My driver for a PCI Bus-Master Device without Scatter/Gather capability calls IoGetDmaAdapter(), but fails with 0xFFFFFFFFC0000005 Access Violation. This causes a BSOD.
Here's how I set it up:
RtlZeroMemory(&deviceDescription, sizeof(DEVICE_DESCRIPTION));
deviceDescription.Master = TRUE; // this is a bus-master device without scatter/gather ability
deviceDescription.Dma32BitAddresses = TRUE; // this device is unable to perform 64-bit addressing
deviceDescription.InterfaceType = InterfaceTypeUndefined;
KdBreakPoint();
deviceDescription.Version = DEVICE_DESCRIPTION_VERSION2;
IoGetDmaAdapter(deviceObject, &deviceDescription, &fakeRegs);
Here's my Windows kernel debugging session:
MyDriver!AllocateHardWareResource+0x313:
fffff803`319626a3 488b8424e8000000 mov rax,qword ptr [rsp+0E8h]
MyDriver!AllocateHardWareResource+0x324:
fffff803`319626b4 488d442478 lea rax,[rsp+78h]
MyDriver!AllocateHardWareResource+0x34d:
fffff803`319626dd 8b442450 mov eax,dword ptr [rsp+50h]
MyDriver!AllocateHardWareResource+0x358:
fffff803`319626e8 c684248900000001 mov byte ptr [rsp+89h],1
MyDriver!AllocateHardWareResource+0x360:
fffff803`319626f0 c784248000000002000000 mov dword ptr [rsp+80h],2
MyDriver!AllocateHardWareResource+0x36b:
fffff803`319626fb 4c8d44244c lea r8,[rsp+4Ch]
KDTARGET: Refreshing KD connection
KDTARGET: Refreshing KD connection
*** Fatal System Error: 0x0000007e
(0xFFFFFFFFC0000005,0x0000000000000000,0xFFFF9400DE25D4B8,0xFFFF9400DE25CCF0)
WARNING: This break is not a step/trace completion.
The last command has been cleared to prevent
accidental continuation of this unrelated event.
Check the event, location and thread before resuming.
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Before the crash at Guard_Dispatch_iCall_NOP, I see the following call-stack:
HalpGetCacheCoherency + 6D
HalGetAdapterV2 + A8
IoGetDmaAdapter + C0
IoGetDmaAdapter + C0
IoGetDmaAdapter + C0
My Call-Site
I checked that Physical Device Object has the same address as originally provided to my AddDevice handler.
How should I ask politely to avoid a "Sorry Dave, I can't do that" from Windows Kernel I/O Manager?
When my driver calls into IoGetDmaAdapter(), the driver receives two interface queries via IRP_MN_QUERY_INTERFACE: GUID_BUS_INTERFACE_STANDARD and GUID_DMA_CACHE_COHERENCY_INTERFACE.
GUID_DMA_CACHE_COHERENCY_INTERFACE is new to Windows 10 or Server 2016.
GUID_DMA_CACHE_COHERENCY_INTERFACE query should normally pass to the next driver in the stack. I was making a mistake, setting the status to success, but should have left it alone.
Related
I am using a can board and an IMU MPU6050 to be able use motors while also reading an angle from the IMU.
When using them separately it works, the IMU reads and the CAN can activate and run the motors. The issue arises when both are activated at the same time and the script gives the following error:
IOError: [Errno 5] Input/output error
Here are the registers:
# MPU6050 Registers
MPU6050_ADDR = 0x68#0x0c
PWR_MGMT_1 = 0x6B
SMPLRT_DIV = 0x19
CONFIG = 0x1A
GYRO_CONFIG = 0x1B
ACCEL_CONFIG = 0x1C
INT_PIN_CFG = 0x37
INT_ENABLE = 0x38
ACCEL_XOUT_H = 0x3B
ACCEL_YOUT_H = 0x3D
And fault messages arises when I try to write a byte to the IMU at the same time as the CAN bus is activated:
# Write to Configuration register
bus.write_byte_data(MPU6050_ADDR, CONFIG, 0)
I created a new I2C bus for the IMU which is bus #3 which gives me the addresses 0x68 and 0x0c.
I have checked the wiring which is correct. Otherwise I should get the same error when running them separately.
Does anyone have any suggestions on what to try next?
I have recently converted a 122-key terminal keyboard to USB as a configfs USB gadget (the keyboard portion is using HID codes), it works quite well in except that I cannot seem to get my Archlinux installation to recognize certain HID codes (specifically at the moment F13-F24) and translate them into event codes that I can use in X.
HID codes received properly
I am able to see the HID being received by the computer through /dev/hidraw2 (the output below is when pressing F24, HID code 0x73 based on: https://gist.github.com/MightyPork/6da26e382a7ad91b5496ee55fdc73db2.
sudo hexdump -C /dev/hidraw2
00000000 00 00 00 00 00 00 00 00 00 00 73 00 00 00 00 00 |..........s.....|
HID codes not translated to events
However, as soon as I try showkey -s, evtest, or xev I get absolutely nothing, it is as if I am not pressing a key. All of the "normal" HID codes work (in fact this message is being typed on the keyboard right now) so it must be something between the receipt of the HID code and its translation.
Interestingly, my evtest capabilities do not list the event codes for the F13-F24 (see below) but I have seen these capabilities listed in other people's output (eg https://unix.stackexchange.com/questions/130656/how-to-get-all-my-keys-to-send-keycodes).
Input driver version is 1.0.1
Input device ID: bus 0x3 vendor 0x1d6b product 0x104 version 0x101
Input device name: "CPMH 122 Gadget"
Supported events:
Event type 0 (EV_SYN)
Event type 1 (EV_KEY)
Event code 1 (KEY_ESC)
Event code 2 (KEY_1)
Event code 3 (KEY_2)
Event code 4 (KEY_3)
Event code 5 (KEY_4)
Event code 6 (KEY_5)
Event code 7 (KEY_6)
Event code 8 (KEY_7)
Event code 9 (KEY_8)
Event code 10 (KEY_9)
Event code 11 (KEY_0)
Event code 12 (KEY_MINUS)
Event code 13 (KEY_EQUAL)
Event code 14 (KEY_BACKSPACE)
Event code 15 (KEY_TAB)
Event code 16 (KEY_Q)
Event code 17 (KEY_W)
Event code 18 (KEY_E)
Event code 19 (KEY_R)
Event code 20 (KEY_T)
Event code 21 (KEY_Y)
Event code 22 (KEY_U)
Event code 23 (KEY_I)
Event code 24 (KEY_O)
Event code 25 (KEY_P)
Event code 26 (KEY_LEFTBRACE)
Event code 27 (KEY_RIGHTBRACE)
Event code 28 (KEY_ENTER)
Event code 29 (KEY_LEFTCTRL)
Event code 30 (KEY_A)
Event code 31 (KEY_S)
Event code 32 (KEY_D)
Event code 33 (KEY_F)
Event code 34 (KEY_G)
Event code 35 (KEY_H)
Event code 36 (KEY_J)
Event code 37 (KEY_K)
Event code 38 (KEY_L)
Event code 39 (KEY_SEMICOLON)
Event code 40 (KEY_APOSTROPHE)
Event code 41 (KEY_GRAVE)
Event code 42 (KEY_LEFTSHIFT)
Event code 43 (KEY_BACKSLASH)
Event code 44 (KEY_Z)
Event code 45 (KEY_X)
Event code 46 (KEY_C)
Event code 47 (KEY_V)
Event code 48 (KEY_B)
Event code 49 (KEY_N)
Event code 50 (KEY_M)
Event code 51 (KEY_COMMA)
Event code 52 (KEY_DOT)
Event code 53 (KEY_SLASH)
Event code 54 (KEY_RIGHTSHIFT)
Event code 55 (KEY_KPASTERISK)
Event code 56 (KEY_LEFTALT)
Event code 57 (KEY_SPACE)
Event code 58 (KEY_CAPSLOCK)
Event code 59 (KEY_F1)
Event code 60 (KEY_F2)
Event code 61 (KEY_F3)
