kdb.c File Reference

#include <ntoskrnl.h>
#include "kdb.h"

Include dependency graph for kdb.c:

Go to the source code of this file.

Macros
#define	KDB_STACK_SIZE   (4096*3)
#define	KDB_STACK_ALIGN   4
#define	KDB_STACK_RESERVE   sizeof(ULONG) /* Return address */
#define	KDB_MAXIMUM_BREAKPOINT_COUNT   256
#define	KDB_MAXIMUM_HW_BREAKPOINT_COUNT   4
#define	KDB_MAXIMUM_SW_BREAKPOINT_COUNT   256
#define	__STRING(x)   #x
#define	_STRING(x)   __STRING(x)
#define	CONST_STR_LEN(x)   (sizeof(x)/sizeof(x[0]) - 1)

Functions
static	DECLSPEC_ALIGN (KDB_STACK_ALIGN)
static VOID	KdbpKdbTrapFrameFromKernelStack (PVOID KernelStack, PKDB_KTRAP_FRAME KdbTrapFrame)
static NTSTATUS	KdbpOverwriteInstruction (IN PEPROCESS Process, IN ULONG_PTR Address, IN UCHAR NewInst, OUT PUCHAR OldInst OPTIONAL)
	Overwrites the instruction at Address with NewInst and stores the old instruction in *OldInst.
BOOLEAN	KdbpShouldStepOverInstruction (ULONG_PTR Eip)
	Checks whether the given instruction can be single stepped or has to be stepped over using a temporary breakpoint.
BOOLEAN	KdbpStepOverInstruction (ULONG_PTR Eip)
	Steps over an instruction.
BOOLEAN	KdbpStepIntoInstruction (ULONG_PTR Eip)
	Steps into an instruction (interrupts)
LONG	KdbpGetNextBreakPointNr (IN ULONG Start OPTIONAL)
	Gets the number of the next breakpoint >= Start.
BOOLEAN	KdbpGetBreakPointInfo (IN ULONG BreakPointNr, OUT ULONG_PTR *Address OPTIONAL, OUT KDB_BREAKPOINT_TYPE *Type OPTIONAL, OUT UCHAR *Size OPTIONAL, OUT KDB_ACCESS_TYPE *AccessType OPTIONAL, OUT UCHAR *DebugReg OPTIONAL, OUT BOOLEAN *Enabled OPTIONAL, OUT BOOLEAN *Global OPTIONAL, OUT PEPROCESS *Process OPTIONAL, OUT PCHAR *ConditionExpression OPTIONAL)
	Returns information of the specified breakpoint.
NTSTATUS	KdbpInsertBreakPoint (IN ULONG_PTR Address, IN KDB_BREAKPOINT_TYPE Type, IN UCHAR Size OPTIONAL, IN KDB_ACCESS_TYPE AccessType OPTIONAL, IN PCHAR ConditionExpression OPTIONAL, IN BOOLEAN Global, OUT PLONG BreakPointNr OPTIONAL)
	Inserts a breakpoint into the breakpoint array.
BOOLEAN	KdbpDeleteBreakPoint (IN LONG BreakPointNr OPTIONAL, IN OUT PKDB_BREAKPOINT BreakPoint OPTIONAL)
	Deletes a breakpoint.
static LONG	KdbpIsBreakPointOurs (IN NTSTATUS ExceptionCode, IN PCONTEXT Context)
	Checks if the breakpoint was set by the debugger.
BOOLEAN	KdbpEnableBreakPoint (IN LONG BreakPointNr OPTIONAL, IN OUT PKDB_BREAKPOINT BreakPoint OPTIONAL)
	Enables a breakpoint.
BOOLEAN	KdbpDisableBreakPoint (IN LONG BreakPointNr OPTIONAL, IN OUT PKDB_BREAKPOINT BreakPoint OPTIONAL)
	Disables a breakpoint.
BOOLEAN	KdbpGetEnterCondition (IN LONG ExceptionNr, IN BOOLEAN FirstChance, OUT KDB_ENTER_CONDITION *Condition)
	Gets the first or last chance enter-condition for exception nr. ExceptionNr.
BOOLEAN	KdbpSetEnterCondition (IN LONG ExceptionNr, IN BOOLEAN FirstChance, IN KDB_ENTER_CONDITION Condition)
	Sets the first or last chance enter-condition for exception nr. ExceptionNr.
BOOLEAN	KdbpAttachToThread (PVOID ThreadId)
	Switches to another thread context.
BOOLEAN	KdbpAttachToProcess (PVOID ProcessId)
	Switches to another process/thread context.
static VOID	KdbpCallMainLoop (VOID)
	Calls the main interactive debugger loop.
static VOID	KdbpInternalEnter (_In_ VOID(*Procedure)(VOID))
	Internal function to enter KDBG and run the specified procedure.
static ULONG	KdbpGetExceptionNumberFromStatus (IN NTSTATUS ExceptionCode)
KD_CONTINUE_TYPE	KdbEnterDebuggerException (IN PEXCEPTION_RECORD64 ExceptionRecord, IN KPROCESSOR_MODE PreviousMode, IN PCONTEXT Context, IN BOOLEAN FirstChance)
	KDB Exception filter.
VOID	KdbpGetCommandLineSettings (_In_ PCSTR p1)
NTSTATUS	KdbpSafeReadMemory (OUT PVOID Dest, IN PVOID Src, IN ULONG Bytes)
NTSTATUS	KdbpSafeWriteMemory (OUT PVOID Dest, IN PVOID Src, IN ULONG Bytes)

Variables
static LONG	KdbEntryCount = 0
static ULONG	KdbSwBreakPointCount = 0
static ULONG	KdbHwBreakPointCount = 0
static PKDB_BREAKPOINT	KdbSwBreakPoints [KDB_MAXIMUM_SW_BREAKPOINT_COUNT]
static PKDB_BREAKPOINT	KdbHwBreakPoints [KDB_MAXIMUM_HW_BREAKPOINT_COUNT]
static PKDB_BREAKPOINT	KdbBreakPointToReenable = NULL
static BOOLEAN	KdbpEvenThoughWeHaveABreakPointToReenableWeAlsoHaveARealSingleStep
LONG	KdbLastBreakPointNr = -1
ULONG	KdbNumSingleSteps = 0
BOOLEAN	KdbSingleStepOver = FALSE
static BOOLEAN	KdbEnteredOnSingleStep = FALSE
PEPROCESS	KdbCurrentProcess = NULL
PEPROCESS	KdbOriginalProcess = NULL
PETHREAD	KdbCurrentThread = NULL
PETHREAD	KdbOriginalThread = NULL
PKDB_KTRAP_FRAME	KdbCurrentTrapFrame = NULL
static KDB_KTRAP_FRAME	KdbTrapFrame = { 0 }
static KDB_KTRAP_FRAME	KdbThreadTrapFrame = { 0 }
static KAPC_STATE	KdbApcState
BOOLEAN	KdbpBugCheckRequested
static KDB_ENTER_CONDITION	KdbEnterConditions [][2]
static const CHAR *	ExceptionNrToString []

Macro Definition Documentation

__STRING

#define __STRING

(

x

)

#x

Definition at line 31 of file kdb.c.

_STRING

#define _STRING

(

x

)

__STRING(x)

Definition at line 32 of file kdb.c.

CONST_STR_LEN

#define CONST_STR_LEN

(

x

)

(sizeof(x)/sizeof(x[0]) - 1)

KDB_MAXIMUM_BREAKPOINT_COUNT

#define KDB_MAXIMUM_BREAKPOINT_COUNT   256

Definition at line 27 of file kdb.c.

KDB_MAXIMUM_HW_BREAKPOINT_COUNT

#define KDB_MAXIMUM_HW_BREAKPOINT_COUNT   4

Definition at line 28 of file kdb.c.

KDB_MAXIMUM_SW_BREAKPOINT_COUNT

#define KDB_MAXIMUM_SW_BREAKPOINT_COUNT   256

Definition at line 29 of file kdb.c.

KDB_STACK_ALIGN

#define KDB_STACK_ALIGN   4

Definition at line 24 of file kdb.c.

KDB_STACK_RESERVE

#define KDB_STACK_RESERVE   sizeof(ULONG) /* Return address */

Definition at line 25 of file kdb.c.

KDB_STACK_SIZE

#define KDB_STACK_SIZE   (4096*3)

Definition at line 19 of file kdb.c.

Function Documentation

DECLSPEC_ALIGN()

static DECLSPEC_ALIGN ( KDB_STACK_ALIGN  )

static

Definition at line 37 of file kdb.c.

                                                                     {{0}};  /* Breakpoint array */

KdbEnterDebuggerException()

KD_CONTINUE_TYPE KdbEnterDebuggerException	(	IN PEXCEPTION_RECORD64	ExceptionRecord,
		IN KPROCESSOR_MODE	PreviousMode,
		IN PCONTEXT	Context,
		IN BOOLEAN	FirstChance
	)

KDB Exception filter.

Called by the exception dispatcher.

Parameters

ExceptionRecord	Unused.
PreviousMode	UserMode if the exception was raised from umode, otherwise KernelMode.
Context	Context, IN/OUT parameter.
TrapFrame	Exception TrapFrame.
FirstChance	TRUE when called before exception frames were serached, FALSE for the second call.

