ReactOS 0.4.16-dev-816-g135a9a9
kdfuncs.h File Reference
#include <umtypes.h>
#include <kdtypes.h>
Include dependency graph for kdfuncs.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

NTSTATUS NTAPI KdSystemDebugControl (_In_ SYSDBG_COMMAND Command, _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG ReturnLength, _In_ KPROCESSOR_MODE PreviousMode)
 Perform various queries to the kernel debugger.
 
BOOLEAN NTAPI KdPollBreakIn (VOID)
 
NTSYSCALLAPI NTSTATUS NTAPI NtQueryDebugFilterState (_In_ ULONG ComponentId, _In_ ULONG Level)
 
NTSYSCALLAPI NTSTATUS NTAPI NtSetDebugFilterState (_In_ ULONG ComponentId, _In_ ULONG Level, _In_ BOOLEAN State)
 
NTSYSCALLAPI NTSTATUS NTAPI NtSystemDebugControl (_In_ SYSDBG_COMMAND Command, _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG ReturnLength)
 Perform various queries to the kernel debugger.
 
NTSYSAPI NTSTATUS NTAPI ZwQueryDebugFilterState (ULONG ComponentId, ULONG Level)
 
NTSYSAPI NTSTATUS NTAPI ZwSetDebugFilterState (ULONG ComponentId, ULONG Level, BOOLEAN State)
 
NTSYSAPI NTSTATUS NTAPI ZwSystemDebugControl (_In_ SYSDBG_COMMAND Command, _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG ReturnLength)
 

Function Documentation

◆ KdPollBreakIn()

BOOLEAN NTAPI KdPollBreakIn ( VOID  )

Definition at line 75 of file kdlock.c.

76{
77 BOOLEAN DoBreak = FALSE, Enable;
78
79 /* First make sure that KD is enabled */
81 {
82 /* Disable interrupts */
84
85 /* Check if a CTRL-C is in the queue */
87 {
88 /* Set it and prepare for break */
90 DoBreak = TRUE;
92 }
93 else
94 {
96 /* Try to acquire the lock */
99 {
100 /* Now get a packet */
102 NULL,
103 NULL,
104 NULL,
106 {
107 /* Successful breakin */
108 DoBreak = TRUE;
110 }
111
112 /* Let go of the port */
114 }
116 }
117
118 /* Re-enable interrupts */
120 }
121
122 /* Tell the caller to do a break */
123 return DoBreak;
124}
unsigned char BOOLEAN
#define NULL
Definition: types.h:112
#define TRUE
Definition: types.h:120
#define FALSE
Definition: types.h:117
UCHAR KIRQL
Definition: env_spec_w32.h:591
#define KeRaiseIrql(irql, oldIrql)
Definition: env_spec_w32.h:597
#define HIGH_LEVEL
Definition: env_spec_w32.h:703
#define KeLowerIrql(oldIrql)
Definition: env_spec_w32.h:602
KSPIN_LOCK KdpDebuggerLock
Definition: kddata.c:67
KD_CONTEXT KdpContext
Definition: kddata.c:65
BOOLEAN KdpControlCPressed
Definition: kddata.c:68
BOOLEAN KdDebuggerEnabled
Definition: kddata.c:82
KDP_STATUS NTAPI KdReceivePacket(IN ULONG PacketType, OUT PSTRING MessageHeader, OUT PSTRING MessageData, OUT PULONG DataLength, IN OUT PKD_CONTEXT KdContext)
Definition: kddll.c:80
VOID NTAPI KdpPortUnlock(VOID)
Definition: kdlock.c:27
_In_ ULONGLONG _In_ ULONGLONG _In_ BOOLEAN Enable
Definition: ntddpcm.h:142
FORCEINLINE BOOLEAN KeDisableInterrupts(VOID)
Definition: ke.h:239
FORCEINLINE VOID KeRestoreInterrupts(BOOLEAN WereEnabled)
Definition: ke.h:254
BOOLEAN FASTCALL KeTryToAcquireSpinLockAtDpcLevel(IN OUT PKSPIN_LOCK SpinLock)
Definition: spinlock.c:309
#define KdPacketReceived
Definition: kddll.h:5
BOOLEAN KdpControlCPending
Definition: windbgkd.h:227
#define PACKET_TYPE_KD_POLL_BREAKIN
Definition: windbgkd.h:49
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
Definition: kefuncs.h:778

Referenced by KdInitSystem(), KeUpdateSystemTime(), KiInitializeSystem(), and KiSystemStartup().

