📄 debug.c
字号:
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
IoStackLocation->Parameters.VerifyVolume.DeviceObject));
}
else if (IoStackLocation->MinorFunction == IRP_MN_LOAD_FILE_SYSTEM)
{
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IRP_MN_LOAD_FILE_SYSTEM\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName));
}
#if (_WIN32_WINNT >= 0x0500)
else if (IoStackLocation->MinorFunction == IRP_MN_KERNEL_CALL)
{
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IRP_MN_KERNEL_CALL\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName));
}
#endif // (_WIN32_WINNT >= 0x0500)
else
{
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s Unknown minor function %#x\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
IoStackLocation->MinorFunction));
}
break;
case IRP_MJ_DEVICE_CONTROL:
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IoControlCode: %#x\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
IoStackLocation->Parameters.DeviceIoControl.IoControlCode));
break;
case IRP_MJ_LOCK_CONTROL:
if (IoStackLocation->MinorFunction & IRP_MN_LOCK)
{
#ifndef _GNU_NTIFS_
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IRP_MN_LOCK Offset: %I64xh Length: %I64xh Key: %u %s%s\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
IoStackLocation->Parameters.LockControl.ByteOffset.QuadPart,
IoStackLocation->Parameters.LockControl.Length->QuadPart,
IoStackLocation->Parameters.LockControl.Key,
(IoStackLocation->Flags & SL_FAIL_IMMEDIATELY ? "SL_FAIL_IMMEDIATELY " : ""),
(IoStackLocation->Flags & SL_EXCLUSIVE_LOCK ? "SL_EXCLUSIVE_LOCK " : "")));
#else
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IRP_MN_LOCK Offset: %I64xh Length: %I64xh Key: %u %s%s\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
((PEXTENDED_IO_STACK_LOCATION)
IoStackLocation)->Parameters.LockControl.ByteOffset.QuadPart,
((PEXTENDED_IO_STACK_LOCATION)
IoStackLocation)->Parameters.LockControl.Length->QuadPart,
((PEXTENDED_IO_STACK_LOCATION)
IoStackLocation)->Parameters.LockControl.Key,
(IoStackLocation->Flags & SL_FAIL_IMMEDIATELY ? "SL_FAIL_IMMEDIATELY " : ""),
(IoStackLocation->Flags & SL_EXCLUSIVE_LOCK ? "SL_EXCLUSIVE_LOCK " : "")));
#endif
}
else if (IoStackLocation->MinorFunction & IRP_MN_UNLOCK_SINGLE)
{
#ifndef _GNU_NTIFS_
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IRP_MN_UNLOCK_SINGLE Offset: %I64xh Length: %I64xh Key: %u\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
IoStackLocation->Parameters.LockControl.ByteOffset.QuadPart,
IoStackLocation->Parameters.LockControl.Length->QuadPart,
IoStackLocation->Parameters.LockControl.Key));
#else
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IRP_MN_UNLOCK_SINGLE Offset: %I64xh Length: %I64xh Key: %u\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
((PEXTENDED_IO_STACK_LOCATION)
IoStackLocation)->Parameters.LockControl.ByteOffset.QuadPart,
((PEXTENDED_IO_STACK_LOCATION)
IoStackLocation)->Parameters.LockControl.Length->QuadPart,
((PEXTENDED_IO_STACK_LOCATION)
IoStackLocation)->Parameters.LockControl.Key));
#endif
}
else if (IoStackLocation->MinorFunction & IRP_MN_UNLOCK_ALL)
{
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IRP_MN_UNLOCK_ALL\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName));
}
else if (IoStackLocation->MinorFunction & IRP_MN_UNLOCK_ALL_BY_KEY)
{
#ifndef _GNU_NTIFS_
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IRP_MN_UNLOCK_ALL_BY_KEY Key: %u\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
