Use backtrace on windows. Updated backtrace API

This commit is contained in:
Christoffer Lerno
2023-11-13 23:30:00 +01:00
committed by Christoffer Lerno
parent 587d5578ab
commit 81c93e3488
15 changed files with 641 additions and 103 deletions

View File

@@ -28,7 +28,22 @@ const Win32_DWORD PIPE_WAIT = 0;
const Win32_DWORD PIPE_NOWAIT = 1;
const Win32_DWORD PIPE_ACCEPT_REMOTE_CLIENTS = 0;
const Win32_DWORD PIPE_REJECT_REMOTE_CLIENTS = 8;
const SYMOPT_CASE_INSENSITIVE = 0x01;
const SYMOPT_UNDNAME = 0x02;
const SYMOPT_DEFERRED_LOADS = 0x04;
const SYMOPT_NO_CPP = 0x08;
const SYMOPT_LOAD_LINES = 0x10;
const SYMOPT_OMAP_FIND_NEAREST = 0x20;
const SYMOPT_LOAD_ANYTHING = 0x40;
const SYMOPT_IGNORE_CVREC = 0x80;
const IMAGE_FILE_MACHINE_UNKNOWN = 0;
const IMAGE_FILE_MACHINE_TARGET_HOST = 1;
const IMAGE_FILE_MACHINE_I386 = 0x014c;
const IMAGE_FILE_MACHINE_IA64 = 0x0200;
const IMAGE_FILE_MACHINE_ARM64 = 0xAA64;
const IMAGE_FILE_MACHINE_AMD64 = 0x8664;
const UNDNAME_COMPLETE = 0x0000;
extern fn void initializeCriticalSection(Win32_CRITICAL_SECTION* section) @extern("InitializeCriticalSection");
extern fn void deleteCriticalSection(Win32_CRITICAL_SECTION* section) @extern("DeleteCriticalSection");
@@ -47,70 +62,136 @@ extern fn Win32_DWORD sleepEx(Win32_DWORD ms, Win32_BOOL alertable) @extern("Sle
extern fn Win32_HANDLE createThread(void* attributes, usz stack, ThreadFn func, void* arg, uint flags, uint* thread_id) @extern("CreateThread");
extern fn Win32_BOOL getExitCodeThread(Win32_HANDLE handle, uint* exit_code) @extern("GetExitCodeThread");
extern fn Win32_BOOL getExitCodeProcess(Win32_HANDLE hProcess, Win32_LPDWORD lpExitCode) @extern("GetExitCodeProcess");
extern fn uint getThreadId(Win32_HANDLE) @extern("GetThreadId");
extern fn void exitThread(uint res) @noreturn @extern("ExitThread");
extern fn Win32_DWORD getThreadId(Win32_HANDLE) @extern("GetThreadId");
extern fn void exitThread(Win32_DWORD dwExitCode) @noreturn @extern("ExitThread");
extern fn Win32_HANDLE getCurrentThread() @extern("GetCurrentThread");
extern fn Win32_BOOL terminateProcess(Win32_HANDLE hProcess, Win32_UINT uExitCode) @extern("TerminateProcess");
extern fn Win32_DWORD getCurrentProcessId() @extern("GetCurrentProcessId");
extern fn Win32_HANDLE getCurrentProcess() @extern("GetCurrentProcess");
extern fn Win32_DWORD getCurrentThreadId() @extern("GetCurrentThreadId");
extern fn Win32_BOOL setHandleInformation(Win32_HANDLE hObject, Win32_DWORD dwMask, Win32_DWORD dwFlags) @extern("SetHandleInformation");
extern fn Win32_HANDLE createEventA(
Win32_LPSECURITY_ATTRIBUTES lpEventAttributes,
Win32_BOOL bManualReset,
Win32_BOOL bInitialState,
Win32_LPCSTR lpName
) @extern("CreateEventA");
extern fn Win32_BOOL createProcessW(
Win32_LPCWSTR lpApplicationName,
Win32_LPWSTR lpCommandLine,
Win32_LPSECURITY_ATTRIBUTES lpProcessAttributes,
