Skip to content

Conversation

@psolvx
Copy link
Contributor

@psolvx psolvx commented Sep 25, 2025

Modified idea from #1824 by @1ndahous3, so most of that pr is included, with some changes.

fill_fmt_args uses parsers specified by:

  • syscall name and argument name
  • argument name
  • argument type

Subkeys from #1850 are used to have a "Arguments" and "Extra" subkeys. Parsers can modify output argument values or add data to "Extra" subkey.

There are 2 boolean options:
--syscall-nested-args - controls if arguments are nested in an "Arguments" subkey
--syscall-dereference-args - controls if argument pointers are dereferenced and enables extra parsers (the goal was for the default setting to leave only parsers corresponding to previous parse_argument and win_extract_string functions, its up to each parser to respect that)

With both of these flags disabled output format should be backwards compatible

New parsers allow for reading:

  • PID from ProcessHandle,
  • TID, PID from ThreadHandle,
  • rip, rcx from NtSetContextThread Context argument
  • eip, eax from NtSetInformationThread Wow64Context argument

This pr is based on #1850 and also #1851 (though this one is not strictly necessary)

@drakvuf-jenkins
Copy link
Collaborator

Can one of the admins verify this patch?

@psolvx psolvx force-pushed the syscall-deref-args-refactor branch from b493c66 to e92e096 Compare September 25, 2025 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants