|
||
|
|
UCHAR PhysicalMemoryBlockBuffer [ DMP_PHYSICAL_MEMORY_BLOCK_SIZE_32 ];
|
||
|
|
};
|
||
|
|
UCHAR ContextRecord [ DMP_CONTEXT_RECORD_SIZE_32 ];
|
||
|
|
EXCEPTION_RECORD32 Exception;
|
||
|
|
CHAR Comment [ DMP_HEADER_COMMENT_SIZE ]; // May not be present.
|
||
|
|
UCHAR _reserved0 [ DMP_RESERVED_0_SIZE_32 ];
|
||
|
|
ULONG DumpType; // Present for Win2k and better.
|
||
|
|
ULONG MiniDumpFields;
|
||
|
|
ULONG SecondaryDataState;
|
||
|
|
ULONG ProductType;
|
||
|
|
ULONG SuiteMask;
|
||
|
|
ULONG WriterStatus;
|
||
|
|
LARGE_INTEGER RequiredDumpSpace; // Present for Win2k and better.
|
||
|
|
UCHAR _reserved2 [ DMP_RESERVED_2_SIZE_32 ];
|
||
|
|
LARGE_INTEGER SystemUpTime; // Present only for Whistler and better.
|
||
|
|
LARGE_INTEGER SystemTime; // Present only for Win2k and better.
|
||
|
|
UCHAR _reserved3 [ DMP_RESERVED_3_SIZE_32 ];
|
||
|
|
} DUMP_HEADER32, *PDUMP_HEADER32;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _FULL_DUMP32 {
|
||
|
|
CHAR Memory [1]; // Variable length to the end of the dump file.
|
||
|
|
} FULL_DUMP32, *PFULL_DUMP32;
|
||
|
|
|
||
|
|
typedef struct _SUMMARY_DUMP32 {
|
||
|
|
ULONG Signature;
|
||
|
|
ULONG ValidDump;
|
||
|
|
ULONG DumpOptions; // Summary Dump Options
|
||
|
|
ULONG HeaderSize; // Offset to the start of actual memory dump
|
||
|
|
ULONG BitmapSize; // Total bitmap size (i.e., maximum #bits)
|
||
|
|
ULONG Pages; // Total bits set in bitmap (i.e., total pages in sdump)
|
||
|
|
|
||
|
|
//
|
||
|
|
// These next three fields essentially form an on-disk RTL_BITMAP structure.
|
||
|
|
// The RESERVED field is stupidness introduced by the way the data is
|
||
|
|
// serialized to disk.
|
||
|
|
//
|
||
|
|
|
||
|
|
struct {
|
||
|
|
ULONG SizeOfBitMap;
|
||
|
|
ULONG _reserved0;
|
||
|
|
ULONG Buffer[];
|
||
|
|
} Bitmap;
|
||
|
|
|
||
|
|
} SUMMARY_DUMP32, * PSUMMARY_DUMP32;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _TRIAGE_DUMP32 {
|
||
|
|
ULONG ServicePackBuild; // What service pack of NT was this ?
|
||
|
|
ULONG SizeOfDump; // Size in bytes of the dump
|
||
|
|
ULONG ValidOffset; // Offset valid ULONG
|
||
|
|
ULONG ContextOffset; // Offset of CONTEXT record
|
||
|
|
ULONG ExceptionOffset; // Offset of EXCEPTION record
|
||
|
|
ULONG MmOffset; // Offset of Mm information
|
||
|
|
ULONG UnloadedDriversOffset; // Offset of Unloaded Drivers
|
||
|
|
ULONG PrcbOffset; // Offset of KPRCB
|
||
|
|
ULONG ProcessOffset; // Offset of EPROCESS
|
||
|
|
ULONG ThreadOffset; // Offset of ETHREAD
|
||
|
|
ULONG CallStackOffset; // Offset of CallStack Pages
|
||
|
|
ULONG SizeOfCallStack; // Size in bytes of CallStack
|
||
|
|
ULONG DriverListOffset; // Offset of Driver List
|
||
|
|
ULONG DriverCount; // Number of Drivers in list
|
||
|
|
ULONG StringPoolOffset; // Offset to the string pool
|
||
|
|
ULONG StringPoolSize; // Size of the string pool
|
||
|
|
ULONG BrokenDriverOffset; // Offset into the driver of the driver that crashed
|
||
|
|
ULONG TriageOptions; // Triage options in effect at crashtime
|
||
|
|
ULONG TopOfStack; // The top (highest address) of the call stack
|
||
|
|
|
||
|
|
ULONG DataPageAddress;
|
||
|
|
ULONG DataPageOffset;
|
||
|
|
ULONG DataPageSize;
|
||
|
|
|
||
|
|
ULONG DebuggerDataOffset;
|
||
|
|
ULONG DebuggerDataSize;
|
||
|
|
|
||
|
|
ULONG DataBlocksOffset;
|
||
|
|
ULONG DataBlocksCount;
|
||
|
|
|
||
|
|
} TRIAGE_DUMP32, * PTRIAGE_DUMP32;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _MEMORY_DUMP32 {
|
||
|
|
DUMP_HEADER32 Header;
|
||
|
|
|
||
|
|
union {
|
||
|
|
FULL_DUMP32 Full; // DumpType == DUMP_TYPE_FULL
|
||
|
|
SUMMARY_DUMP32 Summary; // DumpType == DUMP_TYPE_SUMMARY
|
||
|
|
TRIAGE_DUMP32 Triage; // DumpType == DUMP_TYPE_TRIAGE
|
||
|
|
};
|
||
|
|
|
||
|
|
} MEMORY_DUMP32, *PMEMORY_DUMP32;
|
||
|
|
|
||
|
|
|
||
|
|
#include <poppack.h>
|
||
|
|
|
||
|
|
typedef struct _DUMP_HEADER64 {
|
||
|
|
ULONG Signature;
|
||
|
|
ULONG ValidDump;
|
||
|
|
ULONG MajorVersion;
|
||
|
|
ULONG MinorVersion;
|
||
|
|
ULONG64 DirectoryTableBase;
|
||
|
|
ULONG64 PfnDataBase;
|
||
|
|
ULONG64 PsLoadedModuleList;
|
||
|
|
ULONG64 PsActiveProcessHead;
|
||
|
|
ULONG MachineImageType;
|
||
|
|
ULONG NumberProcessors;
|
||
|
|
ULONG BugCheckCode;
|
||
|
|
ULONG64 BugCheckParameter1;
|
||
|
|
ULONG64 BugCheckParameter2;
|
||
|
|
ULONG64 BugCheckParameter3;
|
||
|
|
ULONG64 BugCheckParameter4;
|
||
|
|
CHAR VersionUser[32];
|
||
|
|
ULONG64 KdDebuggerDataBlock;
|
||
|
|
|
||
|
|
union {
|
||
|
|
PHYSICAL_MEMORY_DESCRIPTOR64 PhysicalMemoryBlock;
|
||
|
|
UCHAR PhysicalMemoryBlockBuffer [ DMP_PHYSICAL_MEMORY_BLOCK_SIZE_64 ];
|
||
|
|
};
|
||
|
|
UCHAR ContextRecord [ DMP_CONTEXT_RECORD_SIZE_64 ];
|
||
|
|
EXCEPTION_RECORD64 Exception;
|
||
|
|
ULONG DumpType;
|
||
|
|
LARGE_INTEGER RequiredDumpSpace;
|
||
|
|
LARGE_INTEGER SystemTime;
|
||
|
|
CHAR Comment [ DMP_HEADER_COMMENT_SIZE ]; // May not be present.
