admin/yardenshafir-WinDbg_Scripts
1
0
Fork 0
mirror of https://github.com/yardenshafir/WinDbg_Scripts synced 2026-06-08 18:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update filterCommPorts.js

Browse Source 
Add functions to enumerate all server ports for a single filter driver or for all filters.
This commit is contained in:
yardenshafir
2023-11-03 19:10:01 -04:00
committed by GitHub
parent 5c60588bb2
commit f22d9e85b4
1 changed files with 100 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
filterCommPorts.js
+100 -53
View File
@@ -3,10 +3,12 @@
function initializeScript()
{
return [new host.functionAlias(GetHandlesToDevice, "DeviceFileHandles"),
new host.functionAlias(GetQueuedIrpsForPort, "IrpsForPort"),
new host.functionAlias(RegisteredFilterDrivers, "RegisteredFilters"),
new host.functionAlias(EnumPortsForFilter, "EnumPortsForFilter"),
new host.apiVersionSupport(1, 6)];
new host.functionAlias(GetQueuedIrpsForPort, "IrpsForPort"),
new host.functionAlias(RegisteredFilterDrivers, "RegisteredFilters"),
new host.functionAlias(EnumCommPortListForFilter, "EnumCommPortListForFilter"),
new host.functionAlias(EnumServerPortsForFilter, "EnumServerPortsForFilter"),
new host.functionAlias(AllServerPorts, "AllServerPorts"),
new host.apiVersionSupport(1, 6)];
}
function GetHandlesToDevice(Device)
@@ -31,13 +33,13 @@ function GetHandlesToDevice(Device)
let fileObj = handle.Object.ObjectType;
if (fileObj === "File") {
if (host.parseInt64(handle.Object.UnderlyingObject.DeviceObject.address, 16).compareTo(Device) == 0)
if (host.parseInt64(handle.Object.UnderlyingObject.DeviceObject.address, 16).compareTo(Device) == 0)
{
let fscontext2 = handle.Object.UnderlyingObject.FsContext2.address;
let fltCcbType = host.getModuleType("FltMgr", "_FLT_CCB");
let port = host.createTypedObject(fscontext2, fltCcbType).Data.Port.Port;
let portObjHeader = host.createTypedObject(port.ServerPort.address.subtract(objHeaderOffset), objHeaderType);
dbgOutput("\tProcess ", process.Name, " has handle ", handle.Handle, " to port ", portObjHeader.ObjectName, "\n");
let fscontext2 = handle.Object.UnderlyingObject.FsContext2.address;
let fltCcbType = host.getModuleType("FltMgr", "_FLT_CCB");
let port = host.createTypedObject(fscontext2, fltCcbType).Data.Port.Port;
let portObjHeader = host.createTypedObject(port.ServerPort.address.subtract(objHeaderOffset), objHeaderType);
dbgOutput("\tProcess ", process.Name, " has handle ", handle.Handle, " to port ", portObjHeader.ObjectName, "\n");
}
}
@@ -68,56 +70,101 @@ function GetQueuedIrpsForPort(Port)
let waiterlist = host.namespace.Debugger.Utility.Collections.FromListEntry(v_port.MsgQ.WaiterQ.mList, "nt!_IRP", "Tail.Overlay.ListEntry");
for (let entry of waiterlist) {
dbgOutput("\tIRP address: ", entry.address, " by thread ", entry.CurrentThread.Cid.UniqueThread.address,"\n");
dbgOutput("\tIRP address: ", entry.address, " by thread ", entry.CurrentThread.Cid.UniqueThread.address,"\n");
}
}
function RegisteredFilterDrivers()
{
let dbgOutput = host.diagnostics.debugLog;
let fltglobals = host.getModuleSymbolAddress("fltmgr", "FltGlobals");
let typedFltGlobals = host.createTypedObject(fltglobals, "fltmgr", "_GLOBALS");
dbgOutput("Flt Globals: ", typedFltGlobals.address, "\n");
let flt_frames = host.namespace.Debugger.Utility.Collections.FromListEntry(typedFltGlobals.FrameList.rList, "fltmgr!_FLTP_FRAME", "Links");
for (let flt_frame of flt_frames) {
dbgOutput("Frame ", flt_frame.FrameID, "\n");
let filters = host.namespace.Debugger.Utility.Collections.FromListEntry(flt_frame.RegisteredFilters.rList, "fltmgr!_FLT_FILTER", "Base.PrimaryLink");
let dbgOutput = host.diagnostics.debugLog;
let fltglobals = host.getModuleSymbolAddress("fltmgr", "FltGlobals");
let typedFltGlobals = host.createTypedObject(fltglobals, "fltmgr", "_GLOBALS");
for (let filter of filters) {
dbgOutput("\tFilter ", filter.Name, " : ", filter.address, "\n");
dbgOutput("Flt Globals: ", typedFltGlobals.address, "\n");
let flt_frames = host.namespace.Debugger.Utility.Collections.FromListEntry(typedFltGlobals.FrameList.rList, "fltmgr!_FLTP_FRAME", "Links");
for (let flt_frame of flt_frames) {
dbgOutput("Frame ", flt_frame.FrameID, "\n");
let instances = host.namespace.Debugger.Utility.Collections.FromListEntry(filter.InstanceList.rList, "fltmgr!_FLT_INSTANCE", "FilterLink");
for (let instance of instances) {
dbgOutput("\t\tInstance: ", instance.address, ", Name: ", instance.Name, ", Altitude: ", instance.Altitude, "\n");
