89{
106
107
109
110
114
115
117 {
118
125
126
128 if (NtHeader)
129 {
130
132 }
133
134
137 {
138
141 &ImageInfo);
143 }
144 else
145 {
146
149 &ImageInfo);
150 }
151
152
159
160
162 if (NtHeader)
163 {
164
166 }
167
168
170 L"\\SystemRoot\\System32\\ntdll.dll");
173 &ImageInfo);
174 }
175
176
177 DebugPort =
Process->DebugPort;
178 if (!DebugPort) return;
179
180
182 {
183
186
187
194
195
197 if (NtHeader)
198 {
199
204 PointerToSymbolTable;
206 NumberOfSymbols;
207 }
208
209
210 ApiMessage.
h.u1.Length =
sizeof(
DBGKM_MSG) << 16 |
212 ApiMessage.
h.u2.ZeroInit = 0;
215
216
218
219
221
222
227
228
230 if (NtHeader)
231 {
232
234 FileHeader.PointerToSymbolTable;
236 }
237
238
240 if (Teb)
241 {
242
247
248
250 }
251
252
269 {
270
271 ApiMessage.
h.u1.Length =
sizeof(
DBGKM_MSG) << 16 |
273 ApiMessage.
h.u2.ZeroInit = 0;
276
277
279
280
282 }
283 }
284 else
285 {
286
289
290
291 ApiMessage.
h.u1.Length =
sizeof(
DBGKM_MSG) << 16 |
293 ApiMessage.
h.u2.ZeroInit = 0;
296
297
299 }
300}
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char * ModuleName
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
NTSTATUS NTAPI DbgkpSendApiMessage(IN OUT PDBGKM_MSG ApiMsg, IN BOOLEAN SuspendProcess)
struct _DBGKM_MSG DBGKM_MSG
HANDLE NTAPI DbgkpSectionToFileHandle(IN PVOID Section)
#define NT_SUCCESS(StatCode)
HANDLE WINAPI DECLSPEC_HOTPATCH CreateThread(IN LPSECURITY_ATTRIBUTES lpThreadAttributes, IN DWORD dwStackSize, IN LPTHREAD_START_ROUTINE lpStartAddress, IN LPVOID lpParameter, IN DWORD dwCreationFlags, OUT LPDWORD lpThreadId)
#define PsGetCurrentThread()
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
#define FILE_SYNCHRONOUS_IO_NONALERT
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
_Must_inspect_result_ _Outptr_ PVOID * SectionObject
#define PSF_CREATE_REPORTED_BIT
#define PSF_IMAGE_NOTIFY_DONE_BIT
#define OBJ_KERNEL_HANDLE
#define OBJ_CASE_INSENSITIVE
#define OBJ_FORCE_ACCESS_CHECK
#define IMAGE_ADDRESSING_MODE_32BIT
static OUT PIO_STATUS_BLOCK IoStatusBlock
#define InitializeObjectAttributes(p, n, a, r, s)
NTSYSAPI NTSTATUS NTAPI ZwOpenFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG ShareAccess, _In_ ULONG OpenOptions)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define FILE_SHARE_DELETE
NTSTATUS NTAPI MmGetFileNameForSection(IN PVOID Section, OUT POBJECT_NAME_INFORMATION *ModuleName)
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
UNICODE_STRING PsNtDllPathName
BOOLEAN PsImageNotifyEnabled
FORCEINLINE VOID PspRunLoadImageNotifyRoutines(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo)
#define PspSetProcessFlag(Process, Flag)
_CRTIMP wchar_t *__cdecl wcsncpy(wchar_t *_Dest, const wchar_t *_Source, size_t _Count)
ULONG DebugInfoFileOffset
DBGKM_CREATE_THREAD CreateThread
DBGKM_CREATE_PROCESS CreateProcess
DBGKM_APINUMBER ApiNumber
ULONG ImageAddressingMode
PVOID ArbitraryUserPointer
WCHAR StaticUnicodeBuffer[261]
#define PsGetCurrentProcess