|
||
|
|
LARGE_INTEGER SystemUpTime;
|
||
|
|
ULONG MiniDumpFields;
|
||
|
|
ULONG SecondaryDataState;
|
||
|
|
ULONG ProductType;
|
||
|
|
ULONG SuiteMask;
|
||
|
|
ULONG WriterStatus;
|
||
|
|
UCHAR _reserved0[ DMP_RESERVED_0_SIZE_64 ];
|
||
|
|
} DUMP_HEADER64, *PDUMP_HEADER64;
|
||
|
|
|
||
|
|
typedef struct _FULL_DUMP64 {
|
||
|
|
CHAR Memory[1]; // Variable length to the end of the dump file.
|
||
|
|
} FULL_DUMP64, *PFULL_DUMP64;
|
||
|
|
|
||
|
|
//
|
||
|
|
// ISSUE - 2000/02/17 - math: NT64 Summary dump.
|
||
|
|
//
|
||
|
|
// This is broken. The 64 bit summary dump should have a ULONG64 for
|
||
|
|
// the BitmapSize to match the size of the PFN_NUMBER.
|
||
|
|
//
|
||
|
|
|
||
|
|
typedef struct _SUMMARY_DUMP64 {
|
||
|
|
ULONG Signature;
|
||
|
|
ULONG ValidDump;
|
||
|
|
ULONG DumpOptions; // Summary Dump Options
|
||
|
|
ULONG HeaderSize; // Offset to the start of actual memory dump
|
||
|
|
ULONG BitmapSize; // Total bitmap size (i.e., maximum #bits)
|
||
|
|
ULONG Pages; // Total bits set in bitmap (i.e., total pages in sdump)
|
||
|
|
|
||
|
|
//
|
||
|
|
// ISSUE - 2000/02/17 - math: Win64
|
||
|
|
//
|
||
|
|
// With a 64-bit PFN, we should not have a 32-bit bitmap.
|
||
|
|
//
|
||
|
|
|
||
|
|
//
|
||
|
|
// These next three fields essentially form an on-disk RTL_BITMAP structure.
|
||
|
|
// The RESERVED field is stupidness introduced by the way the data is
|
||
|
|
// serialized to disk.
|
||
|
|
//
|
||
|
|
|
||
|
|
struct {
|
||
|
|
ULONG SizeOfBitMap;
|
||
|
|
ULONG64 _reserved0;
|
||
|
|
ULONG Buffer[];
|
||
|
|
} Bitmap;
|
||
|
|
|
||
|
|
} SUMMARY_DUMP64, * PSUMMARY_DUMP64;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _TRIAGE_DUMP64 {
|
||
|
|
ULONG ServicePackBuild; // What service pack of NT was this ?
|
||
|
|
ULONG SizeOfDump; // Size in bytes of the dump
|
||
|
|
ULONG ValidOffset; // Offset valid ULONG
|
||
|
|
ULONG ContextOffset; // Offset of CONTEXT record
|
||
|
|
ULONG ExceptionOffset; // Offset of EXCEPTION record
|
||
|
|
ULONG MmOffset; // Offset of Mm information
|
||
|
|
ULONG UnloadedDriversOffset; // Offset of Unloaded Drivers
|
||
|
|
ULONG PrcbOffset; // Offset of KPRCB
|
||
|
|
ULONG ProcessOffset; // Offset of EPROCESS
|
||
|
|
ULONG ThreadOffset; // Offset of ETHREAD
|
||
|
|
ULONG CallStackOffset; // Offset of CallStack Pages
|
||
|
|
ULONG SizeOfCallStack; // Size in bytes of CallStack
|
||
|
|
ULONG DriverListOffset; // Offset of Driver List
|
||
|
|
ULONG DriverCount; // Number of Drivers in list
|
||
|
|
ULONG StringPoolOffset; // Offset to the string pool
|
||
|
|
ULONG StringPoolSize; // Size of the string pool
|
||
|
|
ULONG BrokenDriverOffset; // Offset into the driver of the driver that crashed
|
||
|
|
ULONG TriageOptions; // Triage options in effect at crashtime
|
||
|
|
ULONG64 TopOfStack; // The top (highest address) of the callstack
|
||
|
|
|
||
|
|
//
|
||
|
|
// Architecture Specific fields.
