d0002c0d0d
Add previously undocumented AnimateInterval to settings; Remove AnimateInterval restrictions; Fix a bug on GuiOpenTraceFile
2020-07-05 16:02:52 +02:00
be725d82e1
fix "Trace already active" after "ticnd ())"
2020-07-04 02:48:21 +02:00
a5bd8f1dcc
DBG: Fixed DLL breakpoints.
...
DLL breakpoints can now be enabled/disabled/removed!
2020-07-04 02:45:22 +02:00
Duncan Ogilvie
7b4b40b34b
1984
...
https://twitter.com/TwitterEng/status/1278733305190342656
2020-07-03 21:57:48 +02:00
829235659f
DBG: Added memory breakpoint's types in BpToBridge conversion.
...
Fixes: Memory breakpoints summary always shows type as access for all types.
@BreakPointView.
2020-06-25 21:35:33 +02:00
95315402f1
DBG: added new command showref that shows the references tab
2020-06-22 14:08:45 +02:00
Duncan Ogilvie
d73d4058df
DBG: fix oversight in instruction counting algorithm
2020-06-04 18:59:37 +02:00
Duncan Ogilvie
6f5e786a54
DBG: improve function analysis and introduce loop analysis
...
Thanks to DefCon42 for help on the backedge algorithm!
2020-06-04 17:26:47 +02:00
Duncan Ogilvie
5ab09dae92
DBG: add parent in function API to support function chunks
2020-06-04 17:26:47 +02:00
Duncan Ogilvie
bb49270921
DBG: show progress in status bar when downloading symbols
2020-06-04 17:26:47 +02:00
Duncan Ogilvie
b9b8e52c4e
DBG: improve loop API
2020-06-04 17:26:42 +02:00
Duncan Ogilvie
2b9fc285c8
DBG: minor fixes with iterators and erasing
2020-06-04 17:25:50 +02:00
Duncan Ogilvie
10da0d4654
DBG: allow setting temporary labels from the labelset command
2020-06-04 17:25:50 +02:00
Duncan Ogilvie
6293b90aff
DBG: add dbdecompress helper command
2020-06-04 17:25:50 +02:00
Duncan Ogilvie
9c3e5ec5ff
DBG: truncate labels in LabelGet
2020-06-04 17:25:50 +02:00
Duncan Ogilvie
33403df92b
DBG: improve working set mitigation
2020-06-04 17:25:50 +02:00
Duncan Ogilvie
d2f19c334d
DBG: properly truncate the page info
2020-06-04 17:25:50 +02:00
6043dcf5a6
Allow stopping run trace when not debugging ( #2326 )
2020-05-15 12:31:12 +00:00
Duncan Ogilvie
5507b46dc4
DBG: error message improvement in cbDebugPause + minor project fixes
2020-05-09 22:40:45 +02:00
Duncan Ogilvie
8dd8026d55
DBG: remove a check that has been proven stable in MemoryReadSafePage
2020-04-28 00:25:50 +02:00
Duncan Ogilvie
1d5766e8bc
DBG: not not force RIP to the ExceptionAddress for EXCEPTION_BREAKPOINT
2020-04-28 00:25:04 +02:00
Duncan Ogilvie
0763064b70
DBG: fix more complex union scenarios
2020-04-27 13:20:37 +02:00
Duncan Ogilvie
b1c0eee865
DBG: fix an issue with unions in the type system
2020-04-27 12:58:28 +02:00
Duncan Ogilvie
e0b92786f0
DBG: move InitDLLDebugW out of TitanEngine
2020-04-25 22:14:06 +02:00
Duncan Ogilvie
434ef31a05
PROJECT: minor fixes in vcproj files
2020-04-25 22:14:05 +02:00
Duncan Ogilvie
2bd139d89f
DBG: fix regression related to hardware breakpoint storage
2020-04-12 18:02:40 +02:00
Duncan Ogilvie
99f7d096a8
DBG: refresh the gui in some previously untested scenarios
2020-04-02 00:16:47 +02:00
Duncan Ogilvie
3a253248e5
DBG: finally properly implement setBpActive for hardware breakpoints
2020-04-02 00:16:47 +02:00
Duncan Ogilvie
6f92c63ce2
DBG: fix some potential bugs when disabling/deleting hardware breakpoints
2020-04-02 00:16:46 +02:00
Duncan Ogilvie
5a6817680a
DBG: change order of breakpoint name and custom breakpoint identifier syntax in BpGet
2020-04-02 00:16:46 +02:00
Duncan Ogilvie
d2c62e69c2
DBG: move DbLoad from cbCreateProcess to before entering the debug loop
...
