test: dbgk.h File Reference

Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

# dbgk.h File Reference

Go to the source code of this file.

## Functions

VOID | DbgkCreateThread (PVOID StartAddress)
VOID | DbgkExitThread (NTSTATUS ExitStatus)
VOID | DbgkExitProcess (NTSTATUS ExitStatus)
VOID | DbgkMapViewOfSection (IN HANDLE SectionHandle, IN PVOID BaseAddress, IN ULONG SectionOffset, IN ULONG_PTR ViewSize)
VOID | DbgkUnMapViewOfSection (IN PVOID BaseAddress)
BOOLEAN | DbgkForwardException (IN PEXCEPTION_RECORD ExceptionRecord, IN BOOLEAN DebugException, IN BOOLEAN SecondChance)

## Function Documentation

VOID DbgkCreateThread | ( | PVOID | StartAddress | ) |

Definition at line 211 of file dbgkproc.c.

References _EPROCESS::CreateProcessReported, DbgkpSectionHandleToFileHandle(), DbgkpSendApiMessage(), _ETHREAD::DeadThread, _EPROCESS::DebugPort, EXCEPTION_EXECUTE_HANDLER, ExFreePool(), FALSE, FileName, IMAGE_ADDRESSING_MODE_32BIT, IMAGE_INFO, _IMAGE_INFO::ImageAddressingMode, _IMAGE_INFO::ImageBase, _IMAGE_INFO::ImageSectionNumber, _IMAGE_INFO::ImageSelector, _IMAGE_INFO::ImageSize, KernelMode, L, MmGetFileNameForSection(), NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, _EPROCESS::Pcb, _IMAGE_INFO::Properties, PsCallImageNotifyRoutines(), PsGetCurrentProcess, PsGetCurrentThread, PsImageNotifyEnabled, PsLockProcess(), PsLockWaitForever, PsNtDllPathName, PsSystemDllBase, PsUnlockProcess(), RtlAnsiStringToUnicodeString(), RtlFreeUnicodeString(), RtlImageNtHeader(), RtlInitUnicodeString(), _EPROCESS::SectionBaseAddress, _EPROCESS::SectionHandle, Status, TRUE, _EPROCESS::UniqueProcessId, _KPROCESS::UserTime, and ZwOpenFile().

Referenced by PspUserThreadStartup().

