icex2
fd9f455bf3
A general debugging tool. 3rd party applications such as "procmon" (same name) provide these capabilites and even more. But, they are more difficult to run with bemanitools and don't provide a unified look at the output in combination with the log output by bemanitools. Provide an initial set of system call hooks that have already supported debugging efforts. More can be added when needed later.
106 lines
2.4 KiB
C
106 lines
2.4 KiB
C
#define LOG_MODULE "procmon-thread"
|
|
|
|
#include <windows.h>
|
|
|
|
#include "core/log.h"
|
|
|
|
#include "hook/table.h"
|
|
|
|
#ifdef _WIN64
|
|
#define SIZE_T_FORMAT_SPECIFIER "llu"
|
|
#else
|
|
#define SIZE_T_FORMAT_SPECIFIER "lu"
|
|
#endif
|
|
|
|
static HANDLE(STDCALL *real_CreateThread)(
|
|
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
SIZE_T dwStackSize,
|
|
LPTHREAD_START_ROUTINE lpStartAddress,
|
|
LPVOID lpParameter,
|
|
DWORD dwCreationFlags,
|
|
LPDWORD lpThreadId);
|
|
|
|
static HANDLE STDCALL my_CreateThread(
|
|
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
SIZE_T dwStackSize,
|
|
LPTHREAD_START_ROUTINE lpStartAddress,
|
|
LPVOID lpParameter,
|
|
DWORD dwCreationFlags,
|
|
LPDWORD lpThreadId);
|
|
|
|
static const struct hook_symbol _procmon_thread_hook_syms[] = {
|
|
{
|
|
.name = "CreateThread",
|
|
.patch = my_CreateThread,
|
|
.link = (void **) &real_CreateThread,
|
|
},
|
|
};
|
|
|
|
static HANDLE STDCALL my_CreateThread(
|
|
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
SIZE_T dwStackSize,
|
|
LPTHREAD_START_ROUTINE lpStartAddress,
|
|
LPVOID lpParameter,
|
|
DWORD dwCreationFlags,
|
|
LPDWORD lpThreadId)
|
|
{
|
|
HANDLE result;
|
|
|
|
log_misc(
|
|
"CreateThread(lpThreadAttributes %p, dwStackSize "
|
|
"%" SIZE_T_FORMAT_SPECIFIER
|
|
", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId "
|
|
"%p)",
|
|
lpThreadAttributes,
|
|
dwStackSize,
|
|
lpStartAddress,
|
|
lpParameter,
|
|
dwCreationFlags,
|
|
lpThreadId);
|
|
|
|
result = real_CreateThread(
|
|
lpThreadAttributes,
|
|
dwStackSize,
|
|
lpStartAddress,
|
|
lpParameter,
|
|
dwCreationFlags,
|
|
lpThreadId);
|
|
|
|
log_misc(
|
|
"CreateThread(lpThreadAttributes %p, dwStackSize "
|
|
"%" SIZE_T_FORMAT_SPECIFIER
|
|
", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId "
|
|
"%p) = %p, tid %lu",
|
|
lpThreadAttributes,
|
|
dwStackSize,
|
|
lpStartAddress,
|
|
lpParameter,
|
|
dwCreationFlags,
|
|
lpThreadId,
|
|
result,
|
|
lpThreadId ? *lpThreadId : -1);
|
|
|
|
return result;
|
|
}
|
|
|
|
void procmon_thread_init()
|
|
{
|
|
hook_table_apply(
|
|
NULL,
|
|
"kernel32.dll",
|
|
_procmon_thread_hook_syms,
|
|
lengthof(_procmon_thread_hook_syms));
|
|
|
|
log_misc("init");
|
|
}
|
|
|
|
void procmon_thread_fini()
|
|
{
|
|
hook_table_revert(
|
|
NULL,
|
|
"kernel32.dll",
|
|
_procmon_thread_hook_syms,
|
|
lengthof(_procmon_thread_hook_syms));
|
|
|
|
log_misc("fini");
|
|
} |