From:	CRDGW2::CRDGW2::MRGATE::"SMTP::CRVAX.SRI.COM::RELAY-INFO-VAX"  6-OCT-1989 09:55
To:	MRGATE::"ARISIA::EVERHART"
Subj:	PROCESS_DUMP (DUMP/PROCESS/IDENT=xxx utility) 1/4

Message-Id:  <8910061254.AA01779@crdgw1.ge.com>
Received: From NSFNET-RELAY.AC.UK by CRVAX.SRI.COM with TCP; Fri,  6 OCT 89 05:20:43 PDT
Received: from ncdlab.ulcc.ac.uk by NSFnet-Relay.AC.UK   via Janet with NIFTP
           id aa04040; 6 Oct 89 12:08 BST
Date:           Fri, 6 Oct 89  12:08 BST
From: Nick de Smith <"PSI%JANET.000000000040::NICK%ncdlab.ulcc.ac.uk"@NSFnet-Relay.AC.UK>
To: INFO-VAX <@NSFnet-Relay.AC.UK:INFO-VAX@crvax.sri.com>
Subject:        PROCESS_DUMP (DUMP/PROCESS/IDENT=xxx utility) 1/4

Hi,

> BTW is anyone interested in a DUMP/PROCESS/IDENT=xxx utility,...

I set the limit at 20 requests, and it has passed. I am therefore submitting
PROCESS_DUMP.% (in 4 parts) to the net.
Part 1 is enclosed after the signature in this message, other parts to follow.

Please let me know if there are any problems (It should not crash a machine if
the caveats noted in PDUMP.MAR are followed). Be aware that it uses CMKRNL, so
play safe. I know I would. Please let me know if you find it useful - I may even
get motivated to develop a few other tools into distributable shape. There is
life outside the USA, although in our bit of the UK... :-).

rgds.

nick	(my mail address in in the signature, NOT this mail message's header).
	(this may change, I hope to be NICK@ATG.CO.UK in a while).

=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
| Nick de Smith                  |  Voice:   +44 892 511000         |
| Applied Telematics Group Ltd   |  PSImail: +234213300154::NICK    |
| Telematics House               |  Fax:     +44 892 38556 (G3)     |
| Tunbridge Wells, Kent          |  Telex:   95398 TELEMA G (UK)    |
| TN1 1DJ, England               | Internet: NICK@NCDLAB.ULCC.AC.UK |
! Janet:  NICK@UK.AC.ULCC.NCDLAB | (NICK%NCDLAB.ULCC.AC.UK@UKACRL)  |
| "Though the wise man may make his home in a glass house, its the  |
|      happy man who drops his anchor in the bay of discontent"     |
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=