fixes #2296
2020-02-23 16:24:23 +01:00
Duncan Ogilvie
6745514e31
DBG: improvements to initialization script experience
2020-02-23 16:01:29 +01:00
Duncan Ogilvie
1774ba1f89
DBG: call reference update less frequently
2020-02-10 03:10:35 +01:00
Duncan Ogilvie
472a8160dd
DBG: CloseHandle on the AeDebug event
2020-02-10 02:35:13 +01:00
Duncan Ogilvie
063ce31ec6
DBG+GUI: improve disassembly navigation
...
closes #1226
2020-01-16 15:49:52 +01:00
Duncan Ogilvie
e20cd71549
DBG: fix a race condition with a cached context in _dbg_getregdump
...
closes #2248
2020-01-16 15:25:48 +01:00
Duncan Ogilvie
f7f7a2f463
DBG: attempt to undecorate more symbols based on other prefixes
...
closes #2268
2020-01-08 01:39:49 +01:00
Duncan Ogilvie
ebf3db1095
DBG: add forgotten CBSELCHANGED in pluginload
2020-01-08 01:34:49 +01:00
Duncan Ogilvie
b6b1cce7ba
DBG: force a terminating command at the end of a script
2019-11-26 13:26:35 +01:00
ec451897a5
DBG: Fix function boundary computation when getting x64 stack frames
...
RUNTIME_FUNCTION range: [BeginAddress, EndAddress)
Old code:
Find `func` where:
`func.BeginAddress <= rva <= func.EndAddress`
New code:
Find `func` where:
`func.BeginAddress <= rva < func.EndAddress`
2019-11-26 13:26:15 +01:00
Duncan Ogilvie
824100eea8
DBG: implement memcpy command
2019-11-13 01:13:06 +01:00
Duncan Ogilvie
b23c0dfe37
DBG: remove leading whitespace when loading script to correctly handle tabs
2019-11-12 23:55:56 +01:00
Duncan Ogilvie
fae8434284
DBG: fix a buffer overflow in a terrible 5-year old API
...
Thanks to dudeme for finding a reliable way to reproduce this!
2019-11-12 23:55:23 +01:00
b0ba7d40e1
Fixed #2228 ( #2244 )
...
* Fixed #2228
2019-11-11 22:15:46 +01:00
Duncan Ogilvie
e2a20266d1
DBG: close #2245
...
fix by lynnux
2019-11-10 23:15:29 +01:00
Duncan Ogilvie
c65f65f3b1
DBG: better script cleanup
2019-11-05 00:55:22 +01:00
Duncan Ogilvie
eca2f7f99a
DBG: refactor scripting functionality to allow executing script branches in the GUI
2019-11-05 00:33:32 +01:00
Duncan Ogilvie
6d6df1ff6f
DBG: stop skipping exceptions when pausing on certain debug events
2019-11-04 20:45:27 +01:00
Duncan Ogilvie
3fc1bdebc9
DBG: remove some unused functionality related to pausing
2019-11-04 20:45:26 +01:00
Duncan Ogilvie
03c5406b4b
DBG+EXE: compile on latest Visual Studio 2019 without MFC
2019-10-31 15:31:23 +01:00
Duncan Ogilvie
3efe95135b
DBG: improve savedata command
2019-10-31 15:27:51 +01:00
e0e977c88a
DBG: try querying the process cookie before adding breakpoints
2019-10-31 15:18:27 +01:00
16d9e5a777
DBG: do not add breakpoints to query process cookie when attaching
2019-10-31 15:18:27 +01:00
44c9d81e60
DBG: fix invalid handle exception on terminating attach after run
2019-10-31 15:17:23 +01:00
894ce7842d
DBG: remove duplicate variable and single cycle loop in advanced analysis
2019-10-31 15:17:05 +01:00
e975fc813d
DBG: verify that the decoded instruction or data reference fits into the memory range
2019-10-31 15:17:05 +01:00
382231eff8
DBG: reject wildcard only patterns
...