Win32_LPSECURITY_ATTRIBUTES lpThreadAttributes,
Win32_BOOL bInheritHandles,
Win32_DWORD dwCreationFlags,
Win32_LPVOID lpEnvironment,
Win32_LPCWSTR lpCurrentDirectory,
Win32_LPSTARTUPINFOW lpStartupInfo,
Win32_LPPROCESS_INFORMATION lpProcessInformation
) @extern("CreateProcessW");
extern fn Win32_HANDLE createNamedPipeA(
Win32_LPCSTR lpName, Win32_DWORD dwOpenMode, Win32_DWORD dwPipeMode,
Win32_DWORD nMaxInstances, Win32_DWORD nOutBufferSize, Win32_DWORD nInBufferSize,
Win32_DWORD nDefaultTimeOut, Win32_LPSECURITY_ATTRIBUTES lpSecurityAttributes
) @extern("CreateNamedPipeA");
extern fn Win32_BOOL getOverlappedResult(
Win32_HANDLE hFile,
Win32_LPOVERLAPPED lpOverlapped,
Win32_LPDWORD lpNumberOfBytesTransferred,
Win32_BOOL bWait
) @extern("GetOverlappedResult");
extern fn Win32_DWORD getEnvironmentVariableW(
Win32_LPCWSTR lpName,
Win32_LPWSTR lpBuffer,
Win32_DWORD nSize
) @extern("GetEnvironmentVariableW");
extern fn Win32_BOOL setEnvironmentVariableW(
Win32_LPCWSTR lpName,
Win32_LPCWSTR lpValue
) @extern("SetEnvironmentVariableW");
extern fn Win32_HANDLE createEventA(Win32_LPSECURITY_ATTRIBUTES lpEventAttributes, Win32_BOOL bManualReset, Win32_BOOL bInitialState, Win32_LPCSTR lpName) @extern("CreateEventA");
extern fn Win32_BOOL createProcessW(Win32_LPCWSTR lpApplicationName, Win32_LPWSTR lpCommandLine, Win32_LPSECURITY_ATTRIBUTES lpProcessAttributes, Win32_LPSECURITY_ATTRIBUTES lpThreadAttributes, Win32_BOOL bInheritHandles, Win32_DWORD dwCreationFlags, Win32_LPVOID lpEnvironment, Win32_LPCWSTR lpCurrentDirectory, Win32_LPSTARTUPINFOW lpStartupInfo, Win32_LPPROCESS_INFORMATION lpProcessInformation) @extern("CreateProcessW");
extern fn Win32_HANDLE createNamedPipeA(Win32_LPCSTR lpName, Win32_DWORD dwOpenMode, Win32_DWORD dwPipeMode, Win32_DWORD nMaxInstances, Win32_DWORD nOutBufferSize, Win32_DWORD nInBufferSize, Win32_DWORD nDefaultTimeOut, Win32_LPSECURITY_ATTRIBUTES lpSecurityAttributes) @extern("CreateNamedPipeA");
extern fn Win32_BOOL getOverlappedResult(Win32_HANDLE hFile, Win32_LPOVERLAPPED lpOverlapped, Win32_LPDWORD lpNumberOfBytesTransferred, Win32_BOOL bWait) @extern("GetOverlappedResult");
extern fn Win32_DWORD getEnvironmentVariableW(Win32_LPCWSTR lpName, Win32_LPWSTR lpBuffer, Win32_DWORD nSize) @extern("GetEnvironmentVariableW");
extern fn Win32_BOOL setEnvironmentVariableW(Win32_LPCWSTR lpName, Win32_LPCWSTR lpValue) @extern("SetEnvironmentVariableW");
extern fn void getSystemInfo(Win32_LPSYSTEM_INFO lpSystemInfo) @extern("GetSystemInfo");
extern fn Win32_BOOL enumProcessModules(Win32_HANDLE hProcess, Win32_HMODULE* lphModule, Win32_DWORD cb, Win32_LPDWORD lpcbNeeded) @extern("K32EnumProcessModules");
extern fn Win32_BOOL getModuleInformation(Win32_HANDLE hProcess, Win32_HMODULE hModule, Win32_LPMODULEINFO lpmodinfo, Win32_DWORD cb) @extern("K32GetModuleInformation");