IoStackLocation->Parameters.LockControl.Key));
#else
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s IRP_MN_UNLOCK_ALL_BY_KEY Key: %u\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
((PEXTENDED_IO_STACK_LOCATION)
IoStackLocation)->Parameters.LockControl.Key));
#endif
}
else
{
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s Unknown minor function %#x\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName,
IoStackLocation->MinorFunction));
}
break;
case IRP_MJ_CLEANUP:
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName));
break;
case IRP_MJ_SHUTDOWN:
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName));
break;
#if (_WIN32_WINNT >= 0x0500)
case IRP_MJ_PNP:
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName));
#endif // (_WIN32_WINNT >= 0x0500)
break;
default:
FFSPrintNoIndent((
DBG_TRACE, "%s %s %s\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FileName));
}
}
VOID
FFSDbgPrintComplete(
IN PIRP Irp,
IN BOOLEAN bPrint)
{
PIO_STACK_LOCATION IoStackLocation;
if (!Irp)
return;
if (Irp->IoStatus.Status != STATUS_SUCCESS)
{
IoStackLocation = IoGetCurrentIrpStackLocation(Irp);
if (bPrint)
{
FFSPrintNoIndent((
DBG_TRACE, "%s %s Status: %s (%#x).\n",
FFSGetCurrentProcessName(),
IrpMjStrings[IoStackLocation->MajorFunction],
FFSNtStatusToString(Irp->IoStatus.Status),
Irp->IoStatus.Status));
}
}
}
PUCHAR
FFSNtStatusToString(
IN NTSTATUS Status)
{
switch (Status)
{
case 0x00000000: return "STATUS_SUCCESS";
case 0x00000001: return "STATUS_WAIT_1";
case 0x00000002: return "STATUS_WAIT_2";
case 0x00000003: return "STATUS_WAIT_3";
case 0x0000003F: return "STATUS_WAIT_63";
case 0x00000080: return "STATUS_ABANDONED_WAIT_0";
case 0x000000BF: return "STATUS_ABANDONED_WAIT_63";
case 0x000000C0: return "STATUS_USER_APC";
case 0x00000100: return "STATUS_KERNEL_APC";
case 0x00000101: return "STATUS_ALERTED";
case 0x00000102: return "STATUS_TIMEOUT";
case 0x00000103: return "STATUS_PENDING";
case 0x00000104: return "STATUS_REPARSE";
case 0x00000105: return "STATUS_MORE_ENTRIES";
case 0x00000106: return "STATUS_NOT_ALL_ASSIGNED";
case 0x00000107: return "STATUS_SOME_NOT_MAPPED";
case 0x00000108: return "STATUS_OPLOCK_BREAK_IN_PROGRESS";
case 0x00000109: return "STATUS_VOLUME_MOUNTED";
case 0x0000010A: return "STATUS_RXACT_COMMITTED";
case 0x0000010B: return "STATUS_NOTIFY_CLEANUP";
case 0x0000010C: return "STATUS_NOTIFY_ENUM_DIR";
case 0x0000010D: return "STATUS_NO_QUOTAS_FOR_ACCOUNT";
case 0x0000010E: return "STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED";
case 0x00000110: return "STATUS_PAGE_FAULT_TRANSITION";
case 0x00000111: return "STATUS_PAGE_FAULT_DEMAND_ZERO";
case 0x00000112: return "STATUS_PAGE_FAULT_COPY_ON_WRITE";
case 0x00000113: return "STATUS_PAGE_FAULT_GUARD_PAGE";
case 0x00000114: return "STATUS_PAGE_FAULT_PAGING_FILE";
case 0x00000115: return "STATUS_CACHE_PAGE_LOCKED";
case 0x00000116: return "STATUS_CRASH_DUMP";
case 0x00000117: return "STATUS_BUFFER_ALL_ZEROS";
case 0x00000118: return "STATUS_REPARSE_OBJECT";
case 0x00000119: return "STATUS_RESOURCE_REQUIREMENTS_CHANGED";
case 0x00000120: return "STATUS_TRANSLATION_COMPLETE";
case 0x00000121: return "STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY";
case 0x00010001: return "DBG_EXCEPTION_HANDLED";
case 0x00010002: return "DBG_CONTINUE";
case 0x40000000: return "STATUS_OBJECT_NAME_EXISTS";