|
||
|
|
//
|
||
|
|
|
||
|
|
union {
|
||
|
|
|
||
|
|
//
|
||
|
|
// For IA64 we need to store the BStore as well.
|
||
|
|
//
|
||
|
|
|
||
|
|
struct {
|
||
|
|
ULONG BStoreOffset; // Offset of BStore region.
|
||
|
|
ULONG SizeOfBStore; // The size of the BStore region.
|
||
|
|
ULONG64 LimitOfBStore; // The limit (highest memory address)
|
||
|
|
} Ia64; // of the BStore region.
|
||
|
|
|
||
|
|
} ArchitectureSpecific;
|
||
|
|
|
||
|
|
ULONG64 DataPageAddress;
|
||
|
|
ULONG DataPageOffset;
|
||
|
|
ULONG DataPageSize;
|
||
|
|
|
||
|
|
ULONG DebuggerDataOffset;
|
||
|
|
ULONG DebuggerDataSize;
|
||
|
|
|
||
|
|
ULONG DataBlocksOffset;
|
||
|
|
ULONG DataBlocksCount;
|
||
|
|
|
||
|
|
} TRIAGE_DUMP64, * PTRIAGE_DUMP64;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _MEMORY_DUMP64 {
|
||
|
|
DUMP_HEADER64 Header;
|
||
|
|
|
||
|
|
union {
|
||
|
|
FULL_DUMP64 Full; // DumpType == DUMP_TYPE_FULL
|
||
|
|
SUMMARY_DUMP64 Summary; // DumpType == DUMP_TYPE_SUMMARY
|
||
|
|
TRIAGE_DUMP64 Triage; // DumpType == DUMP_TYPE_TRIAGE
|
||
|
|
};
|
||
|
|
|
||
|
|
} MEMORY_DUMP64, *PMEMORY_DUMP64;
|
||
|
|
|
||
|
|
|
||
|
|
typedef struct _TRIAGE_DATA_BLOCK {
|
||
|
|
ULONG64 Address;
|
||
|
|
ULONG Offset;
|
||
|
|
ULONG Size;
|
||
|
|
} TRIAGE_DATA_BLOCK, *PTRIAGE_DATA_BLOCK;
|
||
|
|
|
||
|
|
//
|
||
|
|
// In the triage dump ValidFields field what portions of the triage-dump have
|
||
|
|
// been turned on.
|
||
|
|
//
|
||
|
|
|
||
|
|
#define TRIAGE_DUMP_CONTEXT (0x0001)
|
||
|
|
#define TRIAGE_DUMP_EXCEPTION (0x0002)
|
||
|
|
#define TRIAGE_DUMP_PRCB (0x0004)
|
||
|
|
#define TRIAGE_DUMP_PROCESS (0x0008)
|
||
|
|
#define TRIAGE_DUMP_THREAD (0x0010)
|
||
|
|
#define TRIAGE_DUMP_STACK (0x0020)
|
||
|
|
#define TRIAGE_DUMP_DRIVER_LIST (0x0040)
|
||
|
|
#define TRIAGE_DUMP_BROKEN_DRIVER (0x0080)
|
||
|
|
#define TRIAGE_DUMP_BASIC_INFO (0x00FF)
|
||
|
|
#define TRIAGE_DUMP_MMINFO (0x0100)
|
||
|
|
#define TRIAGE_DUMP_DATAPAGE (0x0200)
|
||
|
|
#define TRIAGE_DUMP_DEBUGGER_DATA (0x0400)
|
||
|
|
#define TRIAGE_DUMP_DATA_BLOCKS (0x0800)
|
||
|
|
|
||
|
|
#define TRIAGE_OPTION_OVERFLOWED (0x0100)
|
||
|
|
|
||
|
|
#define TRIAGE_DUMP_VALID ( 'DGRT' )
|
||
|
|
#define TRIAGE_DUMP_SIZE32 ( 0x1000 * 16 )
|
||
|
|
#define TRIAGE_DUMP_SIZE64 ( 0x2000 * 16 )
|
||
|
|
|
||
|
|
#ifdef _NTLDRAPI_
|
||
|
|
|
||
|
|
