win: Capture some memory pointed at by context

snapshot/win/capture_context_memory.cc

Index: snapshot/win/capture_context_memory.cc
diff --git a/snapshot/win/capture_context_memory.cc b/snapshot/win/capture_context_memory.cc
new file mode 100644
index 0000000000000000000000000000000000000000..9ee46807216fd8c06eee58a6d44587bf904c5f64
--- /dev/null
+++ b/snapshot/win/capture_context_memory.cc
@@ -0,0 +1,90 @@
+// Copyright 2016 The Crashpad Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "snapshot/win/capture_context_memory.h"
+
+#include "snapshot/win/memory_snapshot_win.h"
+#include "snapshot/win/process_reader_win.h"
+
+namespace crashpad {
+namespace internal {
+
+namespace {
+
+void MaybeCaptureMemoryAround(ProcessReaderWin* process_reader,
+                              WinVMAddress address,
+                              PointerVector<MemorySnapshotWin>* into) {
+  if (address > 0x10000) {

[Mark Mentovai, 2016/01/08 22:05:42]

-1 and other high numbers are valid register contents that probably aren’t
pointers too. Maybe we should make sure address is > 0x10000 and <=
max_for_bitness - 0x10000.

[scottmg, 2016/01/08 22:23:28]

Done.

+    const WinVMSize kRegisterByteOffset = 32;
+    const WinVMAddress target = address - kRegisterByteOffset;
+    const WinVMSize size = 128;
+    auto ranges = process_reader->GetProcessInfo().GetReadableRanges(
+        CheckedRange<WinVMAddress, WinVMSize>(target, size));
+    for (const auto& range : ranges) {
+      internal::MemorySnapshotWin* snapshot = new internal::MemorySnapshotWin();
+      snapshot->Initialize(process_reader, range.base(), range.size());
+      into->push_back(snapshot);

[Mark Mentovai, 2016/01/08 22:05:42]

Interesting, so this might miss address but pick up something near address if
address is just outside of a mapped range. I suppose that’s desirable?

[scottmg, 2016/01/08 22:23:28]

Yeah, I'm not sure how useful/likely it really is. If the register is a bad
pointer for an object, maybe it ends up grabbing the last write to a field
somehow.

+    }
+  }
+}
+
+}  // namespace
+
+void CaptureMemoryPointedToByContext(const CPUContext& context,
+                                     ProcessReaderWin* process_reader,
+                                     const ProcessReaderWin::Thread& thread,
+                                     PointerVector<MemorySnapshotWin>* into) {
+#if defined(ARCH_CPU_X86_64)
+  if (context.architecture == kCPUArchitectureX86_64) {
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->rax, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->rbx, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->rcx, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->rdx, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->rdi, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->rsi, into);
+    if (context.x86_64->rbp < thread.stack_region_address ||
+        context.x86_64->rbp >=
+            thread.stack_region_address + thread.stack_region_size) {
+      MaybeCaptureMemoryAround(process_reader, context.x86_64->rbp, into);
+    }
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->r8, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->r9, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->r10, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->r11, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->r12, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->r13, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->r14, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->r15, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86_64->rip, into);
+  } else {
+#endif
+    MaybeCaptureMemoryAround(process_reader, context.x86->eax, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86->ebx, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86->ecx, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86->edx, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86->edi, into);
+    MaybeCaptureMemoryAround(process_reader, context.x86->esi, into);
+    if (context.x86->ebp < thread.stack_region_address ||
+        context.x86->ebp >=
+            thread.stack_region_address + thread.stack_region_size) {
+      MaybeCaptureMemoryAround(process_reader, context.x86->ebp, into);
+    }
+    MaybeCaptureMemoryAround(process_reader, context.x86->eip, into);
+#if defined(ARCH_CPU_X86_64)
+  }
+#endif
+}
+
+}  // namespace internal
+}  // namespace crashpad