63 ASSERTMSG(
"ExpDebuggerWorker being entered in non-initialized state!\n",
87 if (ProcessToAttach || ProcessToKill)
100 else if (
Process == ProcessToKill)
112 "EX debug work: Unable to find process %p\n",
113 ProcessToAttach ? ProcessToAttach : ProcessToKill);
130 "EX page in: Failed to page-in address 0x%p, Status 0x%08lx\n",
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG ReturnLength
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
#define DPFLTR_ERROR_LEVEL
#define STATUS_NOT_IMPLEMENTED
NTSTATUS NTAPI NtSystemDebugControl(_In_ SYSDBG_COMMAND Command, _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG ReturnLength)
Perform various queries to the kernel debugger.
PEPROCESS ExpDebuggerProcessAttach
PEPROCESS ExpDebuggerProcessKill
WINKD_WORKER_STATE ExpDebuggerWork
VOID NTAPI ExpDebuggerWorker(_In_ PVOID Context)
ULONG_PTR ExpDebuggerPageIn
WORK_QUEUE_ITEM ExpDebuggerWorkItem
enum _WINKD_WORKER_STATE WINKD_WORKER_STATE
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
#define EXCEPTION_EXECUTE_HANDLER
BOOLEAN KdIgnoreUmExceptions
BOOLEAN KdAutoEnableOnEvent
NTSTATUS NTAPI KdChangeOption(IN KD_OPTION Option, IN ULONG InBufferBytes OPTIONAL, IN PVOID InBuffer, IN ULONG OutBufferBytes OPTIONAL, OUT PVOID OutBuffer, OUT PULONG OutBufferNeeded OPTIONAL)
NTSTATUS NTAPI KdSystemDebugControl(_In_ SYSDBG_COMMAND Command, _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG ReturnLength, _In_ KPROCESSOR_MODE PreviousMode)
Perform various queries to the kernel debugger.
NTSTATUS NTAPI KdDisableDebugger(VOID)
NTSTATUS NTAPI KdEnableDebugger(VOID)
BOOLEAN KdDebuggerEnabled
#define DbgPrintEx(cmpid, lvl, fmt,...)
#define KeGetPreviousMode()
#define DBG_STATUS_WORKER
@ SysDbgQuerySpecialCalls
@ SysDbgGetPrintBufferSize
@ SysDbgQueryTraceInformation
@ SysDbgClearSpecialCalls
@ SysDbgWriteControlSpace
@ SysDbgEnableKernelDebugger
@ SysDbgGetKdUmExceptionEnable
@ SysDbgSetKdUmExceptionEnable
@ SysDbgSetPrintBufferSize
@ SysDbgQueryModuleInformation
@ SysDbgDisableKernelDebugger
#define DBG_STATUS_DEBUG_CONTROL
enum _SYSDBG_COMMAND SYSDBG_COMMAND
#define _In_reads_bytes_(s)
#define _Out_writes_bytes_(s)
#define ASSERTMSG(msg, exp)
#define UNREFERENCED_PARAMETER(P)
_In_ ULONG _In_ ULONG _In_ ULONG Length
_Out_ PKAPC_STATE ApcState
const LUID SeDebugPrivilege
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
#define DBG_TERMINATE_PROCESS
#define STATUS_INVALID_INFO_CLASS
VOID NTAPI KeStackAttachProcess(IN PKPROCESS Process, OUT PRKAPC_STATE ApcState)
VOID NTAPI KeUnstackDetachProcess(IN PRKAPC_STATE ApcState)
NTSTATUS NTAPI PsTerminateProcess(IN PEPROCESS Process, IN NTSTATUS ExitStatus)
PEPROCESS NTAPI PsGetNextProcess(IN PEPROCESS OldProcess OPTIONAL)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
#define ProbeForReadUchar(Ptr)
#define ProbeForWriteUlong(Ptr)
#define STATUS_ACCESS_DENIED
#define STATUS_UNSUCCESSFUL
#define STATUS_INFO_LENGTH_MISMATCH
__analysis_noreturn NTSYSAPI VOID NTAPI DbgBreakPointWithStatus(_In_ ULONG Status)
_In_ WDFREQUEST _In_ size_t OutputBufferLength
_In_ WDFREQUEST _In_ size_t _In_ size_t InputBufferLength
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR OutputBuffer
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR InputBuffer
@ KD_OPTION_SET_BLOCK_ENABLE
#define ObDereferenceObject