Skip to content

Commit 5bf5427

Browse files
KOLANICHKOLANICH
committed
Add additional structs used within other Windows structs.
Change `windows_minidump` to use them.
1 parent 5edcbc5 commit 5bf5427

File tree

3 files changed

+317
-13
lines changed

3 files changed

+317
-13
lines changed

‎windows/windows_minidump.ksy‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ meta:
33
title: Windows MiniDump
44
license: CC0-1.0
55
endian: le
6+
imports:
7+
- /windows/windows_suite_mask
8+
- /windows/windows_version_info
69
doc: |
710
Windows MiniDump (MDMP) file provides a concise way to store process
811
core dumps, which is useful for debugging. Given its small size,
@@ -95,27 +98,27 @@ types:
9598
- id: os_type
9699
-orig-id: ProductType
97100
type: u1
98-
- id: os_ver_major
99-
-orig-id: MajorVersion
100-
type: u4
101-
- id: os_ver_minor
102-
-orig-id: MinorVersion
103-
type: u4
104-
- id: os_build
105-
-orig-id: BuildNumber
106-
type: u4
107-
- id: os_platform
108-
-orig-id: PlatformId
109-
type: u4
101+
- id: const_size_version_info
102+
type: windows_version_info::internal::basic
103+
110104
- id: ofs_service_pack
111105
-orig-id: CSDVersionRva
112106
type: u4
113107
- id: os_suite_mask
114-
type: u2
108+
size: 2
109+
type: windows_suite_mask
115110
- id: reserved2
116111
type: u2
117112
# TODO: the rest of CPU information
118113
instances:
114+
os_ver_major:
115+
value: const_size_version_info.major
116+
os_ver_minor:
117+
value: const_size_version_info.minor
118+
os_build:
119+
value: const_size_version_info.build
120+
os_platform:
121+
value: const_size_version_info.platform
119122
service_pack:
120123
io: _root._io
121124
pos: ofs_service_pack

‎windows/windows_suite_mask.ksy‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
meta:
2+
id: windows_suite_mask
3+
title: Windows suite mask bit flags
4+
license: Unlicense
5+
endian: le
6+
bit-endian: le
7+
doc: |
8+
A structure describing Windows feature suite. By default parses 4 bytes. Set `size: 2` to parse the basic version only.
9+
doc-ref:
10+
- https://github.com/mirror/mingw-w64/blob/adfc6f4f73cc9de26007e7879422d5d3d9ffbfa4/mingw-w64-headers/include/ntdef.h#L799-L817
11+
- https://github.com/reactos/reactos/blob/2204695f0a87741b9b6224625a4707e59b9c9995/sdk/include/xdk/ntbasedef.h#L810-L827
12+
- https://github.com/DynamoRIO/drmemory/blob/d4b9a40c6f75ad0e7a03dccebb492876d866acb1/drstrace/drstrace_named_consts.c#L107-L127
13+