case 0x40000001: return "STATUS_THREAD_WAS_SUSPENDED";
case 0x40000002: return "STATUS_WORKING_SET_LIMIT_RANGE";
case 0x40000003: return "STATUS_IMAGE_NOT_AT_BASE";
case 0x40000004: return "STATUS_RXACT_STATE_CREATED";
case 0x40000005: return "STATUS_SEGMENT_NOTIFICATION";
case 0x40000006: return "STATUS_LOCAL_USER_SESSION_KEY";
case 0x40000007: return "STATUS_BAD_CURRENT_DIRECTORY";
case 0x40000008: return "STATUS_SERIAL_MORE_WRITES";
case 0x40000009: return "STATUS_REGISTRY_RECOVERED";
case 0x4000000A: return "STATUS_FT_READ_RECOVERY_FROM_BACKUP";
case 0x4000000B: return "STATUS_FT_WRITE_RECOVERY";
case 0x4000000C: return "STATUS_SERIAL_COUNTER_TIMEOUT";
case 0x4000000D: return "STATUS_NULL_LM_PASSWORD";
case 0x4000000E: return "STATUS_IMAGE_MACHINE_TYPE_MISMATCH";
case 0x4000000F: return "STATUS_RECEIVE_PARTIAL";
case 0x40000010: return "STATUS_RECEIVE_EXPEDITED";
case 0x40000011: return "STATUS_RECEIVE_PARTIAL_EXPEDITED";
case 0x40000012: return "STATUS_EVENT_DONE";
case 0x40000013: return "STATUS_EVENT_PENDING";
case 0x40000014: return "STATUS_CHECKING_FILE_SYSTEM";
case 0x40000015: return "STATUS_FATAL_APP_EXIT";
case 0x40000016: return "STATUS_PREDEFINED_HANDLE";
case 0x40000017: return "STATUS_WAS_UNLOCKED";
case 0x40000018: return "STATUS_SERVICE_NOTIFICATION";
case 0x40000019: return "STATUS_WAS_LOCKED";
case 0x4000001A: return "STATUS_LOG_HARD_ERROR";
case 0x4000001B: return "STATUS_ALREADY_WIN32";
case 0x4000001C: return "STATUS_WX86_UNSIMULATE";
case 0x4000001D: return "STATUS_WX86_CONTINUE";
case 0x4000001E: return "STATUS_WX86_SINGLE_STEP";
case 0x4000001F: return "STATUS_WX86_BREAKPOINT";
case 0x40000020: return "STATUS_WX86_EXCEPTION_CONTINUE";
case 0x40000021: return "STATUS_WX86_EXCEPTION_LASTCHANCE";
case 0x40000022: return "STATUS_WX86_EXCEPTION_CHAIN";
case 0x40000023: return "STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE";
case 0x40000024: return "STATUS_NO_YIELD_PERFORMED";
case 0x40000025: return "STATUS_TIMER_RESUME_IGNORED";
case 0x40000026: return "STATUS_ARBITRATION_UNHANDLED";
case 0x40000027: return "STATUS_CARDBUS_NOT_SUPPORTED";
case 0x40000028: return "STATUS_WX86_CREATEWX86TIB";
case 0x40000029: return "STATUS_MP_PROCESSOR_MISMATCH";
case 0x40010001: return "DBG_REPLY_LATER";
case 0x40010002: return "DBG_UNABLE_TO_PROVIDE_HANDLE";
case 0x40010003: return "DBG_TERMINATE_THREAD";
case 0x40010004: return "DBG_TERMINATE_PROCESS";
case 0x40010005: return "DBG_CONTROL_C";
case 0x40010006: return "DBG_PRINTEXCEPTION_C";
case 0x40010007: return "DBG_RIPEXCEPTION";
case 0x40010008: return "DBG_CONTROL_BREAK";
case 0x80000001: return "STATUS_GUARD_PAGE_VIOLATION";
case 0x80000002: return "STATUS_DATATYPE_MISALIGNMENT";
case 0x80000003: return "STATUS_BREAKPOINT";
case 0x80000004: return "STATUS_SINGLE_STEP";
case 0x80000005: return "STATUS_BUFFER_OVERFLOW";
case 0x80000006: return "STATUS_NO_MORE_FILES";
case 0x80000007: return "STATUS_WAKE_SYSTEM_DEBUGGER";
case 0x8000000A: return "STATUS_HANDLES_CLOSED";
case 0x8000000B: return "STATUS_NO_INHERITANCE";
case 0x8000000C: return "STATUS_GUID_SUBSTITUTION_MADE";
case 0x8000000D: return "STATUS_PARTIAL_COPY";
case 0x8000000E: return "STATUS_DEVICE_PAPER_EMPTY";
case 0x8000000F: return "STATUS_DEVICE_POWERED_OFF";
case 0x80000010: return "STATUS_DEVICE_OFF_LINE";
case 0x80000011: return "STATUS_DEVICE_BUSY";
case 0x80000012: return "STATUS_NO_MORE_EAS";
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -