ThreadHolder.c File Reference

User debugger's thread holder. More...

#include "pch.h"

Functions
VOID	ThreadHolderAllocateThreadHoldingBuffers ()
	Pre allocate buffer for thread holder.
BOOLEAN	ThreadHolderAssignThreadHolderToProcessDebuggingDetails (PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail)
	Assign a thread holder to process debugging details.
BOOLEAN	ThreadHolderIsAnyPausedThreadInProcess (PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail)
	Check if there is any thread paused by checking process debugging details.
PUSERMODE_DEBUGGING_THREAD_DETAILS	ThreadHolderGetProcessThreadDetailsByProcessIdAndThreadId (UINT32 ProcessId, UINT32 ThreadId)
	Find the active threads of the process from process id.
PUSERMODE_DEBUGGING_THREAD_DETAILS	ThreadHolderGetProcessFirstThreadDetailsByProcessId (UINT32 ProcessId)
	Find the first active threads of the process from process id.
PUSERMODE_DEBUGGING_PROCESS_DETAILS	ThreadHolderGetProcessDebuggingDetailsByThreadId (UINT32 ThreadId)
	Find the active process debugging detail from the thread id.
PUSERMODE_DEBUGGING_THREAD_DETAILS	ThreadHolderFindOrCreateThreadDebuggingDetail (UINT32 ThreadId, PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail)
	Find or create user-mode debugging details for threads.
BOOLEAN	ThreadHolderApplyActionToPausedThreads (PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails, PDEBUGGER_UD_COMMAND_PACKET ActionRequest)
	Apply the action of the user debugger to a specific thread or all threads.
VOID	ThreadHolderFreeHoldingStructures (PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail)
	Free all of thread holder structures.
UINT32	ThreadHolderQueryCountOfActiveDebuggingThreadsAndProcesses ()
	Query count of active debugging threads and processes.
VOID	ThreadHolderQueryDetailsOfActiveDebuggingThreadsAndProcesses (USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS *BufferToStoreDetails, UINT32 MaxCount)
	Query details of active debugging threads and processes.

Detailed Description

User debugger's thread holder.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2022-01-28

Copyright

This project is released under the GNU Public License v3.

Function Documentation

ThreadHolderAllocateThreadHoldingBuffers()

VOID ThreadHolderAllocateThreadHoldingBuffers

(

)

Pre allocate buffer for thread holder.

Returns

VOID

{
    //
    // Request to allocate two buffer for holder of threads
    //
    PoolManagerRequestAllocation(sizeof(USERMODE_DEBUGGING_THREAD_HOLDER), 2, PROCESS_THREAD_HOLDER);
 
    //
    // As it might be called from an attaching request and never find a
    // a chance to allocate it, we allocate it here as it's safe at PASSIVE_LEVEL
    //
    PoolManagerCheckAndPerformAllocationAndDeallocation();
}

ThreadHolderApplyActionToPausedThreads()

BOOLEAN ThreadHolderApplyActionToPausedThreads	(	PUSERMODE_DEBUGGING_PROCESS_DETAILS	ProcessDebuggingDetails,
		PDEBUGGER_UD_COMMAND_PACKET	ActionRequest )

Apply the action of the user debugger to a specific thread or all threads.

Parameters

ProcessDebuggingDetails
ActionRequest

Returns

BOOLEAN Shows whether the command is applied or not

{
    PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadDebuggingDetails;
    BOOLEAN                            CommandApplied = FALSE;
 
    if (!ActionRequest->ApplyToAllPausedThreads)
    {
        //
        // *** only the active thread ***
        //
 
        ThreadDebuggingDetails = ThreadHolderGetProcessThreadDetailsByProcessIdAndThreadId(ProcessDebuggingDetails->ProcessId,
                                                                                           ActionRequest->TargetThreadId);
 