Event code 62 (KEY_F4)
Event code 63 (KEY_F5)
Event code 64 (KEY_F6)
Event code 65 (KEY_F7)
Event code 66 (KEY_F8)
Event code 67 (KEY_F9)
Event code 68 (KEY_F10)
Event code 69 (KEY_NUMLOCK)
Event code 70 (KEY_SCROLLLOCK)
Event code 71 (KEY_KP7)
Event code 72 (KEY_KP8)
Event code 73 (KEY_KP9)
Event code 74 (KEY_KPMINUS)
Event code 75 (KEY_KP4)
Event code 76 (KEY_KP5)
Event code 77 (KEY_KP6)
Event code 78 (KEY_KPPLUS)
Event code 79 (KEY_KP1)
Event code 80 (KEY_KP2)
Event code 81 (KEY_KP3)
Event code 82 (KEY_KP0)
Event code 83 (KEY_KPDOT)
Event code 86 (KEY_102ND)
Event code 87 (KEY_F11)
Event code 88 (KEY_F12)
Event code 96 (KEY_KPENTER)
Event code 97 (KEY_RIGHTCTRL)
Event code 98 (KEY_KPSLASH)
Event code 99 (KEY_SYSRQ)
Event code 100 (KEY_RIGHTALT)
Event code 102 (KEY_HOME)
Event code 103 (KEY_UP)
Event code 104 (KEY_PAGEUP)
Event code 105 (KEY_LEFT)
Event code 106 (KEY_RIGHT)
Event code 107 (KEY_END)
Event code 108 (KEY_DOWN)
Event code 109 (KEY_PAGEDOWN)
Event code 110 (KEY_INSERT)
Event code 111 (KEY_DELETE)
Event code 119 (KEY_PAUSE)
Event code 125 (KEY_LEFTMETA)
Event code 126 (KEY_RIGHTMETA)
Event code 127 (KEY_COMPOSE)
Event type 4 (EV_MSC)
Event code 4 (MSC_SCAN)
Event type 17 (EV_LED)
Event code 0 (LED_NUML) state 1
Event code 1 (LED_CAPSL) state 0
Event code 2 (LED_SCROLLL) state 0
Event code 3 (LED_COMPOSE) state 0
Event code 4 (LED_KANA) state 0
Key repeat handling:
Repeat type 20 (EV_REP)
Repeat code 0 (REP_DELAY)
Value 250
Repeat code 1 (REP_PERIOD)
Value 33
Is it the driver?
Based on the difference between my evtest EV_KEY capabilities and others I have seen I thought maybe it is that my driver can't map the USB HID codes to the appropriate event codes.
Using hwinfo I can tell that my keyboard is using the hid-generic driver. Looking at the source for hid-input.c (http://elixir.free-electrons.com/linux/v3.5.2/source/drivers/hid/hid-input.c) I can see that the mapping is indeed there (the HID code 0x73 maps to 194 which maps to the KEY_F24 event, at least according to what I found here: https://github.com/wayland-project/libinput/blob/master/include/linux/input-event-codes.h). So I am led from what I have read online to believe that the problem lies somewhere between the hid-generic and libinput.
I'm not sure where to go from here, with nothing coming out of evtest I am not sure what to map the keys to. Is it just that the capability for those keys isn't defined? Is there anyway to specify the capabilities of my keyboard to evdev?
Found the problem. After looking through the code for usbhid I realized that it was what was assigning the available event codes discovered by evtest. To do this, it reads through the HID descriptor. As it turned out I had used a generic HID descriptor and the Logical Maximum and Usage Maximum were cutting off the higher numbered HID codes. I used https://github.com/DIGImend/hidrd to get an editable version of my binary descriptor and then changed the Usage Maximum and Logical Maximum to the highest HID code I use. Reconverted it to binary format, uploaded and started the keyboard. Now evtest recognizes all keys.
Here is my original spec:
Usage Page (Desktop), ; Generic desktop controls (01h)
Usage (Keyboard), ; Keyboard (06h, application collection)
Collection (Application),
Usage Page (Keyboard), ; Keyboard/keypad (07h)
Usage Minimum (KB Leftcontrol), ; Keyboard left control (E0h, dynamic value)
Usage Maximum (KB Right GUI), ; Keyboard right GUI (E7h, dynamic value)
Logical Minimum (0),
Logical Maximum (1),
Report Size (1),
Report Count (8),
Input (Variable),
Report Count (1),
Report Size (8),
Input (Constant, Variable),
Report Count (5),
Report Size (1),
Usage Page (LED), ; LEDs (08h)
Usage Minimum (01h),
Usage Maximum (05h),
Output (Variable),
Report Count (1),
Report Size (3),
Output (Constant, Variable),
Report Count (6),
Report Size (8),
Logical Minimum (0),
Logical Maximum (101),
Usage Page (Keyboard), ; Keyboard/keypad (07h)
Usage Minimum (None), ; No event (00h, selector)
Usage Maximum (KB Application), ; Keyboard Application (65h, selector)
Input,
End Collection
And my updated spec:
Usage Page (Desktop), ; Generic desktop controls (01h)
Usage (Keyboard), ; Keyboard (06h, application collection)
Collection (Application),
Usage Page (Keyboard), ; Keyboard/keypad (07h)
Usage Minimum (KB Leftcontrol), ; Keyboard left control (E0h, dynamic value)
Usage Maximum (KB Right GUI), ; Keyboard right GUI (E7h, dynamic value)
Logical Minimum (0),
Logical Maximum (1),
Report Size (1),
Report Count (8),
Input (Variable),
Report Count (1),
Report Size (8),
Input (Constant, Variable),
Report Count (5),
Report Size (1),
Usage Page (LED), ; LEDs (08h)
Usage Minimum (01h),
Usage Maximum (05h),
Output (Variable),
Report Count (1),
Report Size (3),
Output (Constant, Variable),
Report Count (6),
Report Size (8),
Logical Minimum (0),
Logical Maximum (115),
Usage Page (Keyboard), ; Keyboard/keypad (07h)
Usage Minimum (None), ; No event (00h, selector)
Usage Maximum (KB F24), ; Keyboard F24 (73h, selector)
Input,
End Collection
I'm writing a block device driver and started with the sbull example from here:
http://lwn.net/images/pdf/LDD3/ldd3_pdf.tar.bz2
I loaded the sbull driver successfully on my machine with kernel version 3.5.0-23.
When I run this code:
int main(){
int fd;
if ((fd = open("/dev/sbulla",O_RDWR)) < 0)
{
perror("open: ");
exit(1);
}
lseek(fd,4096,SEEK_SET);
write(fd,"yonityoyin",10);
lseek(fd,4096*2,SEEK_SET);
write(fd,"yonityoyin",10);
close(fd);
}
The session gets stuck.
If i open another session on the machine and print dmesg i get this after some time:
[56437.815570] INFO: task a.out:4640 blocked for more than 120 seconds.