closes #2212
2019-10-23 12:22:48 +02:00
Duncan Ogilvie
83e1705985
DBG: sync mnemdb with the latest idaref
2019-10-12 16:00:04 +02:00
2952170189
DBG: fix call stack on x64
2019-10-12 15:41:29 +02:00
Duncan Ogilvie
31443c2c78
DBG: allow various more advanced pattern finding techniques
...
closes #2197
2019-09-01 17:28:48 +02:00
Duncan Ogilvie
12cf712ec2
DBG: add bswap format function
2019-09-01 17:28:43 +02:00
Duncan Ogilvie
8e2fb7f0b7
DBG: use patterntransform in the find command
...
see #2197
2019-09-01 15:45:29 +02:00
Duncan Ogilvie
249d5382c1
DBG: update patterntransform to reject invalid patterns
2019-09-01 15:44:28 +02:00
Duncan Ogilvie
d50675ca02
DBG: fix some edge cases with page protections in the memory map
2019-08-23 00:48:20 +02:00
Duncan Ogilvie
2c37afcc9e
DBG: truncate copy data in DISASM_INSTR
...
closes #2028
2019-08-23 00:48:19 +02:00
Duncan Ogilvie
d6b27324f4
DBG: fix bugfix
...
closes #2206
2019-08-22 17:50:30 +02:00
Duncan Ogilvie
bbc93a9426
DBG: improve symbol handling
2019-08-22 17:21:37 +02:00
Duncan Ogilvie
7212e853fb
DBG: better heuristics for detecting the debuggee did not terminate after 10 seconds
2019-08-19 15:39:13 +02:00
Duncan Ogilvie
8a07bd2d7e
DBG+GUI: implement auto completion for exports in goto dialog
...
closes #1987
2019-08-17 17:38:58 +02:00
Duncan Ogilvie
593b5f1752
DBG: fix out of bounds access in valapifromstring
...
closes #2190
2019-08-17 16:30:23 +02:00
Duncan Ogilvie
de2d930d8f
DBG+GUI: add transparent exception stepping option
2019-08-17 12:19:08 +02:00
Duncan Ogilvie
60e1dff147
DBG: fix signature verification for PDB v2.0 and improve symbol log
...
closes #2193
2019-08-09 20:55:59 +02:00
Duncan Ogilvie
d17852b63b
DBG: fix a weird bug where dll breakpoints could not be deleted in certain cases
2019-06-25 21:17:45 +02:00
Duncan Ogilvie
0b7d840b60
DBG+BRIDGE+GUI: fix bugs and add Graph+Memory Map+Symbol Module plugin menus
2019-06-22 16:44:45 +02:00
Duncan Ogilvie
c345647e85
DBG: allow plugstop to indicate FreeLibrary should not be called
2019-06-22 13:22:58 +02:00
Duncan Ogilvie
7114c71fe3
DBG: trim debug strings before showing them
2019-06-22 13:22:29 +02:00
Duncan Ogilvie
3c5a1ad13a
DBG: fix _plugin_menuentrysetvisible
2019-06-21 16:39:03 +02:00
Duncan Ogilvie
cc30f105de
DBG: implement DbgFunctions()->ModSymbolStatus
2019-06-19 00:12:43 +02:00
Duncan Ogilvie
80d84e7108
DBG: implement symunload command
2019-06-19 00:12:38 +02:00
Duncan Ogilvie
728f0eaa8d
DBG: fix various issues pointed out by Visual Studio code analysis
2019-06-19 00:12:31 +02:00
Duncan Ogilvie
d62f7f431c
disable warnings for dbghelp.h
2019-06-19 00:12:31 +02:00
Duncan Ogilvie
0a77a1cb00
DBG: add expression functions for exception information
2019-06-13 13:17:15 +02:00
Duncan Ogilvie
1e075142a5
DBG: add symload command to manually load a PDB
2019-06-12 16:51:19 +02:00
72d76bb9bc
Add GetExports and GetImports to the module scripting API.
2019-05-09 20:46:13 +02:00
4273fce56e
Fix export name is not parsed correctly
2019-05-09 20:45:04 +02:00
Duncan Ogilvie
b244c8177f
DBG: removed sortedlru
...
closes #2124
2019-04-30 15:27:47 +02:00
Duncan Ogilvie
c664ad1b4a
DBG: add dis.iscallsystem expression function
2019-04-30 15:05:36 +02:00
Duncan Ogilvie
2cbafa369d
DBG: add mod.isexport expression function
2019-04-30 15:05:36 +02:00
36741fdaf8
Fix ThreadGetSuspendCount if the suspend count limit is reached
...
