5 #define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800 13 #define MAX_SYMBOL_NAME 1024 40 #if defined(__GNUC__) && \ 41 (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__ < 40400) 84 PVOID pW32pServiceTable, pW32pServiceLimit;
85 PBYTE pW32pArgumentTable;
95 printf(
"Win32k Syscall dumper\n");
96 printf(
"Copyright (c) Timo Kreuzer 2007-08\n");
102 strcat(szModuleFileName,
"\\win32k.sys");
112 strcat(szModuleFileName,
"\\win32k.sys");
122 printf(
"Trying to get syscalls from: %s\n", szModuleFileName);
126 printf(
"SymInitialize() failed\n");
130 printf(
"Loading symbols for %s, please wait...\n", szModuleFileName);
132 if (dwModuleBase == 0)
161 if (!pW32pServiceTable || !pW32pServiceLimit || !pW32pArgumentTable)
163 printf(
"Couldn't find adress!\n");
167 dwServiceLimit = *((
DWORD*)pW32pServiceLimit);
171 DWORD *pdwEntries32 = (
DWORD*)pW32pServiceTable;
173 for (
i = 0;
i < dwServiceLimit;
i++)
184 for (
i = 0;
i < dwServiceLimit;
i++)
193 printf(
"\nDumping apfnSimpleCall:\n");
200 while (pfnSC64[
i] != 0)
211 while (pfnSC32[
i] != 0)
BOOL CALLBACK EnumSymbolsProc(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext)
char * strcat(char *DstString, const char *SrcString)
DWORD WINAPI SymSetOptions(DWORD opts)
#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS
#define INVALID_HANDLE_VALUE
DWORD WINAPI GetLastError(VOID)
_In_ BOOL _In_ HANDLE hProcess
int main(int argc, char *argv[])
PVOID ImageSymToVa(HANDLE hProcess, PSYMBOL_INFO pSym, PBYTE pModule, PCSTR Name)
#define SYMOPT_DEFERRED_LOADS
#define GetCurrentDirectory
BOOL WINAPI SymInitialize(HANDLE hProcess, PCSTR UserSearchPath, BOOL fInvadeProcess)
#define IMAGE_FILE_MACHINE_I386
BOOLEAN Symbol(PVRET pvr)
DWORD64 WINAPI SymLoadModule64(HANDLE hProcess, HANDLE hFile, PCSTR ImageName, PCSTR ModuleName, DWORD64 BaseOfDll, DWORD SizeOfDll)
BOOL WINAPI SymSetSearchPath(HANDLE hProcess, PCSTR searchPath)
struct _SYMBOL_INFO SYMBOL_INFO
unsigned __int3264 UINT_PTR
#define FILE_ATTRIBUTE_NORMAL
#define GetCurrentProcess()
#define GetSystemDirectory
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
IN OUT PVCB OUT PDIRENT OUT PBCB IN BOOLEAN CreateFile
DWORD WINAPI SymGetOptions(void)
PVOID WINAPI ImageRvaToVa(_In_ PIMAGE_NT_HEADERS, _In_ PVOID, _In_ ULONG, _In_opt_ PIMAGE_SECTION_HEADER *)
BOOL InitDbgHelp(HANDLE hProcess)
BOOL WINAPI SymEnumSymbolsForAddr(HANDLE hProcess, DWORD64 Address, PSYM_ENUMERATESYMBOLS_CALLBACK Callback, PVOID pUserContext)
BOOL WINAPI SymFromName(HANDLE hProcess, PCSTR Name, PSYMBOL_INFO Symbol)
char * cleanup(char *str)
PIMAGE_NT_HEADERS WINAPI ImageNtHeader(_In_ PVOID)
HANDLE NTAPI CreateFileMappingA(IN HANDLE hFile, IN LPSECURITY_ATTRIBUTES lpFileMappingAttributes, IN DWORD flProtect, IN DWORD dwMaximumSizeHigh, IN DWORD dwMaximumSizeLow, IN LPCSTR lpName)