Windbg javascript engine: Casting from a byte array to a type

Question

So i have the following data structure:

struct A_TYPE {
UINT64 a;
UINT32 b;
UINT32 c[16];
}

and i have a byte array similar with the following code:

var buf = new ArrayBuffer(128);
var numbers = new Uint8Array(buf);
//code that sets the numbers array

Now i want to create a A_TYPE object based on the numbers byte array.

I have tried doing the following but nothing worked:

//attempt 1:
var instantiatedType = host.typeSystem.marshalAs(numbers, srcName, typeName);

//attempt 2:
var type = host.getModuleType(srcName, typeName);
var instantiatedType = type.initialize(numbers) //initialize/constructor was a function i hoped to exist

Any ideas whether this functionality is already implemented? Sounds like a basic feature but i couldn't find it

William Messmer · Accepted Answer · 2022-06-15 13:21:29Z

1

What, may I ask, are you trying to DO with the instance of "A_TYPE" that you create...?

Types which are described by the symbols of what you are debugging only exist at some location IN the target. They can be at some virtual address in the target's address space... or they can be in some register of a thread or stack frame's context. You cannot just "create an instance" of A_TYPE described by symbols from JavaScript data.

You can create use host.createTypedObject method to say "there is an A_TYPE typed object at virtual address 0x1000 (or whatever) in the address space of the target. You can then read/write fields of that object through what you get back from the createTypedObject method call. That said -- if you write -- you are modifying the address space of the target process.

I'll note that things like host.typeSystem.marshalAs are designed to allow you to change how some object exits JavaScript. If, for instance, you bring a native enum value into JavaScript -- it will lose it's "enumness" and just become a number (there are no custom value types in JS). You cannot, therefore create a property that does something like:

// A property accessor on some class which returns a native enum...
get myValue()
{
    return this.someEnum;
}

The moment someEnum enters JavaScript above, it becomes a number... and that number would get returned. If you really wanted an enum to get returned to the caller, you would need to use host.typeSystem.marshalAs to tell the marshaler that this number should be marshaled out of JavaScript as a specifically typed enum and not just a flat number.

UPDATED PER YOUR COMMENT (re decoding an in-memory A_TYPE):

While you cannot create an instance of A_TYPE from synthetic data, there are two ways to present something like the "decoded" type you are talking about. First is just to return a JavaScript object:

function decodeAType(aType)
{
    // your extraction code...
    var buf = new UInt8Array(...);

    // Just return a JavaScript object
    return { a: decoded_a, b: decoded_b, c: buf };
}

That returned object will work in the EE (dx) and can be passed to and used in any other C++ or JavaScript debugger extension. Yes -- it's not a "real type" and can't be used in legacy commands like 'dt', etc... but it's pretty functional.

The second way is to associate a visualizer with A_TYPE which does the decoding and presents the decoded fields:

class __MyATypeVisualizer
{
    get decoded_a() { ... }
    get decoded_b() { ... }
    get decoded_c() { ... }
}

function initializeScript()
{
    //
    // Make __MyATypeVisualizer the canonical visualizer for A_TYPE.
    // Any time it's displayed in the locals window or 'dx', the fields
    // in __MyATypeVisualizer will be shown instead of the native fields.
    // You can also use typeSignatureExtension below if you want those
    // fields to be added instead of displayed in lieu of the native ones.
    //
    return [new host.typeSignatureRegistration(__MyATypeVisualizer, "A_TYPE")];
}

Here, the original A_TYPE can be passed around and used like a regular typed object... but when DISPLAYED in the locals or watch window... or in the console via dx, you'll see the added/visualized decoded fields. If the object is passed to another C++/JavaScript debugger extension, the fields added/visualized by __MyATypeVisualizer can be used just like the native ones... The same goes for the expression evaluator in 'dx'.

I hope that helps...

edited Jun 15, 2022 at 13:21

answered Jun 10, 2022 at 14:49

William Messmer

3661 silver badge3 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

xar3 Over a year ago

so i have an instance of A_TYPE already in memory. But the problem is that that this structure is encoded, so currently i create a typed object, decode it and then do bit extraction to recreate the original A_TYPE

William Messmer Over a year ago

I updated the reply above to give you some ideas around how to get something similar to what you want. You still can't create an instance of A_TYPE from synthetic data... but you can do things to see the decoded data. I hope that helps...

xar3 Over a year ago

thanks for the suggestions, actually the first way is what i did, but you can imagine that it quickly gets out of hand with structures that have more fields. The second suggestion is also nice, but i want to access those decoded fields within js which i assume won't be possible

William Messmer Over a year ago

If you are talking about the "just return a JavaScript object" style of object, it doesn't have a type name and you can't use it in a cast like that. There are two ways you can create it in the EE though. First is to define a JS function which creates it and then register a function alias (host.functionAlias in initializeScript). You can then do "dx @$myfunc(<args>) to create (or use the long winded @$scriptContents.myFunc) name without the alias).

William Messmer Over a year ago

Second way is to make the object (de)constructable and use "dx @$create(<name>, <args>)". That involves: 1) A namedModelRegistration in initializeScript for your class, 2) A class method getConstructableModelName which returns that registration name, 3) A class method constructInstance(<args>) which creates an instance of your object from <args>, 4) Optionally: a class method deconstructInstance which returns an array of arguments which, if passed to constructInstance will recreate the object. Doing this effectively makes the object (de)serializable which will also be used for DML links.

|

Collectives™ on Stack Overflow

Windbg javascript engine: Casting from a byte array to a type

1 Answer 1

8 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Your Answer

Sign up or log in

Post as a guest

Related