// Mapped crash dump descriptor
struct MappedCrashDump {
	HANDLE hFile;
	HANDLE hMapping;
	union {
		PBYTE lpMapping;
		PDUMP_HEADER DumpHeader;
		ULONG* DataBlocks;
	};
	ULONG *DumpType;
	ULONG *DumpFlags;
	PLARGE_INTEGER DumpSize;
	PPHYSICAL_MEMORY_DESCRIPTOR PhysicalMemoryDescriptor;
	PCONTEXT Context;
	union {
		// Summary dump type
		struct {
			PSUMMARY_DUMP_HEADER pSummaryDumpHeader;
			RTL_BITMAP KernelMemoryMap;
		};

		// Triage dump type
		PTRIAGE_DUMP_HEADER pTriageDumpHeader;
	};
};

//
// This routine maps dump page at given file offset (DesiredAddress is the sum of BaseMapping and desired offset)
//

PVOID MapDumpPage( HANDLE hMapping, PBYTE BaseMapping, PBYTE DesiredAddress )
{
	ULONG FileOffset = (ULONG) ( ( (ULONG_PTR)DesiredAddress-(ULONG_PTR)BaseMapping ) & 0xFFFF0000 );
	PVOID Base = (PVOID)(ULONG_PTR) ( ((ULONG)(ULONG_PTR)DesiredAddress)&0xFFFF0000 );
	MEMORY_BASIC_INFORMATION mbi = {0};
	PVOID Ret = 0;

	VirtualQuery( DesiredAddress, &mbi, sizeof(mbi) );

	if( mbi.State != MEM_COMMIT ) {
		Ret = MapViewOfFileEx(	hMapping,
								FILE_MAP_READ,
								0,
								FileOffset,
								0x10000,
								Base
								);
		if( Ret == Base ) {
			return DesiredAddress;
		}

		// Loaded at different address. Fail
		UnmapViewOfFile( Ret );
		return NULL;
	}

	return DesiredAddress;
}

PBYTE GetSummaryDumpPagesByPhysicalAddress( MappedCrashDump *CrashDump, ULONGLONG AddressAtCrashTime )
{
	PBYTE StartingAddress = (PBYTE)(ULONG_PTR) ( (ULONG)(ULONG_PTR)CrashDump->pSummaryDumpHeader + CrashDump->pSummaryDumpHeader->HeaderSize - 0x1000 );
	ULONG NumberOfPage = (ULONG) (AddressAtCrashTime / 0x1000);
	ULONG OffsetInPage = (ULONG) (AddressAtCrashTime & 0xFFF);

	if( NumberOfPage >= CrashDump->KernelMemoryMap.SizeOfBitMap )
		return NULL;

    if( RtlCheckBit( &CrashDump->KernelMemoryMap, NumberOfPage ) == 0 )
		return NULL; // not included in dump

	// Calculate page number in dump
	ULONG PageNumber = 0;

	for( ULONG i=0; i<CrashDump->KernelMemoryMap.SizeOfBitMap; i++ ) {
		if( i == NumberOfPage ) {
			PBYTE Result = StartingAddress + PageNumber*0x1000 + OffsetInPage;

			return (PBYTE) MapDumpPage( CrashDump->hMapping, CrashDump->lpMapping, Result );
		}

		if( RtlCheckBit( &CrashDump->KernelMemoryMap, i ) ) {
			PageNumber++;
		}
	}

	return NULL;
}

PFN_NUMBER GetPhysicalPFN( PPHYSICAL_MEMORY_DESCRIPTOR ppmd, PFN_NUMBER DumpPFN )
{
	PFN_NUMBER iBuffPage, iPage = iBuffPage = DumpPFN;

	if( iBuffPage >= ppmd->NumberOfPages )
		return -1;

	// Calculate page in memory
	ULONG NumberOfRunsRequired = 0;
	PFN_NUMBER TotalPageCount = 0;

	for( ; NumberOfRunsRequired<ppmd->NumberOfRuns; NumberOfRunsRequired++ )
	{
		PPHYSICAL_MEMORY_RUN Runs = ppmd->Run;

		if( iBuffPage >= TotalPageCount &&
			iBuffPage < TotalPageCount + Runs[NumberOfRunsRequired].PageCount )
			break;

		TotalPageCount += (Runs[NumberOfRunsRequired].PageCount);
	}

	PFN_NUMBER PreviousEnd = 0;
	NumberOfRunsRequired ++;

	for( ULONG i=0; i<NumberOfRunsRequired; i++ )
	{
		PPHYSICAL_MEMORY_RUN Runs = ppmd->Run;

		iPage += (Runs[i].BasePage - PreviousEnd);
		PreviousEnd = Runs[i].BasePage + Runs[i].PageCount;
	}

	return iPage;
}

PFN_NUMBER GetDumpPFN( PPHYSICAL_MEMORY_DESCRIPTOR ppmd, PFN_NUMBER PhysicalPFN )
{
	for( int run=0; run<ppmd->NumberOfRuns; run++ )
	{
		PPHYSICAL_MEMORY_RUN Runs = ppmd->Run;

		if( PhysicalPFN >= Runs[run].BasePage &&
			PhysicalPFN < (Runs[run].BasePage + Runs[run].PageCount) )
			break;
	}

	if( run == ppmd->NumberOfRuns )
		return -1;

