Something went wrong. Try again.
Reactos
Something went wrong. Try again.
5.6 kB · 235 lines
C
at master
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236#include <stdio.h>#include <stdlib.h>#include <ctype.h>#define _WINVER 0x501#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800#include <windows.h>#include <shlwapi.h>#include <dbghelp.h>
HANDLE hCurrentProcess;BOOL bX64;
#define MAX_SYMBOL_NAME 1024
BOOL InitDbgHelp(HANDLE hProcess){ if (!SymInitialize(hProcess, 0, FALSE)) return FALSE;
SymSetOptions(SymGetOptions() | SYMOPT_ALLOW_ABSOLUTE_SYMBOLS); SymSetOptions(SymGetOptions() & (~SYMOPT_DEFERRED_LOADS)); SymSetSearchPath(hProcess, "srv**symbols*http://msdl.microsoft.com/download/symbols"); return TRUE;}
PVOIDImageSymToVa(HANDLE hProcess, PSYMBOL_INFO pSym, PBYTE pModule, PCSTR Name){ PIMAGE_NT_HEADERS NtHeaders; PVOID p;
pSym->SizeOfStruct = sizeof(SYMBOL_INFO); pSym->MaxNameLen = MAX_SYMBOL_NAME-1;
if (!SymFromName(hProcess, Name, pSym)) { printf("SymGetSymFromName64() failed: %ld\n", GetLastError()); return 0; }#if defined(__GNUC__) && \ (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__ < 40400) printf("looking up address for %s: 0x%llx\n", Name, pSym->Address);#else printf("looking up address for %s: 0x%I64x\n", Name, pSym->Address);#endif
NtHeaders = ImageNtHeader(pModule); p = ImageRvaToVa(NtHeaders, pModule, pSym->Address - pSym->ModBase, NULL);
return p;}
BOOL CALLBACK EnumSymbolsProc( PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext){ if ((INT_PTR)UserContext == -1) { printf("%s ", pSymInfo->Name); } else { if (!bX64) { printf("%s@%Iu ", pSymInfo->Name, (UINT_PTR)UserContext); } else { printf("%s <+ %Iu> ", pSymInfo->Name, (UINT_PTR)UserContext); } } return TRUE;}
int main(int argc, char* argv[]){ HANDLE hProcess; CHAR szModuleFileName[MAX_PATH+1]; DWORD64 dwModuleBase; HANDLE hFile = 0, hMap = 0; PBYTE pModule = NULL; UINT i; PVOID pW32pServiceTable, pW32pServiceLimit; PBYTE pW32pArgumentTable; PVOID pfnSimpleCall; DWORD dwServiceLimit;
struct { SYMBOL_INFO Symbol; CHAR Name[MAX_SYMBOL_NAME]; } Sym;
printf("Win32k Syscall dumper\n"); printf("Copyright (c) Timo Kreuzer 2007-08\n");
hProcess = GetCurrentProcess();
// try current dir GetCurrentDirectory(MAX_PATH, szModuleFileName); strcat(szModuleFileName, "\\win32k.sys"); hFile = CreateFile(szModuleFileName, FILE_READ_DATA, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (hFile != INVALID_HANDLE_VALUE) { goto cont; }
// try system dir GetSystemDirectory(szModuleFileName, MAX_PATH); strcat(szModuleFileName, "\\win32k.sys"); hFile = CreateFile(szModuleFileName, FILE_READ_DATA, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (hFile == INVALID_HANDLE_VALUE) { printf("CreateFile() failed: %ld!\n", GetLastError()); goto cleanup; }
cont: printf("Trying to get syscalls from: %s\n", szModuleFileName);
if (!InitDbgHelp(hProcess)) { printf("SymInitialize() failed\n"); goto cleanup; }
printf("Loading symbols for %s, please wait...\n", szModuleFileName); dwModuleBase = SymLoadModule64(hProcess, 0, szModuleFileName, 0, 0, 0); if (dwModuleBase == 0) { printf("SymLoadModule64() failed: %ld\n", GetLastError()); goto cleanup; }
hMap = CreateFileMappingA(hFile, NULL, PAGE_READONLY, 0, 0, NULL); if (!hMap) { printf("CreateFileMapping() failed: %ld\n", GetLastError()); goto cleanup; }
pModule = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0); if(!pModule) { printf("MapViewOfFile() failed: %ld\n", GetLastError()); goto cleanup; }
bX64 = (ImageNtHeader(pModule)->FileHeader.Machine != IMAGE_FILE_MACHINE_I386);
pW32pServiceTable = ImageSymToVa(hProcess, &Sym.Symbol, pModule, "W32pServiceTable"); pW32pServiceLimit = ImageSymToVa(hProcess, &Sym.Symbol, pModule, "W32pServiceLimit"); pW32pArgumentTable = ImageSymToVa(hProcess, &Sym.Symbol, pModule, "W32pArgumentTable");// printf("pW32pServiceTable = %p\n", pW32pServiceTable);// printf("pW32pServiceLimit = %p\n", pW32pServiceLimit);// printf("pW32pArgumentTable = %p\n", pW32pArgumentTable);
if (!pW32pServiceTable || !pW32pServiceLimit || !pW32pArgumentTable) { printf("Couldn't find address!\n"); goto cleanup; }
dwServiceLimit = *((DWORD*)pW32pServiceLimit);
if (!bX64) { DWORD *pdwEntries32 = (DWORD*)pW32pServiceTable;
for (i = 0; i < dwServiceLimit; i++) { printf("0x%x:", i+0x1000); SymEnumSymbolsForAddr(hProcess, (DWORD64)pdwEntries32[i], EnumSymbolsProc, (PVOID)(DWORD_PTR)pW32pArgumentTable[i]); printf("\n"); } } else { DWORD64 *pdwEntries64 = (DWORD64*)pW32pServiceTable;
for (i = 0; i < dwServiceLimit; i++) { printf("0x%x:", i+0x1000); SymEnumSymbolsForAddr(hProcess, (DWORD64)pdwEntries64[i], EnumSymbolsProc, (PVOID)(DWORD_PTR)pW32pArgumentTable[i]); printf("\n"); } }
/* Dump apfnSimpleCall */ printf("\nDumping apfnSimpleCall:\n"); pfnSimpleCall = (PVOID*)ImageSymToVa(hProcess, &Sym.Symbol, pModule, "apfnSimpleCall"); i = 0;
if (bX64) { DWORD64 *pfnSC64 = (DWORD64*)pfnSimpleCall; while (pfnSC64[i] != 0) { printf("0x%x:", i); SymEnumSymbolsForAddr(hProcess, (DWORD64)pfnSC64[i], EnumSymbolsProc, (PVOID)-1); printf("\n"); i++; } } else { DWORD *pfnSC32 = (DWORD*)pfnSimpleCall; while (pfnSC32[i] != 0) { printf("0x%x:", i); SymEnumSymbolsForAddr(hProcess, (DWORD64)pfnSC32[i], EnumSymbolsProc, (PVOID)-1); printf("\n"); i++; } }
cleanup: if (pModule) { UnmapViewOfFile(pModule); } if (hMap) { CloseHandle(hMap); } if (hFile) { CloseHandle(hFile); }
return 0;}