Skip to content

Commit ec192e9

Browse files
author
0vercl0k
committed
Add README and remove a double-space.
1 parent f177341 commit ec192e9

File tree

2 files changed

+84
-1
lines changed

2 files changed

+84
-1
lines changed

‎parse_eh_win64/README.md

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# parse_eh_win64.js
2+
3+
`parse_eh_win64.js` is a [JavaScript](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/javascript-debugger-scripting) debugger extension for WinDbg that shows examples of how to extending the data-model with exception-handling related information for 64 bits executables.
4+
5+
More background is available in this article: [Debugger data model, Javascript & x64 exception handling](https://doar-e.github.io/blog/2017/12/01/debugger-data-model/).
6+
7+
## Usage
8+
9+
Run `.scriptload parse_eh_win64.js` to load the script. The script extends the `Debugger.Models.Process`, `Debugger.Models.Module` models and also exposes the `!ehhandlers` command.
10+
11+
## Examples
12+
13+
* At the process level, dumping `Function` objects and ordering them by the number of exception-handlers they define:
14+
15+
```text
16+
0:002> dx @$curprocess.Functions.OrderByDescending(p => p.ExceptionHandlers.Count())
17+
@$curprocess.Functions.OrderByDescending(p => p.ExceptionHandlers.Count())
18+
[0x0] : RVA:7fffb64bebf0 -> RVA:7fffb64bf022, 12 exception handlers
19+
[0x1] : RVA:7fffb8bdff80 -> RVA:7fffb8be0b67, 11 exception handlers
20+
[0x2] : RVA:7fffb1df8114 -> RVA:7fffb1df8360, 9 exception handlers
21+
[0x3] : RVA:7fffa0111354 -> RVA:7fffa01115a0, 9 exception handlers
22+
[0x4] : RVA:7fffb2183044 -> RVA:7fffb2183290, 9 exception handlers
23+
[0x5] : RVA:7fffa0d41344 -> RVA:7fffa0d41590, 9 exception handlers
24+
[0x6] : RVA:7fffb6573020 -> RVA:7fffb6573356, 6 exception handlers
25+
[0x7] : RVA:7fffb4c71f94 -> RVA:7fffb4c720b4, 6 exception handlers
26+
[0x8] : RVA:7fffb65e5774 -> RVA:7fffb65e5894, 6 exception handlers
27+
[0x9] : RVA:7fffb660c62c -> RVA:7fffb660cf2e, 6 exception handlers
28+
[0xa] : RVA:7fffb6c6f014 -> RVA:7fffb6c6f134, 6 exception handlers
29+
[0xb] : RVA:7fffb8b9a350 -> RVA:7fffb8b9b39b, 6 exception handlers
30+
[0xc] : RVA:7fffb35168a0 -> RVA:7fffb3516efb, 5 exception handlers
31+
```
32+
33+
* Dumping a `Function` object:
34+
35+
```text
36+
0:002> dx -r1 @$curprocess.Functions[0]
37+
@$curprocess.Functions[0] : RVA:7ff67025a6d0 -> RVA:7ff67025a738, 1 exception handlers
38+
EHHandlerRVA : 0x9b9700
39+
EHHandler : 0x7ff6708f9700
40+
BeginRVA : 0x31a6d0
41+
EndRVA : 0x31a738
42+
Begin : 0x7ff67025a6d0
43+
End : 0x7ff67025a738
44+
ExceptionHandlers : __try {7ff67025a6fb -> 7ff67025a712} __except(EXCEPTION_EXECUTE_HANDLER) {7ff67025a736}
45+
```
46+
47+
* At the module level, dumping `ExceptionHandler` objects:
48+
49+
```text
50+
0:002> dx @$curprocess.Modules[0].ExceptionHandlers
51+
@$curprocess.Modules[0].ExceptionHandlers : Exception handlers
52+
[0x0] : __try {7ff67025a6fb -> 7ff67025a712} __except(EXCEPTION_EXECUTE_HANDLER) {7ff67025a736}
53+
[0x1] : __try {7ff6708f80b3 -> 7ff6708f813e} __except(7ff6708f93f2()) {7ff6708f813e}
54+
[0x2] : __try {7ff6708f90fd -> 7ff6708f9202} __except(7ff6708f9425()) {7ff6708f9202}
55+
[0x3] : __try {7ff6708f9236 -> 7ff
56+
```
57+
58+
* Dumping an `ExceptionHandler` object:
59+
60+
```text
61+
0:002> dx @$curprocess.Modules[0].ExceptionHandlers[0]
62+
@$curprocess.Modules[0].ExceptionHandlers[0] : __try {7ff67025a6fb -> 7ff67025a712} __except(EXCEPTION_EXECUTE_HANDLER) {7ff67025a736}
63+
Begin : 0x7ff67025a6fb
64+
End : 0x7ff67025a712
65+
HandlerAddress : 0x1
66+
JumpTarget : 0x7ff67025a736
67+
IsTryFinally : false
68+
HasFilter : false
69+
```
70+
71+
* Dumping the current call-stack with EH information:
72+
73+
```text
74+
0:002> !ehhandlers
75+
5 stack frames, scanning for handlers...
76+
Frame 1: EHHandler: 7fffb8c1fc90: ntdll!_C_specific_handler:
77+
Except: 7fffb8c5ef1d: ntdll!DbgUiRemoteBreakin+0x4d:
78+
Frame 3: EHHandler: 7fffb8c1fc90: ntdll!_C_specific_handler:
79+
Except: 7fffb8bfa267: ntdll!RtlUserThreadStart+0x37:
80+
Filter: 7fffb8c38021: ntdll!RtlUserThreadStart$filt$0:
81+
@$ehhandlers()
82+
```
83+

‎telescope/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# telescope.js
22

3-
`telescope.js` is a [JavaScript](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/javascript-debugger-scripting) debugger extension for WinDbg that mirrors the `dereference`/`telescope` command from [GEF](https://github.com/hugsy/gef). It works on crash-dumps, live debugging, and TTD traces. Both for user and kernel-mode.
3+
`telescope.js` is a [JavaScript](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/javascript-debugger-scripting) debugger extension for WinDbg that mirrors the `dereference`/`telescope` command from [GEF](https://github.com/hugsy/gef). It works on crash-dumps, live debugging, and TTD traces. Both for user and kernel-mode.
44

55
Idea from [@\_\_awe](https://twitter.com/__awe).
66

0 commit comments

Comments
 (0)