◆ KdSystemDebugControl()

NTSTATUS NTAPI KdSystemDebugControl ( _In_ SYSDBG_COMMAND  Command,
_In_reads_bytes_(InputBufferLength) PVOID  InputBuffer,
_In_ ULONG  InputBufferLength,
_Out_writes_bytes_(OutputBufferLength) PVOID  OutputBuffer,
_In_ ULONG  OutputBufferLength,
_Out_opt_ PULONG  ReturnLength,
_In_ KPROCESSOR_MODE  PreviousMode 
)

Perform various queries to the kernel debugger.

Parameters
[in]CommandA SYSDBG_COMMAND value describing the kernel debugger command to perform.
[in]InputBufferPointer to a user-provided input command-specific buffer, whose length is given by InputBufferLength.
[in]InputBufferLengthThe size (in bytes) of the buffer pointed by InputBuffer.
[out]OutputBufferPointer to a user-provided command-specific output buffer, whose length is given by OutputBufferLength.
[in]OutputBufferLengthThe size (in bytes) of the buffer pointed by OutputBuffer.
[out]ReturnLengthOptional pointer to a ULONG variable that receives the actual length of data written written in the output buffer. It is always zero, except for the live dump commands where an actual non-zero length is returned.
[in]PreviousModeThe processor mode (KernelMode or UserMode) in which the command is being executed.
Returns
STATUS_SUCCESS in case of success, or a proper error code otherwise.
Remarks
  • This is a kernel-mode function, accessible only by kernel-mode drivers.
Note
See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2339
See also
NtSystemDebugControl()

Definition at line 2217 of file kdapi.c.