typedef struct _DUMP_DRIVER_ENTRY32 {
|
||
|
|
ULONG DriverNameOffset;
|
||
|
|
KLDR_DATA_TABLE_ENTRY32 LdrEntry;
|
||
|
|
} DUMP_DRIVER_ENTRY32, * PDUMP_DRIVER_ENTRY32;
|
||
|
|
|
||
|
|
typedef struct _DUMP_DRIVER_ENTRY64 {
|
||
|
|
ULONG DriverNameOffset;
|
||
|
|
ULONG __alignment;
|
||
|
|
KLDR_DATA_TABLE_ENTRY64 LdrEntry;
|
||
|
|
} DUMP_DRIVER_ENTRY64, * PDUMP_DRIVER_ENTRY64;
|
||
|
|
|
||
|
|
#endif // _NTLDRAPI
|
||
|
|
|
||
|
|
//
|
||
|
|
// The DUMP_STRING is guaranteed to be both NULL terminated and length prefixed
|
||
|
|
// (prefix does not include the NULL).
|
||
|
|
//
|
||
|
|
|
||
|
|
typedef struct _DUMP_STRING {
|
||
|
|
ULONG Length; // Length IN BYTES of the string.
|
||
|
|
WCHAR Buffer [0]; // Buffer.
|
||
|
|
} DUMP_STRING, * PDUMP_STRING;
|
||
|
|
|
||
|
|
|
||
|
|
//
|
||
|
|
// Secondary dumps can be generated at bugcheck time after
|
||
|
|
// the primary dump has been generated. The data in these
|
||
|
|
// dumps is arbitrary and not interpretable, so the file
|
||
|
|
// format is just a sequence of tagged blobs.
|
||
|
|
//
|
||
|
|
// Each blob header is aligned on an eight-byte boundary
|
||
|
|
// and the data immediately follows it. Padding
|
||
|
|
// may precede and/or follow the data for alignment purposes.
|
||
|
|
//
|
||
|
|
// Blobs are streamed into the file so there is no overall count.
|
||
|
|
//
|
||
|
|
|
||
|
|
#define DUMP_BLOB_SIGNATURE1 'pmuD'
|
||
|
|
#define DUMP_BLOB_SIGNATURE2 'bolB'
|
||
|
|
|
||
|
|
typedef struct _DUMP_BLOB_FILE_HEADER {
|
||
|
|
ULONG Signature1;
|
||
|
|
ULONG Signature2;
|
||
|
|
ULONG HeaderSize;
|
||
|
|
ULONG BuildNumber;
|
||
|
|
} DUMP_BLOB_FILE_HEADER, *PDUMP_BLOB_FILE_HEADER;
|
||
|
|
|
||
|
|
typedef struct _DUMP_BLOB_HEADER {
|
||
|
|
ULONG HeaderSize;
|
||
|
|
GUID Tag;
|
||
|
|
ULONG DataSize;
|
||
|
|
ULONG PrePad;
|
||
|
|
ULONG PostPad;
|
||
|
|
} DUMP_BLOB_HEADER, *PDUMP_BLOB_HEADER;
|
||
|
|
|
||
|
|
#ifdef __cplusplus
|
||
|
|
}
|
||
|
|
#endif
|
||
|
|
|
||
|
|
//
|
||
|
|
// These defines should be used only by components
|
||
|
|
// that know the architecture of the dump matches
|
||
|
|
// the architecture of the machine they are on; i.e.,
|
||
|
|
// the kernel and savedump. In particular, the debugger
|
||
|
|
// should always explicitly use either the 32 or
|
||
|
|
// 64 bit versions of the headers.
