VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInDarwin.cpp@ 67981

Last change on this file since 67981 was 63567, checked in by vboxsync, 8 years ago

scm: cleaning up todos
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 36.0 KB
Line 
1/* $Id: DBGPlugInDarwin.cpp 63567 2016-08-16 14:06:54Z vboxsync $ */
2/** @file
3 * DBGPlugInDarwin - Debugger and Guest OS Digger Plugin For Darwin / OS X.
4 */
5
6/*
7 * Copyright (C) 2008-2016 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23#include "DBGPlugIns.h"
24#include <VBox/vmm/dbgf.h>
25#include <iprt/string.h>
26#include <iprt/mem.h>
27#include <iprt/stream.h>
28#include <iprt/uuid.h>
29#include <iprt/ctype.h>
30#include <iprt/formats/mach-o.h>
31
32
33/*********************************************************************************************************************************
34* Structures and Typedefs *
35*********************************************************************************************************************************/
36
37/** @name Internal Darwin structures
38 * @{ */
39
40/**
41 * 32-bit darwin kernel module info structure (kmod_info_t).
42 */
43typedef struct OSX32_kmod_info
44{
45 uint32_t next;
46 int32_t info_version;
47 uint32_t id;
48 char name[64];
49 char version[64];
50 int32_t reference_count;
51 uint32_t reference_list; /**< Points to kmod_reference_t. */
52 uint32_t address; /**< Where in memory the kext is loaded. */
53 uint32_t size;
54 uint32_t hdr_size;
55 uint32_t start; /**< Address of kmod_start_func_t. */
56 uint32_t stop; /**< Address of kmod_stop_func_t. */
57} OSX32_kmod_info_t;
58
59/**
60 * 32-bit darwin kernel module info structure (kmod_info_t).
61 */
62#pragma pack(1)
63typedef struct OSX64_kmod_info
64{
65 uint64_t next;
66 int32_t info_version;
67 uint32_t id;
68 char name[64];
69 char version[64];
70 int32_t reference_count;
71 uint64_t reference_list; /**< Points to kmod_reference_t. Misaligned, duh. */
72 uint64_t address; /**< Where in memory the kext is loaded. */
73 uint64_t size;
74 uint64_t hdr_size;
75 uint64_t start; /**< Address of kmod_start_func_t. */
76 uint64_t stop; /**< Address of kmod_stop_func_t. */
77} OSX64_kmod_info_t;
78#pragma pack()
79
80/** The value of the info_version field. */
81#define OSX_KMOD_INFO_VERSION INT32_C(1)
82
83/** @} */
84
85
86/**
87 * Linux guest OS digger instance data.
88 */
89typedef struct DBGDIGGERDARWIN
90{
91 /** Whether the information is valid or not.
92 * (For fending off illegal interface method calls.) */
93 bool fValid;
94
95 /** Set if 64-bit kernel, clear if 32-bit.
96 * Set during probing. */
97 bool f64Bit;
98 /** The address of an kernel version string (there are several).
99 * This is set during probing. */
100 DBGFADDRESS AddrKernelVersion;
101 /** Kernel base address.
102 * This is set during probing. */
103 DBGFADDRESS AddrKernel;
104
105 /** The kernel message log interface. */
106 DBGFOSIDMESG IDmesg;
107} DBGDIGGERDARWIN;
108/** Pointer to the linux guest OS digger instance data. */
109typedef DBGDIGGERDARWIN *PDBGDIGGERDARWIN;
110
111
112/*********************************************************************************************************************************
113* Defined Constants And Macros *
114*********************************************************************************************************************************/
115/** Validates a 32-bit darwin kernel address */
116#define OSX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x00001000) && (Addr) < UINT32_C(0xfffff000))
117/** Validates a 64-bit darwin kernel address */
118#define OSX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
119/** Validates a 32-bit or 64-bit darwin kernel address. */
120#define OSX_VALID_ADDRESS(a_f64Bits, a_Addr) \
121 ((a_f64Bits) ? OSX64_VALID_ADDRESS(a_Addr) : OSX32_VALID_ADDRESS(a_Addr))
122
123/** AppleOsX on little endian ASCII systems. */
124#define DIG_DARWIN_MOD_TAG UINT64_C(0x58734f656c707041)
125
126
127/*********************************************************************************************************************************
128* Internal Functions *
129*********************************************************************************************************************************/
130static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, void *pvData);
131
132
133/**
134 * @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
135 */
136static DECLCALLBACK(int) dbgDiggerDarwinIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, uint32_t fFlags, uint32_t cMessages,
137 char *pszBuf, size_t cbBuf, size_t *pcbActual)
138{
139 RT_NOREF1(fFlags);
140 PDBGDIGGERDARWIN pData = RT_FROM_MEMBER(pThis, DBGDIGGERDARWIN, IDmesg);
141
142 if (cMessages < 1)
143 return VERR_INVALID_PARAMETER;
144
145 /*
146 * The 'msgbufp' variable points to a struct msgbuf (bsd/kern/subr_log.c).
