_KSPECIAL_REGISTERS
References
http://www.x86.org/secrets/dr7.htm
http://www.x86.org/secrets/opcodes/icebp.htm
http://www.x86.org/articles/pmcr/probemodecontrolregister.htm
Definition
typedef struct _KSPECIAL_REGISTERS
{
union
{
ULONG Cr0;
struct
{
ULONG u00:31;
ULONG Paging:1; // 31
};
} u_cr0;
ULONG Cr2;
//
// Magic Forensic register.
//
ULONG Cr3;
union
{
ULONG Cr4;
struct
{
ULONG u00:4;
ULONG PageSizeExtensions:1; // 4
ULONG PhysicalAddressExtension:1; // 5
};
} u_cr4;
ULONG KernelDr0;
ULONG KernelDr1;
ULONG KernelDr2;
ULONG KernelDr3;
ULONG KernelDr6;
union
{
ULONG KernelDr7;
struct
{
UCHAR LocalDr0:1; // 0
UCHAR GlobalDr0:1; // 1
UCHAR LocalDr1:1; // 2
UCHAR GlobalDr1:1; // 3
UCHAR LocalDr2:1; // 4
UCHAR GlobalDr2:1; // 5
UCHAR LocalDr3:1; // 6
UCHAR GlobalDr3:1; // 7
UCHAR LocalExact:1; // 8
UCHAR GlobalExact:1; // 9
UCHAR Reserved0:2; // 10
/*++
- IceBp 1=INT01 causes emulator to break emulation / 0=CPU handles INT01
Interrupt Redirection = When set, causes the emulator to break execution when any
breakpoint condition occurs. These conditions include debug register breakpoints,
TSS breakpoints, and the undocumented instruction ICEBP.
--*/
UCHAR InterruptRedirection:1; // 12
/*++
- Global Debug. This bit has enjoyed an on-again, off-again relationship with Intel
documenteers. It all depends on which data book you get, and where you look.
If you look in early 80386 data books, it is described. But if you look in the
80386 Programmer's Reference Manual, it is omitted. Suit yourself, Intel.
--*/
UCHAR GlobalDebug:1; // 13
/*++
- TRace1 1=Generate special address cycles after code dis-continuities.
On Pentium, these cycles are called Branch Trace Messages.
Trace1= When set, the CPU generates a special cycle each time a code discontinuity
occurs.
The ICE reads this special cycle and stores it in the trace data. This address helps
the CPU reconstruct code sequences from the trace data -- since all fetch
discontinuity are logged by the setting of this bit. See also Branch Trace Messages
in Pentium TR12.
--*/
UCHAR TRace1:1; // 14
/*++
- Trace2 1=Unknown.
Trace2= I don't know the exact purpose of this bit, but somehow it governs trace collection.
By clearing this bit and resuming emulation (on an ICE) until the trace buffer is full, one
can observe that the ICE is unable to reconstruct the execution trace for many hundreds, and
sometimes thousands of CPU cycles.
--*/
UCHAR TRace2:1; // 15
UCHAR ConditionDr0:2;
UCHAR LenghtDr0:2;
UCHAR ConditionDr1:2;
UCHAR LenghtDr1:2;
UCHAR ConditionDr2:2;
UCHAR LenghtDr2:2;
UCHAR ConditionDr3:2;
UCHAR LenghtDr3:2;
};
};
DESCRIPTOR Gdtr;
DESCRIPTOR Idtr;
USHORT Tr;
USHORT Ldtr;
ULONG Reserved[6];
} KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS;
Sandman framework. (c) 2008. Matthieu Suiche(msuiche [at] gmail.com)