1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
/* dumper.h
Written by Egor Duda <deo@logos-m.ru>
This file is part of Cygwin.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License (file COPYING.dumper) for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. */
#ifndef _DUMPER_H_
#define _DUMPER_H_
#include <windows.h>
typedef struct
{
LPBYTE base;
SIZE_T size;
} process_mem_region;
typedef struct
{
DWORD tid;
HANDLE hThread;
CONTEXT context;
} process_thread;
typedef struct
{
LPVOID base_address;
char* name;
} process_module;
enum process_entity_type
{
pr_ent_memory,
pr_ent_thread,
pr_ent_module
};
typedef struct _process_entity
{
process_entity_type type;
union
{
process_thread thread;
process_mem_region memory;
process_module module;
} u;
asection* section;
struct _process_entity* next;
} process_entity;
#define PAGE_BUFFER_SIZE 4096
class dumper
{
DWORD pid;
DWORD tid; /* thread id of active thread */
HANDLE hProcess;
process_entity* list;
process_entity* last;
char* file_name;
bfd* core_bfd;
asection* status_section;
int memory_num;
int module_num;
int thread_num;
void close ();
void dumper_abort ();
process_entity* add_process_entity_to_list ( process_entity_type type );
int add_thread ( DWORD tid, HANDLE hThread );
int add_mem_region ( LPBYTE base, SIZE_T size );
/* break mem_region by excl_list and add add all subregions */
int split_add_mem_region ( LPBYTE base, SIZE_T size );
int add_module ( LPVOID base_address );
int collect_memory_sections ();
int dump_memory_region ( asection* to, process_mem_region* memory );
int dump_thread ( asection* to, process_thread* thread );
int dump_module ( asection* to, process_module* module );
public:
int sane ();
int collect_process_information ();
void print_core_section_list ();
dumper ( DWORD pid, DWORD tid, const char* name );
~dumper ();
int init_core_dump ();
int prepare_core_dump ();
int write_core_dump ();
};
extern int deb_printf ( const char* format, ... );
extern char* psapi_get_module_name ( HANDLE hProcess, LPVOID BaseAddress );
extern BOOL verbose;
#endif
|