2225{
2227 ULONG Length = 0;
2228
2229 /* Handle some internal commands */
2230 switch ((ULONG)Command)
2231 {
2232#if DBG
2233 case ' soR': /* ROS-INTERNAL */
2234 {
2235 switch ((ULONG_PTR)InputBuffer)
2236 {
2237 case 0x21: // DumpAllThreads:
2239 break;
2240
2241 case 0x22: // DumpUserThreads:
2243 break;
2244
2245 case 0x24: // KdSpare3:
2247 break;
2248
2249 default:
2250 break;
2251 }
2252 return STATUS_SUCCESS;
2253 }
2254
2255#if defined(_M_IX86) && !defined(_WINKD_) // See ke/i386/traphdlr.c
2256 /* Register a debug callback */
2257 case 'CsoR':
2258 {
2259 switch (InputBufferLength)
2260 {
2261 case ID_Win32PreServiceHook:
2262 KeWin32PreServiceHook = InputBuffer;
2263 break;
2264
2265 case ID_Win32PostServiceHook:
2266 KeWin32PostServiceHook = InputBuffer;
2267 break;
2268
2269 }
2270 break;
2271 }
2272#endif
2273
2274 /* Special case for stack frame dumps */
2275 case 'DsoR':
2276 {
2278 break;
2279 }
2280#ifdef KDBG
2281 /* Register KDBG CLI callback */
2282 case 'RbdK':
2283 {
2285 }
2286#endif // KDBG
2287#endif
2288 default:
2289 break;
2290 }
2291
2292 switch (Command)
2293 {
2294 case SysDbgQueryVersion:
2296 {
2298 }
2299 else
2300 {
2303 }
2304 break;
2305
2306 case SysDbgReadVirtual:
2307 case SysDbgWriteVirtual:
2308 if (InputBufferLength != sizeof(SYSDBG_VIRTUAL))
2309 {
2311 }
2312 else
2313 {
2315 PVOID LockedBuffer;
2316 PMDL LockVariable;
2317
2319 Request.Request,
2322 &LockedBuffer,
2323 &LockVariable);
2324 if (NT_SUCCESS(Status))
2325 {
2327 Request.Buffer,
2328 Request.Request,
2329 0,
2331 &Length);
2332 ExUnlockUserBuffer(LockVariable);
2333 }
2334 }
2335 break;
2336
2337 case SysDbgReadPhysical:
2339 if (InputBufferLength != sizeof(SYSDBG_PHYSICAL))
2340 {
2342 }
2343 else
2344 {
2346 PVOID LockedBuffer;
2347 PMDL LockVariable;
2348
2350 Request.Request,
2353 &LockedBuffer,
2354 &LockVariable);
2355 if (NT_SUCCESS(Status))
2356 {
2357 Status = KdpCopyMemoryChunks(Request.Address.QuadPart,
2358 Request.Buffer,
2359 Request.Request,
2360 0,
2362 &Length);
2363 ExUnlockUserBuffer(LockVariable);
2364 }
2365 }
2366 break;
2367
2370 {
2372 }
2373 else
2374 {
2376 PVOID LockedBuffer;
2377 PMDL LockVariable;
2378
2380 Request.Request,
2383 &LockedBuffer,
2384 &LockVariable);
2385 if (NT_SUCCESS(Status))
2386 {
2388 Request.Address,
2389 LockedBuffer,
2390 Request.Request,
2391 &Length);
2392 ExUnlockUserBuffer(LockVariable);
2393 }
2394 }
2395 break;
2396
2399 {
2401 }
2402 else
2403 {
2405 PVOID LockedBuffer;
2406 PMDL LockVariable;
2407
2409 Request.Request,
2412 &LockedBuffer,
2413 &LockVariable);
2414 if (NT_SUCCESS(Status))
2415 {
2417 Request.Address,
2418 LockedBuffer,
2419 Request.Request,
2420 &Length);
2421 ExUnlockUserBuffer(LockVariable);
2422 }
2423 }
2424 break;
2425
2426 case SysDbgReadIoSpace:
2427 if (InputBufferLength != sizeof(SYSDBG_IO_SPACE))
2428 {
2430 }
2431 else
2432 {
2434 PVOID LockedBuffer;
2435 PMDL LockVariable;
2436
2438 Request.Request,
2441 &LockedBuffer,
2442 &LockVariable);
2443 if (NT_SUCCESS(Status))
2444 {
2445 Status = KdpSysReadIoSpace(Request.InterfaceType,
2446 Request.BusNumber,
2447 Request.AddressSpace,
2448 Request.Address,
2449 LockedBuffer,
2450 Request.Request,
2451 &Length);
2452 ExUnlockUserBuffer(LockVariable);
2453 }
2454 }
2455 break;
2456
2457 case SysDbgWriteIoSpace:
2458 if (InputBufferLength != sizeof(SYSDBG_IO_SPACE))
