395 lines
17 KiB
C
395 lines
17 KiB
C
/*
|
|
* MiniDump dumping utility
|
|
*
|
|
* Copyright 2005 Eric Pouech
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
|
|
*/
|
|
|
|
#include "config.h"
|
|
#include <stdarg.h>
|
|
|
|
#define NONAMELESSUNION
|
|
#define NONAMELESSSTRUCT
|
|
#include "windef.h"
|
|
#include "winbase.h"
|
|
#include "winver.h"
|
|
#include "dbghelp.h"
|
|
#include "winedump.h"
|
|
|
|
static void dump_mdmp_data(const MINIDUMP_LOCATION_DESCRIPTOR* md, const char* pfx)
|
|
{
|
|
if (md->DataSize)
|
|
dump_data(PRD(md->Rva, md->DataSize), md->DataSize, pfx);
|
|
}
|
|
|
|
static void dump_mdmp_string(DWORD rva)
|
|
{
|
|
const MINIDUMP_STRING* ms = PRD(rva, sizeof(MINIDUMP_STRING));
|
|
if (ms)
|
|
dump_unicode_str( ms->Buffer, ms->Length / sizeof(WCHAR) );
|
|
else
|
|
printf("<<?>>");
|
|
}
|
|
|
|
static const MINIDUMP_DIRECTORY* get_mdmp_dir(const MINIDUMP_HEADER* hdr, int str_idx)
|
|
{
|
|
const MINIDUMP_DIRECTORY* dir;
|
|
unsigned int i;
|
|
|
|
for (i = 0; i < hdr->NumberOfStreams; i++)
|
|
{
|
|
dir = PRD(hdr->StreamDirectoryRva + i * sizeof(MINIDUMP_DIRECTORY),
|
|
sizeof(MINIDUMP_DIRECTORY));
|
|
if (!dir) continue;
|
|
if (dir->StreamType == str_idx) return dir;
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
enum FileSig get_kind_mdmp(void)
|
|
{
|
|
const DWORD* pdw;
|
|
|
|
pdw = PRD(0, sizeof(DWORD));
|
|
if (!pdw) {printf("Can't get main signature, aborting\n"); return SIG_UNKNOWN;}
|
|
|
|
if (*pdw == 0x504D444D /* "MDMP" */) return SIG_MDMP;
|
|
return SIG_UNKNOWN;
|
|
}
|
|
|
|
void mdmp_dump(void)
|
|
{
|
|
const MINIDUMP_HEADER* hdr = (const MINIDUMP_HEADER*)PRD(0, sizeof(MINIDUMP_HEADER));
|
|
ULONG idx, ndir = 0;
|
|
const MINIDUMP_DIRECTORY* dir;
|
|
const void* stream;
|
|
|
|
if (!hdr)
|
|
{
|
|
printf("Cannot get Minidump header\n");
|
|
return;
|
|
}
|
|
|
|
printf("Signature: %u (%.4s)\n", hdr->Signature, (const char*)&hdr->Signature);
|
|
printf("Version: %x\n", hdr->Version);
|
|
printf("NumberOfStreams: %u\n", hdr->NumberOfStreams);
|
|
printf("StreamDirectoryRva: %u\n", hdr->StreamDirectoryRva);
|
|
printf("CheckSum: %u\n", hdr->CheckSum);
|
|
printf("TimeDateStamp: %s\n", get_time_str(hdr->u.TimeDateStamp));
|
|
printf("Flags: %x%08x\n", (DWORD)(hdr->Flags >> 32), (DWORD)hdr->Flags);
|
|
|
|
for (idx = 0; idx <= LastReservedStream; idx++)
|
|
{
|
|
if (!(dir = get_mdmp_dir(hdr, idx))) continue;
|
|
|
|
stream = PRD(dir->Location.Rva, dir->Location.DataSize);
|
|
printf("Directory [%u]: ", ndir++);
|
|
switch (dir->StreamType)
|
|
{
|
|
case ThreadListStream:
|
|
{
|
|
