[fireball] 36718: Daniel Zimmerman <[e-mail]> - Implement MmGetFileNameForAddress (with the good description written previously). Testcased with OllyDbg and Syser (with the patch from bug 3454) when try to attach to a process. See issue #3690 for more details.

Author: fireball
Date: Sat Oct 11 10:16:28 2008
New Revision: 36718
URL: http://svn.reactos.org/svn/reactos?rev=36718&view=rev
Log:
Daniel Zimmerman <netzimme(a)aim.com>
- Implement MmGetFileNameForAddress (with the good description written previously).
Testcased with OllyDbg and Syser (with the patch from bug 3454) when try to attach to a
process.
See issue #3690 for more details.
Modified:
    trunk/reactos/ntoskrnl/mm/section.c
Modified: trunk/reactos/ntoskrnl/mm/section.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/mm/section.c?rev=…
==============================================================================
--- trunk/reactos/ntoskrnl/mm/section.c [iso-8859-1] (original)
+++ trunk/reactos/ntoskrnl/mm/section.c [iso-8859-1] Sat Oct 11 10:16:28 2008
@@ -150,18 +150,59 @@
 MmGetFileNameForAddress(IN PVOID Address,
                         OUT PUNICODE_STRING ModuleName)
 {
-    /*
-     * FIXME: TODO.
-     * Filip says to get the MM_AVL_TABLE from EPROCESS,
-     * then use the MmMarea routines to locate the Marea that
-     * corresponds to the address. Then make sure it's a section
-     * view type (MEMORY_AREA_SECTION_VIEW) and use the marea's
-     * per-type union to get the .u.SectionView.Section pointer to
-     * the SECTION_OBJECT. Then we can use MmGetFileNameForSection
-     * to get the full filename.
-     */
-    RtlCreateUnicodeString(ModuleName, L"C:\\ReactOS\\system32\\ntdll.dll");
-    return STATUS_SUCCESS;
+   PROS_SECTION_OBJECT Section;
+   PMEMORY_AREA MemoryArea;
+   PMM_AVL_TABLE AddressSpace;
+   POBJECT_NAME_INFORMATION ModuleNameInformation;
+   NTSTATUS Status = STATUS_ADDRESS_NOT_ASSOCIATED;
+
+   /* Get the MM_AVL_TABLE from EPROCESS */
+   if (Address >= MmSystemRangeStart)
+   {
+      AddressSpace = MmGetKernelAddressSpace();
+   }
+   else
+   {
+      AddressSpace = &PsGetCurrentProcess()->VadRoot;
+   }
+
+   /* Lock address space */
+   MmLockAddressSpace(AddressSpace);
+
+   /* Locate the memory area for the process by address */
+   MemoryArea = MmLocateMemoryAreaByAddress(AddressSpace, Address);
+
+   /* Make sure it's a section view type */
+   if ((MemoryArea != NULL) && (MemoryArea->Type == MEMORY_AREA_SECTION_VIEW))
+   {
+      /* Get the section pointer to the SECTION_OBJECT */
+      Section = MemoryArea->Data.SectionData.Section;
+
+      /* Unlock address space */
+      MmUnlockAddressSpace(AddressSpace);
+
+      /* Get the filename of the section */
+      Status = MmGetFileNameForSection(Section,&ModuleNameInformation);
+
+      if (NT_SUCCESS(Status))
+      {
+         /* Init modulename */
+         RtlCreateUnicodeString(ModuleName,
+                                ModuleNameInformation->Name.Buffer);
+
+         /* Free temp taged buffer from MmGetFileNameForSection() */
+         ExFreePoolWithTag(ModuleNameInformation, TAG('M', 'm', '
', ' '));
+         DPRINT("Found ModuleName %S by address %p\n",
+                ModuleName->Buffer,Address);
+      }
+   }
+   else
+   {
+      /* Unlock address space */
+      MmUnlockAddressSpace(AddressSpace);
+   }
+
+   return Status;
 }
 /* Note: Mmsp prefix denotes "Memory Manager Section Private". */