        //
        // Apply the command
        //
        for (size_t i = 0; i < MAX_USER_ACTIONS_FOR_THREADS; i++)
        {
            if (ThreadDebuggingDetails->UdAction[i].ActionType == DEBUGGER_UD_COMMAND_ACTION_TYPE_NONE)
            {
                //
                // Set the action
                //
                ThreadDebuggingDetails->UdAction[i].OptionalParam1 = ActionRequest->UdAction.OptionalParam1;
                ThreadDebuggingDetails->UdAction[i].OptionalParam2 = ActionRequest->UdAction.OptionalParam2;
                ThreadDebuggingDetails->UdAction[i].OptionalParam3 = ActionRequest->UdAction.OptionalParam3;
                ThreadDebuggingDetails->UdAction[i].OptionalParam4 = ActionRequest->UdAction.OptionalParam4;
 
                //
                // At last we set the action type to make it valid
                //
                ThreadDebuggingDetails->UdAction[i].ActionType = ActionRequest->UdAction.ActionType;
 
                //
                // Command is applied
                //
                return TRUE;
            }
        }
    }
    else
    {
        //
        // *** apply to all paused threads ***
        //
        PLIST_ENTRY TempList = 0;
 
        TempList = &ProcessDebuggingDetails->ThreadsListHead;
 
        while (&ProcessDebuggingDetails->ThreadsListHead != TempList->Flink)
        {
            TempList = TempList->Flink;
            PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
                CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
            for (size_t i = 0; i < MAX_THREADS_IN_A_PROCESS_HOLDER; i++)
            {
                if (ThreadHolder->Threads[i].ThreadId != NULL_ZERO &&
                    ThreadHolder->Threads[i].IsPaused)
                {
                    for (size_t j = 0; j < MAX_USER_ACTIONS_FOR_THREADS; j++)
                    {
                        if (ThreadHolder->Threads[i].UdAction[j].ActionType == DEBUGGER_UD_COMMAND_ACTION_TYPE_NONE)
                        {
                            //
                            // Set the action
                            //
                            ThreadHolder->Threads[i].UdAction[j].OptionalParam1 = ActionRequest->UdAction.OptionalParam1;
                            ThreadHolder->Threads[i].UdAction[j].OptionalParam2 = ActionRequest->UdAction.OptionalParam2;
                            ThreadHolder->Threads[i].UdAction[j].OptionalParam3 = ActionRequest->UdAction.OptionalParam3;
                            ThreadHolder->Threads[i].UdAction[j].OptionalParam4 = ActionRequest->UdAction.OptionalParam4;
 
                            //
                            // At last we set the action type to make it valid
                            //
                            ThreadHolder->Threads[i].UdAction[j].ActionType = ActionRequest->UdAction.ActionType;
 
                            CommandApplied = TRUE;
                            break;
                        }
                    }
                }
            }
        }
    }
 
    //
    // Return the result of applying the command
    //
    return CommandApplied;
}

ThreadHolderAssignThreadHolderToProcessDebuggingDetails()

BOOLEAN ThreadHolderAssignThreadHolderToProcessDebuggingDetails

(

PUSERMODE_DEBUGGING_PROCESS_DETAILS

ProcessDebuggingDetail

)

Assign a thread holder to process debugging details.

Parameters

ProcessDebuggingDetail

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder;
 
    //
    // Initialize the list entry of threads
    //
    InitializeListHead(&ProcessDebuggingDetail->ThreadsListHead);
 
    //
    // Add a thread holder here
    //
    ThreadHolder = (USERMODE_DEBUGGING_THREAD_HOLDER *)
        PoolManagerRequestPool(PROCESS_THREAD_HOLDER, TRUE, sizeof(USERMODE_DEBUGGING_THREAD_HOLDER));
 
    if (!ThreadHolder)
    {
        return FALSE;
    }
 
    //
    // Add it to thread holder of the structure
    //
    InsertHeadList(&ProcessDebuggingDetail->ThreadsListHead, &(ThreadHolder->ThreadHolderList));
 
    return TRUE;
}

ThreadHolderFindOrCreateThreadDebuggingDetail()

PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadHolderFindOrCreateThreadDebuggingDetail	(	UINT32	ThreadId,
		PUSERMODE_DEBUGGING_PROCESS_DETAILS	ProcessDebuggingDetail )

Find or create user-mode debugging details for threads.