[56437.822742] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[56437.831563] a.out D ffffffff8180cbe0 0 4640 4639 0x00000000
[56437.831571] ffff880852715c08 0000000000000082 0000000000000000 0000000000000001
[56437.831580] ffff880852715fd8 ffff880852715fd8 ffff880852715fd8 00000000000139c0
[56437.831588] ffff8808547c0000 ffff880851bc2e00 ffff880852715be8 ffff88085fd74258
[56437.831595] Call Trace:
[56437.831623] [<ffffffff81127220>] ? __lock_page+0x70/0x70
[56437.831638] [<ffffffff8169d8b9>] schedule+0x29/0x70
[56437.831643] [<ffffffff8169d98f>] io_schedule+0x8f/0xd0
[56437.831652] [<ffffffff8112722e>] sleep_on_page+0xe/0x20
[56437.831657] [<ffffffff8169c25f>] __wait_on_bit+0x5f/0x90
[56437.831663] [<ffffffff81127c1b>] ? find_get_pages_tag+0xcb/0x170
[56437.831674] [<ffffffff81127388>] wait_on_page_bit+0x78/0x80
[56437.831682] [<ffffffff81078490>] ? autoremove_wake_function+0x40/0x40
[56437.831691] [<ffffffff8112749c>] filemap_fdatawait_range+0x10c/0x1a0
[56437.831701] [<ffffffff81133000>] ? do_writepages+0x20/0x40
[56437.831706] [<ffffffff8112755b>] filemap_fdatawait+0x2b/0x30
[56437.831711] [<ffffffff811298e4>] filemap_write_and_wait+0x44/0x60
[56437.831718] [<ffffffff811c0091>] __sync_blockdev+0x21/0x40
[56437.831722] [<ffffffff811c00c3>] sync_blockdev+0x13/0x20
[56437.831726] [<ffffffff811c0139>] __blkdev_put+0x69/0x1c0
[56437.831736] [<ffffffff811c02eb>] blkdev_put+0x5b/0x160
[56437.831740] [<ffffffff811c0415>] blkdev_close+0x25/0x30
[56437.831750] [<ffffffff81188afe>] __fput+0xbe/0x240
[56437.831756] [<ffffffff81188ca5>] fput+0x25/0x30
[56437.831761] [<ffffffff81185976>] filp_close+0x66/0x90
[56437.831766] [<ffffffff81185a3e>] sys_close+0x9e/0x110
[56437.831775] [<ffffffff816a7029>] system_call_fastpath+0x16/0x1b
What could be the problem with the driver?
Just to be clear, I get this problem with the original sbull driver.
Please refer the newer example code.
https://github.com/martinezjavier/ldd3
I have a user mode dump from Win 8.1/64, the dump was taken by attaching Windbg when the Wer dialogue. The .ecxr shows then ntdll!DbgBreakPoint for the Windbg injected thread. (As normal)
I have identified the thread by examine all stack, and finding the one which has :
# Call Site
00 ntdll!NtWaitForMultipleObjects
01 KERNELBASE!WaitForMultipleObjectsEx
02 kernel32!WerpReportFaultInternal
03 kernel32!WerpReportFault
04 KERNELBASE!UnhandledExceptionFilter
05 ntdll!RtlUserThreadStart$filt$0
06 ntdll!_C_specific_handler
07 ntdll!RtlpExecuteHandlerForException
08 ntdll!RtlDispatchException
09 ntdll!KiUserExceptionDispatch
10 <My faulty code which generated the exception>
The kvn aslo dispays a TrapFrame # 00000000`0379ed28)
09 00000000`0379e900 00000000`00250bc8 : 00000000`00000000 00000000`0026ca09 00000000`0379f160 00000000`0379f168 : ntdll!KiUserExceptionDispatch+0x2e (TrapFrame # 00000000`0379ed28)
Is there a way to use the trap frame to get the context record to feed into .cxr ?
Or is it other possibilities to find the exception context?
I see a KERNELBASE!UnhandledExceptionFilter on the stack. That seems like a good thing to focus on.
If this were x86, you could easily get an EXCEPTION_POINTERS struct out of the first parameter to KERNELBASE!UnhandledExceptionFilter. From there, you would have access to the EXCEPTION_RECORD and CONTEXT. The procedure is described in this KB article.
The same method works for x64 processes with one caveat. Due to the nature of the x64 calling convention, it is harder to retrieve the actual argument to KERNELBASE!UnhandledExceptionFilter since it is stored in a register rather than on the stack.
I recently found a debugger extension called CMKD that automates the task of hunting for the first 4 args in the x64 calling convention rather than blindly displaying stack values like kb and kv. This can be done by hand but it is a rather lengthy and error-prone process -- better to let an extension take a crack at it first.
