From 8d025718a19520f0eb41b469f46ef72818ef67d9 Mon Sep 17 00:00:00 2001 From: 0vercl0k <1476421+0vercl0k@users.noreply.github.com> Date: Mon, 13 Oct 2025 23:58:28 -0700 Subject: [PATCH 1/4] fix https://github.com/0vercl0k/wtf/issues/242 --- Cargo.toml | 10 +++++----- src/lib.rs | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index afaf20e..0c97290 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "snapshot" -version = "0.2.3" +version = "0.2.4" edition = "2021" authors = ["Axel '0vercl0k' Souchet"] @@ -9,10 +9,10 @@ authors = ["Axel '0vercl0k' Souchet"] crate-type = ["cdylib"] [dependencies] -anyhow = { version = "1.0.79" } -chrono = "0.4.33" +anyhow = { version = "1.0" } +chrono = "0.4.42" clap = { version = "4.5.0", features = ["derive"] } dbgeng = { version = "0.3", features = ["serde"] } -serde = { version = "1.0.195", features = ["derive"] } -serde_json = { version = "1.0.111"} +serde = { version = "1.0.228", features = ["derive"] } +serde_json = { version = "1.0.145"} windows = { version = "0.58.0", features = ["Win32_Foundation", "Win32_System", "Win32_System_Diagnostics", "Win32_System_Diagnostics_Debug", "Win32_System_Diagnostics_Debug_Extensions", "Win32_System_SystemInformation" ] } diff --git a/src/lib.rs b/src/lib.rs index 363e334..c557b48 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -160,15 +160,15 @@ fn fptw(windbg_fptw: u64) -> u64 { /// Generate a directory name where we'll store the CPU state / memory dump. fn gen_state_folder_name(dbg: &DebugClient) -> Result { - let addr = dbg.get_address_by_name("nt!NtBuildLabEx")?; - let build_name = dbg.read_cstring(addr)?; + let addr = dbg.get_address_by_name("nt!NtBuildLabEx").unwrap_or(0); + let build_name = dbg.read_cstring(addr).unwrap_or("UnknownBuild".to_string()); let now = Local::now(); Ok(format!("state.{build_name}.{}", now.format("%Y%m%d_%H%M"))) } /// Dump the register state. -fn state(dbg: &DebugClient) -> Result { +fn state(dbg: &DebugClient) -> Result> { let mut regs = dbg.regs64_dict(&[ "rax", "rbx", "rcx", "rdx", "rsi", "rdi", "rip", "rsp", "rbp", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "fpcw", "fpsw", "cr0", "cr2", "cr3", "cr4", "cr8", "xcr0", From 8a56811c103345edc0e807eb27d20a49e38a6b97 Mon Sep 17 00:00:00 2001 From: 0vercl0k <1476421+0vercl0k@users.noreply.github.com> Date: Tue, 14 Oct 2025 00:15:27 -0700 Subject: [PATCH 2/4] use dbgeng's windows --- Cargo.toml | 3 +-- src/lib.rs | 12 ++++++------ 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 0c97290..766e860 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -12,7 +12,6 @@ crate-type = ["cdylib"] anyhow = { version = "1.0" } chrono = "0.4.42" clap = { version = "4.5.0", features = ["derive"] } -dbgeng = { version = "0.3", features = ["serde"] } +dbgeng = { version = "0.4", features = ["serde"] } serde = { version = "1.0.228", features = ["derive"] } serde_json = { version = "1.0.145"} -windows = { version = "0.58.0", features = ["Win32_Foundation", "Win32_System", "Win32_System_Diagnostics", "Win32_System_Diagnostics_Debug", "Win32_System_Diagnostics_Debug_Extensions", "Win32_System_SystemInformation" ] } diff --git a/src/lib.rs b/src/lib.rs index c557b48..3010ac2 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -12,14 +12,14 @@ use chrono::Local; use clap::{Parser, ValueEnum}; use dbgeng::client::DebugClient; use dbgeng::dlogln; -use serde_json::Value; -use state::{Float80, GlobalSeg, State, Zmm}; -use windows::core::{IUnknown, Interface, HRESULT, PCSTR}; -use windows::Win32::Foundation::{E_ABORT, S_OK}; -use windows::Win32::System::Diagnostics::Debug::Extensions::{ +use dbgeng::windows::core::{IUnknown, Interface, HRESULT, PCSTR}; +use dbgeng::windows::Win32::Foundation::{E_ABORT, S_OK}; +use dbgeng::windows::Win32::System::Diagnostics::Debug::Extensions::{ DEBUG_CLASS_KERNEL, DEBUG_KERNEL_CONNECTION, DEBUG_KERNEL_EXDI_DRIVER, DEBUG_KERNEL_LOCAL, }; -use windows::Win32::System::SystemInformation::IMAGE_FILE_MACHINE_AMD64; +use dbgeng::windows::Win32::System::SystemInformation::IMAGE_FILE_MACHINE_AMD64; +use serde_json::Value; +use state::{Float80, GlobalSeg, State, Zmm}; mod msr { pub const TSC: u32 = 0x0000_0010; From 707486ee1d0f85d5104d9b830ddd4867533bccd7 Mon Sep 17 