VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp

Last change on this file was 104433, checked in by vboxsync, 3 weeks ago

DBGPlugInWinNt: Flag and some comments on LDR_DATA_TABLE_ENTRY / KLDR_DATA_TABLE_ENTRY.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 74.5 KB
Line 
1/* $Id: DBGPlugInWinNt.cpp 104433 2024-04-25 14:13:49Z vboxsync $ */
2/** @file
3 * DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4 */
5
6/*
7 * Copyright (C) 2009-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
33#include "DBGPlugIns.h"
34#include <VBox/vmm/dbgf.h>
35#include <VBox/vmm/cpumctx.h>
36#include <VBox/vmm/mm.h>
37#ifdef VBOX_DEBUGGER_WITH_WIN_DBG_PRINT_HOOKING
38# include <VBox/vmm/vmapi.h>
39# include <VBox/dis.h>
40#endif
41#include <VBox/vmm/vmmr3vtable.h>
42#include <VBox/err.h>
43#include <VBox/param.h>
44#include <iprt/ctype.h>
45#include <iprt/ldr.h>
46#include <iprt/mem.h>
47#include <iprt/path.h>
48#include <iprt/stream.h>
49#include <iprt/string.h>
50#include <iprt/utf16.h>
51#include <iprt/formats/pecoff.h>
52#include <iprt/formats/mz.h>
53#include <iprt/nt/nt-structures.h>
54
55
56/*********************************************************************************************************************************
57* Structures and Typedefs *
58*********************************************************************************************************************************/
59
60/** @name Internal WinNT structures
61 * @{ */
62/**
63 * PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
64 * Tested with XP.
65 *
66 * See comments in NTMTE64.
67 */
68typedef struct NTMTE32
69{
70 struct
71 {
72 uint32_t Flink;
73 uint32_t Blink;
74 } InLoadOrderLinks,
75 InMemoryOrderModuleList,
76 InInitializationOrderModuleList;
77 uint32_t DllBase;
78 uint32_t EntryPoint;
79 /** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
80 * boot loader, for other images it looks like some kind of pointer. */
81 uint32_t SizeOfImage;
82 struct
83 {
84 uint16_t Length;
85 uint16_t MaximumLength;
86 uint32_t Buffer;
87 } FullDllName,
88 BaseDllName;
89 uint32_t Flags; /**< NTMTE_F_XXX */
90 uint16_t LoadCount;
91 uint16_t TlsIndex;
92 /* ... there is more ... */
93} NTMTE32;
94typedef NTMTE32 *PNTMTE32;
95
96/**
97 * PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
98 *
99 * Starting with XP it it's specialized for the kernel as KLDR_DATA_TABLE_ENTRY
100 * with compatible layout up to a point, the non-K version is used in user land.
101 * The Flags values probably differs a bit by now.
102 */
103typedef struct NTMTE64
104{
105 struct
106 {
107 uint64_t Flink;
108 uint64_t Blink;
109 } InLoadOrderLinks, /**< 0x00 */
110 InMemoryOrderModuleList, /**< 0x10 */
111 InInitializationOrderModuleList; /**< 0x20 */
112 uint64_t DllBase; /**< 0x30 */
113 uint64_t EntryPoint; /**< 0x38 */
114 uint32_t SizeOfImage; /**< 0x40 */
115 uint32_t Alignment; /**< 0x44 */
116 struct
117 {
118 uint16_t Length; /**< 0x48,0x58 */
119 uint16_t MaximumLength; /**< 0x4a,0x5a */
120 uint32_t Alignment; /**< 0x4c,0x5c */
121 uint64_t Buffer; /**< 0x50,0x60 */
122 } FullDllName, /**< 0x48 */
123 BaseDllName; /**< 0x58 */
124 uint32_t Flags; /**< 0x68 NTMTE_F_XXX */
125 uint16_t LoadCount; /**< 0x6c */
126 uint16_t TlsIndex; /**< 0x6e */
127 /* ... there is more ... */
128} NTMTE64;
129typedef NTMTE64 *PNTMTE64;
130
131#define NTMTE_F_FORCE_INTEGRITY 0x20 /* copy of IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY */
132
133/** MTE union. */
134typedef union NTMTE
135{
136 NTMTE32 vX_32;
137 NTMTE64 vX_64;
138} NTMTE;
139typedef NTMTE *PNTMTE;
140
141
142/**
143 * The essential bits of the KUSER_SHARED_DATA structure.
144 */
145typedef struct NTKUSERSHAREDDATA
146{
147 uint32_t TickCountLowDeprecated;
148 uint32_t TickCountMultiplier;
149 struct
150 {
151 uint32_t LowPart;
152 int32_t High1Time;
153 int32_t High2Time;
154
155 } InterruptTime,
156 SystemTime,
157 TimeZoneBias;
158 uint16_t ImageNumberLow;
159 uint16_t ImageNumberHigh;
160 RTUTF16 NtSystemRoot[260];
161 uint32_t MaxStackTraceDepth;
162 uint32_t CryptoExponent;
163 uint32_t TimeZoneId;
164 uint32_t LargePageMinimum;
165 uint32_t Reserved2[6];
166 uint32_t NtBuildNumber;
167 uint32_t NtProductType;
168 uint8_t ProductTypeIsValid;
169 uint8_t abPadding[3];
170 uint32_t NtMajorVersion;
171 uint32_t NtMinorVersion;
172 /* uint8_t ProcessorFeatures[64];
173 ...
174 */
175} NTKUSERSHAREDDATA;
176typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
177
178/** KI_USER_SHARED_DATA for i386 */
179#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
180/** KI_USER_SHARED_DATA for AMD64 */
181#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
182
183/** NTKUSERSHAREDDATA::NtProductType */
184typedef enum NTPRODUCTTYPE
185{
186 kNtProductType_Invalid = 0,
187 kNtProductType_WinNt = 1,
188 kNtProductType_LanManNt,
189 kNtProductType_Server
190} NTPRODUCTTYPE;
191
192
193/** NT image header union. */
194typedef union NTHDRSU
195{
196 IMAGE_NT_HEADERS32 vX_32;
197 IMAGE_NT_HEADERS64 vX_64;
198} NTHDRS;
199/** Pointer to NT image header union. */
200typedef NTHDRS *PNTHDRS;
201/** Pointer to const NT image header union. */
202typedef NTHDRS const *PCNTHDRS;
203
204
205/**
206 * NT KD version block.
207 */
208typedef struct NTKDVERSIONBLOCK
209{
210 uint16_t MajorVersion;
211 uint16_t MinorVersion;
212 uint8_t ProtocolVersion;
213 uint8_t KdSecondaryVersion;
214 uint16_t Flags;
215 uint16_t MachineType;
216 uint8_t MaxPacketType;
217 uint8_t MaxStateChange;
218 uint8_t MaxManipulate;
219 uint8_t Simulation;
220 uint16_t Unused;
221 uint64_t KernBase;
222 uint64_t PsLoadedModuleList;
223 uint64_t DebuggerDataList;
224} NTKDVERSIONBLOCK;
225/** Pointer to an NT KD version block. */
226typedef NTKDVERSIONBLOCK *PNTKDVERSIONBLOCK;
227/** Pointer to a const NT KD version block. */
228typedef const NTKDVERSIONBLOCK *PCNTKDVERSIONBLOCK;
229
230/** @} */
231
232
233
234typedef enum DBGDIGGERWINNTVER
235{
236 DBGDIGGERWINNTVER_UNKNOWN,
237 DBGDIGGERWINNTVER_3_1,
238 DBGDIGGERWINNTVER_3_5,
239 DBGDIGGERWINNTVER_4_0,
240 DBGDIGGERWINNTVER_5_0,
241 DBGDIGGERWINNTVER_5_1,
242 DBGDIGGERWINNTVER_6_0
243} DBGDIGGERWINNTVER;
244
245/**
246 * WinNT guest OS digger instance data.
247 */
248typedef struct DBGDIGGERWINNT
249{
250 /** Whether the information is valid or not.
251 * (For fending off illegal interface method calls.) */
252 bool fValid;
253 /** 32-bit (true) or 64-bit (false) */
254 bool f32Bit;
255 /** Set if NT 3.1 was detected.