Returns

KD_CONTINUE_TYPE

Definition at line 1272 of file kdb.c.

{
    KDB_ENTER_CONDITION EnterCondition;
    KD_CONTINUE_TYPE ContinueType = kdHandleException;
    PKDB_BREAKPOINT BreakPoint;
    ULONG ExpNr;
    ULONGLONG ull;
    BOOLEAN Resume = FALSE;
    BOOLEAN EnterConditionMet = TRUE;
    ULONG OldEflags;
    KIRQL OldIrql;
    NTSTATUS ExceptionCode;
    VOID (*EntryPoint)(VOID) = KdbpCallMainLoop;
 
    ExceptionCode = (ExceptionRecord ? ExceptionRecord->ExceptionCode : STATUS_BREAKPOINT);
 
    KdbCurrentProcess = PsGetCurrentProcess();
 
    /* Set continue type to kdContinue for single steps and breakpoints */
    if (ExceptionCode == STATUS_SINGLE_STEP ||
        ExceptionCode == STATUS_BREAKPOINT ||
        ExceptionCode == STATUS_ASSERTION_FAILURE)
    {
        ContinueType = kdContinue;
    }
 
    /* Check if we should handle the exception. */
    /* FIXME - won't get all exceptions here :( */
    ExpNr = KdbpGetExceptionNumberFromStatus(ExceptionCode);
    EnterCondition = KdbEnterConditions[ExpNr][FirstChance ? 0 : 1];
    if (EnterCondition == KdbDoNotEnter ||
        (EnterCondition == KdbEnterFromUmode && PreviousMode == KernelMode) ||
        (EnterCondition == KdbEnterFromKmode && PreviousMode != KernelMode))
    {
        EnterConditionMet = FALSE;
    }
 
    /* If we stopped on one of our breakpoints then let the user know */
    KdbLastBreakPointNr = -1;
    KdbEnteredOnSingleStep = FALSE;
 
    if (FirstChance && (ExceptionCode == STATUS_SINGLE_STEP || ExceptionCode == STATUS_BREAKPOINT) &&
        (KdbLastBreakPointNr = KdbpIsBreakPointOurs(ExceptionCode, Context)) >= 0)
    {
        BreakPoint = KdbBreakPoints + KdbLastBreakPointNr;
 
        if (ExceptionCode == STATUS_BREAKPOINT)
        {
            /* ... and restore the original instruction */
            if (!NT_SUCCESS(KdbpOverwriteInstruction(KdbCurrentProcess, BreakPoint->Address,
                                                     BreakPoint->Data.SavedInstruction, NULL)))
            {
                KdbPuts("Couldn't restore original instruction after INT3! Cannot continue execution.\n");
                KeBugCheck(0); // FIXME: Proper bugcode!
            }
 
            /* Also since we are past the int3 now, decrement EIP in the
               TrapFrame. This is only needed because KDBG insists on working
               with the TrapFrame instead of with the Context, as it is supposed
               to do. The context has already EIP point to the int3, since
               KiDispatchException accounts for that. Whatever we do here with
               the TrapFrame does not matter anyway, since KiDispatchException
               will overwrite it with the values from the Context! */
            KeSetContextPc(Context, KeGetContextPc(Context) - 1);
        }
 
        if ((BreakPoint->Type == KdbBreakPointHardware) &&
            (BreakPoint->Data.Hw.AccessType == KdbAccessExec))
        {
            Resume = TRUE; /* Set the resume flag when continuing execution */
        }
        /*
         * When a temporary breakpoint is hit we have to make sure that we are
         * in the same context in which it was set, otherwise it could happen
         * that another process/thread hits it before and it gets deleted.
         */
        else if (BreakPoint->Type == KdbBreakPointTemporary &&
                 BreakPoint->Process == KdbCurrentProcess)
        {
            ASSERT((Context->EFlags & EFLAGS_TF) == 0);
 
            /* Delete the temporary breakpoint which was used to step over or into the instruction */
            KdbpDeleteBreakPoint(-1, BreakPoint);
 
            if (--KdbNumSingleSteps > 0)
            {
                if ((KdbSingleStepOver && !KdbpStepOverInstruction(KeGetContextPc(Context))) ||
                    (!KdbSingleStepOver && !KdbpStepIntoInstruction(KeGetContextPc(Context))))
                {
                    Context->EFlags |= EFLAGS_TF;
                }
 
                goto continue_execution; /* return */
            }
 
            KdbEnteredOnSingleStep = TRUE;
        }
        /*
         * If we hit a breakpoint set by the debugger we set the single step flag,
         * ignore the next single step and reenable the breakpoint.
         */
        else if (BreakPoint->Type == KdbBreakPointSoftware ||
                 BreakPoint->Type == KdbBreakPointTemporary)
        {
            ASSERT(ExceptionCode == STATUS_BREAKPOINT);
            Context->EFlags |= EFLAGS_TF;
            KdbBreakPointToReenable = BreakPoint;
        }
 
        /* Make sure that the breakpoint should be triggered in this context */
        if (!BreakPoint->Global && BreakPoint->Process != KdbCurrentProcess)
        {
            goto continue_execution; /* return */
        }
 
        /* Check if the condition for the breakpoint is met. */
        if (BreakPoint->Condition)
        {
            /* Setup the KDB trap frame */
            KdbTrapFrame = *Context;
 
            ull = 0;
            if (!KdbpRpnEvaluateParsedExpression(BreakPoint->Condition, &KdbTrapFrame, &ull, NULL, NULL))
            {
                /* FIXME: Print warning? */
            }
            else if (ull == 0) /* condition is not met */
            {
                goto continue_execution; /* return */
            }
        }
 
        if (BreakPoint->Type == KdbBreakPointSoftware)
        {
            KdbPrintf("\nEntered debugger on breakpoint #%d: EXEC 0x%04x:0x%p\n",
                      KdbLastBreakPointNr, Context->SegCs & 0xffff, KeGetContextPc(Context));
        }
        else if (BreakPoint->Type == KdbBreakPointHardware)
        {
            KdbPrintf("\nEntered debugger on breakpoint #%d: %s 0x%08x\n",
                      KdbLastBreakPointNr,
                      (BreakPoint->Data.Hw.AccessType == KdbAccessRead) ? "READ" :
                      ((BreakPoint->Data.Hw.AccessType == KdbAccessWrite) ? "WRITE" :
                      ((BreakPoint->Data.Hw.AccessType == KdbAccessReadWrite) ? "RDWR" : "EXEC")),
                      BreakPoint->Address);
        }
    }
    else if (ExceptionCode == STATUS_SINGLE_STEP)
    {
        /* Silently ignore a debugger initiated single step. */
        if ((Context->Dr6 & 0xf) == 0 && KdbBreakPointToReenable)
        {
            /* FIXME: Make sure that the breakpoint was really hit (check bp->Address vs. tf->Eip) */
            BreakPoint = KdbBreakPointToReenable;
            KdbBreakPointToReenable = NULL;
            ASSERT(BreakPoint->Type == KdbBreakPointSoftware ||
                   BreakPoint->Type == KdbBreakPointTemporary);
 
            /*
             * Reenable the breakpoint we disabled to execute the breakpointed
             * instruction.
             */
            if (!NT_SUCCESS(KdbpOverwriteInstruction(KdbCurrentProcess, BreakPoint->Address, 0xCC,
                                                     &BreakPoint->Data.SavedInstruction)))
            {
                KdbPrintf("Warning: Couldn't reenable breakpoint %d\n",
                          BreakPoint - KdbBreakPoints);
            }
 
            /* Unset TF if we are no longer single stepping. */
            if (KdbNumSingleSteps == 0)
                Context->EFlags &= ~EFLAGS_TF;
 
            if (!KdbpEvenThoughWeHaveABreakPointToReenableWeAlsoHaveARealSingleStep)
            {
                goto continue_execution; /* return */
            }
        }
 
        /* Quoth the raven, 'Nevermore!' */
        KdbpEvenThoughWeHaveABreakPointToReenableWeAlsoHaveARealSingleStep = FALSE;
 
        /* Check if we expect a single step */
        if ((Context->Dr6 & 0xf) == 0 && KdbNumSingleSteps > 0)
        {
            /*ASSERT((Context->Eflags & EFLAGS_TF) != 0);*/
            if (--KdbNumSingleSteps > 0)
            {
                if ((KdbSingleStepOver && KdbpStepOverInstruction(KeGetContextPc(Context))) ||
                    (!KdbSingleStepOver && KdbpStepIntoInstruction(KeGetContextPc(Context))))
                {
                    Context->EFlags &= ~EFLAGS_TF;
                }
                else
                {
                    Context->EFlags |= EFLAGS_TF;
                }
 
                goto continue_execution; /* return */
            }
            else
            {
                Context->EFlags &= ~EFLAGS_TF;
                KdbEnteredOnSingleStep = TRUE;
            }
        }
        else
        {
            if (!EnterConditionMet)
            {
                return kdHandleException;
            }
 
            KdbPuts("\nEntered debugger on unexpected debug trap!\n");
        }
    }
    else if (ExceptionCode == STATUS_BREAKPOINT)
    {
        /* Do the condition check and banner display only if we enter
         * from a true code breakpoint. We skip those when running the
         * KDBinit file, because it is done via an artificial breakpoint. */
        if (KdbInitFileBuffer)
        {
            EntryPoint = KdbpCliInterpretInitFile;
            goto EnterKdbg;
        }
 
        if (!EnterConditionMet)
        {
            return kdHandleException;
        }
 
