yardenshafir-WinDbg_Scripts/filterCommPorts.js

"use strict";

function initializeScript()
{
    return [new host.functionAlias(GetHandlesToDevice, "DeviceFileHandles"),
			new host.functionAlias(GetQueuedIrpsForPort, "IrpsForPort"),
			new host.functionAlias(RegisteredFilterDrivers, "RegisteredFilters"),
			new host.functionAlias(EnumCommPortListForFilter, "EnumCommPortListForFilter"),
	        new host.functionAlias(EnumServerPortsForFilter, "EnumServerPortsForFilter"),
			new host.functionAlias(AllServerPorts, "AllServerPorts"),
			new host.apiVersionSupport(1, 6)];
}

function GetHandlesToDevice(Device)
{
    // Get easy access to the debug output method
    let dbgOutput = host.diagnostics.debugLog;

    // Loop over each process
    let processes = host.currentSession.Processes;
	let objHeaderType = host.getModuleType("nt", "_OBJECT_HEADER");
	let objHeaderOffset = objHeaderType.fields.Body.offset;
 
    for (let process of processes)
    { 
        let handles = process.Io.Handles;
 
        try {
 
            for (let handle of handles) {
 
                try {
 
                    let fileObj = handle.Object.ObjectType;
                    if (fileObj === "File") {
						if (host.parseInt64(handle.Object.UnderlyingObject.DeviceObject.address, 16).compareTo(Device) == 0)
                        {
							let fscontext2 = handle.Object.UnderlyingObject.FsContext2.address;
							let fltCcbType = host.getModuleType("FltMgr", "_FLT_CCB");
							let port = host.createTypedObject(fscontext2, fltCcbType).Data.Port.Port;
							let portObjHeader = host.createTypedObject(port.ServerPort.address.subtract(objHeaderOffset), objHeaderType);
							dbgOutput("\tProcess ", process.Name, " has handle ", handle.Handle, " to port ", portObjHeader.ObjectName, "\n");
							
                        }
                    }
                   
                } catch (e) {
 
                    dbgOutput("\tException parsing handle ", handle.Handle, "in process ", process.Name, "!\n");
 
                }
 
            }
 
        } catch (e) {
 
           // dbgOutput("\tException parsing handle table for process ", process.Name, " PID ", process.Id, "!\n");
 
        }
 
    }

}

function GetQueuedIrpsForPort(Port)
{
	let dbgOutput = host.diagnostics.debugLog;
	let v_port = host.createTypedObject(Port.address, host.getModuleType("FltMgr", "_FLT_PORT_OBJECT"));
	dbgOutput("Port: ", v_port.address, "\n");
	let waiterlist = host.namespace.Debugger.Utility.Collections.FromListEntry(v_port.MsgQ.WaiterQ.mList, "nt!_IRP", "Tail.Overlay.ListEntry");
	
	for (let entry of waiterlist) {
		dbgOutput("\tIRP address: ", entry.address, " by thread ", entry.CurrentThread.Cid.UniqueThread.address,"\n");
	}
}

function RegisteredFilterDrivers()
{
	let dbgOutput = host.diagnostics.debugLog;
	let fltglobals = host.getModuleSymbolAddress("fltmgr", "FltGlobals");
	let typedFltGlobals = host.createTypedObject(fltglobals, "fltmgr", "_GLOBALS");
	
	dbgOutput("Flt Globals: ", typedFltGlobals.address, "\n");
	
	let flt_frames = host.namespace.Debugger.Utility.Collections.FromListEntry(typedFltGlobals.FrameList.rList, "fltmgr!_FLTP_FRAME", "Links");
	
	for (let flt_frame of flt_frames) {
		dbgOutput("Frame ", flt_frame.FrameID, "\n");
		
		let filters = host.namespace.Debugger.Utility.Collections.FromListEntry(flt_frame.RegisteredFilters.rList, "fltmgr!_FLT_FILTER", "Base.PrimaryLink");
		
		for (let filter of filters) {
			dbgOutput("\tFilter ", filter.Name, " : ", filter.address, "\n");
			
			let instances = host.namespace.Debugger.Utility.Collections.FromListEntry(filter.InstanceList.rList, "fltmgr!_FLT_INSTANCE", "FilterLink");
			for (let instance of instances) {
				dbgOutput("\t\tInstance: ", instance.address, ", Name: ", instance.Name, ", Altitude: ", instance.Altitude, "\n");
			}