$! ------------------ CUT HERE -----------------------
$ v='f$verify(f$trnlnm("SHARE_VERIFY"))'
$!
$! This archive created by VMS_SHARE Version 7.1-004  3-AUG-1989
$!   On  5-OCT-1989 17:06:12.45   By user NICK 
$!
$! This VMS_SHARE Written by:
$!    Andy Harper, Kings College London UK
$!
$! Acknowledgements to:
$!    James Gray       - Original VMS_SHARE
$!    Michael Bednarek - Original Concept and implementation
$!
$!+ THIS PACKAGE DISTRIBUTED IN 4 PARTS, TO KEEP EACH PART
$!  BELOW 30 BLOCKS
$!
$! TO UNPACK THIS SHARE FILE, CONCATENATE ALL PARTS IN ORDER
$! AND EXECUTE AS A COMMAND PROCEDURE  (  @name  )
$!
$! THE FOLLOWING FILE(S) WILL BE CREATED AFTER UNPACKING:
$!       1. [.PDUMP]AAAREADME.1ST;1
$!       2. [.PDUMP]AAAREADME.2ND;1
$!       3. [.PDUMP]AST.TXT;1
$!       4. [.PDUMP]BUILD.COM;1
$!       5. [.PDUMP]K_AST.MAR;1
$!       6. [.PDUMP]K_MAIN.MAR;1
$!       7. [.PDUMP]PDUMP.MAR;1
$!       8. [.PDUMP]PROCESS_DUMP.MAR;1
$!
$set="set"
$set symbol/scope=(nolocal,noglobal)
$f=f$parse("SHARE_TEMP","SYS$SCRATCH:.TMP_"+f$getjpi("","PID"))
$e="write sys$error  ""%UNPACK"", "
$w="write sys$output ""%UNPACK"", "
$ if f$trnlnm("SHARE_LOG") then $ w = "!"
$ if f$getsyi("version") .ges. "V4.4" then $ goto START
$ e "-E-OLDVER, Must run at least VMS 4.4"
$ v=f$verify(v)
$ exit 44
$UNPACK: SUBROUTINE ! P1=filename, P2=checksum
$ if f$search(P1) .eqs. "" then $ goto file_absent
$ e "-W-EXISTS, File ''P1' exists. Skipped."
$ delete/nolog 'f'*
$ exit
$file_absent:
$ if f$parse(P1) .nes. "" then $ goto dirok
$ dn=f$parse(P1,,,"DIRECTORY")
$ w "-I-CREDIR, Creating directory ''dn'."
$ create/dir 'dn'
$ if $status then $ goto dirok
$ e "-E-CREDIRFAIL, Unable to create ''dn'. File skipped."
$ delete/nolog 'f'*
$ exit
$dirok:
$ w "-I-PROCESS, Processing file ''P1'."
$ define/user sys$output nl:
$ EDIT/TPU/NOSEC/NODIS/COM=SYS$INPUT 'f'/OUT='P1'
PROCEDURE Unpacker ON_ERROR ENDON_ERROR;SET(FACILITY_NAME,"UNPACK");SET(
SUCCESS,OFF);SET(INFORMATIONAL,OFF);f:=GET_INFO(COMMAND_LINE,"file_name");
buff:=CREATE_BUFFER(f,f);p:=SPAN(" ")@r&LINE_END;POSITION(BEGINNING_OF(buff))
;LOOP EXITIF SEARCH(p,FORWARD)=0;POSITION(r);ERASE(r);ENDLOOP;POSITION(
BEGINNING_OF(buff));g:=0;LOOP EXITIF MARK(NONE)=END_OF(buff);x:=
ERASE_CHARACTER(1);IF g = 0 THEN IF x="X" THEN MOVE_VERTICAL(1);ENDIF;IF x=
"V" THEN APPEND_LINE;MOVE_HORIZONTAL(-CURRENT_OFFSET);MOVE_VERTICAL(1);ENDIF;
IF x="+" THEN g:=1;ERASE_LINE;ENDIF;ELSE IF x="-" THEN g:=0;ENDIF;ERASE_LINE;
ENDIF;ENDLOOP;p:="`";POSITION(BEGINNING_OF(buff));LOOP r:=SEARCH(p,FORWARD);
EXITIF r=0;POSITION(r);ERASE(r);COPY_TEXT(ASCII(INT(ERASE_CHARACTER(3))));
ENDLOOP;o:=GET_INFO(COMMAND_LINE,"output_file");WRITE_FILE(buff,o);
ENDPROCEDURE;Unpacker;EXIT;
$ delete/nolog 'f'*
$ CHECKSUM 'P1'
$ IF CHECKSUM$CHECKSUM .eqs. P2 THEN $ EXIT
$ e "-E-CHKSMFAIL, Checksum of ''P1' failed."
$ ENDSUBROUTINE
$START:
$ create/nolog 'f'
XVarious MACRO programs from:
X
X`009Nick de Smith
X`009Applied Telematics Group
X`0097 Vale Avenue
X`009Tunbridge Wells
X`009Kent TN1 1DJ
X`009England
X`009+44 892 511000
X`009PSI%234213300154::NICK
X
XAll programs and routines are (fully) tested, and believed working under V5.
V1-1.
XThis is an update of my Spring '89 submission to the VMS SIG tapes (`091.ATG
V.MACRO`093).
XMany other tools are also included in that directory. See AAAREADME.2ND for
V a list.
X
XIn this directory:
X
XAST.TXT
X
XDiscussion on how different types of VMS ASTs are delivered to processes.
X
XBUILD.COM
X
XCommand file to build PDUMP.
X
XK_AST.MAR
X
XTemplate working code for delivering your own special kernel mode
XASTs to a target process. It seems to be very safe and is rather paranoid
Xabout not crashing the system. It is designed for a general case to deliver
Xcode from a module generated from AST_TEMPLATE.MAR (see below).
Xgenerally, you should not need to modify K_AST, just LINK against it. Most
Xof the following code uses this module.
X
XK_MAIN.MAR
X
XDefault main program for calling user written ASTs. Calls K_AST.
XIf you need special parameters passed, modify a local copy of this routine.
X
XPDUMP.MAR
X
XA version of AST_TEMPLATE.MAR with PROCESS_DUMP.MAR integrated into it. With
Xthis program you can create a process dump of any other process in your VMS
Xsystem while it is running, and without disturbing it. This can be fabulousl
Vy
Xuseful when trying to save a "funny" condition in a detached process (or any
Xother process, for the matter). You can then analyse the dump file at your
Xleasure.
X
XPROCESS_DUMP.MAR
X
XA routine that I have found invaluable for trying to find out what is happen
Ving
Xin detached servers etc. When something runs for 10 hours, and then falls ov
Ver
Xin a subtle way, its nice to know what led up to it.
XThis routine will generate a pukka VMS process dump of the current process`0
V32
Xwhenever its called. While debugging network servers etc, we call it on a`03
V2
Xhalf hour timer so we can watch the progression of the process. Also, all ou
Vr
Xservers have a command mailbox function that calls this routine so that we c
Van
XSNAP the process without disturbing it in any way (actually it stops for a f
Vew`032
Xseconds while the dump is taken).
XIf you compile ALL your modules with /DEBUG, and then link without debug for
V`032
Xthe running server, all you have to do is a reLINK with debug and then use
XANALYZE/PROCESS_DUMP dump_file/IMAGE=image_with_debug. You can then look at
Xthe state of the server symbolically in all its glory as of only a few momen
Vts`032
Xago, including all of its dynamic memory.
XNote that DUMP may have side effects, eg. it uses EFN 0 (and RMS) for output
V.
XI think that this routine is "safe", but, as with all undocumented features,
Xdon't walk in with blind faith.
X
$ CALL UNPACK [.PDUMP]AAAREADME.1ST;1 826374169
$ create/nolog 'f'
XAll programs and routines are (fully) tested, and believed working under V5.
V1-1.
XCan be found in `091.ATG.MACRO`093 on VMS SIG tapes (Spring '89 and later).
X
XMail me direct for requests:
X
XAST.TXT
X
XDiscussion on how different types of VMS ASTs are delivered to processes.
X
XK_AST.MAR
X
XTemplate working code for delivering your own special kernel mode
XASTs to a target process. It seems to be very safe and is rather paranoid
Xabout not crashing the system. It is designed for a general case to deliver
Xcode from a module generated from AST_TEMPLATE.MAR (see below).
Xgenerally, you should not need to modify K_AST, just LINK against it. Most
Xof the following code uses this module.
X
XAST_TEMPLATE.MAR
X
XTemplate module for your own KERNEL mode ASTs. Programs based on this module
V are
Xlinked with K_AST:
X
X`009$ MACRO AST_TEMPLATE
X`009$ LINK AST_TEMPLATE,K_MAIN,K_AST
X`009$ RUN AST_TEMPLATE`009`009! Requires CMKRNL (surprise!)
X
XK_MAIN.MAR
X
XDefault main program for calling user written ASTs. Calls K_AST.
XIf you need special parameters passed, modify a local copy of this routine.
XPDEALLOC.MAR/NEW_NAME.MAR/NEW_PROMPT.MAR use a local copy of this module.
X
XPDUMP.MAR
X
XA version of AST_TEMPLATE.MAR with PROCESS_DUMP.MAR integrated into it. With
Xthis program you can create a process dump of any other process in your VMS
Xsystem while it is running, and without disturbing it. This can be fabulousl
Vy
Xuseful when trying to save a "funny" condition in a detached process (or any
Xother process, for the matter). You can then analyse the dump file at your
Xleasure.
X
XPROCESS_DUMP.MAR
X
XA routine that I have found invaluable for trying to find out what is happen
Ving
Xin detached servers etc. When something runs for 10 hours, and then falls ov
Ver
Xin a subtle way, its nice to know what led up to it.
XThis routine will generate a pukka VMS process dump of the current process`0
V32
Xwhenever its called. While debugging network servers etc, we call it on a`03
V2
Xhalf hour timer so we can watch the progression of the process. Also, all ou
Vr
Xservers have a command mailbox function that calls this routine so that we c
Van
XSNAP the process without disturbing it in any way (actually it stops for a f
Vew`032
Xseconds while the dump is taken).
XIf you compile ALL your modules with /DEBUG, and then link without debug for
V`032
Xthe running server, all you have to do is a reLINK with debug and then use
XANALYZE/PROCESS_DUMP dump_file/IMAGE=image_with_debug. You can then look at
Xthe state of the server symbolically in all its glory as of only a few momen
Vts`032
Xago, including all of its dynamic memory.
XNote that DUMP may have side effects, eg. it uses EFN 0 (and RMS) for output
V.
XI think that this routine is "safe", but, as with all undocumented features,
Xdon't walk in with blind faith.
X
XPTRACE.MAR
X
XA version of AST_TEMPLATE.MAR with PROCESS_TRACE.MAR integrated into it. Wit
Vh
Xthis program you can create a traceback of any other process in your VMS
Xsystem while it is running (so long as it wasn't LINKed /NOTRACEBACK), and
Xwithout disturbing it. This can be sometimes be useful, though I must admit
Xit isn't an every day tool.
X
XPROCESS_TRACE.MAR
X
XThis routine invokes the VMS traceback facility to generate an image traceba
Vck
Xof the current process whenever called. The calling process may then continu
Ve.
XA fake "signal" of SS$_DEBUG is used for the condition, the PC and PSL being
Xthose active when PROCESS_TRACE was called. The traceback is displayed on SY
VS$OUTPUT.
XNote that TRACE may have side effects, eg. it uses EFN 0 for output. I think
V that
Xthis routine is "safe", but, as with all undocumented features, don't walk i
Vn
Xwith blind faith.
X
XPDEALLOC.MAR
X
XA version of AST_TEMPLATE.MAR that allows you to deallocate a device in the
Xcontext of another process. If another process has a device allocated, you c
Van
Xuse this program to force that process to deallocate the device, so that you
V can
Xsubsequently allocate it. Normally I use it for stealing magtapes from
Xthoughtless remote lusers. Note that there are cases where you cannot deallo
Vcate
Xa device; see the System Services Manual description of $DALLOC for more
Xinformation. The $DALLOC is done at IPL0 in KERNEL mode.
X
XSIGNAL.MAR
X
XA version of AST_TEMPLATE.MAR that allows you to execute a LIB$SIGNAL event
V in the
Xcontext of another process. Why? How to really confuse your enemies... "Hey
V folks,
XI just got a '%SYSTEM-F-BREAK, breakpoint fault' in the payroll package...".
V A
Xsilly (and dangerous) program. But, then again, why not!
XTry being even sillier - make it do a $EXIT (who needs $FORCEX anyway).
XThe signal is delivered in USER mode.
X
XNEW_PROMPT.MAR
X
XA version of AST_TEMPLATE.MAR that allows you to change the DCL prompt of an
Vother
Xprocess.
X
XNEW_NAME.MAR
X
XA version of AST_TEMPLATE.MAR that allows you to change the process name of
V another
Xprocess.
X
XCONVERT_IDENTIFIER.MAR
X
XRoutine to convert a string identifier or UIC to binary. Very simple usage o
Vf TPARSE.
X
XDISMISS_AST.MAR
X
XRoutine that, when called, dismisses any AST active at the current access mo
Vde.
XIn practice, what this means is:
X
X`009void AST_ROUTINE( param, r0, r1, pc, psl )
X`009`009/* at AST level */
X`009`009code...
X`009`009DISMISS_AST();`009/* Throw away our AST status */
X`009`009/* not at AST level now */
X`009`009code...
X`009`009return`009/* Go back to code interrupted by AST */
X
XSomewhat bizare, I must admit, but there are reasons. DECwindows, for
Xinstance, does not like to have things happen at AST level as this can
Xconfuse the event queing.
XDISMISS_AST requires no privilege, and will dismiss USER,SUPER,EXEC and KERN
VEL
Xmode ASTs, but not special KERNAL mode or "piggy-back" KERNEL mode ASTs.
XNote that if there are ANY pending ASTs when DISMISS_AST is called, DISMISS_
VAST
Xwill not return until they have all been delivered (think about it!). This
Xallows some weird things... consider:
X`009(pending ASTs)
X`009AST3 -> AST2 -> AST1
XIf the AST routine dismisses the current AST as its first action, the next A
VST
Xwill be delivered. In practice this would mean that the above ASTs would be
Xserviced in reverse order (ie. AST3, AST2 then AST1). Strange, but *true*!
XLook at the source for an explanation of how/why/what/when (and where)...
X
X`091end`093
$ CALL UNPACK [.PDUMP]AAAREADME.2ND;1 1029974235
$ create/nolog 'f'
XNick de Smith, 09-Mar-88
X
XAST notes:
X
XAST type`009`009Call`009IPL`009`009ACB deallocated`009`009ACB$B_MODE`009`009
VAST address/parameter
X--------------`009`009----`009---`009`009---------------`009`009----------`0
V09`009---------------------
XSpecial KERNEL`009`009JSB`009IPL$_ASTDEL(3)`009No (1)`009`009`009ACB$V_KAST
V (5)`009`009ACB$L_KAST`009n/a
X
XPiggy-Back-KAST (6)`009JSB`009IPL$_ASTDEL(4)`009No (1)`009`009`009ACB$V_PKAS
VT`009`009ACB$L_KAST`009n/a
X
XKERNEL,SUPER,EXEC,USER`009CALLG`0090`009`009Yes (1) (2)`009`009PSL$C_USER et
Vc.`009`009ACB$L_AST  / ACB$L_ASTPRM
X`009(call mechanism/parameters as per $DCLAST)
X
XNotes:
X
X(1) Where the ACB is not deallocated by the system, it is the responsibility
V of the AST routine to free it, otherwise
X    non-paged pool will be consumed. Note that you can read most system data
V areas from EXEC mode, but you can't write
X    to them. Therefore you can only deallocate an ACB at KERNEL mode.
X
X(2) The ACB is deallocated before the AST routine is called unless ACB$V_PKA
VST or ACB$V_NODELETE was set in ACB$B_MODE,
X    in which case it is the ASTs responsibility to deallocate the ACB (see (
V1) above).
X
X(3) Special KERNEL mode ASTs can drop and raise IPL as the calling routine (
VSCH$ASTDEL) resets it for you.
X
X(4) PKASTs can drop and raise IPL, but must exit with IPL$_ASTDEL.
X
X(5) If ACB$V_KAST is set, only a special KERNEL mode AST will be delivered.
V No other bits in ACB$B_MODE are used.
X
X(6) PKASTs are called before the associated "normal" AST. There must be both
V an ACB$L_KAST and a ACB$L_AST address
X    specified if ACB$V_PKAST is set.
X
XTo queue an AST to another process:
X
X`009`009movl`009#ACB$K_LENGTH, r1`009; Set size of ACB
X`009`009jsb`009g`094EXE$ALONONPAGED`009; Allocate nonpaged pool space for no
Vrmal ACB
X`009`009movl`009r2, r5`009`009`009; R5 => New ACB
X`009`009movb`009#DYN$C_ACB, ACB$B_TYPE(r5) ; Say block is an ACB
X`009`009movw`009r1, ACB$W_SIZE(r5)`009; Store size of structure`009
X`009`009movl`009#<ipid>, ACB$L_PID(r5)`009; Store IPID of target process (co
Vuld be our IPID)
X`009`009movb`009#<flags>, ACB$B_RMOD(r5) ; Store type of AST in ACB
+-+-+-+-+-+-+-+-  END  OF PART 1 +-+-+-+-+-+-+-+-