        KdbPrintf("\nEntered debugger on embedded INT3 at 0x%04x:0x%p.\n",
                  Context->SegCs & 0xffff, KeGetContextPc(Context));
EnterKdbg:;
    }
    else
    {
        const CHAR *ExceptionString = (ExpNr < RTL_NUMBER_OF(ExceptionNrToString)) ?
                                      ExceptionNrToString[ExpNr] :
                                      "Unknown/User defined exception";
 
        if (!EnterConditionMet)
        {
            return ContinueType;
        }
 
        KdbPrintf("\nEntered debugger on %s-chance exception (Exception Code: 0x%x) (%s)\n",
                  FirstChance ? "first" : "last", ExceptionCode, ExceptionString);
 
        if (ExceptionCode == STATUS_ACCESS_VIOLATION &&
            ExceptionRecord && ExceptionRecord->NumberParameters != 0)
        {
            ULONG_PTR TrapCr2 = __readcr2();
            KdbPrintf("Memory at 0x%p could not be accessed\n", TrapCr2);
        }
    }
 
    /* Once we enter the debugger we do not expect any more single steps to happen */
    KdbNumSingleSteps = 0;
 
    /* Update the current process pointer */
    KdbCurrentProcess = KdbOriginalProcess = PsGetCurrentProcess();
    KdbCurrentThread = KdbOriginalThread = PsGetCurrentThread();
    KdbCurrentTrapFrame = &KdbTrapFrame;
 
    /* Setup the KDB trap frame */
    KdbTrapFrame = *Context;
 
    /* Enter critical section */
    OldEflags = __readeflags();
    _disable();
 
    /* HACK: Save the current IRQL and pretend we are at dispatch level */
    OldIrql = KeGetCurrentIrql();
    if (OldIrql > DISPATCH_LEVEL)
        KeLowerIrql(DISPATCH_LEVEL);
 
    /* Exception inside the debugger? Game over. */
    if (InterlockedIncrement(&KdbEntryCount) > 1)
    {
        __writeeflags(OldEflags);
        return kdHandleException;
    }
 
    /* Enter KDBG proper and run either the main loop or the KDBinit file */
    KdbpInternalEnter(EntryPoint);
 
    /* Check if we should single step */
    if (KdbNumSingleSteps > 0)
    {
        /* Variable explains itself! */
        KdbpEvenThoughWeHaveABreakPointToReenableWeAlsoHaveARealSingleStep = TRUE;
 
        if ((KdbSingleStepOver && KdbpStepOverInstruction(KeGetContextPc(KdbCurrentTrapFrame))) ||
            (!KdbSingleStepOver && KdbpStepIntoInstruction(KeGetContextPc(KdbCurrentTrapFrame))))
        {
            ASSERT((KdbCurrentTrapFrame->EFlags & EFLAGS_TF) == 0);
            /*KdbCurrentTrapFrame->EFlags &= ~EFLAGS_TF;*/
        }
        else
        {
            KdbTrapFrame.EFlags |= EFLAGS_TF;
        }
    }
 
    /* We can't update the current thread's trapframe 'cause it might not have one */
 
    /* Detach from attached process */
    if (KdbCurrentProcess != KdbOriginalProcess)
    {
        KeUnstackDetachProcess(&KdbApcState);
    }
 
    /* Update the exception Context */
    *Context = KdbTrapFrame;
 
    /* Decrement the entry count */
    InterlockedDecrement(&KdbEntryCount);
 
    /* HACK: Raise back to old IRQL */
    if (OldIrql > DISPATCH_LEVEL)
        KeRaiseIrql(OldIrql, &OldIrql);
 
    /* Leave critical section */
    __writeeflags(OldEflags);
 
    /* Check if user requested a bugcheck */
    if (KdbpBugCheckRequested)
    {
        /* Clear the flag and bugcheck the system */
        KdbpBugCheckRequested = FALSE;
        KeBugCheck(MANUALLY_INITIATED_CRASH);
    }
 
continue_execution:
    /* Clear debug status */
    if (ExceptionCode == STATUS_BREAKPOINT) /* FIXME: Why clear DR6 on INT3? */
    {
        /* Set the RF flag so we don't trigger the same breakpoint again. */
        if (Resume)
        {
            Context->EFlags |= EFLAGS_RF;
        }
 
        /* Clear dr6 status flags. */
        Context->Dr6 &= ~0x0000e00f;
 
        if (!(KdbEnteredOnSingleStep && KdbSingleStepOver))
        {
            /* Skip the current instruction */
            KeSetContextPc(Context, KeGetContextPc(Context) + KD_BREAKPOINT_SIZE);
        }
    }
 
    return ContinueType;
}

Referenced by KdSendPacket().

KdbpAttachToProcess()

BOOLEAN KdbpAttachToProcess

(

PVOID

ProcessId

)

Switches to another process/thread context.

This function switches to the first thread in the specified process.

Parameters

ProcessId

Id of the process to switch to.

Return values

TRUE	Success.
FALSE	Failure (i.e. invalid process id)

Definition at line 1117 of file kdb.c.

{
    PEPROCESS Process = NULL;
    PETHREAD Thread;
    PLIST_ENTRY Entry;
 
    /* Get a pointer to the process */
    if (!NT_SUCCESS(PsLookupProcessByProcessId(ProcessId, &Process)))
    {
        KdbpPrint("Invalid process id: 0x%08x\n", (ULONG_PTR)ProcessId);
        return FALSE;
    }
 
    Entry = Process->ThreadListHead.Flink;
    ObDereferenceObject(Process);
    if (Entry == &KdbCurrentProcess->ThreadListHead)
    {
        KdbpPrint("No threads in process 0x%p, cannot attach to process!\n", ProcessId);
        return FALSE;
    }
 
    Thread = CONTAINING_RECORD(Entry, ETHREAD, ThreadListEntry);
 
    return KdbpAttachToThread(Thread->Cid.UniqueThread);
}

Referenced by KdbpCmdProc().

KdbpAttachToThread()

BOOLEAN KdbpAttachToThread

(

PVOID

ThreadId

)

Switches to another thread context.

Parameters

ThreadId

Id of the thread to switch to.

Return values

TRUE	Success.
FALSE	Failure (i.e. invalid thread id)

Definition at line 1036 of file kdb.c.

{
    PETHREAD Thread = NULL;
    PEPROCESS Process;
 
    /* Get a pointer to the thread */
    if (!NT_SUCCESS(PsLookupThreadByThreadId(ThreadId, &Thread)))
    {
        KdbpPrint("Invalid thread id: 0x%08x\n", (ULONG_PTR)ThreadId);
        return FALSE;
    }
    Process = Thread->ThreadsProcess;
 
    if (KeIsExecutingDpc() && Process != KdbCurrentProcess)
    {
        KdbpPrint("Cannot attach to thread within another process while executing a DPC.\n");
        ObDereferenceObject(Thread);
        return FALSE;
    }
 
    /* Save the current thread's context (if we previously attached to a thread) */
    if (KdbCurrentThread != KdbOriginalThread)
    {
        ASSERT(KdbCurrentTrapFrame == &KdbThreadTrapFrame);
        /* Actually, we can't save the context, there's no guarantee that there was a trap frame */
    }
    else
    {
        ASSERT(KdbCurrentTrapFrame == &KdbTrapFrame);
    }
 
    /* Switch to the thread's context */
    if (Thread != KdbOriginalThread)
    {
        /* The thread we're attaching to isn't the thread on which we entered
         * kdb and so the thread we're attaching to is not running. There
         * is no guarantee that it actually has a trap frame. So we have to
         * peek directly at the registers which were saved on the stack when the
         * thread was preempted in the scheduler */
        KdbpKdbTrapFrameFromKernelStack(Thread->Tcb.KernelStack,
                                        &KdbThreadTrapFrame);
        KdbCurrentTrapFrame = &KdbThreadTrapFrame;
    }
    else /* Switching back to original thread */
    {
        KdbCurrentTrapFrame = &KdbTrapFrame;
    }
    KdbCurrentThread = Thread;
 
    /* Attach to the thread's process */
    ASSERT(KdbCurrentProcess == PsGetCurrentProcess());
    if (KdbCurrentProcess != Process)
    {
        if (KdbCurrentProcess != KdbOriginalProcess) /* detach from previously attached process */
        {
            KeUnstackDetachProcess(&KdbApcState);
        }
 
        if (KdbOriginalProcess != Process)
        {
            KeStackAttachProcess(&Process->Pcb, &KdbApcState);
        }
 
        KdbCurrentProcess = Process;
    }
 
    ObDereferenceObject(Thread);
    return TRUE;
}

Referenced by KdbpAttachToProcess(), and KdbpCmdThread().

KdbpCallMainLoop()

static VOID KdbpCallMainLoop ( VOID  )

static

Calls the main interactive debugger loop.

Definition at line 1148 of file kdb.c.

{
    KdbpCliMainLoop(KdbEnteredOnSingleStep);
}

Referenced by KdbEnterDebuggerException().

KdbpDeleteBreakPoint()

BOOLEAN KdbpDeleteBreakPoint	(	IN LONG BreakPointNr	OPTIONAL,
		IN OUT PKDB_BREAKPOINT BreakPoint	OPTIONAL
	)

Deletes a breakpoint.

Parameters

BreakPointNr	Number of the breakpoint to delete. Can be -1
BreakPoint	Breakpoint to delete. Can be NULL.

Return values

TRUE	Success.
FALSE	Failure (invalid breakpoint number)

Definition at line 599 of file kdb.c.

{
    if (BreakPointNr < 0)
    {
        ASSERT(BreakPoint);
        BreakPointNr = BreakPoint - KdbBreakPoints;
    }
 
    if (BreakPointNr < 0 || BreakPointNr >= KDB_MAXIMUM_BREAKPOINT_COUNT)
    {
        KdbPrintf("Invalid breakpoint: %d\n", BreakPointNr);
        return FALSE;
    }
 
    if (!BreakPoint)
    {
        BreakPoint = KdbBreakPoints + BreakPointNr;
    }
 
    if (BreakPoint->Type == KdbBreakPointNone)
    {
        KdbPrintf("Invalid breakpoint: %d\n", BreakPointNr);
        return FALSE;
    }
 
    if (BreakPoint->Enabled && !KdbpDisableBreakPoint(-1, BreakPoint))
        return FALSE;
 
    if (BreakPoint->Type != KdbBreakPointTemporary)
        KdbPrintf("Breakpoint %d deleted.\n", BreakPointNr);
 
    BreakPoint->Type = KdbBreakPointNone;
    KdbBreakPointCount--;
 
    return TRUE;
}

Referenced by KdbEnterDebuggerException(), and KdbpCmdEnableDisableClearBreakPoint().

KdbpDisableBreakPoint()

BOOLEAN KdbpDisableBreakPoint	(	IN LONG BreakPointNr	OPTIONAL,
		IN OUT PKDB_BREAKPOINT BreakPoint	OPTIONAL
	)

Disables a breakpoint.

Parameters

BreakPointNr	Number of the breakpoint to disable. Can be -1
BreakPoint	Breakpoint to disable. Can be NULL.

Return values

TRUE	Success.
FALSE	Failure.

See also

KdbpEnableBreakPoint

Definition at line 868 of file kdb.c.

{
    ULONG i;
    NTSTATUS Status;
 
    if (BreakPointNr < 0)
    {
        ASSERT(BreakPoint);
        BreakPointNr = BreakPoint - KdbBreakPoints;
    }
 
    if (BreakPointNr < 0 || BreakPointNr >= KDB_MAXIMUM_BREAKPOINT_COUNT)
    {
        KdbPrintf("Invalid breakpoint: %d\n", BreakPointNr);
        return FALSE;
    }
 
    if (!BreakPoint)
    {
        BreakPoint = KdbBreakPoints + BreakPointNr;
    }
 
    if (BreakPoint->Type == KdbBreakPointNone)
    {
        KdbPrintf("Invalid breakpoint: %d\n", BreakPointNr);
        return FALSE;
    }
 
    if (BreakPoint->Enabled == FALSE)
    {
        KdbPrintf("Breakpoint %d is not enabled.\n", BreakPointNr);
        return TRUE;
    }
 
    if (BreakPoint->Type == KdbBreakPointSoftware ||
        BreakPoint->Type == KdbBreakPointTemporary)
    {
        ASSERT(KdbSwBreakPointCount > 0);
        Status = KdbpOverwriteInstruction(BreakPoint->Process, BreakPoint->Address,
                                          BreakPoint->Data.SavedInstruction, NULL);
 
        if (!NT_SUCCESS(Status))
        {
            KdbPuts("Couldn't restore original instruction.\n");
            return FALSE;
        }
 
        for (i = 0; i < KdbSwBreakPointCount; i++)
        {
            if (KdbSwBreakPoints[i] == BreakPoint)
            {
                KdbSwBreakPoints[i] = KdbSwBreakPoints[--KdbSwBreakPointCount];
                i = -1; /* if the last breakpoint is disabled dont break with i >= KdbSwBreakPointCount */
                break;
            }
        }
 
        if (i != MAXULONG) /* not found */
            ASSERT(0);
    }
    else
    {
        ASSERT(BreakPoint->Type == KdbBreakPointHardware);
 
        /* Clear the breakpoint. */
        KdbTrapFrame.Dr7 &= ~(0x3 << (BreakPoint->Data.Hw.DebugReg * 2));
        if ((KdbTrapFrame.Dr7 & 0xFF) == 0)
        {
            /* If no breakpoints are enabled then clear the exact match flags. */
            KdbTrapFrame.Dr7 &= 0xFFFFFCFF;
        }
 
        for (i = 0; i < KdbHwBreakPointCount; i++)
        {
            if (KdbHwBreakPoints[i] == BreakPoint)
            {
                KdbHwBreakPoints[i] = KdbHwBreakPoints[--KdbHwBreakPointCount];
                i = -1; /* if the last breakpoint is disabled dont break with i >= KdbHwBreakPointCount */
                break;
            }
        }
 
        if (i != MAXULONG) /* not found */
            ASSERT(0);
    }
 
    BreakPoint->Enabled = FALSE;
    if (BreakPoint->Type != KdbBreakPointTemporary)
        KdbPrintf("Breakpoint %d disabled.\n", BreakPointNr);
 
    return TRUE;
}

Referenced by KdbpCmdEnableDisableClearBreakPoint(), and KdbpDeleteBreakPoint().

KdbpEnableBreakPoint()

BOOLEAN KdbpEnableBreakPoint	(	IN LONG BreakPointNr	OPTIONAL,
		IN OUT PKDB_BREAKPOINT BreakPoint	OPTIONAL
	)

Enables a breakpoint.

Parameters

BreakPointNr	Number of the breakpoint to enable Can be -1.
BreakPoint	Breakpoint to enable. Can be NULL.

Return values

TRUE	Success.
FALSE	Failure.

See also

KdbpDisableBreakPoint

Definition at line 702 of file kdb.c.

{
    NTSTATUS Status;
    INT i;
    ULONG ul;
 
    if (BreakPointNr < 0)
    {
        ASSERT(BreakPoint);
        BreakPointNr = BreakPoint - KdbBreakPoints;
    }
 
    if (BreakPointNr < 0 || BreakPointNr >= KDB_MAXIMUM_BREAKPOINT_COUNT)
    {
        KdbPrintf("Invalid breakpoint: %d\n", BreakPointNr);
        return FALSE;
    }
 
    if (!BreakPoint)
    {
        BreakPoint = KdbBreakPoints + BreakPointNr;
    }
 
    if (BreakPoint->Type == KdbBreakPointNone)
    {
        KdbPrintf("Invalid breakpoint: %d\n", BreakPointNr);
        return FALSE;
    }
 
    if (BreakPoint->Enabled)
    {
        KdbPrintf("Breakpoint %d is already enabled.\n", BreakPointNr);
        return TRUE;
    }
 
    if (BreakPoint->Type == KdbBreakPointSoftware ||
        BreakPoint->Type == KdbBreakPointTemporary)
    {
        if (KdbSwBreakPointCount >= KDB_MAXIMUM_SW_BREAKPOINT_COUNT)
        {
            KdbPrintf("Maximum number of SW breakpoints (%d) used. "
                      "Disable another breakpoint in order to enable this one.\n",
                      KDB_MAXIMUM_SW_BREAKPOINT_COUNT);
            return FALSE;
        }
 
        Status = KdbpOverwriteInstruction(BreakPoint->Process, BreakPoint->Address,
                                          0xCC, &BreakPoint->Data.SavedInstruction);
        if (!NT_SUCCESS(Status))
        {
            KdbPrintf("Couldn't access memory at 0x%p\n", BreakPoint->Address);
            return FALSE;
        }
 
        KdbSwBreakPoints[KdbSwBreakPointCount++] = BreakPoint;
    }
    else
    {
        if (BreakPoint->Data.Hw.AccessType == KdbAccessExec)
            ASSERT(BreakPoint->Data.Hw.Size == 1);
 
        ASSERT((BreakPoint->Address % BreakPoint->Data.Hw.Size) == 0);
 
        if (KdbHwBreakPointCount >= KDB_MAXIMUM_HW_BREAKPOINT_COUNT)
        {
            KdbPrintf("Maximum number of HW breakpoints (%d) already used. "
                      "Disable another breakpoint in order to enable this one.\n",
                      KDB_MAXIMUM_HW_BREAKPOINT_COUNT);
            return FALSE;
        }
 
        /* Find unused hw breakpoint */
        ASSERT(KDB_MAXIMUM_HW_BREAKPOINT_COUNT == 4);
        for (i = 0; i < KDB_MAXIMUM_HW_BREAKPOINT_COUNT; i++)
        {
            if ((KdbTrapFrame.Dr7 & (0x3 << (i * 2))) == 0)
                break;
        }
 
        ASSERT(i < KDB_MAXIMUM_HW_BREAKPOINT_COUNT);
 
        /* Set the breakpoint address. */
        switch (i)
        {
            case 0:
                KdbTrapFrame.Dr0 = BreakPoint->Address;
                break;
            case 1:
                KdbTrapFrame.Dr1 = BreakPoint->Address;
                break;
            case 2:
                KdbTrapFrame.Dr2 = BreakPoint->Address;
                break;
            case 3:
                KdbTrapFrame.Dr3 = BreakPoint->Address;
                break;
        }
 