2459 {
2461 }
2462 else
2463 {
2465 PVOID LockedBuffer;
2466 PMDL LockVariable;
2467
2469 Request.Request,
2472 &LockedBuffer,
2473 &LockVariable);
2474 if (NT_SUCCESS(Status))
2475 {
2476 Status = KdpSysWriteIoSpace(Request.InterfaceType,
2477 Request.BusNumber,
2478 Request.AddressSpace,
2479 Request.Address,
2480 LockedBuffer,
2481 Request.Request,
2482 &Length);
2483 ExUnlockUserBuffer(LockVariable);
2484 }
2485 }
2486 break;
2487
2488 case SysDbgReadMsr:
2489 if (InputBufferLength != sizeof(SYSDBG_MSR))
2490 {
2492 }
2493 else
2494 {
2496 Status = KdpSysReadMsr(Request->Address, &Request->Data);
2497 }
2498 break;
2499
2500 case SysDbgWriteMsr:
2501 if (InputBufferLength != sizeof(SYSDBG_MSR))
2502 {
2504 }
2505 else
2506 {
2508 Status = KdpSysWriteMsr(Request->Address, &Request->Data);
2509 }
2510 break;
2511
2512 case SysDbgReadBusData:
2513 if (InputBufferLength != sizeof(SYSDBG_BUS_DATA))
2514 {
2516 }
2517 else
2518 {
2520 PVOID LockedBuffer;
2521 PMDL LockVariable;
2522
2524 Request.Request,
2527 &LockedBuffer,
2528 &LockVariable);
2529 if (NT_SUCCESS(Status))
2530 {
2531 Status = KdpSysReadBusData(Request.BusDataType,
2532 Request.BusNumber,
2533 Request.SlotNumber,
2534 Request.Address,
2535 LockedBuffer,
2536 Request.Request,
2537 &Length);
2538 ExUnlockUserBuffer(LockVariable);
2539 }
2540 }
2541 break;
2542
2543 case SysDbgWriteBusData:
2544 if (InputBufferLength != sizeof(SYSDBG_BUS_DATA))
2545 {
2547 }
2548 else
2549 {
2551 PVOID LockedBuffer;
2552 PMDL LockVariable;
2553
2555 Request.Request,
2558 &LockedBuffer,
2559 &LockVariable);
2560 if (NT_SUCCESS(Status))
2561 {
2562 Status = KdpSysWriteBusData(Request.BusDataType,
2563 Request.BusNumber,
2564 Request.SlotNumber,
2565 Request.Address,
2566 LockedBuffer,
2567 Request.Request,
2568 &Length);
2569 ExUnlockUserBuffer(LockVariable);
2570 }
2571 }
2572 break;
2573
2576 break;
2577
2578 default:
2580 break;
2581 }
2582
2583 if (ReturnLength)
2585
2586 return Status;
2587}
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG ReturnLength
_In_ PVOID _In_ ULONG _Out_ PVOID _In_ ULONG _Inout_ PULONG _In_ KPROCESSOR_MODE PreviousMode
LONG NTSTATUS
Definition: precomp.h:26
#define NT_SUCCESS(StatCode)
Definition: apphelp.c:33
#define KeRosDumpStackFrames(Frames, Count)
Definition: gdidebug.h:11
Status
Definition: gdiplustypes.h:25
NTSTATUS NTAPI KdpSysWriteBusData(_In_ BUS_DATA_TYPE BusDataType, _In_ ULONG BusNumber, _In_ ULONG SlotNumber, _In_ ULONG Offset, _In_reads_bytes_(Length) PVOID Buffer, _In_ ULONG Length, _Out_ PULONG ActualLength)
Definition: kdx64.c:151
NTSTATUS NTAPI KdpSysCheckLowMemory(IN ULONG Flags)
Definition: kdx64.c:364
NTSTATUS NTAPI KdpSysWriteIoSpace(_In_ INTERFACE_TYPE InterfaceType, _In_ ULONG BusNumber, _In_ ULONG AddressSpace, _In_ ULONG64 IoAddress, _In_reads_bytes_(DataSize) PVOID DataValue, _In_ ULONG DataSize, _Out_ PULONG ActualDataSize)
Definition: kdx64.c:307
NTSTATUS NTAPI KdpSysWriteMsr(_In_ ULONG Msr, _In_ PULONGLONG MsrValue)
Definition: kdx64.c:116
NTSTATUS NTAPI KdpSysReadMsr(_In_ ULONG Msr, _Out_ PULONGLONG MsrValue)
Definition: kdx64.c:96
NTSTATUS NTAPI KdpSysReadControlSpace(_In_ ULONG Processor, _In_ ULONG64 BaseAddress, _Out_writes_bytes_(Length) PVOID Buffer, _In_ ULONG Length, _Out_ PULONG ActualLength)
Definition: kdx64.c:166
