I'm trying to invoke win32 api with windbg,
> .call kernel32!ExitProcess(0)
^ Symbol not a function in '.call kernel32!ExitProcess(0)'
windbg should support this, any idea?
One reason might be that the debugger cannot find the method:
0:004> x kernel32!Exit*
00007ffc`12e9b0c0 KERNEL32!ExitVDM (<no parameter info>)
00007ffc`12e7d620 KERNEL32!ExitProcessImplementation (<no parameter info>)
You certainly don't have private symbols for kernel32!ExitProcess(). If you don't have the private symbols, then you need to have a function in your own code (for which you have private symbols) that you can pass as the prototype:
.call /s SameSignatureAsExitProcess kernel32!ExitProcess(0)
So what I would suggest is: get the LLD extension, compile yourself some methods like
Header file:
#pragma once
#include <Windows.h>
class Call
{
public:
static void v();
static void vi(int);
static void vui(unsigned int);
static void vl(long);
static void vul(unsigned long);
};
Cpp file:
#include "Call.h"
void Call::v(){}
void Call::vi(int) {}
void Call::vui(unsigned int) {}
void Call::vl(long) {}
void Call::vul(unsigned long) {}
and then use it
0:000> .load ...\lld
0:000> !injectdll ...\Calls\x64\Debug\Calls.dll
ModLoad: 00007ffc`11270000 00007ffc`1129e000 C:\Windows\System32\IMM32.DLL
ModLoad: 00007ffc`070a0000 00007ffc`070c5000 ...\Calls\x64\Debug\Calls.dll
ModLoad: 00007ffb`f9000000 00007ffb`f91c2000 C:\Windows\System32\ucrtbased.dll
ModLoad: 00007ffc`07070000 00007ffc`07092000 C:\Windows\System32\VCRUNTIME140D.dll
ModLoad: 00007ffc`0d800000 00007ffc`0d89c000 C:\Windows\system32\uxtheme.dll
ntdll!NtTerminateThread+0x14:
00007ffc`138f01c4 c3 ret
0:004> ld Calls
*** WARNING: Unable to verify checksum for ...\Calls\x64\Debug\Calls.dll
Symbols loaded for Calls
0:004> x Calls!Call::*
00007ffc`070b1710 Calls!Call::vui (unsigned int)
00007ffc`070b1760 Calls!Call::vul (unsigned long)
00007ffc`070b1670 Calls!Call::vi (int)
00007ffc`070b1620 Calls!Call::v (void)
00007ffc`070b16c0 Calls!Call::vl (long)
0:004> .call /s Calls!Call::v kernelbase!TerminateProcess()
Thread is set up for call, 'g' will execute.
WARNING: This can have serious side-effects,
including deadlocks and corruption of the debuggee.
While this looks much better (no error message), it still does not work - the process does not terminate. I currently can't figure out why. Maybe it's still helpful for someone.
What works for me is
static void t(); // .h
void Call::t() // .cpp
{
ExitProcess(0);
}
and then
0:007> .call Calls!Call::t()
Thread is set up for call, 'g' will execute.
WARNING: This can have serious side-effects,
including deadlocks and corruption of the debuggee.
0:007> p
Calls!Call::t+0x2a:
00007ffc`0709166a 33c9 xor ecx,ecx
0:007> p
ntdll!NtTerminateProcess+0x14:
00007ffc`138efce4 c3 ret
but that's not very convenient, if you don't know in advance what method you want to call.
Related
I have a c++ function in "example.h":
bool myFunc(double const* const* p);
and I want to wrap it with cython code (in .pyx file).
Howerver, when I'm write the following code:
cdef extern from r"example.h":
bool myFunc(double const*const* p)
I'm receiving the following error:
Error compiling Cython file:
Expected ')', found '*'
and pycharm shows this error on double const* const* p:
Unresolved reference 'const'
How can I declare that kind of variables?
In C/C++, there is ongoing battle where to put the const-qualifier: either
void foo(const int *a);
or
void foo(int const *a);
both meaning the same thing.
There is no such battle in Cython, because it accept only the first version.
The above rule, applied to double** leads to:
cdef extern from r"example.h":
bool myFunc(const double * const* p)
Or as a work-around one could drop the const-qualifier altogether:
cdef extern from r"example.h":
bool myFunc(const double **p)
which I would not recommend, all above in large projects, where using const-qualifiers helps a lot when figuring out what happens.
Reference class
class commandsListClass
{
public:
std::string name;
std::string description;
std::vector<std::string> commands;
columnHeaders headersRequired;
void (*function)(System::Object ^ );
std::string recoveryFileHeader;
void reset()
{
name = "";
description = "";
commands.clear();
headersRequired.reset();
recoveryFileHeader = "";
function = dummyFunc; // dummyFunc uses the same members as the intended - this is to ensure it is defined. DummyFunc is empty, returns void etc
}
commandsListClass()
{
reset();
}
};
Currently, if I run the below code, the compiler crashes
// This crashes the compiler
System::Threading::ThreadPool::QueueUserWorkItem(gcnew System::Threading::WaitCallback(global::commandsList[index].function ), ti);
1>------ Build started: Project: MyProject, Configuration: Release x64 ------
1> project.cpp
1>c:\users\guy\documents\visual studio 2012\projects\MyProject\MyProject\Form1.h(807): fatal error C1001: An internal error has occurred in the compiler.
