KEventInfo

KEventInfo

Size : 0x38 bytes

It is converted to struct DebugEventInfo by using svcContinueDebugEvent.

Object definition #

OffsetTypeDescription
0x0u32Event type
0x4u32Current KThread ID
0x8u32Flags. In all observed cases, bit0 means that svcContinueDebugEvent needs to be called for this event (except for EXIT PROCESS events, for which you need to call svcContinueDebugEvent even if this bit is clear)
0xCu8ATTACH PROCESS/THREAD events: 1 if the object was attached by svcDebugActiveProcess, 0 otherwise (this is always 1 for processes)
0xDu8Equal to bit0 of field 0x8 in all observed cases: indicates that svcContinueDebugEvent needs to be called for this event (except for EXIT PROCESS events, for which you need to call svcContinueDebugEvent even if this bit is clear)
0xEboolIgnore continue
0xFu8Indicates that the event has been handled and should be deleted
0x10union { ... }Event-specific data, see below (slightly different from DebugEventInfo)

Event-specific data #

ATTACH PROCESS event #

TypeField
KProcess *Process

ATTACH THREAD event #

TypeField
u32Creator thread ID (0 if attached by svcDebugActiveProcess)
void *Thread local storage
u32 *Entrypoint = .text load address of the parent process

EXIT THREAD/PROCESS events #

TypeField
u32Exit reason

EXCEPTION event #

TypeField
u32Exception type
u32Exception address
u32Exception category: 4 for DEBUGGER BREAK, 3 for USER BREAK, 2 for STOP POINT, 1 for DATA ABORT/UNALIGNED DATA ACCESS/UNDEFINED SYSCALL, 0 otherwise
union { ... }Type-specific data, see below

UNDEFINED INSTRUCTION/PREFETCH ABORT/DATA ABORT/UNALIGNED DATA ACCESS/UNDEFINED SYSCALL/STOP POINT events #

TypeField
u32Fault information: Fault Address Register (for watchpoints, DATA ABORT and UNALIGNED DATA ACCESS), attempted SVC ID (for UNDEFINED SYSCALL), otherwise 0
u32Stop point type that caused the event (when applicable): 0 = svc 0xFF, 1 = breakpoint, 2 = watchpoint

USER BREAK event #

TypeField
u32Break reason
u32[2]User-provided parameters for debug reasons, or 0

DEBUGGER BREAK event #

TypeField
s32[4]IDs of the attached process’s threads that were running on each core at the time of the @ref svcBreakDebugProcess call, or -1 (only the first 2 values are meaningful on O3DS).

SCHEDULE IN/OUT events #

TypeField
u64Clock tick
u32CPU ID
u32[5]Unknown
u32 (?)Event info, apparently 0

SYSCALL IN/OUT events #

TypeField
u64Clock tick
u32Syscall ID

OUTPUT STRING event #

TypeField
u32String address
u32String size

MAP event #

TypeField
u32Mapped address
u32Mapped size
u32MemoryPermission
u32MemoryState

Category:Kernel objects