From 8264898cc0005fef28f669a70028c4eab545a45d Mon Sep 17 00:00:00 2001 From: quelle-est-ton-IRP-preferee Date: Thu, 13 Jul 2017 23:33:36 +0200 Subject: [PATCH 1/6] Add support for Windows 16232 --- RpcCore/RpcCore4_32bits/RpcInternals.h | 7 +++++-- RpcCore/RpcCore4_64bits/RpcInternals.h | 5 +++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/RpcCore/RpcCore4_32bits/RpcInternals.h b/RpcCore/RpcCore4_32bits/RpcInternals.h index 8072475..2853402 100644 --- a/RpcCore/RpcCore4_32bits/RpcInternals.h +++ b/RpcCore/RpcCore4_32bits/RpcInternals.h @@ -18,8 +18,11 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0xA0000295A0132LL, //10.0.10586.306 0xA0000380603E8LL, //10.0.14342.1000 0xA000038190000LL, //10.0.14361.0 - 0xA000038390000LL, //10.0.14393.0 - 0xA000038390052LL //10.0.14393.82 + 0xA000038390000LL, //10.0.14393.0 + 0xA000038390052LL, //10.0.14393.82 + 0xA00003AD70000LL, //10.0.15063.0 + 0xA00003AD701BFLL, //10.0.15063.447 + 0xA00003F6803E8LL, //10.0.16232.1000 }; #ifdef _WIN64 diff --git a/RpcCore/RpcCore4_64bits/RpcInternals.h b/RpcCore/RpcCore4_64bits/RpcInternals.h index 8ef6ae9..64e46e8 100644 --- a/RpcCore/RpcCore4_64bits/RpcInternals.h +++ b/RpcCore/RpcCore4_64bits/RpcInternals.h @@ -17,8 +17,9 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0xA0000295A0132LL, //10.0.10586.306 0xA0000380603E8LL, //10.0.14342.1000 0xA000038190000LL, //10.0.14361.0 - 0xA000038390000LL, //10.0.14393.0 - 0xA000038390052LL //10.0.14393.82 + 0xA000038390000LL, //10.0.14393.0 + 0xA00003AD70000LL, //10.0.15063.0 + 0xA00003F6803E8LL, //10.0.16232.1000 }; #define RPC_CORE_DESCRIPTION "Windows 10 64bits runtime core" From f5a32da2116d1e6e5b52426feecd2a3f3765f291 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Sun, 29 Oct 2017 14:40:28 +0000 Subject: [PATCH 2/6] Limit the MAX_SIMPLE_DICT_ENTRIES 0x200 to avoid dead lock when searching for the RpcServer (heuristic approach) --- RpcCore/RpcCore.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/RpcCore/RpcCore.c b/RpcCore/RpcCore.c index 9c093b2..d9165d9 100644 --- a/RpcCore/RpcCore.c +++ b/RpcCore/RpcCore.c @@ -19,7 +19,7 @@ #pragma comment(lib,"Version.lib") #pragma comment(lib,"Userenv.lib") -#define MAX_SIMPLE_DICT_ENTRIES 0x400 +#define MAX_SIMPLE_DICT_ENTRIES 0x200 #define RPC_MAX_ENDPOINT_PROTOCOL_SIZE 0x100 #define RPC_MAX_ENDPOINT_NAME_SIZE 0x100 #define RPC_MAX_DLL_NAME_SIZE 0x100 @@ -191,7 +191,7 @@ BOOL WINAPI GetRpcServerAddressCallback(HANDLE hProcess, UINT Index, VOID PTR_T UNREFERENCED_PARAMETER(Index); if (!ReadProcessMemory(hProcess,pSimpleDictEntry,&RpcInterface,sizeof(RpcInterface),NULL)) goto End; - + if ( (RpcInterface.RpcServerInterface.Length==sizeof(RPC_SERVER_INTERFACE_T)) && (!memcmp(&RpcInterface.RpcServerInterface.TransferSyntax, &DceRpcSyntaxUuid, sizeof(DceRpcSyntaxUuid)))) { From de6aef20cad9014c62694930d4ae94b359d22a00 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Sun, 29 Oct 2017 14:43:16 +0000 Subject: [PATCH 3/6] Remove the symbol path parameter when the input text is empty --- RpcView/MainWindow.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RpcView/MainWindow.cpp b/RpcView/MainWindow.cpp index 52e00ce..131af0f 100644 --- a/RpcView/MainWindow.cpp +++ b/RpcView/MainWindow.cpp @@ -444,7 +444,7 @@ void MainWindow_C::ConfigureSymbols() CurrentSymbolsPath, &bOk ); - if ( bOk && !NewSymbolsPath.isEmpty() ) + if ( bOk ) { pSettings->setValue("SymbolsPath",NewSymbolsPath); SetEnvironmentVariableA("RpcViewSymbolPath",NewSymbolsPath.toAscii()); From 8b0c7d67252166dbb31e01685ae9a76d356d7970 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Sun, 29 Oct 2017 14:45:26 +0000 Subject: [PATCH 4/6] Add support for the _NT_SYMBOL_PATH environment variable --- RpcView/Pdb.