With it, you can do something like this:
0:000> !cmkd.stack -p
Call Stack : 15 frames
## Stack-Pointer Return-Address Call-Site
[...]
03 000000aea3dae7e0 00007fff1e906b14 KERNELBASE!UnhandledExceptionFilter+196
Parameter[0] = 000000aea3dae930
Parameter[1] = (unknown)
Parameter[2] = (unknown)
Parameter[3] = (unknown)
[...]
And, now we have an EXCEPTION_POINTERS* in Parameter[0].
0:000> dt 000000ae`a3dae930 EXCEPTION_POINTERS
ConsoleApplication2!EXCEPTION_POINTERS
+0x000 ExceptionRecord : 0x000000ae`a3daf850 _EXCEPTION_RECORD
+0x008 ContextRecord : 0x000000ae`a3daf240 _CONTEXT
We can see in my example that a C++ exception was thrown...
0:000> .exr 000000ae`a3daf850
ExceptionAddress: 00007fff1bfeab78 (KERNELBASE!RaiseException+0x0000000000000068)
ExceptionCode: e06d7363 (C++ EH exception)
ExceptionFlags: 00000001
NumberParameters: 4
Parameter[0]: 0000000019930520
Parameter[1]: 000000aea3daf9b0
Parameter[2]: 00007ff6f50024a8
Parameter[3]: 00007ff6f5000000
pExceptionObject: 000000aea3daf9b0
_s_ThrowInfo : 00007ff6f50024a8
Hopefully this helps. Good luck. :)
Another method fox x64 case doesn't require extension but is relying on two unstable facts:
windbg ability to reconstruct registers for a specific frame
the fact that WerpReportFault stores EXCEPTION_POINTERS address in rdi before passing it to WerpReportFaultInternal (it is the case at least for kernel32.dll 6.1.7601.23915 (win7sp1_ldr.170913-0600)
Exception pointer can be extracted as an rdi value of the WerpReportFault's frame:
0:007> k
# Child-SP RetAddr Call Site
00 00000000`0868dcd8 000007fe`fcf61430 ntdll!NtWaitForMultipleObjects+0xa
01 00000000`0868dce0 00000000`76fb16e3 KERNELBASE!WaitForMultipleObjectsEx+0xe8
02 00000000`0868dde0 00000000`7702b8b5 kernel32!WaitForMultipleObjectsExImplementation+0xb3
03 00000000`0868de70 00000000`7702ba37 kernel32!WerpReportFaultInternal+0x215
04 00000000`0868df10 00000000`7702ba8f kernel32!WerpReportFault+0x77
05 00000000`0868df40 00000000`7702bcac kernel32!BasepReportFault+0x1f
06 00000000`0868df70 00000000`77230108 kernel32!UnhandledExceptionFilter+0x1fc
07 00000000`0868e050 00000000`771c7958 ntdll! ?? ::FNODOBFM::`string'+0x2025
08 00000000`0868e080 00000000`771d812d ntdll!_C_specific_handler+0x8c
09 00000000`0868e0f0 00000000`771c855f ntdll!RtlpExecuteHandlerForException+0xd
0a 00000000`0868e120 00000000`771fbcb8 ntdll!RtlDispatchException+0x45a
0b 00000000`0868e800 000007fe`fe03df54 ntdll!KiUserExceptionDispatch+0x2e
0c 00000000`0868ef00 000007fe`fe03e1b6 gdi32!pmfAllocMF+0x2b0
0d 00000000`0868ef70 000007fe`fb10a646 gdi32!GetEnhMetaFileW+0x32
0e 00000000`0868efb0 000007fe`fb0c4959 GdiPlus!GpMetafile::GpMetafile+0x1c6
0f 00000000`0868f150 00000001`40001c35 GdiPlus!GdipCreateBitmapFromFile+0xc5
0:007> .frame /r 04
04 00000000`0868df10 00000000`7702ba8f kernel32!WerpReportFault+0x77
rax=00000000c0000001 rbx=0000000000000000 rcx=0000000002660000
rdx=0000000000000001 rsi=0000000000000001 rdi=000000000868e0b0
rip=000000007702ba37 rsp=000000000868df10 rbp=000000000868ff90
r8=000000000868d3f8 r9=000000000868d560 r10=0000000000000000
r11=0000000000000246 r12=000000000868e0b0 r13=0000000000000000
