You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am trying to evaluate a C++ expression with a function call when the runtime breakpoint hits, but the evaluation never completes.
In a debug monitor component, I capture the stack frame data and send it to an IDE component:
void IDkmRuntimeBreakpointNotification.OnRuntimeBreakpoint(DkmRuntimeBreakpoint runtimeBreakpoint, DkmThread thread, bool hasException, DkmEventDescriptorS eventDescriptor)
{
var process = thread.Process;
thread.GetCurrentFrameInfo(out ulong retAddr, out ulong frameBase, out ulong vframe);
var data = new SupportBreakpointHitMessage
{
breakpointId = runtimeBreakpoint.UniqueId,
threadId = thread.UniqueId,
retAddr = retAddr,
frameBase = frameBase,
vframe = vframe
};
DkmCustomMessage.Create(process.Connection, process, MessageToLocal.guid, MessageToLocal.supportBreakpointHitNotification, data.Encode(), null).SendHigher();
}
in the IDE component (tested levels 1999000 and 9995000) IDkmCustomMessageCallbackReceiver.SendHigher I try to execute an expression:
const int CV_ALLREG_VFRAME = 0x00007536;
var vFrameRegister = DkmUnwoundRegister.Create(CV_ALLREG_VFRAME, new ReadOnlyCollection<byte>(BitConverter.GetBytes(data.vframe)));
var registers = thread.GetCurrentRegisters(new[] { vFrameRegister });
var instructionAddress = process.CreateNativeInstructionAddress(registers.GetInstructionPointer());
DkmStackWalkFrame frame = DkmStackWalkFrame.Create(thread, instructionAddress, data.frameBase, 0, DkmStackWalkFrameFlags.None, null, registers, null);
var inspectionSession = DkmInspectionSession.Create(process, null);
string expression = $"sethook(0x{stateAddress:x}, 0x{processData.helperHookFunctionAddress_5_1:x}, 7, 0)";
var compilerId = new DkmCompilerId(DkmVendorId.Microsoft, DkmLanguageId.Cpp);
var language = DkmLanguage.Create("C++", compilerId);
var languageExpression = DkmLanguageExpression.Create(language, DkmEvaluationFlags.None, expression, null);
var inspectionContext = DkmInspectionContext.Create(inspectionSession, frame.RuntimeInstance, thread, 2000, DkmEvaluationFlags.None, DkmFuncEvalFlags.None, 10, language, null);
var workList = DkmWorkList.Create(null);
DkmSuccessEvaluationResult result = null;
inspectionContext.EvaluateExpression(workList, languageExpression, frame, res =>
{
if (res.ErrorCode == 0)
{
result = res.ResultObject as DkmSuccessEvaluationResult;
res.ResultObject.Close();
}
});
workList.Execute();
workList.Execute(); call never returns.
If the same evaluation is performed in a IDkmCallStackFilter.FilterNextFrame there are no issues with it.
Expressions without function evaluations can also be successfully performed with this code in IDkmCustomMessageCallbackReceiver.SendHigher.
Documentation for IDkmRuntimeBreakpointNotification.OnRuntimeBreakpoint tells that:
When this
notification is called, the target process is stopped and implementers are
able to either inspect the process or cause it to execute in a controlled
manner (slip, func-eval).
Is this really true?
The text was updated successfully, but these errors were encountered:
I am trying to evaluate a C++ expression with a function call when the runtime breakpoint hits, but the evaluation never completes.
In a debug monitor component, I capture the stack frame data and send it to an IDE component:
in the IDE component (tested levels 1999000 and 9995000)
IDkmCustomMessageCallbackReceiver.SendHigher
I try to execute an expression:workList.Execute();
call never returns.If the same evaluation is performed in a
IDkmCallStackFilter.FilterNextFrame
there are no issues with it.Expressions without function evaluations can also be successfully performed with this code in
IDkmCustomMessageCallbackReceiver.SendHigher
.Documentation for
IDkmRuntimeBreakpointNotification.OnRuntimeBreakpoint
tells that:Is this really true?
The text was updated successfully, but these errors were encountered: