VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInDarwin.cpp@ 77887

Last change on this file since 77887 was 76553, checked in by vboxsync, 5 years ago

scm --update-copyright-year
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 36.6 KB
Line 
1/* $Id: DBGPlugInDarwin.cpp 76553 2019-01-01 01:45:53Z vboxsync $ */
2/** @file
3 * DBGPlugInDarwin - Debugger and Guest OS Digger Plugin For Darwin / OS X.
4 */
5
6/*
7 * Copyright (C) 2008-2019 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23#include "DBGPlugIns.h"
24#include <VBox/vmm/dbgf.h>
25#include <iprt/err.h>
26#include <iprt/mem.h>
27#include <iprt/stream.h>
28#include <iprt/string.h>
29#include <iprt/uuid.h>
30#include <iprt/ctype.h>
31#include <iprt/formats/mach-o.h>
32
33
34/*********************************************************************************************************************************
35* Structures and Typedefs *
36*********************************************************************************************************************************/
37
38/** @name Internal Darwin structures
39 * @{ */
40
41/**
42 * 32-bit darwin kernel module info structure (kmod_info_t).
43 */
44typedef struct OSX32_kmod_info
45{
46 uint32_t next;
47 int32_t info_version;
48 uint32_t id;
49 char name[64];
50 char version[64];
51 int32_t reference_count;
52 uint32_t reference_list; /**< Points to kmod_reference_t. */
53 uint32_t address; /**< Where in memory the kext is loaded. */
54 uint32_t size;
55 uint32_t hdr_size;
56 uint32_t start; /**< Address of kmod_start_func_t. */
57 uint32_t stop; /**< Address of kmod_stop_func_t. */
58} OSX32_kmod_info_t;
59
60/**
61 * 32-bit darwin kernel module info structure (kmod_info_t).
62 */
63#pragma pack(1)
64typedef struct OSX64_kmod_info
65{
66 uint64_t next;
67 int32_t info_version;
68 uint32_t id;
69 char name[64];
70 char version[64];
71 int32_t reference_count;
72 uint64_t reference_list; /**< Points to kmod_reference_t. Misaligned, duh. */
73 uint64_t address; /**< Where in memory the kext is loaded. */
74 uint64_t size;
75 uint64_t hdr_size;
76 uint64_t start; /**< Address of kmod_start_func_t. */
77 uint64_t stop; /**< Address of kmod_stop_func_t. */
78} OSX64_kmod_info_t;
79#pragma pack()
80
81/** The value of the info_version field. */
82#define OSX_KMOD_INFO_VERSION INT32_C(1)
83
84/** @} */
85
86
87/**
88 * Linux guest OS digger instance data.
89 */
90typedef struct DBGDIGGERDARWIN
91{
92 /** Whether the information is valid or not.
93 * (For fending off illegal interface method calls.) */
94 bool fValid;
95
96 /** Set if 64-bit kernel, clear if 32-bit.
97 * Set during probing. */
98 bool f64Bit;
99 /** The address of an kernel version string (there are several).
100 * This is set during probing. */
101 DBGFADDRESS AddrKernelVersion;
102 /** Kernel base address.
103 * This is set during probing. */
104 DBGFADDRESS AddrKernel;
105
106 /** The kernel message log interface. */
107 DBGFOSIDMESG IDmesg;
108} DBGDIGGERDARWIN;
109/** Pointer to the linux guest OS digger instance data. */
110typedef DBGDIGGERDARWIN *PDBGDIGGERDARWIN;
111
112
113/*********************************************************************************************************************************
114* Defined Constants And Macros *
115*********************************************************************************************************************************/
116/** Validates a 32-bit darwin kernel address */
117#define OSX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x00001000) && (Addr) < UINT32_C(0xfffff000))
118/** Validates a 64-bit darwin kernel address */
119#define OSX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
120/** Validates a 32-bit or 64-bit darwin kernel address. */
121#define OSX_VALID_ADDRESS(a_f64Bits, a_Addr) \
122 ((a_f64Bits) ? OSX64_VALID_ADDRESS(a_Addr) : OSX32_VALID_ADDRESS(a_Addr))
123
124/** AppleOsX on little endian ASCII systems. */
125#define DIG_DARWIN_MOD_TAG UINT64_C(0x58734f656c707041)
126
127
128/*********************************************************************************************************************************
129* Internal Functions *
130*********************************************************************************************************************************/
131static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, void *pvData);
132
133
134
135/**
136 * @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
137 */
138static DECLCALLBACK(int) dbgDiggerDarwinIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, uint32_t fFlags, uint32_t cMessages,
139 char *pszBuf, size_t cbBuf, size_t *pcbActual)
140{
141 RT_NOREF1(fFlags);
142 PDBGDIGGERDARWIN pData = RT_FROM_MEMBER(pThis, DBGDIGGERDARWIN, IDmesg);
143
144 if (cMessages < 1)
145 return VERR_INVALID_PARAMETER;
146
147 /*
148 * The 'msgbufp' variable points to a struct msgbuf (bsd/kern/subr_log.c).