NTSTATUS NTAPI KdpSysReadBusData(_In_ BUS_DATA_TYPE BusDataType, _In_ ULONG BusNumber, _In_ ULONG SlotNumber, _In_ ULONG Offset, _Out_writes_bytes_(Length) PVOID Buffer, _In_ ULONG Length, _Out_ PULONG ActualLength)
Definition: kdx64.c:136
NTSTATUS NTAPI KdpSysWriteControlSpace(_In_ ULONG Processor, _In_ ULONG64 BaseAddress, _In_reads_bytes_(Length) PVOID Buffer, _In_ ULONG Length, _Out_ PULONG ActualLength)
Definition: kdx64.c:218
NTSTATUS NTAPI KdpSysReadIoSpace(_In_ INTERFACE_TYPE InterfaceType, _In_ ULONG BusNumber, _In_ ULONG AddressSpace, _In_ ULONG64 IoAddress, _Out_writes_bytes_(DataSize) PVOID DataValue, _In_ ULONG DataSize, _Out_ PULONG ActualDataSize)
Definition: kdx64.c:250
VOID NTAPI PspDumpThreads(BOOLEAN SystemThreads)
NTSTATUS NTAPI KdpCopyMemoryChunks(_In_ ULONG64 Address, _In_ PVOID Buffer, _In_ ULONG TotalSize, _In_ ULONG ChunkSize, _In_ ULONG Flags, _Out_opt_ PULONG ActualSize)
Definition: kdapi.c:55
VOID NTAPI KdpSysGetVersion(_Out_ PDBGKD_GET_VERSION64 Version)
Definition: kdapi.c:433
BOOLEAN NTAPI KdbRegisterCliCallback(PVOID Callback, BOOLEAN Deregister)
Definition: kdb_cli.c:3203
unsigned __int64 ULONG64
Definition: imports.h:198
struct _SYSDBG_MSR * PSYSDBG_MSR
struct _SYSDBG_CONTROL_SPACE * PSYSDBG_CONTROL_SPACE
struct _SYSDBG_BUS_DATA * PSYSDBG_BUS_DATA
struct _SYSDBG_PHYSICAL * PSYSDBG_PHYSICAL
@ SysDbgCheckLowMemory
Definition: kdtypes.h:82
@ SysDbgReadPhysical
Definition: kdtypes.h:72
@ SysDbgReadMsr
Definition: kdtypes.h:78
@ SysDbgWriteControlSpace
Definition: kdtypes.h:75
@ SysDbgWriteBusData
Definition: kdtypes.h:81
@ SysDbgWriteVirtual
Definition: kdtypes.h:71
@ SysDbgWritePhysical
Definition: kdtypes.h:73
@ SysDbgQueryVersion
Definition: kdtypes.h:69
@ SysDbgReadControlSpace
Definition: kdtypes.h:74
@ SysDbgReadBusData
Definition: kdtypes.h:80
@ SysDbgReadIoSpace
Definition: kdtypes.h:76
@ SysDbgWriteMsr
Definition: kdtypes.h:79
@ SysDbgReadVirtual
Definition: kdtypes.h:70
@ SysDbgWriteIoSpace
Definition: kdtypes.h:77
struct _SYSDBG_IO_SPACE * PSYSDBG_IO_SPACE
struct _SYSDBG_VIRTUAL * PSYSDBG_VIRTUAL
_In_ ULONG _In_ ULONG _In_ ULONG Length
Definition: ntddpcm.h:102
VOID NTAPI ExUnlockUserBuffer(PMDL Mdl)
Definition: sysinfo.c:194
NTSTATUS NTAPI ExLockUserBuffer(PVOID BaseAddress, ULONG Length, KPROCESSOR_MODE AccessMode, LOCK_OPERATION Operation, PVOID *MappedSystemVa, PMDL *OutMdl)
Definition: sysinfo.c:202
#define MMDBG_COPY_PHYSICAL
Definition: mm.h:76
VOID NTAPI MmDumpArmPfnDatabase(IN BOOLEAN StatusOnly)
Definition: mminit.c:1465
#define MMDBG_COPY_WRITE
Definition: mm.h:75
#define STATUS_INVALID_INFO_CLASS
Definition: ntstatus.h:240
#define STATUS_SUCCESS
Definition: shellext.h:65
Definition: shell.h:41
uint32_t * PULONG_PTR
Definition: typedefs.h:65
uint32_t ULONG_PTR
Definition: typedefs.h:65
uint32_t ULONG
Definition: typedefs.h:59
#define STATUS_INFO_LENGTH_MISMATCH
Definition: udferr_usr.h:133
_In_ WDFREQUEST Request
Definition: wdfdevice.h:547
_In_ WDFREQUEST _In_ size_t OutputBufferLength
Definition: wdfio.h:320
_In_ WDFREQUEST _In_ size_t _In_ size_t InputBufferLength
Definition: wdfio.h:322
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR OutputBuffer
Definition: wdfiotarget.h:863
_Must_inspect_result_ _In_ WDFIOTARGET _In_opt_ WDFREQUEST _In_opt_ PWDF_MEMORY_DESCRIPTOR InputBuffer
Definition: wdfiotarget.h:953
@ IoReadAccess
Definition: ketypes.h:863
@ IoWriteAccess
Definition: ketypes.h:864

Referenced by DriverEntry(), i8042KbdInterruptService(), KdbpCmdRegs(), KdRosDumpStackFrames(), KdRosSetDebugCallback(), and NtSystemDebugControl().

◆ NtQueryDebugFilterState()

NTSYSCALLAPI NTSTATUS NTAPI NtQueryDebugFilterState ( _In_ ULONG  ComponentId,
_In_ ULONG  Level 
)

Definition at line 2712 of file kdapi.c.

2715{
2716 PULONG Mask;
2717
2718 /* Check if the ID fits in the component table */
2720 {
2721 /* It does, so get the mask from there */
2723 }
2724 else if (ComponentId == MAXULONG)
2725 {
2726 /*
2727 * This is the internal ID used for DbgPrint messages without ID
2728 * and Level. Use the system-wide mask for those.
2729 */
2731 }
2732 else
2733 {
2734#if (NTDDI_VERSION >= NTDDI_VISTA)
2735 /* Use the default component ID */
2737 // Level = DPFLTR_INFO_LEVEL; // Override the Level.
2738#else
2739 /* Invalid ID, fail */
2741#endif
2742 }
2743
2744 /* Convert Level to bit field if required */
2745 if (Level < 32) Level = 1 << Level;
2746 Level &= ~DPFLTR_MASK;
2747
2748 /* Determine if this Level is filtered out */
2749 if ((Kd_WIN2000_Mask & Level) || (*Mask & Level))
2750 {
2751 /* This mask will get through to the debugger */
2752 return (NTSTATUS)TRUE;
2753 }
2754 else
2755 {
2756 /* This mask is filtered out */
2757 return (NTSTATUS)FALSE;
2758 }
2759}
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char UINT32 ComponentId
Definition: acpixf.h:1281
unsigned int Mask
Definition: fpcontrol.c:82
ULONG Kd_WIN2000_Mask
Definition: kddata.c:143
ULONG KdComponentTableSize
Definition: kddata.c:484
ULONG Kd_DEFAULT_Mask
Definition: kddata.c:245
PULONG KdComponentTable[MAX_KD_COMPONENT_TABLE_ENTRIES]
Definition: kddata.c:314
#define STATUS_INVALID_PARAMETER_1
Definition: ntstatus.h:475
#define MAXULONG
Definition: typedefs.h:251
uint32_t * PULONG
Definition: typedefs.h:59
_IRQL_requires_same_ typedef _In_ ULONG _In_ UCHAR Level
Definition: wmitypes.h:56

Referenced by DbgQueryDebugFilterState(), KdpPrint(), and vDbgPrintExWithPrefixInternal().

◆ NtSetDebugFilterState()

NTSYSCALLAPI NTSTATUS NTAPI NtSetDebugFilterState ( _In_ ULONG  ComponentId,
_In_ ULONG  Level,
_In_ BOOLEAN  State 
)

Definition at line 2766 of file kdapi.c.

2770{
2771 PULONG Mask;
2772
2773 /* Modifying debug filters requires the debug privilege */
2775 {
2776 /* Fail */
2777 return STATUS_ACCESS_DENIED;
2778 }
2779
2780 /* Check if the ID fits in the component table */
2782 {
2783 /* It does, so get the mask from there */
2785 }
2786 else if (ComponentId == MAXULONG)
2787 {
2788 /*
2789 * This is the internal ID used for DbgPrint messages without ID
2790 * and Level. Use the system-wide mask for those.
2791 */
2793 }
2794 else
2795 {
2796#if (NTDDI_VERSION >= NTDDI_VISTA)
2797 /* Use the default component ID */
2799#else
2800 /* Invalid ID, fail */
2802#endif
2803 }
2804
2805 /* Convert Level to bit field if required */
2806 if (Level < 32) Level = 1 << Level;
2807 Level &= ~DPFLTR_MASK;
2808
2809 /* Set or remove the Level */
2810 if (State)
2811 *Mask |= Level;
2812 else
2813 *Mask &= ~Level;
2814
2815 return STATUS_SUCCESS;
2816}
#define ExGetPreviousMode
Definition: ex.h:143
const LUID SeDebugPrivilege
Definition: priv.c:39
BOOLEAN NTAPI SeSinglePrivilegeCheck(_In_ LUID PrivilegeValue, _In_ KPROCESSOR_MODE PreviousMode)
Checks if a single privilege is present in the context of the calling thread.
Definition: priv.c:744
#define STATUS_ACCESS_DENIED
Definition: udferr_usr.h:145

Referenced by DbgSetDebugFilterState(), and KdbpCmdFilter().

◆ NtSystemDebugControl()

NTSYSCALLAPI NTSTATUS NTAPI NtSystemDebugControl ( _In_ SYSDBG_COMMAND  Command,
_In_reads_bytes_(InputBufferLength) PVOID  InputBuffer,
_In_ ULONG  InputBufferLength,
_Out_writes_bytes_(OutputBufferLength) PVOID  OutputBuffer,
_In_ ULONG  OutputBufferLength,
_Out_opt_ PULONG  ReturnLength 
)

Perform various queries to the kernel debugger.