}
}
}
}
let filters = host.namespace.Debugger.Utility.Collections.FromListEntry(flt_frame.RegisteredFilters.rList, "fltmgr!_FLT_FILTER", "Base.PrimaryLink");
for (let filter of filters) {
dbgOutput("\tFilter ", filter.Name, " : ", filter.address, "\n");
let instances = host.namespace.Debugger.Utility.Collections.FromListEntry(filter.InstanceList.rList, "fltmgr!_FLT_INSTANCE", "FilterLink");
for (let instance of instances) {
dbgOutput("\t\tInstance: ", instance.address, ", Name: ", instance.Name, ", Altitude: ", instance.Altitude, "\n");
}
function EnumPortsForFilter(Filter)
{
let dbgOutput = host.diagnostics.debugLog;
let v_filter = host.createTypedObject(Filter, host.getModuleType("FltMgr", "_FLT_FILTER"));
dbgOutput("Filter: ", v_filter.address, "\n");
if (v_filter.PortList.mCount != 0) {
let ports = host.namespace.Debugger.Utility.Collections.FromListEntry(v_filter.PortList.mList, "fltmgr!_FLT_PORT_OBJECT", "FilterLink");
for (let port of ports) {
if (port != 0) {
dbgOutput("Port: ", port.address, "\n");
dbgOutput("\tServerPort: ", port.ServerPort.address, "\n");
dbgOutput("\t\tConnectNotify: ", port.ServerPort.ConnectNotify.address, "\n");
dbgOutput("\t\tDisconnectNotify: ", port.ServerPort.DisconnectNotify.address, "\n");
dbgOutput("\t\tMessageNotify: ", port.ServerPort.MessageNotify.address, "\n");
dbgOutput("\t\tNumberOfConnections: ", port.ServerPort.NumberOfConnections, "\n");
dbgOutput("\t\tMaxConnections: ", port.ServerPort.MaxConnections, "\n");
dbgOutput("\tMsgQ: ", port.MsgQ.address, "\n");
dbgOutput("\tDisconnected: ", port.Disconnected, "\n");
}
}
}
}
function EnumCommPortListForFilter(Filter)
{
let dbgOutput = host.diagnostics.debugLog;
let v_filter = host.createTypedObject(Filter, host.getModuleType("FltMgr", "_FLT_FILTER"));
dbgOutput("Filter: ", v_filter.address, "\n");
if (v_filter.PortList.mCount != 0) {
let ports = host.namespace.Debugger.Utility.Collections.FromListEntry(v_filter.PortList.mList, "fltmgr!_FLT_PORT_OBJECT", "FilterLink");
for (let port of ports) {
if (port != 0) {
dbgOutput("Port: ", port.address, "\n");
dbgOutput("\tServerPort: ", port.ServerPort.address, "\n");
dbgOutput("\t\tConnectNotify: ", port.ServerPort.ConnectNotify.address, "\n");
dbgOutput("\t\tDisconnectNotify: ", port.ServerPort.DisconnectNotify.address, "\n");
dbgOutput("\t\tMessageNotify: ", port.ServerPort.MessageNotify.address, "\n");
dbgOutput("\t\tNumberOfConnections: ", port.ServerPort.NumberOfConnections, "\n");
dbgOutput("\t\tMaxConnections: ", port.ServerPort.MaxConnections, "\n");
dbgOutput("\tMsgQ: ", port.MsgQ.address, "\n");
dbgOutput("\tDisconnected: ", port.Disconnected, "\n");
}
}
}
}
function EnumServerPortsForFilter(Filter)
{
let dbgOutput = host.diagnostics.debugLog;
let v_filter = host.createTypedObject(Filter, host.getModuleType("FltMgr", "_FLT_FILTER"));
if (v_filter.ConnectionList.mCount != 0)
{
let ports = host.namespace.Debugger.Utility.Collections.FromListEntry(v_filter.ConnectionList.mList, "fltmgr!_FLT_SERVER_PORT_OBJECT", "FilterLink");
for (let port of ports) {
let objectHeaderAddress = host.parseInt64(port.address, 16).subtract(0x30);
let objectHeader = host.createTypedObject(objectHeaderAddress, host.getModuleType("nt", "_OBJECT_HEADER"));
dbgOutput("\tServerPort ", objectHeader.ObjectName, ": ", port.address, "\n");
dbgOutput("\t\tConnectNotify: ", port.ConnectNotify.address, "\n");
dbgOutput("\t\tDisconnectNotify: ", port.DisconnectNotify.address, "\n");
dbgOutput("\t\tMessageNotify: ", port.MessageNotify.address, "\n");
dbgOutput("\t\tNumberOfConnections: ", port.NumberOfConnections, "\n");
dbgOutput("\t\tMaxConnections: ", port.MaxConnections, "\n");
}
}
}
function AllServerPorts()
{
let dbgOutput = host.diagnostics.debugLog;
let fltglobals = host.getModuleSymbolAddress("fltmgr", "FltGlobals");
let typedFltGlobals = host.createTypedObject(fltglobals, "fltmgr", "_GLOBALS");
let flt_frames = host.namespace.Debugger.Utility.Collections.FromListEntry(typedFltGlobals.FrameList.rList, "fltmgr!_FLTP_FRAME", "Links");
for (let flt_frame of flt_frames) {
dbgOutput("Frame ", flt_frame.FrameID, "\n");
let filters = host.namespace.Debugger.Utility.Collections.FromListEntry(flt_frame.RegisteredFilters.rList, "fltmgr!_FLT_FILTER", "Base.PrimaryLink");
for (let filter of filters) {
dbgOutput("Filter ", filter.Name, " : ", filter.address, "\n");
EnumServerPortsForFilter(filter.address);
dbgOutput("\n");
}
}
}
}