91 lines
2.7 KiB
C++
91 lines
2.7 KiB
C++
/////////////////////////////////////////////////////////////////////////////
|
|
//
|
|
// sips.cpp - Extension to find Singularity SIPs.
|
|
//
|
|
// Copyright Microsoft Corporation. All rights reserved.
|
|
//
|
|
#include "singx86.h"
|
|
|
|
EXT_DECL(sips) // Defines: PDEBUG_CLIENT Client, PCSTR args
|
|
{
|
|
EXT_ENTER(); // Defines: HRESULT status = S_OK;
|
|
bool stack = false;
|
|
bool detail = false;
|
|
|
|
while (*args != '\0') {
|
|
if (*args == '-' || *args == '/') {
|
|
args++;
|
|
switch (*args++) {
|
|
case 'd': // detail
|
|
case 'D':
|
|
detail = !detail;
|
|
break;
|
|
case 's': // stack
|
|
case 'S':
|
|
stack = !stack;
|
|
break;
|
|
}
|
|
while (*args != ' ') {
|
|
args++;
|
|
}
|
|
}
|
|
else {
|
|
break;
|
|
}
|
|
}
|
|
|
|
ULONG pointerSize = (g_ExtControl->IsPointer64Bit() == S_OK) ? 8 : 4;
|
|
ULONG64 address = 0;
|
|
ULONG64 procs = 0;
|
|
ULONG type = 0;
|
|
ULONG subtype = 0;
|
|
ULONG64 module = 0;
|
|
|
|
EXT_CHECK(g_ExtSymbols->GetOffsetByName(kernel_processTable, &address));
|
|
EXT_CHECK(g_ExtSymbols->GetOffsetTypeId(address, &type, &module));
|
|
EXT_CHECK(TraceReadPointer(1, address, &procs));
|
|
ExtVerb("processTable: %p\n", procs);
|
|
|
|
CHAR name[512];
|
|
|
|
EXT_CHECK(g_ExtSymbols->GetTypeName(module, type, name, arrayof(name), NULL));
|
|
ExtVerb(" processTable type: %s\n", name);
|
|
int len = (int)strlen(name);
|
|
if (len > 3 &&
|
|
name[len-3] == '[' &&
|
|
name[len-2] == ']' &&
|
|
name[len-1] == '*') {
|
|
name[len-3] = '\0';
|
|
|
|
EXT_CHECK(g_ExtSymbols->GetTypeId(module, name, &subtype));
|
|
EXT_CHECK(g_ExtSymbols->GetTypeName(module, subtype, name, arrayof(name), NULL));
|
|
ExtVerb(" processTable[] type: %s\n", name);
|
|
}
|
|
|
|
ULONG lengthOffset = 0;
|
|
EXT_CHECK(g_ExtSymbols->GetFieldOffset(module, type, "overall_length", &lengthOffset));
|
|
|
|
ULONG valuesOffset = 0;
|
|
EXT_CHECK(g_ExtSymbols->GetFieldOffset(module, type, "values", &valuesOffset));
|
|
|
|
ULONG length = 0;
|
|
EXT_CHECK(TraceRead(procs + lengthOffset, &length, sizeof(length)));
|
|
ExtOut("processTable: %p [maximum %d entries]\n", procs, length);
|
|
|
|
for (ULONG id = 0; id < length; id++) {
|
|
ULONG64 process = 0;
|
|
|
|
EXT_CHECK(TraceReadPointer(1, procs + valuesOffset + id * pointerSize, &process));
|
|
if (process != 0) {
|
|
if (detail) {
|
|
ExtOut(" %p\n", process);
|
|
}
|
|
else {
|
|
ExtOut(" %p\n", process);
|
|
}
|
|
}
|
|
}
|
|
|
|
EXT_LEAVE(); // Macro includes: return status;
|
|
}
|