256 * This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
257 bool fNt31;
258
259 /** The NT version. */
260 DBGDIGGERWINNTVER enmVer;
261 /** NTKUSERSHAREDDATA::NtProductType */
262 NTPRODUCTTYPE NtProductType;
263 /** NTKUSERSHAREDDATA::NtMajorVersion */
264 uint32_t NtMajorVersion;
265 /** NTKUSERSHAREDDATA::NtMinorVersion */
266 uint32_t NtMinorVersion;
267 /** NTKUSERSHAREDDATA::NtBuildNumber */
268 uint32_t NtBuildNumber;
269
270 /** The address of the ntoskrnl.exe image. */
271 DBGFADDRESS KernelAddr;
272 /** The address of the ntoskrnl.exe module table entry. */
273 DBGFADDRESS KernelMteAddr;
274 /** The address of PsLoadedModuleList. */
275 DBGFADDRESS PsLoadedModuleListAddr;
276
277 /** Array of detected KPCR addresses for each vCPU. */
278 PDBGFADDRESS paKpcrAddr;
279 /** Array of detected KPCRB addresses for each vCPU. */
280 PDBGFADDRESS paKpcrbAddr;
281
282 /** The Windows NT specifics interface. */
283 DBGFOSIWINNT IWinNt;
284
285#ifdef VBOX_DEBUGGER_WITH_WIN_DBG_PRINT_HOOKING
286 /** Breakpoint owner handle for the DbgPrint/vDbgPrint{,Ex}... interception. */
287 DBGFBPOWNER hBpOwnerDbgPrint;
288 /** Breakpoint handle for the DbgPrint/vDbgPrint{,Ex}... interception. */
289 DBGFBP hBpDbgPrint;
290#endif
291} DBGDIGGERWINNT;
292/** Pointer to the linux guest OS digger instance data. */
293typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
294
295
296/**
297 * The WinNT digger's loader reader instance data.
298 */
299typedef struct DBGDIGGERWINNTRDR
300{
301 /** The VM handle (referenced). */
302 PUVM pUVM;
303 /** The image base. */
304 DBGFADDRESS ImageAddr;
305 /** The image size. */
306 uint32_t cbImage;
307 /** The file offset of the SizeOfImage field in the optional header if it
308 * needs patching, otherwise set to UINT32_MAX. */
309 uint32_t offSizeOfImage;
310 /** The correct image size. */
311 uint32_t cbCorrectImageSize;
312 /** Number of entries in the aMappings table. */
313 uint32_t cMappings;
314 /** Mapping hint. */
315 uint32_t iHint;
316 /** Mapping file offset to memory offsets, ordered by file offset. */
317 struct
318 {
319 /** The file offset. */
320 uint32_t offFile;
321 /** The size of this mapping. */
322 uint32_t cbMem;
323 /** The offset to the memory from the start of the image. */
324 uint32_t offMem;
325 } aMappings[1];
326} DBGDIGGERWINNTRDR;
327/** Pointer a WinNT loader reader instance data. */
328typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
329
330
331/*********************************************************************************************************************************
332* Defined Constants And Macros *
333*********************************************************************************************************************************/
334/** Validates a 32-bit Windows NT kernel address */
335#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
336/** Validates a 64-bit Windows NT kernel address */
337#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
338/** Validates a kernel address. */
339#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
340/** Versioned and bitness wrapper. */
341#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
342
343/** The length (in chars) of the kernel file name (no path). */
344#define WINNT_KERNEL_BASE_NAME_LEN 12
345
346/** WindowsNT on little endian ASCII systems. */
347#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
348
349
350/*********************************************************************************************************************************
351* Internal Functions *
352*********************************************************************************************************************************/
353static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData);
354
355
356/*********************************************************************************************************************************
357* Global Variables *
358*********************************************************************************************************************************/
359/** Kernel names. */
360static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
361{
362 { 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
363};
364
365
366#ifdef VBOX_DEBUGGER_WITH_WIN_DBG_PRINT_HOOKING
367/**
368 * Queries the string from guest memory with the pointer in the given register, sanitizing it.
369 *
370 * @returns VBox status code.
371 * @param pUVM The user mode VM handle.
372 * @param idCpu The CPU ID.
373 * @param enmReg The register to query the string pointer from.
374 * @param pszBuf Where to store the sanitized string.
375 * @param cbBuf Size of the buffer in number of bytes.
376 */
377static int dbgDiggerWinNtDbgPrintQueryStringFromReg(PUVM pUVM, VMCPUID idCpu, DBGFREG enmReg, char *pszBuf, size_t cbBuf)
378{
379 uint64_t u64RegPtr = 0;
380 int rc = DBGFR3RegCpuQueryU64(pUVM, idCpu, enmReg, &u64RegPtr);
381 if ( rc == VINF_SUCCESS
382 || rc == VINF_DBGF_ZERO_EXTENDED_REGISTER) /* Being strict about what we expect here. */
383 {
384 DBGFADDRESS AddrStr;
385 DBGFR3AddrFromFlat(pUVM, &AddrStr, u64RegPtr);
386 rc = DBGFR3MemRead(pUVM, idCpu, &AddrStr, pszBuf, cbBuf);
387 if (RT_SUCCESS(rc))
388 {
389 /* Check that there is a zero terminator and purge invalid encoding (expecting UTF-8 here). */
390 size_t idx = 0;
391 for (idx = 0; idx < cbBuf; idx++)
392 if (pszBuf[idx] == '\0')
393 break;
394
395 if (idx == cbBuf)
396 pszBuf[cbBuf - 1] = '\0'; /* Force terminator, truncating the string. */
397 else
398 memset(&pszBuf[idx], 0, cbBuf - idx); /* Clear everything afterwards. */
399
400 /* Purge the string encoding. */
401 RTStrPurgeEncoding(pszBuf);
402 }
403 }
404 else if (RT_SUCCESS(rc))
405 rc = VERR_INVALID_STATE;
406
407 return rc;
408}
409
410
411/**
412 * @copydoc{FNDBGFBPHIT, Breakpoint callback for the DbgPrint interception.}
413 */
414static DECLCALLBACK(VBOXSTRICTRC) dbgDiggerWinNtDbgPrintHit(PVM pVM, VMCPUID idCpu, void *pvUserBp, DBGFBP hBp, PCDBGFBPPUB pBpPub, uint16_t fFlags)
415{
416 RT_NOREF(hBp, pBpPub, fFlags);
417 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvUserBp;
418 PUVM pUVM = VMR3GetUVM(pVM);
419
420 /*
421 * The worker prototype looks like the following:
422 * vDbgPrintExWorker(PCCH Prefix, ULONG ComponentId, ULONG Level, PCCH Format, va_list arglist, BOOL fUnknown)
423 *
424 * Depending on the bitness the parameters are grabbed from the appropriate registers and stack locations.
425 * For amd64 reading the following is recommended:
426 * https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention?view=vs-2019
427 * https://docs.microsoft.com/en-us/cpp/build/prolog-and-epilog?view=vs-2019
428 * https://docs.microsoft.com/en-us/cpp/build/stack-usage?view=vs-2019
429 *
430 * @todo 32bit
431 */
432 int rc = VINF_SUCCESS;
433 uint32_t idComponent = 0;
434 uint32_t iLevel = 0;
435 char aszPrefixStr[128]; /* Restricted size. */
436 char aszFmtStr[_1K]; /* Restricted size. */
437 DBGFADDRESS AddrVaList;
438 if (!pThis->f32Bit)
439 {
440 /*
441 * Grab the prefix, component, level, format string pointer from the registers and the argument list from the
442 * stack (mind the home area for the register arguments).
443 */
444 rc = dbgDiggerWinNtDbgPrintQueryStringFromReg(pUVM, idCpu, DBGFREG_RCX, &aszPrefixStr[0], sizeof(aszPrefixStr));
445 if (RT_SUCCESS(rc))
446 rc = DBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_RDX, &idComponent);
447 if (RT_SUCCESS(rc))
448 rc = DBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_R8, &iLevel);
449 if (RT_SUCCESS(rc))
450 rc = dbgDiggerWinNtDbgPrintQueryStringFromReg(pUVM, idCpu, DBGFREG_R9, &aszFmtStr[0], sizeof(aszFmtStr));
451 if (RT_SUCCESS(rc))
452 {
453 /* Grabbing the pointer to the va list. The stack layout when we are here looks like (each entry is 64bit):
454 * +-------------+
455 * | ... |
456 * | VA list ptr |
457 * | (arg3/r9) |
458 * | (arg2/r8) |
459 * | (arg1/rdx) |
460 * | (arg0/rcx) |
461 * | return RIP |
462 * +-------------+ <- RSP
463 */
464 uint64_t uRegRsp = 0;
465 rc = DBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_RSP, &uRegRsp);
466 if (rc == VINF_SUCCESS)
467 {
468 DBGFADDRESS AddrVaListPtr;
469 RTGCUINTPTR GCPtrVaList = 0;
470
471 DBGFR3AddrFromFlat(pUVM, &AddrVaListPtr, uRegRsp + 5 * sizeof(RTGCUINTPTR));
472 rc = DBGFR3MemRead(pUVM, idCpu, &AddrVaListPtr, &GCPtrVaList, sizeof(GCPtrVaList));
473 if (RT_SUCCESS(rc))
474 DBGFR3AddrFromFlat(pUVM, &AddrVaList, GCPtrVaList);
475 }
476 else
477 rc = VERR_INVALID_STATE;
478 }
479 }
480 else
481 rc = VERR_NOT_IMPLEMENTED; /** @todo */
482
483 if (RT_SUCCESS(rc))
484 {
485 LogRel(("DigWinNt/DbgPrint: Queried arguments %s %#x %u %s %RGv\n", &aszPrefixStr[0], idComponent, iLevel, &aszFmtStr[0], AddrVaList.FlatPtr));
486 /** @todo Continue here. */
487 }
488 else
489 LogRel(("DigWinNt/DbgPrint: Failed to query all arguments with rc=%Rrc\n", rc));
490
491 return VINF_SUCCESS;
492}
493
494
495/**
496 * Disassembles the given instruction and checks whether it is a call with a fixed address.
