diff options
Diffstat (limited to 'private/mvdm/bde/bdeutil.c')
| -rw-r--r-- | private/mvdm/bde/bdeutil.c | 614 |
1 files changed, 614 insertions, 0 deletions
diff --git a/private/mvdm/bde/bdeutil.c b/private/mvdm/bde/bdeutil.c new file mode 100644 index 000000000..141358b37 --- /dev/null +++ b/private/mvdm/bde/bdeutil.c @@ -0,0 +1,614 @@ +#include <precomp.h> +#pragma hdrstop + +BOOL +WINAPI +ReadProcessMem( + HANDLE hProcess, + LPVOID lpBaseAddress, + LPVOID lpBuffer, + DWORD nSize, + LPDWORD lpNumberOfBytesRead + ) +{ + if ( fWinDbg ) { + return (*ReadProcessMemWinDbg)( (DWORD)lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead ); + } else { + return ReadProcessMemory( hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead ); + } +} + +BOOL +WINAPI +WriteProcessMem( + HANDLE hProcess, + LPVOID lpBaseAddress, + LPVOID lpBuffer, + DWORD nSize, + LPDWORD lpNumberOfBytesWritten + ) +{ + if ( fWinDbg ) { + return (*WriteProcessMemWinDbg)( (DWORD)lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten ); + } else { + return WriteProcessMemory( hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten ); + } + +} + +#ifndef i386 + +ULONG +GetRegValue( + NT_CPU_REG reg, + BOOL bInNano, + ULONG UMask + ) + +{ + if (bInNano) { + + return(ReadDword(reg.nano_reg)); + + } else if (UMask & reg.universe_8bit_mask) { + + return (ReadDword(reg.saved_reg) & 0xFFFFFF00 | + ReadDword(reg.reg) & 0xFF); + + } else if (UMask & reg.universe_16bit_mask) { + + return (ReadDword(reg.saved_reg) & 0xFFFF0000 | + ReadDword(reg.reg) & 0xFFFF); + + } else { + + return (ReadDword(reg.reg)); + + } +} + +ULONG +GetEspValue( + NT_CPU_INFO nt_cpu_info, + BOOL bInNano + ) + +{ + if (bInNano) { + + return (ReadDword(nt_cpu_info.nano_esp)); + + } else { + + if (ReadDword(nt_cpu_info.stack_is_big)) { + + return (ReadDword(nt_cpu_info.host_sp) - + ReadDword(nt_cpu_info.ss_base)); + + } else { + + return (ReadDword(nt_cpu_info.esp_sanctuary) & 0xFFFF0000 | + (ReadDword(nt_cpu_info.host_sp) - + ReadDword(nt_cpu_info.ss_base) & 0xFFFF)); + + } + + } + +} + +#endif + +int +GetContext( + VDMCONTEXT* lpContext +) { +#ifndef i386 // + int mode; + ULONG pTmp; + NT_CPU_INFO nt_cpu_info; + BOOL b; + BOOL bInNano; + ULONG UMask; + + pTmp = (ULONG)EXPRESSION("ntvdm!nt_cpu_info"); + + if ( pTmp ) { + b = ReadProcessMem( hCurrentProcess, + (LPVOID) pTmp, + (LPVOID) &nt_cpu_info, + sizeof(NT_CPU_INFO), + NULL ); + if ( !b ) { + PRINTF("Could not read IntelRegisters context out of process\n"); + return( -1 ); + } + + bInNano = ReadDword((ULONG) nt_cpu_info.in_nano_cpu); + UMask = ReadDword((ULONG) nt_cpu_info.universe); + + lpContext->Eax = GetRegValue(nt_cpu_info.eax, bInNano, UMask); + lpContext->Ecx = GetRegValue(nt_cpu_info.ecx, bInNano, UMask); + lpContext->Edx = GetRegValue(nt_cpu_info.edx, bInNano, UMask); + lpContext->Ebx = GetRegValue(nt_cpu_info.ebx, bInNano, UMask); + lpContext->Ebp = GetRegValue(nt_cpu_info.ebp, bInNano, UMask); + lpContext->Esi = GetRegValue(nt_cpu_info.esi, bInNano, UMask); + lpContext->Edi = GetRegValue(nt_cpu_info.edi, bInNano, UMask); + + lpContext->Esp = GetEspValue(nt_cpu_info, bInNano); + lpContext->EFlags = ReadDword(nt_cpu_info.flags); + lpContext->Eip = ReadDword(nt_cpu_info.eip); + + lpContext->SegEs = ReadWord(nt_cpu_info.es); + lpContext->SegCs = ReadWord(nt_cpu_info.cs); + lpContext->SegSs = ReadWord(nt_cpu_info.ss); + lpContext->SegDs = ReadWord(nt_cpu_info.ds); + lpContext->SegFs = ReadWord(nt_cpu_info.fs); + lpContext->SegGs = ReadWord(nt_cpu_info.gs); + + + } else { + + PRINTF("Could not find the symbol 'ntvdm!nt_cpu_info'\n"); + return( -1 ); + } + + if ( !(ReadDword(nt_cpu_info.cr0) & 1) ) { + mode = V86_MODE; + } else { + mode = PROT_MODE; + } + return( mode ); + +#else // + + NTSTATUS rc; + BOOL b; + ULONG EFlags; + WORD cs; + int mode; + ULONG lpVdmTib; + + lpContext->ContextFlags = CONTEXT_FULL; + rc = NtGetContextThread( hCurrentThread, + lpContext ); + if ( NT_ERROR(rc) ) { + PRINTF( "bde.k: Could not get current threads context - status = %08lX\n", rc ); + return( -1 ); + } + /* + ** Get the 16-bit registers from the context + */ + cs = (WORD)lpContext->SegCs; + EFlags = lpContext->EFlags; + + if ( EFlags & V86_BITS ) { + /* + ** V86 Mode + */ + mode = V86_MODE; + } else { + if ( (cs & RPL_MASK) != KGDT_R3_CODE ) { + mode = PROT_MODE; + } else { + /* + ** We are in flat 32-bit address space! + */ + lpVdmTib = (ULONG)EXPRESSION("ntvdm!VdmTib"); + if ( !lpVdmTib ) { + PRINTF("Could not find the symbol 'VdmTib'\n"); + return( -1 ); + } + b = ReadProcessMem( hCurrentProcess, + (LPVOID) (lpVdmTib + + FIELD_OFFSET(VDM_TIB,VdmContext)), + lpContext, + sizeof(VDMCONTEXT), + NULL ); + if ( !b ) { + PRINTF("Could not read IntelRegisters context out of process\n"); + return( -1 ); + } + EFlags = lpContext->EFlags; + if ( EFlags & V86_BITS ) { + mode = V86_MODE; + } else { + mode = PROT_MODE; + } + } + } + + return( mode ); +#endif +} + +ULONG +GetIntelBase( + VOID + ) +{ +#ifndef i386 + ULONG IntelBase; + BOOL b; + + IntelBase = (ULONG)EXPRESSION("ntvdm!Start_of_M_area"); + if ( IntelBase ) { + b = ReadProcessMem( hCurrentProcess, + (LPVOID) IntelBase, &IntelBase, + sizeof(ULONG), NULL ); + if ( !b ) { + PRINTF("Could not read symbol 'ntvdm!Start_of_M_area\n"); + return(0); + } + + } else { + PRINTF("Could not find the symbol 'ntvdm!Start_of_M_area'\n"); + } + + return(IntelBase); +#else + return(0); +#endif +} + +DWORD read_dword( + ULONG lpAddress, + BOOL bSafe +) { + BOOL b; + DWORD dword; + + b = ReadProcessMem( + hCurrentProcess, + (LPVOID)lpAddress, + &dword, + sizeof(dword), + NULL + ); + if ( !b ) { + if ( !bSafe ) { + PRINTF("Failure reading dword at memory location %08lX\n", lpAddress ); + } + return( 