Page MenuHomePhabricator

Get register context for the 32-bit process in a WoW64 process minidump.
ClosedPublic

Authored by amccarth on Feb 19 2016, 3:49 PM.

Details

Summary

32-bit processes on 64-bit Windows run in a layer called WoW64 (Windows-on-Windows64). If you capture a mini dump of such a process from a 32-bit debugger, you end up with a register context for the 64-bit WoW64 process rather than the 32-bit one you probably care about.

This detects WoW64 by looking to see if there's a module named wow64.dll loaded. For such processes, it then looks in the 64-bit Thread Environment Block (TEB) to locate a copy of the 32-bit CONTEXT record that the plugin needs for the register context.

I'll add a test before submitting this, but it seems to work in my manual experiments.

Diff Detail

Event Timeline

amccarth updated this revision to Diff 48552.Feb 19 2016, 3:49 PM
amccarth retitled this revision from to Get register context for the 32-bit process in a WoW64 process minidump..
amccarth updated this object.
amccarth added a reviewer: zturner.
amccarth added a subscriber: lldb-commits.
zturner edited edge metadata.Feb 19 2016, 3:53 PM

I'll have to look at this more carefully next week. I'm guessing the same logic can eventually be re-used to live debug a 32-bit process from a 64-bit LLDB? (Not that you have to address that now, just curious)

zturner added inline comments.Feb 19 2016, 4:11 PM
source/Plugins/Process/Windows/MiniDump/ProcessWinMiniDump.cpp
192

I think this structure should go in a different header file in Process/Windows/Common. Maybe it could be called NtStructures.h or something like that.

236–237

Are the other fields of this structure known what they mean?

amccarth marked an inline comment as done.Feb 22 2016, 11:10 AM

I'll have to look at this more carefully next week.

Take your time, I'm still working on adding some tests for this.

I'm guessing the same logic can eventually be re-used to live debug a 32-bit process from a 64-bit LLDB? (Not that you have to address that now, just curious)

I think most of this patch is specific to minidump debugging. With a live process, you can get the 32-bit context through API calls like Wow64GetThreadContext function, which hopefully is less prone to breakage in future versions of Windows. That does mean, however, that we'll have to treat 32-bit on Wow64 as a distinct case from 32-bit on 32-bit and 64-bit on 64-bit.

source/Plugins/Process/Windows/MiniDump/ProcessWinMiniDump.cpp
236–237

Nope.

The fact that TLS slot 1 points to a structure that contains the context is documented (with the caveat that it may change in future versions of Windows) here: https://msdn.microsoft.com/en-us/library/ms681670.aspx

But there's not much other information.

I've updated the comment with that MSDN link.

amccarth updated this revision to Diff 48712.Feb 22 2016, 11:13 AM
amccarth edited edge metadata.

Addressed first round of comments.

amccarth updated this revision to Diff 48863.Feb 23 2016, 5:10 PM

Adds some very basic tests using a check-in minidump captured with Task Manager.

What we can do in the test is limited because the minidump doesn't seem to have an exception record (thus the thread isn't stopped). I plan to look into this in the future. There's a chance we can get this information from the thread environment block (TEB).

zturner accepted this revision.Feb 24 2016, 2:13 PM
zturner edited edge metadata.
zturner added inline comments.
source/Plugins/Process/Windows/Common/NtStructures.h
18 ↗(On Diff #48863)

Just as a general tip for future reference, you can get better definitions of these structures in WinDbg. In this case, for example, dt ntdll!_TEB64 gives a fairly comprehensive definition of _TEB64. The offset of TlsSlots matches up with what you have here too, which at least shows it's correct.

source/Plugins/Process/Windows/MiniDump/ProcessWinMiniDump.cpp
255–257

Interesting, according to WinDbg's definition of _TEB64, the TEB has this field:

+0x180c WowTebOffset     : Int4B

Not sure what the difference is between this and wow64teb.Reserved1[0] (if there is one at all), but maybe we'll need this in the future (or maybe it's not what it sounds like)

This revision is now accepted and ready to land.Feb 24 2016, 2:13 PM
amccarth added inline comments.Feb 24 2016, 2:22 PM
source/Plugins/Process/Windows/MiniDump/ProcessWinMiniDump.cpp
255–257

Yeah, I spotted that, too. The comment is based on documentation in MSDN.

This revision was automatically updated to reflect the committed changes.