147 */
148 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
149 RTDBGMOD hMod;
150 int rc = RTDbgAsModuleByName(hAs, "mach_kernel", 0, &hMod);
151 if (RT_FAILURE(rc))
152 return VERR_NOT_FOUND;
153 RTDbgAsRelease(hAs);
154
155 DBGFADDRESS Addr;
156 RTGCPTR GCPtrMsgBufP = 0;
157 RTDBGSYMBOL SymInfo;
158 rc = RTDbgModSymbolByName(hMod, "_msgbufp", &SymInfo);
159 if (RT_SUCCESS(rc))
160 {
161 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, SymInfo.Value + pData->AddrKernel.FlatPtr),
162 &GCPtrMsgBufP, pData->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t));
163 if (RT_FAILURE(rc))
164 {
165 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read _msgbufp at %RGv: %Rrc\n", Addr.FlatPtr, rc));
166 return VERR_NOT_FOUND;
167 }
168 if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
169 {
170 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbufp: %RGv\n", GCPtrMsgBufP));
171 return VERR_NOT_FOUND;
172 }
173 }
174 else
175 {
176 rc = RTDbgModSymbolByName(hMod, "_msgbuf", &SymInfo);
177 if (RT_FAILURE(rc))
178 {
179 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to find _msgbufp and _msgbuf: %Rrc\n", rc));
180 return VERR_NOT_FOUND;
181 }
182 GCPtrMsgBufP = SymInfo.Value + pData->AddrKernel.FlatPtr;
183 if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
184 {
185 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbuf: %RGv\n", GCPtrMsgBufP));
186 return VERR_NOT_FOUND;
187 }
188 }
189
190 /*
191 * Read the msgbuf structure.
192 */
193 struct
194 {
195 uint32_t msg_magic;
196 uint32_t msg_size;
197 uint32_t msg_bufx;
198 uint32_t msg_bufr;
199 uint64_t msg_bufc; /**< Size depends on windows size. */
200 } MsgBuf;
201 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrMsgBufP),
202 &MsgBuf, sizeof(MsgBuf) - (pData->f64Bit ? 0 : sizeof(uint32_t)) );
203 if (RT_FAILURE(rc))
204 {
205 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read msgbuf struct at %RGv: %Rrc\n", Addr.FlatPtr, rc));
206 return VERR_NOT_FOUND;
207 }
208 if (!pData->f64Bit)
209 MsgBuf.msg_bufc &= UINT32_MAX;
210
211 /*
212 * Validate the structure.
213 */
214 if ( MsgBuf.msg_magic != UINT32_C(0x63061)
215 || MsgBuf.msg_size < UINT32_C(4096)
216 || MsgBuf.msg_size > 16*_1M
217 || MsgBuf.msg_bufx > MsgBuf.msg_size
218 || MsgBuf.msg_bufr > MsgBuf.msg_size
219 || !OSX_VALID_ADDRESS(pData->f64Bit, MsgBuf.msg_bufc) )
220 {
221 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid MsgBuf data: magic=%#x size=%#x bufx=%#x bufr=%#x bufc=%RGv\n",
222 MsgBuf.msg_magic, MsgBuf.msg_size, MsgBuf.msg_bufx, MsgBuf.msg_bufr, MsgBuf.msg_bufc));
223 return VERR_INVALID_STATE;
224 }
225
226 /*
227 * Read the buffer.
228 */
229 char *pchMsgBuf = (char *)RTMemAlloc(MsgBuf.msg_size);
230 if (!pchMsgBuf)
231 {
232 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Failed to allocate %#x bytes of memory for the log buffer\n",
233 MsgBuf.msg_size));
234 return VERR_INVALID_STATE;
235 }
236 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, MsgBuf.msg_bufc), pchMsgBuf, MsgBuf.msg_size);
237 if (RT_SUCCESS(rc))
238 {
239 /*
240 * Copy it out raw.