    00217                    :
    00218
    00219     This function is called when a new thread begins to execute. If the
    00220     thread has an associated DebugPort, then a message is sent thru the
    00221     port.
    00222
    00223     If this thread is the first thread in the process, then this event
    00224     is translated into a CreateProcessInfo message.
    00225
    00226     If a message is sent, then while the thread is awaiting a reply,
    00227     all other threads in the process are suspended.
    00228
    00229 Arguments:
    00230
    00231     StartAddress - Supplies the start address for the thread that is
    00232         starting.
    00233
    00234 Return Value:
    00235
    00236     None.
    00237
    00238 --*/
    00239
    00240 {
    00241     PVOID Port;
    00242     DBGKM_APIMSG m;
    00243     PDBGKM_CREATE_THREAD CreateThreadArgs;
    00244     PDBGKM_CREATE_PROCESS CreateProcessArgs;
    00245     PETHREAD Thread;
    00246     PEPROCESS Process;
    00247     PDBGKM_LOAD_DLL LoadDllArgs;
    00248     NTSTATUS Status;
    00249     OBJECT_ATTRIBUTES Obja;
    00250     IO_STATUS_BLOCK IoStatusBlock;
    00251     PIMAGE_NT_HEADERS NtHeaders;
    00252
    00253     PAGED_CODE();
    00254
    00255     Process = PsGetCurrentProcess();
    00256
    00257     Port = PsGetCurrentThread()->HideFromDebugger ? NULL : Process->DebugPort;
    00258
    00259     if ( PsImageNotifyEnabled && !Process->Pcb.UserTime) {
    00260         IMAGE_INFO ImageInfo;
    00261         PIMAGE_NT_HEADERS NtHeaders;
    00262         ANSI_STRING FileName;
    00263         UNICODE_STRING UnicodeFileName;
    00264         PUNICODE_STRING pUnicodeFileName;
    00265
    00266         //
    00267         // notification of main .exe
    00268         //
    00269         ImageInfo.Properties = 0;
    00270         ImageInfo.ImageAddressingMode = IMAGE_ADDRESSING_MODE_32BIT;
    00271         ImageInfo.ImageBase = Process->SectionBaseAddress;
    00272         ImageInfo.ImageSize = 0;
    00273
    00274         try {
    00275             NtHeaders = RtlImageNtHeader(Process->SectionBaseAddress);
    00276
    00277             if ( NtHeaders ) {
    00278                 ImageInfo.ImageSize = NtHeaders->OptionalHeader.SizeOfImage;
    00279                 }
    00280             }
    00281         except(EXCEPTION_EXECUTE_HANDLER) {
    00282             ImageInfo.ImageSize = 0;
    00283         }
    00284         ImageInfo.ImageSelector = 0;
    00285         ImageInfo.ImageSectionNumber = 0;
    00286
    00287         pUnicodeFileName = NULL;
    00288         Status = MmGetFileNameForSection(Process->SectionHandle, (PSTRING)&FileName);
    00289         if ( NT_SUCCESS(Status) ) {
    00290             Status = RtlAnsiStringToUnicodeString(&UnicodeFileName,&FileName,TRUE);
    00291             ExFreePool(FileName.Buffer);
    00292             if ( NT_SUCCESS(Status) ) {
    00293                 pUnicodeFileName = &UnicodeFileName;
    00294                 }
    00295             }
    00296         PsCallImageNotifyRoutines(
    00297                     pUnicodeFileName,
    00298                     Process->UniqueProcessId,
    00299                     &ImageInfo
    00300                     );
    00301         if ( pUnicodeFileName ) {
    00302             RtlFreeUnicodeString(pUnicodeFileName);
    00303             }
    00304
    00305         //
    00306         // and of ntdll.dll
    00307         //
    00308         ImageInfo.Properties = 0;
    00309         ImageInfo.ImageAddressingMode = IMAGE_ADDRESSING_MODE_32BIT;
    00310         ImageInfo.ImageBase = PsSystemDllBase;
    00311         ImageInfo.ImageSize = 0;
    00312
    00313         try {
    00314             NtHeaders = RtlImageNtHeader(PsSystemDllBase);
    00315             if ( NtHeaders ) {
    00316                 ImageInfo.ImageSize = NtHeaders->OptionalHeader.SizeOfImage;
    00317                 }
    00318             }
    00319         except(EXCEPTION_EXECUTE_HANDLER) {
    00320             ImageInfo.ImageSize = 0;
    00321             }
    00322
    00323         ImageInfo.ImageSelector = 0;
    00324         ImageInfo.ImageSectionNumber = 0;
    00325
    00326         RtlInitUnicodeString(&UnicodeFileName,L"\\SystemRoot\\System32\\ntdll.dll");
    00327         PsCallImageNotifyRoutines(
    00328                     &UnicodeFileName,
    00329                     Process->UniqueProcessId,
    00330                     &ImageInfo
    00331                     );
    00332         }
    00333
    00334
    00335     if ( !Port ) {
    00336
    00337         return;
    00338     }
    00339
    00340     Thread = PsGetCurrentThread();
    00341
    00342     if ( Thread->DeadThread ) {
    00343         return;
    00344     }
    00345
    00346     //
    00347     // To determine if this should be turned into a create process,
    00348     // all threads in the process are suspended. The process list
    00349     // is then examined to see if the curent thread is the only thread