        /* Enable the global breakpoint */
        KdbTrapFrame.Dr7 |= (0x2 << (i * 2));
 
        /* Enable the exact match bits. */
        KdbTrapFrame.Dr7 |= 0x00000300;
 
        /* Clear existing state. */
        KdbTrapFrame.Dr7 &= ~(0xF << (16 + (i * 4)));
 
        /* Set the breakpoint type. */
        switch (BreakPoint->Data.Hw.AccessType)
        {
            case KdbAccessExec:
                ul = 0;
                break;
            case KdbAccessWrite:
                ul = 1;
                break;
            case KdbAccessRead:
            case KdbAccessReadWrite:
                ul = 3;
                break;
            default:
                ASSERT(0);
                return TRUE;
                break;
        }
 
        KdbTrapFrame.Dr7 |= (ul << (16 + (i * 4)));
 
        /* Set the breakpoint length. */
        KdbTrapFrame.Dr7 |= ((BreakPoint->Data.Hw.Size - 1) << (18 + (i * 4)));
 
        /* Update KdbCurrentTrapFrame - values are taken from there by the CLI */
        if (&KdbTrapFrame != KdbCurrentTrapFrame)
        {
            KdbCurrentTrapFrame->Dr0 = KdbTrapFrame.Dr0;
            KdbCurrentTrapFrame->Dr1 = KdbTrapFrame.Dr1;
            KdbCurrentTrapFrame->Dr2 = KdbTrapFrame.Dr2;
            KdbCurrentTrapFrame->Dr3 = KdbTrapFrame.Dr3;
            KdbCurrentTrapFrame->Dr6 = KdbTrapFrame.Dr6;
            KdbCurrentTrapFrame->Dr7 = KdbTrapFrame.Dr7;
        }
 
        BreakPoint->Data.Hw.DebugReg = i;
        KdbHwBreakPoints[KdbHwBreakPointCount++] = BreakPoint;
    }
 
    BreakPoint->Enabled = TRUE;
    if (BreakPoint->Type != KdbBreakPointTemporary)
        KdbPrintf("Breakpoint %d enabled.\n", BreakPointNr);
 
    return TRUE;
}

Referenced by KdbpCmdEnableDisableClearBreakPoint(), and KdbpInsertBreakPoint().

KdbpGetBreakPointInfo()

BOOLEAN KdbpGetBreakPointInfo	(	IN ULONG	BreakPointNr,
		OUT ULONG_PTR *Address	OPTIONAL,
		OUT KDB_BREAKPOINT_TYPE *Type	OPTIONAL,
		OUT UCHAR *Size	OPTIONAL,
		OUT KDB_ACCESS_TYPE *AccessType	OPTIONAL,
		OUT UCHAR *DebugReg	OPTIONAL,
		OUT BOOLEAN *Enabled	OPTIONAL,
		OUT BOOLEAN *Global	OPTIONAL,
		OUT PEPROCESS *Process	OPTIONAL,
		OUT PCHAR *ConditionExpression	OPTIONAL
	)

Returns information of the specified breakpoint.

Parameters

BreakPointNr	Number of the breakpoint to return information of.
Address	Receives the address of the breakpoint.
Type	Receives the type of the breakpoint (hardware or software)
Size	Size - for memory breakpoints.
AccessType	Access type - for hardware breakpoints.
DebugReg	Debug register - for enabled hardware breakpoints.
Enabled	Whether the breakpoint is enabled or not.
Process	The owning process of the breakpoint.
ConditionExpression	The expression which was given as condition for the bp.

Returns

NULL on failure, pointer to a KDB_BREAKPOINT struct on success.

Definition at line 409 of file kdb.c.

{
    PKDB_BREAKPOINT bp;
 
    if (BreakPointNr >= RTL_NUMBER_OF(KdbBreakPoints) ||
        KdbBreakPoints[BreakPointNr].Type == KdbBreakPointNone)
    {
        return FALSE;
    }
 
    bp = KdbBreakPoints + BreakPointNr;
    if (Address)
        *Address = bp->Address;
 
    if (Type)
        *Type = bp->Type;
 
    if (bp->Type == KdbBreakPointHardware)
    {
        if (Size)
            *Size = bp->Data.Hw.Size;
 
        if (AccessType)
            *AccessType = bp->Data.Hw.AccessType;
 
        if (DebugReg && bp->Enabled)
            *DebugReg = bp->Data.Hw.DebugReg;
    }
 
    if (Enabled)
        *Enabled = bp->Enabled;
 
    if (Global)
        *Global = bp->Global;
 
    if (Process)
        *Process = bp->Process;
 
    if (ConditionExpression)
        *ConditionExpression = bp->ConditionExpression;
 
    return TRUE;
}

Referenced by KdbpCmdBreakPointList().

KdbpGetCommandLineSettings()

VOID KdbpGetCommandLineSettings

(

_In_ PCSTR

p1

)

Definition at line 1635 of file kdb.c.

{
#define CONST_STR_LEN(x) (sizeof(x)/sizeof(x[0]) - 1)
 
    while (p1 && *p1)
    {
        /* Skip leading whitespace */
        while (*p1 == ' ') ++p1;
 
        if (!_strnicmp(p1, "FIRSTCHANCE", CONST_STR_LEN("FIRSTCHANCE")))
        {
            p1 += CONST_STR_LEN("FIRSTCHANCE");
            KdbpSetEnterCondition(-1, TRUE, KdbEnterAlways);
        }
 
        /* Move on to the next option */
        p1 = strchr(p1, ' ');
    }
}

Referenced by KdbInitialize().

KdbpGetEnterCondition()

BOOLEAN KdbpGetEnterCondition	(	IN LONG	ExceptionNr,
		IN BOOLEAN	FirstChance,
		OUT KDB_ENTER_CONDITION *	Condition
	)

Gets the first or last chance enter-condition for exception nr. ExceptionNr.

Parameters

ExceptionNr	Number of the exception to get condition of.
FirstChance	Whether to get first or last chance condition.
Condition	Receives the condition setting.

Return values

TRUE	Success.
FALSE	Failure (invalid exception nr)

Definition at line 973 of file kdb.c.

{
    if (ExceptionNr >= (LONG)RTL_NUMBER_OF(KdbEnterConditions))
        return FALSE;
 
    *Condition = KdbEnterConditions[ExceptionNr][FirstChance ? 0 : 1];
    return TRUE;
}

Referenced by KdbpCmdSet().

KdbpGetExceptionNumberFromStatus()

static ULONG KdbpGetExceptionNumberFromStatus ( IN NTSTATUS  ExceptionCode )

static

Definition at line 1206 of file kdb.c.

{
    ULONG Ret;
 
    switch (ExceptionCode)
    {
        case STATUS_INTEGER_DIVIDE_BY_ZERO:
            Ret = 0;
            break;
        case STATUS_SINGLE_STEP:
            Ret = 1;
            break;
        case STATUS_BREAKPOINT:
            Ret = 3;
            break;
        case STATUS_INTEGER_OVERFLOW:
            Ret = 4;
            break;
        case STATUS_ARRAY_BOUNDS_EXCEEDED:
            Ret = 5;
            break;
        case STATUS_ILLEGAL_INSTRUCTION:
            Ret = 6;
            break;
        case STATUS_FLOAT_INVALID_OPERATION:
            Ret = 7;
            break;
        case STATUS_STACK_OVERFLOW:
            Ret = 12;
            break;
        case STATUS_ACCESS_VIOLATION:
            Ret = 14;
            break;
        case STATUS_DATATYPE_MISALIGNMENT:
            Ret = 17;
            break;
        case STATUS_FLOAT_MULTIPLE_TRAPS:
            Ret = 18;
            break;
        case STATUS_ASSERTION_FAILURE:
            Ret = 20;
            break;
 
        default:
            Ret = RTL_NUMBER_OF(KdbEnterConditions) - 1;
            break;
    }
 
    return Ret;
}

Referenced by KdbEnterDebuggerException().

KdbpGetNextBreakPointNr()

LONG KdbpGetNextBreakPointNr

(

IN ULONG Start

OPTIONAL

)

Gets the number of the next breakpoint >= Start.

Parameters

Start

Breakpoint number to start searching at. -1 if no more breakpoints are found.

Returns

Breakpoint number (-1 if no more breakpoints are found)

Definition at line 382 of file kdb.c.

{
    for (; Start < RTL_NUMBER_OF(KdbBreakPoints); Start++)
    {
        if (KdbBreakPoints[Start].Type != KdbBreakPointNone)
            return Start;
    }
 
    return -1;
}

Referenced by KdbpCmdBreakPointList().

KdbpInsertBreakPoint()

NTSTATUS KdbpInsertBreakPoint	(	IN ULONG_PTR	Address,
		IN KDB_BREAKPOINT_TYPE	Type,
		IN UCHAR Size	OPTIONAL,
		IN KDB_ACCESS_TYPE AccessType	OPTIONAL,
		IN PCHAR ConditionExpression	OPTIONAL,
		IN BOOLEAN	Global,
		OUT PLONG BreakPointNr	OPTIONAL
	)

Inserts a breakpoint into the breakpoint array.