- https://github.com/hfiref0x/WinObjEx64/blob/71d340be5effe2b99d95b686105349972764f061/Source/WinObjEx64/extras/extrasUSD.c#L95-L115
14+
- https://learn.microsoft.com/en-us/windows/win32/sysinfo/rtlgetsuitemask
15+
- https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_system_info
16+
- https://learn.microsoft.com/en-us/windows-hardware/drivers/install/inf-manufacturer-section
17+
18+
-orig-id:
19+
- wSuiteMask
20+
- SuiteMask
21+
22+
seq:
23+
- id: basic
24+
type: basic
25+
- id: extended
26+
type: extended
27+
if: _io.size > sizeof<basic>
28+
29+
types:
30+
basic:
31+
meta:
32+
bit-endian: le
33+
doc: first 2 bytes (lower half of u4le)
34+
seq:
35+
- id: small_business # 01
36+
-orig-id: VER_SUITE_SMALLBUSINESS
37+
type: b1
38+
- id: enterprise # 02
39+
-orig-id: VER_SUITE_ENTERPRISE
40+
type: b1
41+
- id: back_office # 04
42+
-orig-id: VER_SUITE_BACKOFFICE
43+
type: b1
44+
- id: communications # 08
45+
-orig-id: VER_SUITE_COMMUNICATIONS
46+
type: b1
47+
48+
- id: terminal # 10
49+
-orig-id: VER_SUITE_TERMINAL
50+
type: b1
51+
52+
- id: small_business_restricted # 20
53+
-orig-id: VER_SUITE_SMALLBUSINESS_RESTRICTED
54+
type: b1
55+
- id: embedded_nt # 40
56+
-orig-id: VER_SUITE_EMBEDDEDNT
57+
type: b1
58+
- id: data_center # 80
59+
-orig-id: VER_SUITE_DATACENTER
60+
type: b1
61+
62+
- id: single_user_ts # 100
63+
-orig-id: VER_SUITE_SINGLEUSERTS
64+
type: b1
65+
66+
- id: personal # 200
67+
-orig-id: VER_SUITE_PERSONAL
68+
type: b1
69+
- id: blade # 400
70+
-orig-id:
71+
- VER_SUITE_BLADE
72+
- VER_SUITE_SERVERAPPLIANCE
73+
type: b1
74+
75+
- id: embedded_restricted # 800
76+
-orig-id: VER_SUITE_EMBEDDED_RESTRICTED
77+
type: b1
78+
79+
- id: security_appliance # 1000
80+
-orig-id: VER_SUITE_SECURITY_APPLIANCE
81+
type: b1
82+
83+
- id: storage_server # 2000
84+
-orig-id: VER_SUITE_STORAGE_SERVER
85+
type: b1
86+
- id: compute_server # 4000
87+
-orig-id: VER_SUITE_COMPUTE_SERVER
88+
type: b1
89+
- id: home_server # 8000
90+
-orig-id: VER_SUITE_WH_SERVER
91+
type: b1
92+
93+
extended:
94+
meta:
95+
bit-endian: le
96+
doc: last 2 bytes (upper half of u4le)
97+
seq:
98+
- id: unkn0 # 0001_0000
99+
type: b1
100+
- id: multi_user_ts # 0002_0000
101+
-orig-id: VER_SUITE_MULTIUSERTS
102+
type: b1
103+
- id: unkn1
104+
type: b6
105+
106+
- id: unkn2
107+
type: b6
108+
- id: workstation_nt # 0x4000_0000
109+
-orig-id: VER_WORKSTATION_NT
110+
type: b1
111+
- id: server_nt # 0x8000_0000
112+
-orig-id: VER_SERVER_NT
113+
type: b1