    00350     // on the list. If so, this becomes a create process message
    00351     //
    00352
    00353     PsLockProcess(Process,KernelMode,PsLockWaitForever);
    00354
    00355     //
    00356     // If we are doing a debug attach, then the create process has
    00357     // already occured. If this is the case, then the process has
    00358     // accumulated some time, so set reported to true
    00359     //
    00360
    00361     if ( Process->Pcb.UserTime ) {
    00362         Process->CreateProcessReported = TRUE;
    00363         }
    00364
    00365     if ( Process->CreateProcessReported == FALSE ) {
    00366
    00367         //
    00368         // This is a create process
    00369         //
    00370
    00371         Process->CreateProcessReported = TRUE;
    00372
    00373         CreateThreadArgs = &m.u.CreateProcessInfo.InitialThread;
    00374         CreateThreadArgs->SubSystemKey = 0;
    00375
    00376         CreateProcessArgs = &m.u.CreateProcessInfo;
    00377         CreateProcessArgs->SubSystemKey = 0;
    00378         CreateProcessArgs->FileHandle = DbgkpSectionHandleToFileHandle(
    00379                                             Process->SectionHandle
    00380                                             );
    00381         CreateProcessArgs->BaseOfImage = Process->SectionBaseAddress;
    00382         CreateThreadArgs->StartAddress = NULL;
    00383         CreateProcessArgs->DebugInfoFileOffset = 0;
    00384         CreateProcessArgs->DebugInfoSize = 0;
    00385
    00386         try {
    00387             NtHeaders = RtlImageNtHeader(Process->SectionBaseAddress);
    00388             if ( NtHeaders ) {
    00389                 CreateThreadArgs->StartAddress = (PVOID)(
    00390                     NtHeaders->OptionalHeader.ImageBase +
    00391                     NtHeaders->OptionalHeader.AddressOfEntryPoint);
    00392
    00393                 CreateProcessArgs->DebugInfoFileOffset = NtHeaders->FileHeader.PointerToSymbolTable;
    00394                 CreateProcessArgs->DebugInfoSize = NtHeaders->FileHeader.NumberOfSymbols;
    00395                 }
    00396             }
    00397         except(EXCEPTION_EXECUTE_HANDLER) {
    00398             CreateThreadArgs->StartAddress = NULL;
    00399             CreateProcessArgs->DebugInfoFileOffset = 0;
    00400             CreateProcessArgs->DebugInfoSize = 0;
    00401         }
    00402
    00403         DBGKM_FORMAT_API_MSG(m,DbgKmCreateProcessApi,sizeof(*CreateProcessArgs));
    00404
    00405         PsUnlockProcess(Process);
    00406
    00407         DbgkpSendApiMessage(&m,Port,FALSE);
    00408         ZwClose(CreateProcessArgs->FileHandle);
    00409
    00410         LoadDllArgs = &m.u.LoadDll;
    00411         LoadDllArgs->BaseOfDll = PsSystemDllBase;
    00412         LoadDllArgs->DebugInfoFileOffset = 0;
    00413         LoadDllArgs->DebugInfoSize = 0;
    00414
    00415         try {
    00416             NtHeaders = RtlImageNtHeader(PsSystemDllBase);
    00417             if ( NtHeaders ) {
    00418                 LoadDllArgs->DebugInfoFileOffset = NtHeaders->FileHeader.PointerToSymbolTable;
    00419                 LoadDllArgs->DebugInfoSize = NtHeaders->FileHeader.NumberOfSymbols;
    00420                 }
    00421             }
    00422         except(EXCEPTION_EXECUTE_HANDLER) {
    00423             LoadDllArgs->DebugInfoFileOffset = 0;
    00424             LoadDllArgs->DebugInfoSize = 0;
    00425         }
    00426
    00427         //
    00428         // Send load dll section for NT dll !
    00429         //
    00430
    00431         InitializeObjectAttributes(
    00432             &Obja,
    00433             &PsNtDllPathName,
    00434             OBJ_CASE_INSENSITIVE,
    00435             NULL,
    00436             NULL
    00437             );
    00438
    00439         Status = ZwOpenFile(
    00440                     &LoadDllArgs->FileHandle,
    00441                     (ACCESS_MASK)(GENERIC_READ | SYNCHRONIZE),
    00442                     &Obja,
    00443                     &IoStatusBlock,
    00444                     FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE,
    00445                     FILE_SYNCHRONOUS_IO_NONALERT
    00446                     );
    00447
    00448         if ( NT_SUCCESS(Status) ) {
    00449             DBGKM_FORMAT_API_MSG(m,DbgKmLoadDllApi,sizeof(*LoadDllArgs));
    00450             DbgkpSendApiMessage(&m,Port,TRUE);
    00451         }
    00452         ZwClose(LoadDllArgs->FileHandle);
    00453
    00454     } else {
    00455
    00456         CreateThreadArgs = &m.u.CreateThread;
    00457         CreateThreadArgs->SubSystemKey = 0;
    00458         CreateThreadArgs->StartAddress = StartAddress;
    00459
    00460         DBGKM_FORMAT_API_MSG(m,DbgKmCreateThreadApi,sizeof(*CreateThreadArgs));
    00461
    00462         PsUnlockProcess(Process);
    00463
    00464         DbgkpSendApiMessage(&m,Port,TRUE);
    00465     }
    00466
    00467
    00468 }

