| 
 | 1 | +// run  | 
 | 2 | +// check "Found variable 'three_deep', value: 0x3333333333333333"  | 
 | 3 | +// check "Found variable 'local_scope', value: 0xdeadbeefdeadbabe"  | 
 | 4 | +// check "Found variable 'root_scope', value: 0x1337133713371337"  | 
 | 5 | +// check "Found variable 'three_deep_2', value: 0x333333333332222"  | 
 | 6 | +// check "Found variable 'local_scope_2', value: 0xdeadbeefdead2222"  | 
 | 7 | +// check "Found variable 'root_scope', value: 0x1337133713371337"  | 
 | 8 | +// reject "Found variable 'should_not_see_this_variable'"  | 
 | 9 | +// reject "Found variable 'should_not_see_this_variable_2'"  | 
 | 10 | + | 
 | 11 | +#include <windows.h>  | 
 | 12 | +#include <dbghelp.h>  | 
 | 13 | +#include <stdio.h>  | 
 | 14 | + | 
 | 15 | +#pragma comment(lib, "dbghelp.lib")  | 
 | 16 | + | 
 | 17 | +BOOL SymbolCheckProc(PSYMBOL_INFO symbol, ULONG size, PVOID UserContext) {  | 
 | 18 | +      | 
 | 19 | +    if((symbol->Flags & (SYMFLAG_LOCAL | SYMFLAG_REGREL)) != symbol->Flags) return TRUE;  | 
 | 20 | +      | 
 | 21 | +    CONTEXT *StackFrame = UserContext;  | 
 | 22 | +      | 
 | 23 | +    ULONG64 register_value = (symbol->Register == /*rbp*/334) ? StackFrame->Rbp : StackFrame->Rsp;  | 
 | 24 | +      | 
 | 25 | +    printf("Found variable '%s', value: 0x%llx\n", symbol->Name, *(ULONG64 *)(register_value + symbol->Address));  | 
 | 26 | +      | 
 | 27 | +    return TRUE; // Continue enumeration  | 
 | 28 | +}  | 
 | 29 | + | 
 | 30 | +#ifndef __HLC__  | 
 | 31 | +#pragma function(memset)  | 
 | 32 | +void *memset(void *mem, int val, size_t amount){  | 
 | 33 | +      | 
 | 34 | +    if(!amount) return mem;  | 
 | 35 | +    __stosb(mem, (unsigned char)val, amount);  | 
 | 36 | +    return mem;  | 
 | 37 | +}  | 
 | 38 | +#endif  | 
 | 39 | + | 
 | 40 | +void ReadLocalVariable(void) {  | 
 | 41 | +    // Initialize DbgHelp  | 
 | 42 | +    SymInitialize(GetCurrentProcess(), NULL, TRUE);  | 
 | 43 | +      | 
 | 44 | +    // Capture the current context  | 
 | 45 | +    CONTEXT context;  | 
 | 46 | +    RtlCaptureContext(&context);  | 
 | 47 | +      | 
 | 48 | +    // Initialize the stack frame  | 
 | 49 | +    STACKFRAME64 stackFrame;  | 
 | 50 | +    memset(&stackFrame, 0, sizeof(STACKFRAME64));  | 
 | 51 | +      | 
 | 52 | +    // Set up the stack frame for x64 architecture  | 
 | 53 | +    stackFrame.AddrPC.Offset = context.Rip;  | 
 | 54 | +    stackFrame.AddrPC.Mode = AddrModeFlat;  | 
 | 55 | +    stackFrame.AddrFrame.Offset = context.Rsp;  | 
 | 56 | +    stackFrame.AddrFrame.Mode = AddrModeFlat;  | 
 | 57 | +    stackFrame.AddrStack.Offset = context.Rsp;  | 
 | 58 | +    stackFrame.AddrStack.Mode = AddrModeFlat;  | 
 | 59 | +      | 
 | 60 | +    HANDLE process = GetCurrentProcess();  | 
 | 61 | +    HANDLE thread = GetCurrentThread();  | 
 | 62 | +      | 
 | 63 | +    int first_time = 1;  | 
 | 64 | +      | 
 | 65 | +    // Unwind the stack  | 
 | 66 | +    while (StackWalk64(IMAGE_FILE_MACHINE_AMD64, process, thread, &stackFrame, &context, NULL, SymFunctionTableAccess64, SymGetModuleBase64, NULL)) {  | 
 | 67 | +        if(first_time){  | 
 | 68 | +            first_time = 0;  | 
 | 69 | +            continue;  | 
 | 70 | +        }  | 
 | 71 | +          | 
 | 72 | +        // Set the context for the current stack frame  | 
 | 73 | +        IMAGEHLP_STACK_FRAME frame = {0};  | 
 | 74 | +        frame.InstructionOffset = stackFrame.AddrPC.Offset;  | 
 | 75 | +        frame.ReturnOffset = stackFrame.AddrReturn.Offset;  | 
 | 76 | +        frame.FrameOffset = stackFrame.AddrFrame.Offset;  | 
 | 77 | +        frame.StackOffset = stackFrame.AddrStack.Offset;  | 
 | 78 | +        frame.BackingStoreOffset = stackFrame.AddrBStore.Offset;  | 
 | 79 | +        frame.FuncTableEntry = (ULONG64)stackFrame.FuncTableEntry;  | 
 | 80 | +        frame.Params[0] = stackFrame.Params[0];  | 
 | 81 | +        frame.Params[1] = stackFrame.Params[1];  | 
 | 82 | +        frame.Params[2] = stackFrame.Params[2];  | 
 | 83 | +        frame.Params[3] = stackFrame.Params[3];  | 
 | 84 | +        frame.Virtual = stackFrame.Virtual;  | 
 | 85 | +          | 
 | 86 | +        SymSetContext(process, &frame, NULL); // There is something weird here about the the return value.  | 
 | 87 | +          | 
 | 88 | +        // Enumerate local symbols  | 
 | 89 | +        SymEnumSymbols(process, /*UseSymSetContext*/0, NULL, SymbolCheckProc, &context);  | 
 | 90 | +    }  | 
 | 91 | +      | 
 | 92 | +    // Cleanup  | 
 | 93 | +    SymCleanup(process);  | 
 | 94 | +}  | 
 | 95 | + | 
 | 96 | +int main() {  | 
 | 97 | +      | 
 | 98 | +    __int64 root_scope = 0x1337133713371337;  | 
 | 99 | +      | 
 | 100 | +    {  | 
 | 101 | +        __int64 local_scope = 0xdeadbeefdeadbabe;  | 
 | 102 | +          | 
 | 103 | +        {  | 
 | 104 | +            __int64 three_deep = 0x3333333333333333;  | 
 | 105 | +              | 
 | 106 | +            ReadLocalVariable();  | 
 | 107 | +              | 
 | 108 | +            int k = 1;  | 
 | 109 | +              | 
 | 110 | +        }  | 
 | 111 | +        {  | 
 | 112 | +            __int64 should_not_see_this_variable = 0x12345678abcdef;  | 
 | 113 | +        }  | 
 | 114 | +          | 
 | 115 | +    }  | 
 | 116 | +      | 
 | 117 | +      | 
 | 118 | +      | 
 | 119 | +    {  | 
 | 120 | +        __int64 local_scope_2 = 0xdeadbeefdead2222;  | 
 | 121 | +          | 
 | 122 | +        {  | 
 | 123 | +            __int64 three_deep_2 = 0x333333333332222;  | 
 | 124 | +              | 
 | 125 | +            ReadLocalVariable();  | 
 | 126 | +              | 
 | 127 | +            int k = 1;  | 
 | 128 | +              | 
 | 129 | +        }  | 
 | 130 | +        {  | 
 | 131 | +            __int64 should_not_see_this_variable_2 = 0x12345678ab2222;  | 
 | 132 | +        }  | 
 | 133 | +          | 
 | 134 | +    }  | 
 | 135 | +      | 
 | 136 | +    return 0;  | 
 | 137 | +}  | 
 | 138 | + | 
0 commit comments