149 */
150 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
151 RTDBGMOD hMod;
152 int rc = RTDbgAsModuleByName(hAs, "mach_kernel", 0, &hMod);
153 if (RT_FAILURE(rc))
154 return VERR_NOT_FOUND;
155 RTDbgAsRelease(hAs);
156
157 DBGFADDRESS Addr;
158 RTGCPTR GCPtrMsgBufP = 0;
159 RTDBGSYMBOL SymInfo;
160 rc = RTDbgModSymbolByName(hMod, "_msgbufp", &SymInfo);
161 if (RT_SUCCESS(rc))
162 {
163 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, SymInfo.Value + pData->AddrKernel.FlatPtr),
164 &GCPtrMsgBufP, pData->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t));
165 if (RT_FAILURE(rc))
166 {
167 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read _msgbufp at %RGv: %Rrc\n", Addr.FlatPtr, rc));
168 return VERR_NOT_FOUND;
169 }
170 if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
171 {
172 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbufp: %RGv\n", GCPtrMsgBufP));
173 return VERR_NOT_FOUND;
174 }
175 }
176 else
177 {
178 rc = RTDbgModSymbolByName(hMod, "_msgbuf", &SymInfo);
179 if (RT_FAILURE(rc))
180 {
181 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to find _msgbufp and _msgbuf: %Rrc\n", rc));
182 return VERR_NOT_FOUND;
183 }
184 GCPtrMsgBufP = SymInfo.Value + pData->AddrKernel.FlatPtr;
185 if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
186 {
187 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbuf: %RGv\n", GCPtrMsgBufP));
188 return VERR_NOT_FOUND;
189 }
190 }
191
192 /*
193 * Read the msgbuf structure.
194 */
195 struct
196 {
197 uint32_t msg_magic;
198 uint32_t msg_size;
199 uint32_t msg_bufx;
200 uint32_t msg_bufr;
201 uint64_t msg_bufc; /**< Size depends on windows size. */
202 } MsgBuf;
203 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrMsgBufP),
204 &MsgBuf, sizeof(MsgBuf) - (pData->f64Bit ? 0 : sizeof(uint32_t)) );
205 if (RT_FAILURE(rc))
206 {
207 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read msgbuf struct at %RGv: %Rrc\n", Addr.FlatPtr, rc));
208 return VERR_NOT_FOUND;
209 }
210 if (!pData->f64Bit)
211 MsgBuf.msg_bufc &= UINT32_MAX;
212
213 /*
214 * Validate the structure.
215 */
216 if ( MsgBuf.msg_magic != UINT32_C(0x63061)
217 || MsgBuf.msg_size < UINT32_C(4096)
218 || MsgBuf.msg_size > 16*_1M
219 || MsgBuf.msg_bufx > MsgBuf.msg_size
220 || MsgBuf.msg_bufr > MsgBuf.msg_size
221 || !OSX_VALID_ADDRESS(pData->f64Bit, MsgBuf.msg_bufc) )
222 {
223 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid MsgBuf data: magic=%#x size=%#x bufx=%#x bufr=%#x bufc=%RGv\n",
224 MsgBuf.msg_magic, MsgBuf.msg_size, MsgBuf.msg_bufx, MsgBuf.msg_bufr, MsgBuf.msg_bufc));
225 return VERR_INVALID_STATE;
226 }
227
228 /*
229 * Read the buffer.
230 */
231 char *pchMsgBuf = (char *)RTMemAlloc(MsgBuf.msg_size);
232 if (!pchMsgBuf)
233 {
234 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Failed to allocate %#x bytes of memory for the log buffer\n",
235 MsgBuf.msg_size));
236 return VERR_INVALID_STATE;
237 }
238 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, MsgBuf.msg_bufc), pchMsgBuf, MsgBuf.msg_size);
239 if (RT_SUCCESS(rc))
240 {
241 /*
242 * Copy it out raw.
