diff options
Diffstat (limited to 'src/events.c')
| -rw-r--r-- | src/events.c | 389 |
1 files changed, 374 insertions, 15 deletions
diff --git a/src/events.c b/src/events.c index a1dd6ce..1886617 100644 --- a/src/events.c +++ b/src/events.c @@ -1,8 +1,367 @@ -#include <Windows.h> - #include "utils.h" #include "pdb.h" +// ======================= +// ====== windows.h ====== +// ======================= + +// +// Debug APIs +// +#define EXCEPTION_DEBUG_EVENT 1 +#define CREATE_THREAD_DEBUG_EVENT 2 +#define CREATE_PROCESS_DEBUG_EVENT 3 +#define EXIT_THREAD_DEBUG_EVENT 4 +#define EXIT_PROCESS_DEBUG_EVENT 5 +#define LOAD_DLL_DEBUG_EVENT 6 +#define UNLOAD_DLL_DEBUG_EVENT 7 +#define OUTPUT_DEBUG_STRING_EVENT 8 +#define RIP_EVENT 9 + +typedef u32 (*PTHREAD_START_ROUTINE)(void* lpThreadParameter); +typedef PTHREAD_START_ROUTINE LPTHREAD_START_ROUTINE; + +#define EXCEPTION_MAXIMUM_PARAMETERS 15 // maximum number of exception parameters + +// +// Exception record definition. +// + +typedef struct _EXCEPTION_RECORD { + u32 ExceptionCode; + u32 ExceptionFlags; + struct _EXCEPTION_RECORD *ExceptionRecord; + void* ExceptionAddress; + u32 NumberParameters; + u64* ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; + } EXCEPTION_RECORD; + +typedef EXCEPTION_RECORD *PEXCEPTION_RECORD; + +typedef struct _EXCEPTION_DEBUG_INFO { + EXCEPTION_RECORD ExceptionRecord; + u32 dwFirstChance; +} EXCEPTION_DEBUG_INFO, *LPEXCEPTION_DEBUG_INFO; + +typedef struct _CREATE_THREAD_DEBUG_INFO { + void* hThread; + void* lpThreadLocalBase; + LPTHREAD_START_ROUTINE lpStartAddress; +} CREATE_THREAD_DEBUG_INFO, *LPCREATE_THREAD_DEBUG_INFO; + +typedef struct _CREATE_PROCESS_DEBUG_INFO { + void* hFile; + void* hProcess; + void* hThread; + void* lpBaseOfImage; + u32 dwDebugInfoFileOffset; + u32 nDebugInfoSize; + void* lpThreadLocalBase; + LPTHREAD_START_ROUTINE lpStartAddress; + void* lpImageName; + u16 fUnicode; +} CREATE_PROCESS_DEBUG_INFO, *LPCREATE_PROCESS_DEBUG_INFO; + +typedef struct _EXIT_THREAD_DEBUG_INFO { + u32 dwExitCode; +} EXIT_THREAD_DEBUG_INFO, *LPEXIT_THREAD_DEBUG_INFO; + +typedef struct _EXIT_PROCESS_DEBUG_INFO { + u32 dwExitCode; +} EXIT_PROCESS_DEBUG_INFO, *LPEXIT_PROCESS_DEBUG_INFO; + +typedef struct _LOAD_DLL_DEBUG_INFO { + void* hFile; + void* lpBaseOfDll; + u32 dwDebugInfoFileOffset; + u32 nDebugInfoSize; + void* lpImageName; + u16 fUnicode; +} LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO; + +typedef struct _UNLOAD_DLL_DEBUG_INFO { + void* lpBaseOfDll; +} UNLOAD_DLL_DEBUG_INFO, *LPUNLOAD_DLL_DEBUG_INFO; + +typedef struct _OUTPUT_DEBUG_STRING_INFO { + char* lpDebugStringData; + u16 fUnicode; + u16 nDebugStringLength; +} OUTPUT_DEBUG_STRING_INFO, *LPOUTPUT_DEBUG_STRING_INFO; + +typedef struct _RIP_INFO { + u32 dwError; + u32 dwType; +} RIP_INFO, *LPRIP_INFO; + +typedef struct _DEBUG_EVENT { + u32 dwDebugEventCode; + u32 dwProcessId; + u32 dwThreadId; + union { + EXCEPTION_DEBUG_INFO Exception; + CREATE_THREAD_DEBUG_INFO CreateThread; + CREATE_PROCESS_DEBUG_INFO CreateProcessInfo; + EXIT_THREAD_DEBUG_INFO ExitThread; + EXIT_PROCESS_DEBUG_INFO ExitProcess; + LOAD_DLL_DEBUG_INFO LoadDll; + UNLOAD_DLL_DEBUG_INFO UnloadDll; + OUTPUT_DEBUG_STRING_INFO DebugString; + RIP_INFO RipInfo; + } u; +} DEBUG_EVENT, *LPDEBUG_EVENT; + +#define FILE_NAME_NORMALIZED 0x0 //default +#define FILE_NAME_OPENED 0x8 + +#define STATUS_WAIT_0 ((u32 )0x00000000L) +#define STATUS_ABANDONED_WAIT_0 ((u32 )0x00000080L) +#define STATUS_USER_APC ((u32 )0x000000C0L) +#define STATUS_TIMEOUT ((u32 )0x00000102L) +#define STATUS_PENDING ((u32 )0x00000103L) +#define DBG_EXCEPTION_HANDLED ((u32 )0x00010001L) +#define DBG_CONTINUE ((u32 )0x00010002L) +#define STATUS_SEGMENT_NOTIFICATION ((u32 )0x40000005L) +#define STATUS_FATAL_APP_EXIT ((u32 )0x40000015L) +#define DBG_REPLY_LATER ((u32 )0x40010001L) +#define DBG_TERMINATE_THREAD ((u32 )0x40010003L) +#define DBG_TERMINATE_PROCESS ((u32 )0x40010004L) +#define DBG_CONTROL_C ((u32 )0x40010005L) +#define DBG_PRINTEXCEPTION_C ((u32 )0x40010006L) +#define DBG_RIPEXCEPTION ((u32 )0x40010007L) +#define DBG_CONTROL_BREAK ((u32 )0x40010008L) +#define DBG_COMMAND_EXCEPTION ((u32 )0x40010009L) +#define DBG_PRINTEXCEPTION_WIDE_C ((u32 )0x4001000AL) +#define STATUS_GUARD_PAGE_VIOLATION ((u32 )0x80000001L) +#define STATUS_DATATYPE_MISALIGNMENT ((u32 )0x80000002L) +#define STATUS_BREAKPOINT ((u32 )0x80000003L) +#define STATUS_SINGLE_STEP ((u32 )0x80000004L) +#define STATUS_LONGJUMP ((u32 )0x80000026L) +#define STATUS_UNWIND_CONSOLIDATE ((u32 )0x80000029L) +#define DBG_EXCEPTION_NOT_HANDLED ((u32 )0x80010001L) +#define STATUS_ACCESS_VIOLATION ((u32 )0xC0000005L) +#define STATUS_IN_PAGE_ERROR ((u32 )0xC0000006L) +#define STATUS_INVALID_HANDLE ((u32 )0xC0000008L) +#define STATUS_INVALID_PARAMETER ((u32 )0xC000000DL) +#define STATUS_NO_MEMORY ((u32 )0xC0000017L) +#define STATUS_ILLEGAL_INSTRUCTION ((u32 )0xC000001DL) +#define STATUS_NONCONTINUABLE_EXCEPTION ((u32 )0xC0000025L) +#define STATUS_INVALID_DISPOSITION ((u32 )0xC0000026L) +#define STATUS_ARRAY_BOUNDS_EXCEEDED ((u32 )0xC000008CL) +#define STATUS_FLOAT_DENORMAL_OPERAND ((u32 )0xC000008DL) +#define STATUS_FLOAT_DIVIDE_BY_ZERO ((u32 )0xC000008EL) +#define STATUS_FLOAT_INEXACT_RESULT ((u32 )0xC000008FL) +#define STATUS_FLOAT_INVALID_OPERATION ((u32 )0xC0000090L) +#define STATUS_FLOAT_OVERFLOW ((u32 )0xC0000091L) +#define STATUS_FLOAT_STACK_CHECK ((u32 )0xC0000092L) +#define STATUS_FLOAT_UNDERFLOW ((u32 )0xC0000093L) +#define STATUS_INTEGER_DIVIDE_BY_ZERO ((u32 )0xC0000094L) +#define STATUS_INTEGER_OVERFLOW ((u32 )0xC0000095L) +#define STATUS_PRIVILEGED_INSTRUCTION ((u32 )0xC0000096L) +#define STATUS_STACK_OVERFLOW ((u32 )0xC00000FDL) +#define STATUS_DLL_NOT_FOUND ((u32 )0xC0000135L) +#define STATUS_ORDINAL_NOT_FOUND ((u32 )0xC0000138L) +#define STATUS_ENTRYPOINT_NOT_FOUND ((u32 )0xC0000139L) +#define STATUS_CONTROL_C_EXIT ((u32 )0xC000013AL) +#define STATUS_DLL_INIT_FAILED ((u32 )0xC0000142L) +#define STATUS_CONTROL_STACK_VIOLATION ((u32 )0xC00001B2L) +#define STATUS_FLOAT_MULTIPLE_FAULTS ((u32 )0xC00002B4L) +#define STATUS_FLOAT_MULTIPLE_TRAPS ((u32 )0xC00002B5L) +#define STATUS_REG_NAT_CONSUMPTION ((u32 )0xC00002C9L) +#define STATUS_HEAP_CORRUPTION ((u32 )0xC0000374L) +#define STATUS_STACK_BUFFER_OVERRUN ((u32 )0xC0000409L) +#define STATUS_INVALID_CRUNTIME_PARAMETER ((u32 )0xC0000417L) +#define STATUS_ASSERTION_FAILURE ((u32 )0xC0000420L) +#define STATUS_ENCLAVE_VIOLATION ((u32 )0xC00004A2L) +#define STATUS_INTERRUPTED ((u32 )0xC0000515L) +#define STATUS_THREAD_NOT_RUNNING ((u32 )0xC0000516L) +#define STATUS_ALREADY_REGISTERED ((u32 )0xC0000718L) + +/* compatibility macros */ +#define STILL_ACTIVE STATUS_PENDING +#define EXCEPTION_ACCESS_VIOLATION STATUS_ACCESS_VIOLATION +#define EXCEPTION_DATATYPE_MISALIGNMENT STATUS_DATATYPE_MISALIGNMENT +#define EXCEPTION_BREAKPOINT STATUS_BREAKPOINT +#define EXCEPTION_SINGLE_STEP STATUS_SINGLE_STEP +#define EXCEPTION_ARRAY_BOUNDS_EXCEEDED STATUS_ARRAY_BOUNDS_EXCEEDED +#define EXCEPTION_FLT_DENORMAL_OPERAND STATUS_FLOAT_DENORMAL_OPERAND +#define EXCEPTION_FLT_DIVIDE_BY_ZERO STATUS_FLOAT_DIVIDE_BY_ZERO +#define EXCEPTION_FLT_INEXACT_RESULT STATUS_FLOAT_INEXACT_RESULT +#define EXCEPTION_FLT_INVALID_OPERATION STATUS_FLOAT_INVALID_OPERATION +#define EXCEPTION_FLT_OVERFLOW STATUS_FLOAT_OVERFLOW +#define EXCEPTION_FLT_STACK_CHECK STATUS_FLOAT_STACK_CHECK +#define EXCEPTION_FLT_UNDERFLOW STATUS_FLOAT_UNDERFLOW +#define EXCEPTION_INT_DIVIDE_BY_ZERO STATUS_INTEGER_DIVIDE_BY_ZERO +#define EXCEPTION_INT_OVERFLOW STATUS_INTEGER_OVERFLOW +#define EXCEPTION_PRIV_INSTRUCTION STATUS_PRIVILEGED_INSTRUCTION +#define EXCEPTION_IN_PAGE_ERROR STATUS_IN_PAGE_ERROR +#define EXCEPTION_ILLEGAL_INSTRUCTION STATUS_ILLEGAL_INSTRUCTION +#define EXCEPTION_NONCONTINUABLE_EXCEPTION STATUS_NONCONTINUABLE_EXCEPTION +#define EXCEPTION_STACK_OVERFLOW STATUS_STACK_OVERFLOW +#define EXCEPTION_INVALID_DISPOSITION STATUS_INVALID_DISPOSITION +#define EXCEPTION_GUARD_PAGE STATUS_GUARD_PAGE_VIOLATION +#define EXCEPTION_INVALID_HANDLE STATUS_INVALID_HANDLE +#define EXCEPTION_POSSIBLE_DEADLOCK STATUS_POSSIBLE_DEADLOCK +#define CONTROL_C_EXIT STATUS_CONTROL_C_EXIT + +typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY { + u32 BeginAddress; + u32 EndAddress; + union { + u32 UnwindInfoAddress; + u32 UnwindData; + }; +} _IMAGE_RUNTIME_FUNCTION_ENTRY, *_PIMAGE_RUNTIME_FUNCTION_ENTRY; + +typedef struct _IMAGE_EXPORT_DIRECTORY { + u32 Characteristics; + u32 TimeDateStamp; + u16 MajorVersion; + u16 MinorVersion; + u32 Name; + u32 Base; + u32 NumberOfFunctions; + u32 NumberOfNames; + u32 AddressOfFunctions; // RVA from base of image + u32 AddressOfNames; // RVA from base of image + u32 AddressOfNameOrdinals; // RVA from base of