497 *
498 * @returns Flag whether the insturction at the given address is a call.
499 * @param pThis The instance data.
500 * @param pUVM The user mode VM handle.
501 * @param pAddrInsn Guest address of the instruction.
502 * @param pAddrCall Where to store the destination if the instruction is a call.
503 */
504static bool dbgDiggerWinNtDbgPrintWrapperInsnIsCall(PDBGDIGGERWINNT pThis, PUVM pUVM, PCDBGFADDRESS pAddrInsn, PDBGFADDRESS pAddrCall)
505{
506 DISSTATE DisState;
507 RT_ZERO(DisState);
508
509 /* Prefetch the instruction. */
510 uint8_t abInstr[32];
511 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, pAddrInsn, &abInstr[0], sizeof(abInstr));
512 if (RT_SUCCESS(rc))
513 {
514 uint32_t cbInsn = 0;
515 rc = DISInstr(&abInstr[0], pThis->f32Bit ? DISCPUMODE_32BIT : DISCPUMODE_64BIT, &DisState, &cbInsn);
516 if ( RT_SUCCESS(rc)
517 && DisState.pCurInstr->uOpcode == OP_CALL
518 && DisState.Param1.fUse & DISUSE_IMMEDIATE)
519 {
520 if (DisState.Param1.fUse & (DISUSE_IMMEDIATE32 | DISUSE_IMMEDIATE64))
521 DBGFR3AddrFromFlat(pUVM, pAddrCall, DisState.Param1.uValue);
522 else if (DisState.Param1.fUse & (DISUSE_IMMEDIATE32_REL | DISUSE_IMMEDIATE64_REL))
523 {
524 *pAddrCall = *pAddrInsn;
525 DBGFR3AddrAdd(pAddrCall, DisState.Param1.uValue + cbInsn);
526 }
527
528 return true;
529 }
530 }
531
532 return false;
533}
534
535
536/**
537 * Tries to find the single call instruction of the DbgPrint/etc. worker in the given control flow graph
538 * (single basic block assumed).
539 *
540 * @returns VBox status code.
541 * @param pThis The instance data.
542 * @param pUVM The user mode VM handle.
543 * @param hFlow The control flow graph handle.
544 * @param pAddr Where to store the worker address on success.
545 */
546static int dbgDiggerWinNtDbgPrintResolveWorker(PDBGDIGGERWINNT pThis, PUVM pUVM, DBGFFLOW hFlow, PDBGFADDRESS pAddr)
547{
548 DBGFFLOWBB hBb;
549 int rc = DBGFR3FlowQueryStartBb(hFlow, &hBb);
550 if (RT_SUCCESS(rc))
551 {
552 bool fCallFound = false;
553
554 for (uint32_t i = 0; i < DBGFR3FlowBbGetInstrCount(hBb) && RT_SUCCESS(rc); i++)
555 {
556 DBGFADDRESS AddrInsn;
557 uint32_t cbInsn;
558 rc = DBGFR3FlowBbQueryInstr(hBb, i, &AddrInsn, &cbInsn, NULL);
559 if (RT_SUCCESS(rc))
560 {
561 DBGFADDRESS AddrCall;
562 if (dbgDiggerWinNtDbgPrintWrapperInsnIsCall(pThis, pUVM, &AddrInsn, &AddrCall))
563 {
564 if (!fCallFound)
565 {
566 *pAddr = AddrCall;
567 fCallFound = true;
568 }
569 else
570 {
571 LogRel(("DigWinNt/DbgPrint: nt!vDbgPrintEx contains multiple call instructions!\n"));
572 rc = VERR_ALREADY_EXISTS;
573 }
574 }
575 }
576 }
577
578 DBGFR3FlowBbRelease(hBb);
579 }
580
581 return rc;
582}
583
584
585/**
586 * Tries to resolve and hook into the worker for all the DbgPrint like wrappers to be able
587 * to gather debug information from the system.
588 *
589 * @param pThis The instance data.
590 * @param pUVM The user mode VM handle.
591 */
592static void dbgDiggerWinNtDbgPrintHook(PDBGDIGGERWINNT pThis, PUVM pUVM)
593{
594 /*
595 * This is a multi step process:
596 * 1. Try to resolve the address of vDbgPrint() (available since XP).
597 * 2. Create a control flow graph from the code and verify the following assumptions:
598 * 1. Only a single basic block.
599 * 2. Just one call instruction.
600 * @todo More?
601 * 3. Get the address from the called worker
602 * 4. Set a hardware breakpoint with our callback.
603 */
604 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
605 if (hAs != NIL_RTDBGAS)
606 {
607 RTDBGSYMBOL SymInfo;
608 int rc = RTDbgAsSymbolByName(hAs, "nt!vDbgPrintEx", &SymInfo, NULL /*phMod*/);
609 if (RT_SUCCESS(rc))
610 {
611 DBGFADDRESS Addr;
612 DBGFR3AddrFromFlat(pUVM, &Addr, (RTGCPTR)SymInfo.Value);
613
614 LogRel(("DigWinNt/DbgPrint: nt!vDbgPrintEx resolved to %RGv\n", SymInfo.Value));
615
616 DBGFFLOW hCfg;
617 rc = DBGFR3FlowCreate(pUVM, 0 /*idCpu*/, &Addr, 512 /*cbDisasmMax*/,
618 0 /*fFlagsFlow*/, DBGF_DISAS_FLAGS_UNPATCHED_BYTES | DBGF_DISAS_FLAGS_ANNOTATE_PATCHED | DBGF_DISAS_FLAGS_DEFAULT_MODE,
619 &hCfg);
620 if (RT_SUCCESS(rc))
621 {
622 /* Verify assumptions. */
623 if (DBGFR3FlowGetBbCount(hCfg) == 1)
624 {
625 rc = dbgDiggerWinNtDbgPrintResolveWorker(pThis, pUVM, hCfg, &Addr);
626 if (RT_SUCCESS(rc))
627 {
628 /* Try to hook the worker. */
629 LogRel(("DigWinNt/DbgPrint: Worker for nt!vDbgPrintEx resolved to %RGv\n", Addr.FlatPtr));
630 rc = DBGFR3BpOwnerCreate(pUVM, dbgDiggerWinNtDbgPrintHit, NULL /*pfnBpIoHit*/, &pThis->hBpOwnerDbgPrint);
631 if (RT_SUCCESS(rc))
632 {
633 rc = DBGFR3BpSetInt3Ex(pUVM, pThis->hBpOwnerDbgPrint, pThis, 0 /*idCpu*/, &Addr, DBGF_BP_F_DEFAULT,
634 0 /*iHitTrigger*/, 0 /*iHitDisable*/, &pThis->hBpDbgPrint);
635 if (RT_SUCCESS(rc))
636 LogRel(("DigWinNt/DbgPrint: Hooked nt!vDbgPrintEx worker hBp=%#x\n", pThis->hBpDbgPrint));
637 else
638 {
639 LogRel(("DigWinNt/DbgPrint: Setting hardware breakpoint for nt!vDbgPrintEx worker failed with rc=%Rrc\n", rc));
640 int rc2 = DBGFR3BpOwnerDestroy(pUVM, pThis->hBpOwnerDbgPrint);
641 pThis->hBpOwnerDbgPrint = NIL_DBGFBPOWNER;
642 AssertRC(rc2);
643 }
644 }
645 }
646 /* else LogRel() already done */
647 }
648 else
649 LogRel(("DigWinNt/DbgPrint: Control flow graph for nt!vDbgPrintEx has more than one basic block (%u)\n",
650 DBGFR3FlowGetBbCount(hCfg)));
651
652 DBGFR3FlowRelease(hCfg);
653 }
654 else
655 LogRel(("DigWinNt/DbgPrint: Failed to create control flow graph from nt!vDbgPrintEx rc=%Rrc\n", rc));
656 }
657 else
658 LogRel(("DigWinNt/DbgPrint: Failed to resolve nt!vDbgPrintEx -> rc=%Rrc\n", rc));
659 RTDbgAsRelease(hAs);
660 }
661 else
662 LogRel(("DigWinNt/DbgPrint: Failed to resolve kernel address space handle\n"));
663}
664#endif
665
666/**
667 * Tries to resolve the KPCR and KPCRB addresses for each vCPU.
668 *
669 * @param pThis The instance data.
670 * @param pUVM The user mode VM handle.
671 * @param pVMM The VMM function table.
672 */
673static void dbgDiggerWinNtResolveKpcr(PDBGDIGGERWINNT pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
674{
675 /*
676 * Getting at the KPCR and KPCRB is explained here:
677 * https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kpcr.htm
678 * Together with the available offsets from:
679 * https://github.com/tpn/winsdk-10/blob/master/Include/10.0.16299.0/shared/ksamd64.inc#L883
680 * we can verify that the found addresses are valid by cross checking that the GDTR and self reference
681 * match what we expect.
682 */
683 VMCPUID cCpus = pVMM->pfnDBGFR3CpuGetCount(pUVM);
684 pThis->paKpcrAddr = (PDBGFADDRESS)RTMemAllocZ(cCpus * 2 * sizeof(DBGFADDRESS));
685 if (RT_LIKELY(pThis->paKpcrAddr))
686 {
687 pThis->paKpcrbAddr = &pThis->paKpcrAddr[cCpus];
688
689 /* Work each CPU, unexpected values in each CPU make the whole thing fail to play safe. */
690 int rc = VINF_SUCCESS;
691 for (VMCPUID idCpu = 0; (idCpu < cCpus) && RT_SUCCESS(rc); idCpu++)
692 {
693 PDBGFADDRESS pKpcrAddr = &pThis->paKpcrAddr[idCpu];
694 PDBGFADDRESS pKpcrbAddr = &pThis->paKpcrbAddr[idCpu];
695
696 if (pThis->f32Bit)
697 {
698 /* Read FS base */
699 uint32_t GCPtrKpcrBase = 0;
700
701 rc = pVMM->pfnDBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_FS_BASE, &GCPtrKpcrBase);
702 if ( RT_SUCCESS(rc)
703 && WINNT32_VALID_ADDRESS(GCPtrKpcrBase))
704 {
705 /*
706 * Read the start of the KPCR (@todo Probably move this to a global header)
707 * and verify its content.
708 */
709 struct
710 {
711 uint8_t abOoi[28]; /* Out of interest */
712 uint32_t GCPtrSelf;
713 uint32_t GCPtrCurrentPrcb;
714 uint32_t u32Irql;
715 uint32_t u32Iir;
716 uint32_t u32IirActive;
717 uint32_t u32Idr;
718 uint32_t GCPtrKdVersionBlock;
719 uint32_t GCPtrIdt;
720 uint32_t GCPtrGdt;
721 uint32_t GCPtrTss;
722 } Kpcr;
723
724 LogFlow(("DigWinNt/KPCR[%u]: GS Base %RGv\n", idCpu, GCPtrKpcrBase));
725 pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrAddr, GCPtrKpcrBase);
726
727 rc = pVMM->pfnDBGFR3MemRead(pUVM, idCpu, pKpcrAddr, &Kpcr, sizeof(Kpcr));
728 if (RT_SUCCESS(rc))
729 {
730 uint32_t GCPtrGdt = 0;
731 uint32_t GCPtrIdt = 0;
732
733 rc = pVMM->pfnDBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_GDTR_BASE, &GCPtrGdt);
734 if (RT_SUCCESS(rc))
735 rc = pVMM->pfnDBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_IDTR_BASE, &GCPtrIdt);
736 if (RT_SUCCESS(rc))
737 {
738 if ( Kpcr.GCPtrGdt == GCPtrGdt
739 && Kpcr.GCPtrIdt == GCPtrIdt
740 && Kpcr.GCPtrSelf == pKpcrAddr->FlatPtr)
741 {
742 pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrbAddr, Kpcr.GCPtrCurrentPrcb);
743 LogRel(("DigWinNt/KPCR[%u]: KPCR=%RGv KPCRB=%RGv\n", idCpu, pKpcrAddr->FlatPtr, pKpcrbAddr->FlatPtr));
744
745 /*
746 * Try to extract the NT build number from the KD version block if it exists,
747 * the shared user data might have set it to 0.
748 *
749 * @todo We can use this method to get at the kern base and loaded module list if the other detection
750 * method fails (seen with Windows 10 x86).
751 * @todo On 32bit Windows the debugger data list is also always accessible this way contrary to
752 * the amd64 version where it is only available with "/debug on" set.
753 */
754 if (!pThis->NtBuildNumber)
755 {
756 NTKDVERSIONBLOCK KdVersBlock;
757 DBGFADDRESS AddrKdVersBlock;
758
759 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrKdVersBlock, Kpcr.GCPtrKdVersionBlock);
760 rc = pVMM->pfnDBGFR3MemRead(pUVM, idCpu, &AddrKdVersBlock, &KdVersBlock, sizeof(KdVersBlock));
761 if (RT_SUCCESS(rc))
762 pThis->NtBuildNumber = KdVersBlock.MinorVersion;
763 }
764 }
765 else
766 LogRel(("DigWinNt/KPCR[%u]: KPCR validation error GDT=(%RGv vs %RGv) KPCR=(%RGv vs %RGv)\n", idCpu,
767 Kpcr.GCPtrGdt, GCPtrGdt, Kpcr.GCPtrSelf, pKpcrAddr->FlatPtr));
768 }
769 else
770 LogRel(("DigWinNt/KPCR[%u]: Getting GDT or IDT base register failed with %Rrc\n", idCpu, rc));
771 }
772 }
773 else
774 LogRel(("DigWinNt/KPCR[%u]: Getting FS base register failed with %Rrc (%RGv)\n", idCpu, rc, GCPtrKpcrBase));
775 }
776 else
777 {
778 /* Read GS base which points to the base of the KPCR for each CPU. */
779 RTGCUINTPTR GCPtrTmp = 0;
780 rc = pVMM->pfnDBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_GS_BASE, &GCPtrTmp);
781 if ( RT_SUCCESS(rc)
782 && !WINNT64_VALID_ADDRESS(GCPtrTmp))
783 {
784 /*
785 * Could be a user address when we stopped the VM right in usermode,
786 * read the GS kernel base MSR instead.
787 */
788 rc = pVMM->pfnDBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_MSR_K8_KERNEL_GS_BASE, &GCPtrTmp);
789 }
790
791 if ( RT_SUCCESS(rc)
792 && WINNT64_VALID_ADDRESS(GCPtrTmp))
793 {
794 LogFlow(("DigWinNt/KPCR[%u]: GS Base %RGv\n", idCpu, GCPtrTmp));
795 pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrAddr, GCPtrTmp);
796
797 rc = pVMM->pfnDBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_GDTR_BASE, &GCPtrTmp);
798 if (RT_SUCCESS(rc))
799 {
800 /*
801 * Read the start of the KPCR (@todo Probably move this to a global header)
802 * and verify its content.
803 */
804 struct
805 {
806 RTGCUINTPTR GCPtrGdt;
807 RTGCUINTPTR GCPtrTss;
808 RTGCUINTPTR GCPtrUserRsp;
809 RTGCUINTPTR GCPtrSelf;
810 RTGCUINTPTR GCPtrCurrentPrcb;
811 } Kpcr;
812
813 rc = pVMM->pfnDBGFR3MemRead(pUVM, idCpu, pKpcrAddr, &Kpcr, sizeof(Kpcr));
814 if (RT_SUCCESS(rc))
815 {
816 if ( Kpcr.GCPtrGdt == GCPtrTmp
817 && Kpcr.GCPtrSelf == pKpcrAddr->FlatPtr
818 /** @todo && TSS */ )
819 {
820 pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrbAddr, Kpcr.GCPtrCurrentPrcb);
821 LogRel(("DigWinNt/KPCR[%u]: KPCR=%RGv KPCRB=%RGv\n", idCpu, pKpcrAddr->FlatPtr, pKpcrbAddr->FlatPtr));
822 }
823 else
824 LogRel(("DigWinNt/KPCR[%u]: KPCR validation error GDT=(%RGv vs %RGv) KPCR=(%RGv vs %RGv)\n", idCpu,
825 Kpcr.GCPtrGdt, GCPtrTmp, Kpcr.GCPtrSelf, pKpcrAddr->FlatPtr));
826 }
827 else
828 LogRel(("DigWinNt/KPCR[%u]: Reading KPCR start at %RGv failed with %Rrc\n", idCpu, pKpcrAddr->FlatPtr, rc));
829 }
830 else
831 LogRel(("DigWinNt/KPCR[%u]: Getting GDT base register failed with %Rrc\n", idCpu, rc));
832 }
833 else
834 LogRel(("DigWinNt/KPCR[%u]: Getting GS base register failed with %Rrc\n", idCpu, rc));
835 }
836 }
837
838 if (RT_FAILURE(rc))
839 {
840 LogRel(("DigWinNt/KPCR: Failed to detmine KPCR and KPCRB rc=%Rrc\n", rc));
841 RTMemFree(pThis->paKpcrAddr);
842 pThis->paKpcrAddr = NULL;
843 pThis->paKpcrbAddr = NULL;
844 }
845 }
846 else
847 LogRel(("DigWinNt/KPCR: Failed to allocate %u entries for the KPCR/KPCRB addresses\n", cCpus * 2));
848}
849
850
851/**
852 * Process a PE image found in guest memory.
