tsc.cpp File Reference

!tsc commands More...

#include "pch.h"

Functions
VOID	CommandTscHelp ()
	help of the !tsc command
VOID	CommandTsc (vector< string > SplitCommand, string Command)
	handler of !tsc command

Detailed Description

!tsc commands

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-06-02

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CommandTsc()

VOID CommandTsc	(	vector< string >	SplitCommand,
		string	Command )

handler of !tsc command

Parameters

SplitCommand
Command

Returns

VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            TSC_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (SplitCommand.size() > 1)
    {
        ShowMessages("incorrect use of the '!tsc'\n");
        CommandTscHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

CommandTscHelp()

VOID CommandTscHelp

(

)

help of the !tsc command

Returns

VOID

{
    ShowMessages("!tsc : monitors execution of rdtsc/rdtscp instructions.\n\n");
 
    ShowMessages("syntax : \t!tsc [pid ProcessId (hex)] [core CoreId (hex)] [imm IsImmediate (yesno)] "
                 "[sc EnableShortCircuiting (onoff)] [stage CallingStage (prepostall)] [buffer PreAllocatedBuffer (hex)] "
                 "[script { Script (string) }] [asm condition { Condition (assembly/hex) }] [asm code { Code (assembly/hex) }] "
                 "[output {OutputName (string)}]\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : !tsc\n");
    ShowMessages("\t\te.g : !tsc pid 400\n");
    ShowMessages("\t\te.g : !tsc core 2 pid 400\n");
    ShowMessages("\t\te.g : !tsc script { printf(\"RDTSC/P instruction called at: %%llx\\n\", @rip); }\n");
    ShowMessages("\t\te.g : !tsc asm code { nop; nop; nop }\n");
}