1> (compiler file 'msc1.cpp', line 1443)
1> To work around this problem, try simplifying or changing the program near the locations listed above.
1> Please choose the Technical Support command on the Visual C++
1> Help menu, or open the Technical Support help file for more information
========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========
If I declare a member inside the same function as I am making the call, and set it to the global::commandsList[index].function, it compiles and runs correctly
// This runs correctly
void (*func)(System::Object ^);
func = global::commandsList[index].function;
System::Threading::ThreadPool::QueueUserWorkItem(gcnew System::Threading::WaitCallback(func ), ti);
global::commandsList is a vector of type commandsListClass
Any ideas? Browsing Google and SO suggest changing the compiler to not optimize, which I've tried with no success. The code is written in such a way that:
That point in the code cannot be reached if index does not point to a valid member of the global::commandsList vector
The function variable is guaranteed to be set, either to the dummyFunc on creation, or the correct (requested) function as set elsewhere in the code.
Any help would be greatly appreciated.
Edit 1: This is using Visual Studio 2012, Windows 7 x64
Here's a simplified repo:
public delegate void MyDel(Object^);
void g(Object^) {}
struct A {
static void(*fs)(Object^);
void(*f)(Object^);
gcroot<MyDel^> del;
};
void(*fg)(Object^);
void h()
{
void (*f)(Object^);
A a;
gcnew MyDel(f);
gcnew MyDel(fg);
gcnew MyDel(a.fs);
a.del = gcnew MyDel(g);
//gcnew MyDel(a.f); // this line fails
// work around
f = a.f;
gcnew MyDel(f);
}
Only the non-static member variable fails. Seems like a compiler bug. Work around it by using a local intermediate.
Or better is Lucas's suggestion to use gcroot.
in mongodb, class cursor is defined as 'Cursor : boost::noncopyable', and then there are many class which are derived from it. I want to know for a given operation from client, which XXXCursor was used. so I want to set a breakpoint on Cursor::Cursor. but failed.
(gdb) b mongo::Cursor::Cursor
the class mongo::Cursor does not have any method named Cursor
Hint: try 'mongo::Cursor::Cursor<TAB> or 'mongo::Cursor::Cursor<ESC-?>
(Note leading single quote.)
Make breakpoint pending on future shared library load? (y or [n]) n
(gdb) ptype mongo::Cursor
type = class mongo::Cursor : private boost::noncopyable_::noncopyable {
public:
~Cursor(int);
virtual bool ok(void);
bool eof(void);
virtual mongo::Record * _current(void);
virtual mongo::BSONObj current(void);
virtual mongo::DiskLoc currLoc(void);
virtual bool advance(void);
virtual mongo::BSONObj currKey(void) const;
....
}
(gdb) list mongo::Cursor::Cursor
**the class mongo::Cursor does not have any method named Cursor
Hint: try 'mongo::Cursor::Cursor<TAB> or 'mongo::Cursor::Cursor<ESC-?>**
(Note leading single quote.)
But I wrote a similar program
#include <iostream>
#include <boost/utility.hpp>
class Base : boost::noncopyable {
public:
void printx() {std::cout<< getx() <<"\n" ;}
virtual int getx()=0;
};
class P : public Base {
public:
int x;
virtual int getx() { return x*3;}
P(int c){ x= c;}
};
int main(){
P p(2);
p.printx();
return 0;
}
I can set breakpoint on Base::Base sucessfully.
do you have any idea why I can't set breakpoint on mongo::Cursor::Cursor ?
mongo::Cursor was definied here: https://github.com/mongodb/mongo/blob/master/src/mongo/db/cursor.h
As for your example. If I compile it like this:
g++ -O0 -g -m64 -I ./boost_1_53_0 main.cpp
I can set a breakpoint on Base::Base and I see Base::Base as a symbol:
>nm -C a.out | grep Base::Base
0000000000400a4e W Base::Base()
If I compile compile it like this (with optimization level O2):
g++ -O2 -g -m64 -I ./boost_1_53_0 main.cpp
I don't see Base::Base as a symbol:
>nm -C a.out | grep Base::Base
>
And can't set a breakpoint:
(gdb) b Base::Base
the class Base does not have any method named Base
Hint: try 'Base::Base<TAB> or 'Base::Base<ESC-?>
So as a first step make sure that there is mongo::Cursor::Cursor as a symbol in your program or shared library. It can be optimized out.
