#include "winbugcheck.h"
#include "alerts.h"
#include "decoder.h"
#include "guests.h"
#include "memcloak.h"
#include "winprocesshp.h"

Macros
#define	BUGCHECK_NAME(x) case(x): return &(#x[9])

#define	MODULE_NAMES_TO_PRINT 64

#define	TRACE_LIMIT_X64 0x2000

#define	TRACE_LIMIT_X86 0x2000

Functions
static char const *	IntGetBugCheckName (QWORD Reason)
	Returns a name for a bug check code. More...

static char const *	IntGetBugCheckLink (QWORD Reason)
	Returns the bug check documentation page link for a bug check reason. More...

static void	IntLogBSODParams (QWORD Reason, QWORD Param1, QWORD Param2, QWORD Param3, QWORD Param4)
	Logs the bug check parameters. More...

static void	IntLogCurrentIP (QWORD Rip, CHAR const *Message)
	Logs information about the RIP at which the crash was triggered. More...

static void	IntLogGuestRegisters (void)
	Logs the guest register state. More...

static void	IntLogProcessInfo (void)
	Logs information about the current process. More...

static void	IntWinLogVAInfo (QWORD Va)
	Logs information about a guest virtual address translation. More...

static void	IntWinDumpEflags (DWORD Eflags)
	Logs the EFLAGS contents. More...

static void	IntLogStackTrace (QWORD Address, CHAR const *Message)
	Attempts to log a guest stack trace. More...

static void	IntLogTrapFrame (QWORD TrapFrame)
	Logs information about a trap frame. More...

static void	IntLogContextRecord (QWORD ContextRecord)
	Logs information about a context record. More...

static void	IntLogExceptionRecord (QWORD ExceptionRecord)
	Logs information about an exception record. More...

static void	IntLogCriticalProcessHasDied (QWORD Param1, QWORD Param2)
	Handles a BUGCHECK_CRITICAL_PROCESS_DIED bug check. More...

static void	IntLogCriticalStructureCoruption (QWORD Param3, QWORD Param4)
	Handles a BUGCHEDCK_CRITICAL_STRUCTURE_CORRUPTION bug check. More...

static void	IntWinBcLogBsodEvent (QWORD Reason, QWORD Param1, QWORD Param2, QWORD Param3, QWORD Param4)
	Logs a bug check event and related information about the crash and the kernel. More...

static INTSTATUS	IntWinBcSendBsodEvent (QWORD Reason, QWORD Param1, QWORD Param2, QWORD Param3, QWORD Param4)
	Sends a introEventCrashEvent event. More...

INTSTATUS	IntWinBcHandleBugCheck (void const *Detour)
	Handles a Windows OS crash.This is the detour handle for the KeBugCheck2 32-bit Windows kernel API and the KeBugCheckEx 64-bit Windows kernel API. This will log as much information as possible and will notify the integrator about the event. More...

Macro Definition Documentation

◆ BUGCHECK_NAME

#define BUGCHECK_NAME ( x ) case(x): return &(#x[9])

Referenced by IntGetBugCheckName().

◆ MODULE_NAMES_TO_PRINT

#define MODULE_NAMES_TO_PRINT 64

Referenced by IntLogStackTrace().

◆ TRACE_LIMIT_X64

#define TRACE_LIMIT_X64 0x2000

Referenced by IntLogStackTrace().

◆ TRACE_LIMIT_X86

#define TRACE_LIMIT_X86 0x2000

Referenced by IntLogStackTrace().

Function Documentation

◆ IntGetBugCheckLink()

static char const* IntGetBugCheckLink ( QWORD Reason )

static

Returns the bug check documentation page link for a bug check reason.

Parameters

[in] Reason The bug check reason, as obtained from the guest. This is one of the reasons documented by Microsoft: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2

Returns: The link to the online documentation.

Definition at line 55 of file winbugcheck.c.

Referenced by IntLogBSODParams().

◆ IntGetBugCheckName()

static char const* IntGetBugCheckName ( QWORD Reason )

static

Returns a name for a bug check code.

Parameters

[in] Reason The bug check reason, as obtained from the guest. This is one of the reasons documented by Microsoft: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2

Returns: The name of the bug check.

Jump over the "BUGCHECK_" part of the define

Definition at line 13 of file winbugcheck.c.

Referenced by IntLogBSODParams().

◆ IntLogBSODParams()

static void IntLogBSODParams	(	QWORD	Reason,
		QWORD	Param1,
		QWORD	Param2,
		QWORD	Param3,
		QWORD	Param4
	)

static

Logs the bug check parameters.

Parameters

[in]	Reason	The bug check reason, as obtained from the guest. This is one of the reasons documented by Microsoft: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
[in]	Param1	First parameter, as obtained from the guest. It has different meanings based on the Reason.
[in]	Param2	Second parameter, as obtained from the guest. It has different meanings based on the Reason.
[in]	Param3	Third parameter, as obtained from the guest. It has different meanings based on the Reason.
[in]	Param4	Fourth parameter, as obtained from the guest. It has different meanings based on the Reason.

Definition at line 109 of file winbugcheck.c.

Referenced by IntWinBcLogBsodEvent().

◆ IntLogContextRecord()

static void IntLogContextRecord ( QWORD ContextRecord )

static

Logs information about a context record.

Parameters

[in] ContextRecord Guest virtual address from which the context record will be read

Definition at line 526 of file winbugcheck.c.

Referenced by IntWinBcLogBsodEvent().

◆ IntLogCriticalProcessHasDied()

static void IntLogCriticalProcessHasDied	(	QWORD	Param1,
		QWORD	Param2
	)

static

Handles a BUGCHECK_CRITICAL_PROCESS_DIED bug check.

Parameters

[in]	Param1	First parameter, as obtained from the guest. This is the process object.
[in]	Param2	Second parameter, as obtained from the guest. If 0, a process died; if 1, a thread died.

Definition at line 668 of file winbugcheck.c.

Referenced by IntWinBcLogBsodEvent().

◆ IntLogCriticalStructureCoruption()

static void IntLogCriticalStructureCoruption	(	QWORD	Param3,
		QWORD	Param4
	)

static

Handles a BUGCHEDCK_CRITICAL_STRUCTURE_CORRUPTION bug check.

This is usually generated by patch guard. The different types of corrupted regions are documented here: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x109—critical-structure-corruption

Parameters

[in]	Param3	Third parameter, as obtained from the guest. It has different meanings based on the Reason
[in]	Param4	Fourth parameter, as obtained from the guest. It has different meanings based on the Reason. This is the type of the region that was corrupted.

Definition at line 705 of file winbugcheck.c.

Referenced by IntWinBcLogBsodEvent().

◆ IntLogCurrentIP()

static void IntLogCurrentIP	(	QWORD	Rip,
		CHAR const *	Message
	)

static

Logs information about the RIP at which the crash was triggered.

This will log the instruction at RIP, and, if possible, the name of the module in which RIP resided and the offset relative to the module base at which the crash was triggered.

Parameters

[in]	Rip	The RIP to be logged.
[in]	Message	Optional message to be displayed.

Definition at line 142 of file winbugcheck.c.

Referenced by IntLogContextRecord(), IntLogTrapFrame(), and IntWinBcLogBsodEvent().

◆ IntLogExceptionRecord()

static void IntLogExceptionRecord ( QWORD ExceptionRecord )

static

Logs information about an exception record.

Parameters

[in] ExceptionRecord Guest virtual address from which the except exception will be read

Definition at line 599 of file winbugcheck.c.

Referenced by IntWinBcLogBsodEvent().

◆ IntLogGuestRegisters()

static void IntLogGuestRegisters ( void )

static

Logs the guest register state.

This will dump the general purpose registers, control register, eflags, debug registers, segment registers, ant the base and limit of the IDT and GDT for all the guests CPUs.

Definition at line 186 of file winbugcheck.c.

Referenced by IntWinBcLogBsodEvent().

◆ IntLogProcessInfo()

static void IntLogProcessInfo ( void )

static

Logs information about the current process.

Definition at line 266 of file winbugcheck.c.

Referenced by IntWinBcLogBsodEvent().

◆ IntLogStackTrace()

static void IntLogStackTrace	(	QWORD	Address,
		CHAR const *	Message
	)

static

Attempts to log a guest stack trace.

