DBGPlugInWinNt.cpp@ 46101

Last change on this file since 46101 was 46101, checked in by vboxsync, 12 years ago
More NT4 debugging. Getting closer to working state...
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 37.9 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 46101 2013-05-15 15:36:43Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF ///@todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/err.h>
26	#include <VBox/param.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/string.h>
31
32	#include "../Runtime/include/internal/ldrMZ.h" /* ugly */
33	#include "../Runtime/include/internal/ldrPE.h" /* ugly */
34
35
36	/*******************************************************************************
37	* Structures and Typedefs *
38	*******************************************************************************/
39
40	/** @name Internal WinNT structures
41	* @{ */
42	/**
43	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
44	* Tested with XP.
45	*/
46	typedef struct NTMTE32
47	{
48	struct
49	{
50	uint32_t Flink;
51	uint32_t Blink;
52	} InLoadOrderLinks,
53	InMemoryOrderModuleList,
54	InInitializationOrderModuleList;
55	uint32_t DllBase;
56	uint32_t EntryPoint;
57	uint32_t SizeOfImage;
58	struct
59	{
60	uint16_t Length;
61	uint16_t MaximumLength;
62	uint32_t Buffer;
63	} FullDllName,
64	BaseDllName;
65	uint32_t Flags;
66	uint16_t LoadCount;
67	uint16_t TlsIndex;
68	/* ... there is more ... */
69	} NTMTE32;
70	typedef NTMTE32 *PNTMTE32;
71
72	/**
73	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
74	* Tested with XP.
75	*
76	* @todo This is incomplete and just to get rid of warnings.
77	*/
78	typedef struct NTMTE64
79	{
80	struct
81	{
82	uint64_t Flink;
83	uint64_t Blink;
84	} InLoadOrderLinks,
85	InMemoryOrderModuleList,
86	InInitializationOrderModuleList;
87	uint64_t DllBase;
88	uint64_t EntryPoint;
89	uint32_t SizeOfImage;
90	uint32_t Alignment;
91	struct
92	{
93	uint16_t Length;
94	uint16_t MaximumLength;
95	uint32_t Alignment;
96	uint64_t Buffer;
97	} FullDllName,
98	BaseDllName;
99	uint32_t Flags;
100	uint16_t LoadCount;
101	uint16_t TlsIndex;
102	/* ... there is more ... */
103	} NTMTE64;
104	typedef NTMTE64 *PNTMTE64;
105
106	/** MTE union. */
107	typedef union NTMTE
108	{
109	NTMTE32 vX_32;
110	NTMTE64 vX_64;
111	} NTMTE;
112	typedef NTMTE *PNTMTE;
113
114
115	/**
116	* The essential bits of the KUSER_SHARED_DATA structure.
117	*/
118	typedef struct NTKUSERSHAREDDATA
119	{
120	uint32_t TickCountLowDeprecated;
121	uint32_t TickCountMultiplier;
122	struct
123	{
124	uint32_t LowPart;
125	int32_t High1Time;
126	int32_t High2Time;
127
128	} InterruptTime,
129	SystemTime,
130	TimeZoneBias;
131	uint16_t ImageNumberLow;
132	uint16_t ImageNumberHigh;
133	RTUTF16 NtSystemRoot[260];
134	uint32_t MaxStackTraceDepth;
135	uint32_t CryptoExponent;
136	uint32_t TimeZoneId;
137	uint32_t LargePageMinimum;
138	uint32_t Reserved2[7];
139	uint32_t NtProductType;
140	uint8_t ProductTypeIsValid;
141	uint8_t abPadding[3];
142	uint32_t NtMajorVersion;
143	uint32_t NtMinorVersion;
144	/* uint8_t ProcessorFeatures[64];
145	...