	PFN_NUMBER iDumpPFN = 0;

	for( int i=0; i<run; i++ )
	{
		iDumpPFN += ppmd->Run[i].PageCount;
	}

	iDumpPFN += PhysicalPFN - ppmd->Run[i].BasePage;

	return iDumpPFN;
}

PBYTE GetCompleteDumpPagesByPhysicalAddress( MappedCrashDump *CrashDump, ULONGLONG AddressAtCrashTime )
{
	PBYTE StartingAddress = (PBYTE)(ULONG_PTR)( (ULONG)(ULONG_PTR)CrashDump->lpMapping + 0x1000 );
	PFN_NUMBER PFN = (ULONG) (AddressAtCrashTime >> 12);
	ULONG OffsetInPage = (ULONG) (AddressAtCrashTime & 0xFFF);

	// Calculate page number in dump
	for( ULONG i=0; i<CrashDump->PhysicalMemoryDescriptor->NumberOfRuns; i++ ) {    
		PPHYSICAL_MEMORY_RUN Runs = (PPHYSICAL_MEMORY_RUN) &CrashDump->PhysicalMemoryDescriptor->Run;

		if( PFN >= Runs[i].BasePage && PFN < (Runs[i].BasePage + Runs[i].PageCount) ) {
		
			PFN_NUMBER DumpPFN = GetDumpPFN( CrashDump->PhysicalMemoryDescriptor, PFN );
			PBYTE Result = StartingAddress + DumpPFN*0x1000 + OffsetInPage;

			return (PBYTE) MapDumpPage( CrashDump->hMapping, CrashDump->lpMapping, Result );
		}
	}
	return NULL;
}

PBYTE GetDumpPagesByPhysicalAddress( MappedCrashDump *CrashDump, ULONGLONG AddressAtCrashTime )
{
	if( *CrashDump->DumpType == DUMP_TYPE_SUMMARY ) {

		return GetSummaryDumpPagesByPhysicalAddress( CrashDump, AddressAtCrashTime );

	} else if( *CrashDump->DumpType == DUMP_TYPE_COMPLETE ) {

		return GetCompleteDumpPagesByPhysicalAddress( CrashDump, AddressAtCrashTime );

	} else {

		return NULL;
	}
}

//
// Page Directory Entry
//

struct PDE {
	DWORD  Present:1;
	DWORD  ReadWrite:1;
	DWORD  UserSupervisor:1;
	DWORD  WriteThrough:1;
	DWORD  CacheDisabled:1;
	DWORD  Accessed:1;
	DWORD  Reserved:1;		// Dirty, ignored
	DWORD  PageSize:1;
	DWORD  GlobalPage:1;	// Ignored
	DWORD  Available:3;
	DWORD  Pte:19;
};


//
// Page Table Entry
//

struct PTE {
	DWORD  Present:1;
	DWORD  ReadWrite:1;
	DWORD  UserSupervisor:1;
	DWORD  WriteThrough:1;
	DWORD  CacheDisabled:1;
	DWORD  Accessed:1;
	DWORD  Dirty:1;
	DWORD  PageTableAttributeIndex:1;
	DWORD  GlobalPage:1;
	DWORD  Available:3;
	DWORD  PageFrameNumber:19;
};

// Virtual address
struct VIRTUAL_ADDRESS {
	DWORD  Offset:12;
	DWORD  Table:10;
	DWORD  Directory:10;
};


//
// Page Directory Entry in PAE mode
//

#define QWORD ULONGLONG

struct LongPDE {
	QWORD  Present:1;
	QWORD  ReadWrite:1;
	QWORD  UserSupervisor:1;
	QWORD  WriteThrough:1;
	QWORD  CacheDisabled:1;
	QWORD  Accessed:1;
	QWORD  Reserved:1;		// Dirty, ignored
	QWORD  PageSize:1;
	QWORD  GlobalPage:1;	// Ignored
	QWORD  Available:3;
	QWORD  Pte:24;
	QWORD  ReservedHigh:28;
};


//
// Page Table Entry in PAE mode
//

struct LongPTE {
	QWORD  Present:1;
	QWORD  ReadWrite:1;
	QWORD  UserSupervisor:1;
	QWORD  WriteThrough:1;
	QWORD  CacheDisabled:1;
	QWORD  Accessed:1;
	QWORD  Dirty:1;
	QWORD  PageTableAttributeIndex:1;
	QWORD  GlobalPage:1;
	QWORD  Available:3;
	QWORD  PageFrameNumber:24;
	QWORD  ReservedHigh:28;
};