Parameters
[in]CommandA SYSDBG_COMMAND value describing the kernel debugger command to perform.
[in]InputBufferPointer to a user-provided input command-specific buffer, whose length is given by InputBufferLength.
[in]InputBufferLengthThe size (in bytes) of the buffer pointed by InputBuffer.
[out]OutputBufferPointer to a user-provided command-specific output buffer, whose length is given by OutputBufferLength.
[in]OutputBufferLengthThe size (in bytes) of the buffer pointed by OutputBuffer.
[out]ReturnLengthOptional pointer to a ULONG variable that receives the actual length of data written written in the output buffer. It is always zero, except for the live dump commands where an actual non-zero length is returned.
Returns
STATUS_SUCCESS in case of success, or a proper error code otherwise.
Remarks
  • The caller must have SeDebugPrivilege, otherwise the function fails with STATUS_ACCESS_DENIED.
  • Only the live dump commands: SysDbgGetTriageDump, and SysDbgGetLiveKernelDump (Win8.1+) are available even if the debugger is disabled or absent.
  • The following system-critical commands are not accessible anymore for user-mode usage with this API on NT 5.2+ (Windows 2003 SP1 and later) systems:

    SysDbgQueryVersion, SysDbgReadVirtual and SysDbgWriteVirtual, SysDbgReadPhysical and SysDbgWritePhysical, SysDbgReadControlSpace and SysDbgWriteControlSpace, SysDbgReadIoSpace and SysDbgWriteIoSpace, SysDbgReadMsr and SysDbgWriteMsr, SysDbgReadBusData and SysDbgWriteBusData, SysDbgCheckLowMemory.

    For these, NtSystemDebugControl() will return STATUS_NOT_IMPLEMENTED. They are now available from kernel-mode only with KdSystemDebugControl().

Note
See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2339
See also
KdSystemDebugControl()

Definition at line 209 of file dbgctrl.c.

