markhc/windbg_to_c

Translates WinDbg "dt" structure dump to a C structure

windbg_to_c's Issues

Wrong union processing

Windows 10 RS1 x86:

0: kd> dt nt!_EPROCESS
...
+0x370 AllowedCpuSets : Uint4B
+0x374 DefaultCpuSets : Uint4B
+0x370 AllowedCpuSetsIndirect : Ptr32 Uint4B
+0x374 DefaultCpuSetsIndirect : Ptr32 Uint4B

Result:

ULONG AllowedCpuSets;
ULONG DefaultCpuSets;
Ptr32 Uint4B AllowedCpuSetsIndirect;
Ptr32 Uint4B DefaultCpuSetsIndirect;

Should be:

union
{
    UINT_3264       AllowedCpuSets;
    UINT_3264*      AllowedCpuSetsIndirect;
};
union
{
    UINT_3264       DefaultCpuSets;
    UINT_3264*      DefaultCpuSetsIndirect;
};

eprocess.txt
result.txt

static_assert at the end

I'm suggesting to add a static_assert after generated structure to check it's size.

static_assert(sizeof(BLAH_BLAH_BLAH) == 0x20, "Invalid BLAH_BLAH_BLAH size");

Also, you can use intellectually (somehow) choosen asserts like:

static_assert(FIELD_OFFSET(BLAH_BLAH_BLAH, SomeMember) == 0x18, "Invalid SomeMember offset");

Wrong types

Ptr32 (Ptr64?) should be * after any type. Void should be void/VOID.

Windows 10 RS1 x86 _EPROCESS:
...
Ptr32 Void Win32Process;
Ptr32 _EJOB Job;
Ptr32 Void SectionObject;
Ptr32 Void SectionBaseAddress;
...