//
// Page Directory Pointer Table (PAE mode only)
//

struct PDPE {
	QWORD  Present:1;
	QWORD  Reserved1:2;
	QWORD  WriteThough:1;
	QWORD  CacheDisabled:1;
	QWORD  Reserved2:4;
	QWORD  Available:3;
	QWORD  Pdt:24;
	QWORD  ReservedHigh:28;
};

// Virtual address (PAE)
struct PAE_VIRTUAL_ADDRESS {
	DWORD  Offset:12;
	DWORD  Table:9;
	DWORD  Directory:9;
	DWORD  DirectoryPointer:2;
};

//
// Translates virtual address to physical address
//

ULONGLONG VirtualToPhysical( MappedCrashDump *CrashDump, ULONG VirtualAddress )
{
	ULONG CR3 = CrashDump->DumpHeader->DirectoryTableBase;

	CR3 &= 0xFFFFFFF0;   // clear flags in cr3

	if( CrashDump->DumpHeader->PaeEnabled )
	{
		// PAE enabled. Use 3-level addressing system: PDPE->PDE->PTE->Page
		PAE_VIRTUAL_ADDRESS va;

		*(ULONG*)&va = VirtualAddress;

		PDPE* dirptr = (PDPE*)GetDumpPagesByPhysicalAddress( CrashDump, CR3 );

		if( dirptr != NULL && dirptr[va.DirectoryPointer].Present )
		{
			LongPDE *dir = (LongPDE*)GetDumpPagesByPhysicalAddress( CrashDump, dirptr[va.DirectoryPointer].Pdt << 12 );

			if( dir != NULL && dir[va.Directory].Present )
			{
				LongPTE* tbl = (LongPTE*)GetDumpPagesByPhysicalAddress( CrashDump, dir[va.Directory].Pte << 12 );

				if( tbl != NULL && tbl[va.Table].Present )
				{
					return ( tbl[va.Table].PageFrameNumber << 12 ) | va.Offset;
				}
			}
		}
	}
	else
	{
		// PAE disabled. Use 2-level addressing system: PDE->PTE->Page
		VIRTUAL_ADDRESS va;
		*(ULONG*)&va = VirtualAddress;

		PDE *dir = (PDE*)GetDumpPagesByPhysicalAddress( CrashDump, CR3 );
		
		if( dir != NULL && dir[va.Directory].Present )
		{
			PTE* tbl = (PTE*)GetDumpPagesByPhysicalAddress( CrashDump, dir[va.Directory].Pte << 12 );

			if( tbl != NULL && tbl[va.Table].Present )
			{
				return ( tbl[va.Table].PageFrameNumber << 12 ) | va.Offset;
			}
		}
	}

	return NULL;
}

//
// Translates virtual address to physical address and loads that physical pages
//

PVOID RetrieveDumpData( MappedCrashDump* CrashDump, PVOID VirtualAddress )
{
	return GetDumpPagesByPhysicalAddress( CrashDump, VirtualToPhysical( CrashDump, (ULONG)(ULONG_PTR)VirtualAddress ) );
}

struct CONST_DESCRIPTION {
	ULONG	Value;
	LPSTR	Desc;
#define DEFINE_STRING(x) { x, #x }
#define TABLE_END { 0, 0 }
};

CONST_DESCRIPTION MachineTypes[] = {
	DEFINE_STRING( IMAGE_FILE_MACHINE_I386 ),
	DEFINE_STRING( IMAGE_FILE_MACHINE_IA64 ),
	TABLE_END
};

CONST_DESCRIPTION DumpTypes[] = {
	DEFINE_STRING( DUMP_TYPE_TRIAGE ),
	DEFINE_STRING( DUMP_TYPE_SUMMARY ),
	DEFINE_STRING( DUMP_TYPE_FULL ),
	TABLE_END
};

// Bugcheck descriptions
typedef ULONG NTSTATUS;
#include "D:\Progs\driverdev\bcdesc.h"    // багчек коды бсодов, я не прилагаю этот файл, скажу лишь что там лежит функция BugCheckDescf, получающая имя бсода по его номеру.

// Получение имени константы по значению
LPSTR LookupConstDesc( CONST_DESCRIPTION* Table, ULONG Value )
{
	while( Table->Desc ) {
		if( Table->Value == Value ) {
			return Table->Desc;
		}
		Table ++;
	}
	return "(unknown)";
}

void ExtractDumpHeader( MappedCrashDump* CrashDump, char* saveto )
{
	HANDLE hFile = CreateFile( saveto, GENERIC_WRITE, 0, 0, OPEN_ALWAYS, 0, 0 );
	DWORD wr;
	WriteFile( hFile, CrashDump->lpMapping, 0x1000, &wr, 0 );
	SetEndOfFile( hFile );
	CloseHandle( hFile );
}


int AnalyseDump( char* filename )
{
	MappedCrashDump CrashDump = {0}; 
	CrashDump.hFile = INVALID_HANDLE_VALUE;

	__try
	{
		CrashDump.hFile = CreateFile( filename, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0 );
		if( CrashDump.hFile == INVALID_HANDLE_VALUE )
			return 0;

		CrashDump.hMapping = CreateFileMapping( CrashDump.hFile, 0, PAGE_READONLY, 0, 0, NULL );
		if( CrashDump.hMapping == NULL )
			return 0;

		CrashDump.lpMapping = (PBYTE) MapViewOfFile( CrashDump.hMapping, FILE_MAP_READ, 0, 0, 0x10000 ); //0x12000 );
		if( CrashDump.lpMapping == NULL )
			return 0;

		PDUMP_HEADER hdr = CrashDump.DumpHeader;

		if( hdr->ValidDump != 'PMUD' || hdr->Signature != 'EGAP' ) {
			printf("Invalid dump header\n");
			return 0;
		}

		printf("Crash dump '%s' analysing started. Version: %d.%d\n\n", filename, hdr->MajorVersion, hdr->MinorVersion);

		// Header
		printf("CR3 = 0x%08x                   PfnDatabase = 0x%08x\n"
			   "PsLoadedModuleList = 0x%08x    PsActiveProcessHead = 0x%08x\n", hdr->DirectoryTableBase, (ULONG_PTR)hdr->PfnDataBase,
			   (ULONG_PTR)hdr->PsLoadedModuleList, (ULONG_PTR)hdr->PsActiveProcessHead );
		printf("Machine type: %s,  NumberProcessors: %d\n", LookupConstDesc( MachineTypes, hdr->MachineImageType ), hdr->NumberProcessors);
		printf("PaeEnabled = %d, KdDebuggerDataBlock = 0x%08x\n", hdr->PaeEnabled, (ULONG_PTR)hdr->KdDebuggerDataBlock);
		printf("\n");

		// Bug check
		printf("Bugcheck code %s (0x%08x)\n", BugCheckDescf(hdr->BugCheckCode), hdr->BugCheckCode);
		printf("Arguments[0] = 0x%08x\n", hdr->BugCheckParameter1);
		printf("Arguments[1] = 0x%08x\n", hdr->BugCheckParameter2);
		printf("Arguments[2] = 0x%08x\n", hdr->BugCheckParameter3);
		printf("Arguments[3] = 0x%08x\n", hdr->BugCheckParameter4);
		printf("\n");

		// Data blocks
		ULONG* block = CrashDump.DataBlocks;

		// Dump type & size
		CrashDump.DumpType  = &block[ DH_DUMP_TYPE     ];
		CrashDump.DumpFlags = &block[ DH_DUMP_TYPE + 1 ];
		CrashDump.DumpSize = (PLARGE_INTEGER) &block[ DH_REQUIRED_DUMP_SPACE ];
		printf(	"Dump type: %s, DumpSize: %d bytes (0x%08x)\n",
				LookupConstDesc( DumpTypes, *CrashDump.DumpType ),
				CrashDump.DumpSize->LowPart,
				CrashDump.DumpSize->LowPart );
		printf("\n");

		// Physical memory descriptor
		CrashDump.PhysicalMemoryDescriptor = (PPHYSICAL_MEMORY_DESCRIPTOR)( &block[DH_PHYSICAL_MEMORY_BLOCK] );
		if( CrashDump.PhysicalMemoryDescriptor->NumberOfRuns == 'EGAP' )
		{
			printf("PPHYSICAL_MEMORY_DESCRIPTOR: Invalid\n");
		}
		else
		{
			printf(	"PPHYSICAL_MEMORY_DESCRIPTOR:\nNumberOfRuns = 0x%08x  NumberOfPages = 0x%08x\n",
					CrashDump.PhysicalMemoryDescriptor->NumberOfRuns,
					CrashDump.PhysicalMemoryDescriptor->NumberOfPages );
			for( ULONG i=0;i<CrashDump.PhysicalMemoryDescriptor->NumberOfRuns;i++ )
			{
				printf(	"PPHYSICAL_MEMORY_RUN[%d]: BasePage = 0x%08x   PageCount = 0x%08x\n",
						i,
						CrashDump.PhysicalMemoryDescriptor->Run[i].BasePage,
						CrashDump.PhysicalMemoryDescriptor->Run[i].PageCount );
			}
		}
		printf("\n");