Use a better method of querying the suspend count on Windows >= 8.1 that doesn't involve suspending and resuming
2019-04-28 21:24:59 +02:00
1874da8657
Fix export name parsing
2019-04-28 16:40:21 +02:00
Duncan Ogilvie
425a531535
DBG: fix use after free derp
...
closes #2149
2019-04-22 11:45:38 +02:00
ed5d085fa3
Fix compilation in VS2019
2019-04-17 19:34:00 +02:00
Duncan Ogilvie
1d9df16898
DBG: fix missing module name in symbol log and implement source mapping
2019-04-17 19:30:59 +02:00
Duncan Ogilvie
d13b2eefe1
GUI: better handling of xbegin tokenizing
2019-04-17 18:10:19 +02:00
Duncan Ogilvie
6bc16f8bac
PROJECT: remove and ignore vcxproj.user files
2019-04-12 17:51:56 +02:00
Duncan Ogilvie
4af8ff6174
DBG: (performance) improvements to SymbolSourceDIA
2019-04-12 16:51:37 +02:00
Duncan Ogilvie
3b8469ba55
DBG: print rex info in Zydis command
2019-04-09 15:47:22 +02:00
Duncan Ogilvie
386e242645
DBG+GUI: removed yara
2019-04-06 13:18:16 +02:00
Duncan Ogilvie
41978f961c
DBG: show full command line near 'Process Started' log entry
2019-04-06 12:40:51 +02:00
Duncan Ogilvie
ee411b0c30
DBG: some more improvements to safely reading the PE info
2019-04-06 12:40:50 +02:00
6e18613e37
DBG: ReadExportDirectory: put upper bound on the number of imports
2019-03-17 19:46:33 +01:00
e38adf1265
DBG: AddressOfNameOrdinals is WORD[], not DWORD[]
2019-03-17 19:46:33 +01:00
c54c96816e
DBG: ReadExportDirectory: do bounds checks on all export dir entries before indexing into arrays
...
Fixes #2105 (second case/malware sample)
2019-03-17 19:46:33 +01:00
e36779d7a4
DBG: more robust validation of PE directory sizes
2019-03-17 19:46:33 +01:00
Duncan Ogilvie
7d53b1ae08
DBG: fix potential crashes in GetModuleInfo
2019-01-20 22:41:26 +01:00
Duncan Ogilvie
9f5ce5041d
DBG: fix a mistake in MemUpdateMap
...
closes #2101
2019-01-20 20:45:47 +01:00
Duncan Ogilvie
85e96353cb
DBG+BRIDGE+GUI: put in the title whether x64dbg is elevated or not
2019-01-20 20:43:39 +01:00
Duncan Ogilvie
223ea586bb
DBG: add some more helpful format functions
...
ascii, ansi, utf8, utf16, disasm, modname
2019-01-10 23:54:31 +01:00
Duncan Ogilvie
d04288cbc1
DBG: improve performance of MemoryMapUpdate
2019-01-10 23:45:24 +01:00
Duncan Ogilvie
e5e96f7cbb
DBG: analyze all xrefs in the module with XrefsAnalysis
2019-01-10 23:44:51 +01:00
Duncan Ogilvie
cc15cdec9f
DBG: correctly handle executables with entry points inside the MZ header
...
closes #1994
2019-01-10 23:44:07 +01:00
Duncan Ogilvie
f1fbfd98b3
DBG: don't use CreateProcessInfo->lpStartAddress because it is broken
...
closes #2099
2019-01-10 23:43:05 +01:00
Duncan Ogilvie
688e2ccc04
DBG+GUI: AStyle
2018-11-18 15:50:13 +01:00
Duncan Ogilvie
418541e46e
DBG: improve the skipInt3Stepping feature to work for long int3 instructions
2018-11-18 15:49:43 +01:00
1e9bf1ab7c
DBG: Fix mapped area overrun in ReadDebugDirectory for bogus debugDirSize
2018-11-18 15:20:38 +01:00
0adb663a91
Fixed Symbol::GetList() for symbols without undecorated name
...