r14=0000000000000002 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000244
kernel32!WerpReportFault+0x77:
00000000`7702ba37 8b0d27ff0600 mov ecx,dword ptr [kernel32!RestrictedUserHandle+0xc (00000000`7709b964)] ds:00000000`7709b964=00000000
0:007> .exptr 000000000868e0b0
----- Exception record at 00000000`0868ecf0:
ExceptionAddress: 000007fefe03df54 (gdi32!pmfAllocMF+0x00000000000002b0)
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 0000000000000000
Parameter[1]: 0000000002610028
Parameter[2]: 00000000c00000be
Inpage operation failed at 0000000002610028, due to I/O error 00000000c00000be
----- Context record at 00000000`0868e800:
rax=0000000002610000 rbx=000000000e5fe7c0 rcx=0000000000006894
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=000007fefe03df54 rsp=000000000868ef00 rbp=0000000000000104
r8=000000000868ee38 r9=0000000000000104 r10=0000000000000000
r11=0000000000000286 r12=0000000000000001 r13=000000006d9cf760
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
gdi32!pmfAllocMF+0x2b0:
000007fe`fe03df54 81782820454d46 cmp dword ptr [rax+28h],464D4520h ds:00000000`02610028=????????
I did some research and found two ways of getting it without any plugins, relying on WinDBG magic, etc.
First, invoke k command in WinDBG. Find a portion of stack like this:
Child-SP RetAddr
00000000`0ab7d9d0 00007ff9`98baed2d exception handler
00000000`0ab7da10 00007ff9`98b16c86 ntdll!RtlpExecuteHandlerForException+0xd
00000000`0ab7da40 00007ff9`98badc5e ntdll!RtlDispatchException+0x3c6
00000000`0ab7e140 00007ff9`98b5b48a ntdll!KiUserExceptionDispatch+0x2e
00000000`0ab7e860 00007ff9`96925531 Function that crashed
Now you can find what you want in local variables:
Option 1: Use EXCEPTION_POINTERS structure saved on stack
.exptr 00000000`0ab7da10 - 0x20
Option 2: Use CONTEXT and EXCEPTION_RECORD separately
.cxr 00000000`0ab7e140
.exr 00000000`0ab7e140 + ##c++(sizeof(ntdll!_CONTEXT)) + 0x20
I am trying to determine if the PC my app is running on is x64 or x86.
Here is my current code:
format PE GUI 4.0
include "Win32A.Inc"
entry start
section ".idata" import data readable writable
library kernel32,"KERNEL32.DLL",user32,"USER32.DLL"
import kernel32,\
IsWow64Process,"IsWow64Process",\
GetCurrentProcess,"GetCurrentProcess",\
ExitProcess,"ExitProcess"
import user32,\
MessageBox,"MessageBoxA"
section '.data' data readable writeable
hProcess dd ?
hResult dd ?
section '.code' code readable executable
start:
invoke GetCurrentProcess
mov [hProcess],eax
invoke IsWow64Process,hProcess,hResult
cmp [hResult],1
je Is64
cmp [hResult],0
je Is32
invoke ExitProcess,0
Is64:
invoke MessageBox,0,'64','AR',0
invoke ExitProcess,0
Is32:
invoke MessageBox,0,'32','AR',0
invoke ExitProcess,0
It simply crashes upon execution.
What is the proper way to check the value of a boolean, am I doing that part correctly?
Thanks for any help solving this issue.
To be able to declare inline strings, you need to include the extended headers:
include "Win32AX.Inc"
or else '64' and so on will be interpreted as constants.
You're also not passing hProcess as a value:
invoke IsWow64Process,[hProcess],hResult