		}
	}
}

function EnumCommPortListForFilter(Filter)
{
	let dbgOutput = host.diagnostics.debugLog;
	let v_filter = host.createTypedObject(Filter, host.getModuleType("FltMgr", "_FLT_FILTER"));
	dbgOutput("Filter: ", v_filter.address, "\n");

	if (v_filter.PortList.mCount != 0) {
		let ports = host.namespace.Debugger.Utility.Collections.FromListEntry(v_filter.PortList.mList, "fltmgr!_FLT_PORT_OBJECT", "FilterLink");

		for (let port of ports) {
			if (port != 0) {
				dbgOutput("Port: ", port.address, "\n");
				dbgOutput("\tServerPort: ", port.ServerPort.address, "\n");
				dbgOutput("\t\tConnectNotify: ", port.ServerPort.ConnectNotify.address, "\n");
				dbgOutput("\t\tDisconnectNotify: ", port.ServerPort.DisconnectNotify.address, "\n");
				dbgOutput("\t\tMessageNotify: ", port.ServerPort.MessageNotify.address, "\n");
				dbgOutput("\t\tNumberOfConnections: ", port.ServerPort.NumberOfConnections, "\n");
				dbgOutput("\t\tMaxConnections: ", port.ServerPort.MaxConnections, "\n");
				dbgOutput("\tMsgQ: ", port.MsgQ.address, "\n");
				dbgOutput("\tDisconnected: ", port.Disconnected, "\n");
			}
		}
	}	
}

function EnumServerPortsForFilter(Filter)
{
	let dbgOutput = host.diagnostics.debugLog;
	let v_filter = host.createTypedObject(Filter, host.getModuleType("FltMgr", "_FLT_FILTER"));

	if (v_filter.ConnectionList.mCount != 0)
	{
		let ports = host.namespace.Debugger.Utility.Collections.FromListEntry(v_filter.ConnectionList.mList, "fltmgr!_FLT_SERVER_PORT_OBJECT", "FilterLink");

		for (let port of ports) {
			let objectHeaderAddress = host.parseInt64(port.address, 16).subtract(0x30);
			let objectHeader = host.createTypedObject(objectHeaderAddress, host.getModuleType("nt", "_OBJECT_HEADER"));
			
			dbgOutput("\tServerPort ", objectHeader.ObjectName, ": ", port.address, "\n");
			dbgOutput("\t\tConnectNotify: ", port.ConnectNotify.address, "\n");
			dbgOutput("\t\tDisconnectNotify: ", port.DisconnectNotify.address, "\n");
			dbgOutput("\t\tMessageNotify: ", port.MessageNotify.address, "\n");
			dbgOutput("\t\tNumberOfConnections: ", port.NumberOfConnections, "\n");
			dbgOutput("\t\tMaxConnections: ", port.MaxConnections, "\n");
		}
	}
}

function AllServerPorts()
{
	let dbgOutput = host.diagnostics.debugLog;
	let fltglobals = host.getModuleSymbolAddress("fltmgr", "FltGlobals");
	let typedFltGlobals = host.createTypedObject(fltglobals, "fltmgr", "_GLOBALS");
	let flt_frames = host.namespace.Debugger.Utility.Collections.FromListEntry(typedFltGlobals.FrameList.rList, "fltmgr!_FLTP_FRAME", "Links");
	
	for (let flt_frame of flt_frames) {
		dbgOutput("Frame ", flt_frame.FrameID, "\n");
		
		let filters = host.namespace.Debugger.Utility.Collections.FromListEntry(flt_frame.RegisteredFilters.rList, "fltmgr!_FLT_FILTER", "Base.PrimaryLink");
		
		for (let filter of filters) {
			dbgOutput("Filter ", filter.Name, " : ", filter.address, "\n");
			EnumServerPortsForFilter(filter.address);
			dbgOutput("\n");
		}
	}
}