C# DkmThread类代码示例

    void IFunctionTracer.OnEntryBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException) {
      // The function was just entered.  Install the exit breakpoint on the calling thread at the
      // return address, and notify any listeners.
      DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance);

      bool suppressExitBreakpoint = false;
      if (OnFunctionEntered != null)
        OnFunctionEntered(frame, frameAnalyzer, out suppressExitBreakpoint);

      if (!suppressExitBreakpoint) {
        ulong ret = frame.VscxGetReturnAddress();

        DkmInstructionAddress retAddr = thread.Process.CreateNativeInstructionAddress(ret);
        DkmRuntimeInstructionBreakpoint exitBp = DkmRuntimeInstructionBreakpoint.Create(
            Guids.Source.FunctionTraceExit, thread, retAddr, false, null);
        // Capture the value of every argument now, since when the exit breakpoint gets hit, the
        // target function will have already returned and its frame will be cleaned up.
        exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways,
            new FunctionTraceEntryDataItem { 
                EntryArgumentValues = frameAnalyzer.GetAllArgumentValues(frame) 
            });
        exitBp.SetDataItem(DkmDataCreationDisposition.CreateAlways,
            new FunctionTraceDataItem { Tracer = this });
        exitBp.Enable();
      }
    }

    public static void VscxOnRuntimeBreakpointReceived(
        this DkmProcess process,
        DkmRuntimeBreakpoint bp,
        DkmThread thread,
        bool hasException,
        DkmEventDescriptorS eventDescriptor) {
      RuntimeBreakpointHandler handler = process.GetDataItem<RuntimeBreakpointHandler>();
      if (handler == null)
        return;

      handler.OnRuntimeBreakpointReceived(bp, thread, hasException, eventDescriptor);
    }

 public void OnRuntimeBreakpointReceived(
     DkmRuntimeBreakpoint bp,
     DkmThread thread,
     bool hasException,
     DkmEventDescriptorS eventDescriptor) {
   FunctionTraceDataItem traceDataItem = bp.GetDataItem<FunctionTraceDataItem>();
   if (traceDataItem != null && traceDataItem.Tracer != null) {
     if (bp.SourceId == Guids.Source.FunctionTraceEnter)
       traceDataItem.Tracer.OnEntryBreakpointHit(bp, thread, hasException);
     else if (bp.SourceId == Guids.Source.FunctionTraceExit)
       traceDataItem.Tracer.OnExitBreakpointHit(bp, thread, hasException);
   }
 }

        public CppExpressionEvaluator(DkmThread thread, ulong frameBase, ulong vframe) {
            _process = thread.Process;

            var inspectionSession = DkmInspectionSession.Create(_process, null);
            _cppInspectionContext = DkmInspectionContext.Create(inspectionSession, _process.GetNativeRuntimeInstance(), thread, Timeout,
                DkmEvaluationFlags.TreatAsExpression | DkmEvaluationFlags.NoSideEffects, DkmFuncEvalFlags.None, 10, CppLanguage, null);

            const int CV_ALLREG_VFRAME = 0x00007536;
            var vframeReg = DkmUnwoundRegister.Create(CV_ALLREG_VFRAME, new ReadOnlyCollection<byte>(BitConverter.GetBytes(vframe)));
            var regs = thread.GetCurrentRegisters(new[] { vframeReg });
            var iaddr = _process.CreateNativeInstructionAddress(regs.GetInstructionPointer());
            _nativeFrame = DkmStackWalkFrame.Create(thread, iaddr, frameBase, 0, DkmStackWalkFrameFlags.None, null, regs, null);
        }

 public static DkmInspectionContext Create(
     DkmInspectionSession InspectionSession,
     DkmRuntimeInstance RuntimeInstance,
     DkmThread Thread,
     uint Timeout,
     DkmEvaluationFlags EvaluationFlags,
     DkmFuncEvalFlags FuncEvalFlags,
     uint Radix,
     DkmLanguage Language,
     DkmRawReturnValue ReturnValue,
     DkmCompiledVisualizationData AdditionalVisualizationData,
     DkmCompiledVisualizationDataPriority AdditionalVisualizationDataPriority,
     ReadOnlyCollection<DkmRawReturnValueContainer> ReturnValues)
 {
     return new DkmInspectionContext(InspectionSession, EvaluationFlags, Radix, RuntimeInstance);
 }

    void IFunctionTracer.OnExitBreakpointHit(DkmRuntimeBreakpoint bp, DkmThread thread, bool hasException) {
      FunctionTraceEntryDataItem traceDataItem = bp.GetDataItem<FunctionTraceEntryDataItem>();

      if (OnFunctionExited != null) {
        DkmStackWalkFrame frame = thread.GetTopStackWalkFrame(bp.RuntimeInstance);
        StackFrameAnalyzer exitAnalyzer = null;
        if (traceDataItem != null) {
          DkmSystemInformationFlags systemInformationFlags = 
              frame.ModuleInstance.Process.SystemInformation.Flags;
          bool isTarget64Bit = systemInformationFlags.HasFlag(DkmSystemInformationFlags.Is64Bit);
          int pointerSize = (isTarget64Bit) ? 8 : 4;
          exitAnalyzer = new CachedFrameAnalyzer(
              frameAnalyzer.Parameters, 
              traceDataItem.EntryArgumentValues, 
              pointerSize);
        }
        OnFunctionExited(frame, exitAnalyzer);
      }