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/RpcView/Pdb.c b/RpcView/Pdb.c index ca54615..bf240b1 100644 --- a/RpcView/Pdb.c +++ b/RpcView/Pdb.c @@ -1,3 +1,4 @@ +#define _CRT_SECURE_NO_WARNINGS #include "Pdb.h" #include #include @@ -80,8 +81,9 @@ End: BOOL WINAPI GetPdbFilePath(HANDLE hProcess, VOID* pModuleBase, UCHAR* pPdbPath, UINT PdbPathSize) { CV_INFO_PDB70 Pdb70Info; - CHAR SymbolPath[MAX_PATH]; - BOOL bResult = FALSE; + CHAR SymbolPath[MAX_PATH] = { 0 }; + CHAR NtSymbolPath[MAX_PATH] = { 0 }; + BOOL bResult = FALSE; if (!GetModulePdbInfo(hProcess, pModuleBase, &Pdb70Info)) goto End; /* @@ -97,7 +99,18 @@ BOOL WINAPI GetPdbFilePath(HANDLE hProcess, VOID* pModuleBase, UCHAR* pPdbPath, } else { - if (GetEnvironmentVariableA("RpcViewSymbolPath", SymbolPath, sizeof(SymbolPath)) == 0) goto End; + int iResult; + char* pStar = NULL; + + if (GetEnvironmentVariableA("RpcViewSymbolPath", NtSymbolPath, sizeof(NtSymbolPath)) == 0) + { + if (GetEnvironmentVariableA("_NT_SYMBOL_PATH", NtSymbolPath, sizeof(NtSymbolPath)) == 0) goto End; + } + iResult = sscanf(NtSymbolPath, "srv*%259s", SymbolPath); + if (iResult == 0) goto End; + pStar = strchr(SymbolPath+4, '*'); + if (pStar != NULL) *pStar = 0; + StringCbPrintfA((STRSAFE_LPSTR)pPdbPath, PdbPathSize, "%s\\%s\\%08X%04X%04X%02X%02X%02X%02X%02X%02X%02X%02X%X\\%s", SymbolPath, Pdb70Info.PdbFileName, @@ -116,7 +129,6 @@ BOOL WINAPI GetPdbFilePath(HANDLE hProcess, VOID* pModuleBase, UCHAR* pPdbPath, Pdb70Info.PdbFileName ); } - //printf("pdb path: %s\n",pPdbPath); bResult = TRUE; End: return (bResult); From fc685d4fbc816469ccfa7720bfc2d18c78566aa5 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Sun, 29 Oct 2017 14:48:33 +0000 Subject: [PATCH 5/6] Add support for windows 10 redstone 2 and 3 --- RpcCore/RpcCore4_32bits/RpcInternals.h | 2 ++ RpcCore/RpcCore4_64bits/RpcInternals.h | 3 +++ 2 files changed, 5 insertions(+) diff --git a/RpcCore/RpcCore4_32bits/RpcInternals.h b/RpcCore/RpcCore4_32bits/RpcInternals.h index 2853402..7b33f85 100644 --- a/RpcCore/RpcCore4_32bits/RpcInternals.h +++ b/RpcCore/RpcCore4_32bits/RpcInternals.h @@ -22,7 +22,9 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0xA000038390052LL, //10.0.14393.82 0xA00003AD70000LL, //10.0.15063.0 0xA00003AD701BFLL, //10.0.15063.447 + 0xA00003AD702A2LL, //10.0.15063.674 0xA00003F6803E8LL, //10.0.16232.1000 + 0xA00003FAB000FLL, //10.0.16299.15 }; #ifdef _WIN64 diff --git a/RpcCore/RpcCore4_64bits/RpcInternals.h b/RpcCore/RpcCore4_64bits/RpcInternals.h index 64e46e8..ce5e200 100644 --- a/RpcCore/RpcCore4_64bits/RpcInternals.h +++ b/RpcCore/RpcCore4_64bits/RpcInternals.h @@ -19,7 +19,10 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = { 0xA000038190000LL, //10.0.14361.0 0xA000038390000LL, //10.0.14393.0 0xA00003AD70000LL, //10.0.15063.0 + 0xA00003AD701BFLL, //10.0.15063.447 + 0xA00003AD702A2LL, //10.0.15063.674 0xA00003F6803E8LL, //10.0.16232.1000 + 0xA00003FAB000FLL, //10.0.16299.15 }; #define RPC_CORE_DESCRIPTION "Windows 10 64bits runtime core" From 9e37a628958be64e26fed838cf0af3385fec3133 Mon Sep 17 00:00:00 2001 From: silverf0x Date: Sun, 29 Oct 2017 15:50:08 +0000 Subject: [PATCH 6/6] Update CMakeLists.txt to version 0.2.1 --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index ec8def8..a0af226 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -4,7 +4,7 @@ project(RpcView) set(RPCVIEW_VERSION_MAJOR 0) set(RPCVIEW_VERSION_MINOR 2) -set(RPCVIEW_VERSION_RELEASE 0) +set(RPCVIEW_VERSION_RELEASE 1) # configure a header file to pass some of the CMake settings to the source code configure_file (