|
||
|
|
//
|
||
|
|
|
||
|
|
#ifndef __NTSDP_HPP__
|
||
|
|
#if defined (_WIN64)
|
||
|
|
|
||
|
|
typedef DUMP_HEADER64 DUMP_HEADER;
|
||
|
|
typedef PDUMP_HEADER64 PDUMP_HEADER;
|
||
|
|
typedef MEMORY_DUMP64 MEMORY_DUMP;
|
||
|
|
typedef PMEMORY_DUMP64 PMEMORY_DUMP;
|
||
|
|
typedef SUMMARY_DUMP64 SUMMARY_DUMP;
|
||
|
|
typedef PSUMMARY_DUMP64 PSUMMARY_DUMP;
|
||
|
|
typedef TRIAGE_DUMP64 TRIAGE_DUMP;
|
||
|
|
typedef PTRIAGE_DUMP64 PTRIAGE_DUMP;
|
||
|
|
#ifdef _NTLDRAPI_
|
||
|
|
typedef DUMP_DRIVER_ENTRY64 DUMP_DRIVER_ENTRY;
|
||
|
|
typedef PDUMP_DRIVER_ENTRY64 PDUMP_DRIVER_ENTRY;
|
||
|
|
#endif
|
||
|
|
#define DUMP_SIGNATURE DUMP_SIGNATURE64
|
||
|
|
#define DUMP_VALID_DUMP DUMP_VALID_DUMP64
|
||
|
|
#define TRIAGE_DUMP_SIZE TRIAGE_DUMP_SIZE64
|
||
|
|
typedef PPHYSICAL_MEMORY_RUN64 PPHYSICAL_MEMORYRUN;
|
||
|
|
typedef PPHYSICAL_MEMORY_DESCRIPTOR64 PPHYSICAL_MEMORYDESCRIPTOR;
|
||
|
|
|
||
|
|
#else
|
||
|
|
|
||
|
|
typedef DUMP_HEADER32 DUMP_HEADER;
|
||
|
|
typedef PDUMP_HEADER32 PDUMP_HEADER;
|
||
|
|
typedef MEMORY_DUMP32 MEMORY_DUMP;
|
||
|
|
typedef PMEMORY_DUMP32 PMEMORY_DUMP;
|
||
|
|
typedef SUMMARY_DUMP32 SUMMARY_DUMP;
|
||
|
|
typedef PSUMMARY_DUMP32 PSUMMARY_DUMP;
|
||
|
|
typedef TRIAGE_DUMP32 TRIAGE_DUMP;
|
||
|
|
typedef PTRIAGE_DUMP32 PTRIAGE_DUMP;
|
||
|
|
#ifdef _NTLDRAPI_
|
||
|
|
typedef DUMP_DRIVER_ENTRY32 DUMP_DRIVER_ENTRY;
|
||
|
|
typedef PDUMP_DRIVER_ENTRY32 PDUMP_DRIVER_ENTRY;
|
||
|
|
#endif
|
||
|
|
#define DUMP_SIGNATURE DUMP_SIGNATURE32
|
||
|
|
#define DUMP_VALID_DUMP DUMP_VALID_DUMP32
|
||
|
|
#define TRIAGE_DUMP_SIZE TRIAGE_DUMP_SIZE32
|
||
|
|
typedef PPHYSICAL_MEMORY_RUN32 PPHYSICAL_MEMORYRUN;
|
||
|
|
typedef PPHYSICAL_MEMORY_DESCRIPTOR32 PPHYSICAL_MEMORYDESCRIPTOR;
|
||
|
|
|
||
|
|
#endif
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#ifndef MIDL_PASS
|
||
|
|
#if _MSC_VER >= 1200
|
||
|
|
#pragma warning(pop)
|
||
|
|
#else
|
||
|
|
#pragma warning( default : 4200 ) // nonstandard extension used : zero-sized array in struct/union
|
||
|
|
#endif
|
||
|
|
#endif // MIDL_PASS
|
||
|
|
|
||
|
|
#endif // _NTIODUMP_
|