ThreadHolder.h

Go to the documentation of this file.

#pragma once

//                      Locks                   //

volatile LONG VmxRootThreadHoldingLock;

//                    Structures                //

typedef struct _USERMODE_DEBUGGING_THREAD_DETAILS
{
    UINT32                     ThreadId;
    UINT64                     ThreadRip; // if IsPaused is TRUE
    BOOLEAN                    IsPaused;
    BYTE                       InstructionBytesOnRip[MAXIMUM_INSTR_SIZE];
    UINT32                     SizeOfInstruction;
    UINT64                     NumberOfBlockedContextSwitches;
    DEBUGGER_UD_COMMAND_ACTION UdAction[MAX_USER_ACTIONS_FOR_THREADS];
 
} USERMODE_DEBUGGING_THREAD_DETAILS, *PUSERMODE_DEBUGGING_THREAD_DETAILS;

typedef struct _USERMODE_DEBUGGING_THREAD_HOLDER
{
    LIST_ENTRY                        ThreadHolderList;
    USERMODE_DEBUGGING_THREAD_DETAILS Threads[MAX_THREADS_IN_A_PROCESS_HOLDER];
 
} USERMODE_DEBUGGING_THREAD_HOLDER, *PUSERMODE_DEBUGGING_THREAD_HOLDER;

//                    Functions                 //
 
VOID
ThreadHolderAllocateThreadHoldingBuffers();
 
BOOLEAN
ThreadHolderAssignThreadHolderToProcessDebuggingDetails(PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail);
 
BOOLEAN
ThreadHolderIsAnyPausedThreadInProcess(PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail);
 
BOOLEAN
ThreadHolderUnpauseAllThreadsInProcess(PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail);
 
PUSERMODE_DEBUGGING_THREAD_DETAILS
ThreadHolderGetProcessThreadDetailsByProcessIdAndThreadId(UINT32 ProcessId, UINT32 ThreadId);
 
PUSERMODE_DEBUGGING_THREAD_DETAILS
ThreadHolderGetProcessFirstThreadDetailsByProcessId(UINT32 ProcessId);
 
PUSERMODE_DEBUGGING_PROCESS_DETAILS
ThreadHolderGetProcessDebuggingDetailsByThreadId(UINT32 ThreadId);
 
PUSERMODE_DEBUGGING_THREAD_DETAILS
ThreadHolderFindOrCreateThreadDebuggingDetail(UINT32 ThreadId, PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail);
 
BOOLEAN
ThreadHolderApplyActionToPausedThreads(PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails,
                                       PDEBUGGER_UD_COMMAND_PACKET         ActionRequest);
 
VOID
ThreadHolderFreeHoldingStructures(PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail);
 
UINT32
ThreadHolderQueryCountOfActiveDebuggingThreadsAndProcesses();
 
VOID
ThreadHolderQueryDetailsOfActiveDebuggingThreadsAndProcesses(
    USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS * BufferToStoreDetails,
    UINT32                                               MaxCount);