| 749 | |
| 750 | |
| 751 | NTSTATUS |
| 752 | DbgkpPostModuleMessages( |
| 753 | _In_ PEPROCESS Process, |
| 754 | _In_ PETHREAD Thread, |
| 755 | _In_ PDEBUG_OBJECT DebugObject) |
| 756 | /*++ |
| 757 | Routine Description: |
| 758 | This routine posts the module load messages when we debug an active process. |
| 759 | --*/ |
| 760 | { |
| 761 | PPEB Peb = kDbgUtil::GetProcessPeb(Process); |
| 762 | PPEB_LDR_DATA Ldr = nullptr; |
| 763 | PLIST_ENTRY LdrHead, LdrNext; |
| 764 | PLDR_DATA_TABLE_ENTRY LdrEntry; |
| 765 | ULONG i; |
| 766 | OBJECT_ATTRIBUTES attr; |
| 767 | UNICODE_STRING Name; |
| 768 | PIMAGE_NT_HEADERS NtHeaders; |
| 769 | NTSTATUS status; |
| 770 | IO_STATUS_BLOCK ioStatus; |
| 771 | DBGKM_APIMSG ApiMsg; |
| 772 | |
| 773 | if (Peb == nullptr) { |
| 774 | return STATUS_SUCCESS; |
| 775 | } |
| 776 | |
| 777 | ULONG maxModuleMsgs = *g_pDbgkpMaxModuleMsgs; |
| 778 | __try { |
| 779 | Ldr = kDbgUtil::GetPEBLdr(Peb); |
| 780 | |
| 781 | LdrHead = &Ldr->InLoadOrderModuleList; |
| 782 | ProbeForReadSmallStructure(LdrHead, sizeof(LIST_ENTRY), sizeof(UCHAR)); |
| 783 | for (LdrNext = LdrHead->Flink, i = 0; |
| 784 | LdrNext != LdrHead && i < maxModuleMsgs; |
| 785 | LdrNext = LdrNext->Flink,i++) { |
| 786 | if (i > 1) { |
| 787 | |
| 788 | // |
| 789 | // First image got send with process create message |
| 790 | // |
| 791 | RtlZeroMemory(&ApiMsg, sizeof(ApiMsg)); |
| 792 | |
| 793 | LdrEntry = CONTAINING_RECORD(LdrNext, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks); |
| 794 | ProbeForReadSmallStructure(LdrEntry, sizeof(LDR_DATA_TABLE_ENTRY), sizeof(UCHAR)); |
| 795 | |
| 796 | ApiMsg.ApiNumber = DbgKmLoadDllApi; |
| 797 | ApiMsg.u.LoadDll.BaseOfDll = LdrEntry->DllBase; |
| 798 | |
| 799 | ProbeForReadSmallStructure(ApiMsg.u.LoadDll.BaseOfDll, sizeof(IMAGE_DOS_HEADER), sizeof(UCHAR)); |
| 800 | |
| 801 | NtHeaders = RtlImageNtHeader(ApiMsg.u.LoadDll.BaseOfDll); |
| 802 | if (NtHeaders) { |
| 803 | ApiMsg.u.LoadDll.DebugInfoFileOffset = NtHeaders->FileHeader.PointerToSymbolTable; |
| 804 | ApiMsg.u.LoadDll.DebugInfoSize = NtHeaders->FileHeader.NumberOfSymbols; |
| 805 | } |
| 806 | status = kDbgUtil::g_pMmGetFileNameForAddress(NtHeaders, &Name); |
| 807 | if (NT_SUCCESS(status)) { |
| 808 | InitializeObjectAttributes(&attr, &Name, |
no test coverage detected