extern fn Win32_DWORD symAddrIncludeInlineTrace(Win32_HANDLE hProcess, Win32_DWORD64 address) @extern("SymAddrIncludeInlineTrace");
extern fn Win32_BOOL symQueryInlineTrace(Win32_HANDLE hProcess, Win32_DWORD64 startAddress, Win32_DWORD startContext, Win32_DWORD64 startRetAddress, Win32_DWORD64 curAddress, Win32_LPDWORD curContext, Win32_LPDWORD curFrameIndex) @extern("SymQueryInlineTrace");
extern fn Win32_BOOL symFromInlineContext(Win32_HANDLE hProcess, Win32_DWORD64 address, Win32_ULONG inlineContext, Win32_PDWORD64 displacement, Win32_PSYMBOL_INFO symbol) @extern("SymFromInlineContext");
extern fn Win32_BOOL symGetLineFromInlineContext(Win32_HANDLE hProcess, Win32_DWORD64 qwAddr, Win32_ULONG inlineContext, Win32_DWORD64 qwModuleBaseAddress, Win32_PDWORD pdwDisplacement, Win32_PIMAGEHLP_LINE64 line64) @extern("SymGetLineFromInlineContext");
extern fn Win32_ULONG rtlWalkFrameChain(Win32_PVOID*, Win32_ULONG, Win32_ULONG) @extern("RtlWalkFrameChain");
extern fn Win32_BOOL symInitialize(Win32_HANDLE hProcess, Win32_PCSTR userSearchPath, Win32_BOOL fInvadeProcess) @extern("SymInitialize");
extern fn Win32_BOOL symCleanup(Win32_HANDLE hProcess) @extern("SymCleanup");
extern fn Win32_DWORD getModuleFileNameA(Win32_HMODULE hModule, Win32_LPSTR lpFilename, Win32_DWORD nSize) @extern("GetModuleFileNameA");
extern fn Win32_DWORD getModuleFileNameExA(Win32_HANDLE hProcess, Win32_HMODULE hModule, Win32_LPSTR lpFilename, Win32_DWORD nSize) @extern("GetModuleFileNameExA");
extern fn Win32_DWORD64 symLoadModuleEx(Win32_HANDLE hProcess, Win32_HANDLE hFile, Win32_PCSTR imageName, Win32_PCSTR moduleName, Win32_DWORD64 baseOfDll, Win32_DWORD dllSize, Win32_PMODLOAD_DATA data, Win32_DWORD flags) @extern("SymLoadModule");
extern fn Win32_BOOL stackWalk64(Win32_DWORD machineType, Win32_HANDLE hProcess, Win32_HANDLE hThread, Win32_LPSTACKFRAME64 stackFrame, Win32_PVOID contextRecord, Win32_PREAD_PROCESS_MEMORY_ROUTINE64 readMemoryRoutine, Win32_PFUNCTION_TABLE_ACCESS_ROUTINE64 functionTableAccessRoutine, Win32_PGET_MODULE_BASE_ROUTINE64 getModuleBaseRoutine, Win32_PTRANSLATE_ADDRESS_ROUTINE64 translateAddress) @extern("StackWalk64");
extern fn void rtlCaptureContext(Win32_PCONTEXT contextRecord) @extern("RtlCaptureContext");
extern fn void* symFunctionTableAccess64(Win32_HANDLE hProcess, Win32_DWORD64 addrBase) @extern("SymFunctionTableAccess64");
extern fn Win32_DWORD64 symGetModuleBase64(Win32_HANDLE hProcess, Win32_DWORD64 qwAddr) @extern("SymGetModuleBase64");
extern fn Win32_DWORD getModuleBaseNameA(Win32_HANDLE hProcess, Win32_HMODULE hModule, Win32_LPSTR lpBaseName, Win32_DWORD nSize) @extern("K32GetModuleBaseNameA");
extern fn Win32_DWORD symGetOptions() @extern("SymGetOptions");
extern fn Win32_DWORD symSetOptions(Win32_DWORD symOptions) @extern("SymSetOptions");
