I remembered reading somewhere that you cant call dbghelp functions
from Extensions
So I Asked if we can use crt and win32 apis
Thanks For Confirming Ken
stepping back and doing IDebug Whatever:: = s_ok looks like lot
better option
the sooner i start should yield better results i think coz wdbgexts
looks like it doesnt even touch the tip of iceberg that dbgeng holds
beneath the surface
anyway i wrote some simple code and tested it and the results appear in a jiffy
only the script is taking forever to complete
ill post below the code and results for the sake of completeness
//#define PRINTCRAP
#include “simple.h”
#include “malloc.h”
#include “stdio.h”
#include “windows.h”
PCHAR SplitFlags(ULONG64 Flags);
DECLARE_API( symstack ){
ULONG64 instptr,stkptr[0x11] = {0};
ULONG64 ptrstkptr[0x11] = {0};
ULONG lpCbReadBytes = {0};
PCHAR Remainder = (PCHAR) calloc(0x100,sizeof(PCHAR));
PCHAR Freebuff;
#ifdef PRINTCRAP
sprintf_s(Remainder,0x95,“This buffer is Allocated for symname\n”);
dprintf(“**************\nBuffer Address is %p and contains
%s**************\n”,Remainder,&Remainder);
#endif
PULONG64 pDisp = (PULONG64) calloc(0x100,sizeof(PULONG64));
#ifdef PRINTCRAP
sprintf_s((PCHAR)pDisp,0x95,“This buffer is Allocated for Displacement\n”);
dprintf(“**************\nBuffer Address is %p and contains
%s**************\n”,pDisp,&pDisp);
#endif
instptr = GetExpression(“@eip”);
GetSymbol(instptr,Remainder,pDisp);
#ifdef PRINTCRAP
dprintf(“**************\nAddress\t%x\tContents\t%s\n”,(ULONG)Remainder,Remainder);
dprintf(“Address\t%x\tContents\t%x\n***************\n”,(ULONG)pDisp,*pDisp);
#endif
dprintf(“Eip Is %08I64X\tPoints At %s+%x\n”,instptr,Remainder,*pDisp);
stkptr[0] = GetExpression(“@esp+(4*0)”);
ptrstkptr[0] = GetExpression(“poi(@esp+(4*0))”);
GetSymbol(ptrstkptr[0],Remainder,pDisp);
dprintf( “esp+00\t%08I64X\t%08I64X\tReturn to
%s+%x\n”,stkptr[0],ptrstkptr[0],Remainder,*pDisp);
stkptr[1] = GetExpression(“@esp+(4*1)”);
ptrstkptr[1] = GetExpression(“poi(@esp+(4*1))”);
GetClassName((HWND)ptrstkptr[1],Remainder,0x40);
dprintf( “esp+04\t%08I64X\t%08I64X\t%s\n”,stkptr[1],ptrstkptr[1],Remainder);
stkptr[2] = GetExpression(“@esp+(4*2)”);
ptrstkptr[2] = GetExpression(“poi(@esp+(4*2))”);
if (ReadMemory(ptrstkptr[2],Remainder,0x40,&lpCbReadBytes)) {
dprintf( “esp+08\t%08I64X\t%08I64X\tText=\t\t%s\n”,stkptr[2],ptrstkptr[2],Remainder);
} else {
dprintf(“ReadMemory @ %08I64X Failed\n”,ptrstkptr[2]);
}
stkptr[3] = GetExpression(“@esp+(4*3)”);
ptrstkptr[3] = GetExpression(“poi(@esp+(4*3))”);
if(ReadMemory(ptrstkptr[3],Remainder,0x40,&lpCbReadBytes)){
dprintf( “esp+0C\t%08I64X\t%08I64X\tCaption=\t%s\n”,stkptr[3],ptrstkptr[3],Remainder);
} else {
dprintf(“ReadMemory @ %08I64X Failed\n”,ptrstkptr[3]);
}
stkptr[4] = GetExpression(“@esp+(4*4)”);
ptrstkptr[4] = GetExpression(“poi(@esp+(4*4))”);
if(ReadMemory(stkptr[4],Remainder,0x40,&lpCbReadBytes)){
Freebuff = SplitFlags(ptrstkptr[4]);
dprintf( “esp+10\t%08I64X\t%08I64X\tFlags=\t%s\n”,stkptr[4],ptrstkptr[4],Freebuff);
} else {
dprintf(“ReadMemory @ %08I64X Failed\n”,ptrstkptr[4]);
}
free(Remainder);
free(pDisp);
free(Freebuff);
}
PCHAR SplitFlags(ULONG64 Flags) {
PCHAR Buff = (PCHAR) calloc(0x100,sizeof(PCHAR));
if (Buff == NULL) {
return NULL;
}
#ifdef PRINTCRAP
dprintf(“SplitFlags called Buffer Alloted =%p\n”,Buff);
sprintf_s(Buff,0x95,“This buffer is Allocated for symname\n”);
dprintf(“Buffer Address is %p and contains %s\n”,Buff,&Buff);
#endif
if (Flags & 0x40) {
strcpy_s(Buff,0x95,“MB_YESNO|”);
if(Flags & 0x4) {
strcat_s(Buff,0x95,“MB_ICONEXCLAMATION”);
}
}
#ifdef PRINTCRAP
dprintf(" returning Buffer Contents %s\n",Buff);
#endif
return Buff;
}
DECLARE_API ( help ) {
dprintf(“usage !symstack\n”);
}
built with Build -czMg on w2k8 serv env
results like
0:000> .load symstack.dll ;!symstack ; .unload symstack.dll
Eip Is 7E4507EA Points At user32!MessageBoxA+0
esp+00 0013FDF4 00401142 Return to image00400000+1142
esp+04 0013FDF8 000A020C SimpleWinClass
esp+08 0013FDFC 00403058 Text= .foreach slash f (Arg2Child
scriptresults temp.txt ){.if ( $t0
esp+0C 0013FE00 00403020 Caption= This Is a Test Message Box For
Windbg Script Evaluation
esp+10 0013FE04 00000044 Flags= MB_YESNO|MB_ICONEXCLAMATION
Unloading symstack.dll extension DLL
On 8/30/11, Skywing wrote:
> Taking a brief step back, I’d use the modern IDebugClient based extension
> API here when starting out, preferably with the aid of engextcpp. You’ll
> save a fair amount of time way in general and the new API is generally more
> powerful.
>
> Yes, the usual CRT and Win32 APIs are available from a debugger extension.
>
> - S
>
> -----Original Message-----
> From: xxxxx@gmail.com
> Sent: Monday, August 29, 2011 23:19
> To: Kernel Debugging Interest List
> Subject: RE:[windbg] script is runnig too slow
>
>
> No Takers yet 
>
> anyway since script is taking too long i thought let me try writing an
> extension and see how it goes
>
> i start with wdbgexts style extension
>
> yes i read that dbgeng and engext are more powerful
> yes i may try using them later not now
>
> so i took the simpleext sample in windbg sdk and started modifying it
>
> my exts.c contains so much now
>
> #include “simple.h”
> #include “malloc.h”
>
> DECLARE_API( symstack ){
>
> ULONG64 instptr,stkptr;
> PCHAR Remainder = (PUCHAR)
> calloc(100,sizeof(PUCHAR));
> PULONG64 pDisp = (PULONG64)
> calloc(100,sizeof(PULONG64));
>
>
> instptr = GetExpression(“@eip”);
> stkptr = GetExpression(“@esp”);
> dprintf(“Eip is %I64X And Stack Pointer is %I64X\n”,instptr,stkptr);
> GetSymbol(instptr,Remainder,pDisp);
> dprintf(“Printing Buffer And Displacement %s \t %I64X
> \n”,Remainder,*pDisp);
> free(Remainder);
> free(pDisp);
> }
>
> DECLARE_API ( help ) {
> dprintf(“usage !symstack\n”);
> }
>
>
> it seems to work
> prints the follwing results
>
> 0:000> .load symstack.dll ; !symstack ; .unload symstack.dll
> Eip is 7E4507F6 And Stack Pointer is 13FDF0
> Printing Buffer And Displacement user32!MessageBoxA C
> Unloading symstack.dll extension DLL
>
> 0:000> ? user32!MessageBoxA + 0xc
> Evaluate expression: 2118453238 = 7e4507f6
>
> 0:000> ? eip
> Evaluate expression: 2118453238 = 7e4507f6
>
> 0:000> ? esp
> Evaluate expression: 1310192 = 0013fdf0
>
>
> now my generic questions
>
> 1) is malloc / calloc / virtualalloc /virtualallocex / heapalloc/ localalloc
> /globalalloc and friends usable in extensions
>
> 2) if i alloc space how do i know iam allocating enough space ??
>
> 3) is there some mechanism like we call functions with 0 long buffer
> check return for required buff length and recall with buffer ??
>
>
>
>
>
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
–
thanks and regards
raj_r