241 */
242 uint32_t offDst = 0;
243 if (MsgBuf.msg_bufr < MsgBuf.msg_bufx)
244 {
245 /* Single chunk between the read and write offsets. */
246 uint32_t cbToCopy = MsgBuf.msg_bufx - MsgBuf.msg_bufr;
247 if (cbToCopy < cbBuf)
248 {
249 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbToCopy);
250 pszBuf[cbToCopy] = '\0';
251 rc = VINF_SUCCESS;
252 }
253 else
254 {
255 if (cbBuf)
256 {
257 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
258 pszBuf[cbBuf - 1] = '\0';
259 }
260 rc = VERR_BUFFER_OVERFLOW;
261 }
262 offDst = cbToCopy + 1;
263 }
264 else
265 {
266 /* Two chunks, read offset to end, start to write offset. */
267 uint32_t cbFirst = MsgBuf.msg_size - MsgBuf.msg_bufr;
268 uint32_t cbSecond = MsgBuf.msg_bufx;
269 if (cbFirst + cbSecond < cbBuf)
270 {
271 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
272 memcpy(&pszBuf[cbFirst], pchMsgBuf, cbSecond);
273 offDst = cbFirst + cbSecond;
274 pszBuf[offDst++] = '\0';
275 rc = VINF_SUCCESS;
276 }
277 else
278 {
279 offDst = cbFirst + cbSecond + 1;
280 if (cbFirst < cbBuf)
281 {
282 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
283 memcpy(&pszBuf[cbFirst], pchMsgBuf, cbBuf - cbFirst);
284 pszBuf[cbBuf - 1] = '\0';
285 }
286 else if (cbBuf)
287 {
288 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
289 pszBuf[cbBuf - 1] = '\0';
290 }
291 rc = VERR_BUFFER_OVERFLOW;
292 }
293 }
294
295 if (pcbActual)
296 *pcbActual = offDst;
297 }
298 else
299 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Error reading %#x bytes at %RGv: %Rrc\n", MsgBuf.msg_size, MsgBuf.msg_bufc, rc));
300 RTMemFree(pchMsgBuf);
301 return rc;
302}
303
304
305/**
306 * @copydoc DBGFOSREG::pfnQueryInterface
307 */
308static DECLCALLBACK(void *) dbgDiggerDarwinQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
309{
310 RT_NOREF1(pUVM);
311 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
312 switch (enmIf)
313 {
314 case DBGFOSINTERFACE_DMESG:
315 return &pThis->IDmesg;
316
317 default:
318 return NULL;
319 }
320}
321
322
323/**
324 * @copydoc DBGFOSREG::pfnQueryVersion
325 */
326static DECLCALLBACK(int) dbgDiggerDarwinQueryVersion(PUVM pUVM, void *pvData, char *pszVersion, size_t cchVersion)
327{
328 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
329 Assert(pThis->fValid);
330
331 /*
332 * It's all in the linux banner.
333 */
334 int rc = DBGFR3MemReadString(pUVM, 0, &pThis->AddrKernelVersion, pszVersion, cchVersion);
335 if (RT_SUCCESS(rc))
336 {
337 char *pszEnd = RTStrEnd(pszVersion, cchVersion);
338 AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
339 while ( pszEnd > pszVersion
340 && RT_C_IS_SPACE(pszEnd[-1]))
341 pszEnd--;
342 *pszEnd = '\0';
343 }
344 else
345 RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
346
347 return rc;
348}
349
350
351/**
352 * @copydoc DBGFOSREG::pfnTerm
353 */
354static DECLCALLBACK(void) dbgDiggerDarwinTerm(PUVM pUVM, void *pvData)
355{
356 RT_NOREF1(pUVM);
357 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
358
359 pThis->fValid = false;
360}
361
362
363/**
364 * @copydoc DBGFOSREG::pfnRefresh
365 */
366static DECLCALLBACK(int) dbgDiggerDarwinRefresh(PUVM pUVM, void *pvData)
367{
368 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
369 NOREF(pThis);
370 Assert(pThis->fValid);
371
372 /*
373 * For now we'll flush and reload everything.
374 */
375 dbgDiggerDarwinTerm(pUVM, pvData);
376 return dbgDiggerDarwinInit(pUVM, pvData);
377}
378
379
380/**
381 * Helper function that validates a segment (or section) name.
382 *
383 * @returns true if valid, false if not.
384 * @param pszName The name string.
385 * @param cbName The size of the string, including terminator.
386 */
387static bool dbgDiggerDarwinIsValidSegOrSectName(const char *pszName, size_t cbName)
388{
389 /* ascii chars */
390 char ch;
391 size_t off = 0;
392 while (off < cbName && (ch = pszName[off]))
393 {
394 if (RT_C_IS_CNTRL(ch) || ch >= 127)
395 return false;
396 off++;
397 }
398
399 /* Not empty nor 100% full. */
400 if (off == 0 || off == cbName)
401 return false;
402
403 /* remainder should be zeros. */
404 while (off < cbName)
405 {
406 if (pszName[off])
407 return false;
408 off++;
409 }
410
411 return true;
412}
413
414
415static int dbgDiggerDarwinAddModule(PDBGDIGGERDARWIN pThis, PUVM pUVM, uint64_t uModAddr, const char *pszName, bool *pf64Bit)
416{
417 RT_NOREF1(pThis);
418 union
419 {
420 uint8_t ab[2 * X86_PAGE_4K_SIZE];
421 mach_header_64_t Hdr64;
422 mach_header_32_t Hdr32;
423 } uBuf;
424
425 /* Read the first page of the image. */
426 DBGFADDRESS ModAddr;
427 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr), uBuf.ab, X86_PAGE_4K_SIZE);
428 if (RT_FAILURE(rc))
429 return rc;
430
431 /* Validate the header. */
432 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
433 if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
434 && uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
435 return VERR_INVALID_EXE_SIGNATURE;
436 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
437 bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
438 if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
439 return VERR_LDR_ARCH_MISMATCH;
440 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
441 if ( uBuf.Hdr32.filetype != MH_EXECUTE
442 && uBuf.Hdr32.filetype != (f64Bit ? MH_KEXT_BUNDLE : MH_OBJECT))
443 return VERR_BAD_EXE_FORMAT;
444 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
445 if (uBuf.Hdr32.ncmds > 256)
446 return VERR_BAD_EXE_FORMAT;
447 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
448 if (uBuf.Hdr32.sizeofcmds > X86_PAGE_4K_SIZE * 2 - sizeof(mach_header_64_t))
449 return VERR_BAD_EXE_FORMAT;
450
451 /* Do we need to read a 2nd page to get all the load commands? If so, do it. */
452 if (uBuf.Hdr32.sizeofcmds + (f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)) > X86_PAGE_4K_SIZE)
453 {
454 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr + X86_PAGE_4K_SIZE),
455 &uBuf.ab[X86_PAGE_4K_SIZE], X86_PAGE_4K_SIZE);
456 if (RT_FAILURE(rc))
457 return rc;
458 }
459
460 /*
461 * Process the load commands.
462 */
463 RTDBGSEGMENT aSegs[24];
464 uint32_t cSegs = 0;
465 RTUUID Uuid = RTUUID_INITIALIZE_NULL;
466 uint32_t cLeft = uBuf.Hdr32.ncmds;
467 uint32_t cbLeft = uBuf.Hdr32.sizeofcmds;
468 union
469 {
470 uint8_t const *pb;
471 load_command_t const *pGenric;
472 segment_command_32_t const *pSeg32;
473 segment_command_64_t const *pSeg64;
474 section_32_t const *pSect32;
475 section_64_t const *pSect64;
476 symtab_command_t const *pSymTab;
477 uuid_command_t const *pUuid;
478 } uLCmd;
479 uLCmd.pb = &uBuf.ab[f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)];
480
481 while (cLeft-- > 0)
482 {
483 uint32_t const cbCmd = uLCmd.pGenric->cmdsize;
484 if (cbCmd > cbLeft || cbCmd < sizeof(load_command_t))
485 return VERR_BAD_EXE_FORMAT;
486
487 switch (uLCmd.pGenric->cmd)
488 {
489 case LC_SEGMENT_32:
490 if (cbCmd != sizeof(segment_command_32_t) + uLCmd.pSeg32->nsects * sizeof(section_32_t))
491 return VERR_BAD_EXE_FORMAT;
492 if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg32->segname, sizeof(uLCmd.pSeg32->segname)))
493 return VERR_INVALID_NAME;
494 if (!strcmp(uLCmd.pSeg32->segname, "__LINKEDIT"))
495 break; /* This usually is discarded or not loaded at all. */
