1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
|
//
// Pointers to WINDBG api
//
extern PNTSD_OUTPUT_ROUTINE Print;
extern PNTSD_GET_EXPRESSION GetExpression;
extern PNTSD_GET_SYMBOL GetSymbol;
//extern PNTSD_DISASM Disassemble;
extern PNTSD_CHECK_CONTROL_C CheckCtrlC;
extern PWINDBG_READ_PROCESS_MEMORY_ROUTINE ReadProcessMemWinDbg;
extern PWINDBG_WRITE_PROCESS_MEMORY_ROUTINE WriteProcessMemWinDbg;
extern PWINDBG_GET_THREAD_CONTEXT_ROUTINE GetThreadContextWinDbg;
extern PWINDBG_SET_THREAD_CONTEXT_ROUTINE SetThreadContextWinDbg;
extern fWinDbg;
extern HANDLE hCurrentProcess;
extern HANDLE hCurrentThread;
extern LPSTR lpArgumentString;
#define PRINTF (* Print)
#define EXPRESSION (* GetExpression)
#define ReadDword(x) read_dword((ULONG)x, FALSE)
#define ReadWord(x) read_word ((ULONG)x, FALSE)
#define ReadByte(x) read_byte ((ULONG)x, FALSE)
#define ReadDwordSafe(x) read_dword((ULONG)x, TRUE)
#define ReadWordSafe(x) read_word ((ULONG)x, TRUE)
#define ReadByteSafe(x) read_byte ((ULONG)x, TRUE)
#define ReadGNode(x,p) read_gnode((ULONG)x,p,FALSE)
#define ReadGNode32(x,p) read_gnode32((ULONG)x,p,FALSE)
#define BEFORE 0
#define AFTER 1
#define RPL_MASK 0x78
#define V86_BITS 0x20000
#define SELECTOR_LDT 0x04
#define SELECTOR_RPL 0x03
#define V86_MODE 0
#define PROT_MODE 1
#define FLAT_MODE 2
#define CALL_NEAR_RELATIVE 0xE8
#define CALL_NEAR_INDIRECT 0xFF
#define INDIRECT_NEAR_TYPE 0x02
#define CALL_FAR_ABSOLUTE 0x9A
#define CALL_FAR_INDIRECT 0xFF
#define INDIRECT_FAR_TYPE 0x03
#define PUSH_CS 0x0E
#define ADD_SP 0xC483
#define TYPE_BITS 0x38
#define TYPE0 0x00
#define TYPE1 0x08
#define TYPE2 0x10
#define TYPE3 0x18
#define TYPE4 0x20
#define TYPE5 0x28
#define TYPE6 0x30
#define TYPE7 0x38
#define MOD_BITS 0xC0
#define MOD0 0x00
#define MOD1 0x40
#define MOD2 0x80
#define MOD3 0xC0
#define RM_BITS 0x07
#define RM0 0x00
#define RM1 0x01
#define RM2 0x02
#define RM3 0x03
#define RM4 0x04
#define RM5 0x05
#define RM6 0x06
#define RM7 0x07
#define FLAG_OVERFLOW 0x0800
#define FLAG_DIRECTION 0x0400
#define FLAG_INTERRUPT 0x0200
#define FLAG_SIGN 0x0080
#define FLAG_ZERO 0x0040
#define FLAG_AUXILLIARY 0x0010
#define FLAG_PARITY 0x0004
#define FLAG_CARRY 0x0001
#define SEGTYPE_AVAILABLE 0
#define SEGTYPE_V86 1
#define SEGTYPE_PROT 2
#define MAXSEGENTRY 1024
#define WOW16 0
#define GA_ENDSIG ((BYTE)0x5a)
typedef struct _SELECTORINFO {
DWORD Base;
DWORD Limit;
BOOL bCode;
BOOL bSystem;
BOOL bPresent;
BOOL bWrite;
BOOL bAccessed;
BOOL bBig;
} SELECTORINFO;
typedef struct _segentry {
int type;
LPSTR path_name;
WORD selector;
WORD segment;
DWORD ImgLen;
} SEGENTRY;
#pragma pack(1)
typedef struct _GNODE { // GlobalArena
BYTE ga_count ; // lock count for movable segments
WORD ga_owner ; // DOS 2.x 3.x owner field (current task)
WORD ga_size ; // DOS 2.x 3.x size, in paragraphs, not incl. header
BYTE ga_flags ; // 1 byte available for flags