146	*/
147	} NTKUSERSHAREDDATA;
148	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
149
150	/** KI_USER_SHARED_DATA for i386 */
151	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
152	/** KI_USER_SHARED_DATA for AMD64 */
153	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
154
155	/** NTKUSERSHAREDDATA::NtProductType */
156	typedef enum NTPRODUCTTYPE
157	{
158	kNtProductType_Invalid = 0,
159	kNtProductType_WinNt = 1,
160	kNtProductType_LanManNt,
161	kNtProductType_Server
162	} NTPRODUCTTYPE;
163
164
165	/** NT image header union. */
166	typedef union NTHDRSU
167	{
168	IMAGE_NT_HEADERS32 vX_32;
169	IMAGE_NT_HEADERS64 vX_64;
170	} NTHDRS;
171	/** Pointer to NT image header union. */
172	typedef NTHDRS *PNTHDRS;
173	/** Pointer to const NT image header union. */
174	typedef NTHDRS const *PCNTHDRS;
175
176	/** @} */
177
178
179
180	typedef enum DBGDIGGERWINNTVER
181	{
182	DBGDIGGERWINNTVER_UNKNOWN,
183	DBGDIGGERWINNTVER_3_1,
184	DBGDIGGERWINNTVER_3_5,
185	DBGDIGGERWINNTVER_4_0,
186	DBGDIGGERWINNTVER_5_0,
187	DBGDIGGERWINNTVER_5_1,
188	DBGDIGGERWINNTVER_6_0
189	} DBGDIGGERWINNTVER;
190
191	/**
192	* WinNT guest OS digger instance data.
193	*/
194	typedef struct DBGDIGGERWINNT
195	{
196	/** Whether the information is valid or not.
197	* (For fending off illegal interface method calls.) */
198	bool fValid;
199	/** 32-bit (true) or 64-bit (false) */
200	bool f32Bit;
201
202	/** The NT version. */
203	DBGDIGGERWINNTVER enmVer;
204	/** NTKUSERSHAREDDATA::NtProductType */
205	NTPRODUCTTYPE NtProductType;
206	/** NTKUSERSHAREDDATA::NtMajorVersion */
207	uint32_t NtMajorVersion;
208	/** NTKUSERSHAREDDATA::NtMinorVersion */
209	uint32_t NtMinorVersion;
210
211	/** The address of the ntoskrnl.exe image. */
212	DBGFADDRESS KernelAddr;
213	/** The address of the ntoskrnl.exe module table entry. */
214	DBGFADDRESS KernelMteAddr;
215	/** The address of PsLoadedModuleList. */
216	DBGFADDRESS PsLoadedModuleListAddr;
217	} DBGDIGGERWINNT;
218	/** Pointer to the linux guest OS digger instance data. */
219	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
220
221
222	/**
223	* The WinNT digger's loader reader instance data.
224	*/
225	typedef struct DBGDIGGERWINNTRDR
226	{
227	/** The VM handle (referenced). */
228	PUVM pUVM;
229	/** The image base. */
230	DBGFADDRESS ImageAddr;
231	/** The image size. */
232	uint32_t cbImage;
233	/** The file offset of the SizeOfImage field in the optional header if it
234	* needs patching, otherwise set to UINT32_MAX. */
235	uint32_t offSizeOfImage;
236	/** The correct image size. */
237	uint32_t cbCorrectImageSize;
238	/** Number of entries in the aMappings table. */
239	uint32_t cMappings;
240	/** Mapping hint. */
241	uint32_t iHint;
242	/** Mapping file offset to memory offsets, ordered by file offset. */
243	struct
244	{
245	/** The file offset. */
246	uint32_t offFile;
247	/** The size of this mapping. */
248	uint32_t cbMem;
249	/** The offset to the memory from the start of the image. */
250	uint32_t offMem;
251	} aMappings[1];
252	} DBGDIGGERWINNTRDR;
253	/** Pointer a WinNT loader reader instance data. */
254	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
255
256
257	/*******************************************************************************
258	* Defined Constants And Macros *
259	*******************************************************************************/
260	/** Validates a 32-bit Windows NT kernel address */
261	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
262	/** Validates a 64-bit Windows NT kernel address */
263	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffffffff80000000) && (Addr) < UINT64_C(0xfffffffffffff000))
264	/** Validates a kernel address. */
265	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