* Such symbols have "" instead of nullptr in SYMBOLINFO.undecoratedSymbol
* This fix greatly improves Snowman's decompiled results, example: comctl32!ListBox_SetCurSelHandler
2018-11-13 12:10:36 +01:00
836a544287
Run "AStyleWhore"
2018-11-13 10:01:22 +08:00
5162450ff3
Fix yara crash when used with a single argument
2018-11-04 23:14:31 +01:00
c7107374d2
DBG: remove capstone references
2018-11-04 23:14:04 +01:00
de678aec21
Fixed incorrect error message when memory could not be allocated
2018-11-02 15:31:14 +00:00
0c87d87fe6
DBG: fix getting raw int value for float typed watch points
2018-10-31 12:39:00 +01:00
e0052d6b2b
ZYDIS: Use ZydisOperandAction as an enum instead of a flag
2018-10-31 12:38:40 +01:00
0065f204a3
Add DLL ordinal to symbol table and fix symbol table comparator
2018-10-31 12:38:00 +01:00
5a4f15e9f5
DBG: add OptionalHeader.AddressOfEntryPoint to the displayed symbols
2018-10-31 12:37:48 +01:00
Duncan Ogilvie
fba7af6bcd
Merge branch 'torusrxxx-patch00000092' into development
2018-10-29 13:38:56 +01:00
5669e13485
temporary
2018-10-16 18:15:01 +02:00
ae9bf8c49e
st(X) can be edited
2018-10-16 18:15:01 +02:00
cf1498786c
Merge branch 'development' into patch00000092
2018-10-12 20:50:28 +08:00
d149f6d794
Do not leave empty or corrupt PDBs in the store if a download failed. Fixes a crash in LoadDataFromIStream in MS DIA 14.15
2018-10-10 15:50:40 +02:00
Duncan Ogilvie
da69e828ea
DBG: improve memory usage and performance with line numbers
2018-10-10 15:45:32 +02:00
Duncan Ogilvie
25a67b778e
DBG: fix buffer overflow and assert when tracing fxsave or invalid instructions
2018-10-10 15:44:37 +02:00
Duncan Ogilvie
22861d69e5
Add some analysis for exceptions containing FACILITY_VISUALCPP in exinfo
2018-10-10 15:44:37 +02:00
Duncan Ogilvie
b1188c3c04
DBG: fix crash in stackgetsuspectedcallstack when CSP is not pointing to valid memory
2018-10-10 15:44:37 +02:00
Duncan Ogilvie
521195eea9
DBG: small refactor for SymAutoComplete
2018-10-10 15:44:37 +02:00
Duncan Ogilvie
d7f1dadb52
DBG: exclude some invalid imports + give ordinal imports a name
2018-10-10 15:44:37 +02:00
Duncan Ogilvie
70cfec4094
DBG: add (undocumented) option to force load PDB
2018-10-10 15:44:37 +02:00
03f596c162
Stricter ordinal name check
2018-10-09 11:20:55 +08:00
Duncan Ogilvie
da913f7cdc
DBG: fix a possible crash in disasmget
2018-09-13 12:56:10 +02:00
Duncan Ogilvie
7aab39f8e1
Revert "DBG: do not step if there is an enable breakpoint at CIP"
...
This reverts commit 9804400df6
2018-09-02 00:53:05 +02:00
d4ec06f6de
Fixed a crash when tracing into far jump
2018-08-21 17:04:36 +02:00
Duncan Ogilvie
7526b7e482
DBG: update TitanEngine
2018-07-19 16:44:44 +02:00
Duncan Ogilvie
62b6be97e0
DBG: allow the "-p PID -e EVENT" command line for JIT debugging
2018-07-15 19:11:52 +02:00
Duncan Ogilvie
fa82c80c51
DBG: temporary fix for AutoPatchExporter
2018-07-05 02:41:18 +02:00
Duncan Ogilvie
bcb1df389c
DBG: include DIA in deps
2018-07-05 02:41:09 +02:00
Duncan Ogilvie
d7eac4598d
DBG: better error messages in PDBDiaFile::open
2018-07-05 02:39:58 +02:00
Duncan Ogilvie
144dbd4c2f
DBG: undecorate import/export names
2018-07-04 17:12:37 +02:00
Duncan Ogilvie
9804400df6
DBG: do not step if there is an enable breakpoint at CIP
...