WORD ga_prev ; // previous arena entry (first points to self)
WORD ga_next ; // next arena entry (last points to self)
WORD ga_handle ; // back link to handle table entry
WORD ga_lruprev ; // Previous handle in lru chain
WORD ga_lrunext ; // Next handle in lru chain
} GNODE;
typedef GNODE UNALIGNED *PGNODE;
typedef struct _GNODE32 { // GlobalArena
DWORD pga_next ; // next arena entry (last points to self)
DWORD pga_prev ; // previous arena entry (first points to self)
DWORD pga_address ; // 32 bit linear address of memory
DWORD pga_size ; // 32 bit size in bytes
WORD pga_handle ; // back link to handle table entry
WORD pga_owner ; // Owner field (current task)
BYTE pga_count ; // lock count for movable segments
BYTE pga_pglock ; // # times page locked
BYTE pga_flags ; // 1 word available for flags
BYTE pga_selcount ; // Number of selectors allocated
DWORD pga_lruprev ; // Previous entry in lru chain
DWORD pga_lrunext ; // Next entry in lru chain
} GNODE32;
typedef GNODE32 UNALIGNED *PGNODE32;
typedef struct _GHI {
WORD hi_check ; // arena check word (non-zero enables heap checking)
WORD hi_freeze ; // arena frozen word (non-zero prevents compaction)
WORD hi_count ; // #entries in arena
WORD hi_first ; // first arena entry (sentinel, always busy)
WORD hi_last ; // last arena entry (sentinel, always busy)
BYTE hi_ncompact ; // #compactions done so far (max of 3)
BYTE ghi_dislevel; // current discard level
WORD hi_distotal ; // total amount discarded so far
WORD hi_htable ; // head of handle table list
WORD hi_hfree ; // head of free handle table list
WORD hi_hdelta ; // #handles to allocate each time
WORD hi_hexpand ; // address of near procedure to expand handles for
// this arena
} GHI;
typedef GHI UNALIGNED *PGHI;
typedef struct _GHI32 {
WORD hi_check ; // arena check word (non-zero enables heap checking)
WORD hi_freeze ; // arena frozen word (non-zero prevents compaction)
WORD hi_count ; // #entries in arena
WORD hi_first ; // first arena entry (sentinel, always busy)
WORD hi_res1 ; // reserved
WORD hi_last ; // last arena entry (sentinel, always busy)
WORD hi_res2 ; // reserved
BYTE hi_ncompact ; // #compactions done so far (max of 3)
BYTE hi_dislevel ; // current discard level
DWORD hi_distotal ; // total amount discarded so far
WORD hi_htable ; // head of handle table list
WORD hi_hfree ; // head of free handle table list
WORD hi_hdelta ; // #handles to allocate each time
WORD hi_hexpand ; // address of near procedure to expand handles for this arena
WORD hi_pstats ; // address of statistics table or zero
} GHI32;
typedef GHI32 UNALIGNED *PGHI32;
typedef struct _HEAPENTRY {
GNODE32 gnode;
DWORD CurrentEntry;
DWORD NextEntry;
WORD Selector;
int SegmentNumber;
char OwnerName[9];
char FileName[9];
} HEAPENTRY;
typedef struct _NEHEADER {
WORD ne_magic ;
BYTE ne_ver ;
BYTE ne_rev ;
WORD ne_enttab ;
WORD ne_cbenttab ;
DWORD ne_crc ;
WORD ne_flags ;
WORD ne_autodata ;
WORD ne_heap ;