266	/** Versioned and bitness wrapper. */
267	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
268
269	/** The length (in chars) of the kernel file name (no path). */
270	#define WINNT_KERNEL_BASE_NAME_LEN 12
271
272	/** WindowsNT on little endian ASCII systems. */
273	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
274
275
276	/*******************************************************************************
277	* Internal Functions *
278	*******************************************************************************/
279	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
280
281
282	/*******************************************************************************
283	* Global Variables *
284	*******************************************************************************/
285	/** Kernel names. */
286	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
287	{
288	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
289	};
290
291
292
293	/** @callback_method_impl{PFNRTLDRRDRMEMREAD} */
294	static DECLCALLBACK(int) dbgDiggerWinNtRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
295	{
296	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
297	uint32_t offFile = (uint32_t)off;
298	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
299
300	uint32_t i = pThis->iHint;
301	if (pThis->aMappings[i].offFile > offFile)
302	{
303	i = pThis->cMappings;
304	while (i-- > 0)
305	if (offFile >= pThis->aMappings[i].offFile)
306	break;
307	pThis->iHint = i;
308	}
309
310	while (cb > 0)
311	{
312	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
313	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
314
315	/* Read file bits backed by memory. */
316	if (offMap < pThis->aMappings[i].cbMem)
317	{
318	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
319	if (cbToRead > cb)
320	cbToRead = (uint32_t)cb;
321
322	DBGFADDRESS Addr = pThis->ImageAddr;
323	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
324
325	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
326	if (RT_FAILURE(rc))
327	return rc;
328
329	/* Patch it? */
330	if ( pThis->offSizeOfImage != UINT32_MAX
331	&& offFile < pThis->offSizeOfImage + 4
332	&& offFile + cbToRead > pThis->offSizeOfImage)
333	{
334	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
335	int32_t offPatch = pThis->offSizeOfImage - offFile;
336	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
337	uint32_t cbPatch = sizeof(uint32_t);
338	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
339	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
340	while (cbPatch-- > 0)
341	{
342	if (offPatch >= 0)
343	*pbPatch = (uint8_t)SizeOfImage;
344	offPatch++;
345	pbPatch++;
346	SizeOfImage >>= 8;
347	}
348	}
349
350	/* Done? */
351	if (cbToRead == cb)
352	break;
353
354	offFile += cbToRead;
355	cb -= cbToRead;
356	pvBuf = (char *)pvBuf + cbToRead;
357	}
358
359	/* Mind the gap. */
360	if (offNextMap > offFile)
361	{
362	uint32_t cbZero = offNextMap - offFile;
363	if (cbZero > cb)
364	{
365	RT_BZERO(pvBuf, cb);
366	break;
367	}
368
369	RT_BZERO(pvBuf, cbZero);
370	offFile += cbZero;
371	cb -= cbZero;
372	pvBuf = (char *)pvBuf + cbZero;
373	}
374
375	pThis->iHint = ++i;
376	}
377
378	return VINF_SUCCESS;
379	}
380
381
382	/** @callback_method_impl{PFNRTLDRRDRMEMDTOR} */
383	static DECLCALLBACK(void) dbgDiggerWinNtRdr_Dtor(void *pvUser)
384	{
385	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
386
387	VMR3ReleaseUVM(pThis->pUVM);
388	pThis->pUVM = NULL;
389	RTMemFree(pvUser);
390	}
391
392
393	/**
394	* Checks if the section headers look okay.
395	*
396	* @returns true / false.
397	* @param paShs Pointer to the section headers.
398	* @param cShs Number of headers.
399	* @param cbImage The image size.