0 ); + } + return( dword ); +} + +WORD read_word( + ULONG lpAddress, + BOOL bSafe +) { + BOOL b; + WORD word; + + b = ReadProcessMem( + hCurrentProcess, + (LPVOID)lpAddress, + &word, + sizeof(word), + NULL + ); + if ( !b ) { + if ( !bSafe ) { + PRINTF("Failure reading word at memory location %08lX\n", lpAddress ); + } + return( 0 ); + } + return( word ); +} + +BYTE read_byte( + ULONG lpAddress, + BOOL bSafe +) { + BOOL b; + BYTE byte; + + b = ReadProcessMem( + hCurrentProcess, + (LPVOID)lpAddress, + &byte, + sizeof(byte), + NULL + ); + if ( !b ) { + if ( !bSafe ) { + PRINTF("Failure reading byte at memory location %08lX\n", lpAddress ); + } + return( 0 ); + } + return( byte ); +} + +BOOL read_gnode( + ULONG lpAddress, + PGNODE p, + BOOL bSafe +) { + BOOL b; + + b = ReadProcessMem( + hCurrentProcess, + (LPVOID)lpAddress, + p, + sizeof(*p), + NULL + ); + if ( !b ) { + if ( !bSafe ) { + PRINTF("Failure reading word at memory location %08lX\n", lpAddress ); + } + return( 0 ); + } + return( TRUE ); +} + +BOOL read_gnode32( + ULONG lpAddress, + PGNODE32 p, + BOOL bSafe +) { + BOOL b; + + b = ReadProcessMem( + hCurrentProcess, + (LPVOID)lpAddress, + p, + sizeof(*p), + NULL + ); + if ( !b ) { + if ( !bSafe ) { + PRINTF("Failure reading word at memory location %08lX\n", lpAddress ); + } + return( 0 ); + } + return( TRUE ); +} + + +BOOL GetDescriptorData( + WORD selector, + LPVDMLDT_ENTRY pdte + ) +{ +#ifdef i386 + NTSTATUS rc; + DESCRIPTOR_TABLE_ENTRY dte; + dte.Selector = selector; + rc = NtQueryInformationThread( hCurrentThread, + ThreadDescriptorTableEntry, + &dte, + sizeof(DESCRIPTOR_TABLE_ENTRY), + NULL ); + if ( NT_ERROR(rc) ) { + return( FALSE ); + } + pdte->HighWord = dte.Descriptor.HighWord; + pdte->BaseLow = dte.Descriptor.BaseLow; + pdte->LimitLow = dte.Descriptor.LimitLow; + return (TRUE); +#else + PVOID LdtAddress; + NTSTATUS Status; + ULONG BytesRead; + selector &= ~(SELECTOR_LDT | SELECTOR_RPL); + + // + // Get address of Ldt + // + + LdtAddress = (PVOID)EXPRESSION("ntvdm!Ldt"); + + Status = ReadProcessMem( + hCurrentProcess, + LdtAddress, + &LdtAddress, + sizeof(ULONG), + &BytesRead + ); + + if ((!Status) || (BytesRead != sizeof(ULONG))) { + return FALSE; + } + + (PUCHAR)LdtAddress += selector; + + Status = ReadProcessMem( + hCurrentProcess, + LdtAddress, + pdte, + sizeof(VDMLDT_ENTRY), + &BytesRead + ); + return TRUE; +#endif +} + +ULONG GetInfoFromSelector( + WORD selector, + int mode, + SELECTORINFO *si +) { + + ULONG base; + ULONG type; +#ifdef i386 + BYTE byte; + BOOL b; +#endif + VDMLDT_ENTRY dte; + + switch( mode ) { + case V86_MODE: + base = (ULONG)selector << 4; + if ( si ) { + si->Limit = 0xFFFFL; + si->bCode = FALSE; + } + break; + case PROT_MODE: + +#ifdef i386 + if ( (selector & 0xFF78) < KGDT_LDT ) { + return( (ULONG)-1 ); + } +#endif + + if ( !GetDescriptorData(selector, &dte) ) { + return( (ULONG)-1 ); + } + + base = ((ULONG)dte.HighWord.Bytes.BaseHi << 24) + + ((ULONG)dte.HighWord.Bytes.BaseMid << 16) + + ((ULONG)dte.BaseLow); + + if ( si ) { + si->Limit = (ULONG)dte.LimitLow + + ((ULONG)dte.HighWord.Bits.LimitHi << 16); + + if ( dte.HighWord.Bits.Granularity ) { + si->Limit <<= 12; + si->Limit += 0xFFF; + } + si->Base = base; + + type = dte.HighWord.Bits.Type; + + si->bSystem = !