extern fn Win32_PIMAGE_NT_HEADERS imageNtHeader(Win32_PVOID base) @extern("ImageNtHeader");
extern fn Win32_DWORD unDecorateSymbolName(Win32_PCSTR name, Win32_PSTR outputString, Win32_DWORD maxStringLength, Win32_DWORD flags) @extern("UnDecorateSymbolName");
extern fn Win32_BOOL symFromAddr(Win32_HANDLE hProcess, Win32_DWORD64 address, Win32_PDWORD64 displacement, Win32_PSYMBOL_INFO symbol) @extern("SymFromAddr");
extern fn Win32_BOOL symGetLineFromAddr64(Win32_HANDLE hProcess, Win32_DWORD64 dwAddr, Win32_PDWORD pdwDisplacement, Win32_PIMAGEHLP_LINE64 line) @extern("SymGetLineFromAddr64");
extern fn Win32_WORD rtlCaptureStackBackTrace(Win32_DWORD framesToSkip, Win32_DWORD framesToCapture, Win32_PVOID *backTrace, Win32_PDWORD backTraceHash) @extern("RtlCaptureStackBackTrace");
extern fn Win32_BOOL symGetModuleInfo64(Win32_HANDLE hProcess, Win32_DWORD64 qwAddr, Win32_PIMAGEHLP_MODULE64 moduleInfo) @extern("SymGetModuleInfo64");
struct SystemInfo
fn Win32_DWORD! load_modules()
{
union {
uint dwOemId;
struct {
ushort wProcessorArchitecture;
ushort wReserved;
}
Win32_HANDLE process = getCurrentProcess();
Win32_DWORD needed;
symInitialize(getCurrentProcess(), null, 1);
Win32_DWORD symOptions = symGetOptions();
symOptions |= SYMOPT_LOAD_LINES | SYMOPT_UNDNAME;
symSetOptions(symOptions);
Win32_HMODULE[1024] mod_buffer;
if (!enumProcessModules(process, &mod_buffer, mod_buffer.len, &needed))
{
return BacktraceFault.RESOLUTION_FAILED?;
}
uint dwPageSize;
void* lpMinimumApplicationAddress;
void* lpMaximumApplicationAddress;
usz dwActiveProcessorMask;
uint dwNumberOfProcessors;
uint dwProcessorType;
uint dwAllocationGranularity;
ushort wProcessorLevel;
ushort wProcessorRevision;
if (needed > mod_buffer.len) return BacktraceFault.RESOLUTION_FAILED?;
Win32_HMODULE[] modules = mod_buffer[:needed];
void* base = null;
foreach (mod : modules)
{
Win32_MODULEINFO info;
if (!getModuleInformation(process, mod, &info, $sizeof(info)))
{
return BacktraceFault.RESOLUTION_FAILED?;
}
if (!base) base = info.lpBaseOfDll;
Win32_DWORD load_size = info.sizeOfImage;
char[1024] char_buf;
Win32_DWORD len = getModuleFileNameA(mod, (Win32_LPSTR)&char_buf, char_buf.len - 1);
if (len < 1) continue;
char[1024] module_name;
Win32_DWORD len2 = getModuleBaseNameA(process, mod, (Win32_LPSTR)&module_name, 1021);
if (len2 < 1) continue;
Win32_DWORD64 base_addr = symLoadModuleEx(process, null, (Win32_PCSTR)&char_buf, (Win32_PCSTR)&module_name, (Win32_DWORD64)info.lpBaseOfDll, load_size, null, 0);
}
if (!base) return BacktraceFault.IMAGE_NOT_FOUND?;
Win32_IMAGE_NT_HEADERS* h = imageNtHeader(base);
return h.fileHeader.machine;
}
extern fn CInt get_system_info(SystemInfo*) @extern("GetSystemInfo");
struct Symbol
{
inline Win32_SYMBOL_INFO sym;
char[256] buffer;
}
Win32_DWORD64 displacement;