		// Context record:
		CrashDump.Context = (PCONTEXT)( &block[DH_CONTEXT_RECORD] );
		printf(	"Context record:\nEip = 0x%08x   ESP = 0x%08x   EBP = 0x%08x\n",
				CrashDump.Context->Eip,
				CrashDump.Context->Esp,
				CrashDump.Context->Ebp );
		printf("EAX=%08x EBX=%08x ECX=%08x EDX=%08x ESI=%08x EDI=%08x\n",
			CrashDump.Context->Eax,
			CrashDump.Context->Ebx,
			CrashDump.Context->Ecx,
			CrashDump.Context->Edx,
			CrashDump.Context->Esi,
			CrashDump.Context->Edi,
			CrashDump.Context->Eax);
		printf("\n");

        // Analyse dump
		if( *CrashDump.DumpType == DUMP_TYPE_TRIAGE )
		{
			//
			// Minidump
			//

			CrashDump.pTriageDumpHeader = (PTRIAGE_DUMP_HEADER)( CrashDump.lpMapping + 0x1000 );

			printf("Analysing triage dump header\n");

			printf("[-] Not implemented\n");

			__asm nop;
		}
		else if( *CrashDump.DumpType == DUMP_TYPE_SUMMARY )
		{
			//
			// Kernel summary dump - only kernel address space available
			//

			CrashDump.pSummaryDumpHeader = (PSUMMARY_DUMP_HEADER) ( CrashDump.lpMapping + 0x1000 );
			CrashDump.KernelMemoryMap.SizeOfBitMap = CrashDump.pSummaryDumpHeader->BitmapSize;
			CrashDump.KernelMemoryMap.Buffer = (PULONG) ( CrashDump.pSummaryDumpHeader + 1 );

			if( CrashDump.pSummaryDumpHeader->ValidDump != 'PMUD' ) {
				printf("Invalid summary dump header\n");
				return 0;
			}

			printf("Analyzing summary dump header\n");
			printf(	"HeaderSize = 0x%08x   BitmapSize = 0x%08x\n",
					CrashDump.pSummaryDumpHeader->HeaderSize, 
					CrashDump.pSummaryDumpHeader->BitmapSize );
			printf(	"Number of kernel pages in dump: 0x%08x\n\n", 
					CrashDump.pSummaryDumpHeader->Pages );


			ULONG Virtual = CrashDump.Context->Eip;
			ULONGLONG Physical;
			Physical = VirtualToPhysical( &CrashDump, Virtual  );

			printf("Translating virtual address [0x%08x]: 0x%08x\n", Virtual, Physical);

			PBYTE MappedEIP = (PBYTE)RetrieveDumpData( &CrashDump, (void*)(ULONG_PTR)CrashDump.Context->Eip );

			if( MappedEIP )
			{
				printf("Bytes at [EIP=%08x]: %02x %02x %02x %02x  %02x %02x %02x %02x\n", CrashDump.Context->Eip,
							MappedEIP[0], MappedEIP[1], MappedEIP[2], MappedEIP[3],
							MappedEIP[4], MappedEIP[5], MappedEIP[6], MappedEIP[7] );
			}
			else printf("Memory pointed by EIP is not present\n");

			__asm nop;
		}
		else if( *CrashDump.DumpType == DUMP_TYPE_COMPLETE )
		{
			//
			// Complete memory dump - full address space available
			//

			ULONG Virtual = CrashDump.Context->Eip;
			ULONGLONG Physical;
			Physical = VirtualToPhysical( &CrashDump, Virtual  );

			printf("Translating virtual address [0x%08x]: 0x%08x\n", Virtual, Physical);

			PBYTE MappedEIP = (PBYTE)RetrieveDumpData( &CrashDump, (void*)(ULONG_PTR)CrashDump.Context->Eip );

			printf("Bytes at [EIP=%08x]: %02x %02x %02x %02x  %02x %02x %02x %02x\n", CrashDump.Context->Eip,
						MappedEIP[0], MappedEIP[1], MappedEIP[2], MappedEIP[3],
						MappedEIP[4], MappedEIP[5], MappedEIP[6], MappedEIP[7] );

			ExtractDumpHeader( &CrashDump, "crashdump.hdr" );

			__asm nop;

		}


		printf("\nDump analysis finished\n");
	}
	__finally
	{
		if( CrashDump.lpMapping )
			UnmapViewOfFile( CrashDump.lpMapping );

		if( CrashDump.hMapping )
			CloseHandle( CrashDump.hMapping );

		if( CrashDump.hFile != INVALID_HANDLE_VALUE )
			CloseHandle( CrashDump.hFile );