Parameters

ThreadId
ProcessDebuggingDetail

Returns

PUSERMODE_DEBUGGING_THREAD_DETAILS

{
    PLIST_ENTRY TempList = 0;
 
    TempList = &ProcessDebuggingDetail->ThreadsListHead;
 
    //
    // Let's see if we can find the thread
    //
    while (&ProcessDebuggingDetail->ThreadsListHead != TempList->Flink)
    {
        TempList = TempList->Flink;
        PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
            CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
        for (size_t i = 0; i < MAX_THREADS_IN_A_PROCESS_HOLDER; i++)
        {
            if (ThreadHolder->Threads[i].ThreadId == ThreadId)
            {
                //
                // We find a thread, let's return it's structure
                //
                return &ThreadHolder->Threads[i];
            }
        }
    }
 
    //
    // *** We're here, the thread is not found, let's create an entry for it ***
    //
 
    //
    // Two threads should not simultaneously reach here
    //
    SpinlockLock(&VmxRootThreadHoldingLock);
 
    TempList = &ProcessDebuggingDetail->ThreadsListHead;
 
    //
    // Let's see if we can find the thread
    //
    while (&ProcessDebuggingDetail->ThreadsListHead != TempList->Flink)
    {
        TempList = TempList->Flink;
        PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
            CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
        for (size_t i = 0; i < MAX_THREADS_IN_A_PROCESS_HOLDER; i++)
        {
            if (ThreadHolder->Threads[i].ThreadId == NULL_ZERO)
            {
                //
                // We find a null thread place, let's return it's structure
                //
                ThreadHolder->Threads[i].ThreadId = ThreadId;
 
                SpinlockUnlock(&VmxRootThreadHoldingLock);
                return &ThreadHolder->Threads[i];
            }
        }
    }
 
    //
    // We didn't find an empty entry,
    // let's use another structure and link it to the thread holder
    //
    PUSERMODE_DEBUGGING_THREAD_HOLDER NewThreadHolder = (USERMODE_DEBUGGING_THREAD_HOLDER *)
        PoolManagerRequestPool(PROCESS_THREAD_HOLDER, TRUE, sizeof(USERMODE_DEBUGGING_THREAD_HOLDER));
 
    if (NewThreadHolder == NULL)
    {
        LogError("Err, enable to find a place to save the threads data, "
                 "please use 'prealloc' command to allocate more pre-allocated "
                 "buffer for the thread holder");
 
        SpinlockUnlock(&VmxRootThreadHoldingLock);
        return NULL;
    }
 
    //
    // Add the current thread as the first entry of the holder
    //
    NewThreadHolder->Threads[0].ThreadId = ThreadId;
 
    //
    // Link to the thread holding structure
    //
    InsertHeadList(&ProcessDebuggingDetail->ThreadsListHead, &(NewThreadHolder->ThreadHolderList));
 
    //
    // Other threads are now allowed to use the thread listing mechanism
    //
    SpinlockUnlock(&VmxRootThreadHoldingLock);
 
    return &NewThreadHolder->Threads[0];
}

ThreadHolderFreeHoldingStructures()

VOID ThreadHolderFreeHoldingStructures

(

PUSERMODE_DEBUGGING_PROCESS_DETAILS

ProcessDebuggingDetail

)

Free all of thread holder structures.

Parameters

ProcessDebuggingDetail

Returns

VOID

{
    PLIST_ENTRY TempList = 0;
 
    TempList = &ProcessDebuggingDetail->ThreadsListHead;
 
    while (&ProcessDebuggingDetail->ThreadsListHead != TempList->Flink)
    {
        TempList = TempList->Flink;
        PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
            CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
        //
        // The thread is allocated from the pool management, so we'll
        // free it from there
        //
        PoolManagerFreePool((UINT64)ThreadHolder);
    }
}

ThreadHolderGetProcessDebuggingDetailsByThreadId()

PUSERMODE_DEBUGGING_PROCESS_DETAILS ThreadHolderGetProcessDebuggingDetailsByThreadId

(

UINT32

ThreadId

)

Find the active process debugging detail from the thread id.