853 *
854 * @param pThis The instance data.
855 * @param pUVM The user mode VM handle.
856 * @param pVMM The VMM function table.
857 * @param pszName The module name.
858 * @param pszFilename The image filename.
859 * @param pImageAddr The image address.
860 * @param cbImage The size of the image.
861 */
862static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, const char *pszName,
863 const char *pszFilename, PCDBGFADDRESS pImageAddr, uint32_t cbImage)
864{
865 LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
866
867 /*
868 * Do some basic validation first.
869 */
870 if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
871 || cbImage >= _1M * 256)
872 {
873 Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
874 return;
875 }
876
877 /*
878 * Use the common in-memory module reader to create a debug module.
879 */
880 RTERRINFOSTATIC ErrInfo;
881 RTDBGMOD hDbgMod = NIL_RTDBGMOD;
882 int rc = pVMM->pfnDBGFR3ModInMem(pUVM, pImageAddr, pThis->fNt31 ? DBGFMODINMEM_F_PE_NT31 : 0, pszName, pszFilename,
883 pThis->f32Bit ? RTLDRARCH_X86_32 : RTLDRARCH_AMD64, cbImage,
884 &hDbgMod, RTErrInfoInitStatic(&ErrInfo));
885 if (RT_SUCCESS(rc))
886 {
887 /*
888 * Tag the module.
889 */
890 rc = RTDbgModSetTag(hDbgMod, DIG_WINNT_MOD_TAG);
891 AssertRC(rc);
892
893 /*
894 * Link the module.
895 */
896 RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
897 if (hAs != NIL_RTDBGAS)
898 rc = RTDbgAsModuleLink(hAs, hDbgMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
899 else
900 rc = VERR_INTERNAL_ERROR;
901 RTDbgModRelease(hDbgMod);
902 RTDbgAsRelease(hAs);
903 }
904 else if (RTErrInfoIsSet(&ErrInfo.Core))
905 Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc - %s\n", pszName, rc, ErrInfo.Core.pszMsg));
906 else
907 Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc\n", pszName, rc));
908}
909
910
911/**
912 * Generate a debugger compatible module name from a filename.
913 *
914 * @returns Pointer to module name (doesn't need to be pszName).
915 * @param pszFilename The source filename.
916 * @param pszName Buffer to put the module name in.
917 * @param cbName Buffer size.
918 */
919static const char *dbgDiggerWintNtFilenameToModuleName(const char *pszFilename, char *pszName, size_t cbName)
920{
921 /* Skip to the filename part of the filename. :-) */
922 pszFilename = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
923
924 /* We try use 'nt' for the kernel. */
925 if ( RTStrICmpAscii(pszFilename, "ntoskrnl.exe") == 0
926 || RTStrICmpAscii(pszFilename, "ntkrnlmp.exe") == 0)
927 return "nt";
928
929
930 /* Drop the extension if .dll or .sys. */
931 size_t cchFilename = strlen(pszFilename);
932 if ( cchFilename > 4
933 && pszFilename[cchFilename - 4] == '.')
934 {
935 if ( RTStrICmpAscii(&pszFilename[cchFilename - 4], ".sys") == 0
936 || RTStrICmpAscii(&pszFilename[cchFilename - 4], ".dll") == 0)
937 cchFilename -= 4;
938 }
939
940 /* Copy and do replacements. */
941 if (cchFilename >= cbName)
942 cchFilename = cbName - 1;
943 size_t off;
944 for (off = 0; off < cchFilename; off++)
945 {
946 char ch = pszFilename[off];
947 if (!RT_C_IS_ALNUM(ch))
948 ch = '_';
949 pszName[off] = ch;
950 }
951 pszName[off] = '\0';
952 return pszName;
953}
954
955
956/**
957 * @interface_method_impl{DBGFOSIWINNT,pfnQueryVersion}
958 */
959static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryVersion(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
960 uint32_t *puVersMajor, uint32_t *puVersMinor,
961 uint32_t *puBuildNumber, bool *pf32Bit)
962{
963 PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
964 RT_NOREF(pUVM, pVMM);
965
966 if (puVersMajor)
967 *puVersMajor = pData->NtMajorVersion;
968 if (puVersMinor)
969 *puVersMinor = pData->NtMinorVersion;
970 if (puBuildNumber)
971 *puBuildNumber = pData->NtBuildNumber;
972 if (pf32Bit)
973 *pf32Bit = pData->f32Bit;
974 return VINF_SUCCESS;
975}
976
977
978/**
979 * @interface_method_impl{DBGFOSIWINNT,pfnQueryKernelPtrs}
980 */
981static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryKernelPtrs(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
982 PRTGCUINTPTR pGCPtrKernBase, PRTGCUINTPTR pGCPtrPsLoadedModuleList)
983{
984 PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
985 RT_NOREF(pUVM, pVMM);
986
987 *pGCPtrKernBase = pData->KernelAddr.FlatPtr;
988 *pGCPtrPsLoadedModuleList = pData->PsLoadedModuleListAddr.FlatPtr;
989 return VINF_SUCCESS;
990}
991
992
993/**
994 * @interface_method_impl{DBGFOSIWINNT,pfnQueryKpcrForVCpu}
995 */
996static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryKpcrForVCpu(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
997 VMCPUID idCpu, PRTGCUINTPTR pKpcr, PRTGCUINTPTR pKpcrb)
998{
999 PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
1000
1001 if (!pData->paKpcrAddr)
1002 return VERR_NOT_SUPPORTED;
1003
1004 AssertReturn(idCpu < pVMM->pfnDBGFR3CpuGetCount(pUVM), VERR_INVALID_CPU_ID);
1005
1006 if (pKpcr)
1007 *pKpcr = pData->paKpcrAddr[idCpu].FlatPtr;
1008 if (pKpcrb)
1009 *pKpcrb = pData->paKpcrbAddr[idCpu].FlatPtr;
1010 return VINF_SUCCESS;
1011}
1012
1013
1014/**
1015 * @interface_method_impl{DBGFOSIWINNT,pfnQueryCurThrdForVCpu}
1016 */
1017static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryCurThrdForVCpu(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
1018 VMCPUID idCpu, PRTGCUINTPTR pCurThrd)
1019{
1020 PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
1021
1022 if (!pData->paKpcrAddr)
1023 return VERR_NOT_SUPPORTED;
1024
1025 AssertReturn(idCpu < pVMM->pfnDBGFR3CpuGetCount(pUVM), VERR_INVALID_CPU_ID);
1026
1027 DBGFADDRESS AddrCurThrdPtr = pData->paKpcrbAddr[idCpu];
1028 pVMM->pfnDBGFR3AddrAdd(&AddrCurThrdPtr, 0x08); /** @todo Make this prettier. */
1029 return pVMM->pfnDBGFR3MemRead(pUVM, idCpu, &AddrCurThrdPtr, pCurThrd, sizeof(*pCurThrd));
1030}
1031
1032
1033/**
1034 * @copydoc DBGFOSREG::pfnStackUnwindAssist
1035 */
1036static DECLCALLBACK(int) dbgDiggerWinNtStackUnwindAssist(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, VMCPUID idCpu,
1037 PDBGFSTACKFRAME pFrame, PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx,
1038 RTDBGAS hAs, uint64_t *puScratch)
1039{
1040 Assert(pInitialCtx);
1041
1042 /*
1043 * We want to locate trap frames here. The trap frame structure contains
1044 * the 64-bit IRET frame, so given unwind information it's easy to identify
1045 * using the return type and frame address.
1046 */
1047 if (pFrame->fFlags & DBGFSTACKFRAME_FLAGS_64BIT)
1048 {
1049 /*
1050 * Is this a trap frame? If so, try read the trap frame.