Parameters

[in]	Address	Guest virtual address from which to obtain a trace. If 0, will use the value of the guest RSP on the current CPU
[in]	Message	Optional NULL-terminated string with a message to be displayed.

Definition at line 370 of file winbugcheck.c.

Referenced by IntLogTrapFrame(), and IntWinBcLogBsodEvent().

◆ IntLogTrapFrame()

static void IntLogTrapFrame ( QWORD TrapFrame )

static

Logs information about a trap frame.

Parameters

[in] TrapFrame Guest virtual address from which the trap frame will be read

Definition at line 453 of file winbugcheck.c.

Referenced by IntWinBcLogBsodEvent().

◆ IntWinBcLogBsodEvent()

static void IntWinBcLogBsodEvent	(	QWORD	Reason,
		QWORD	Param1,
		QWORD	Param2,
		QWORD	Param3,
		QWORD	Param4
	)

static

Logs a bug check event and related information about the crash and the kernel.

Parameters

[in]	Reason	The bug check reason, as obtained from the guest. This is one of the reasons documented by Microsoft: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
[in]	Param1	First parameter, as obtained from the guest. It has different meanings based on the Reason
[in]	Param2	Second parameter, as obtained from the guest. It has different meanings based on the Reason
[in]	Param3	Third parameter, as obtained from the guest. It has different meanings based on the Reason
[in]	Param4	Fourth parameter, as obtained from the guest. It has different meanings based on the Reason. This is the type of the region that was corrupted.

Definition at line 801 of file winbugcheck.c.

Referenced by IntWinBcHandleBugCheck().

◆ IntWinBcSendBsodEvent()

static INTSTATUS IntWinBcSendBsodEvent	(	QWORD	Reason,
		QWORD	Param1,
		QWORD	Param2,
		QWORD	Param3,
		QWORD	Param4
	)

static

Sends a introEventCrashEvent event.

If the INTRO_OPT_EVENT_OS_CRASH option is not enabled, this function does nothing.

Parameters

[in]	Reason	The bug check reason, as obtained from the guest. This is one of the reasons documented by Microsoft: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
[in]	Param1	First parameter, as obtained from the guest. It has different meanings based on the Reason.
[in]	Param2	Second parameter, as obtained from the guest. It has different meanings based on the Reason.
[in]	Param3	Third parameter, as obtained from the guest. It has different meanings based on the Reason.
[in]	Param4	Fourth parameter, as obtained from the guest. It has different meanings based on the Reason. This is the type of the region that was corrupted.

Definition at line 881 of file winbugcheck.c.

Referenced by IntWinBcHandleBugCheck().

◆ IntWinDumpEflags()

static void IntWinDumpEflags ( DWORD Eflags )

static

Logs the EFLAGS contents.

Parameters

[in] Eflags Raw guest EFLAGS value

Definition at line 344 of file winbugcheck.c.

Referenced by IntLogContextRecord(), and IntLogTrapFrame().

◆ IntWinLogVAInfo()

static void IntWinLogVAInfo ( QWORD Va )

static

Logs information about a guest virtual address translation.

Parameters

[in] Va Guest virtual address to log

Definition at line 313 of file winbugcheck.c.

Referenced by IntWinBcLogBsodEvent().

Macros

Functions

Macro Definition Documentation

◆ BUGCHECK_NAME

◆ MODULE_NAMES_TO_PRINT

◆ TRACE_LIMIT_X64

◆ TRACE_LIMIT_X86

Function Documentation

◆ IntGetBugCheckLink()

◆ IntGetBugCheckName()

◆ IntLogBSODParams()

◆ IntLogContextRecord()

◆ IntLogCriticalProcessHasDied()

◆ IntLogCriticalStructureCoruption()

◆ IntLogCurrentIP()

◆ IntLogExceptionRecord()

◆ IntLogGuestRegisters()

◆ IntLogProcessInfo()

◆ IntLogStackTrace()

◆ IntLogTrapFrame()

◆ IntWinBcLogBsodEvent()

◆ IntWinBcSendBsodEvent()

◆ IntWinDumpEflags()

◆ IntWinLogVAInfo()