closes #1721
2018-07-01 19:28:08 +02:00
Duncan Ogilvie
e5467cf966
DBG: correctly update module list when changing module type
2018-07-01 19:28:07 +02:00
Duncan Ogilvie
0c8956f480
DBG+GUI: disable source debugging per default
2018-07-01 19:28:07 +02:00
Duncan Ogilvie
8c169ae2ed
DBG+BRIDGE+GUI: fix source loading
2018-07-01 19:28:06 +02:00
Duncan Ogilvie
b63402066b
DBG: implement findSourceLineInfo by fileName + line in symbol source
2018-07-01 19:28:06 +02:00
Duncan Ogilvie
47d6efb59e
DBG: do not fully escape debug strings
2018-07-01 19:28:06 +02:00
Duncan Ogilvie
b8ae4b1496
DBG: invalidate symbol source when MODINFO is destroyed
2018-07-01 19:28:06 +02:00
Duncan Ogilvie
d70ed83a72
DBG: fix a bug in getLabel where jmp [MessageBoxA] would not be recognized correctly
2018-07-01 19:28:06 +02:00
Duncan Ogilvie
df31f0da45
DBG: change symbol load order + add debuggee.pdb to the search list
2018-07-01 19:28:05 +02:00
Duncan Ogilvie
4098dc8fb2
DBG: finally fix the handle leak in PDBDiaFile
2018-07-01 19:28:05 +02:00
Duncan Ogilvie
8af904fad6
DBG: fix assert in debug mode on pluginunloadall
2018-07-01 19:28:04 +02:00
Duncan Ogilvie
9e68ea3900
DBG: only store file hash in database if there is other data as well
2018-07-01 19:28:03 +02:00
Duncan Ogilvie
7d1afa0940
DBG+GUI: change layout of window title to be more helpful in the task bar
2018-07-01 19:28:03 +02:00
Duncan Ogilvie
2665df4eb3
DBG: added mod.headerva expression function
2018-07-01 19:28:03 +02:00
Duncan Ogilvie
87c3238de8
DBG (WIP): set up DIA file stream for profiling of a handle leak
2018-07-01 19:28:03 +02:00
Duncan Ogilvie
d79586d02b
DBG: fix a crash in the Cleanup in downslib
2018-07-01 19:28:02 +02:00
Duncan Ogilvie
70b3149599
WIP: new symbol gui mostly working
2018-07-01 19:28:02 +02:00
0bb2efcb2c
Improve performance and crash resistance when loading PE files containing 1000 or more sections. Tested on https://github.com/corkami/pocs/blob/master/PE/bin/65535sects.exe . Technically performance was already very good, but that was only due to crashing instantly
2018-07-01 19:28:01 +02:00
f515484790
ReadBaseRelocationTable() refactor. Is it better now? Dunno really. This method may be slightly easier to use with both SEC_COMMIT and SEC_IMAGE mappings in the future if needed, but in the end they pretty much do the same thing. At least some more TitanEngine calls were killed off so that's something I suppose
...
Replaced dark and brooding "..."s in error messages with exclamation marks to better emphasise that this stuff is serious
2018-07-01 19:28:01 +02:00
1f485f313e
DBG: more robust debug directory parsing. Validate the RVA, type and size bounds for each debug directory entry, and do not stop after the one unrecognised (non-CV) entry
...
Protect against PDB paths that do not have a null terminator in the PE codeview info
2018-07-01 19:28:01 +02:00
Duncan Ogilvie
14da6c4448
DBG: clean up downslib
2018-07-01 19:28:00 +02:00
6df9535ba4
Rewrite ReadTlsCallbacks() to use RtlImageDirectoryEntryToData and remove all TitanEngine calls. Also fix an anti-debug trick I found by accident: it is possible to have working TLS callbacks with a TLS directory size of 0. The loader does not check this field and always executes callbacks if they exist
2018-07-01 19:28:00 +02:00
28c03967c7
RvaToVa(): use SizeOfRawData instead of VirtualSize as the upper bound on section RVAs. This matches the behaviour of RtlImageRvaToSection for SEC_COMMIT mappings
2018-07-01 19:28:00 +02:00
a4638d2ea9
DBG: misc. changes and fixes in SymbolSourceDIA:
...