VOID DbgkExitProcess | ( | NTSTATUS | ExitStatus | ) |

Definition at line 528 of file dbgkproc.c.

References DbgkpSendApiMessage(), _EPROCESS::DebugPort, FALSE, KeQuerySystemTime(), NULL, PAGED_CODE, PsGetCurrentProcess, and PsGetCurrentThread.

Referenced by PspExitThread().

    00534                    :
    00535
    00536     This function is called when a process terminates. The address
    00537     space of the process is still intact, but no threads exist in
    00538     the process.
    00539
    00540 Arguments:
    00541
    00542     ExitStatus - Supplies the ExitStatus of the exiting process.
    00543
    00544 Return Value:
    00545
    00546     None.
    00547
    00548 --*/
    00549
    00550 {
    00551     PVOID Port;
    00552     DBGKM_APIMSG m;
    00553     PDBGKM_EXIT_PROCESS args;
    00554     PEPROCESS Process;
    00555
    00556     PAGED_CODE();
    00557
    00558     Process = PsGetCurrentProcess();
    00559     Port = PsGetCurrentThread()->HideFromDebugger ? NULL : Process->DebugPort;
    00560
    00561     if ( !Port ) {
    00562         return;
    00563     }
    00564
    00565     if ( PsGetCurrentThread()->DeadThread ) {
    00566         return;
    00567     }
    00568
    00569     //
    00570     // this ensures that other timed lockers of the process will bail
    00571     // since this call is done while holding the process lock, and lock duration
    00572     // is controlled by debugger
    00573     //
    00574     KeQuerySystemTime(&PsGetCurrentProcess()->ExitTime);
    00575
    00576     args = &m.u.ExitProcess;
    00577     args->ExitStatus = ExitStatus;
    00578
    00579     DBGKM_FORMAT_API_MSG(m,DbgKmExitProcessApi,sizeof(*args));
    00580
    00581     DbgkpSendApiMessage(&m,Port,FALSE);
    00582
    00583 }

VOID DbgkExitThread | ( | NTSTATUS | ExitStatus | ) |

Definition at line 471 of file dbgkproc.c.

References DbgkpResumeProcess(), DbgkpSendApiMessage(), DbgkpSuspendProcess(), _EPROCESS::DebugPort, FALSE, NULL, PAGED_CODE, PsGetCurrentProcess, PsGetCurrentThread, and TRUE.

Referenced by PspExitThread().

    00477                    :
    00478
    00479     This function is called when a new thread terminates. At this
    00480     point, the thread will no longer execute in user-mode. No other
    00481     exit processing has occured.
    00482
    00483     If a message is sent, then while the thread is awaiting a reply,
    00484     all other threads in the process are suspended.
    00485
    00486 Arguments:
    00487
    00488     ExitStatus - Supplies the ExitStatus of the exiting thread.
    00489
    00490 Return Value:
    00491
    00492     None.
    00493
    00494 --*/
    00495
    00496 {
    00497     PVOID Port;
    00498     DBGKM_APIMSG m;
    00499     PDBGKM_EXIT_THREAD args;
    00500     PEPROCESS Process;
    00501
    00502     PAGED_CODE();
    00503
    00504     Process = PsGetCurrentProcess();
    00505     Port = PsGetCurrentThread()->HideFromDebugger ? NULL : Process->DebugPort;
    00506
    00507     if ( !Port ) {
    00508         return;
    00509     }
    00510
    00511     if ( PsGetCurrentThread()->DeadThread ) {
    00512         return;
    00513     }
    00514
    00515     args = &m.u.ExitThread;
    00516     args->ExitStatus = ExitStatus;
    00517
    00518     DBGKM_FORMAT_API_MSG(m,DbgKmExitThreadApi,sizeof(*args));
    00519
    00520     DbgkpSuspendProcess(TRUE);
    00521
    00522     DbgkpSendApiMessage(&m,Port,FALSE);
    00523
    00524     DbgkpResumeProcess(TRUE);
    00525 }

BOOLEAN DbgkForwardException | ( | IN PEXCEPTION_RECORD | ExceptionRecord,
|  | IN BOOLEAN | DebugException,
|  | IN BOOLEAN | SecondChance
| ) |

Definition at line 99 of file dbgkport.c.

