#ifndef _NT_DEBUG_H_ #define _NT_DEBUG_H_ #include "nt_abi.h" #include "nt_object.h" #include "nt_exception.h" /* debug access rights */ #define NT_DEBUG_SPECIFIC_RIGHTS (0xf) #define NT_DEBUG_ALL_ACCESS (NT_SEC_STANDARD_RIGHTS_ALL \ | NT_DEBUG_SPECIFIC_RIGHTS) /* debug flags */ #define NT_DEBUG_DETACH_ON_EXIT (0x0) #define NT_DEBUG_KILL_ON_EXIT (0x1) /* debug object information classes */ #define NT_DEBUG_OBJECT_FLAGS_INFO (0X1) /* debug filter mask */ #define NT_DBG_FLTR_ERROR_LEVEL (0x0) #define NT_DBG_FLTR_WARNING_LEVEL (0x1) #define NT_DBG_FLTR_TRACE_LEVEL (0x2) #define NT_DBG_FLTR_INFO_LEVEL (0x3) #define NT_DBG_FLTR_MASK (0x8000000) /* debug states */ typedef enum _nt_dbg_state { NT_DBG_STATE_IDLE, NT_DBG_STATE_REPLY_PENDING, NT_DBG_STATE_CREATE_THREAD, NT_DBG_STATE_CREATE_PROCESS, NT_DBG_STATE_EXIT_THREAD, NT_DBG_STATE_EXIT_PROCESS, NT_DBG_STATE_EXCEPTION, NT_DBG_STATE_BREAKPOINT, NT_DBG_STATE_SINGLE_STEP, NT_DBG_STATE_DLL_LOAD, NT_DBG_STATE_DLL_UNLOAD, } nt_dbg_state; /* debug filters */ typedef enum _nt_dbg_fltr_type { NT_DBG_FLTR_SYSTEM_ID, NT_DBG_FLTR_SMSS_ID, NT_DBG_FLTR_SETUP_ID, NT_DBG_FLTR_NTFS_ID, NT_DBG_FLTR_FSTUB_ID, NT_DBG_FLTR_CRASHDUMP_ID, NT_DBG_FLTR_CDAUDIO_ID, NT_DBG_FLTR_CDROM_ID, NT_DBG_FLTR_CLASSPNP_ID, NT_DBG_FLTR_DISK_ID, NT_DBG_FLTR_REDBOOK_ID, NT_DBG_FLTR_STORPROP_ID, NT_DBG_FLTR_SCSIPORT_ID, NT_DBG_FLTR_SCSIMINIPORT_ID, NT_DBG_FLTR_CONFIG_ID, NT_DBG_FLTR_I8042PRT_ID, NT_DBG_FLTR_SERMOUSE_ID, NT_DBG_FLTR_LSERMOUS_ID, NT_DBG_FLTR_KBDHID_ID, NT_DBG_FLTR_MOUHID_ID, NT_DBG_FLTR_KBDCLASS_ID, NT_DBG_FLTR_MOUCLASS_ID, NT_DBG_FLTR_TWOTRACK_ID, NT_DBG_FLTR_WMILIB_ID, NT_DBG_FLTR_ACPI_ID, NT_DBG_FLTR_AMLI_ID, NT_DBG_FLTR_HALIA64_ID, NT_DBG_FLTR_VIDEO_ID, NT_DBG_FLTR_SVCHOST_ID, NT_DBG_FLTR_VIDEOPRT_ID, NT_DBG_FLTR_TCPIP_ID, NT_DBG_FLTR_DMSYNTH_ID, NT_DBG_FLTR_NTOSPNP_ID, NT_DBG_FLTR_FASTFAT_ID, NT_DBG_FLTR_SAMSS_ID, NT_DBG_FLTR_PNPMGR_ID, NT_DBG_FLTR_NETAPI_ID, NT_DBG_FLTR_SCSERVER_ID, NT_DBG_FLTR_SCCLIENT_ID, NT_DBG_FLTR_SERIAL_ID, NT_DBG_FLTR_SERENUM_ID, NT_DBG_FLTR_UHCD_ID, NT_DBG_FLTR_RPCPROXY_ID, NT_DBG_FLTR_AUTOCHK_ID, NT_DBG_FLTR_DCOMSS_ID, NT_DBG_FLTR_UNIMODEM_ID, NT_DBG_FLTR_SIS_ID, NT_DBG_FLTR_FLTMGR_ID, NT_DBG_FLTR_WMICORE_ID, NT_DBG_FLTR_BURNENG_ID, NT_DBG_FLTR_IMAPI_ID, NT_DBG_FLTR_SXS_ID, NT_DBG_FLTR_FUSION_ID, NT_DBG_FLTR_IDLETASK_ID, NT_DBG_FLTR_SOFTPCI_ID, NT_DBG_FLTR_TAPE_ID, NT_DBG_FLTR_MCHGR_ID, NT_DBG_FLTR_IDEP_ID, NT_DBG_FLTR_PCIIDE_ID, NT_DBG_FLTR_FLOPPY_ID, NT_DBG_FLTR_FDC_ID, NT_DBG_FLTR_TERMSRV_ID, NT_DBG_FLTR_W32TIME_ID, NT_DBG_FLTR_PREFETCHER_ID, NT_DBG_FLTR_RSFILTER_ID, NT_DBG_FLTR_FCPORT_ID, NT_DBG_FLTR_PCI_ID, NT_DBG_FLTR_DMIO_ID, NT_DBG_FLTR_DMCONFIG_ID, NT_DBG_FLTR_DMADMIN_ID, NT_DBG_FLTR_WSOCKTRANSPORT_ID, NT_DBG_FLTR_VSS_ID, NT_DBG_FLTR_PNPMEM_ID, NT_DBG_FLTR_PROCESSOR_ID, NT_DBG_FLTR_DMSERVER_ID, NT_DBG_FLTR_SR_ID, NT_DBG_FLTR_INFINIBAND_ID, NT_DBG_FLTR_IHVDRIVER_ID, NT_DBG_FLTR_IHVVIDEO_ID, NT_DBG_FLTR_IHVAUDIO_ID, NT_DBG_FLTR_IHVNETWORK_ID, NT_DBG_FLTR_IHVSTREAMING_ID, NT_DBG_FLTR_IHVBUS_ID, NT_DBG_FLTR_HPS_ID, NT_DBG_FLTR_RTLTHREADPOOL_ID, NT_DBG_FLTR_LDR_ID, NT_DBG_FLTR_TCPIP6_ID, NT_DBG_FLTR_ISAPNP_ID, NT_DBG_FLTR_SHPC_ID, NT_DBG_FLTR_STORPORT_ID, NT_DBG_FLTR_STORMINIPORT_ID, NT_DBG_FLTR_PRINTSPOOLER_ID, NT_DBG_FLTR_VSSDYNDISK_ID, NT_DBG_FLTR_VERIFIER_ID, NT_DBG_FLTR_VDS_ID, NT_DBG_FLTR_VDSBAS_ID, NT_DBG_FLTR_VDSDYN_ID, NT_DBG_FLTR_VDSDYNDR_ID, NT_DBG_FLTR_VDSLDR_ID, NT_DBG_FLTR_VDSUTIL_ID, NT_DBG_FLTR_DFRGIFC_ID, NT_DBG_FLTR_DEFAULT_ID, NT_DBG_FLTR_MM_ID, NT_DBG_FLTR_DFSC_ID, NT_DBG_FLTR_WOW64_ID, NT_DBG_FLTR_ALPC_ID, NT_DBG_FLTR_WDI_ID, NT_DBG_FLTR_PERFLIB_ID, NT_DBG_FLTR_KTM_ID, NT_DBG_FLTR_IOSTRESS_ID, NT_DBG_FLTR_HEAP_ID, NT_DBG_FLTR_WHEA_ID, NT_DBG_FLTR_USERGDI_ID, NT_DBG_FLTR_MMCSS_ID, NT_DBG_FLTR_TPM_ID, NT_DBG_FLTR_THREADORDER_ID, NT_DBG_FLTR_ENVIRON_ID, NT_DBG_FLTR_EMS_ID, NT_DBG_FLTR_WDT_ID, NT_DBG_FLTR_FVEVOL_ID, NT_DBG_FLTR_NDIS_ID, NT_DBG_FLTR_NVCTRACE_ID, NT_DBG_FLTR_LUAFV_ID, NT_DBG_FLTR_APPCOMPAT_ID, NT_DBG_FLTR_USBSTOR_ID, NT_DBG_FLTR_SBP2PORT_ID, NT_DBG_FLTR_COVERAGE_ID, NT_DBG_FLTR_CACHEMGR_ID, NT_DBG_FLTR_MOUNTMGR_ID, NT_DBG_FLTR_CFR_ID, NT_DBG_FLTR_TXF_ID, NT_DBG_FLTR_KSECDD_ID, NT_DBG_FLTR_FLTREGRESS_ID, NT_DBG_FLTR_MPIO_ID, NT_DBG_FLTR_MSDSM_ID, NT_DBG_FLTR_UDFS_ID, NT_DBG_FLTR_PSHED_ID, NT_DBG_FLTR_STORVSP_ID, NT_DBG_FLTR_LSASS_ID, NT_DBG_FLTR_SSPICLI_ID, NT_DBG_FLTR_CNG_ID, NT_DBG_FLTR_EXFAT_ID, NT_DBG_FLTR_FILETRACE_ID, NT_DBG_FLTR_XSAVE_ID, NT_DBG_FLTR_SE_ID, NT_DBG_FLTR_DRIVEEXTENDER_ID, NT_DBG_FLTR_POWER_ID, NT_DBG_FLTR_CRASHDUMPXHCI_ID, NT_DBG_FLTR_GPIO_ID, NT_DBG_FLTR_REFS_ID, NT_DBG_FLTR_WER_ID, NT_DBG_FLTR_CAPIMG_ID, NT_DBG_FLTR_VPCI_ID, NT_DBG_FLTR_STORAGECLASSMEMORY_ID, NT_DBG_FLTR_ENDOFTABLE_ID, } nt_dbg_fltr_type; /* execution flow masks */ #define NT_DBG_FLOW_MASK_IDLE (1 << NT_DBG_STATE_IDLE) #define NT_DBG_FLOW_MASK_REPLY_PENDING (1 << NT_DBG_STATE_REPLY_PENDING) #define NT_DBG_FLOW_MASK_CREATE_THREAD (1 << NT_DBG_STATE_CREATE_THREAD) #define NT_DBG_FLOW_MASK_CREATE_PROCESS (1 << NT_DBG_STATE_CREATE_PROCESS) #define NT_DBG_FLOW_MASK_EXIT_THREAD (1 << NT_DBG_STATE_EXIT_THREAD) #define NT_DBG_FLOW_MASK_EXIT_PROCESS (1 << NT_DBG_STATE_EXIT_PROCESS) #define NT_DBG_FLOW_MASK_EXCEPTION (1 << NT_DBG_STATE_EXCEPTION) #define NT_DBG_FLOW_MASK_BREAKPOINT (1 << NT_DBG_STATE_BREAKPOINT) #define NT_DBG_FLOW_MASK_SINGLE_STEP (1 << NT_DBG_STATE_SINGLE_STEP) #define NT_DBG_FLOW_MASK_DLL_LOAD (1 << NT_DBG_STATE_DLL_LOAD) #define NT_DBG_FLOW_MASK_DLL_UNLOAD (1 << NT_DBG_STATE_DLL_UNLOAD) #define NT_DBG_FLOW_MASK_EXECUTION_TREE (0x10000000) #define NT_DBG_FLOW_MASK_DETACH_AND_CLOSE (0x20000000) /* debug events */ typedef struct _nt_dbg_km_thread_exit { int32_t exit_status; } nt_dbg_km_thread_exit; typedef struct _nt_dbg_km_process_exit { int32_t exit_status; } nt_dbg_km_process_exit; typedef struct _nt_dbg_km_load_module { void * image_handle; void * image_base; uint32_t dbginfo_offset; uint32_t dbginfo_size; } nt_dbg_km_load_module; typedef struct _nt_dbg_km_unload_module { void * image_base; } nt_dbg_km_unload_module; typedef struct _nt_dbg_km_exception { nt_exception_record exception_record; uint32_t exception_priority; } nt_dbg_km_exception; typedef struct _nt_dbg_km_thread_info { uint32_t subsystem_key; void * start_address; } nt_dbg_km_thread_info; typedef struct _nt_dbg_ui_thread_info { void * hthread; uint32_t subsystem_key; void * start_address; } nt_dbg_ui_thread_info; typedef struct _nt_dbg_km_process_info { uint32_t subsystem_key; void * image_handle; void * image_base; uint32_t dbginfo_offset; uint32_t dbginfo_size; nt_dbg_km_thread_info thread_info; } nt_dbg_km_process_info; typedef struct _nt_dbg_ui_process_info { void * hprocess; void * hthread; uint32_t