image +} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; + +typedef struct _IMAGE_DEBUG_DIRECTORY { + u32 Characteristics; + u32 TimeDateStamp; + u16 MajorVersion; + u16 MinorVersion; + u32 Type; + u32 SizeOfData; + u32 AddressOfRawData; + u32 PointerToRawData; +} IMAGE_DEBUG_DIRECTORY, *PIMAGE_DEBUG_DIRECTORY; + +#define IMAGE_DEBUG_TYPE_UNKNOWN 0 +#define IMAGE_DEBUG_TYPE_COFF 1 +#define IMAGE_DEBUG_TYPE_CODEVIEW 2 +#define IMAGE_DEBUG_TYPE_FPO 3 +#define IMAGE_DEBUG_TYPE_MISC 4 +#define IMAGE_DEBUG_TYPE_EXCEPTION 5 +#define IMAGE_DEBUG_TYPE_FIXUP 6 +#define IMAGE_DEBUG_TYPE_OMAP_TO_SRC 7 +#define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC 8 +#define IMAGE_DEBUG_TYPE_BORLAND 9 +#define IMAGE_DEBUG_TYPE_RESERVED10 10 +#define IMAGE_DEBUG_TYPE_BBT IMAGE_DEBUG_TYPE_RESERVED10 +#define IMAGE_DEBUG_TYPE_CLSID 11 +#define IMAGE_DEBUG_TYPE_VC_FEATURE 12 +#define IMAGE_DEBUG_TYPE_POGO 13 +#define IMAGE_DEBUG_TYPE_ILTCG 14 +#define IMAGE_DEBUG_TYPE_MPX 15 +#define IMAGE_DEBUG_TYPE_REPRO 16 +#define IMAGE_DEBUG_TYPE_SPGO 18 +#define IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS 20 + +typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY RUNTIME_FUNCTION, *PRUNTIME_FUNCTION; + +extern u32 GetLastError(void); + +// +// Code Page Default Values. +// Please Use Unicode, either UTF-16 (as in WCHAR) or UTF-8 (code page CP_ACP) +// +#define CP_ACP 0 // default to ANSI code page +#define CP_OEMCP 1 // default to OEM code page +#define CP_MACCP 2 // default to MAC code page +#define CP_THREAD_ACP 3 // current thread's ANSI code page +#define CP_SYMBOL 42 // SYMBOL translations + +#define CP_UTF7 65000 // UTF-7 translation +#define CP_UTF8 65001 // UTF-8 translation + +extern i32 WideCharToMultiByte(u32 CodePage, u32 dwFlags, const u16* lpWideCharStr, i32 cchWideChar, i8* lpMultiByteStr, i32 cbMultiByte, const i8* lpDefaultChar, i32* lpUsedDefaultChar); + +extern u32 GetFinalPathNameByHandleA(void* hFile, i8* lpszFilePath, u32 cchFilePath, u32 dwFlags); + +#define PAGE_NOACCESS 0x01 +#define PAGE_READONLY 0x02 +#define PAGE_READWRITE 0x04 +#define PAGE_WRITECOPY 0x08 +#define PAGE_EXECUTE 0x10 +#define PAGE_EXECUTE_READ 0x20 +#define PAGE_EXECUTE_READWRITE 0x40 +#define PAGE_EXECUTE_WRITECOPY 0x80 +#define PAGE_GUARD 0x100 +#define PAGE_NOCACHE 0x200 +#define PAGE_WRITECOMBINE 0x400 +#define PAGE_GRAPHICS_NOACCESS 0x0800 +#define PAGE_GRAPHICS_READONLY 0x1000 +#define PAGE_GRAPHICS_READWRITE 0x2000 +#define PAGE_GRAPHICS_EXECUTE 0x4000 +#define PAGE_GRAPHICS_EXECUTE_READ 0x8000 +#define PAGE_GRAPHICS_EXECUTE_READWRITE 0x10000 +#define PAGE_GRAPHICS_COHERENT 0x20000 +#define PAGE_GRAPHICS_NOCACHE 0x40000 +#define PAGE_ENCLAVE_THREAD_CONTROL 0x80000000 +#define PAGE_REVERT_TO_FILE_MAP 0x80000000 +#define PAGE_TARGETS_NO_UPDATE 0x40000000 +#define PAGE_TARGETS_INVALID 0x40000000 +#define PAGE_ENCLAVE_UNVALIDATED 0x20000000 +#define PAGE_ENCLAVE_MASK 