- Rename SetThreadDescription to SetWin10ThreadDescription, to clarify that this function isn't actually useful to anyone. (ha ha, OK... but seriously, the same name is also used by the Windows SDK which apparently takes precedence and gets added as a static import, making it impossible to start the debugger on OSes other than Windows 10)
- Thread names are a good idea and they even kind of work on older Windows versions with NtQueryInformationThread(ThreadQuerySetWin32StartAddress), which is what e.g. Process Explorer and Process Hacker use. What *doesn't* work so well is lambdas. Added static functions SymbolsThread() and SourceLinesThread() to replace these. (before: x64dbg.dll!<lambda_fc00d3fb731b14a9b4857ac068d657c4>::<lambda_invoker_cdecl>. after: x64dbg.dll!SymbolSourceDIA::SymbolsThread). These should probably be file statics instead of class members, but they need access to private class functions
- GetModuleHandleA -> GetModuleHandleW. The former just calls the latter but with an extra string allocation and pointless unicode conversion
- Fix pedantic Clang warnings about member initialization order in ctor
- Qualify type name in call to virtual function in destructor, as this will be statically resolved and won't call any potential future implementations in derived classes (this can be further 'fixed' by making either the function or the class final so you'll get a compile time error if you try to do this later)
2018-07-01 19:28:00 +02:00
9b0f9b5c59
Add clarifying comment/TODO re: invalid RVAs to ReadExportDirectory(). Don't feed your .avi collection to this function just yet
2018-07-01 19:28:00 +02:00
a94c250c5d
[DBG] Rewrite ReadImportDirectory()
...
- Obtain the directory directly using RtlImageDirectoryEntryToData and ditch TitanEngine conversion helpers
- Use OFTs instead of FTs if possible, with FTs only as fallback
- Answer the pop quiz questions in comments re: ntdll loader behaviour and handle these cases appropriately
- Use THUNK_VAL() to obtain OFT/FT values independent of process and file bitness
- Always use ULONG64 for AddressOfData to be able to test for IMAGE_ORDINAL_FLAG64. Also return ULONG64 from RvaToVa(), and rva2offset too as a result of this. This makes these functions compatible with both 32 and 64 bit files regardless of process bitness. There shouldn't be any functional changes due to this, otherwise will revert/fix
- Require an import by name to have a non-null name in addition to not having the ordinal flag set. Otherwise treat it as an import by ordinal
- The ordinal value of an import by ordinal is obtained by (val & 0xffff), not (val &= ~ordinalFlag). The ordinal flag is now always removed to ensure the RVA is valid
- Give imports by ordinal a 'name' the same way dbghelp does, e.g. Ordinal57. Previously imports by ordinal were not being shown in the Symbols tab due to having no name. TODO: if we have the PDB for the file being imported from, we can overwrite or append the real function name later using the importee's export directory
- RvaToVa(): assert that RVA 0 always returns VA 0, because if this isn't the case something is seriously messed up
2018-07-01 19:27:59 +02:00
5ad21c69ee
- ReadDebugDirectory(): add about 20 years worth of missing debug directory type names
...
- symbolsourcedia.h: Add _global.h #include to prevent various macros like WINVER and _WIN32_WINNT from being redefined because Windows.h was indirectly included first
2018-07-01 19:27:59 +02:00
fc9285ed2e
[DBG] Work on modinfo improvements:
...
- Add ImageNtHeaders() (clone of RtlImageNtHeaderEx which doesn't exist on XP) to obtain PE headers given a VA
- Add HEADER_FIELD() and THUNK_VAL() macros to module.h to allow accessing header fields independent of process and file bitness
- Add IMAGE_NT_HEADERS pointer to MODINFO, since anything related to parsing PEs needs this struct
- Read PE headers in GetModuleInfo(). Currently the headers are being parsed every time a TitanEngine helper function is called, the goal is to reduce this to once per module load
- GetModuleInfo(): eliminate all TitanEngine calls now that we have the headers
- Add RvaToVa() for SEC_COMMIT mappings. This can simultaneously serve as replacement for rva2offset helpers (pass base = 0). Preferably SEC_IMAGE should be used though as that way neither of these would be needed
- ReadExportDirectory(): use RtlImageDirectoryEntryToData() to obtain a PIMAGE_EXPORT_DIRECTORY and its size in one go to eliminate TitanEngine helper calls and RVA to offset conversions
- Answer burning questions re: Windows loader behaviour when parsing exports in comments
- (Minor) fix '>= 0' comparison against unsigned as this will always evaluate to true
- Add comment re: PDB search path order since it's wrong atm but I'm too scared of breaking something if I change this code myself
2018-07-01 19:27:59 +02:00
Duncan Ogilvie
013cd1e5f7
DBG: dont copy MODINFO and MODIMPORT/MODEXPORT structures
2018-07-01 19:27:59 +02:00
Duncan Ogilvie
4e88b399fe
Update DIA to 14.13.26128.0 + XP support
2018-07-01 19:27:58 +02:00
Duncan Ogilvie
aa8a215895
DBG: use win32 threads instead of std::thread
2018-07-01 19:27:58 +02:00
72ccf42298
Fix too early stream deletion.