1051 */
1052 if ( pFrame->enmReturnType == RTDBGRETURNTYPE_IRET64
1053 && !(pFrame->AddrFrame.FlatPtr & 0x7)
1054 && WINNT64_VALID_ADDRESS(pFrame->AddrFrame.FlatPtr) )
1055 {
1056 KTRAP_FRAME_AMD64 TrapFrame;
1057 RT_ZERO(TrapFrame);
1058 uint64_t const uTrapFrameAddr = pFrame->AddrFrame.FlatPtr
1059 - RT_UOFFSETOF(KTRAP_FRAME_AMD64, ErrCdOrXcptFrameOrS);
1060 int rc = pState->pfnReadStack(pState, uTrapFrameAddr, sizeof(TrapFrame), &TrapFrame);
1061 if (RT_SUCCESS(rc))
1062 {
1063 /* Valid? Not too much else we can check here (EFlags isn't
1064 reliable in manually construct frames). */
1065 if (TrapFrame.ExceptionActive <= 2)
1066 {
1067 pFrame->fFlags |= DBGFSTACKFRAME_FLAGS_TRAP_FRAME;
1068
1069 /*
1070 * Add sure 'register' information from the frame to the frame.
1071 *
1072 * To avoid code duplication, we do this in two steps in a loop.
1073 * The first iteration only figures out how many registers we're
1074 * going to save and allocates room for them. The second iteration
1075 * does the actual adding.
1076 */
1077 uint32_t cRegs = pFrame->cSureRegs;
1078 PDBGFREGVALEX paSureRegs = NULL;
1079#define ADD_REG_NAMED(a_Type, a_ValMemb, a_Value, a_pszName) do { \
1080 if (paSureRegs) \
1081 { \
1082 paSureRegs[iReg].pszName = a_pszName;\
1083 paSureRegs[iReg].enmReg = DBGFREG_END; \
1084 paSureRegs[iReg].enmType = a_Type; \
1085 paSureRegs[iReg].Value.a_ValMemb = (a_Value); \
1086 } \
1087 iReg++; \
1088 } while (0)
1089#define MAYBE_ADD_GREG(a_Value, a_enmReg, a_idxReg) do { \
1090 if (!(pState->u.x86.Loaded.s.fRegs & RT_BIT(a_idxReg))) \
1091 { \
1092 if (paSureRegs) \
1093 { \
1094 pState->u.x86.Loaded.s.fRegs |= RT_BIT(a_idxReg); \
1095 pState->u.x86.auRegs[a_idxReg] = (a_Value); \
1096 paSureRegs[iReg].Value.u64 = (a_Value); \
1097 paSureRegs[iReg].enmReg = a_enmReg; \
1098 paSureRegs[iReg].enmType = DBGFREGVALTYPE_U64; \
1099 paSureRegs[iReg].pszName = NULL; \
1100 } \
1101 iReg++; \
1102 } \
1103 } while (0)
1104 for (unsigned iLoop = 0; iLoop < 2; iLoop++)
1105 {
1106 uint32_t iReg = pFrame->cSureRegs;
1107 ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, uTrapFrameAddr, "TrapFrame");
1108 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.ExceptionActive, "ExceptionActive");
1109 if (TrapFrame.ExceptionActive == 0)
1110 {
1111 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.PreviousIrql, "PrevIrql");
1112 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, (uint8_t)TrapFrame.ErrCdOrXcptFrameOrS, "IntNo");
1113 }
1114 else if ( TrapFrame.ExceptionActive == 1
1115 && TrapFrame.FaultIndicator == ((TrapFrame.ErrCdOrXcptFrameOrS >> 1) & 0x9))
1116 ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, TrapFrame.FaultAddrOrCtxRecOrTS, "cr2-probably");
1117 if (TrapFrame.SegCs & X86_SEL_RPL)
1118 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "UserMode");
1119 else
1120 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "KernelMode");
1121 if (TrapFrame.ExceptionActive <= 1)
1122 {
1123 MAYBE_ADD_GREG(TrapFrame.Rax, DBGFREG_RAX, X86_GREG_xAX);
1124 MAYBE_ADD_GREG(TrapFrame.Rcx, DBGFREG_RCX, X86_GREG_xCX);
1125 MAYBE_ADD_GREG(TrapFrame.Rdx, DBGFREG_RDX, X86_GREG_xDX);
1126 MAYBE_ADD_GREG(TrapFrame.R8, DBGFREG_R8, X86_GREG_x8);
1127 MAYBE_ADD_GREG(TrapFrame.R9, DBGFREG_R9, X86_GREG_x9);
1128 MAYBE_ADD_GREG(TrapFrame.R10, DBGFREG_R10, X86_GREG_x10);
1129 MAYBE_ADD_GREG(TrapFrame.R11, DBGFREG_R11, X86_GREG_x11);
1130 }
1131 else if (TrapFrame.ExceptionActive == 2)
1132 {
1133 MAYBE_ADD_GREG(TrapFrame.Rbx, DBGFREG_RBX, X86_GREG_xBX);
1134 MAYBE_ADD_GREG(TrapFrame.Rsi, DBGFREG_RSI, X86_GREG_xSI);
1135 MAYBE_ADD_GREG(TrapFrame.Rdi, DBGFREG_RDI, X86_GREG_xDI);
1136 }
1137 // MAYBE_ADD_GREG(TrapFrame.Rbp, DBGFREG_RBP, X86_GREG_xBP); - KiInterrupt[Sub]Dispatch* may leave this invalid.
1138
1139 /* Done? */
1140 if (iLoop > 0)
1141 {
1142 Assert(cRegs == iReg);
1143 break;
1144 }
1145
1146 /* Resize the array, zeroing the extension. */
1147 if (pFrame->cSureRegs)
1148 paSureRegs = (PDBGFREGVALEX)pVMM->pfnMMR3HeapRealloc(pFrame->paSureRegs, iReg * sizeof(paSureRegs[0]));
1149 else
1150 paSureRegs = (PDBGFREGVALEX)pVMM->pfnMMR3HeapAllocU(pUVM, MM_TAG_DBGF_STACK, iReg * sizeof(paSureRegs[0]));
1151 AssertReturn(paSureRegs, VERR_NO_MEMORY);
1152
1153 pFrame->paSureRegs = paSureRegs;
1154 RT_BZERO(&paSureRegs[pFrame->cSureRegs], (iReg - pFrame->cSureRegs) * sizeof(paSureRegs[0]));
1155 cRegs = iReg;
1156 }
1157#undef ADD_REG_NAMED
1158#undef MAYBE_ADD_GREG
1159
1160 /* Commit the register update. */
1161 pFrame->cSureRegs = cRegs;
1162 }
1163 }
1164 }
1165 }
1166
1167 RT_NOREF(pUVM, pVMM, pvData, idCpu, hAs, pInitialCtx, puScratch);
1168 return VINF_SUCCESS;
1169}
1170
1171
1172/**
1173 * @copydoc DBGFOSREG::pfnQueryInterface
1174 */
1175static DECLCALLBACK(void *) dbgDiggerWinNtQueryInterface(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, DBGFOSINTERFACE enmIf)
1176{
1177 RT_NOREF(pUVM, pVMM);
1178 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1179
1180 switch (enmIf)
1181 {
1182 case DBGFOSINTERFACE_WINNT:
1183 return &pThis->IWinNt;
1184 default:
1185 return NULL;
1186 }
1187}
1188
1189
1190/**
1191 * @copydoc DBGFOSREG::pfnQueryVersion
1192 */
1193static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData,
1194 char *pszVersion, size_t cchVersion)
1195{
1196 RT_NOREF(pUVM, pVMM);
1197 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1198 Assert(pThis->fValid);
1199
1200 const char *pszNtProductType;
1201 switch (pThis->NtProductType)
1202 {
1203 case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
1204 case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
1205 case kNtProductType_Server: pszNtProductType = "-Server"; break;
1206 default: pszNtProductType = ""; break;
1207 }
1208
1209 RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s (BuildNumber %u)", pThis->NtMajorVersion, pThis->NtMinorVersion,
1210 pThis->f32Bit ? "x86" : "AMD64", pszNtProductType, pThis->NtBuildNumber);
1211 return VINF_SUCCESS;
1212}
1213
1214
1215/**
1216 * @copydoc DBGFOSREG::pfnTerm
1217 */
1218static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1219{
1220 RT_NOREF1(pUVM);
1221 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1222 Assert(pThis->fValid);
1223
1224#ifdef VBOX_DEBUGGER_WITH_WIN_DBG_PRINT_HOOKING
1225 if (pThis->hBpDbgPrint != NIL_DBGFBP)
1226 {
1227 int rc = DBGFR3BpClear(pUVM, pThis->hBpDbgPrint);
1228 AssertRC(rc);
1229 pThis->hBpDbgPrint = NIL_DBGFBP;
1230 }
1231
1232 if (pThis->hBpOwnerDbgPrint != NIL_DBGFBPOWNER)
1233 {
1234 int rc = DBGFR3BpOwnerDestroy(pUVM, pThis->hBpOwnerDbgPrint);
1235 AssertRC(rc);
1236 pThis->hBpOwnerDbgPrint = NIL_DBGFBPOWNER;
1237 }
1238#endif
1239
1240 /*
1241 * As long as we're using our private LDR reader implementation,
1242 * we must unlink and ditch the modules we created.
1243 */
1244 RTDBGAS hDbgAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
1245 if (hDbgAs != NIL_RTDBGAS)
1246 {
1247 uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
1248 while (iMod-- > 0)
1249 {
1250 RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
1251 if (hMod != NIL_RTDBGMOD)
1252 {
1253 if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
1254 {
1255 int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
1256 AssertRC(rc);
1257 }
1258 RTDbgModRelease(hMod);
1259 }
1260 }
1261 RTDbgAsRelease(hDbgAs);
1262 }
1263
1264 if (pThis->paKpcrAddr)
1265 RTMemFree(pThis->paKpcrAddr);
1266 /* pThis->paKpcrbAddr comes from the same allocation as pThis->paKpcrAddr. */
1267
1268 pThis->paKpcrAddr = NULL;
1269 pThis->paKpcrbAddr = NULL;
1270
1271 pThis->fValid = false;
1272}
1273
1274
1275/**
1276 * @copydoc DBGFOSREG::pfnRefresh
1277 */
1278static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1279{
1280 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1281 NOREF(pThis);
1282 Assert(pThis->fValid);
1283
1284 /*
1285 * For now we'll flush and reload everything.
1286 */
1287 dbgDiggerWinNtTerm(pUVM, pVMM, pvData);
1288
1289 return dbgDiggerWinNtInit(pUVM, pVMM, pvData);
1290}
1291
1292
1293/**
1294 * @copydoc DBGFOSREG::pfnInit
1295 */
1296static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1297{
1298 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1299 Assert(!pThis->fValid);
1300
1301 union
1302 {
1303 uint8_t au8[GUEST_PAGE_SIZE * 2];
1304 RTUTF16 wsz[GUEST_PAGE_SIZE];
1305 NTKUSERSHAREDDATA UserSharedData;
1306 } u;
1307 DBGFADDRESS Addr;
1308 int rc;
1309
1310 /*
1311 * Figure the NT version.
1312 */
1313 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
1314 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &u, GUEST_PAGE_SIZE);
1315 if (RT_SUCCESS(rc))
1316 {
1317 pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
1318 ? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
1319 : kNtProductType_Invalid;
1320 pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
1321 pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
1322 pThis->NtBuildNumber = u.UserSharedData.NtBuildNumber;
1323 }
1324 else if (pThis->fNt31)
1325 {
1326 pThis->NtProductType = kNtProductType_WinNt;
1327 pThis->NtMajorVersion = 3;
1328 pThis->NtMinorVersion = 1;
1329 pThis->NtBuildNumber = 0;
1330 }
1331 else
1332 {
1333 Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
1334 return rc;
1335 }
1336
1337 /*
1338 * Dig out the module chain.
1339 */
1340 DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
1341 Addr = pThis->KernelMteAddr;
1342 do
1343 {
1344 /* Read the validate the MTE. */
1345 NTMTE Mte;
1346 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
1347 if (RT_FAILURE(rc))
1348 break;
1349 if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
1350 {
1351 Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
1352 break;
1353 }
1354 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
1355 {
1356 Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
1357 break;
1358 }
1359 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
1360 {
1361 Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
1362 break;
1363 }
1364 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
1365 {
1366 Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
1367 break;
1368 }
1369 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
1370 {
1371 Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
1372 break;
1373 }
1374
1375 uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
1376 if ( !pThis->fNt31
1377 && ( cbImageMte > _256M
1378 || WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
1379 {
1380 Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
1381 Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
1382 break;
1383 }
1384
1385 /* Read the full name. */
1386 DBGFADDRESS AddrName;
1387 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
1388 uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
1389 if (cbName < sizeof(u))
1390 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
1391 else
1392 rc = VERR_OUT_OF_RANGE;
1393 if (RT_FAILURE(rc))
1394 {
1395 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
1396 cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
1397 if (cbName < sizeof(u))
1398 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
1399 else
1400 rc = VERR_OUT_OF_RANGE;
1401 }
1402 if (RT_SUCCESS(rc))
1403 {
1404 u.wsz[cbName / 2] = '\0';
1405
1406 char *pszFilename;
1407 rc = RTUtf16ToUtf8(u.wsz, &pszFilename);
1408 if (RT_SUCCESS(rc))
1409 {
1410 char szModName[128];
1411 const char *pszModName = dbgDiggerWintNtFilenameToModuleName(pszFilename, szModName, sizeof(szModName));
1412
1413 /* Read the start of the PE image and pass it along to a worker. */
1414 DBGFADDRESS ImageAddr;
1415 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
1416 dbgDiggerWinNtProcessImage(pThis, pUVM, pVMM, pszModName, pszFilename, &ImageAddr, cbImageMte);
1417 RTStrFree(pszFilename);
1418 }
1419 }
1420
1421 /* next */
1422 AddrPrev = Addr;
1423 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
1424 } while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
1425 && Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
1426
1427 /* Try resolving the KPCR and KPCRB addresses for each vCPU. */
1428 dbgDiggerWinNtResolveKpcr(pThis, pUVM, pVMM);
1429
1430#ifdef VBOX_DEBUGGER_WITH_WIN_DBG_PRINT_HOOKING
1431 /* Try to hook into the DbgPrint/vDbgPrint... code so we can gather information from the drivers. */
1432 dbgDiggerWinNtDbgPrintHook(pThis, pUVM);
1433#endif
1434
1435 pThis->fValid = true;
1436 return VINF_SUCCESS;
1437}
1438
1439
1440/**
1441 * @copydoc DBGFOSREG::pfnProbe
1442 */
1443static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1444{
1445 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1446 DBGFADDRESS Addr;
1447 union
1448 {
1449 uint8_t au8[8192];
1450 uint16_t au16[8192/2];
1451 uint32_t au32[8192/4];
1452 IMAGE_DOS_HEADER MzHdr;
1453 RTUTF16 wsz[8192/2];
1454 X86DESCGATE a32Gates[X86_XCPT_PF + 1];
1455 X86DESC64GATE a64Gates[X86_XCPT_PF + 1];
1456 } u;
1457
1458 union
1459 {
1460 NTMTE32 v32;
1461 NTMTE64 v64;
1462 } uMte, uMte2, uMte3;
1463
1464 /*
1465 * NT only runs in protected or long mode.
1466 */
1467 CPUMMODE const enmMode = pVMM->pfnDBGFR3CpuGetMode(pUVM, 0 /*idCpu*/);
1468 if (enmMode != CPUMMODE_PROTECTED && enmMode != CPUMMODE_LONG)
1469 return false;
1470 bool const f64Bit = enmMode == CPUMMODE_LONG;
1471 uint64_t const uStart = f64Bit ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
1472 uint64_t const uEnd = f64Bit ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
1473
1474 /*
1475 * To approximately locate the kernel we examine the IDTR handlers.
1476 *
1477 * The exception/trap/fault handlers are all in NT kernel image, we pick
1478 * KiPageFault here.
1479 */
1480 uint64_t uIdtrBase = 0;
1481 uint16_t uIdtrLimit = 0;
1482 int rc = pVMM->pfnDBGFR3RegCpuQueryXdtr(pUVM, 0, DBGFREG_IDTR, &uIdtrBase, &uIdtrLimit);
1483 AssertRCReturn(rc, false);
1484
1485 const uint16_t cbMinIdtr = (X86_XCPT_PF + 1) * (f64Bit ? sizeof(X86DESC64GATE) : sizeof(X86DESCGATE));
1486 if (uIdtrLimit < cbMinIdtr)
1487 return false;
1488
1489 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uIdtrBase), &u, cbMinIdtr);
1490 if (RT_FAILURE(rc))
1491 return false;
1492
1493 uint64_t uKrnlStart = uStart;
1494 uint64_t uKrnlEnd = uEnd;
1495 if (f64Bit)
1496 {
1497 uint64_t uHandler = u.a64Gates[X86_XCPT_PF].u16OffsetLow
1498 | ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16)
1499 | ((uint64_t)u.a64Gates[X86_XCPT_PF].u32OffsetTop << 32);
1500 if (uHandler < uStart || uHandler > uEnd)
1501 return false;
1502 uKrnlStart = (uHandler & ~(uint64_t)_4M) - _512M;
1503 uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
1504 }
1505 else
1506 {
1507 uint32_t uHandler = RT_MAKE_U32(u.a32Gates[X86_XCPT_PF].u16OffsetLow, u.a32Gates[X86_XCPT_PF].u16OffsetHigh);
1508 if (uHandler < uStart || uHandler > uEnd)
1509 return false;
1510 uKrnlStart = (uHandler & ~(uint64_t)_4M) - _64M;
1511 uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
1512 }
1513
1514 /*
1515 * Look for the PAGELK section name that seems to be a part of all kernels.
1516 * Then try find the module table entry for it. Since it's the first entry
1517 * in the PsLoadedModuleList we can easily validate the list head and report
1518 * success.
1519 *
1520 * Note! We ASSUME the section name is 8 byte aligned.