0x10000000 +#define PAGE_ENCLAVE_DECOMMIT (PAGE_ENCLAVE_MASK | 0) +#define PAGE_ENCLAVE_SS_FIRST (PAGE_ENCLAVE_MASK | 1) +#define PAGE_ENCLAVE_SS_REST (PAGE_ENCLAVE_MASK | 2) +#define MEM_COMMIT 0x00001000 +#define MEM_RESERVE 0x00002000 +#define MEM_REPLACE_PLACEHOLDER 0x00004000 +#define MEM_RESERVE_PLACEHOLDER 0x00040000 +#define MEM_RESET 0x00080000 +#define MEM_TOP_DOWN 0x00100000 +#define MEM_WRITE_WATCH 0x00200000 +#define MEM_PHYSICAL 0x00400000 +#define MEM_ROTATE 0x00800000 +#define MEM_DIFFERENT_IMAGE_BASE_OK 0x00800000 +#define MEM_RESET_UNDO 0x01000000 +#define MEM_LARGE_PAGES 0x20000000 +#define MEM_4MB_PAGES 0x80000000 +#define MEM_64K_PAGES (MEM_LARGE_PAGES | MEM_PHYSICAL) +#define MEM_UNMAP_WITH_TRANSIENT_BOOST 0x00000001 +#define MEM_COALESCE_PLACEHOLDERS 0x00000001 +#define MEM_PRESERVE_PLACEHOLDER 0x00000002 +#define MEM_DECOMMIT 0x00004000 +#define MEM_RELEASE 0x00008000 +#define MEM_FREE 0x00010000 +#define MEM_EXTENDED_PARAMETER_GRAPHICS 0x00000001 +#define MEM_EXTENDED_PARAMETER_NONPAGED 0x00000002 +#define MEM_EXTENDED_PARAMETER_ZERO_PAGES_OPTIONAL 0x00000004 +#define MEM_EXTENDED_PARAMETER_NONPAGED_LARGE 0x00000008 +#define MEM_EXTENDED_PARAMETER_NONPAGED_HUGE 0x00000010 +#define MEM_EXTENDED_PARAMETER_SOFT_FAULT_PAGES 0x00000020 +#define MEM_EXTENDED_PARAMETER_EC_CODE 0x00000040 +#define MEM_EXTENDED_PARAMETER_NUMA_NODE_MANDATORY MINLONG64 + +extern void* VirtualAlloc(void* lpAddress, size_t dwSize, u32 flAllocationType, u32 flProtect); +extern i32 VirtualFree(void* lpAddress, size_t dwSize, u32 dwFreeType); + +#define PROCESS_TERMINATE (0x0001) +#define PROCESS_CREATE_THREAD (0x0002) +#define PROCESS_SET_SESSIONID (0x0004) +#define PROCESS_VM_OPERATION (0x0008) +#define PROCESS_VM_READ (0x0010) +#define PROCESS_VM_WRITE (0x0020) +#define PROCESS_DUP_HANDLE (0x0040) +#define PROCESS_CREATE_PROCESS (0x0080) +#define PROCESS_SET_QUOTA (0x0100) +#define PROCESS_SET_INFORMATION (0x0200) +#define PROCESS_QUERY_INFORMATION (0x0400) +#define PROCESS_SUSPEND_RESUME (0x0800) +#define PROCESS_QUERY_LIMITED_INFORMATION (0x1000) +#define PROCESS_SET_LIMITED_INFORMATION (0x2000) + +extern void* OpenProcess(u32 dwDesiredAccess, i32 bInheritHandle, u32 dwProcessId); +extern i32 TerminateProcess(void* hProcess, u32 uExitCode); + +// ======================== +// ====== !windows.h ====== +// ======================== + u8 expect_single_step = FALSE; extern DEBUG_EVENT dbg_event; @@ -11,14 +370,14 @@ extern u8* string_stack_current; const char* dummy_name = "Function_dummy_name"; -void read_name_uni(const void* name_addr, const char* name, size_t name_size) { +void read_name_uni(const void* name_addr, i8* name, size_t name_size) { u8* addr = NULL; if (!read_memory(name_addr, (void*)&addr, 8U)) { print("%s %u\n", "Loading DLL : error reading dll name : ", GetLastError()); return; } - wchar_t name_uni[256U] = { 0U }; + u16 name_uni[256U] = { 0U }; if (!read_memory((const void*)addr, name_uni, sizeof(name_uni))) { print("Cannot read dll name from proc memory %u\n", GetLastError()); return; @@ -29,7 +388,7 @@ void read_name_uni(const void* name_addr, const char* name, size_t name_size) { 0, name_uni, -1, - (char*)name, + name, (int)name_size, NULL, NULL @@ -220,7 +579,7 @@ void load_symbols(const void* base_addr, struct module* module) { u32 signature; u32 guid[4U]; u32 age; - char path; + i8 path; } header = { 0U }; if (!read_memory((const void*)((u64)base_addr + (u64)debug_entries[i].AddressOfRawData), (void*)&header, debug_entries[i].SizeOfData)) { print("Cannot read code view header for module %s at address %x\n", (char*)module->name, base_addr); @@ -353,8 +712,8 @@ void handle_create_process() { CREATE_PROCESS_DEBUG_INFO proc_dbg_info = dbg_event.u.CreateProcessInfo; - HANDLE hproc = OpenProcess(PROCESS_VM_READ, FALSE, dbg_event.dwProcessId); - hproc; + void* hproc = OpenProcess(PROCESS_VM_READ, FALSE, dbg_event.dwProcessId); + (void)hproc; struct module* module = &modules[add_module()]; // https://learn.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-create_process_debug_info @@ -363,7 +722,7 @@ void handle_create_process() { // module->base_addr = proc_dbg_info.lpBaseOfImage; // read_name_uni(proc_dbg_info.lpImageName, (const char*)module->name, sizeof(module->name)); module->base_addr = proc_dbg_info.lpBaseOfImage; - GetFinalPathNameByHandleA(proc_dbg_info.hFile, (LPSTR)module->name, sizeof(module->name), FILE_NAME_NORMALIZED); + GetFinalPathNameByHandleA(proc_dbg_info.hFile, module->name, sizeof(module->name), FILE_NAME_NORMALIZED); print("%s%s\n", "Loading Process : ", (char*)module->name); load_symbols((const void*)proc_dbg_info.lpBaseOfImage, module); @@ -374,7 +733,7 @@ void handle_create_thread() { } void handle_exception() { - extern DWORD continue_status; + extern u32 continue_status; print("%s : ", "ExceptionDebugEvent"); @@ -410,7 +769,7 @@ void handle_load_dll() { struct module* module = &modules[add_module()]; module->base_addr = dll_base_addr; - read_name_uni(dll_name_addr, (const char*)module->name, sizeof(module->name)); + read_name_uni(dll_name_addr, module->name, sizeof(module->name)); print("%s%s\n", "Loading DLL : ", (char*)module->name); @@ -426,19 +785,19 @@ void handle_output_debug_string() { char* str_addr = dbg_str_event.lpDebugStringData; size_t str_size = (size_t)dbg_str_event.nDebugStringLength; // assert(str_size > 1024U); - u8 dbg_str[1024U] = { 0U }; + u16 dbg_str[1024U] = { 0U }; if (!read_memory(str_addr, dbg_str, str_size)) { print("%s %u\n", "OutputDebugStringDebugEvent : error reading debug string : ", GetLastError()); return; } if (dbg_str_event.fUnicode) { - u8 ansi_str[1024U] = { 0U }; + i8 ansi_str[1024U] = { 0U }; WideCharToMultiByte( CP_ACP, 0, - (wchar_t*)dbg_str, + dbg_str, -1, - (char*)ansi_str, + ansi_str, sizeof(ansi_str), NULL, NULL |