References DbgkpSendApiMessage(), _EPROCESS::DebugPort, _EPROCESS::ExceptionPort, FALSE, NT_SUCCESS, NTSTATUS(), NULL, PAGED_CODE, PsGetCurrentProcess, PsGetCurrentThread, and TRUE.

Referenced by KiDispatchException().

    00107                    :
    00108
    00109     This function is called forward an exception to the calling process's
    00110     debug or subsystem exception port.
    00111
    00112 Arguments:
    00113
    00114     ExceptionRecord - Supplies a pointer to an exception record.
    00115
    00116     DebugException - Supplies a boolean variable that specifies whether
    00117         this exception is to be forwarded to the process's
    00118         DebugPort(TRUE), or to its ExceptionPort(FALSE).
    00119
    00120 Return Value:
    00121
    00122     TRUE - The process has a DebugPort or an ExceptionPort, and the reply
    00123         received from the port indicated that the exception was handled.
    00124
    00125     FALSE - The process either does not have a DebugPort or
    00126         ExceptionPort, or the process has a port, but the reply received
    00127         from the port indicated that the exception was not handled.
    00128
    00129 --*/
    00130
    00131 {
    00132     PEPROCESS Process;
    00133     PVOID Port;
    00134     DBGKM_APIMSG m;
    00135     PDBGKM_EXCEPTION args;
    00136     NTSTATUS st;
    00137
    00138     PAGED_CODE();
    00139
    00140     args = &m.u.Exception;
    00141
    00142     //
    00143     // Initialize the debug LPC message with default infomaation.
    00144     //
    00145
    00146     DBGKM_FORMAT_API_MSG(m,DbgKmExceptionApi,sizeof(*args));
    00147
    00148     //
    00149     // Get the address of the destination LPC port.
    00150     //
    00151
    00152     Process = PsGetCurrentProcess();
    00153     if (DebugException) {
    00154         Port = PsGetCurrentThread()->HideFromDebugger ? NULL : Process->DebugPort;
    00155
    00156     } else {
    00157         Port = Process->ExceptionPort;
    00158         m.h.u2.ZeroInit = LPC_EXCEPTION;
    00159     }
    00160
    00161     //
    00162     // If the destination LPC port address is NULL, then return FALSE.
    00163     //
    00164
    00165     if (Port == NULL) {
    00166         return FALSE;
    00167     }
    00168
    00169     //
    00170     // Fill in the remainder of the debug LPC message.
    00171     //
    00172
    00173     args->ExceptionRecord = *ExceptionRecord;
    00174     args->FirstChance = !SecondChance;
    00175
    00176     //
    00177     // Send the debug message to the destination LPC port.
    00178     //
    00179
    00180     st = DbgkpSendApiMessage(&m,Port,DebugException);
    00181
    00182     //
    00183     // If the send was not successful, then return a FALSE indicating that
    00184     // the port did not handle the exception. Otherwise, if the debug port
    00185     // is specified, then look at the return status in the message.
    00186     //
    00187
    00188     if (!NT_SUCCESS(st) ||
    00189         ((DebugException) &&
    00190         (m.ReturnedStatus == DBG_EXCEPTION_NOT_HANDLED || !NT_SUCCESS(m.ReturnedStatus)))) {
    00191         return FALSE;
    00192
    00193     } else {
    00194         return TRUE;
    00195     }
    00196 }
    }

VOID DbgkMapViewOfSection | ( | IN HANDLE | SectionHandle,
|  | IN PVOID | BaseAddress,
|  | IN ULONG | SectionOffset,
|  | IN ULONG_PTR | ViewSize
| ) |

Definition at line 586 of file dbgkproc.c.

References DbgkpSectionHandleToFileHandle(), DbgkpSendApiMessage(), _EPROCESS::DebugPort, EXCEPTION_EXECUTE_HANDLER, KernelMode, NULL, PAGED_CODE, PsGetCurrentProcess, PsGetCurrentThread, RtlImageNtHeader(), and TRUE.

Referenced by NtMapViewOfSection().

    00595                    :
    00596
    00597     This function is called when the current process successfully
    00598     maps a view of an image section. If the process has an associated
    00599     debug port, then a load dll message is sent.
    00600
    00601 Arguments:
    00602
    00603     SectionHandle - Supplies a handle to the section mapped by the
    00604         process.
    00605
    00606     BaseAddress - Supplies the base address of where the section is
    00607         mapped in the current process address space.
    00608
    00609     SectionOffset - Supplies the offset in the section where the
    00610         processes mapped view begins.
    00611
    00612     ViewSize - Supplies the size of the mapped view.
    00613
    00614 Return Value:
    00615
    00616     None.
    00617
    00618 --*/
    00619
    00620 {
    00621
    00622     PVOID Port;
    00623     DBGKM_APIMSG m;
    00624     PDBGKM_LOAD_DLL LoadDllArgs;
    00625     PEPROCESS Process;
    00626     PIMAGE_NT_HEADERS NtHeaders;
    00627
    00628     PAGED_CODE();
    00629
    00630     Process = PsGetCurrentProcess();
    00631
    00632     Port = PsGetCurrentThread()->HideFromDebugger ? NULL : Process->DebugPort;
    00633
    00634     if ( !Port || KeGetPreviousMode() == KernelMode ) {
    00635         return;
    00636     }
    00637
    00638     LoadDllArgs = &m.u.LoadDll;
    00639     LoadDllArgs->FileHandle = DbgkpSectionHandleToFileHandle(SectionHandle);
    00640     LoadDllArgs->BaseOfDll = BaseAddress;
    00641     LoadDllArgs->DebugInfoFileOffset = 0;
    00642     LoadDllArgs->DebugInfoSize = 0;
    00643
    00644     try {
    00645         NtHeaders = RtlImageNtHeader(BaseAddress);
    00646         if ( NtHeaders ) {
    00647             LoadDllArgs->DebugInfoFileOffset = NtHeaders->FileHeader.PointerToSymbolTable;
    00648             LoadDllArgs->DebugInfoSize = NtHeaders->FileHeader.NumberOfSymbols;
    00649             }
    00650         }
    00651     except(EXCEPTION_EXECUTE_HANDLER) {
    00652         LoadDllArgs->DebugInfoFileOffset = 0;
    00653         LoadDllArgs->DebugInfoSize = 0;
    00654     }
    00655
    00656     DBGKM_FORMAT_API_MSG(m,DbgKmLoadDllApi,sizeof(*LoadDllArgs));
    00657
    00658     DbgkpSendApiMessage(&m,Port,TRUE);
    00659     ZwClose(LoadDllArgs->FileHandle);
    00660
    00661 }

VOID DbgkUnMapViewOfSection | ( | IN PVOID | BaseAddress | ) |

Definition at line 664 of file dbgkproc.c.

References DbgkpSendApiMessage(), _EPROCESS::DebugPort, KernelMode, NULL, PAGED_CODE, PsGetCurrentProcess, PsGetCurrentThread, and TRUE.

Referenced by MmUnmapViewOfSection().

    00670                    :
    00671
    00672     This function is called when the current process successfully
    00673     un maps a view of an image section. If the process has an associated
    00674     debug port, then an "unmap view of section" message is sent.
    00675
    00676 Arguments:
    00677
    00678     BaseAddress - Supplies the base address of the section being
    00679         unmapped.
    00680
    00681 Return Value:
    00682
    00683     None.
    00684
    00685 --*/
    00686
    00687 {
    00688
    00689     PVOID Port;
    00690     DBGKM_APIMSG m;
    00691     PDBGKM_UNLOAD_DLL UnloadDllArgs;
    00692     PEPROCESS Process;
    00693
    00694     PAGED_CODE();
    00695
    00696     Process = PsGetCurrentProcess();
    00697
    00698     Port = PsGetCurrentThread()->HideFromDebugger ? NULL : Process->DebugPort;
    00699
    00700     if ( !Port || KeGetPreviousMode() == KernelMode ) {
    00701         return;
    00702     }
    00703
    00704     UnloadDllArgs = &m.u.UnloadDll;
    00705     UnloadDllArgs->BaseAddress = BaseAddress;
    00706
    00707     DBGKM_FORMAT_API_MSG(m,DbgKmUnloadDllApi,sizeof(*UnloadDllArgs));
    00708
    00709     DbgkpSendApiMessage(&m,Port,TRUE);
    00710
    00711 }
    }