x64dbg/x64_dbg_dbg/stackinfo.cpp

#include "stackinfo.h"
#include "debugger.h"
#include "memory.h"
#include "disasm_helper.h"
#include "disasm_fast.h"
#include "BeaEngine\BeaEngine.h"
#include "addrinfo.h"
#include "_exports.h"

bool stackcommentget(uint addr, STACK_COMMENT* comment)
{
    uint data=0;
    memset(comment, 0, sizeof(STACK_COMMENT));
    memread(fdProcessInfo->hProcess, (const void*)addr, &data, sizeof(uint), 0);
    if(!memisvalidreadptr(fdProcessInfo->hProcess, data)) //the stack value is no pointer
        return false;

    uint size=0;
    uint base=memfindbaseaddr(data, &size);
    uint readStart=data-16*4;
    if(readStart<base)
        readStart=base;
    unsigned char disasmData[256];
    memread(fdProcessInfo->hProcess, (const void*)readStart, disasmData, sizeof(disasmData), 0);
    uint prev=disasmback(disasmData, 0, sizeof(disasmData), data-readStart, 1);
    uint previousInstr=readStart+prev;

    DISASM disasm;
    disasm.Options=NoformatNumeral;
#ifdef _WIN64
    disasm.Archi=64;
#endif // _WIN64
    disasm.VirtualAddr=previousInstr;
    disasm.EIP=(UIntPtr)(disasmData+prev);
    int len=Disasm(&disasm);
    BASIC_INSTRUCTION_INFO basicinfo;
    bool valid=disasmfast(disasmData+prev, previousInstr, &basicinfo);
    if(valid && basicinfo.call) //call
    {
        char label[MAX_LABEL_SIZE]="";
        ADDRINFO addrinfo;
        addrinfo.flags=flaglabel;
        if(_dbg_addrinfoget(data, SEG_DEFAULT, &addrinfo))
            strcpy(label, addrinfo.label);
        char module[MAX_MODULE_SIZE]="";
        modnamefromaddr(data, module, false);
        char returnToAddr[MAX_COMMENT_SIZE]="";
        if(*module)
            sprintf(returnToAddr, "%s.", module);
        if(!*label)
            sprintf(label, fhex, data);
        strcat(returnToAddr, label);

        data=basicinfo.addr;
        if(data)
        {
            *label=0;
            addrinfo.flags=flaglabel;
            if(_dbg_addrinfoget(data, SEG_DEFAULT, &addrinfo))
                strcpy(label, addrinfo.label);
            *module=0;
            modnamefromaddr(data, module, false);
            char returnFromAddr[MAX_COMMENT_SIZE]="";
            if(*module)
                sprintf(returnFromAddr, "%s.", module);
            if(!*label)
                sprintf(label, fhex, data);
            strcat_s(returnFromAddr, label);
            sprintf_s(comment->comment, "return to %s from %s", returnToAddr, returnFromAddr);
        }
        else
            sprintf_s(comment->comment, "return to %s from ???", returnToAddr);
        strcpy(comment->color, "#ff0000");
        return true;
    }

    //string
    STRING_TYPE strtype;
    char string[512]="";
    if(disasmgetstringat(data, &strtype, string, string, 500))
    {
        if(strtype==str_ascii)
            sprintf(comment->comment, "\"%s\"", string);
        else //unicode
            sprintf(comment->comment, "L\"%s\"", string);
        return true;
    }

    //label
    char label[MAX_LABEL_SIZE]="";
    ADDRINFO addrinfo;
    addrinfo.flags=flaglabel;
    if(_dbg_addrinfoget(data, SEG_DEFAULT, &addrinfo))
        strcpy(label, addrinfo.label);
    char module[MAX_MODULE_SIZE]="";
    modnamefromaddr(data, module, false);
    char addrInfo[MAX_COMMENT_SIZE]="";
    if(*module) //module
    {
        if(*label) //+label
            sprintf(comment->comment, "%s.%s", module, label);
        else //module only
            sprintf(comment->comment, "%s."fhex, module, data);
        return true;
    }
    else if(*label) //label only
    {
        sprintf(comment->comment, "<%s>", label);
        return true;
    }

    return false;
}
#include "console.h"
void stackgetcallstack(uint csp, CALLSTACK* callstack)
{
    callstack->total=0;
    if(!DbgIsDebugging() or csp%sizeof(uint)) //alignment problem
        return;
    if(!memisvalidreadptr(fdProcessInfo->hProcess, csp))
        return;
    std::vector<CALLSTACKENTRY> callstackVector;
    DWORD ticks=GetTickCount();
    uint stacksize=0;
    uint stackbase=memfindbaseaddr(csp, &stacksize, false);
    if(!stackbase) //super-fail (invalid stack address)
        return;
    //walk up the stack
    uint i=csp;
    while(i!=stackbase+stacksize)
    {
        uint data=0;
        memread(fdProcessInfo->hProcess, (const void*)i, &data, sizeof(uint), 0);
        if(memisvalidreadptr(fdProcessInfo->hProcess, data)) //the stack value is a pointer
        {
            uint size=0;
            uint base=memfindbaseaddr(data, &size);
            uint readStart=data-16*4;
            if(readStart<base)
                readStart=base;
            unsigned char disasmData[256];
            memread(fdProcessInfo->hProcess, (const void*)readStart, disasmData, sizeof(disasmData), 0);
            uint prev=disasmback(disasmData, 0, sizeof(disasmData), data-readStart, 1);
            uint previousInstr=readStart+prev;
            BASIC_INSTRUCTION_INFO basicinfo;
            bool valid=disasmfast(disasmData+prev, previousInstr, &basicinfo);
            if(valid && basicinfo.call) //call
            {
                char label[MAX_LABEL_SIZE]="";
                ADDRINFO addrinfo;
                addrinfo.flags=flaglabel;
                if(_dbg_addrinfoget(data, SEG_DEFAULT, &addrinfo))
                    strcpy(label, addrinfo.label);
                char module[MAX_MODULE_SIZE]="";
                modnamefromaddr(data, module, false);
                char returnToAddr[MAX_COMMENT_SIZE]="";
                if(*module)
                    sprintf(returnToAddr, "%s.", module);
                if(!*label)
                    sprintf(label, fhex, data);
                strcat(returnToAddr, label);

                CALLSTACKENTRY curEntry;
                memset(&curEntry, 0, sizeof(CALLSTACKENTRY));
                curEntry.addr=i;
                curEntry.to=data;
                curEntry.from=basicinfo.addr;

                data=basicinfo.addr;
                
                if(data)
                {
                    *label=0;
                    addrinfo.flags=flaglabel;
                    if(_dbg_addrinfoget(data, SEG_DEFAULT, &addrinfo))
                        strcpy(label, addrinfo.label);
                    *module=0;
                    modnamefromaddr(data, module, false);
                    char returnFromAddr[MAX_COMMENT_SIZE]="";
                    if(*module)
                        sprintf(returnFromAddr, "%s.", module);
                    if(!*label)
                        sprintf(label, fhex, data);
                    strcat(returnFromAddr, label);
    
                    sprintf_s(curEntry.comment, "return to %s from %s", returnToAddr, returnFromAddr);
                }
                else
                    sprintf_s(curEntry.comment, "return to %s from ???", returnToAddr);
                callstackVector.push_back(curEntry);
            }
        }
        i+=sizeof(uint);
    }
    callstack->total=(int)callstackVector.size();
    if(callstack->total)
    {
        callstack->entries=(CALLSTACKENTRY*)BridgeAlloc(callstack->total*sizeof(CALLSTACKENTRY));
        for(int i=0; i<callstack->total; i++)
        {
            //CALLSTACKENTRY curEntry;
            //memcpy(&curEntry, &callstackVector.at(i), sizeof(CALLSTACKENTRY));
            //dprintf(fhex":"fhex":"fhex":%s\n", curEntry.addr, curEntry.to, curEntry.from, curEntry.comment);
            memcpy(&callstack->entries[i], &callstackVector.at(i), sizeof(CALLSTACKENTRY));
        }
    }
}