const MINIDUMP_THREAD_LIST* mtl = (const MINIDUMP_THREAD_LIST*)stream;
|
|
const MINIDUMP_THREAD* mt = &mtl->Threads[0];
|
|
unsigned int i;
|
|
|
|
printf("Threads: %u\n", mtl->NumberOfThreads);
|
|
for (i = 0; i < mtl->NumberOfThreads; i++, mt++)
|
|
{
|
|
printf(" Thread: #%d\n", i);
|
|
printf(" ThreadId: %u\n", mt->ThreadId);
|
|
printf(" SuspendCount: %u\n", mt->SuspendCount);
|
|
printf(" PriorityClass: %u\n", mt->PriorityClass);
|
|
printf(" Priority: %u\n", mt->Priority);
|
|
printf(" Teb: 0x%x%08x\n", (DWORD)(mt->Teb >> 32), (DWORD)mt->Teb);
|
|
printf(" Stack: 0x%x%08x-0x%x%08x\n",
|
|
(DWORD)(mt->Stack.StartOfMemoryRange >> 32),
|
|
(DWORD)mt->Stack.StartOfMemoryRange,
|
|
(DWORD)((mt->Stack.StartOfMemoryRange + mt->Stack.Memory.DataSize) >> 32),
|
|
(DWORD)(mt->Stack.StartOfMemoryRange + mt->Stack.Memory.DataSize));
|
|
dump_mdmp_data(&mt->Stack.Memory, " ");
|
|
printf(" ThreadContext:\n");
|
|
dump_mdmp_data(&mt->ThreadContext, " ");
|
|
}
|
|
}
|
|
break;
|
|
case ModuleListStream:
|
|
case 0xFFF0:
|
|
{
|
|
const MINIDUMP_MODULE_LIST* mml = (const MINIDUMP_MODULE_LIST*)stream;
|
|
const MINIDUMP_MODULE* mm = &mml->Modules[0];
|
|
unsigned int i;
|
|
const char* p1;
|
|
const char* p2;
|
|
|
|
printf("Modules (%s): %u\n",
|
|
dir->StreamType == ModuleListStream ? "PE" : "ELF",
|
|
mml->NumberOfModules);
|
|
for (i = 0; i < mml->NumberOfModules; i++, mm++)
|
|
{
|
|
printf(" Module #%d:\n", i);
|
|
printf(" BaseOfImage: 0x%x%08x\n",
|
|
(DWORD)(mm->BaseOfImage >> 32), (DWORD) mm->BaseOfImage);
|
|
printf(" SizeOfImage: %u\n", mm->SizeOfImage);
|
|
printf(" CheckSum: %u\n", mm->CheckSum);
|
|
printf(" TimeDateStamp: %s\n", get_time_str(mm->TimeDateStamp));
|
|
printf(" ModuleName: ");
|
|
dump_mdmp_string(mm->ModuleNameRva);
|
|
printf("\n");
|
|
printf(" VersionInfo:\n");
|
|
printf(" dwSignature: %x\n", mm->VersionInfo.dwSignature);
|
|
printf(" dwStrucVersion: %x\n",
|
|
mm->VersionInfo.dwStrucVersion);
|
|
printf(" dwFileVersion: %d,%d,%d,%d\n",
|
|
HIWORD(mm->VersionInfo.dwFileVersionMS),
|
|
LOWORD(mm->VersionInfo.dwFileVersionMS),
|
|
HIWORD(mm->VersionInfo.dwFileVersionLS),
|
|
LOWORD(mm->VersionInfo.dwFileVersionLS));
|
|
printf(" dwProductVersion %d,%d,%d,%d\n",
|
|
HIWORD(mm->VersionInfo.dwProductVersionMS),
|
|
LOWORD(mm->VersionInfo.dwProductVersionMS),
|
|
HIWORD(mm->VersionInfo.dwProductVersionLS),
|
|
LOWORD(mm->VersionInfo.dwProductVersionLS));
|
|
printf(" dwFileFlagsMask: %u\n",
|
|
mm->VersionInfo.dwFileFlagsMask);
|
|
printf(" dwFileFlags: %s%s%s%s%s%s\n",
|
|
mm->VersionInfo.dwFileFlags & VS_FF_DEBUG ? "Debug " : "",