400	*/
401	static bool dbgDiggerWinNtIsSectionHeaderOk(PCIMAGE_SECTION_HEADER paShs, uint32_t cShs, uint32_t cbImage)
402	{
403	for (uint32_t i = 0; i < cShs; i++)
404	{
405	if (!paShs[i].Name[0])
406	{
407	Log(("DigWinNt: Section header #%u has no name\n", i));
408	return false;
409	}
410
411	if (paShs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
412	continue;
413	if (paShs[i].VirtualAddress >= cbImage)
414	{
415	Log(("DigWinNt: Section header #%u has a virtual address beyond the image: %#x cbImage=%#x\n",
416	i, paShs[i].VirtualAddress, cbImage));
417	return false;
418	}
419	if (paShs[i].Misc.VirtualSize >= cbImage) /* we don't check too strictly here becuase NT4 SP1 ntfs.sys. */
420	{
421	Log(("DigWinNt: Section header #%u has a end beyond the image: VirtualAddress=%#x VirtualSize=%#x cbImage=%#x\n",
422	i, paShs[i].VirtualAddress, paShs[i].Misc.VirtualSize, cbImage));
423	return false;
424	}
425	}
426	return true;
427	}
428
429
430	/**
431	* Create a loader module for the in-guest-memory PE module.
432	*/
433	static int dbgDiggerWinNtCreateLdrMod(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName, PCDBGFADDRESS pImageAddr,
434	uint32_t cbImage, uint8_t *pbBuf, size_t cbBuf,
435	uint32_t offHdrs, PCNTHDRS pHdrs, PRTLDRMOD phLdrMod)
436	{
437	/*
438	* Allocate and create a reader instance.
439	*/
440	uint32_t const cShs = WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections);
441	PDBGDIGGERWINNTRDR pRdr = (PDBGDIGGERWINNTRDR)RTMemAlloc(RT_OFFSETOF(DBGDIGGERWINNTRDR, aMappings[cShs + 2]));
442	if (!pRdr)
443	return VERR_NO_MEMORY;
444
445	VMR3RetainUVM(pUVM);
446	pRdr->pUVM = pUVM;
447	pRdr->ImageAddr = *pImageAddr;
448	pRdr->cbImage = cbImage;
449	pRdr->cbCorrectImageSize = cbImage;
450	pRdr->offSizeOfImage = UINT32_MAX;
451	pRdr->iHint = 0;
452
453	/*
454	* Use the section table to construct a more accurate view of the file/
455	* image if it's in the buffer (it should be).
456	*/
457	uint32_t offShs = offHdrs
458	+ ( pThis->f32Bit
459	? pHdrs->vX_32.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
460	: pHdrs->vX_64.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader));
461	uint32_t cbShs = cShs * sizeof(IMAGE_SECTION_HEADER);
462	PCIMAGE_SECTION_HEADER paShs = (PCIMAGE_SECTION_HEADER)(pbBuf + offShs);
463	if ( offShs + cbShs <= RT_MIN(cbImage, cbBuf)
464	&& dbgDiggerWinNtIsSectionHeaderOk(paShs, cShs, cbImage))
465	{
466	pRdr->cMappings = 0;
467
468	for (uint32_t i = 0; i < cShs; i++)
469	if ( paShs[i].SizeOfRawData > 0
470	&& paShs[i].PointerToRawData > 0)
471	{
472	uint32_t j = 1;
473	if (!pRdr->cMappings)
474	pRdr->cMappings++;
475	else
476	{
477	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShs[i].PointerToRawData)
478	j++;
479	if (j < pRdr->cMappings)
480	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
481	}
482	pRdr->aMappings[j].offFile = paShs[i].PointerToRawData;
483	pRdr->aMappings[j].offMem = paShs[i].VirtualAddress;
484	pRdr->aMappings[j].cbMem = i + 1 < cShs
485	? paShs[i + 1].VirtualAddress - paShs[i].VirtualAddress
486	: paShs[i].Misc.VirtualSize;
487	if (j == pRdr->cMappings)
488	pRdr->cbImage = paShs[i].PointerToRawData + paShs[i].SizeOfRawData;
489	pRdr->cMappings++;
490	}
491
492	/* Insert the mapping of the headers that isn't covered by the section table. */
493	pRdr->aMappings[0].offFile = 0;
494	pRdr->aMappings[0].offMem = 0;
495	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
496
497	int j = pRdr->cMappings - 1;
498	while (j-- > 0)
499	{
500	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
501	if (pRdr->aMappings[j].cbMem > cbFile)
502	pRdr->aMappings[j].cbMem = cbFile;
503	}
504	}
505	else
506	{
507	/*
508	* Fallback, fake identity mapped file data.
509	*/
510	pRdr->cMappings = 1;
511	pRdr->aMappings[0].offFile = 0;
512	pRdr->aMappings[0].offMem = 0;
513	pRdr->aMappings[0].cbMem = pRdr->cbImage;
514	}
515
516	/*
517	* Call the loader to open the PE image for debugging.
518	* Note! It always calls pfnDtor.
519	*/
520	RTLDRMOD hLdrMod;
521	int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
522	dbgDiggerWinNtRdr_Read, dbgDiggerWinNtRdr_Dtor, pRdr,
523	&hLdrMod);
524	if (RT_SUCCESS(rc))
525	*phLdrMod = hLdrMod;
526	else
527	*phLdrMod = NIL_RTLDRMOD;
528	return rc;
529	}
530
531
532	/**
533	* Process a PE image found in guest memory.
534	*
535	* @param pThis The instance data.
536	* @param pUVM The user mode VM handle.
537	* @param pszName The image name.
538	* @param pImageAddr The image address.
539	* @param cbImage The size of the image.
540	* @param pbBuf Scratch buffer containing the first
541	* RT_MIN(cbBuf, cbImage) bytes of the image.
542	* @param cbBuf The scratch buffer size.
543	*/
544	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
545	PCDBGFADDRESS pImageAddr, uint32_t cbImage,
546	uint8_t *pbBuf, size_t cbBuf)
547	{
548	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
549
550	/*
551	* Do some basic validation first.
552	* This is the usual exteremely verbose and messy code...
553	*/
554	Assert(cbBuf >= sizeof(IMAGE_NT_HEADERS64));
555	if ( cbImage < sizeof(IMAGE_NT_HEADERS64)
556	\|\| cbImage >= _1M * 256)
557	{
558	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
559	return;
560	}
561
562	/* Dig out the NT/PE headers. */
563	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbBuf;
564	PCNTHDRS pHdrs;
565	uint32_t offHdrs;
566	if (pMzHdr->e_magic != IMAGE_DOS_SIGNATURE)
567	{
568	offHdrs = 0;
569	pHdrs = (PCNTHDRS)pbBuf;
570	}
571	else if ( pMzHdr->e_lfanew >= cbImage
572	\|\| pMzHdr->e_lfanew < sizeof(*pMzHdr)
573	\|\| pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) > cbImage)
574	{
575	Log(("DigWinNt: %s: PE header to far into image: %#x cbImage=%#x\n", pMzHdr->e_lfanew, cbImage));
576	return;
577	}
578	else if ( pMzHdr->e_lfanew < cbBuf
579	&& pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) <= cbBuf)
580	{
581	offHdrs = pMzHdr->e_lfanew;
582	pHdrs = (NTHDRS const *)(pbBuf + offHdrs);
583	}
584	else
585	{
586	Log(("DigWinNt: %s: PE header to far into image (lazy bird): %#x\n", pMzHdr->e_lfanew));
587	return;
588	}
589	if (pHdrs->vX_32.Signature != IMAGE_NT_SIGNATURE)
590	{
591	Log(("DigWinNt: %s: Bad PE signature: %#x\n", pszName, pHdrs->vX_32.Signature));
592	return;
593	}
594
595	/* The file header is the same on both archs */
596	if (pHdrs->vX_32.FileHeader.Machine != (pThis->f32Bit ? IMAGE_FILE_MACHINE_I386 : IMAGE_FILE_MACHINE_AMD64))
597	{
598	Log(("DigWinNt: %s: Invalid FH.Machine: %#x\n", pszName, pHdrs->vX_32.FileHeader.Machine));
599	return;
600	}
601	if (pHdrs->vX_32.FileHeader.SizeOfOptionalHeader != (pThis->f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
602	{
603	Log(("DigWinNt: %s: Invalid FH.SizeOfOptionalHeader: %#x\n", pszName, pHdrs->vX_32.FileHeader.SizeOfOptionalHeader));
604	return;
605	}
606	if (WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections) > 64)
607	{
608	Log(("DigWinNt: %s: Too many sections: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections)));
609	return;
610	}
611
612	const uint32_t TimeDateStamp = pHdrs->vX_32.FileHeader.TimeDateStamp;
613
614	/* The optional header is not... */
615	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic) != (pThis->f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
616	{
617	Log(("DigWinNt: %s: Invalid OH.Magic: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic)));
618	return;
619	}
620	uint32_t cbImageFromHdr = WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage);
621	if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
622	{
623	Log(("DigWinNt: %s: Invalid OH.SizeOfImage: %#x, expected %#x\n", pszName, cbImageFromHdr, cbImage));
624	return;
625	}
626	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes) != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
627	{
628	Log(("DigWinNt: %s: Invalid OH.NumberOfRvaAndSizes: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes)));
629	return;
630	}
631
632
633	/*
634	* Create the module using the in memory image first, falling back
635	* on cached image.
636	*/
637	RTLDRMOD hLdrMod;
638	int rc = dbgDiggerWinNtCreateLdrMod(pThis, pUVM, pszName, pImageAddr, cbImage, pbBuf, cbBuf, offHdrs, pHdrs,
639	&hLdrMod);
640	if (RT_FAILURE(rc))
641	hLdrMod = NIL_RTLDRMOD;
642
643	RTDBGMOD hMod;
644	rc = RTDbgModCreateFromPeImage(&hMod, pszName, NULL, hLdrMod,
645	cbImageFromHdr, TimeDateStamp, DBGFR3AsGetConfig(pUVM));
646	if (RT_FAILURE(rc))
647	{
648	/*
649	* Final fallback is a container module.
650	*/
651	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
652	if (RT_FAILURE(rc))
653	return;
654
655	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
656	AssertRC(rc);
657	}
658
659	/* Tag the module. */
660	rc = RTDbgModSetTag(hMod, DIG_WINNT_MOD_TAG);
661	AssertRC(rc);
662
663	/*
664	* Link the module.
665	*/
666	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
667	if (hAs != NIL_RTDBGAS)
668	rc = RTDbgAsModuleLink(hAs, hMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
669	else
670	rc = VERR_INTERNAL_ERROR;
671	RTDbgModRelease(hMod);
672	RTDbgAsRelease(hAs);
673	}
674
675
676	/**
677	* @copydoc DBGFOSREG::pfnQueryInterface
678	*/
679	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
680	{
681	return NULL;
682	}
683
684
685	/**
686	* @copydoc DBGFOSREG::pfnQueryVersion
687	*/
688	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
689	{
690	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
691	Assert(pThis->fValid);
692	const char *pszNtProductType;
693	switch (pThis->NtProductType)
694	{
695	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
696	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
697	case kNtProductType_Server: pszNtProductType = "-Server"; break;
698	default: pszNtProductType = ""; break;
699	}
700	RTStrPrintf(pszVersion, cchVersion, "%u.%u%s", pThis->NtMajorVersion, pThis->NtMinorVersion, pszNtProductType);
701	return VINF_SUCCESS;
702	}
703
704
705	/**
706	* @copydoc DBGFOSREG::pfnTerm
707	*/
708	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
709	{
710	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
711	Assert(pThis->fValid);
712
713	pThis->fValid = false;
714	}
715
716
717	/**
718	* @copydoc DBGFOSREG::pfnRefresh
719	*/
720	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
721	{
722	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
723	NOREF(pThis);
724	Assert(pThis->fValid);
725
726	/*
727	* For now we'll flush and reload everything.
