Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- typedef BOOL (*SymInitializeType)(
- _In_ HANDLE hProcess,
- _In_opt_ PCWSTR UserSearchPath,
- _In_ BOOL fInvadeProcess
- );
- #define SYMOPT_DEBUG 0x80000000
- typedef DWORD(*SymSetOptionsType)(
- _In_ DWORD SymOptions
- );
- typedef BOOL
- (CALLBACK* PSYMBOL_REGISTERED_CALLBACK64)(
- _In_ HANDLE hProcess,
- _In_ ULONG ActionCode,
- _In_opt_ ULONG64 CallbackData,
- _In_opt_ ULONG64 UserContext
- );
- typedef BOOL (*SymRegisterCallback64Type)(
- _In_ HANDLE hProcess,
- _In_ PSYMBOL_REGISTERED_CALLBACK64 CallbackFunction,
- _In_ ULONG64 UserContext
- );
- typedef struct _MODLOAD_DATA {
- DWORD ssize; // size of this struct
- DWORD ssig; // signature identifying the passed data
- PVOID data; // pointer to passed data
- DWORD size; // size of passed data
- DWORD flags; // options
- } MODLOAD_DATA, * PMODLOAD_DATA;
- typedef DWORD64
- (*SymLoadModuleExType)(
- _In_ HANDLE hProcess,
- _In_opt_ HANDLE hFile,
- _In_opt_ PCWSTR ImageName,
- _In_opt_ PCWSTR ModuleName,
- _In_ DWORD64 BaseOfDll,
- _In_ DWORD DllSize,
- _In_opt_ PMODLOAD_DATA Data,
- _In_opt_ DWORD Flags
- );
- typedef struct _IMAGEHLP_CBA_EVENT {
- DWORD severity; // values from sevInfo to sevFatal
- DWORD code; // numerical code IDs the error
- PCHAR desc; // may contain a text description of the error
- PVOID object; // value dependant upon the error code
- } IMAGEHLP_CBA_EVENT, * PIMAGEHLP_CBA_EVENT;
- #define CBA_EVENT 0x00000010
- static BOOL
- CALLBACK
- HandleEvent(
- __in HANDLE hProcess,
- __in ULONG ActionCode,
- __in_opt ULONG64 CallbackData,
- __in_opt ULONG64 UserContext
- )
- {
- UNREFERENCED_PARAMETER(hProcess);
- UNREFERENCED_PARAMETER(UserContext);
- PIMAGEHLP_CBA_EVENT evt;
- // If SYMOPT_DEBUG is set, then the symbol handler will pass
- // verbose information on its attempt to load symbols.
- // This information be delivered as text strings.
- switch (ActionCode)
- {
- case CBA_EVENT:
- evt = (PIMAGEHLP_CBA_EVENT)CallbackData;
- LogD(Tag::BASE) << WideString((PTSTR)evt->desc);
- break;
- // CBA_DEBUG_INFO is the old ActionCode for symbol spew.
- // It still works, but we use CBA_EVENT in this example.
- #if 0
- case CBA_DEBUG_INFO:
- _tprintf(_T("%s"), (PTSTR)CallbackData);
- break;
- #endif
- default:
- // Return false to any ActionCode we don't handle
- // or we could generate some undesirable behavior.
- return FALSE;
- }
- return TRUE;
- }
- static String GetLastErrorAsString()
- {
- //Get the error message ID, if any.
- DWORD errorMessageID = ::GetLastError();
- if (errorMessageID == 0) {
- return std::string(); //No error message has been recorded
- }
- LPSTR messageBuffer = nullptr;
- //Ask Win32 to give us the string version of that message ID.
- //The parameters we pass in, tell Win32 to create the buffer that holds the message for us (because we don't yet know how long the message string will be).
- size_t size = FormatMessageA(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
- NULL, errorMessageID, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPSTR)&messageBuffer, 0, NULL);
- //Copy the error message into a std::string.
- std::string message(messageBuffer, size);
- //Free the Win32's string's buffer.
- LocalFree(messageBuffer);
- return message;
- }
- void TryLoadMainModule(HANDLE hProcess) const
- {
- SymInitializeType SymInitialize = reinterpret_cast<SymInitializeType>(GetProcAddress(dbgLibrary, "SymInitializeW"));
- SymSetOptionsType SymSetOptions = reinterpret_cast<SymSetOptionsType>(GetProcAddress(dbgLibrary, "SymSetOptions"));
- SymRegisterCallback64Type SymRegisterCallback64 = reinterpret_cast<SymRegisterCallback64Type>(GetProcAddress(dbgLibrary, "SymRegisterCallbackW64"));
- SymLoadModuleExType SymLoadModuleEx = reinterpret_cast<SymLoadModuleExType>(GetProcAddress(dbgLibrary, "SymLoadModuleExW"));
- BOOL status;
- int rc = -1;
- DWORD64 module;
- // If we want to se debug spew, we need to set this option.
- SymSetOptions(SYMOPT_DEBUG);
- // Now register our callback.
- status = SymInitialize(hProcess, NULL, false);
- if (!status)
- {
- LogD(Tag::BASE) << "Error calling SSymInitialize: " << GetLastErrorAsString();
- return;
- }
- status = SymRegisterCallback64(hProcess, HandleEvent, NULL);
- if (!status)
- {
- LogD(Tag::BASE) << "Error calling SymRegisterCallback64: " << GetLastErrorAsString();
- return;
- }
- // Go ahead and load a module for testing.
- module = SymLoadModuleEx(hProcess, // our unique id
- NULL, // no open file handle to image
- L"bla-bla.exe", // name of image to load
- NULL, // no module name - dbghelp will get it
- 0, // no base address - dbghelp will get it
- 0, // no module size - dbghelp will get it
- NULL, // no special MODLOAD_DATA structure
- 0); // flags
- if (!module)
- {
- LogD(Tag::BASE) << "Error calling SymLoadModuleEx: " << GetLastErrorAsString();
- return;
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement