1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
|
/// Full Windows crash context
pub struct CrashContext {
/// The information on the exception.
///
/// Note that this is a pointer into the actual memory of the crashed process,
/// and is a pointer to an [EXCEPTION_POINTERS](https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-exception_pointers)
pub exception_pointers: *const EXCEPTION_POINTERS,
/// The top level exception code from the exception_pointers. This is provided
/// so that external processes don't need to use `ReadProcessMemory` to inspect
/// the exception code
pub exception_code: i32,
/// The pid of the process that crashed
pub process_id: u32,
/// The thread id on which the exception occurred
pub thread_id: u32,
}
#[link(name = "kernel32")]
extern "system" {
#[link_name = "RtlCaptureContext"]
pub fn capture_context(ctx_rec: *mut CONTEXT);
}
cfg_if::cfg_if! {
if #[cfg(target_arch = "x86_64")] {
#[repr(C, align(16))]
pub struct M128A {
pub Low: u64,
pub High: i64,
}
#[repr(C)]
pub struct CONTEXT_0_0 {
pub Header: [M128A; 2],
pub Legacy: [M128A; 8],
pub Xmm0: M128A,
pub Xmm1: M128A,
pub Xmm2: M128A,
pub Xmm3: M128A,
pub Xmm4: M128A,
pub Xmm5: M128A,
pub Xmm6: M128A,
pub Xmm7: M128A,
pub Xmm8: M128A,
pub Xmm9: M128A,
pub Xmm10: M128A,
pub Xmm11: M128A,
pub Xmm12: M128A,
pub Xmm13: M128A,
pub Xmm14: M128A,
pub Xmm15: M128A,
}
#[repr(C, align(16))]
pub struct XSAVE_FORMAT {
pub ControlWord: u16,
pub StatusWord: u16,
pub TagWord: u8,
pub Reserved1: u8,
pub ErrorOpcode: u16,
pub ErrorOffset: u32,
pub ErrorSelector: u16,
pub Reserved2: u16,
pub DataOffset: u32,
pub DataSelector: u16,
pub Reserved3: u16,
pub MxCsr: u32,
pub MxCsr_Mask: u32,
pub FloatRegisters: [M128A; 8],
pub XmmRegisters: [M128A; 16],
pub Reserved4: [u8; 96],
}
#[repr(C)]
pub union CONTEXT_0 {
pub FltSave: std::mem::ManuallyDrop<XSAVE_FORMAT>,
pub Anonymous: std::mem::ManuallyDrop<CONTEXT_0_0>,
}
#[repr(C, align(16))]
pub struct CONTEXT {
pub P1Home: u64,
pub P2Home: u64,
pub P3Home: u64,
pub P4Home: u64,
pub P5Home: u64,
pub P6Home: u64,
pub ContextFlags: u32,
pub MxCsr: u32,
pub SegCs: u16,
pub SegDs: u16,
pub SegEs: u16,
pub SegFs: u16,
pub SegGs: u16,
pub SegSs: u16,
pub EFlags: u32,
pub Dr0: u64,
pub Dr1: u64,
pub Dr2: u64,
pub Dr3: u64,
pub Dr6: u64,
pub Dr7: u64,
pub Rax: u64,
pub Rcx: u64,
pub Rdx: u64,
pub Rbx: u64,
pub Rsp: u64,
pub Rbp: u64,
pub Rsi: u64,
pub Rdi: u64,
pub R8: u64,
pub R9: u64,
pub R10: u64,
pub R11: u64,
pub R12: u64,
pub R13: u64,
pub R14: u64,
pub R15: u64,
pub Rip: u64,
pub Anonymous: CONTEXT_0,
pub VectorRegister: [M128A; 26],
pub VectorControl: u64,
pub DebugControl: u64,
pub LastBranchToRip: u64,
pub LastBranchFromRip: u64,
pub LastExceptionToRip: u64,
pub LastExceptionFromRip: u64,
}
} else if #[cfg(target_arch = "x86")] {
#[repr(C)]
pub struct FLOATING_SAVE_AREA {
pub ControlWord: u32,
pub StatusWord: u32,
pub TagWord: u32,
pub ErrorOffset: u32,
pub ErrorSelector: u32,
pub DataOffset: u32,
pub DataSelector: u32,
pub RegisterArea: [u8; 80],
pub Spare0: u32,
}
#[repr(C, packed(4))]
pub struct CONTEXT {
pub ContextFlags: u32,
pub Dr0: u32,
pub Dr1: u32,
pub Dr2: u32,
pub Dr3: u32,
pub Dr6: u32,
pub Dr7: u32,
pub FloatSave: FLOATING_SAVE_AREA,
pub SegGs: u32,
pub SegFs: u32,
pub SegEs: u32,
pub SegDs: u32,
pub Edi: u32,
pub Esi: u32,
pub Ebx: u32,
pub Edx: u32,
pub Ecx: u32,
pub Eax: u32,
pub Ebp: u32,
pub Eip: u32,
pub SegCs: u32,
pub EFlags: u32,
pub Esp: u32,
pub SegSs: u32,
pub ExtendedRegisters: [u8; 512],
}
} else if #[cfg(target_arch = "aarch64")] {
#[repr(C)]
pub struct ARM64_NT_NEON128_0 {
pub Low: u64,
pub High: i64,
}
#[repr(C)]
pub union ARM64_NT_NEON128 {
pub Anonymous: std::mem::ManuallyDrop<ARM64_NT_NEON128_0>,
pub D: [f64; 2],
pub S: [f32; 4],
pub H: [u16; 8],
pub B: [u8; 16],
}
#[repr(C)]
pub struct CONTEXT_0_0 {
pub X0: u64,
pub X1: u64,
pub X2: u64,
pub X3: u64,
pub X4: u64,
pub X5: u64,
pub X6: u64,
pub X7: u64,
pub X8: u64,
pub X9: u64,
pub X10: u64,
pub X11: u64,
pub X12: u64,
pub X13: u64,
pub X14: u64,
pub X15: u64,
pub X16: u64,
pub X17: u64,
pub X18: u64,
pub X19: u64,
pub X20: u64,
pub X21: u64,
pub X22: u64,
pub X23: u64,
pub X24: u64,
pub X25: u64,
pub X26: u64,
pub X27: u64,
pub X28: u64,
pub Fp: u64,
pub Lr: u64,
}
#[repr(C)]
pub union CONTEXT_0 {
pub Anonymous: std::mem::ManuallyDrop<CONTEXT_0_0>,
pub X: [u64; 31],
}
#[repr(C, align(16))]
pub struct CONTEXT {
pub ContextFlags: u32,
pub Cpsr: u32,
pub Anonymous: CONTEXT_0,
pub Sp: u64,
pub Pc: u64,
pub V: [ARM64_NT_NEON128; 32],
pub Fpcr: u32,
pub Fpsr: u32,
pub Bcr: [u32; 8],
pub Bvr: [u64; 8],
pub Wcr: [u32; 2],
pub Wvr: [u64; 2],
}
}
}
pub type NTSTATUS = i32;
pub type BOOL = i32;
#[repr(C)]
pub struct EXCEPTION_RECORD {
pub ExceptionCode: NTSTATUS,
pub ExceptionFlags: u32,
pub ExceptionRecord: *mut EXCEPTION_RECORD,
pub ExceptionAddress: *mut std::ffi::c_void,
pub NumberParameters: u32,
pub ExceptionInformation: [usize; 15],
}
#[repr(C)]
pub struct EXCEPTION_POINTERS {
pub ExceptionRecord: *mut EXCEPTION_RECORD,
pub ContextRecord: *mut CONTEXT,
}
|