|
|
mm->VersionInfo.dwFileFlags & VS_FF_INFOINFERRED ? "Inferred " : "",
|
|
mm->VersionInfo.dwFileFlags & VS_FF_PATCHED ? "Patched " : "",
|
|
mm->VersionInfo.dwFileFlags & VS_FF_PRERELEASE ? "PreRelease " : "",
|
|
mm->VersionInfo.dwFileFlags & VS_FF_PRIVATEBUILD ? "PrivateBuild " : "",
|
|
mm->VersionInfo.dwFileFlags & VS_FF_SPECIALBUILD ? "SpecialBuild " : "");
|
|
if (mm->VersionInfo.dwFileOS)
|
|
{
|
|
switch (mm->VersionInfo.dwFileOS & 0x000F)
|
|
{
|
|
case VOS__BASE: p1 = "_base"; break;
|
|
case VOS__WINDOWS16:p1 = "16 bit Windows"; break;
|
|
case VOS__PM16: p1 = "16 bit Presentation Manager"; break;
|
|
case VOS__PM32: p1 = "32 bit Presentation Manager"; break;
|
|
case VOS__WINDOWS32:p1 = "32 bit Windows"; break;
|
|
default: p1 = "---"; break;
|
|
}
|
|
switch (mm->VersionInfo.dwFileOS & 0xF0000)
|
|
{
|
|
case VOS_UNKNOWN: p2 = "unknown"; break;
|
|
case VOS_DOS: p2 = "DOS"; break;
|
|
case VOS_OS216: p2 = "16 bit OS/2"; break;
|
|
case VOS_OS232: p2 = "32 bit OS/2"; break;
|
|
case VOS_NT: p2 = "Windows NT"; break;
|
|
default: p2 = "---"; break;
|
|
}
|
|
printf(" dwFileOS: %s running on %s\n", p1, p2);
|
|
}
|
|
else printf(" dwFileOS: 0\n");
|
|
switch (mm->VersionInfo.dwFileType)
|
|
{
|
|
case VFT_UNKNOWN: p1 = "Unknown"; break;
|
|
case VFT_APP: p1 = "Application"; break;
|
|
case VFT_DLL: p1 = "DLL"; break;
|
|
case VFT_DRV: p1 = "Driver"; break;
|
|
case VFT_FONT: p1 = "Font"; break;
|
|
case VFT_VXD: p1 = "VxD"; break;
|
|
case VFT_STATIC_LIB: p1 = "Static Library"; break;
|
|
default: p1 = "---"; break;
|
|
}
|
|
printf(" dwFileType: %s\n", p1);
|
|
printf(" dwFileSubtype: %u\n",
|
|
mm->VersionInfo.dwFileSubtype);
|
|
printf(" dwFileDate: %x%08x\n",
|
|
mm->VersionInfo.dwFileDateMS, mm->VersionInfo.dwFileDateLS);
|
|
printf(" CvRecord: <%u>\n", mm->CvRecord.DataSize);
|
|
dump_mdmp_data(&mm->CvRecord, " ");
|
|
printf(" MiscRecord: <%u>\n", mm->MiscRecord.DataSize);
|
|
dump_mdmp_data(&mm->MiscRecord, " ");
|
|
printf(" Reserved0: 0x%x%08x\n",
|
|
(DWORD)(mm->Reserved0 >> 32), (DWORD)mm->Reserved0);
|
|
printf(" Reserved1: 0x%x%08x\n",
|
|
(DWORD)(mm->Reserved1 >> 32), (DWORD)mm->Reserved1);
|
|
}
|
|
}
|
|
break;
|
|
case MemoryListStream:
|
|
{
|
|
const MINIDUMP_MEMORY_LIST* mml = (const MINIDUMP_MEMORY_LIST*)stream;
|
|
const MINIDUMP_MEMORY_DESCRIPTOR* mmd = &mml->MemoryRanges[0];
|
|
unsigned int i;
|
|
|
|
printf("Memory Ranges: %u\n", mml->NumberOfMemoryRanges);
|
|
for (i = 0; i < mml->NumberOfMemoryRanges; i++, mmd++)
|
|
{
|
|
printf(" Memory Range #%d:\n", i);
|
|
printf(" Range: 0x%x%08x-0x%x%08x\n",
|
|
(DWORD)(mmd->StartOfMemoryRange >> 32),
|
|
(DWORD)mmd->StartOfMemoryRange,
|
|
(DWORD)((mmd->StartOfMemoryRange + mmd->Memory.DataSize) >> 32),
|
|
(DWORD)(mmd->StartOfMemoryRange + mmd->Memory.DataSize));
|
|
dump_mdmp_data(&mmd->Memory, " ");
|
|
}
|
|
}
|
|
break;
|
|
case SystemInfoStream:
|
|
{
|
|
const MINIDUMP_SYSTEM_INFO* msi = (const MINIDUMP_SYSTEM_INFO*)stream;
|
|
const char* str;
|
|
char tmp[128];
|
|
|
|
printf("System Information:\n");
|
|
switch (msi->ProcessorArchitecture)
|
|
{
|
|
case PROCESSOR_ARCHITECTURE_UNKNOWN:
|
|
str = "Unknown";
|
|
break;
|
|
case PROCESSOR_ARCHITECTURE_INTEL:
|
|
strcpy(tmp, "Intel ");
|
|
switch (msi->ProcessorLevel)
|
|
{
|
|
case 3: str = "80386"; break;
|
|
case 4: str = "80486"; break;
|
|
case 5: str = "Pentium"; break;
|
|
case 6: str = "Pentium Pro/II"; break;
|
|
default: str = "???"; break;
|
|
}
|
|
strcat(tmp, str);
|
|
if (msi->ProcessorLevel == 3 || msi->ProcessorLevel == 4)
|
|
{
|
|
if (HIWORD(msi->ProcessorRevision) == 0xFF)
|
|
sprintf(tmp + strlen(tmp), "-%c%d", 'A' + HIBYTE(LOWORD(msi->ProcessorRevision)), LOBYTE(LOWORD(msi->ProcessorRevision)));
|
|
else
|
|
sprintf(tmp + strlen(tmp), "-%c%d", 'A' + HIWORD(msi->ProcessorRevision), LOWORD(msi->ProcessorRevision));
|
|
}
|
|
else sprintf(tmp + strlen(tmp), "-%d.%d", HIWORD(msi->ProcessorRevision), LOWORD(msi->ProcessorRevision));
|
|
str = tmp;
|
|
break;
|
|
case PROCESSOR_ARCHITECTURE_MIPS:
|
|
str = "Mips";
|
|
break;
|
|
case PROCESSOR_ARCHITECTURE_ALPHA:
|
|
str = "Alpha";
|
|
break;
|
|
case PROCESSOR_ARCHITECTURE_PPC:
|
|
str = "PowerPC";
|
|
break;
|
|
default:
|
|
str = "???";
|
|
break;
|
|
}
|
|
printf(" Processor: %s (#%d CPUs)\n", str, msi->u.s.NumberOfProcessors);
|
|
switch (msi->MajorVersion)
|
|
{
|
|
case 3:
|
|
switch (msi->MinorVersion)
|
|
{
|
|
case 51: str = "NT 3.51"; break;
|
|
default: str = "3-????"; break;
|
|
}
|
|
break;
|
|
case 4:
|
|
switch (msi->MinorVersion)
|
|
{
|
|
case 0: str = (msi->PlatformId == VER_PLATFORM_WIN32_NT) ? "NT 4.0" : "95"; break;
|
|
case 10: str = "98"; break;
|
|
case 90: str = "ME"; break;
|
|
default: str = "5-????"; break;
|
|
}
|
|
break;
|
|
case 5:
|
|
switch (msi->MinorVersion)
|
|
{
|
|
case 0: str = "2000"; break;
|
|
case 1: str = "XP"; break;
|
|
case 2: str = "Server 2003"; break;
|
|
default: str = "5-????"; break;
|
|
}
|
|
break;
|
|
default: str = "???"; break;
|
|
}
|
|
printf(" Version: Windows %s (%u)\n", str, msi->BuildNumber);
|
|
printf(" PlatformId: %u\n", msi->PlatformId);
|
|
printf(" CSD: ");
|
|
dump_mdmp_string(msi->CSDVersionRva);
|
|
printf("\n");
|
|
printf(" Reserved1: %u\n", msi->u1.Reserved1);
|
|
if (msi->ProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL)
|
|
{
|
|
printf(" x86.VendorId: %.12s\n",
|
|
(const char*)&msi->Cpu.X86CpuInfo.VendorId[0]);
|
|
printf(" x86.VersionInformation: %x\n",
|
|
msi->Cpu.X86CpuInfo.VersionInformation);
|
|
printf(" x86.FeatureInformation: %x\n",
|
|
msi->Cpu.X86CpuInfo.FeatureInformation);
|
|
printf(" x86.AMDExtendedCpuFeatures: %u\n",
|
|
msi->Cpu.X86CpuInfo.AMDExtendedCpuFeatures);
|
|
}
|
|
}
|
|
break;
|
|
case MiscInfoStream:
|
|
{
|
|
const MINIDUMP_MISC_INFO* mmi = (const MINIDUMP_MISC_INFO*)stream;
|
|
|
|
printf("Misc Information\n");
|
|
printf(" Size: %u\n", mmi->SizeOfInfo);
|
|
printf(" Flags: %s%s\n",
|
|
mmi->Flags1 & MINIDUMP_MISC1_PROCESS_ID ? "ProcessId " : "",
|
|
mmi->Flags1 & MINIDUMP_MISC1_PROCESS_TIMES ? "ProcessTimes " : "");
|
|
if (mmi->Flags1 & MINIDUMP_MISC1_PROCESS_ID)
|
|
printf(" ProcessId: %u\n", mmi->ProcessId);
|
|
if (mmi->Flags1 & MINIDUMP_MISC1_PROCESS_TIMES)
|
|
{
|
|
printf(" ProcessCreateTime: %u\n", mmi->ProcessCreateTime);
|
|
printf(" ProcessUserTime: %u\n", mmi->ProcessUserTime);
|
|
printf(" ProcessKernelTime: %u\n", mmi->ProcessKernelTime);
|
|
}
|
|
}
|
|
break;
|
|
case ExceptionStream:
|
|
{
|
|
const MINIDUMP_EXCEPTION_STREAM* mes = (const MINIDUMP_EXCEPTION_STREAM*)stream;
|
|
unsigned int i;
|
|
|
|
printf("Exception:\n");
|
|
printf(" ThreadId: %08x\n", mes->ThreadId);
|
|
printf(" ExceptionRecord:\n");
|
|
printf(" ExceptionCode: %u\n", mes->ExceptionRecord.ExceptionCode);
|
|
printf(" ExceptionFlags: %u\n", mes->ExceptionRecord.ExceptionFlags);
|
|
printf(" ExceptionRecord: 0x%x%08x\n",
|
|
(DWORD)(mes->ExceptionRecord.ExceptionRecord >> 32),
|
|
(DWORD)mes->ExceptionRecord.ExceptionRecord);
|
|
printf(" ExceptionAddress: 0x%x%08x\n",
|
|
(DWORD)(mes->ExceptionRecord.ExceptionAddress >> 32),
|
|
(DWORD)(mes->ExceptionRecord.ExceptionAddress));
|
|
printf(" ExceptionNumberParameters: %u\n",
|
|
mes->ExceptionRecord.NumberParameters);
|
|
for (i = 0; i < mes->ExceptionRecord.NumberParameters; i++)
|
|
{
|
|
printf(" [%d]: 0x%x%08x\n", i,
|
|
(DWORD)(mes->ExceptionRecord.ExceptionInformation[i] >> 32),
|
|
(DWORD)mes->ExceptionRecord.ExceptionInformation[i]);
|
|
}
|
|
printf(" ThreadContext:\n");
|
|
dump_mdmp_data(&mes->ThreadContext, " ");
|
|
}
|
|
break;
|
|
|
|
default:
|
|
printf("NIY %d\n", dir->StreamType);
|
|
printf(" RVA: %u\n", dir->Location.Rva);
|
|
printf(" Size: %u\n", dir->Location.DataSize);
|
|
dump_mdmp_data(&dir->Location, " ");
|
|
break;
|
|
}
|
|
}
|
|
}
|