subsystem_key; void * image_handle; void * image_base; uint32_t dbginfo_offset; uint32_t dbginfo_size; nt_dbg_km_thread_info thread_info; } nt_dbg_ui_process_info; typedef struct _nt_dbg_wait_state_change { nt_dbg_state state; nt_cid cid; union { nt_dbg_km_thread_exit thread_exit; nt_dbg_km_process_exit process_exit; nt_dbg_km_load_module load_module; nt_dbg_km_unload_module unload_module; nt_dbg_km_exception exception_info; nt_dbg_ui_thread_info thread_info; nt_dbg_ui_process_info process_info; } _u; } nt_dbg_wait_state_change; /* debug interfaces */ typedef int32_t __stdcall ntapi_zw_create_debug_object( __out void ** hdbobj, __in uint32_t access_mask, __in nt_oa * oa, __in uint32_t flags); typedef int32_t __stdcall ntapi_zw_debug_active_process( __in void * hprocess, __in void * hdbgobj); typedef int32_t __stdcall ntapi_zw_remove_process_debug( __in void * hprocess, __in void * hdbgobj); typedef int32_t __stdcall ntapi_zw_wait_for_debug_event( __in void * hdbgobj, __in int32_t alertable, __in nt_timeout * timeout, __out nt_dbg_wait_state_change * state); typedef int32_t __stdcall ntapi_zw_debug_continue( __in void * hdbgobj, __in nt_cid * cid, __in int32_t status); typedef int32_t __stdcall ntapi_zw_set_information_debug_object( __in void * hdbgobj, __in int32_t dbg_info_class, __in void * dbg_info, __in size_t dbg_info_length, __out uint32_t * dbg_return_length); typedef int32_t __stdcall ntapi_zw_query_debug_filter_state( __in int32_t dbg_component_id, __in uint32_t dbg_level); typedef int32_t __stdcall ntapi_zw_set_debug_filter_state( __in int32_t dbg_component_id, __in uint32_t dbg_level, __in int32_t dbg_state); /* extension interfaces */ typedef int32_t __stdcall ntapi_tt_debug_create_object( __out void ** hdbobj, __in uint32_t flags); typedef int32_t __stdcall ntapi_tt_debug_create_attach_object( __out void ** hdbgobj, __in void * hprocess, __in uint32_t flags); typedef int32_t __stdcall ntapi_tt_debug_execution_flow( __in void * hdbgobj, __in void * hprocess, __in void * hserver, __in void * hlogfile, __in uint32_t evtmask, __in uint64_t * nevents); typedef int32_t __stdcall ntapi_tt_debug_break_process( __in void * hprocess, __out void ** hthread, __out nt_cid * cid); #endif