The Process of the breakpoint is set to KdbCurrentProcess

Parameters

Address	Address at which to set the breakpoint.
Type	Type of breakpoint (hardware or software)
Size	Size of breakpoint (for hardware/memory breakpoints)
AccessType	Access type (for hardware breakpoins)
ConditionExpression	Expression which must evaluate to true for conditional breakpoints.
Global	Wether the breakpoint is global or local to a process.
BreakPointNumber	Receives the breakpoint number on success

Returns

NTSTATUS

Definition at line 478 of file kdb.c.

{
    LONG_PTR i;
    PVOID Condition;
    PCHAR ConditionExpressionDup;
    LONG ErrOffset;
    CHAR ErrMsg[128];
 
    ASSERT(Type != KdbBreakPointNone);
 
    if (Type == KdbBreakPointHardware)
    {
        if ((Address % Size) != 0)
        {
            KdbPrintf("Address (0x%p) must be aligned to a multiple of the size (%d)\n", Address, Size);
            return STATUS_UNSUCCESSFUL;
        }
 
        if (AccessType == KdbAccessExec && Size != 1)
        {
            KdbPuts("Size must be 1 for execution breakpoints.\n");
            return STATUS_UNSUCCESSFUL;
        }
    }
 
    if (KdbBreakPointCount == KDB_MAXIMUM_BREAKPOINT_COUNT)
    {
        return STATUS_UNSUCCESSFUL;
    }
 
    /* Parse condition expression string and duplicate it */
    if (ConditionExpression)
    {
        Condition = KdbpRpnParseExpression(ConditionExpression, &ErrOffset, ErrMsg);
        if (!Condition)
        {
            if (ErrOffset >= 0)
                KdbPrintf("Couldn't parse expression: %s at character %d\n", ErrMsg, ErrOffset);
            else
                KdbPrintf("Couldn't parse expression: %s", ErrMsg);
 
            return STATUS_UNSUCCESSFUL;
        }
 
        i = strlen(ConditionExpression) + 1;
        ConditionExpressionDup = ExAllocatePoolWithTag(NonPagedPool, i, TAG_KDBG);
        RtlCopyMemory(ConditionExpressionDup, ConditionExpression, i);
    }
    else
    {
        Condition = NULL;
        ConditionExpressionDup = NULL;
    }
 
    /* Find unused breakpoint */
    if (Type == KdbBreakPointTemporary)
    {
        for (i = RTL_NUMBER_OF(KdbBreakPoints) - 1; i >= 0; i--)
        {
            if (KdbBreakPoints[i].Type == KdbBreakPointNone)
                break;
        }
    }
    else
    {
        for (i = 0; i < (LONG)RTL_NUMBER_OF(KdbBreakPoints); i++)
        {
            if (KdbBreakPoints[i].Type == KdbBreakPointNone)
                break;
        }
    }
 
    ASSERT(i < (LONG)RTL_NUMBER_OF(KdbBreakPoints));
 
    /* Set the breakpoint */
    ASSERT(KdbCurrentProcess);
    KdbBreakPoints[i].Type = Type;
    KdbBreakPoints[i].Address = Address;
    KdbBreakPoints[i].Enabled = FALSE;
    KdbBreakPoints[i].Global = Global;
    KdbBreakPoints[i].Process = KdbCurrentProcess;
    KdbBreakPoints[i].ConditionExpression = ConditionExpressionDup;
    KdbBreakPoints[i].Condition = Condition;
 
    if (Type == KdbBreakPointHardware)
    {
        KdbBreakPoints[i].Data.Hw.Size = Size;
        KdbBreakPoints[i].Data.Hw.AccessType = AccessType;
    }
 
    KdbBreakPointCount++;
 
    if (Type != KdbBreakPointTemporary)
        KdbPrintf("Breakpoint %d inserted.\n", i);
 
    /* Try to enable the breakpoint */
    KdbpEnableBreakPoint(i, NULL);
 
    /* Return the breakpoint number */
    if (BreakPointNr)
        *BreakPointNr = i;
 
    return STATUS_SUCCESS;
}

Referenced by KdbpCmdBreakPoint(), KdbpStepIntoInstruction(), and KdbpStepOverInstruction().

KdbpInternalEnter()

static VOID KdbpInternalEnter ( _In_ VOID(*)(VOID)  Procedure )

static

Internal function to enter KDBG and run the specified procedure.

Disables interrupts, releases display ownership, ...

Parameters

[in]

Procedure

The procedure to execute under the KDBG environment. Either execute the main interactive debugger loop (KdbpCallMainLoop) or run the KDBinit file (KdbpCliInterpretInitFile).

Definition at line 1165 of file kdb.c.

{
    PETHREAD Thread;
    PVOID SavedInitialStack, SavedStackBase, SavedKernelStack;
    ULONG SavedStackLimit;
 
    KbdDisableMouse();
 
    /* Take control of the display */
    if (KdpDebugMode.Screen)
        KdpScreenAcquire();
 
    /* Call the specified debugger procedure on a different stack */
    Thread = PsGetCurrentThread();
    SavedInitialStack = Thread->Tcb.InitialStack;
    SavedStackBase = Thread->Tcb.StackBase;
    SavedStackLimit = Thread->Tcb.StackLimit;
    SavedKernelStack = Thread->Tcb.KernelStack;
    Thread->Tcb.InitialStack = Thread->Tcb.StackBase = (char*)KdbStack + KDB_STACK_SIZE;
    Thread->Tcb.StackLimit = (ULONG_PTR)KdbStack;
    Thread->Tcb.KernelStack = (char*)KdbStack + KDB_STACK_SIZE;
 
    // KdbPrintf("Switching to KDB stack 0x%08x-0x%08x (Current Stack is 0x%08x)\n",
    //           Thread->Tcb.StackLimit, Thread->Tcb.StackBase, Esp);
 
    KdbpStackSwitchAndCall(KdbStack + KDB_STACK_SIZE - KDB_STACK_RESERVE, Procedure);
 
    Thread->Tcb.InitialStack = SavedInitialStack;
    Thread->Tcb.StackBase = SavedStackBase;
    Thread->Tcb.StackLimit = SavedStackLimit;
    Thread->Tcb.KernelStack = SavedKernelStack;
 
    /* Release the display */
    if (KdpDebugMode.Screen)
        KdpScreenRelease();
 
    KbdEnableMouse();
}

Referenced by KdbEnterDebuggerException().

KdbpIsBreakPointOurs()

static LONG KdbpIsBreakPointOurs ( IN NTSTATUS  ExceptionCode, IN PCONTEXT  Context  )

static

Checks if the breakpoint was set by the debugger.

Tries to find a breakpoint in the breakpoint array which caused the debug exception to happen.

Parameters

ExpNr	Exception Number (1 or 3)
TrapFrame	Exception trapframe

Returns

Breakpoint number, -1 on error.

Definition at line 649 of file kdb.c.

{
    ULONG i;
    ASSERT(ExceptionCode == STATUS_SINGLE_STEP || ExceptionCode == STATUS_BREAKPOINT);
 
    if (ExceptionCode == STATUS_BREAKPOINT) /* Software interrupt */
    {
        ULONG_PTR BpPc = KeGetContextPc(Context) - 1; /* Get EIP of INT3 instruction */
        for (i = 0; i < KdbSwBreakPointCount; i++)
        {
            ASSERT((KdbSwBreakPoints[i]->Type == KdbBreakPointSoftware ||
                   KdbSwBreakPoints[i]->Type == KdbBreakPointTemporary));
            ASSERT(KdbSwBreakPoints[i]->Enabled);
 
            if (KdbSwBreakPoints[i]->Address == BpPc)
            {
                return KdbSwBreakPoints[i] - KdbBreakPoints;
            }
        }
    }
    else if (ExceptionCode == STATUS_SINGLE_STEP) /* Hardware interrupt */
    {
        UCHAR DebugReg;
 
        for (i = 0; i < KdbHwBreakPointCount; i++)
        {
            ASSERT(KdbHwBreakPoints[i]->Type == KdbBreakPointHardware &&
                   KdbHwBreakPoints[i]->Enabled);
            DebugReg = KdbHwBreakPoints[i]->Data.Hw.DebugReg;
 
            if ((Context->Dr6 & ((ULONG_PTR)1 << DebugReg)) != 0)
            {
                return KdbHwBreakPoints[i] - KdbBreakPoints;
            }
        }
    }
 
    return -1;
}

Referenced by KdbEnterDebuggerException().

KdbpKdbTrapFrameFromKernelStack()

static VOID KdbpKdbTrapFrameFromKernelStack ( PVOID  KernelStack, PKDB_KTRAP_FRAME  KdbTrapFrame  )

static

Definition at line 119 of file kdb.c.

{
    ULONG_PTR *StackPtr;
 
    RtlZeroMemory(KdbTrapFrame, sizeof(KDB_KTRAP_FRAME));
    StackPtr = (ULONG_PTR *) KernelStack;
#ifdef _M_IX86
    KdbTrapFrame->Ebp = StackPtr[3];
    KdbTrapFrame->Edi = StackPtr[4];
    KdbTrapFrame->Esi = StackPtr[5];
    KdbTrapFrame->Ebx = StackPtr[6];
    KdbTrapFrame->Eip = StackPtr[7];
    KdbTrapFrame->Esp = (ULONG) (StackPtr + 8);
    KdbTrapFrame->SegSs = KGDT_R0_DATA;
    KdbTrapFrame->SegCs = KGDT_R0_CODE;
    KdbTrapFrame->SegDs = KGDT_R0_DATA;
    KdbTrapFrame->SegEs = KGDT_R0_DATA;
    KdbTrapFrame->SegGs = KGDT_R0_DATA;
#endif
 
    /* FIXME: what about the other registers??? */
}

Referenced by KdbpAttachToThread().

KdbpOverwriteInstruction()

static NTSTATUS KdbpOverwriteInstruction ( IN PEPROCESS  Process, IN ULONG_PTR  Address, IN UCHAR  NewInst, OUT PUCHAR OldInst  OPTIONAL  )

static

Overwrites the instruction at Address with NewInst and stores the old instruction in *OldInst.

Parameters

Process	Process in which's context to overwrite the instruction.
Address	Address at which to overwrite the instruction.
NewInst	New instruction (written to Address)
OldInst	Old instruction (read from Address)

Returns

NTSTATUS

Definition at line 155 of file kdb.c.

{
    NTSTATUS Status;
    ULONG Protect;
    PEPROCESS CurrentProcess = PsGetCurrentProcess();
    KAPC_STATE ApcState;
 
    /* Get the protection for the address. */
    Protect = MmGetPageProtect(Process, (PVOID)PAGE_ROUND_DOWN(Address));
 
    /* Return if that page isn't present. */
    if (Protect & PAGE_NOACCESS)
    {
        return STATUS_MEMORY_NOT_ALLOCATED;
    }
 
    /* Attach to the process */
    if (CurrentProcess != Process)
    {
        KeStackAttachProcess(&Process->Pcb, &ApcState);
    }
 
    /* Make the page writeable if it is read only. */
    if (Protect & (PAGE_READONLY|PAGE_EXECUTE|PAGE_EXECUTE_READ))
    {
        MmSetPageProtect(Process, (PVOID)PAGE_ROUND_DOWN(Address),
                         (Protect & ~(PAGE_READONLY|PAGE_EXECUTE|PAGE_EXECUTE_READ)) | PAGE_READWRITE);
    }
 
    /* Copy the old instruction back to the caller. */
    if (OldInst)
    {
        Status = KdbpSafeReadMemory(OldInst, (PUCHAR)Address, 1);
        if (!NT_SUCCESS(Status))
        {
            if (Protect & (PAGE_READONLY|PAGE_EXECUTE|PAGE_EXECUTE_READ))
            {
                MmSetPageProtect(Process, (PVOID)PAGE_ROUND_DOWN(Address), Protect);
            }
 
            /* Detach from process */
            if (CurrentProcess != Process)
            {
                KeUnstackDetachProcess(&ApcState);
            }
 
            return Status;
        }
    }
 
    /* Copy the new instruction in its place. */
    Status = KdbpSafeWriteMemory((PUCHAR)Address, &NewInst, 1);
 
    /* Restore the page protection. */
    if (Protect & (PAGE_READONLY|PAGE_EXECUTE|PAGE_EXECUTE_READ))
    {
        MmSetPageProtect(Process, (PVOID)PAGE_ROUND_DOWN(Address), Protect);
    }
 
    /* Detach from process */
    if (CurrentProcess != Process)
    {
        KeUnstackDetachProcess(&ApcState);
    }
 
    return Status;
}

Referenced by KdbEnterDebuggerException(), KdbpDisableBreakPoint(), and KdbpEnableBreakPoint().

KdbpSafeReadMemory()

NTSTATUS KdbpSafeReadMemory	(	OUT PVOID	Dest,
		IN PVOID	Src,
		IN ULONG	Bytes
	)

Definition at line 1657 of file kdb.c.

{
    return KdpCopyMemoryChunks((ULONG64)(ULONG_PTR)Src,
                               Dest,
                               Bytes,
                               0,
                               MMDBG_COPY_UNSAFE,
                               NULL);
}

Referenced by KdbpCmdBackTrace(), KdbpCmdDisassembleX(), KdbpCmdGdtLdtIdt(), KdbpCmdThread(), KdbpOverwriteInstruction(), KdbpReadMemory(), KdbpShouldStepOverInstruction(), KdbpStepIntoInstruction(), and RpnpEvaluateStack().

KdbpSafeWriteMemory()

NTSTATUS KdbpSafeWriteMemory	(	OUT PVOID	Dest,
		IN PVOID	Src,
		IN ULONG	Bytes
	)

Definition at line 1671 of file kdb.c.

{
    return KdpCopyMemoryChunks((ULONG64)(ULONG_PTR)Dest,
                               Src,
                               Bytes,
                               0,
                               MMDBG_COPY_UNSAFE | MMDBG_COPY_WRITE,
                               NULL);
}

Referenced by KdbpOverwriteInstruction().

KdbpSetEnterCondition()

BOOLEAN KdbpSetEnterCondition	(	IN LONG	ExceptionNr,
		IN BOOLEAN	FirstChance,
		IN KDB_ENTER_CONDITION	Condition
	)

Sets the first or last chance enter-condition for exception nr. ExceptionNr.

Parameters

ExceptionNr	Number of the exception to set condition of (-1 for all)
FirstChance	Whether to set first or last chance condition.
Condition	The new condition setting.

Return values

TRUE	Success.
FALSE	Failure (invalid exception nr)

Definition at line 995 of file kdb.c.

{
    if (ExceptionNr < 0)
    {
        for (ExceptionNr = 0; ExceptionNr < (LONG)RTL_NUMBER_OF(KdbEnterConditions); ExceptionNr++)
        {
            if (ExceptionNr == 1 || ExceptionNr == 8 ||
                ExceptionNr == 9 || ExceptionNr == 15) /* Reserved exceptions */
            {
                continue;
            }
 
            KdbEnterConditions[ExceptionNr][FirstChance ? 0 : 1] = Condition;
        }
    }
    else
    {
        if (ExceptionNr >= (LONG)RTL_NUMBER_OF(KdbEnterConditions) ||
            ExceptionNr == 1 || ExceptionNr == 8 || /* Do not allow changing of the debug */
            ExceptionNr == 9 || ExceptionNr == 15)  /* trap or reserved exceptions */
        {
            return FALSE;
        }
 
        KdbEnterConditions[ExceptionNr][FirstChance ? 0 : 1] = Condition;
    }
 
    return TRUE;
}

Referenced by KdbpCmdSet(), and KdbpGetCommandLineSettings().

KdbpShouldStepOverInstruction()

BOOLEAN KdbpShouldStepOverInstruction

(

ULONG_PTR

Eip

)

Checks whether the given instruction can be single stepped or has to be stepped over using a temporary breakpoint.

Return values

TRUE	Instruction is a call.
FALSE	Instruction is not a call.

Definition at line 234 of file kdb.c.

{
    UCHAR Mem[3];
    ULONG i = 0;
 
    if (!NT_SUCCESS(KdbpSafeReadMemory(Mem, (PVOID)Eip, sizeof (Mem))))
    {
        KdbPrintf("Couldn't access memory at 0x%p\n", Eip);
        return FALSE;
    }
 
    /* Check if the current instruction is a call. */
    while ((i < sizeof (Mem)) && (Mem[i] == 0x66 || Mem[i] == 0x67))
        i++;
 
    if (i == sizeof (Mem))
        return FALSE;
 
    if (Mem[i] == 0xE8 || Mem[i] == 0x9A || Mem[i] == 0xF2 || Mem[i] == 0xF3 ||
        (((i + 1) < sizeof (Mem)) && Mem[i] == 0xFF && (Mem[i+1] & 0x38) == 0x10))
    {
        return TRUE;
    }
 
    return FALSE;
}

Referenced by KdbpStepOverInstruction().

KdbpStepIntoInstruction()

BOOLEAN KdbpStepIntoInstruction

(

ULONG_PTR

Eip

)

Steps into an instruction (interrupts)

If the given instruction should be stepped into, this function inserts a temporary breakpoint at the target instruction and returns TRUE, otherwise it returns FALSE.

Return values

TRUE	Temporary breakpoint set at target instruction.
FALSE	No breakpoint was set.

Definition at line 300 of file kdb.c.

{
    KDESCRIPTOR Idtr = {0};
    UCHAR Mem[2];
    INT IntVect;
    ULONG IntDesc[2];
    ULONG_PTR TargetEip;
 
    /* Read memory */
    if (!NT_SUCCESS(KdbpSafeReadMemory(Mem, (PVOID)Eip, sizeof (Mem))))
    {
        // KdbPrintf("Couldn't access memory at 0x%p\n", Eip);
        return FALSE;
    }
 
    /* Check for INT instruction */
    /* FIXME: Check for iret */
    if (Mem[0] == 0xcc)
        IntVect = 3;
    else if (Mem[0] == 0xcd)
        IntVect = Mem[1];
    else if (Mem[0] == 0xce && KdbCurrentTrapFrame->EFlags & (1<<11)) /* 1 << 11 is the overflow flag */
        IntVect = 4;
    else
        return FALSE;
 
    if (IntVect < 32) /* We should be informed about interrupts < 32 by the kernel, no need to breakpoint them */
    {
        return FALSE;
    }
 
    /* Read the interrupt descriptor table register  */
    __sidt(&Idtr.Limit);
    if (IntVect >= (Idtr.Limit + 1) / 8)
    {
        // KdbPrintf("IDT does not contain interrupt vector %d.\n", IntVect);
        return TRUE;
    }
 
    /* Get the interrupt descriptor */
    if (!NT_SUCCESS(KdbpSafeReadMemory(IntDesc, (PVOID)((ULONG_PTR)Idtr.Base + (IntVect * 8)), sizeof(IntDesc))))
    {
        // KdbPrintf("Couldn't access memory at 0x%p\n", (ULONG_PTR)Idtr.Base + (IntVect * 8));
        return FALSE;
    }
 
    /* Check descriptor and get target eip (16 bit interrupt/trap gates not supported) */
    if ((IntDesc[1] & (1 << 15)) == 0) /* not present */
    {
        return FALSE;
    }
    if ((IntDesc[1] & 0x1f00) == 0x0500) /* Task gate */
    {
        /* FIXME: Task gates not supported */
        return FALSE;
    }
    else if (((IntDesc[1] & 0x1fe0) == 0x0e00) || /* 32 bit Interrupt gate */
             ((IntDesc[1] & 0x1fe0) == 0x0f00))   /* 32 bit Trap gate */
    {
        /* FIXME: Should the segment selector of the interrupt gate be checked? */
        TargetEip = (IntDesc[1] & 0xffff0000) | (IntDesc[0] & 0x0000ffff);
    }
    else
    {
        return FALSE;
    }
 
    /* Insert breakpoint */
    if (!NT_SUCCESS(KdbpInsertBreakPoint(TargetEip, KdbBreakPointTemporary, 0, 0, NULL, FALSE, NULL)))
        return FALSE;
 
    return TRUE;
}

Referenced by KdbEnterDebuggerException().

KdbpStepOverInstruction()

BOOLEAN KdbpStepOverInstruction

(

ULONG_PTR

Eip

)

Steps over an instruction.

If the given instruction should be stepped over, this function inserts a temporary breakpoint after the instruction and returns TRUE, otherwise it returns FALSE.

Return values

TRUE	Temporary breakpoint set after instruction.
FALSE	No breakpoint was set.

Definition at line 272 of file kdb.c.

{
    LONG InstLen;
 
    if (!KdbpShouldStepOverInstruction(Eip))
        return FALSE;
 
    InstLen = KdbpGetInstLength(Eip);
    if (InstLen < 1)
        return FALSE;
 
    if (!NT_SUCCESS(KdbpInsertBreakPoint(Eip + InstLen, KdbBreakPointTemporary, 0, 0, NULL, FALSE, NULL)))
        return FALSE;
 
    return TRUE;
}

Referenced by KdbEnterDebuggerException().

Variable Documentation

ExceptionNrToString

const CHAR* ExceptionNrToString[]

static

Initial value:

=
{
    "Divide Error",
    "Debug Trap",
    "NMI",
    "Breakpoint",
    "Overflow",
    "BOUND range exceeded",
    "Invalid Opcode",
    "No Math Coprocessor",
    "Double Fault",
    "Unknown(9)",
    "Invalid TSS",
    "Segment Not Present",
    "Stack Segment Fault",
    "General Protection",
    "Page Fault",
    "Reserved(15)",
    "Math Fault",
    "Alignment Check",
    "Machine Check",
    "SIMD Fault",
    "Assertion Failure"
}

Definition at line 91 of file kdb.c.

Referenced by KdbEnterDebuggerException().

KdbApcState

KAPC_STATE KdbApcState

static

Definition at line 59 of file kdb.c.

Referenced by KdbEnterDebuggerException(), and KdbpAttachToThread().

KdbBreakPointToReenable

PKDB_BREAKPOINT KdbBreakPointToReenable = NULL

static

Definition at line 45 of file kdb.c.

Referenced by KdbEnterDebuggerException().

KdbCurrentProcess

PEPROCESS KdbCurrentProcess = NULL

Definition at line 52 of file kdb.c.

Referenced by KdbEnterDebuggerException(), KdbpAttachToProcess(), KdbpAttachToThread(), KdbpCmdProc(), KdbpCmdThread(), and KdbpInsertBreakPoint().

KdbCurrentThread

PETHREAD KdbCurrentThread = NULL

Definition at line 54 of file kdb.c.

Referenced by KdbEnterDebuggerException(), KdbpAttachToThread(), KdbpCmdProc(), and KdbpCmdThread().

KdbCurrentTrapFrame

PKDB_KTRAP_FRAME KdbCurrentTrapFrame = NULL

Definition at line 56 of file kdb.c.

Referenced by KdbEnterDebuggerException(), KdbpAttachToThread(), KdbpCliMainLoop(), KdbpCmdBackTrace(), KdbpCmdDisassembleX(), KdbpCmdRegs(), KdbpEnableBreakPoint(), KdbpEvaluateExpression(), and KdbpStepIntoInstruction().

KdbEnterConditions

KDB_ENTER_CONDITION KdbEnterConditions[][2]

static

Initial value:

=
{
    
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbEnterFromKmode,  KdbDoNotEnter },       
    { KdbDoNotEnter,      KdbEnterAlways },      
    { KdbEnterFromKmode,  KdbDoNotEnter },       
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbEnterAlways,     KdbEnterAlways },      
    { KdbEnterAlways,     KdbEnterAlways },      
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbEnterAlways,     KdbEnterAlways },      
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbDoNotEnter,      KdbEnterFromKmode },   
    { KdbEnterFromKmode,  KdbDoNotEnter },       
    { KdbDoNotEnter,      KdbEnterFromKmode }    
}

Definition at line 63 of file kdb.c.

Referenced by KdbEnterDebuggerException(), KdbpGetEnterCondition(), KdbpGetExceptionNumberFromStatus(), and KdbpSetEnterCondition().

KdbEnteredOnSingleStep

BOOLEAN KdbEnteredOnSingleStep = FALSE

static

Definition at line 51 of file kdb.c.

Referenced by KdbEnterDebuggerException(), and KdbpCallMainLoop().

KdbEntryCount

LONG KdbEntryCount = 0

static

Definition at line 36 of file kdb.c.

Referenced by KdbEnterDebuggerException().

KdbHwBreakPointCount

ULONG KdbHwBreakPointCount = 0

static

Definition at line 42 of file kdb.c.

Referenced by KdbpDisableBreakPoint(), KdbpEnableBreakPoint(), and KdbpIsBreakPointOurs().

KdbHwBreakPoints

PKDB_BREAKPOINT KdbHwBreakPoints[KDB_MAXIMUM_HW_BREAKPOINT_COUNT]

static

Definition at line 44 of file kdb.c.

Referenced by KdbpDisableBreakPoint(), KdbpEnableBreakPoint(), and KdbpIsBreakPointOurs().

KdbLastBreakPointNr

LONG KdbLastBreakPointNr = -1

Definition at line 48 of file kdb.c.

Referenced by KdbEnterDebuggerException(), and KdbpCmdBreakPointList().

KdbNumSingleSteps

ULONG KdbNumSingleSteps = 0

Definition at line 49 of file kdb.c.

Referenced by KdbEnterDebuggerException(), and KdbpCmdStep().

KdbOriginalProcess

PEPROCESS KdbOriginalProcess = NULL

Definition at line 53 of file kdb.c.

Referenced by KdbEnterDebuggerException(), and KdbpAttachToThread().

KdbOriginalThread

PETHREAD KdbOriginalThread = NULL

Definition at line 55 of file kdb.c.

Referenced by KdbEnterDebuggerException(), and KdbpAttachToThread().

KdbpBugCheckRequested

BOOLEAN KdbpBugCheckRequested

extern

Definition at line 138 of file kdb_cli.c.

Referenced by KdbEnterDebuggerException(), and KdbpCmdBugCheck().

KdbpEvenThoughWeHaveABreakPointToReenableWeAlsoHaveARealSingleStep

BOOLEAN KdbpEvenThoughWeHaveABreakPointToReenableWeAlsoHaveARealSingleStep

static

Definition at line 47 of file kdb.c.

Referenced by KdbEnterDebuggerException().

KdbSingleStepOver

BOOLEAN KdbSingleStepOver = FALSE

Definition at line 50 of file kdb.c.

Referenced by KdbEnterDebuggerException(), and KdbpCmdStep().

KdbSwBreakPointCount

ULONG KdbSwBreakPointCount = 0

static

Definition at line 41 of file kdb.c.

Referenced by KdbpDisableBreakPoint(), KdbpEnableBreakPoint(), and KdbpIsBreakPointOurs().

KdbSwBreakPoints

PKDB_BREAKPOINT KdbSwBreakPoints[KDB_MAXIMUM_SW_BREAKPOINT_COUNT]

static

Definition at line 43 of file kdb.c.

Referenced by KdbpDisableBreakPoint(), KdbpEnableBreakPoint(), and KdbpIsBreakPointOurs().

KdbThreadTrapFrame

KDB_KTRAP_FRAME KdbThreadTrapFrame = { 0 }

static

Definition at line 58 of file kdb.c.

Referenced by KdbpAttachToThread().

KdbTrapFrame

KDB_KTRAP_FRAME KdbTrapFrame = { 0 }

static

Definition at line 57 of file kdb.c.

Referenced by KdbEnterDebuggerException(), KdbpAttachToThread(), KdbpDisableBreakPoint(), KdbpEnableBreakPoint(), and KdbpKdbTrapFrameFromKernelStack().