2018-07-01 19:27:58 +02:00
cad8aed97d
Refactor PDB data loading via IStream, explicit file access.
2018-07-01 19:27:58 +02:00
c8af1f9144
Use correct PDBDiaFile instance.
2018-07-01 19:27:57 +02:00
Duncan Ogilvie
45b49995f3
DBG: fall back to resolving modules exports when no symbol is found
2018-07-01 19:27:57 +02:00
Duncan Ogilvie
73a5ffebd9
DBG: use export/import data from modules instead of from memory
2018-07-01 19:27:57 +02:00
Duncan Ogilvie
476bc093bc
DBG: add export and import parsing routines in module.cpp
...
#580
2018-07-01 19:27:57 +02:00
Duncan Ogilvie
bee62fbbf0
DBG: add missing locks for ModInfoFromAddr
2018-07-01 19:27:56 +02:00
Duncan Ogilvie
a2c52260f7
DBG: remove unused imports field from MODINFO
2018-07-01 19:27:56 +02:00
Duncan Ogilvie
4fa1b9a2a1
DBG: fix a buffer overflow in the symbol autocomplete function
2018-07-01 19:27:56 +02:00
0cbf519e66
Fix undecorated name being uninitialized.
2018-07-01 19:27:56 +02:00
Duncan Ogilvie
d5ae04dce4
DBG: fully implement symdownload command without dbghelp usage
2018-07-01 19:27:56 +02:00
Duncan Ogilvie
ff11a39533
DBG: attempt to load symbols from multiple locations
2018-07-01 19:27:55 +02:00
Duncan Ogilvie
637815b63d
DBG: symdownload now works without dbghelp
2018-07-01 19:27:55 +02:00
Duncan Ogilvie
ba6ad4cefc
DBG: initial version of Wininet download library
2018-07-01 19:27:55 +02:00
Duncan Ogilvie
3ab836225f
DBG: remove some useless dbghelp calls
2018-07-01 19:27:55 +02:00
Duncan Ogilvie
66017a7442
DBG: refactor SymbolInfo to use VA instead of RVA
2018-07-01 19:27:54 +02:00
Duncan Ogilvie
ffc168f44d
DBG: rename SymbolSourcePDB to SymbolSourceDIA
2018-07-01 19:27:54 +02:00
Duncan Ogilvie
73b30ed49b
DBG: actually use findSymbolsByPrefix
2018-07-01 19:27:54 +02:00
Duncan Ogilvie
876abcdf10
DBG: change findSymbolsByPrefix to take a callback
2018-07-01 19:27:53 +02:00
Duncan Ogilvie
a6ccf69e5b
DBG: implement SymAddrFromName (untested on large symbols, working on small)
2018-07-01 19:27:53 +02:00
Duncan Ogilvie
550a1ff45a
DBG: correct PDB signature format
2018-07-01 19:27:53 +02:00
Duncan Ogilvie
2ce2470ea1
DBG: implement a much nicer data structure for SymbolSourcePDB
2018-07-01 19:27:53 +02:00
Duncan Ogilvie
c7d0f50207
DBG: initial implementation of name-sorted symbol storage
2018-07-01 19:27:52 +02:00
torusrxxx
Jack Reez
Duncan Ogilvie
morsisko
now-raymond
mappzor
Bálint Faragó
Matthaeus Puehringer
pxf_god
Matt
Zhang Li
Mattiwatti
Alexander Miloslavskiy