243 */
244 uint32_t offDst = 0;
245 if (MsgBuf.msg_bufr < MsgBuf.msg_bufx)
246 {
247 /* Single chunk between the read and write offsets. */
248 uint32_t cbToCopy = MsgBuf.msg_bufx - MsgBuf.msg_bufr;
249 if (cbToCopy < cbBuf)
250 {
251 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbToCopy);
252 pszBuf[cbToCopy] = '\0';
253 rc = VINF_SUCCESS;
254 }
255 else
256 {
257 if (cbBuf)
258 {
259 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
260 pszBuf[cbBuf - 1] = '\0';
261 }
262 rc = VERR_BUFFER_OVERFLOW;
263 }
264 offDst = cbToCopy + 1;
265 }
266 else
267 {
268 /* Two chunks, read offset to end, start to write offset. */
269 uint32_t cbFirst = MsgBuf.msg_size - MsgBuf.msg_bufr;
270 uint32_t cbSecond = MsgBuf.msg_bufx;
271 if (cbFirst + cbSecond < cbBuf)
272 {
273 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
274 memcpy(&pszBuf[cbFirst], pchMsgBuf, cbSecond);
275 offDst = cbFirst + cbSecond;
276 pszBuf[offDst++] = '\0';
277 rc = VINF_SUCCESS;
278 }
279 else
280 {
281 offDst = cbFirst + cbSecond + 1;
282 if (cbFirst < cbBuf)
283 {
284 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
285 memcpy(&pszBuf[cbFirst], pchMsgBuf, cbBuf - cbFirst);
286 pszBuf[cbBuf - 1] = '\0';
287 }
288 else if (cbBuf)
289 {
290 memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
291 pszBuf[cbBuf - 1] = '\0';
292 }
293 rc = VERR_BUFFER_OVERFLOW;
294 }
295 }
296
297 if (pcbActual)
298 *pcbActual = offDst;
299 }
300 else
301 Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Error reading %#x bytes at %RGv: %Rrc\n", MsgBuf.msg_size, MsgBuf.msg_bufc, rc));
302 RTMemFree(pchMsgBuf);
303 return rc;
304}
305
306
307/**
308 * @copydoc DBGFOSREG::pfnStackUnwindAssist
309 */
310static DECLCALLBACK(int) dbgDiggerDarwinStackUnwindAssist(PUVM pUVM, void *pvData, VMCPUID idCpu, PDBGFSTACKFRAME pFrame,
311 PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx, RTDBGAS hAs,
312 uint64_t *puScratch)
313{
314 RT_NOREF(pUVM, pvData, idCpu, pFrame, pState, pInitialCtx, hAs, puScratch);
315 return VINF_SUCCESS;
316}
317
318
319/**
320 * @copydoc DBGFOSREG::pfnQueryInterface
321 */
322static DECLCALLBACK(void *) dbgDiggerDarwinQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
323{
324 RT_NOREF1(pUVM);
325 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
326 switch (enmIf)
327 {
328 case DBGFOSINTERFACE_DMESG:
329 return &pThis->IDmesg;
330
331 default:
332 return NULL;
333 }
334}
335
336
337/**
338 * @copydoc DBGFOSREG::pfnQueryVersion
339 */
340static DECLCALLBACK(int) dbgDiggerDarwinQueryVersion(PUVM pUVM, void *pvData, char *pszVersion, size_t cchVersion)
341{
342 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
343 Assert(pThis->fValid);
344
345 /*
346 * It's all in the linux banner.
347 */
348 int rc = DBGFR3MemReadString(pUVM, 0, &pThis->AddrKernelVersion, pszVersion, cchVersion);
349 if (RT_SUCCESS(rc))
350 {
351 char *pszEnd = RTStrEnd(pszVersion, cchVersion);
352 AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
353 while ( pszEnd > pszVersion
354 && RT_C_IS_SPACE(pszEnd[-1]))
355 pszEnd--;
356 *pszEnd = '\0';
357 }
358 else
359 RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
360
361 return rc;
362}
363
364
365/**
366 * @copydoc DBGFOSREG::pfnTerm
367 */
368static DECLCALLBACK(void) dbgDiggerDarwinTerm(PUVM pUVM, void *pvData)
369{
370 RT_NOREF1(pUVM);
371 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
372
373 pThis->fValid = false;
374}
375
376
377/**
378 * @copydoc DBGFOSREG::pfnRefresh
379 */
380static DECLCALLBACK(int) dbgDiggerDarwinRefresh(PUVM pUVM, void *pvData)
381{
382 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
383 NOREF(pThis);
384 Assert(pThis->fValid);
385
386 /*
387 * For now we'll flush and reload everything.
388 */
389 dbgDiggerDarwinTerm(pUVM, pvData);
390 return dbgDiggerDarwinInit(pUVM, pvData);
391}
392
393
394/**
395 * Helper function that validates a segment (or section) name.
396 *
397 * @returns true if valid, false if not.
398 * @param pszName The name string.
399 * @param cbName The size of the string, including terminator.
400 */
401static bool dbgDiggerDarwinIsValidSegOrSectName(const char *pszName, size_t cbName)
402{
403 /* ascii chars */
404 char ch;
405 size_t off = 0;
406 while (off < cbName && (ch = pszName[off]))
407 {
408 if (RT_C_IS_CNTRL(ch) || ch >= 127)
409 return false;
410 off++;
411 }
412
413 /* Not empty nor 100% full. */
414 if (off == 0 || off == cbName)
415 return false;
416
417 /* remainder should be zeros. */
418 while (off < cbName)
419 {
420 if (pszName[off])
421 return false;
422 off++;
423 }
424
425 return true;
426}
427
428
429static int dbgDiggerDarwinAddModule(PDBGDIGGERDARWIN pThis, PUVM pUVM, uint64_t uModAddr, const char *pszName, bool *pf64Bit)
430{
431 RT_NOREF1(pThis);
432 union
433 {
434 uint8_t ab[2 * X86_PAGE_4K_SIZE];
435 mach_header_64_t Hdr64;
436 mach_header_32_t Hdr32;
437 } uBuf;
438
439 /* Read the first page of the image. */
440 DBGFADDRESS ModAddr;
441 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr), uBuf.ab, X86_PAGE_4K_SIZE);
442 if (RT_FAILURE(rc))
443 return rc;
444
445 /* Validate the header. */
446 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
447 if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
448 && uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
449 return VERR_INVALID_EXE_SIGNATURE;
450 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
451 bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
452 if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
453 return VERR_LDR_ARCH_MISMATCH;
454 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
455 if ( uBuf.Hdr32.filetype != MH_EXECUTE
456 && uBuf.Hdr32.filetype != (f64Bit ? MH_KEXT_BUNDLE : MH_OBJECT))
457 return VERR_BAD_EXE_FORMAT;
458 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
459 if (uBuf.Hdr32.ncmds > 256)
460 return VERR_BAD_EXE_FORMAT;
461 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
462 if (uBuf.Hdr32.sizeofcmds > X86_PAGE_4K_SIZE * 2 - sizeof(mach_header_64_t))
463 return VERR_BAD_EXE_FORMAT;
464
465 /* Do we need to read a 2nd page to get all the load commands? If so, do it. */
466 if (uBuf.Hdr32.sizeofcmds + (f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)) > X86_PAGE_4K_SIZE)
467 {
468 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr + X86_PAGE_4K_SIZE),
469 &uBuf.ab[X86_PAGE_4K_SIZE], X86_PAGE_4K_SIZE);
470 if (RT_FAILURE(rc))
471 return rc;
472 }
473
474 /*
475 * Process the load commands.
476 */
477 RTDBGSEGMENT aSegs[24];
478 uint32_t cSegs = 0;
479 RTUUID Uuid = RTUUID_INITIALIZE_NULL;
480 uint32_t cLeft = uBuf.Hdr32.ncmds;
481 uint32_t cbLeft = uBuf.Hdr32.sizeofcmds;
482 union
483 {
484 uint8_t const *pb;
485 load_command_t const *pGenric;
486 segment_command_32_t const *pSeg32;
487 segment_command_64_t const *pSeg64;
488 section_32_t const *pSect32;
489 section_64_t const *pSect64;
490 symtab_command_t const *pSymTab;
491 uuid_command_t const *pUuid;
492 } uLCmd;
493 uLCmd.pb = &uBuf.ab[f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)];
494
495 while (cLeft-- > 0)
496 {
497 uint32_t const cbCmd = uLCmd.pGenric->cmdsize;
498 if (cbCmd > cbLeft || cbCmd < sizeof(load_command_t))
499 return VERR_BAD_EXE_FORMAT;
500
501 switch (uLCmd.pGenric->cmd)
502 {
503 case LC_SEGMENT_32:
504 if (cbCmd != sizeof(segment_command_32_t) + uLCmd.pSeg32->nsects * sizeof(section_32_t))
505 return VERR_BAD_EXE_FORMAT;
506 if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg32->segname, sizeof(uLCmd.pSeg32->segname)))
507 return VERR_INVALID_NAME;
508 if (!strcmp(uLCmd.pSeg32->segname, "__LINKEDIT"))
509 break; /* This usually is discarded or not loaded at all. */
510 if (cSegs >= RT_ELEMENTS(aSegs))
511 return VERR_BUFFER_OVERFLOW;
512 aSegs[cSegs].Address = uLCmd.pSeg32->vmaddr;
513 aSegs[cSegs].uRva = uLCmd.pSeg32->vmaddr - uModAddr;
514 aSegs[cSegs].cb = uLCmd.pSeg32->vmsize;
515 aSegs[cSegs].fFlags = uLCmd.pSeg32->flags; /* Abusing the flags field here... */
516 aSegs[cSegs].iSeg = cSegs;
517 AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg32->segname));
518 strcpy(aSegs[cSegs].szName, uLCmd.pSeg32->segname);
519 cSegs++;
520 break;
521
522 case LC_SEGMENT_64:
523 if (cbCmd != sizeof(segment_command_64_t) + uLCmd.pSeg64->nsects * sizeof(section_64_t))
524 return VERR_BAD_EXE_FORMAT;
525 if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg64->segname, sizeof(uLCmd.pSeg64->segname)))
526 return VERR_INVALID_NAME;
527 if (!strcmp(uLCmd.pSeg64->segname, "__LINKEDIT"))
528 break; /* This usually is discarded or not loaded at all. */
529 if (cSegs >= RT_ELEMENTS(aSegs))
530 return VERR_BUFFER_OVERFLOW;
531 aSegs[cSegs].Address = uLCmd.pSeg64->vmaddr;
532 aSegs[cSegs].uRva = uLCmd.pSeg64->vmaddr - uModAddr;
533 aSegs[cSegs].cb = uLCmd.pSeg64->vmsize;
534 aSegs[cSegs].fFlags = uLCmd.pSeg64->flags; /* Abusing the flags field here... */
535 aSegs[cSegs].iSeg = cSegs;
536 AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg64->segname));
537 strcpy(aSegs[cSegs].szName, uLCmd.pSeg64->segname);
538 cSegs++;
539 break;
540
541 case LC_UUID:
542 if (cbCmd != sizeof(uuid_command_t))
543 return VERR_BAD_EXE_FORMAT;
544 if (RTUuidIsNull((PCRTUUID)&uLCmd.pUuid->uuid[0]))
545 return VERR_BAD_EXE_FORMAT;
546 memcpy(&Uuid, &uLCmd.pUuid->uuid[0], sizeof(uLCmd.pUuid->uuid));
547 break;
548
549 default:
550 /* Current known max plus a lot of slack. */
551 if (uLCmd.pGenric->cmd > LC_DYLIB_CODE_SIGN_DRS + 32)
552 return VERR_BAD_EXE_FORMAT;
553 break;
554 }
555
556 /* next */
557 cbLeft -= cbCmd;
558 uLCmd.pb += cbCmd;
559 }
560
561 if (cbLeft != 0)
562 return VERR_BAD_EXE_FORMAT;
563
564 /*
565 * Some post processing checks.
566 */
567 uint32_t iSeg;
568 for (iSeg = 0; iSeg < cSegs; iSeg++)
569 if (aSegs[iSeg].Address == uModAddr)
570 break;
571 if (iSeg >= cSegs)
572 return VERR_ADDRESS_CONFLICT;
573
574 /*
575 * Create a debug module.
576 */
577 RTDBGMOD hMod;
578 rc = RTDbgModCreateFromMachOImage(&hMod, pszName, NULL, f64Bit ? RTLDRARCH_AMD64 : RTLDRARCH_X86_32, 0 /*cbImage*/,
579 cSegs, aSegs, &Uuid, DBGFR3AsGetConfig(pUVM), RTDBGMOD_F_NOT_DEFERRED);
580
581 if (RT_FAILURE(rc))
582 {
583 /*
584 * Final fallback is a container module.
585 */
586 rc = RTDbgModCreate(&hMod, pszName, 0, 0);
587 if (RT_FAILURE(rc))
588 return rc;
589
590 uint64_t uRvaNext = 0;
591 for (iSeg = 0; iSeg < cSegs && RT_SUCCESS(rc); iSeg++)
592 {
593 if ( aSegs[iSeg].uRva > uRvaNext
594 && aSegs[iSeg].uRva - uRvaNext < _1M)
595 uRvaNext = aSegs[iSeg].uRva;
596 rc = RTDbgModSegmentAdd(hMod, aSegs[iSeg].uRva, aSegs[iSeg].cb, aSegs[iSeg].szName, 0, NULL);
597 if (aSegs[iSeg].cb > 0 && RT_SUCCESS(rc))
598 {
599 char szTmp[RTDBG_SEGMENT_NAME_LENGTH + sizeof("_start")];
600 strcat(strcpy(szTmp, aSegs[iSeg].szName), "_start");
601 rc = RTDbgModSymbolAdd(hMod, szTmp, iSeg, 0 /*uRva*/, 0 /*cb*/, 0 /*fFlags*/, NULL);
602 }
603 uRvaNext += aSegs[iSeg].cb;
604 }
605
606 if (RT_FAILURE(rc))
607 {
608 RTDbgModRelease(hMod);
609 return rc;
610 }
611 }
612
613 /* Tag the module. */
614 rc = RTDbgModSetTag(hMod, DIG_DARWIN_MOD_TAG);
615 AssertRC(rc);
616
617 /*
618 * Link the module.
619 */
620 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
621 if (hAs != NIL_RTDBGAS)
622 {
623 //uint64_t uRvaNext = 0; - what was this?
624 uint32_t cLinked = 0;
625 iSeg = cSegs;
626 while (iSeg-- > 0) /* HACK: Map in reverse order to avoid replacing __TEXT. */
627 if (aSegs[iSeg].cb)
628 {
629 /* Find matching segment in the debug module. */
630 uint32_t iDbgSeg = 0;
631 while (iDbgSeg < cSegs)
632 {
633 RTDBGSEGMENT SegInfo;
634 int rc3 = RTDbgModSegmentByIndex(hMod, iDbgSeg, &SegInfo);
635 if (RT_SUCCESS(rc3) && !strcmp(SegInfo.szName, aSegs[iSeg].szName))
636 break;
637 iDbgSeg++;
638 }
639 AssertMsgStmt(iDbgSeg < cSegs, ("%s\n", aSegs[iSeg].szName), continue);
640
641 /* Map it. */
642 int rc2 = RTDbgAsModuleLinkSeg(hAs, hMod, iDbgSeg, aSegs[iSeg].Address, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
643 if (RT_SUCCESS(rc2))
644 cLinked++;
645 else if (RT_SUCCESS(rc))
646 rc = rc2;
647 }
648 if (RT_FAILURE(rc) && cLinked != 0)
649 rc = -rc;
650 }
651 else
652 rc = VERR_INTERNAL_ERROR;
653
654 RTDbgModRelease(hMod);
655 RTDbgAsRelease(hAs);
656
657 if (pf64Bit)
658 *pf64Bit = f64Bit;
659 return rc;
660}
661
662
663static bool dbgDiggerDarwinIsValidName(const char *pszName)
664{
665 char ch;
666 while ((ch = *pszName++) != '\0')
667 {
668 if (ch < 0x20 || ch >= 127)
669 return false;
670 }
671 return true;
672}
673
674
675static bool dbgDiggerDarwinIsValidVersion(const char *pszVersion)
676{
677 char ch;
678 while ((ch = *pszVersion++) != '\0')
679 {
680 if (ch < 0x20 || ch >= 127)
681 return false;
682 }
683 return true;
684}
685
686
687/**
688 * @copydoc DBGFOSREG::pfnInit
689 */
690static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, void *pvData)
691{
692 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
693 Assert(!pThis->fValid);
694
695 /*
696 * Add the kernel module.
697 */
698 bool f64Bit;
699 int rc = dbgDiggerDarwinAddModule(pThis, pUVM, pThis->AddrKernel.FlatPtr, "mach_kernel", &f64Bit);
700 if (RT_SUCCESS(rc))
701 {
702 /*
703 * The list of modules can be found at the 'kmod' symbol, that means
704 * that we currently require some kind of symbol file for the kernel
705 * to be loaded at this point.
706 *
707 * Note! Could also use the 'gLoadedKextSummaries', but I don't think
708 * it's any easier to find without any kernel map than 'kmod'.
709 */
710 RTDBGSYMBOL SymInfo;
711 rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!kmod", &SymInfo, NULL);
712 if (RT_FAILURE(rc))
713 rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!_kmod", &SymInfo, NULL);
714 if (RT_SUCCESS(rc))
715 {
716 DBGFADDRESS AddrModInfo;
717 DBGFR3AddrFromFlat(pUVM, &AddrModInfo, SymInfo.Value);
718
719 /* Read the variable. */
720 RTUINT64U uKmodValue = { 0 };
721 if (f64Bit)
722 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrModInfo, &uKmodValue.u, sizeof(uKmodValue.u));
723 else
724 rc = DBGFR3MemRead (pUVM, 0 /*idCpu*/, &AddrModInfo, &uKmodValue.s.Lo, sizeof(uKmodValue.s.Lo));
725 if (RT_SUCCESS(rc))
726 {
727 DBGFR3AddrFromFlat(pUVM, &AddrModInfo, uKmodValue.u);
728
729 /* Walk the list of modules. */
730 uint32_t cIterations = 0;
731 while (AddrModInfo.FlatPtr != 0)
732 {
733 /* Some extra loop conditions... */
734 if (!OSX_VALID_ADDRESS(f64Bit, AddrModInfo.FlatPtr))
735 {
736 Log(("OSXDig: Invalid kmod_info pointer: %RGv\n", AddrModInfo.FlatPtr));
737 break;
738 }
739 if (AddrModInfo.FlatPtr == uKmodValue.u && cIterations != 0)
740 {
741 Log(("OSXDig: kmod_info list looped back to the start.\n"));
742 break;
743 }
744 if (cIterations++ >= 2048)
745 {
746 Log(("OSXDig: Too many mod_info loops (%u)\n", cIterations));
747 break;
748 }
749
750 /*
751 * Read the kmod_info_t structure.
752 */
753 union
754 {
755 OSX64_kmod_info_t Info64;
756 OSX32_kmod_info_t Info32;
757 } uMod;
758 RT_ZERO(uMod);
759 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrModInfo, &uMod,
760 f64Bit ? sizeof(uMod.Info64) : sizeof(uMod.Info32));
761 if (RT_FAILURE(rc))
762 {
763 Log(("OSXDig: Error reading kmod_info structure at %RGv: %Rrc\n", AddrModInfo.FlatPtr, rc));
764 break;
765 }
766
767 /*
768 * Validate the kmod_info_t structure.
769 */
770 int32_t iInfoVer = f64Bit ? uMod.Info64.info_version : uMod.Info32.info_version;
771 if (iInfoVer != OSX_KMOD_INFO_VERSION)
772 {
773 Log(("OSXDig: kmod_info @%RGv: Bad info_version %d\n", AddrModInfo.FlatPtr, iInfoVer));
774 break;
775 }
776
777 const char *pszName = f64Bit ? uMod.Info64.name : uMod.Info32.name;
778 if ( !*pszName
779 || !RTStrEnd(pszName, sizeof(uMod.Info64.name))
780 || !dbgDiggerDarwinIsValidName(pszName) )
781 {
782 Log(("OSXDig: kmod_info @%RGv: Bad name '%.*s'\n", AddrModInfo.FlatPtr,
783 sizeof(uMod.Info64.name), pszName));
784 break;
785 }
786
787 const char *pszVersion = f64Bit ? uMod.Info64.version : uMod.Info32.version;
788 if ( !RTStrEnd(pszVersion, sizeof(uMod.Info64.version))
789 || !dbgDiggerDarwinIsValidVersion(pszVersion) )
790 {
791 Log(("OSXDig: kmod_info @%RGv: Bad version '%.*s'\n", AddrModInfo.FlatPtr,
792 sizeof(uMod.Info64.version), pszVersion));
793 break;
794 }
795
796 int32_t cRefs = f64Bit ? uMod.Info64.reference_count : uMod.Info32.reference_count;
797 if (cRefs < -1 || cRefs > 16384)
798 {
799 Log(("OSXDig: kmod_info @%RGv: Bad reference_count %d\n", AddrModInfo.FlatPtr, cRefs));
800 break;
801 }
802
803 uint64_t uImageAddr = f64Bit ? uMod.Info64.address : uMod.Info32.address;
804 if (!OSX_VALID_ADDRESS(f64Bit, uImageAddr))
805 {
806 Log(("OSXDig: kmod_info @%RGv: Bad address %#llx\n", AddrModInfo.FlatPtr, uImageAddr));
807 break;
808 }
809
810 uint64_t cbImage = f64Bit ? uMod.Info64.size : uMod.Info32.size;
811 if (cbImage > 64U*_1M)
812 {
813 Log(("OSXDig: kmod_info @%RGv: Bad size %#llx\n", AddrModInfo.FlatPtr, cbImage));
814 break;
815 }
816
817 uint64_t cbHdr = f64Bit ? uMod.Info64.hdr_size : uMod.Info32.hdr_size;
818 if (cbHdr > 16U*_1M)
819 {
820 Log(("OSXDig: kmod_info @%RGv: Bad hdr_size %#llx\n", AddrModInfo.FlatPtr, cbHdr));
821 break;
822 }
823
824 uint64_t uStartAddr = f64Bit ? uMod.Info64.start : uMod.Info32.start;
825 if (!uStartAddr && !OSX_VALID_ADDRESS(f64Bit, uStartAddr))
826 {
827 Log(("OSXDig: kmod_info @%RGv: Bad start function %#llx\n", AddrModInfo.FlatPtr, uStartAddr));
828 break;
829 }
830
831 uint64_t uStopAddr = f64Bit ? uMod.Info64.stop : uMod.Info32.stop;
832 if (!uStopAddr && !OSX_VALID_ADDRESS(f64Bit, uStopAddr))
833 {
834 Log(("OSXDig: kmod_info @%RGv: Bad stop function %#llx\n", AddrModInfo.FlatPtr, uStopAddr));
835 break;
836 }
837
838 /*
839 * Try add the module.
840 */
841 Log(("OSXDig: kmod_info @%RGv: '%s' ver '%s', image @%#llx LB %#llx cbHdr=%#llx\n", AddrModInfo.FlatPtr,
842 pszName, pszVersion, uImageAddr, cbImage, cbHdr));
843 rc = dbgDiggerDarwinAddModule(pThis, pUVM, uImageAddr, pszName, NULL);
844
845
846 /*
847 * Advance to the next kmod_info entry.
848 */
849 DBGFR3AddrFromFlat(pUVM, &AddrModInfo, f64Bit ? uMod.Info64.next : uMod.Info32.next);
850 }
851 }
852 else
853 Log(("OSXDig: Error reading the 'kmod' variable: %Rrc\n", rc));
854 }
855 else
856 Log(("OSXDig: Failed to locate the 'kmod' variable in mach_kernel.\n"));
857
858 pThis->fValid = true;
859 return VINF_SUCCESS;
860 }
861
862 return rc;
863}
864
865
866/**
867 * @copydoc DBGFOSREG::pfnProbe
868 */
869static DECLCALLBACK(bool) dbgDiggerDarwinProbe(PUVM pUVM, void *pvData)
870{
871 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
872
873 /*
874 * Look for a section + segment combo that normally only occures in
875 * mach_kernel. Follow it up with probing of the rest of the executable
876 * header. We must search a largish area because the more recent versions
877 * of darwin have random load address for security raisins.
878 */
879 static struct { uint64_t uStart, uEnd; } const s_aRanges[] =
880 {
881 /* 64-bit: */
882 { UINT64_C(0xffffff8000000000), UINT64_C(0xffffff81ffffffff), },
883
884 /* 32-bit - always search for this because of the hybrid 32-bit kernel
885 with cpu in long mode that darwin used for a number of versions. */
886 { UINT64_C(0x00001000), UINT64_C(0x0ffff000), }
887 };
888 for (unsigned iRange = DBGFR3CpuGetMode(pUVM, 0 /*idCpu*/) != CPUMMODE_LONG;
889 iRange < RT_ELEMENTS(s_aRanges);
890 iRange++)
891 {
892 DBGFADDRESS KernelAddr;
893 for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, s_aRanges[iRange].uStart);
894 KernelAddr.FlatPtr < s_aRanges[iRange].uEnd;
895 KernelAddr.FlatPtr += X86_PAGE_4K_SIZE)
896 {
897 static const uint8_t s_abNeedle[16 + 16] =
898 {
899 '_','_','t','e','x','t', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::sectname */
900 '_','_','K','L','D', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::segname. */
901 };
902
903 int rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, s_aRanges[iRange].uEnd - KernelAddr.FlatPtr,
904 1, s_abNeedle, sizeof(s_abNeedle), &KernelAddr);
905 if (RT_FAILURE(rc))
906 break;
907 DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & X86_PAGE_4K_OFFSET_MASK);
908
909 /*
910 * Read the first page of the image and check the headers.
911 */
912 union
913 {
914 uint8_t ab[X86_PAGE_4K_SIZE];
915 mach_header_64_t Hdr64;
916 mach_header_32_t Hdr32;
917 } uBuf;
918 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &KernelAddr, uBuf.ab, X86_PAGE_4K_SIZE);
919 if (RT_FAILURE(rc))
920 continue;
921 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
922 if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
923 && uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
924 continue;
925 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
926 bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
927 if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
928 continue;
929 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
930 if (uBuf.Hdr32.filetype != MH_EXECUTE)
931 continue;
932 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
933 if (uBuf.Hdr32.ncmds > 256)
934 continue;
935 AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
936 if (uBuf.Hdr32.sizeofcmds > X86_PAGE_4K_SIZE * 2 - sizeof(mach_header_64_t))
937 continue;
938
939 /* Seems good enough for now.
940
941 If the above causes false positives, check the segments and make
942 sure there is a kernel version string in the right one. */
943 pThis->AddrKernel = KernelAddr;
944 pThis->f64Bit = f64Bit;
945
946 /*
947 * Finally, find the kernel version string.
948 */
949 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, 32*_1M, 1, RT_STR_TUPLE("Darwin Kernel Version"),
950 &pThis->AddrKernelVersion);
951 if (RT_FAILURE(rc))
952 DBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelVersion, 0);
953 return true;
954 }
955 }
956 return false;
957}
958
959
960/**
961 * @copydoc DBGFOSREG::pfnDestruct
962 */
963static DECLCALLBACK(void) dbgDiggerDarwinDestruct(PUVM pUVM, void *pvData)
964{
965 RT_NOREF2(pUVM, pvData);
966
967}
968
969
970/**
971 * @copydoc DBGFOSREG::pfnConstruct
972 */
973static DECLCALLBACK(int) dbgDiggerDarwinConstruct(PUVM pUVM, void *pvData)
974{
975 RT_NOREF1(pUVM);
976 PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
977
978 pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
979 pThis->IDmesg.pfnQueryKernelLog = dbgDiggerDarwinIDmsg_QueryKernelLog;
980 pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
981
982 return VINF_SUCCESS;
983}
984
985
986const DBGFOSREG g_DBGDiggerDarwin =
987{
988 /* .u32Magic = */ DBGFOSREG_MAGIC,
989 /* .fFlags = */ 0,
990 /* .cbData = */ sizeof(DBGDIGGERDARWIN),
991 /* .szName = */ "Darwin",
992 /* .pfnConstruct = */ dbgDiggerDarwinConstruct,
993 /* .pfnDestruct = */ dbgDiggerDarwinDestruct,
994 /* .pfnProbe = */ dbgDiggerDarwinProbe,
995 /* .pfnInit = */ dbgDiggerDarwinInit,
996 /* .pfnRefresh = */ dbgDiggerDarwinRefresh,
997 /* .pfnTerm = */ dbgDiggerDarwinTerm,
998 /* .pfnQueryVersion = */ dbgDiggerDarwinQueryVersion,
999 /* .pfnQueryInterface = */ dbgDiggerDarwinQueryInterface,
1000 /* .pfnStackUnwindAssist = */ dbgDiggerDarwinStackUnwindAssist,
1001 /* .u32EndMagic = */ DBGFOSREG_MAGIC
1002};
1003
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use