Skip to content

Commit 7f98155

Browse files
Expand-LIST_ENTRY: add -Count, sanity check Blink
This is useful for when you are looking at a corrupt list.
1 parent 1758a37 commit 7f98155

1 file changed

Lines changed: 29 additions & 3 deletions

File tree

DbgProvider/OtherUtils.ps1

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,11 @@ function Expand-LIST_ENTRY
103103

104104
[Parameter( Mandatory = $false, Position = 2 )]
105105
[ValidateNotNullOrEmpty()]
106-
[string] $ListEntryMemberName
106+
[string] $ListEntryMemberName,
107+
108+
# Limit the number of items we return.
109+
[Parameter( Mandatory = $false )]
110+
[int] $Count
107111
)
108112

109113
begin
@@ -161,6 +165,7 @@ function Expand-LIST_ENTRY
161165
{
162166
$headAddr = addrOf $Head
163167

168+
$prevListEntry = $null
164169
$curListEntry = $Head.Flink
165170

166171
[int] $idx = 0
@@ -183,6 +188,28 @@ function Expand-LIST_ENTRY
183188

184189
Write-Output $val
185190

191+
$idx++
192+
193+
if( $prevListEntry )
194+
{
195+
# Sometimes lists are corrupt (or we are looking at junk); sanity
196+
# check the links.
197+
#
198+
# Note that we do this check *after* writing out the bad item, so that
199+
# you can easily look at the bad item.
200+
201+
# TODO: this is obviously not applicable for singly-linked lists...
202+
if( $curListEntry.Blink.DbgGetPointer() -ne $prevListEntry.DbgGetPointer() )
203+
{
204+
Write-Warning "Corrupt linked list detected, at index ${idx}: the current entry's Blink does not point to the previous entry's link."
205+
break
206+
}
207+
}
208+
209+
if( $Count -and ($idx -ge $Count) )
210+
{
211+
break
212+
}
186213

187214
# The $ListEntryMemberName might have dots (".") in it (like
188215
# "Tcb.ThreadListEntry"), so we'll use Invoke-Expression to get what we
@@ -192,8 +219,8 @@ function Expand-LIST_ENTRY
192219
# TODO: Using 'Flink' won't work for singly-linked lists (the link pointer
193220
# in SINGLE_LIST_ENTRY is called 'Next'). We should just switch to just
194221
# follow the pointer at offset 0.
222+
$prevListEntry = $curListEntry
195223
$curListEntry = Invoke-Expression "`$val.$ListEntryMemberName.Flink"
196-
$idx++
197224
}
198225

199226
# If things go badly, this is likely where we find out--$curListEntry will
@@ -208,7 +235,6 @@ function Expand-LIST_ENTRY
208235
$curListEntry ) # TargetObject
209236
$PSCmdlet.ThrowTerminatingError( $er )
210237
}
211-
212238
}
213239
finally { }
214240
} # end 'process' block

0 commit comments

Comments
 (0)