		Sleep(INFINITE);
	}

	return 0;
}


int main()
{
	AnalyseDump( "C:\\gr8lkd.dmp" );
	//AnalyseDump( "D:\\memory.dmp" );

	return 0;
}

template <class T>
struct PFUNC {
	T  VirtualAddress;
	ULONG  ZeroField;
};

typedef struct _KD_DEBUGGER_DATA_BLOCK {
	ULONG  Unknown1[4];
	ULONG  ValidBlock; // 'GBDK'
	ULONG  Size; // 0x290
	PFUNC<PVOID>  _imp__VidInitialize;
	PFUNC<PVOID>  RtlpBreakWithStatusInstruction;
	ULONG  Unknown2[4];
	PFUNC<PVOID>  KiCallUserMode;
	ULONG  Unknown3[2];
	PFUNC<PVOID>  PsLoadedModuleList;
	PFUNC<PVOID>  PsActiveProcessHead;
	PFUNC<PVOID>  PspCidTable;
	PFUNC<PVOID>  ExpSystemResourcesList;
	PFUNC<PVOID>  ExpPagedPoolDescriptor;
	PFUNC<PVOID>  ExpNumberOfPagedPools;
	PFUNC<PVOID>  KeTimeIncrement;
	PFUNC<PVOID>  KeBugCheckCallbackListHead;
	PFUNC<PVOID>  KiBugCheckData;
	PFUNC<PVOID>  IopErrorLogListHead;
	PFUNC<PVOID>  ObpRootDirectoryObject;
	PFUNC<PVOID>  ObpTypeObjectType;
	PFUNC<PVOID>  MmSystemCacheStart;
	PFUNC<PVOID>  MmSystemCacheEnd;
	PFUNC<PVOID>  MmSystemCacheWs;
	PFUNC<PVOID>  MmPfnDatabase;
	PFUNC<PVOID>  MmSystemPtesStart;
	PFUNC<PVOID>  MmSystemPtesEnd;
	PFUNC<PVOID>  MmSubsectionBase;
	PFUNC<PVOID>  MmNumberOfPagingFiles;
	PFUNC<PVOID>  MmLowestPhysicalPage;
	PFUNC<PVOID>  MmHighestPhysicalPage;
	PFUNC<PVOID>  MmNumberOfPhysicalPages;
	PFUNC<PVOID>  MmMaximumNonPagedPoolInBytes;
	PFUNC<PVOID>  MmNonPagedSystemStart;
	PFUNC<PVOID>  MmNonPagedPoolStart;
	PFUNC<PVOID>  MmNonPagedPoolEnd;
	PFUNC<PVOID>  MmPagedPoolStart;
	PFUNC<PVOID>  MmPagedPoolEnd;
	PFUNC<PVOID>  MmPagedPoolInfo;
	PFUNC<PVOID>  Unknown4;
	PFUNC<PVOID>  MmSizeOfPagedPoolInBytes;
	PFUNC<PVOID>  MmTotalCommitLimit;
	PFUNC<PVOID>  MmTotalCommittedPages;
	PFUNC<PVOID>  MmSharedCommit;
	PFUNC<PVOID>  MmDriverCommit;
	PFUNC<PVOID>  MmProcessCommit;
	PFUNC<PVOID>  MmPagedPoolCommit;
	PFUNC<PVOID>  Unknown5;
	PFUNC<PVOID>  MmZeroedPageListHead;
	PFUNC<PVOID>  MmFreePageListHead;
	PFUNC<PVOID>  MmStandbyPageListHead;
	PFUNC<PVOID>  MmModifiedPageListHead;
	PFUNC<PVOID>  MmModifiedNoWritePageListHead;
	PFUNC<PVOID>  MmAvailablePages;
	PFUNC<PVOID>  MmResidentAvailablePages;
	PFUNC<PVOID>  PoolTrackTable;
	PFUNC<PVOID>  NonPagedPoolDescriptor;
	PFUNC<PVOID>  MmHighestUserAddress;
	PFUNC<PVOID>  MmSystemRangeStart;
	PFUNC<PVOID>  MmUserProbeAddress;
	PFUNC<PVOID>  KdPrintCircularBuffer;
	PFUNC<PVOID>  KdPrintWritePointer;
	PFUNC<PVOID>  KdPrintWritePointer2;
	PFUNC<PVOID>  KdPrintRolloverCount;
	PFUNC<PVOID>  MmLoadedUserImageList;
	PFUNC<PVOID>  NtBuildLab;
	PFUNC<PVOID>  Unknown6;
	PFUNC<PVOID>  KiProcessorBlock;
	PFUNC<PVOID>  MmUnloadedDrivers;
	PFUNC<PVOID>  MmLastUnloadedDriver;
	PFUNC<PVOID>  MmTriageActionTaken;
	PFUNC<PVOID>  MmSpecialPoolTag;
	PFUNC<PVOID>  KernelVerifier;
	PFUNC<PVOID>  MmVerifierData;
	PFUNC<PVOID>  MmAllocateNonPagedPool;
	PFUNC<PVOID>  MmPeakCommitment;
	PFUNC<PVOID>  MmTotalCommitLimitMaximum;
	PFUNC<PVOID>  CmNtCSDVersion;
	PFUNC<PPHYSICAL_MEMORY_DESCRIPTOR*>  MmPhysicalMemoryBlock;
	PFUNC<PVOID>  MmSessionBase;
	PFUNC<PVOID>  MmSessionSize;
	PFUNC<PVOID>  Unknown7;