WORD ne_stack ;
DWORD ne_csip ;
DWORD ne_sssp ;
WORD ne_cseg ;
WORD ne_cmod ;
WORD ne_cbnrestab ;
WORD ne_segtab ;
WORD ne_rsrctab ;
WORD ne_restab ;
WORD ne_modtab ;
WORD ne_imptab ;
DWORD ne_nrestab ;
WORD ne_cmovent ;
WORD ne_align ;
WORD ne_cres ;
BYTE ne_exetyp ;
BYTE ne_flagsothers ;
WORD ne_pretthunks ;
WORD ne_psegrefbytes;
WORD ne_swaparea ;
WORD ne_expver ;
} NEHEADER;
typedef NEHEADER UNALIGNED *PNEHEADER;
#pragma pack()
#ifndef i386
//
// Structures in 486 cpu for obtaining registers (FROM NT_CPU.C)
//
typedef struct NT_CPU_REG {
ULONG *nano_reg; /* where the nano CPU keeps the register */
ULONG *reg; /* where the light compiler keeps the reg */
ULONG *saved_reg; /* where currently unused bits are kept */
ULONG universe_8bit_mask;/* is register in 8-bit form? */
ULONG universe_16bit_mask;/* is register in 16-bit form? */
} NT_CPU_REG;
typedef struct NT_CPU_INFO {
/* Variables for deciding what mode we're in */
BOOL *in_nano_cpu; /* is the Nano CPU executing? */
ULONG *universe; /* the mode that the CPU is in */
/* General purpose register pointers */
NT_CPU_REG eax, ebx, ecx, edx, esi, edi, ebp;
/* Variables for getting SP or ESP. */
BOOL *stack_is_big; /* is the stack 32-bit? */
ULONG *nano_esp; /* where the Nano CPU keeps ESP */
UCHAR **host_sp; /* ptr to variable holding stack pointer as a
host address */
UCHAR **ss_base; /* ptr to variables holding base of SS as a
host address */
ULONG *esp_sanctuary; /* top 16 bits of ESP if we're now using SP */
ULONG *eip;
/* Segment registers. */
USHORT *cs, *ds, *es, *fs, *gs, *ss;
ULONG *flags;
/* CR0, mainly to let us figure out if we're in real or protect mode */
ULONG *cr0;
} NT_CPU_INFO;
#endif // i386
BOOL
WINAPI
ReadProcessMem(
HANDLE hProcess,
LPVOID lpBaseAddress,
LPVOID lpBuffer,
DWORD nSize,
LPDWORD lpNumberOfBytesRead
);
BOOL
WINAPI
WriteProcessMem(
HANDLE hProcess,
LPVOID lpBaseAddress,
LPVOID lpBuffer,
DWORD nSize,
LPDWORD lpNumberOfBytesWritten
);
BOOL
CheckGlobalHeap(
VOID
);
int GetContext(
VDMCONTEXT* lpContext
);
ULONG GetInfoFromSelector(
WORD selector,
int mode,
SELECTORINFO *si
);
BOOL
FindHeapEntry(
HEAPENTRY *he,
BOOL bFindAny
);
BOOL FindSymbol(
WORD selector,
LONG offset,
LPSTR sym_text,
LONG *dist,
int direction,
int mode
);
ULONG GetIntelBase(
VOID
);
DWORD read_dword(
ULONG lpAddress,
BOOL bSafe
);
WORD read_word(
ULONG lpAddress,
BOOL bSafe
);
BYTE read_byte(
ULONG lpAddress,
BOOL bSafe
);
BOOL read_gnode(
ULONG lpAddress,
PGNODE p,
BOOL bSafe
);
BOOL read_gnode32(
ULONG lpAddress,
PGNODE32 p,
BOOL bSafe
);
BOOL GetNextToken(
VOID
);
BOOL ParseIntelAddress(
int *pMode,
WORD *pSelector,
PULONG pOffset
);
VOID DumpRegs (VOID);
VOID DumpMemory (UINT);
VOID DumpGHeap (VOID);
VOID DumpDescriptor (VOID);
VOID EvaluateSymbol (VOID);
VOID ListModules (VOID);
VOID ListNear (VOID);
VOID TaskInfo (VOID);
VOID WalkStack (VOID);
VOID WalkStackVerbose (VOID);
VOID Unassemble (VOID);
|