fn BacktraceList! symbolize_backtrace(void*[] backtrace, Allocator* allocator)
{
BacktraceList list;
list.init_new(backtrace.len, allocator);
Win32_HANDLE process = getCurrentProcess();
symInitialize(process, null, 1);
defer symCleanup(process);
foreach (addr : backtrace)
{
list.append(resolve_backtrace(addr, process, allocator) ?? backtrace::BACKTRACE_UNKNOWN);
}
return list;
}
fn Backtrace! resolve_backtrace(void* addr, Win32_HANDLE process, Allocator* allocator)
{
Symbol symbol;
//Win32_DWORD image_type = load_modules()!;
symbol.sizeOfStruct = Win32_SYMBOL_INFO.sizeof;
symbol.maxNameLen = 255;
if (!symFromAddr(process, (Win32_DWORD64)addr - 1, &displacement, &symbol))
{
return BacktraceFault.NO_BACKTRACE_SYMBOLS?;
}
Win32_IMAGEHLP_MODULE64 module_info;
module_info.sizeOfStruct = Win32_IMAGEHLP_MODULE64.sizeof;
if (!symGetModuleInfo64(process, (Win32_DWORD64)addr - 1, &module_info))
{
return BacktraceFault.NO_BACKTRACE_SYMBOLS?;
}
ZString module_name = (ZString)&module_info.imageName;
char[256] name;
unDecorateSymbolName(&symbol.name, (Win32_PSTR)&name, 256, UNDNAME_COMPLETE);
Win32_DWORD offset = 0;
Win32_IMAGEHLP_LINE64 line;
Backtrace backtrace;
ZString zname = (ZString)&name;
if (!symGetLineFromAddr64(process, (Win32_ULONG64)addr - 1, &offset, &line))
{
backtrace.init((uptr)addr, .function = zname.str_view(), .object_file = module_name.str_view(), .allocator = allocator);
return backtrace;
}
String filename = ((ZString)line.fileName).str_view();
backtrace.init((uptr)addr, .function = zname.str_view(), .object_file = module_name.str_view(), .file = filename, .line = line.lineNumber, .allocator = allocator);
return backtrace;
}

View File

@@ -266,3 +266,431 @@ struct Win32_PROCESS_INFORMATION
def Win32_PPROCESS_INFORMATION = Win32_PROCESS_INFORMATION*;
def Win32_LPPROCESS_INFORMATION = Win32_PROCESS_INFORMATION*;
struct Win32_SYSTEM_INFO
{
union
{
Win32_DWORD dwOemId;
struct
{
Win32_WORD wProcessorArchitecture;
Win32_WORD wReserved;
}
}
Win32_DWORD dwPageSize;
Win32_LPVOID lpMinimumApplicationAddress;
Win32_LPVOID lpMaximumApplicationAddress;
Win32_DWORD_PTR dwActiveProcessorMask;
Win32_DWORD dwNumberOfProcessors;
Win32_DWORD dwProcessorType;
Win32_DWORD dwAllocationGranularity;
Win32_WORD wProcessorLevel;
Win32_WORD wProcessorRevision;
}
def Win32_LPSYSTEM_INFO = Win32_SYSTEM_INFO*;
struct Win32_MODULEINFO
{
Win32_LPVOID lpBaseOfDll;
Win32_DWORD sizeOfImage;
Win32_LPVOID entryPoint;
}
struct Win32_IMAGEHLP_LINE64
{
Win32_DWORD sizeOfStruct;
Win32_PVOID key;
Win32_DWORD lineNumber;
Win32_PCHAR fileName;
Win32_DWORD64 address;
}
enum Win32_SYM_TYPE
{
SYM_NONE,
SYM_COFF,
SYM_CV,
SYM_PDB,
SYM_EXPORT,
SYM_DEFERRED,
SYM_SYM,
SYM_DIA,
SYM_VIRTUAL
}
struct Win32_GUID
{
CULong data1;
CUShort data2;
CUShort data3;
char[8] data4;
}
struct Win32_IMAGEHLP_MODULE64
{
Win32_DWORD sizeOfStruct;
Win32_DWORD64 baseOfImage;
Win32_DWORD imageSize;
Win32_DWORD timeDateStamp;
Win32_DWORD checkSum;
Win32_DWORD numSyms;
Win32_SYM_TYPE symType;
Win32_CHAR[32] moduleName;
Win32_CHAR[256] imageName;
Win32_CHAR[256] loadedImageName;
Win32_CHAR[256] loadedPdbName;
Win32_DWORD cVSig;
Win32_CHAR** cVData;
Win32_DWORD pdbSig;
Win32_GUID pdbSig70;
Win32_DWORD pdbAge;
Win32_BOOL pdbUnmatched;
Win32_BOOL dbgUnmatched;
Win32_BOOL lineNumbers;
Win32_BOOL globalSymbols;
Win32_BOOL typeInfo;
Win32_BOOL sourceIndexed;
Win32_BOOL publics;
Win32_DWORD machineType;
Win32_DWORD reserved;
}
def Win32_PIMAGEHLP_MODULE64 = Win32_IMAGEHLP_MODULE64*;
struct Win32_ARM64_NT_CONTEXT @align(16)
{
Win32_DWORD contextFlags;
Win32_DWORD cpsr;
union
{
struct
{
Win32_DWORD64 x0;
Win32_DWORD64 x1;
Win32_DWORD64 x2;
Win32_DWORD64 x3;
Win32_DWORD64 x4;
Win32_DWORD64 x5;
Win32_DWORD64 x6;
Win32_DWORD64 x7;
Win32_DWORD64 x8;
Win32_DWORD64 x9;
Win32_DWORD64 x10;
Win32_DWORD64 x11;
Win32_DWORD64 x12;
Win32_DWORD64 x13;
Win32_DWORD64 x14;
Win32_DWORD64 x15;
Win32_DWORD64 x16;
Win32_DWORD64 x17;
Win32_DWORD64 x18;
Win32_DWORD64 x19;
Win32_DWORD64 x20;
Win32_DWORD64 x21;
Win32_DWORD64 x22;
Win32_DWORD64 x23;
Win32_DWORD64 x24;
Win32_DWORD64 x25;
Win32_DWORD64 x26;
Win32_DWORD64 x27;
Win32_DWORD64 x28;
Win32_DWORD64 fp;
Win32_DWORD64 lr;
}
Win32_DWORD64[31] x;
}
Win32_DWORD64 sp;
Win32_DWORD64 pc;
Win32_ARM64_NT_NEON128[32] v;
Win32_DWORD fpcr;
Win32_DWORD fpsr;
Win32_DWORD[ARM64_MAX_BREAKPOINTS] bcr;
Win32_DWORD64[ARM64_MAX_BREAKPOINTS] bvr;
Win32_DWORD[ARM64_MAX_WATCHPOINTS] wcr;
Win32_DWORD64[ARM64_MAX_WATCHPOINTS] wvr;
}
const ARM64_MAX_BREAKPOINTS = 8;
const ARM64_MAX_WATCHPOINTS = 2;
struct Win32_ARM64_NT_NEON128
{
Win32_ULONGLONG low;
Win32_LONGLONG high;
}
struct Win32_XMM_SAVE_AREA32
{
Win32_USHORT controlWord;
Win32_USHORT statusWord;
Win32_UCHAR tagWord;
Win32_UCHAR reserved1;
Win32_USHORT errorOpcode;
Win32_ULONG errrorOffset;
Win32_USHORT errorSelector;
Win32_USHORT reserved2;
Win32_ULONG dataOffset;
Win32_USHORT dataSelector;
Win32_USHORT reserved3;
Win32_ULONG mxCsr;
Win32_ULONG mxCsr_Mask;
Win32_M128A[8] floatRegisters;
Win32_M128A[16] xmmRegisters;
Win32_UCHAR[96] reserved4;
}
struct Win32_AMD64_CONTEXT @align(16)
{
Win32_DWORD64 p1Home;
Win32_DWORD64 p2Home;
Win32_DWORD64 p3Home;
Win32_DWORD64 p4Home;
Win32_DWORD64 p5Home;
Win32_DWORD64 p6Home;
Win32_DWORD contextFlags;
Win32_DWORD mxCsr;
Win32_WORD segCs;
Win32_WORD segDs;
Win32_WORD segEs;
Win32_WORD segFs;
Win32_WORD segGs;
Win32_WORD segSs;
Win32_DWORD eFlags;
Win32_DWORD64 dr0;
Win32_DWORD64 dr1;
Win32_DWORD64 dr2;
Win32_DWORD64 dr3;
Win32_DWORD64 dr6;
Win32_DWORD64 dr7;
Win32_DWORD64 rax;
Win32_DWORD64 rcx;
Win32_DWORD64 rdx;
Win32_DWORD64 rbx;
Win32_DWORD64 rsp;
Win32_DWORD64 rbp;
Win32_DWORD64 rsi;
Win32_DWORD64 rdi;
Win32_DWORD64 r8;
Win32_DWORD64 r9;
Win32_DWORD64 r10;
Win32_DWORD64 r11;
Win32_DWORD64 r12;
Win32_DWORD64 r13;
Win32_DWORD64 r14;
Win32_DWORD64 r15;
Win32_DWORD64 rip;
union
{
Win32_XMM_SAVE_AREA32 fltSave;
//Win32_NEON128[16] q;
Win32_ULONGLONG[32] d;
struct
{
Win32_M128A[2] header;
Win32_M128A[8] legacy;
Win32_M128A xmm0;
Win32_M128A xmm1;
Win32_M128A xmm2;
Win32_M128A xmm3;
Win32_M128A xmm4;
Win32_M128A xmm5;
Win32_M128A xmm6;
Win32_M128A xmm7;
Win32_M128A xmm8;
Win32_M128A xmm9;
Win32_M128A xmm10;
Win32_M128A xmm11;
Win32_M128A xmm12;
Win32_M128A xmm13;
Win32_M128A xmm14;
Win32_M128A xmm15;
}
Win32_DWORD[32] s;
}
Win32_M128A[26] vectorRegister;
Win32_DWORD64 vectorControl;
Win32_DWORD64 debugControl;
Win32_DWORD64 lastBranchToRip;
Win32_DWORD64 lastBranchFromRip;
Win32_DWORD64 lastExceptionToRip;
Win32_DWORD64 lastExceptionFromRip;
}
const CONTEXT_AMD64 = 0x00100000;
const CONTEXT_AMD64_CONTROL = CONTEXT_AMD64 | 0x0001;
const CONTEXT_AMD64_INTEGER = CONTEXT_AMD64 | 0x0002;
const CONTEXT_AMD64_SEGMENTS = CONTEXT_AMD64 | 0x0004;
const CONTEXT_AMD64_FLOATING_POINT = CONTEXT_AMD64 | 0x0008;
const CONTEXT_AMD64_DEBUG_REGISTERS = CONTEXT_AMD64 | 0x0010;
const CONTEXT_AMD64_FULL = CONTEXT_AMD64_CONTROL | CONTEXT_AMD64_INTEGER | CONTEXT_AMD64_FLOATING_POINT;
const CONTEXT_AMD64_ALL = CONTEXT_AMD64_CONTROL | CONTEXT_AMD64_INTEGER | CONTEXT_AMD64_SEGMENTS | CONTEXT_AMD64_FLOATING_POINT | CONTEXT_AMD64_DEBUG_REGISTERS;
def CONTEXT_CONTROL = CONTEXT_AMD64_CONTROL;
def CONTEXT_FULL = CONTEXT_AMD64_FULL;
def CONTEXT_ALL = CONTEXT_AMD64_ALL;
def Win32_CONTEXT = Win32_AMD64_CONTEXT;
def Win32_PCONTEXT = Win32_CONTEXT*;
struct Win32_M128A @align(16)
{
Win32_ULONGLONG low;
Win32_LONGLONG high;
}
struct Win32_IMAGE_DATA_DIRECTORY
{
Win32_ULONG virtualAddress;
Win32_ULONG size;
}
struct Win32_IMAGE_OPTIONAL_HEADER64
{
Win32_WORD magic;
Win32_BYTE majorLinkerVersion;
Win32_BYTE minorLinkerVersion;
Win32_DWORD sizeOfCode;
Win32_DWORD sizeOfInitializedData;
Win32_DWORD sizeOfUninitializedData;
Win32_DWORD addressOfEntryPoint;
Win32_DWORD baseOfCode;
Win32_ULONGLONG imageBase;
Win32_DWORD sectionAlignment;
Win32_DWORD fileAlignment;
Win32_WORD majorOperatingSystemVersion;
Win32_WORD minorOperatingSystemVersion;
Win32_WORD majorImageVersion;
Win32_WORD minorImageVersion;
Win32_WORD majorSubsystemVersion;
Win32_WORD minorSubsystemVersion;
Win32_DWORD win32VersionValue;
Win32_DWORD sizeOfImage;
Win32_DWORD sizeOfHeaders;
Win32_DWORD checkSum;
Win32_WORD subsystem;
Win32_WORD dllCharacteristics;
Win32_ULONGLONG sizeOfStackReserve;
Win32_ULONGLONG sizeOfStackCommit;
Win32_ULONGLONG sizeOfHeapReserve;
Win32_ULONGLONG sizeOfHeapCommit;
Win32_DWORD loaderFlags;
Win32_DWORD numberOfRvaAndSizes;
Win32_IMAGE_DATA_DIRECTORY[16] dataDirectory;
}
def Win32_PIMAGE_OPTIONAL_HEADER64 = Win32_IMAGE_OPTIONAL_HEADER64*;
struct Win32_IMAGE_FILE_HEADER