      // Since this was a one-shot breakpoint, it is unconditionally closed.
      bp.Close();
    }

            public void PyCFunction_Call(DkmThread thread, ulong frameBase, ulong vframe, bool useRegisters) {
                var process = thread.Process;
                var cppEval = new CppExpressionEvaluator(thread, frameBase, vframe);

                ulong ml_meth = cppEval.EvaluateUInt64(
                    "((PyObject*){0})->ob_type == &PyCFunction_Type ? ((PyCFunctionObject*){0})->m_ml->ml_meth : 0",
                    useRegisters ? "@rcx" : "func");
                _owner.OnPotentialRuntimeExit(thread, ml_meth);
            }

            public void call_function(DkmThread thread, ulong frameBase, ulong vframe, bool useRegisters) {
                var process = thread.Process;
                var cppEval = new CppExpressionEvaluator(thread, frameBase, vframe);

                int oparg = cppEval.EvaluateInt32(useRegisters ? "@rdx" : "oparg");

                int na = oparg & 0xff;
                int nk = (oparg >> 8) & 0xff;
                int n = na + 2 * nk;

                ulong func = cppEval.EvaluateUInt64(
                    "*((*(PyObject***){0}) - {1} - 1)",
                    useRegisters ? "@rcx" : "pp_stack",
                    n);
                var obj = PyObject.FromAddress(process, func);
                ulong ml_meth = cppEval.EvaluateUInt64(
                    "((PyObject*){0})->ob_type == &PyCFunction_Type ? ((PyCFunctionObject*){0})->m_ml->ml_meth : 0",
                    func);

                _owner.OnPotentialRuntimeExit(thread, ml_meth);
            }

 public void OnAsyncBreakComplete(DkmThread thread) {
     var e = _evalAbortedEvent;
     if (e != null) {
         new RemoteComponent.EndFuncEvalExecutionRequest { ThreadId = thread.UniqueId }.SendLower(thread.Process);
         e.Set();
     }
 }

            public void builtin_next(DkmThread thread, ulong frameBase, ulong vframe, bool useRegisters) {
                var process = thread.Process;
                var cppEval = new CppExpressionEvaluator(thread, frameBase, vframe);

                string argsVar = useRegisters ? "((PyTupleObject*)@rdx)" : "((PyTupleObject*)args)";

                ulong tp_iternext = cppEval.EvaluateUInt64(argsVar + "->ob_item[0]->ob_type->tp_iternext");
                _owner.OnPotentialRuntimeExit(thread, tp_iternext);
            }

            public void do_richcompare(DkmThread thread, ulong frameBase, ulong vframe, bool useRegisters) {
                var process = thread.Process;
                var cppEval = new CppExpressionEvaluator(thread, frameBase, vframe);

                string vVar = useRegisters ? "((PyObject*)@rcx)" : "v";
                string wVar = useRegisters ? "((PyObject*)@rdx)" : "w";

                ulong tp_richcompare1 = cppEval.EvaluateUInt64(vVar + "->ob_type->tp_richcompare");
                _owner.OnPotentialRuntimeExit(thread, tp_richcompare1);

                ulong tp_richcompare2 = cppEval.EvaluateUInt64(wVar + "->ob_type->tp_richcompare");
                _owner.OnPotentialRuntimeExit(thread, tp_richcompare2);
            }

            public void PyObject_SetAttr(DkmThread thread, ulong frameBase, ulong vframe, bool useRegisters) {
                var process = thread.Process;
                var cppEval = new CppExpressionEvaluator(thread, frameBase, vframe);

                string vVar = useRegisters ? "((PyObject*)@rcx)" : "v";

                ulong tp_setattr = cppEval.EvaluateUInt64(vVar + "->ob_type->tp_setattr");
                _owner.OnPotentialRuntimeExit(thread, tp_setattr);

                ulong tp_setattro = cppEval.EvaluateUInt64(vVar + "->ob_type->tp_setattro");
                _owner.OnPotentialRuntimeExit(thread, tp_setattro);
            }

            public static void PyCode_NewEmpty(DkmThread thread, ulong frameBase, ulong vframe, ulong returnAddress) {
                var process = thread.Process;
                var cppEval = new CppExpressionEvaluator(thread, frameBase, vframe);

                ulong filenamePtr = cppEval.EvaluateUInt64("filename");
                if (filenamePtr == 0) {
                    return;
                }

                string filename = new CStringProxy(process, filenamePtr).ReadUnicode();
                if (process.GetPythonRuntimeInstance().GetModuleInstances().Any(mi => mi.FullName == filename)) {
                    return;
                }

                new RemoteComponent.CreateModuleRequest {
                    ModuleId = Guid.NewGuid(),
                    FileName = filename
                }.SendLower(process);
            }

            public static void PyCode_New(DkmThread thread, ulong frameBase, ulong vframe, ulong returnAddress) {
                var process = thread.Process;
                var cppEval = new CppExpressionEvaluator(thread, frameBase, vframe);

                var filenamePtr = cppEval.EvaluateUInt64("filename");
                var filenameObj = PyObject.FromAddress(process, filenamePtr) as IPyBaseStringObject;
                if (filenameObj == null) {
                    return;
                }

                string filename = filenameObj.ToString();
                if (process.GetPythonRuntimeInstance().GetModuleInstances().Any(mi => mi.FullName == filename)) {
                    return;
                }

                new RemoteComponent.CreateModuleRequest {
                    ModuleId = Guid.NewGuid(),
                    FileName = filename
                }.SendLower(process);
            }

            public void PyInterpreterState_New(DkmThread thread, ulong frameBase, ulong vframe, ulong returnAddress) {
                var process = thread.Process;
                var cppEval = new CppExpressionEvaluator(thread, frameBase, vframe);

                var istate = PyInterpreterState.TryCreate(process, cppEval.EvaluateReturnValueUInt64());
                if (istate == null) {
                    return;
                }

                if (process.GetPythonRuntimeInfo().LanguageVersion >= PythonLanguageVersion.V36) {
                    _owner.RegisterJITTracing(istate);
                }
            }