Parameters

ThreadId

Returns

PUSERMODE_DEBUGGING_PROCESS_DETAILS

{
    PLIST_ENTRY TempList  = 0;
    PLIST_ENTRY TempList2 = 0;
 
    TempList = &g_ProcessDebuggingDetailsListHead;
 
    while (&g_ProcessDebuggingDetailsListHead != TempList->Flink)
    {
        TempList = TempList->Flink;
        PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails =
            CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_PROCESS_DETAILS, AttachedProcessList);
 
        //
        // Search through all the active threads of this process
        //
        TempList2 = &ProcessDebuggingDetails->ThreadsListHead;
 
        while (&ProcessDebuggingDetails->ThreadsListHead != TempList2->Flink)
        {
            TempList2 = TempList2->Flink;
            PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
                CONTAINING_RECORD(TempList2, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
            for (size_t i = 0; i < MAX_THREADS_IN_A_PROCESS_HOLDER; i++)
            {
                if (ThreadHolder->Threads[i].ThreadId == ThreadId)
                {
                    //
                    // The target thread is found, not let's return the process debugging
                    // details of this process
                    //
                    return ProcessDebuggingDetails;
                }
            }
        }
    }
 
    //
    // Active thread not found
    //
    return NULL;
}

ThreadHolderGetProcessFirstThreadDetailsByProcessId()

PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadHolderGetProcessFirstThreadDetailsByProcessId

(

UINT32

ProcessId

)

Find the first active threads of the process from process id.

Parameters

ProcessId

Returns

PUSERMODE_DEBUGGING_THREAD_DETAILS

{
    PLIST_ENTRY                         TempList = 0;
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
 
    //
    // First, find the process details
    //
    ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(ProcessId);
 
    if (ProcessDebuggingDetail == NULL)
    {
        return NULL;
    }
 
    TempList = &ProcessDebuggingDetail->ThreadsListHead;
 
    while (&ProcessDebuggingDetail->ThreadsListHead != TempList->Flink)
    {
        TempList = TempList->Flink;
        PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
            CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
        for (size_t i = 0; i < MAX_THREADS_IN_A_PROCESS_HOLDER; i++)
        {
            if (ThreadHolder->Threads[i].ThreadId != NULL_ZERO)
            {
                //
                // The active thread's structure is found
                //
                return &ThreadHolder->Threads[i];
            }
        }
    }
 
    //
    // Active thread not found
    //
    return NULL;
}

ThreadHolderGetProcessThreadDetailsByProcessIdAndThreadId()

PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadHolderGetProcessThreadDetailsByProcessIdAndThreadId	(	UINT32	ProcessId,
		UINT32	ThreadId )

Find the active threads of the process from process id.

Parameters

ProcessId
ThreadId

Returns

PUSERMODE_DEBUGGING_THREAD_DETAILS

{
    PLIST_ENTRY                         TempList = 0;
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
 
    //
    // First, find the process details
    //
    ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(ProcessId);
 
    if (ProcessDebuggingDetail == NULL)
    {
        return NULL;
    }
 
    TempList = &ProcessDebuggingDetail->ThreadsListHead;
 
    while (&ProcessDebuggingDetail->ThreadsListHead != TempList->Flink)
    {
        TempList = TempList->Flink;
        PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
            CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
        for (size_t i = 0; i < MAX_THREADS_IN_A_PROCESS_HOLDER; i++)
        {
            if (ThreadHolder->Threads[i].ThreadId == ThreadId)
            {
                //
                // The active thread's structure is found
                //
                return &ThreadHolder->Threads[i];
            }
        }
    }
 
    //
    // Active thread not found
    //
    return NULL;
}

ThreadHolderIsAnyPausedThreadInProcess()

BOOLEAN ThreadHolderIsAnyPausedThreadInProcess

(

PUSERMODE_DEBUGGING_PROCESS_DETAILS

ProcessDebuggingDetail

)

Check if there is any thread paused by checking process debugging details.

Parameters

ProcessDebuggingDetail

Returns

BOOLEAN

{
    PLIST_ENTRY TempList = 0;
 
    TempList = &ProcessDebuggingDetail->ThreadsListHead;
 
    while (&ProcessDebuggingDetail->ThreadsListHead != TempList->Flink)
    {
        TempList = TempList->Flink;
        PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
            CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
        for (size_t i = 0; i < MAX_THREADS_IN_A_PROCESS_HOLDER; i++)
        {
            if (ThreadHolder->Threads[i].ThreadId != NULL_ZERO && ThreadHolder->Threads[i].IsPaused)
            {
                return TRUE;
            }
        }
    }
 
    return FALSE;
}

ThreadHolderQueryCountOfActiveDebuggingThreadsAndProcesses()

UINT32 ThreadHolderQueryCountOfActiveDebuggingThreadsAndProcesses

(

)

Query count of active debugging threads and processes.

Returns

UINT32

{
    PLIST_ENTRY TempList                   = 0;
    PLIST_ENTRY TempList2                  = 0;
    UINT32      CountOfThreadsAndProcesses = 0;
 
    TempList = &g_ProcessDebuggingDetailsListHead;
 
    while (&g_ProcessDebuggingDetailsListHead != TempList->Flink)
    {
        TempList = TempList->Flink;
        PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails =
            CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_PROCESS_DETAILS, AttachedProcessList);
 
        //
        // Each process is also counted (no matter if it has active paused thread or not)
        //
        CountOfThreadsAndProcesses++;
 
        //
        // Search through all the active threads of this process
        //
        TempList2 = &ProcessDebuggingDetails->ThreadsListHead;
 
        while (&ProcessDebuggingDetails->ThreadsListHead != TempList2->Flink)
        {
            TempList2 = TempList2->Flink;
            PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
                CONTAINING_RECORD(TempList2, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
            for (size_t i = 0; i < MAX_THREADS_IN_A_PROCESS_HOLDER; i++)
            {
                if (ThreadHolder->Threads[i].IsPaused)
                {
                    //
                    // A paused thread should be counted
                    //
                    CountOfThreadsAndProcesses++;
                }
            }
        }
    }
 
    //
    // Return count of active threads and processes
    //
    return CountOfThreadsAndProcesses;
}

ThreadHolderQueryDetailsOfActiveDebuggingThreadsAndProcesses()

VOID ThreadHolderQueryDetailsOfActiveDebuggingThreadsAndProcesses	(	USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS *	BufferToStoreDetails,
		UINT32	MaxCount )

Query details of active debugging threads and processes.

Parameters

BufferToStoreDetails
MaxCount

Returns

VOID

{
    PLIST_ENTRY TempList     = 0;
    PLIST_ENTRY TempList2    = 0;
    UINT32      CurrentIndex = 0;
 
    if (MaxCount == 0)
    {
        //
        // Invalid query, storage is empty
        //
        return;
    }
 
    TempList = &g_ProcessDebuggingDetailsListHead;
 
    while (&g_ProcessDebuggingDetailsListHead != TempList->Flink)
    {
        TempList = TempList->Flink;
        PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails =
            CONTAINING_RECORD(TempList, USERMODE_DEBUGGING_PROCESS_DETAILS, AttachedProcessList);
 
        //
        // Each process is also save (no matter if it has active paused thread or not)
        //
        BufferToStoreDetails[CurrentIndex].IsProcess = TRUE;
        BufferToStoreDetails[CurrentIndex].ProcessId = ProcessDebuggingDetails->ProcessId;
        CurrentIndex++;
        if (MaxCount == CurrentIndex)
        {
            //
            // Storage is full
            //
            return;
        }
 
        //
        // Search through all the active threads of this process
        //
        TempList2 = &ProcessDebuggingDetails->ThreadsListHead;
 
        while (&ProcessDebuggingDetails->ThreadsListHead != TempList2->Flink)
        {
            TempList2 = TempList2->Flink;
            PUSERMODE_DEBUGGING_THREAD_HOLDER ThreadHolder =
                CONTAINING_RECORD(TempList2, USERMODE_DEBUGGING_THREAD_HOLDER, ThreadHolderList);
 
            for (size_t i = 0; i < MAX_THREADS_IN_A_PROCESS_HOLDER; i++)
            {
                if (ThreadHolder->Threads[i].IsPaused)
                {
                    //
                    // A paused thread should be saved
                    //
                    BufferToStoreDetails[CurrentIndex].IsProcess = FALSE;
                    BufferToStoreDetails[CurrentIndex].ProcessId = ProcessDebuggingDetails->ProcessId;
                    BufferToStoreDetails[CurrentIndex].ThreadId  = ThreadHolder->Threads[i].ThreadId;
                    CurrentIndex++;
                    if (MaxCount == CurrentIndex)
                    {
                        //
                        // Storage is full
                        //
                        return;
                    }
                }
            }
        }
    }
}