Having followed the examples http://www.tcpdump.org/pcap.htm, and exploring the documentation, I can't see what I have done wrong with the following code
// main.c
void got_packet(u_char *args, struct pcap_pkthdr *header, const u_char *packet);
/// ...snip...
void got_packet(u_char *args, struct pcap_pkthdr *header, const u_char *packet) {
printf("Received Packet\n");
}
/// ...snip...
pcap_dispatch(handle, 100, got_packet, NULL);
to warrant the compiler warnings that I am seeing:
gcc -g -O3 -I../sensor/ -c -o sensordatad.o sensordatad.c
main.c: In function ‘start_capture’:
main.c:96:27: warning: initialization from incompatible pointer type [enabled by default]
main.c:146:3: warning: passing argument 3 of ‘pcap_dispatch’ from incompatible pointer
type [enabled by default]
It might be that I'm being too fussy, it seems like every other piece of C code I have ever seen has a page full of compiler warnings when compiling, but I want to at least finish this code without warnings!
I've also tried doing this, to somehow typecast the function pointer, something I hadn't seen in any of the examples; but I felt it worth a shot:
pcap_handler callback = &got_packet;
/// ...snip...
pcap_dispatch(handle, 100, &callback, NULL);
This resulted in the equally perplexing error:
main.c: In function ‘start_capture’:
main.c:96:27: warning: initialization from incompatible pointer type [enabled by default]
It's the first time I've run across function pointers with special typedef'ed types, the man page for pcap_{loop,dispatch} reads:
NAME
pcap_loop, pcap_dispatch - process packets from a live capture or savefile
SYNOPSIS
#include
typedef void (*pcap_handler)(u_char *user, const struct pcap_pkthdr *h,
const u_char *bytes);
int pcap_loop(pcap_t *p, int cnt,
pcap_handler callback, u_char *user);
int pcap_dispatch(pcap_t *p, int cnt,
pcap_handler callback, u_char *user);
Solved
The function signature should be:
void got_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet);
I had:
void got_packet(u_char *args, struct pcap_pkthdr *header, const u_char *packet);
I suppose in some ways the error makes sense?! But anyway Solved.
If I missed the prototype, XCode (LLVM) prompt me for error
no previous prototype for function for exceptionHandler
But why they are needed in my code below?
void exceptionHandler(NSException * exception); // Why this Line is needed?
void exceptionHandler(NSException * exception)
{
// ....
}
#implementation AppDelegate
- (void) applicationDidFinishLaunching:(UIApplication *)application
{
NSSetUncaughtExceptionHandler(&exceptionHandler);
...
From the GCC manual:
-Wmissing-prototypes (C and Objective-C only)
Warn if a global function is defined without a previous prototype declaration. This warning is issued even if the definition itself provides a prototype. The aim is to detect global functions that fail to be declared in header files.
Clang borrowed this option for GCC compatibility, and because it's useful (I would presume this of the Clang devs).
The option exists so you can prevent yourself from making a common mistake which may be easily avoided. It's nice to be explicit about visibility/linkage for clarity/intent's sake.
In short, you've asked the compiler to tell you when an unqualified definition does not match a declaration by enabling this option. You should either qualify that as extern and make it usable to others (e.g. put it in a header), or declare it static. If using C++ inline is also an option.
Of course, implicit visibility is well known, but I typically find the option useful in these scenarios:
1) I made a typo:
// file.h
extern void MONExceptionHandler(NSException * exception);
and
// file.m
void MONExceptionhandler(NSException * exception) {
…
2) I should be explicit about the symbol's visibility:
// file.m
static void MONExceptionHandler(NSException * exception) {
…
3) I forgot to #include the header which declared the function:
// file.h
extern void MONExceptionHandler(NSException * exception);
Warning:
// file.m
void MONExceptionHandler(NSException * exception) {
…
No Warning:
// file.m
#include "file.h"
void MONExceptionHandler(NSException * exception) {
…
So there's the rationale, history, and some examples - again, -Wmissing-prototypes is an option. If you trust yourself to work with it disabled, then do so. My preference is to be explicit, and to let programs detect potential and actual issues so I don't have to do it manually.
If you're declaring a function only for use within this file, prefix the declaration with the static keyword and the warning will go away. As it is, you're declaring a global function; theoretically it could be called from anywhere within your app. But as you've given it no prototype, nobody else could call it.
So the warning, as I understand it, is trying to make you clarify your intentions between static functions and global functions, and discourage you from declaring a global function when you meant to declare only a static one.
I think this is most useful for C++ code. For example I have header
class MyClass {
public:
void hello();
};
and .cpp file
void hello() {
cout << "hello";
}
And you will see the warning because there are no prototype for function void hello(). In case the correct implementation should be
void MyClass::hello() {
cout << "hello";
}
So this warning make sure you are implementing the function that you are aware of (not miss typed a name or different argument format).
That warning is alerting that you can't call your method from another method that is written above. In C, the order of the declaration/implementation minds a lot and gives the difference between something that you can access or you can't.