00:00:00 2001 From: 0vercl0k <1476421+0vercl0k@users.noreply.github.com> Date: Wed, 15 Oct 2025 02:30:01 -0700 Subject: [PATCH 3/4] conditionally dump @xcr0 if CR4.OSXSAVE is armed --- Cargo.toml | 2 +- rustfmt.toml | 13 +++++++++++++ src/lib.rs | 28 +++++++++++++++++++++------- 3 files changed, 35 insertions(+), 8 deletions(-) create mode 100644 rustfmt.toml diff --git a/Cargo.toml b/Cargo.toml index 766e860..925ab71 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "snapshot" version = "0.2.4" -edition = "2021" +edition = "2024" authors = ["Axel '0vercl0k' Souchet"] # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html diff --git a/rustfmt.toml b/rustfmt.toml new file mode 100644 index 0000000..3170662 --- /dev/null +++ b/rustfmt.toml @@ -0,0 +1,13 @@ +reorder_modules = true +use_field_init_shorthand = true + +unstable_features = true +indent_style = "Block" +reorder_imports = true +imports_granularity = "Module" +normalize_comments = true +normalize_doc_attributes = true +overflow_delimited_expr = true +reorder_impl_items = true +group_imports = "StdExternalCrate" +wrap_comments = true \ No newline at end of file diff --git a/src/lib.rs b/src/lib.rs index 3010ac2..55f2d48 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -7,17 +7,17 @@ use std::fs::{self, File}; use std::path::PathBuf; use std::{env, mem}; -use anyhow::{bail, Result}; +use anyhow::{Result, bail}; use chrono::Local; use clap::{Parser, ValueEnum}; use dbgeng::client::DebugClient; use dbgeng::dlogln; -use dbgeng::windows::core::{IUnknown, Interface, HRESULT, PCSTR}; use dbgeng::windows::Win32::Foundation::{E_ABORT, S_OK}; use dbgeng::windows::Win32::System::Diagnostics::Debug::Extensions::{ DEBUG_CLASS_KERNEL, DEBUG_KERNEL_CONNECTION, DEBUG_KERNEL_EXDI_DRIVER, DEBUG_KERNEL_LOCAL, }; use dbgeng::windows::Win32::System::SystemInformation::IMAGE_FILE_MACHINE_AMD64; +use dbgeng::windows::core::{HRESULT, IUnknown, Interface, PCSTR}; use serde_json::Value; use state::{Float80, GlobalSeg, State, Zmm}; @@ -169,12 +169,26 @@ fn gen_state_folder_name(dbg: &DebugClient) -> Result { /// Dump the register state. fn state(dbg: &DebugClient) -> Result> { + const CR4_OSXSAVE: u64 = 1 << 18; let mut regs = dbg.regs64_dict(&[ "rax", "rbx", "rcx", "rdx", "rsi", "rdi", "rip", "rsp", "rbp", "r8", "r9", "r10", "r11", - "r12", "r13", "r14", "r15", "fpcw", "fpsw", "cr0", "cr2", "cr3", "cr4", "cr8", "xcr0", - "dr0", "dr1", "dr2", "dr3", "dr6", "dr7", "mxcsr", + "r12", "r13", "r14", "r15", "fpcw", "fpsw", "cr0", "cr2", "cr3", "cr4", "cr8", "dr0", + "dr1", "dr2", "dr3", "dr6", "dr7", "mxcsr", ])?; + let xcr0 = if let Some(cr4) = regs.get("cr4") + && (cr4 & CR4_OSXSAVE) != 0 + { + dbg.reg64("xcr0").unwrap() + } else { + 0 + }; + + assert!( + regs.insert("xcr0", xcr0).is_none(), + "xcr0 shouldn't be in regs" + ); + assert!( regs.insert("rflags", dbg.reg64("efl")?).is_none(), "efl shouldn't be in regs" @@ -452,19 +466,19 @@ fn wrap( } } -#[no_mangle] +#[unsafe(no_mangle)] extern "C" fn snapshot(raw_client: RawIUnknown, args: PCSTR) -> HRESULT { wrap(raw_client, args, snapshot_inner) } /// The DebugExtensionInitialize callback function is called by the engine after /// loading a DbgEng extension DLL. https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/dbgeng/nc-dbgeng-pdebug_extension_initialize -#[no_mangle] +#[unsafe(no_mangle)] extern "C" fn DebugExtensionInitialize(_version: *mut u32, _flags: *mut u32) -> HRESULT { S_OK } -#[no_mangle] +#[unsafe(no_mangle)] extern "C" fn DebugExtensionUninitialize() {} #[cfg(test)] From faed085c5cf989909892dcf72207104eabfbd163 Mon Sep 17 00:00:00 2001 From: 0vercl0k <1476421+0vercl0k@users.noreply.github.com> Date: Wed, 15 Oct 2025 02:36:08 -0700 Subject: [PATCH 4/4] reg should be there, so lets unwrap --- src/lib.rs | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/lib.rs b/src/lib.rs index 55f2d48..01435af 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -176,9 +176,7 @@ fn state(dbg: &DebugClient) -> Result> { "dr1", "dr2", "dr3", "dr6", "dr7", "mxcsr", ])?; - let xcr0 = if let Some(cr4) = regs.get("cr4") - && (cr4 & CR4_OSXSAVE) != 0 - { + let xcr0 = if (regs.get("cr4").unwrap() & CR4_OSXSAVE) != 0 { dbg.reg64("xcr0").unwrap() } else { 0