1521 */
1522 DBGFADDRESS KernelAddr;
1523 for (pVMM->pfnDBGFR3AddrFromFlat(pUVM, &KernelAddr, uKrnlStart);
1524 KernelAddr.FlatPtr < uKrnlEnd;
1525 KernelAddr.FlatPtr += GUEST_PAGE_SIZE)
1526 {
1527 bool fNt31 = false;
1528 DBGFADDRESS const RetryAddress = KernelAddr;
1529 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1530 8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
1531 if ( rc == VERR_DBGF_MEM_NOT_FOUND
1532 && enmMode != CPUMMODE_LONG)
1533 {
1534 /* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
1535 following VirtualSize is zero, so check for that too. */
1536 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
1537 8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
1538 fNt31 = true;
1539 }
1540 if (RT_FAILURE(rc))
1541 break;
1542 pVMM->pfnDBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & GUEST_PAGE_OFFSET_MASK);
1543
1544 /* MZ + PE header. */
1545 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &KernelAddr, &u, sizeof(u));
1546 if ( RT_SUCCESS(rc)
1547 && u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
1548 && !(u.MzHdr.e_lfanew & 0x7)
1549 && u.MzHdr.e_lfanew >= 0x080
1550 && u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
1551 {
1552 if (enmMode != CPUMMODE_LONG)
1553 {
1554 IMAGE_NT_HEADERS32 const *pHdrs = (IMAGE_NT_HEADERS32 const *)&u.au8[u.MzHdr.e_lfanew];
1555 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1556 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
1557 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1558 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1559 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
1560 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
1561 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1562 )
1563 {
1564 /* Find the MTE. */
1565 RT_ZERO(uMte);
1566 uMte.v32.DllBase = KernelAddr.FlatPtr;
1567 uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1568 uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
1569 DBGFADDRESS HitAddr;
1570 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1571 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1572 while (RT_SUCCESS(rc))
1573 {
1574 /* check the name. */
1575 DBGFADDRESS MteAddr = HitAddr;
1576 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1577 pVMM->pfnDBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
1578 &uMte2.v32, sizeof(uMte2.v32));
1579 if ( RT_SUCCESS(rc)
1580 && uMte2.v32.DllBase == uMte.v32.DllBase
1581 && uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1582 && uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1583 && WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1584 && WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1585 && WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1586 && uMte2.v32.BaseDllName.Length <= 128
1587 && uMte2.v32.FullDllName.Length <= 260
1588 )
1589 {
1590 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1591 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1592 u.wsz, uMte2.v32.BaseDllName.Length);
1593 u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1594 if ( RT_SUCCESS(rc)
1595 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1596 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1597 )
1598 )
1599 {
1600 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1601 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1602 uMte2.v32.InLoadOrderLinks.Blink),
1603 &uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1604 if ( RT_SUCCESS(rc)
1605 && uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1606 && WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1607 {
1608 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1609 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1610 pThis->KernelAddr = KernelAddr;
1611 pThis->KernelMteAddr = MteAddr;
1612 pThis->PsLoadedModuleListAddr = Addr;
1613 pThis->f32Bit = true;
1614 pThis->fNt31 = fNt31;
1615 return true;
1616 }
1617 }
1618 else if (RT_SUCCESS(rc))
1619 {
1620 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1621 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1622 break; /* Not NT kernel */
1623 }
1624 }
1625
1626 /* next */
1627 pVMM->pfnDBGFR3AddrAdd(&HitAddr, 4);
1628 if (HitAddr.FlatPtr < uEnd)
1629 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1630 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1631 else
1632 rc = VERR_DBGF_MEM_NOT_FOUND;
1633 }
1634 }
1635 }
1636 else
1637 {
1638 IMAGE_NT_HEADERS64 const *pHdrs = (IMAGE_NT_HEADERS64 const *)&u.au8[u.MzHdr.e_lfanew];
1639 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1640 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1641 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1642 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1643 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL))
1644 == IMAGE_FILE_EXECUTABLE_IMAGE
1645 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1646 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1647 )
1648 {
1649 /* Find the MTE. */
1650 RT_ZERO(uMte.v64);
1651 uMte.v64.DllBase = KernelAddr.FlatPtr;
1652 uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1653 uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1654 DBGFADDRESS ScanAddr;
1655 DBGFADDRESS HitAddr;
1656 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1657 uEnd - uStart, 8 /*align*/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1658 while (RT_SUCCESS(rc))
1659 {
1660 /* Read the start of the MTE and check some basic members. */
1661 DBGFADDRESS MteAddr = HitAddr;
1662 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1663 pVMM->pfnDBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1664 &uMte2.v64, sizeof(uMte2.v64));
1665 if ( RT_SUCCESS(rc)
1666 && uMte2.v64.DllBase == uMte.v64.DllBase
1667 && uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1668 && uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1669 && WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1670 && WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1671 && WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1672 && uMte2.v64.BaseDllName.Length <= 128
1673 && uMte2.v64.FullDllName.Length <= 260
1674 )
1675 {
1676 /* Try read the base name and compare with known NT kernel names. */
1677 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1678 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1679 u.wsz, uMte2.v64.BaseDllName.Length);
1680 u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1681 if ( RT_SUCCESS(rc)
1682 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1683 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1684 )
1685 )
1686 {
1687 /* Read the link entry of the previous entry in the list and check that its
1688 forward pointer points at the MTE we've found. */
1689 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1690 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1691 uMte2.v64.InLoadOrderLinks.Blink),
1692 &uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1693 if ( RT_SUCCESS(rc)
1694 && uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1695 && WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1696 {
1697 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1698 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1699 pThis->KernelAddr = KernelAddr;
1700 pThis->KernelMteAddr = MteAddr;
1701 pThis->PsLoadedModuleListAddr = Addr;
1702 pThis->f32Bit = false;
1703 pThis->fNt31 = false;
1704 return true;
1705 }
1706 }
1707 else if (RT_SUCCESS(rc))
1708 {
1709 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1710 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1711 break; /* Not NT kernel */
1712 }
1713 }
1714
1715 /* next */
1716 pVMM->pfnDBGFR3AddrAdd(&HitAddr, 8);
1717 if (HitAddr.FlatPtr < uEnd)
1718 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1719 8 /*align*/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1720 else
1721 rc = VERR_DBGF_MEM_NOT_FOUND;
1722 }
1723 }
1724 }
1725 }
1726 }
1727 return false;
1728}
1729
1730
1731/**
1732 * @copydoc DBGFOSREG::pfnDestruct
1733 */
1734static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1735{
1736 RT_NOREF(pUVM, pVMM, pvData);
1737}
1738
1739
1740/**
1741 * @copydoc DBGFOSREG::pfnConstruct
1742 */
1743static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1744{
1745 RT_NOREF(pUVM, pVMM);
1746 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1747 pThis->fValid = false;
1748 pThis->f32Bit = false;
1749 pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1750
1751 pThis->IWinNt.u32Magic = DBGFOSIWINNT_MAGIC;
1752 pThis->IWinNt.pfnQueryVersion = dbgDiggerWinNtIWinNt_QueryVersion;
1753 pThis->IWinNt.pfnQueryKernelPtrs = dbgDiggerWinNtIWinNt_QueryKernelPtrs;
1754 pThis->IWinNt.pfnQueryKpcrForVCpu = dbgDiggerWinNtIWinNt_QueryKpcrForVCpu;
1755 pThis->IWinNt.pfnQueryCurThrdForVCpu = dbgDiggerWinNtIWinNt_QueryCurThrdForVCpu;
1756 pThis->IWinNt.u32EndMagic = DBGFOSIWINNT_MAGIC;
1757
1758#ifdef VBOX_DEBUGGER_WITH_WIN_DBG_PRINT_HOOKING
1759 pThis->hBpDbgPrint = NIL_DBGFBP;
1760 pThis->hBpOwnerDbgPrint = NIL_DBGFBPOWNER;
1761#endif
1762
1763 return VINF_SUCCESS;
1764}
1765
1766
1767const DBGFOSREG g_DBGDiggerWinNt =
1768{
1769 /* .u32Magic = */ DBGFOSREG_MAGIC,
1770 /* .fFlags = */ 0,
1771 /* .cbData = */ sizeof(DBGDIGGERWINNT),
1772 /* .szName = */ "WinNT",
1773 /* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1774 /* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1775 /* .pfnProbe = */ dbgDiggerWinNtProbe,
1776 /* .pfnInit = */ dbgDiggerWinNtInit,
1777 /* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1778 /* .pfnTerm = */ dbgDiggerWinNtTerm,
1779 /* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1780 /* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1781 /* .pfnStackUnwindAssist = */ dbgDiggerWinNtStackUnwindAssist,
1782 /* .u32EndMagic = */ DBGFOSREG_MAGIC
1783};
1784
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use