| 21 | } |
| 22 | |
| 23 | void KernelTimer::EnumKernelTimer(KernelTimerData* pData, DpcTimerInfo* pInfo) { |
| 24 | PULONG_PTR KiProcessorBlock = (PULONG_PTR)pData->pKiProcessorBlock; |
| 25 | int k = 0; |
| 26 | |
| 27 | #ifdef _WIN64 |
| 28 | Helpers::KiWaitAlways = *(ULONG_PTR*)pData->pKiWaitAlways; |
| 29 | Helpers::KiWaitNever = *(ULONG_PTR*)pData->pKiWaitNever; |
| 30 | #endif // _WIN64 |
| 31 | ULONG maxCount = pData->maxEntryCount; |
| 32 | ULONG tableOffset = pData->tableOffset; |
| 33 | ULONG entriesOffset = pData->entriesOffset; |
| 34 | |
| 35 | for (KAFFINITY i = 0; i < KeNumberProcessors; i++) { |
| 36 | ULONG_PTR kprcbAddr = KiProcessorBlock[i]; |
| 37 | ULONG_PTR tableAddr = kprcbAddr + tableOffset; |
| 38 | ULONG_PTR entriesAddr = tableAddr + entriesOffset; |
| 39 | PKTIMER_TABLE_ENTRY pTableEntry = (PKTIMER_TABLE_ENTRY)entriesAddr; |
| 40 | if (!MmIsAddressValid(pTableEntry)) { |
| 41 | continue; |
| 42 | } |
| 43 | for (int j = 0; j < maxCount; j++) { |
| 44 | PLIST_ENTRY pListHead = &pTableEntry[j].Entry; |
| 45 | |
| 46 | for (PLIST_ENTRY pListEntry = pListHead->Flink; pListEntry != pListHead; pListEntry = pListEntry->Flink) { |
| 47 | if (!MmIsAddressValid(pListEntry)) |
| 48 | break; |
| 49 | PKTIMER pTimer = CONTAINING_RECORD(pListEntry, KTIMER, TimerListEntry); |
| 50 | #ifdef _WIN64 |
| 51 | ULONG_PTR salt = (ULONG_PTR)pTimer; |
| 52 | PKDPC pKDpc = (PKDPC)Helpers::KiDecodePointer((ULONG_PTR)pTimer->Dpc, salt); |
| 53 | if (!MmIsAddressValid(pKDpc)) |
| 54 | continue; |
| 55 | LogInfo("KTIMER: 0x%p \t KDPC: 0x%p \t�������: 0x%p\t\n", pTimer, pKDpc,pKDpc->DeferredRoutine); |
| 56 | pInfo[k].DueTime = pTimer->DueTime; |
| 57 | pInfo[k].KDpc = pKDpc; |
| 58 | pInfo[k].KTimer = pTimer; |
| 59 | pInfo[k].Routine = pKDpc->DeferredRoutine; |
| 60 | pInfo[k].Period = pTimer->Period; |
| 61 | k++; |
| 62 | #else |
| 63 | if (!MmIsAddressValid(pTimer->Dpc)) { |
| 64 | continue; |
| 65 | } |
| 66 | LogInfo("KTIMER: 0x%p \t KDPC: 0x%p \t�������: 0x%p\t\n", pTimer, pTimer->Dpc, pTimer->Dpc->DeferredRoutine); |
| 67 | pInfo[k].DueTime = pTimer->DueTime; |
| 68 | pInfo[k].KDpc = pTimer->Dpc; |
| 69 | pInfo[k].KTimer = pTimer; |
| 70 | pInfo[k].Routine = pTimer->Dpc->DeferredRoutine; |
| 71 | pInfo[k].Period = pTimer->Period; |
| 72 | k++; |
| 73 | #endif // _WIN64 |
| 74 | } |
| 75 | } |
| 76 | } |
| 77 | |
| 78 | LogInfo("Total Kernel Timer: %d\n", k); |
| 79 | } |
| 80 | |