‎windows/windows_version_info.ksy‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
meta:
2+
id: windows_version_info
3+
title: Windows OSVERSIONINFO(EX)?[AW] structure
4+
license: Unlicense
5+
endian: le
6+
imports:
7+
- /windows/windows_suite_mask
8+
doc: |
9+
A structure describing Windows OS edition.
10+
doc-ref:
11+
- https://github.com/reactos/reactos/blob/01eb9ba8de4bed03cd67049b158acb3faec5dc8b/sdk/include/xdk/rtltypes.h#L236-L296
12+
- https://learn.microsoft.com/en-us/windows-hardware/drivers/install/combining-platform-extensions-with-operating-system-versions
13+
- https://learn.microsoft.com/en-us/windows-hardware/drivers/install/inf-manufacturer-section
14+
- https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_system_info
15+
- https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-osversioninfoa
16+
- https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-osversioninfow
17+
- https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_osversioninfoexw
18+
- https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-verifyversioninfoa
19+
20+
-orig-id:
21+
- _OSVERSIONINFOA
22+
- OSVERSIONINFOA
23+
- _OSVERSIONINFOEXA
24+
- OSVERSIONINFOEXA
25+
- _OSVERSIONINFOW
26+
- OSVERSIONINFOW
27+
- _OSVERSIONINFOEXW
28+
- OSVERSIONINFOEXW
29+
30+
instances:
31+
csd_version_size:
32+
value: 128
33+
csd_version_char_size:
34+
value: csd_version_size
35+
csd_version_wchar_size:
36+
value: csd_version_size * 2
37+
basic_char_size: # 148
38+
value: size._sizeof + sizeof<internal::basic> + csd_version_char_size
39+
extended_char_size: # 156
40+
value: basic_char_size + sizeof<internal::extended>
41+
basic_wchar_size: # 532
42+
value: size._sizeof + sizeof<internal::basic> + csd_version_wchar_size
43+
extended_wchar_size: # 540
44+
value: basic_wchar_size + sizeof<internal::extended>
45+
46+
seq:
47+
- id: size
48+
-orig-id: dwOSVersionInfoSize
49+
type: u4
50+
valid:
51+
any-of:
52+
- basic_char_size
53+
- extended_char_size
54+
- basic_wchar_size
55+
- extended_wchar_size
56+
- id: sized
57+
size: size - size._sizeof
58+
type:
59+
switch-on: size
60+
cases:
61+
basic_char_size: internal(false, false)
62+
extended_char_size: internal(false, true)
63+
basic_wchar_size: internal(true, false)
64+
extended_wchar_size: internal(true, true)
65+
66+
types:
67+
internal:
68+
params:
69+
- id: is_wide
70+
type: bool
71+
- id: is_extended
72+
type: bool
73+
seq:
74+
- id: basic
75+
type: basic
76+
- id: csd_version_wchar
77+
-orig-id: szCSDVersion
78+
type: str
79+
encoding: utf-16
80+
size: _root.csd_version_wchar_size
81+
if: is_wide
82+
- id: csd_version_char
83+
-orig-id: szCSDVersion
84+
type: str
85+
encoding: ascii
86+
size: _root.csd_version_char_size
87+
if: not is_wide
88+
- id: extended
89+
type: extended
90+
if: is_extended
91+
instances:
92+
csd_version:
93+
value: is_wide?csd_version_wchar:csd_version_char
94+
types:
95+
basic:
96+
seq:
97+
- id: major
98+
-orig-id:
99+
- dwMajorVersion
100+
- MajorVersion
101+
type: u4
102+
- id: minor
103+
-orig-id:
104+
- dwMinorVersion
105+
- MinorVersion
106+
type: u4
107+
- id: build
108+
-orig-id:
109+
- dwBuildNumber
110+
- BuildNumber
111+
type: u4
112+
- id: platform
113+
-orig-id:
114+
- dwPlatformId
115+
- PlatformId
116+
type: u4
117+
enum: platform
118+
enums:
119+
platform:
120+
0:
121+
id: win32s
122+
-orig-id: VER_PLATFORM_WIN32s
123+
doc: 3.1
124+
1:
125+
id: windows
126+
-orig-id: VER_PLATFORM_WIN32_WINDOWS
127+
doc: 95 to ME
128+
2:
129+
id: win32_nt
130+
-orig-id: VER_PLATFORM_WIN32_NT
131+
doc: 2000 to 7
132+
extended:
133+
seq:
134+
- id: service_pack_major
135+
-orig-id: wServicePackMajor
136+
type: u2
137+
- id: service_pack_minor
138+
-orig-id: wServicePackMinor
139+
type: u2
140+
- id: suite_mask
141+
-orig-id: wSuiteMask
142+
size: 2
143+
type: windows_suite_mask
144+
- id: product_type
145+
-orig-id: wProductType
146+
type: u1
147+
enum: product_type
148+
- id: reserved
149+
-orig-id: wReserved
150+
type: u1
151+
enums:
152+
product_type:
153+
1:
154+
id: nt_workstation
155+
-orig-id: VER_NT_WORKSTATION
156+
2:
157+
id: nt_domain_controller
158+
-orig-id: VER_NT_DOMAIN_CONTROLLER
159+
3:
160+
id: nt_server
161+
-orig-id: VER_NT_SERVER
162+
163+
enums:
164+
verify_type_mask: # dwTypeMask argument of VerifyVersionInfoA. The names must match to the ones in internal::basic
165+
0x0000001:
166+
id: minor
167+
-orig-id: VER_MINORVERSION
168+
0x0000002:
169+
id: major
170+
-orig-id: VER_MAJORVERSION
171+
0x0000004:
172+
id: build
173+
-orig-id: VER_BUILDNUMBER
174+
0x0000008:
175+
id: platform_id
176+
-orig-id: VER_PLATFORMID
177+
0x0000010:
178+
id: service_pack_minor
179+
-orig-id: VER_SERVICEPACKMINOR
180+
0x0000020:
181+
id: service_pack_major
182+
-orig-id: VER_SERVICEPACKMAJOR
183+
0x0000040:
184+
id: suite_mask
185+
-orig-id: VER_SUITENAME
186+
0x0000080:
187+
id: product_type
188+
-orig-id: VER_PRODUCT_TYPE

0 commit comments

Comments
 (0)