496 if (cSegs >= RT_ELEMENTS(aSegs))
497 return VERR_BUFFER_OVERFLOW;
498 aSegs[cSegs].Address = uLCmd.pSeg32->vmaddr;
499 aSegs[cSegs].uRva = uLCmd.pSeg32->vmaddr - uModAddr;
500 aSegs[cSegs].cb = uLCmd.pSeg32->vmsize;
501 aSegs[cSegs].fFlags = uLCmd.pSeg32->flags; /* Abusing the flags field here... */
502 aSegs[cSegs].iSeg = cSegs;
503 AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg32->segname));
504 strcpy(aSegs[cSegs].szName, uLCmd.pSeg32->segname);
505 cSegs++;
506 break;
507
508 case LC_SEGMENT_64:
509 if (cbCmd != sizeof(segment_command_64_t) + uLCmd.pSeg64->nsects * sizeof(section_64_t))
510 return VERR_BAD_EXE_FORMAT;
511 if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg64->segname, sizeof(uLCmd.pSeg64->segname)))
512 return VERR_INVALID_NAME;
513 if (!strcmp(uLCmd.pSeg64->segname, "__LINKEDIT"))
514 break; /* This usually is discarded or not loaded at all. */
515 if (cSegs >= RT_ELEMENTS(aSegs))
516 return VERR_BUFFER_OVERFLOW;
517 aSegs[cSegs].Address = uLCmd.pSeg64->vmaddr;
518 aSegs[cSegs].uRva = uLCmd.pSeg64->vmaddr - uModAddr;
519 aSegs[cSegs].cb = uLCmd.pSeg64->vmsize;
520 aSegs[cSegs].fFlags = uLCmd.pSeg64->flags; /* Abusing the flags field here... */
521 aSegs[cSegs].iSeg = cSegs;
522 AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg64->segname));
523 strcpy(aSegs[cSegs].szName, uLCmd.pSeg64->segname);
524 cSegs++;
525 break;
526
527 case LC_UUID:
528 if (cbCmd != sizeof(uuid_command_t))
529 return VERR_BAD_EXE_FORMAT;
530 if (RTUuidIsNull((PCRTUUID)&uLCmd.pUuid->uuid[0]))
531 return VERR_BAD_EXE_FORMAT;
532 memcpy(&Uuid, &uLCmd.pUuid->uuid[0], sizeof(uLCmd.pUuid->uuid));
533 break;
534
535 default:
536 /* Current known max plus a lot of slack. */
537 if (uLCmd.pGenric->cmd > LC_DYLIB_CODE_SIGN_DRS + 32)
538 return VERR_BAD_EXE_FORMAT;
539 break;
540 }
541
542 /* next */
543 cbLeft -= cbCmd;
544 uLCmd.pb += cbCmd;
545 }
546
547 if (cbLeft != 0)
548 return VERR_BAD_EXE_FORMAT;
549
550 /*
551 * Some post processing checks.
552 */
553 uint32_t iSeg;
554 for (iSeg = 0; iSeg < cSegs; iSeg++)
555 if (aSegs[iSeg].Address == uModAddr)
556 break;
557 if (iSeg >= cSegs)
558 return VERR_ADDRESS_CONFLICT;
559
560 /*
561 * Create a debug module.
562 */
563 RTDBGMOD hMod;
564 rc = RTDbgModCreateFromMachOImage(&hMod, pszName, NULL, f64Bit ? RTLDRARCH_AMD64 : RTLDRARCH_X86_32, 0 /*cbImage*/,
565 cSegs, aSegs, &Uuid, DBGFR3AsGetConfig(pUVM), RTDBGMOD_F_NOT_DEFERRED);
566
567 if (RT_FAILURE(rc))
568 {
569 /*
570 * Final fallback is a container module.
571 */
572 rc = RTDbgModCreate(&hMod, pszName, 0, 0);
573 if (RT_FAILURE(rc))
574 return rc;
575
576 uint64_t uRvaNext = 0;
577 for (iSeg = 0; iSeg < cSegs && RT_SUCCESS(rc); iSeg++)
578 {
579 if ( aSegs[iSeg].uRva > uRvaNext
580 && aSegs[iSeg].uRva - uRvaNext < _1M)
581 uRvaNext = aSegs[iSeg].uRva;
582 rc = RTDbgModSegmentAdd(hMod, aSegs[iSeg].uRva, aSegs[iSeg].cb, aSegs[iSeg].szName, 0, NULL);
583 if (aSegs[iSeg].cb > 0 && RT_SUCCESS(rc))
584 {
585 char szTmp[RTDBG_SEGMENT_NAME_LENGTH + sizeof("_start")];
586 strcat(strcpy(szTmp, aSegs[iSeg].szName), "_start");
587 rc = RTDbgModSymbolAdd(hMod, szTmp, iSeg, 0 /*uRva*/, 0 /*cb*/, 0 /*fFlags*/, NULL);
588 }
589 uRvaNext += aSegs[iSeg].cb;
590 }
591
592 if (RT_FAILURE(rc))
593 {
594 RTDbgModRelease(hMod);
595 return rc;
596 }
597 }
598
599 /* Tag the module. */
600 rc = RTDbgModSetTag(hMod, DIG_DARWIN_MOD_TAG);
601 AssertRC(rc);
602
603 /*
604 * Link the module.
605 */
606 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
607 if (hAs != NIL_RTDBGAS)
608 {
609 //uint64_t uRvaNext = 0; - what was this?
610 uint32_t cLinked = 0;
611 iSeg = cSegs;
612 while (iSeg-- > 0) /* HACK: Map in reverse order to avoid replacing __TEXT. */
613 if (aSegs[iSeg].cb)
614 {
615 /* Find matching segment in the debug module. */
616 uint32_t iDbgSeg = 0;
617 while (iDbgSeg < cSegs)
618 {
619 RTDBGSEGMENT SegInfo;
620 int rc3 = RTDbgModSegmentByIndex(hMod, iDbgSeg, &SegInfo);
621 if (RT_SUCCESS(rc3) && !strcmp(SegInfo.szName, aSegs[iSeg].szName))
622 break;
623 iDbgSeg++;
624 }
625 AssertMsgStmt(iDbgSeg < cSegs, ("%s\n", aSegs[iSeg].szName), continue);
626
627 /* Map it. */
628 int rc2 = RTDbgAsModuleLinkSeg(hAs, hMod, iDbgSeg, aSegs[iSeg].Address, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
629 if (RT_SUCCESS(rc2))
630 cLinked++;
631 else if (RT_SUCCESS(rc))
632 rc = rc2;
633 }
634 if (RT_FAILURE(rc) && cLinked != 0)
635 rc = -rc;
636 }
637 else
638 rc = VERR_INTERNAL_ERROR;
639
640 RTDbgModRelease(hMod);
641 RTDbgAsRelease(hAs);
642
643 if (pf64Bit)
644 *pf64Bit = f64Bit;
645 return rc;
646}
647
648
649static bool dbgDiggerDarwinIsValidName(const char *pszName)
650{
651 char ch;
652 while ((ch = *pszName++) != '\0')
653 {
654 if (ch < 0x20 || ch >= 127)
655 return false;
656 }
657 return true;
658}
659
660
661static bool dbgDiggerDarwinIsValidVersion(const char *pszVersion)
662{
663 char ch;
664 while ((ch = *pszVersion++) != '\0')
665 {
666 if (ch < 0x20 || ch >= 127)
667 return false;
668 }
669 return true;
670}
671
672
673/**
674 * @copydoc DBGFOSREG::pfnInit
675 */
676static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, void *pvData)
677{
678 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
679 Assert(!pThis->fValid);
680
681 /*
682 * Add the kernel module.
683 */
684 bool f64Bit;
685 int rc = dbgDiggerDarwinAddModule(pThis, pUVM, pThis->AddrKernel.FlatPtr, "mach_kernel", &f64Bit);
686 if (RT_SUCCESS(rc))
687 {
688 /*
689 * The list of modules can be found at the 'kmod' symbol, that means
690 * that we currently require some kind of symbol file for the kernel
691 * to be loaded at this point.
692 *
693 * Note! Could also use the 'gLoadedKextSummaries', but I don't think
694 * it's any easier to find without any kernel map than 'kmod'.
695 */
696 RTDBGSYMBOL SymInfo;
697 rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!kmod", &SymInfo, NULL);
698 if (RT_FAILURE(rc))
699 rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!_kmod", &SymInfo, NULL);
700 if (RT_SUCCESS(rc))
701 {
702 DBGFADDRESS AddrModInfo;
703 DBGFR3AddrFromFlat(pUVM, &AddrModInfo, SymInfo.Value);
704
705 /* Read the variable. */
706 RTUINT64U uKmodValue = { 0 };
707 if (f64Bit)
708 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrModInfo, &uKmodValue.u, sizeof(uKmodValue.u));
709 else
710 rc = DBGFR3MemRead (pUVM, 0 /*idCpu*/, &AddrModInfo, &uKmodValue.s.Lo, sizeof(uKmodValue.s.Lo));
711 if (RT_SUCCESS(rc))
712 {
713 DBGFR3AddrFromFlat(pUVM, &AddrModInfo, uKmodValue.u);
714
715 /* Walk the list of modules. */
716 uint32_t cIterations = 0;
717 while (AddrModInfo.FlatPtr != 0)
718 {
719 /* Some extra loop conditions... */
720 if (!OSX_VALID_ADDRESS(f64Bit, AddrModInfo.FlatPtr))
721 {
722 Log(("OSXDig: Invalid kmod_info pointer: %RGv\n", AddrModInfo.FlatPtr));
723 break;
724 }
725 if (AddrModInfo.FlatPtr == uKmodValue.u && cIterations != 0)
726 {
727 Log(("OSXDig: kmod_info list looped back to the start.\n"));
728 break;
729 }
730 if (cIterations++ >= 2048)
731 {
732 Log(("OSXDig: Too many mod_info loops (%u)\n", cIterations));
733 break;
734 }
735
736 /*
737 * Read the kmod_info_t structure.
738 */
739 union
740 {
741 OSX64_kmod_info_t Info64;
742 OSX32_kmod_info_t Info32;
743 } uMod;
744 RT_ZERO(uMod);
745 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrModInfo, &uMod,
746 f64Bit ? sizeof(uMod.Info64) : sizeof(uMod.Info32));
747 if (RT_FAILURE(rc))
748 {
749 Log(("OSXDig: Error reading kmod_info structure at %RGv: %Rrc\n", AddrModInfo.FlatPtr, rc));
750 break;
751 }
752
753 /*
754 * Validate the kmod_info_t structure.
755 */
756 int32_t iInfoVer = f64Bit ? uMod.Info64.info_version : uMod.Info32.info_version;
757 if (iInfoVer != OSX_KMOD_INFO_VERSION)
758 {
759 Log(("OSXDig: kmod_info @%RGv: Bad info_version %d\n", AddrModInfo.FlatPtr, iInfoVer));
760 break;
761 }
762
763 const char *pszName = f64Bit ? uMod.Info64.name : uMod.Info32.name;
764 if ( !*pszName
765 || !RTStrEnd(pszName, sizeof(uMod.Info64.name))
766 || !dbgDiggerDarwinIsValidName(pszName) )
767 {
768 Log(("OSXDig: kmod_info @%RGv: Bad name '%.*s'\n", AddrModInfo.FlatPtr,
769 sizeof(uMod.Info64.name), pszName));
770 break;
771 }
772
773 const char *pszVersion = f64Bit ? uMod.Info64.version : uMod.Info32.version;
774 if ( !RTStrEnd(pszVersion, sizeof(uMod.Info64.version))
775 || !dbgDiggerDarwinIsValidVersion(pszVersion) )
776 {
777 Log(("OSXDig: kmod_info @%RGv: Bad version '%.*s'\n", AddrModInfo.FlatPtr,
778 sizeof(uMod.Info64.version), pszVersion));
779 break;
780 }
781
782 int32_t cRefs = f64Bit ? uMod.Info64.reference_count : uMod.Info32.reference_count;
783 if (cRefs < -1 || cRefs > 16384)
784 {
785 Log(("OSXDig: kmod_info @%RGv: Bad reference_count %d\n", AddrModInfo.FlatPtr, cRefs));
786 break;
787 }
788
789 uint64_t uImageAddr = f64Bit ? uMod.Info64.address : uMod.Info32.address;
790 if (!OSX_VALID_ADDRESS(f64Bit, uImageAddr))
791 {
792 Log(("OSXDig: kmod_info @%RGv: Bad address %#llx\n", AddrModInfo.FlatPtr, uImageAddr));
793 break;
794 }
795
796 uint64_t cbImage = f64Bit ? uMod.Info64.size : uMod.Info32.size;
797 if (cbImage > 64U*_1M)
798 {
799 Log(("OSXDig: kmod_info @%RGv: Bad size %#llx\n", AddrModInfo.FlatPtr, cbImage));
800 break;
801 }
802
803 uint64_t cbHdr = f64Bit ? uMod.Info64.hdr_size : uMod.Info32.hdr_size;
804 if (cbHdr > 16U*_1M)
805 {
806 Log(("OSXDig: kmod_info @%RGv: Bad hdr_size %#llx\n", AddrModInfo.FlatPtr, cbHdr));
807 break;
808 }
809
810 uint64_t uStartAddr = f64Bit ? uMod.Info64.start : uMod.Info32.start;
811 if (!uStartAddr && !OSX_VALID_ADDRESS(f64Bit, uStartAddr))
812 {
813 Log(("OSXDig: kmod_info @%RGv: Bad start function %#llx\n", AddrModInfo.FlatPtr, uStartAddr));
814 break;
815 }
816
817 uint64_t uStopAddr = f64Bit ? uMod.Info64.stop : uMod.Info32.stop;
818 if (!uStopAddr && !OSX_VALID_ADDRESS(f64Bit, uStopAddr))
819 {
820 Log(("OSXDig: kmod_info @%RGv: Bad stop function %#llx\n", AddrModInfo.FlatPtr, uStopAddr));
821 break;
822 }
823
824 /*
825 * Try add the module.
826 */
827 Log(("OSXDig: kmod_info @%RGv: '%s' ver '%s', image @%#llx LB %#llx cbHdr=%#llx\n", AddrModInfo.FlatPtr,
828 pszName, pszVersion, uImageAddr, cbImage, cbHdr));
829 rc = dbgDiggerDarwinAddModule(pThis, pUVM, uImageAddr, pszName, NULL);
830
831
832 /*
833 * Advance to the next kmod_info entry.
834 */
835 DBGFR3AddrFromFlat(pUVM, &AddrModInfo, f64Bit ? uMod.Info64.next : uMod.Info32.next);
836 }
837 }
838 else
839 Log(("OSXDig: Error reading the 'kmod' variable: %Rrc\n", rc));
840 }
841 else
842 Log(("OSXDig: Failed to locate the 'kmod' variable in mach_kernel.\n"));
843
844 pThis->fValid = true;
845 return VINF_SUCCESS;
846 }
847
848 return rc;
849}
850
851
852/**
853 * @copydoc DBGFOSREG::pfnProbe
854 */
855static DECLCALLBACK(bool) dbgDiggerDarwinProbe(PUVM pUVM, void *pvData)
856{
857 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
858
859 /*
860 * Look for a section + segment combo that normally only occures in
861 * mach_kernel. Follow it up with probing of the rest of the executable
862 * header. We must search a largish area because the more recent versions
863 * of darwin have random load address for security raisins.
864 */
865 static struct { uint64_t uStart, uEnd; } const s_aRanges[] =
866 {
867 /* 64-bit: */
868 { UINT64_C(0xffffff8000000000), UINT64_C(0xffffff81ffffffff), },
869
870 /* 32-bit - always search for this because of the hybrid 32-bit kernel
871 with cpu in long mode that darwin used for a number of versions. */
872 { UINT64_C(0x00001000), UINT64_C(0x0ffff000), }
873 };
874 for (unsigned iRange = DBGFR3CpuGetMode(pUVM, 0 /*idCpu*/) != CPUMMODE_LONG;
875 iRange < RT_ELEMENTS(s_aRanges);
876 iRange++)
877 {
878 DBGFADDRESS KernelAddr;
879 for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, s_aRanges[iRange].uStart);
880 KernelAddr.FlatPtr < s_aRanges[iRange].uEnd;
881 KernelAddr.FlatPtr += X86_PAGE_4K_SIZE)
882 {
883 static const uint8_t s_abNeedle[16 + 16] =
884 {
885 '_','_','t','e','x','t', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::sectname */
886 '_','_','K','L','D', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::segname. */
887 };
888
889 int rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, s_aRanges[iRange].uEnd - KernelAddr.FlatPtr,
890 1, s_abNeedle, sizeof(s_abNeedle), &KernelAddr);
891 if (RT_FAILURE(rc))
892 break;
893 DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & X86_PAGE_4K_OFFSET_MASK);
894
895 /*
896 * Read the first page of the image and check the headers.
897 */
898 union
899 {
900 uint8_t ab[X86_PAGE_4K_SIZE];
901 mach_header_64_t Hdr64;
902 mach_header_32_t Hdr32;
903 } uBuf;
904 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &KernelAddr, uBuf.ab, X86_PAGE_4K_SIZE);
905 if (RT_FAILURE(rc))
906 continue;
907 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
908 if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
909 && uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
910 continue;
911 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
912 bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
913 if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
914 continue;
915 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
916 if (uBuf.Hdr32.filetype != MH_EXECUTE)
917 continue;
918 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
919 if (uBuf.Hdr32.ncmds > 256)
920 continue;
921 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
922 if (uBuf.Hdr32.sizeofcmds > X86_PAGE_4K_SIZE * 2 - sizeof(mach_header_64_t))
923 continue;
924
925 /* Seems good enough for now.
926
927 If the above causes false positives, check the segments and make
928 sure there is a kernel version string in the right one. */
929 pThis->AddrKernel = KernelAddr;
930 pThis->f64Bit = f64Bit;
931
932 /*
933 * Finally, find the kernel version string.
934 */
935 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, 32*_1M, 1, RT_STR_TUPLE("Darwin Kernel Version"),
936 &pThis->AddrKernelVersion);
937 if (RT_FAILURE(rc))
938 DBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelVersion, 0);
939 return true;
940 }
941 }
942 return false;
943}
944
945
946/**
947 * @copydoc DBGFOSREG::pfnDestruct
948 */
949static DECLCALLBACK(void) dbgDiggerDarwinDestruct(PUVM pUVM, void *pvData)
950{
951 RT_NOREF2(pUVM, pvData);
952
953}
954
955
956/**
957 * @copydoc DBGFOSREG::pfnConstruct
958 */
959static DECLCALLBACK(int) dbgDiggerDarwinConstruct(PUVM pUVM, void *pvData)
960{
961 RT_NOREF1(pUVM);
962 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
963
964 pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
965 pThis->IDmesg.pfnQueryKernelLog = dbgDiggerDarwinIDmsg_QueryKernelLog;
966 pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
967
968 return VINF_SUCCESS;
969}
970
971
972const DBGFOSREG g_DBGDiggerDarwin =
973{
974 /* .u32Magic = */ DBGFOSREG_MAGIC,
975 /* .fFlags = */ 0,
976 /* .cbData = */ sizeof(DBGDIGGERDARWIN),
977 /* .szName = */ "Darwin",
978 /* .pfnConstruct = */ dbgDiggerDarwinConstruct,
979 /* .pfnDestruct = */ dbgDiggerDarwinDestruct,
980 /* .pfnProbe = */ dbgDiggerDarwinProbe,
981 /* .pfnInit = */ dbgDiggerDarwinInit,
982 /* .pfnRefresh = */ dbgDiggerDarwinRefresh,
983 /* .pfnTerm = */ dbgDiggerDarwinTerm,
984 /* .pfnQueryVersion = */ dbgDiggerDarwinQueryVersion,
985 /* .pfnQueryInterface = */ dbgDiggerDarwinQueryInterface,
986 /* .u32EndMagic = */ DBGFOSREG_MAGIC
987};
988
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use