mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-07-15 12:09:34 +00:00
126 lines
3 KiB
C++
126 lines
3 KiB
C++
/**
|
|
* @file symbol.h
|
|
* @author Sina Karvandi (sina@hyperdbg.org)
|
|
* @brief Symbol related functions header
|
|
* @details
|
|
* @version 0.1
|
|
* @date 2021-06-09
|
|
*
|
|
* @copyright This project is released under the GNU Public License v3.
|
|
*
|
|
*/
|
|
#pragma once
|
|
|
|
//////////////////////////////////////////////////
|
|
// Structures //
|
|
//////////////////////////////////////////////////
|
|
|
|
/**
|
|
* @brief Save the local function symbols' description
|
|
*
|
|
*/
|
|
typedef struct _LOCAL_FUNCTION_DESCRIPTION
|
|
{
|
|
std::string ObjectName;
|
|
UINT32 ObjectSize;
|
|
|
|
} LOCAL_FUNCTION_DESCRIPTION, *PLOCAL_FUNCTION_DESCRIPTION;
|
|
|
|
/**
|
|
* @brief Save the local module symbols' description
|
|
*
|
|
*/
|
|
typedef struct _IMAGE_SYMBOL_CONTEXT
|
|
{
|
|
UINT64 ImageBase;
|
|
UINT64 CodeBase;
|
|
UINT64 CodeSize;
|
|
UINT8 * Code;
|
|
} IMAGE_SYMBOL_CONTEXT;
|
|
|
|
/*
|
|
* @brief Process basic information structure
|
|
*/
|
|
typedef struct _PROC_BASIC_INFO
|
|
{
|
|
LONG ExitStatus;
|
|
PVOID PebBaseAddress;
|
|
ULONG_PTR Reserved[4];
|
|
} PROC_BASIC_INFO;
|
|
|
|
/**
|
|
* @brief Thread basic information
|
|
*
|
|
*/
|
|
typedef struct _THREAD_BASIC_INFO_EX
|
|
{
|
|
LONG ExitStatus;
|
|
PVOID TebBaseAddress;
|
|
struct
|
|
{
|
|
HANDLE UniqueProcess;
|
|
HANDLE UniqueThread;
|
|
} ClientId;
|
|
ULONG_PTR AffinityMask;
|
|
LONG Priority;
|
|
LONG BasePriority;
|
|
} THREAD_BASIC_INFO_EX;
|
|
|
|
//////////////////////////////////////////////////
|
|
// Function Defs //
|
|
//////////////////////////////////////////////////
|
|
|
|
typedef LONG(NTAPI * PFN_NT_QIP)(HANDLE, ULONG, PVOID, ULONG, PULONG);
|
|
typedef LONG(NTAPI * PFN_NT_QIT)(HANDLE, ULONG, PVOID, ULONG, PULONG);
|
|
|
|
//////////////////////////////////////////////////
|
|
// Pdbex //
|
|
//////////////////////////////////////////////////
|
|
|
|
#define PDBEX_DEFAULT_CONFIGURATION "-j- -k- -e n -i"
|
|
|
|
//////////////////////////////////////////////////
|
|
// For symbol (pdb) parsing //
|
|
//////////////////////////////////////////////////
|
|
|
|
VOID
|
|
SymbolBuildAndShowSymbolTable();
|
|
|
|
BOOLEAN
|
|
SymbolShowFunctionNameBasedOnAddress(UINT64 Address, PUINT64 UsedBaseAddress);
|
|
|
|
BOOLEAN
|
|
SymbolLoadOrDownloadSymbols(BOOLEAN IsDownload, BOOLEAN SilentLoad);
|
|
|
|
BOOLEAN
|
|
SymbolConvertNameOrExprToAddress(const string & TextToConvert, PUINT64 Result);
|
|
|
|
BOOLEAN
|
|
SymbolDeleteSymTable();
|
|
|
|
BOOLEAN
|
|
SymbolBuildSymbolTable(PMODULE_SYMBOL_DETAIL * BufferToStoreDetails,
|
|
PUINT32 StoredLength,
|
|
UINT32 UserProcessId,
|
|
BOOLEAN SendOverSerial);
|
|
|
|
BOOLEAN
|
|
SymbolBuildAndUpdateSymbolTable(PMODULE_SYMBOL_DETAIL SymbolDetail);
|
|
|
|
VOID
|
|
SymbolInitialReload();
|
|
|
|
BOOLEAN
|
|
SymbolLocalReload(UINT32 UserProcessId);
|
|
|
|
VOID
|
|
SymbolPrepareDebuggerWithSymbolInfo(UINT32 UserProcessId);
|
|
|
|
BOOLEAN
|
|
SymbolReloadSymbolTableInDebuggerMode(UINT32 ProcessId);
|
|
|
|
#ifdef _WIN32
|
|
// PRTL_PROCESS_MODULES is from winternl.h — Windows-only
|
|
BOOLEAN
|
|
SymbolCheckAndAllocateModuleInformation(PRTL_PROCESS_MODULES * Modules);
|
|
#endif // _WIN32
|