(BOOL) (type & 0x10); + + if (!si->bSystem) { + si->bCode = (BOOL) (type & 8); + } + si->bAccessed = (BOOL) (type & 1); + si->bWrite = (BOOL) (type & 2); + if (si->bCode) { + si->bWrite = !si->bWrite; + + } + si->bPresent = (BOOL) dte.HighWord.Bits.Pres; + si->bBig = (BOOL) dte.HighWord.Bits.Default_Big; + + } + + if ( base == 0 ) { + return( (ULONG)-1 ); + } + +#ifdef i386 + b = ReadProcessMem( + hCurrentProcess, + (LPVOID)base, + &byte, + sizeof(byte), + NULL + ); + if ( !b ) { + return( (ULONG)-1 ); + } +#endif + break; + + case FLAT_MODE: + PRINTF("Unsupported determination of base address in flat mode\n"); + base = 0; + break; + } + + return( base ); +} + + +//**************************************************************************** +// +// Command line parsing routines +// +//**************************************************************************** +BOOL +SkipToNextWhiteSpace( + VOID + ) +{ + char ch; + while ( (ch = *lpArgumentString) != '\0' ) { + if ( ch == ' ' || ch == '\t' || ch == '\r' || ch == '\n' ) { + return TRUE; + } + lpArgumentString++; + } + return FALSE; +} + + +BOOL +GetNextToken( + VOID + ) +{ + char ch; + + while ( (ch = *lpArgumentString) != '\0' ) { + if ( ch != ' ' && ch != '\t' && ch != '\r' && ch != '\n' ) { + return TRUE; + } + lpArgumentString++; + } + return FALSE; +} + + +BOOL +ParseIntelAddress( + int *pMode, + WORD *pSelector, + PULONG pOffset + ) + +{ + char sel_text[128], off_text[128]; + char *colon; + char *mode_prefix; + + colon = strchr( lpArgumentString, ':' ); + if ( colon == NULL ) { + PRINTF("Please specify an address in the form 'seg:offset'\n"); + return FALSE; + } + + mode_prefix = strchr( lpArgumentString, '&' ); + if ( mode_prefix == NULL ) { + + mode_prefix = strchr( lpArgumentString, '#' ); + if ( mode_prefix != NULL ) { + + if ( mode_prefix != lpArgumentString ) { + PRINTF("Address must have '&' symbol as the first character\n"); + return FALSE; + } + + *pMode = PROT_MODE; + lpArgumentString = mode_prefix+1; + } + + } else { + + if ( mode_prefix != lpArgumentString ) { + PRINTF("Address must have '#' symbol as the first character\n"); + return FALSE; + } + *pMode = V86_MODE; + lpArgumentString = mode_prefix+1; + + } + + *colon = '\0'; + strcpy( sel_text, lpArgumentString ); + *colon = ':'; + strcpy( off_text, colon+1 ); + *pSelector = (WORD) EXPRESSION( sel_text ); + *pOffset = (ULONG) EXPRESSION( off_text ); + + SkipToNextWhiteSpace(); + + return TRUE; +} |