{
Win32_WORD machine;
Win32_WORD numberOfSections;
Win32_DWORD timeDateStamp;
Win32_DWORD pointerToSymbolTable;
Win32_DWORD numberOfSymbols;
Win32_WORD sizeOfOptionalHeader;
Win32_WORD characteristics;
}
def Win32_PIMAGE_FILE_HEADER = Win32_IMAGE_FILE_HEADER*;
struct Win32_IMAGE_NT_HEADERS
{
Win32_DWORD signature;
Win32_IMAGE_FILE_HEADER fileHeader;
Win32_IMAGE_OPTIONAL_HEADER64 optionalHeader;
}
def Win32_PIMAGE_NT_HEADERS = Win32_IMAGE_NT_HEADERS*;
struct Win32_SYMBOL_INFO
{
Win32_ULONG sizeOfStruct;
Win32_ULONG typeIndex;
Win32_ULONG64[2] reserved;
Win32_ULONG index;
Win32_ULONG size;
Win32_ULONG64 modBase;
Win32_ULONG flags;
Win32_ULONG64 value;
Win32_ULONG64 address;
Win32_ULONG register;
Win32_ULONG scope;
Win32_ULONG tag;
Win32_ULONG nameLen;
Win32_ULONG maxNameLen;
Win32_CHAR[1] name;
}
def Win32_PSYMBOL_INFO = Win32_SYMBOL_INFO*;
struct Win32_MODLOAD_DATA
{
Win32_DWORD ssize;
Win32_DWORD ssig;
Win32_PVOID data;
Win32_DWORD size;
Win32_DWORD flags;
}
enum Win32_ADDRESS_MODE
{
ADDR_MODE_1616,
ADDR_MODE_1632,
ADDR_MODE_REAL,
ADDR_MODE_FLAT,
}
struct Win32_ADDRESS64
{
Win32_DWORD64 offset;
Win32_WORD segment;
Win32_ADDRESS_MODE mode;
}
struct Win32_KDHELP64
{
Win32_DWORD64 thread;
Win32_DWORD thCallbackStack;
Win32_DWORD thCallbackBStore;
Win32_DWORD nextCallback;
Win32_DWORD framePointer;
Win32_DWORD64 kiCallUserMode;
Win32_DWORD64 keUserCallbackDispatcher;
Win32_DWORD64 systemRangeStart;
Win32_DWORD64 kiUserExceptionDispatcher;
Win32_DWORD64 stackBase;
Win32_DWORD64 stackLimit;
Win32_DWORD buildVersion;
Win32_DWORD retpolineStubFunctionTableSize;
Win32_DWORD64 retpolineStubFunctionTable;
Win32_DWORD retpolineStubOffset;
Win32_DWORD retpolineStubSize;
Win32_DWORD64[2] reserved0;
}
struct Win32_STACKFRAME64
{
Win32_ADDRESS64 addrPC;
Win32_ADDRESS64 addrReturn;
Win32_ADDRESS64 addrFrame;
Win32_ADDRESS64 addrStack;
Win32_ADDRESS64 addrBStore;
Win32_PVOID funcTableEntry;
Win32_DWORD64[4] params;
Win32_BOOL far;
Win32_BOOL virtual;
Win32_DWORD64[3] reserved;
Win32_KDHELP64 kdHelp;
}
def Win32_PREAD_PROCESS_MEMORY_ROUTINE64 = fn Win32_BOOL(Win32_HANDLE hProcess, Win32_DWORD64 qwBaseAddress, Win32_PVOID lpBuffer, Win32_DWORD nSize, Win32_LPDWORD lpNumberOfBytesRead);
def Win32_PFUNCTION_TABLE_ACCESS_ROUTINE64 = fn Win32_PVOID(Win32_HANDLE ahProcess, Win32_DWORD64 addrBase);
def Win32_PGET_MODULE_BASE_ROUTINE64 = fn Win32_DWORD64(Win32_HANDLE hProcess, Win32_DWORD64 address);
def Win32_PTRANSLATE_ADDRESS_ROUTINE64 = fn Win32_DWORD64(Win32_HANDLE hProcess, Win32_HANDLE hThread, Win32_LPADDRESS64 lpaddr);
def Win32_PKDHELP64 = Win32_KDHELP64*;
def Win32_LPADDRESS64 = Win32_ADDRESS64*;
def Win32_LPSTACKFRAME64 = Win32_STACKFRAME64*;
def Win32_PMODLOAD_DATA = Win32_MODLOAD_DATA*;
def Win32_PIMAGEHLP_LINE64 = Win32_IMAGEHLP_LINE64*;
def Win32_LPMODULEINFO = Win32_MODULEINFO*;