} KD_DEBUGGER_DATA_BLOCK, *PKD_DEBUGGER_DATA_BLOCK;

BOOLEAN
InitializeDumpHeader(
	IN	PBYTE HeaderPage
	)
{
	PDUMP_HEADER hdr;
	ULONG* blocks;
	PKD_DEBUGGER_DATA_BLOCK KdDebuggerDataBlock;
	EXCEPTION_RECORD exception;
	PVOID KeCapturePersistentThreadState;
	UNICODE_STRING uKeCapturePersistentThreadState;
	PPHYSICAL_MEMORY_DESCRIPTOR MmPhysicalMemoryBlock;
	CONTEXT ctx = {CONTEXT_FULL};
	PEXCEPTION_POINTERS pei;
	
	// Get context
	__asm
	{
		// Common registers
        mov [ctx.Eax], eax
		mov [ctx.Ebx], ebx
		mov [ctx.Ecx], ecx
		mov [ctx.Edx], edx
		mov [ctx.Esi], esi
		mov [ctx.Edi], edi

		// Control registers
		mov [ctx.Esp], esp
		mov [ctx.Ebp], ebp

		call _1
		// This address will appear in kd as crash address:
_1:		pop eax
		mov [ctx.Eip], eax

		pushfd
		pop eax
		mov [ctx.EFlags], eax

		// Debug registers
		__emit 0x0F
		__emit 0x21
		__emit 0xC0 ; mov eax, dr0
		mov [ctx.Dr0], eax
		__emit 0x0F
		__emit 0x21
		__emit 0xC8 ; mov eax, dr1
		mov [ctx.Dr1], eax
		__emit 0x0F
		__emit 0x21
		__emit 0xD0 ; mov eax, dr2
		mov [ctx.Dr2], eax
		__emit 0x0F
		__emit 0x21
		__emit 0xD8 ; mov eax, dr3
		mov [ctx.Dr3], eax
		__emit 0x0F
		__emit 0x21
		__emit 0xF0 ; mov eax, dr6
		mov [ctx.Dr6], eax
		__emit 0x0F
		__emit 0x21
		__emit 0xF8 ; mov eax, dr7
		mov [ctx.Dr7], eax

		// Segment registers
		push cs
		pop eax
        mov [ctx.SegCs], eax
		xor eax,eax
		mov ax, ss
		mov [ctx.SegSs], eax
		mov ax, ds
		mov [ctx.SegDs], eax
		mov ax, es
		mov [ctx.SegEs], eax
		mov ax, fs
		mov [ctx.SegFs], eax
		mov ax, gs
		mov [ctx.SegGs], eax
	}

	// Get KeCapturePersistentThreadState address
	RtlInitUnicodeString( &uKeCapturePersistentThreadState, L"KeCapturePersistentThreadState" );
	KeCapturePersistentThreadState = MmGetSystemRoutineAddress( &uKeCapturePersistentThreadState );

	// Initialize dump header
	hdr = (PDUMP_HEADER) HeaderPage;
	hdr->ValidDump = 'PMUD';
	hdr->MinorVersion = (USHORT) *NtBuildNumber;
    hdr->MajorVersion = (USHORT) 0xF; // checked/free, в идеале нужно брать инфу из реестра; если посмотреть код в приложении к статье - там так и сделано
	hdr->DirectoryTableBase = CR3();

	//
	// Capture KdDebuggerDataBlock
	//
	
	__try {
		hdr->KdDebuggerDataBlock = *(PVOID*)((ULONG)KeCapturePersistentThreadState + *(ULONG*)((ULONG)KeCapturePersistentThreadState + 0xC )+ 0x11);

	} __except( (pei=GetExceptionInformation()) ? EXCEPTION_EXECUTE_HANDLER : EXCEPTION_EXECUTE_HANDLER ) {
		ULONG i;

		DbgPrint("An exception occurred while trying to get KdDebuggerDataBlock address:\n");
		DbgPrint("Exception code: 0x%08x\n", pei->ExceptionRecord->ExceptionCode);
		DbgPrint("Number of arguments: 0x%08x\n", pei->ExceptionRecord->NumberParameters);

		for( i = 0; i < pei->ExceptionRecord->NumberParameters; i++ ) {
			DbgPrint("Argument[%d]: 0x%08x\n", i, pei->ExceptionRecord->ExceptionInformation[i]);
		}

		return FALSE;
	}
	hdr->MachineImageType = 0x14c;
	hdr->NumberProcessors = 1;
	hdr->BugCheckCode = KMODE_EXCEPTION_NOT_HANDLED;
	hdr->BugCheckParameter1 = STATUS_BREAKPOINT;
	hdr->BugCheckParameter2 = ctx.Eip;
	hdr->BugCheckParameter3 = 0;
	hdr->BugCheckParameter4 = 0;
	hdr->PaeEnabled = (CR4() & PAE_ENABLED) ? TRUE : FALSE;