216{
218 ULONG Length = 0;
220
221 /* Debugger controlling requires the debug privilege */
224
226 {
228 {
233 if (ReturnLength)
235 }
236
237 switch (Command)
238 {
240 /* Removed in WinNT4 */
242 break;
243
244#ifdef _M_IX86
252 break;
253#endif
254
264 case SysDbgReadMsr:
265 case SysDbgWriteMsr:
269 /* Those are implemented in KdSystemDebugControl */
270 if (InitIsWinPEMode)
271 {
276 }
277 else
278 {
280 }
281 break;
282
283 case SysDbgBreakPoint:
285 {
288 }
289 else
290 {
292 }
293 break;
294
297 break;
298
301 break;
302
304 if (OutputBufferLength != sizeof(BOOLEAN))
305 {
307 }
308 else
309 {
312 }
313 break;
314
316 if (InputBufferLength != sizeof(BOOLEAN))
317 {
319 }
320 else if (KdPitchDebugger)
321 {
323 }
324 else
325 {
328 }
329 break;
330
332 if (OutputBufferLength != sizeof(ULONG))
333 {
335 }
336 else
337 {
338 /* Return buffer size only if KD is enabled */
341 }
342 break;
343
347 break;
348
350 if (OutputBufferLength != sizeof(BOOLEAN))
351 {
353 }
354 else
355 {
356 /* Unfortunately, the internal flag says if UM exceptions are disabled */
359 }
360 break;
361
363 if (InputBufferLength != sizeof(BOOLEAN))
364 {
366 }
367 else if (KdPitchDebugger)
368 {
370 }
371 else
372 {
373 /* Unfortunately, the internal flag says if UM exceptions are disabled */
376 }
377 break;
378
382 break;
383
385 if (OutputBufferLength != sizeof(BOOLEAN))
386 {
388 }
389 else
390 {
393 }
394 break;
395
402 &Length);
403 break;
404
405 default:
407 break;
408 }
409
410 if (ReturnLength)
412
413 _SEH2_YIELD(return Status);
414 }
416 {
418 }
419 _SEH2_END;
420}
#define UNIMPLEMENTED
Definition: ntoskrnl.c:15
#define STATUS_NOT_IMPLEMENTED
Definition: d3dkmdt.h:42
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:102
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
Definition: exintrin.c:143
#define EXCEPTION_EXECUTE_HANDLER
Definition: excpt.h:90
BOOLEAN KdPitchDebugger
Definition: kddata.c:80
ULONG KdPrintBufferSize
Definition: kddata.c:136
BOOLEAN KdBlockEnable
Definition: kddata.c:84
BOOLEAN KdIgnoreUmExceptions
Definition: kddata.c:85
BOOLEAN KdAutoEnableOnEvent
Definition: kddata.c:83
NTSTATUS NTAPI KdChangeOption(IN KD_OPTION Option, IN ULONG InBufferBytes OPTIONAL, IN PVOID InBuffer, IN ULONG OutBufferBytes OPTIONAL, OUT PVOID OutBuffer, OUT PULONG OutBufferNeeded OPTIONAL)
Definition: kdapi.c:2594
NTSTATUS NTAPI KdSystemDebugControl(_In_ SYSDBG_COMMAND Command, _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, _In_ ULONG InputBufferLength, _Out_writes_bytes_(OutputBufferLength) PVOID OutputBuffer, _In_ ULONG OutputBufferLength, _Out_opt_ PULONG ReturnLength, _In_ KPROCESSOR_MODE PreviousMode)
Perform various queries to the kernel debugger.
Definition: kdapi.c:2217
NTSTATUS NTAPI KdDisableDebugger(VOID)
Definition: kdapi.c:2169
NTSTATUS NTAPI KdEnableDebugger(VOID)
Definition: kdapi.c:2158
#define KeGetPreviousMode()
Definition: ketypes.h:1115
#define KernelMode
Definition: asm.h:38
@ SysDbgQuerySpecialCalls
Definition: kdtypes.h:67
@ SysDbgSetTracepoint
Definition: kdtypes.h:64
@ SysDbgGetPrintBufferSize
Definition: kdtypes.h:87
@ SysDbgQueryTraceInformation
Definition: kdtypes.h:63
@ SysDbgClearSpecialCalls
Definition: kdtypes.h:66
@ SysDbgGetKdBlockEnable
Definition: kdtypes.h:92
@ SysDbgEnableKernelDebugger
Definition: kdtypes.h:83
@ SysDbgGetKdUmExceptionEnable
Definition: kdtypes.h:89
@ SysDbgBreakPoint
Definition: kdtypes.h:68
@ SysDbgSetKdUmExceptionEnable
Definition: kdtypes.h:90
@ SysDbgGetAutoKdEnable
Definition: kdtypes.h:85
@ SysDbgSetPrintBufferSize
Definition: kdtypes.h:88
@ SysDbgQueryModuleInformation
Definition: kdtypes.h:62
@ SysDbgSetAutoKdEnable
Definition: kdtypes.h:86
@ SysDbgGetTriageDump
Definition: kdtypes.h:91
@ SysDbgDisableKernelDebugger
Definition: kdtypes.h:84
@ SysDbgSetSpecialCall
Definition: kdtypes.h:65
@ SysDbgSetKdBlockEnable
Definition: kdtypes.h:93
#define DBG_STATUS_DEBUG_CONTROL
Definition: kdtypes.h:44
BOOLEAN InitIsWinPEMode
Definition: init.c:72
#define _SEH2_GetExceptionCode()
Definition: pseh2_64.h:165
#define _SEH2_EXCEPT(...)
Definition: pseh2_64.h:66
#define _SEH2_END
Definition: pseh2_64.h:155
#define _SEH2_TRY
Definition: pseh2_64.h:55
#define _SEH2_YIELD(__stmt)
Definition: pseh2_64.h:168
#define ProbeForWriteUlong(Ptr)
Definition: probe.h:36
unsigned char * PBOOLEAN
Definition: typedefs.h:53
#define STATUS_UNSUCCESSFUL
Definition: udferr_usr.h:132
__analysis_noreturn NTSYSAPI VOID NTAPI DbgBreakPointWithStatus(_In_ ULONG Status)
CCHAR KPROCESSOR_MODE
Definition: ketypes.h:7
@ KD_OPTION_SET_BLOCK_ENABLE
Definition: ketypes.h:524

Referenced by TestSystemDebugControl().

◆ ZwQueryDebugFilterState()

NTSYSAPI NTSTATUS NTAPI ZwQueryDebugFilterState ( ULONG  ComponentId,
ULONG  Level 
)

◆ ZwSetDebugFilterState()

NTSYSAPI NTSTATUS NTAPI ZwSetDebugFilterState ( ULONG  ComponentId,
ULONG  Level,
BOOLEAN  State 
)

◆ ZwSystemDebugControl()

NTSYSAPI NTSTATUS NTAPI ZwSystemDebugControl ( _In_ SYSDBG_COMMAND  Command,
_In_reads_bytes_(InputBufferLength) PVOID  InputBuffer,
_In_ ULONG  InputBufferLength,
_Out_writes_bytes_(OutputBufferLength) PVOID  OutputBuffer,
_In_ ULONG  OutputBufferLength,
_Out_opt_ PULONG  ReturnLength 
)