	KdDebuggerDataBlock = (PKD_DEBUGGER_DATA_BLOCK) hdr->KdDebuggerDataBlock;

	// Check KdDebuggerDataBlock
	if( KdDebuggerDataBlock->ValidBlock != 'GBDK' || KdDebuggerDataBlock->Size != sizeof(*KdDebuggerDataBlock) )
	{
		// Invalid debugger data block
		DbgPrint(	"KdDebuggerDataBlock is not valid.\nSignature = 0x%08x (should be 0x%08x)\nSize = 0x%08x (should be 0x%08x)\n",
					KdDebuggerDataBlock->ValidBlock, 'GBDK',
					KdDebuggerDataBlock->Size, sizeof(*KdDebuggerDataBlock) );
		return FALSE;
	}

	DbgPrint("Got valid KdDebuggerDataBlock=0x%08x\n", KdDebuggerDataBlock);
	
	hdr->PfnDataBase = (PULONG) KdDebuggerDataBlock->MmPfnDatabase.VirtualAddress;
	hdr->PsLoadedModuleList = (PLIST_ENTRY) KdDebuggerDataBlock->PsLoadedModuleList.VirtualAddress;
	hdr->PsActiveProcessHead = (PLIST_ENTRY) KdDebuggerDataBlock->PsActiveProcessHead.VirtualAddress;

	DbgPrint("PfnDataBase = 0x%08x\n", hdr->PfnDataBase);
	DbgPrint("PsLoadedModuleList = 0x%08x\n", hdr->PsLoadedModuleList);
	DbgPrint("PsActiveProcessHead = 0x%08x\n", hdr->PsActiveProcessHead);

	blocks = (ULONG*)(ULONG_PTR)HeaderPage;

	//
	// Get physical memory descriptor
	//

	MmPhysicalMemoryBlock = *(KdDebuggerDataBlock->MmPhysicalMemoryBlock.VirtualAddress);

	DbgPrint("MmPhysicalMemoryBlock = 0x%08x\n", MmPhysicalMemoryBlock);

	if( MmPhysicalMemoryBlock->NumberOfRuns == 'EGAP' ) {
		RtlCopyMemory(	&blocks[ DH_PHYSICAL_MEMORY_BLOCK ],
						MmPhysicalMemoryBlock, 
						sizeof(PHYSICAL_MEMORY_DESCRIPTOR)
						);
	} else {
		RtlCopyMemory(	&blocks[ DH_PHYSICAL_MEMORY_BLOCK ],
						MmPhysicalMemoryBlock, 
						sizeof(PHYSICAL_MEMORY_DESCRIPTOR) - sizeof(PHYSICAL_MEMORY_RUN) + 
						sizeof(PHYSICAL_MEMORY_RUN)*MmPhysicalMemoryBlock->NumberOfRuns
						);
	}

	//
	// Save context record
	//

	RtlCopyMemory(	&blocks[ DH_CONTEXT_RECORD ],
					&ctx,
					sizeof(CONTEXT)
					);
	DbgPrint("Context record saved.\n");
	DbgPrint("EAX=%08x EBX=%08x ECX=%08x EDX=%08x\n", ctx.Eax, ctx.Ebx, ctx.Ecx, ctx.Edx);
	DbgPrint("ESI=%08x EDI=%08x EBP=%08x ESP=%08x\n", ctx.Esi, ctx.Edi, ctx.Ebp, ctx.Esp);
	DbgPrint("EIP=%08x CS=%08x FS=%08x DS=%08x\n", ctx.Eip, ctx.SegCs, ctx.SegFs, ctx.SegDs);

	//
	// Create & store exception record
	//

	exception.ExceptionCode = STATUS_BREAKPOINT;
	exception.ExceptionFlags = EXCEPTION_NONCONTINUABLE;
	exception.ExceptionRecord = NULL;
	exception.ExceptionAddress = (PVOID) ctx.Eip;
	exception.NumberParameters = 0;

	RtlCopyMemory(	&blocks[ DH_EXCEPTION_RECORD ],
					&exception,
					sizeof(EXCEPTION_RECORD)
					);

	//
	// Initialize dump type & size
	//

	blocks[ DH_DUMP_TYPE ] = DUMP_TYPE_COMPLETE;

    ((LARGE_INTEGER*)&blocks[DH_REQUIRED_DUMP_SPACE])->QuadPart = ( MmPhysicalMemoryBlock->NumberOfPages << 12 ) + 0x1000;

	DbgPrint("Header page initialized OK\n");

	return TRUE;
}