728	*/
729	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
730	if (hDbgAs != NIL_RTDBGAS)
731	{
732	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
733	while (iMod-- > 0)
734	{
735	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
736	if (hMod != NIL_RTDBGMOD)
737	{
738	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
739	{
740	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
741	AssertRC(rc);
742	}
743	RTDbgModRelease(hMod);
744	}
745	}
746	RTDbgAsRelease(hDbgAs);
747	}
748
749	dbgDiggerWinNtTerm(pUVM, pvData);
750	return dbgDiggerWinNtInit(pUVM, pvData);
751	}
752
753
754	/**
755	* @copydoc DBGFOSREG::pfnInit
756	*/
757	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
758	{
759	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
760	Assert(!pThis->fValid);
761
762	union
763	{
764	uint8_t au8[0x2000];
765	RTUTF16 wsz[0x2000/2];
766	NTKUSERSHAREDDATA UserSharedData;
767	} u;
768	DBGFADDRESS Addr;
769	int rc;
770
771	/*
772	* Figure the NT version.
773	*/
774	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
775	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
776	if (RT_FAILURE(rc))
777	return rc;
778	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
779	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
780	: kNtProductType_Invalid;
781	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
782	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
783
784	/*
785	* Dig out the module chain.
786	*/
787	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
788	Addr = pThis->KernelMteAddr;
789	do
790	{
791	/* Read the validate the MTE. */
792	NTMTE Mte;
793	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
794	if (RT_FAILURE(rc))
795	break;
796	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
797	{
798	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
799	break;
800	}
801	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
802	{
803	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
804	break;
805	}
806	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
807	{
808	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
809	break;
810	}
811	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
812	{
813	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
814	break;
815	}
816	if ( !WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase))
817	\|\| WINNT_UNION(pThis, &Mte, SizeOfImage) > _1M*256
818	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > WINNT_UNION(pThis, &Mte, SizeOfImage) )
819	{
820	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
821	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), WINNT_UNION(pThis, &Mte, SizeOfImage), WINNT_UNION(pThis, &Mte, DllBase)));
822	break;
823	}
824
825	/* Read the full name. */
826	DBGFADDRESS AddrName;
827	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
828	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
829	if (cbName < sizeof(u))
830	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
831	else
832	rc = VERR_OUT_OF_RANGE;
833	if (RT_FAILURE(rc))
834	{
835	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
836	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
837	if (cbName < sizeof(u))
838	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
839	else
840	rc = VERR_OUT_OF_RANGE;
841	}
842	if (RT_SUCCESS(rc))
843	{
844	u.wsz[cbName/2] = '\0';
845	char *pszName;
846	rc = RTUtf16ToUtf8(u.wsz, &pszName);
847	if (RT_SUCCESS(rc))
848	{
849	/* Read the start of the PE image and pass it along to a worker. */
850	DBGFADDRESS ImageAddr;
851	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
852	uint32_t cbImageBuf = RT_MIN(sizeof(u), WINNT_UNION(pThis, &Mte, SizeOfImage));
853	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &ImageAddr, &u, cbImageBuf);
854	if (RT_SUCCESS(rc))
855	dbgDiggerWinNtProcessImage(pThis,
856	pUVM,
857	pszName,
858	&ImageAddr,
859	WINNT_UNION(pThis, &Mte, SizeOfImage),
860	&u.au8[0],
861	sizeof(u));
862	RTStrFree(pszName);
863	}
864	}
865
866	/* next */
867	AddrPrev = Addr;
868	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
869	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
870	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
871
872	pThis->fValid = true;
873	return VINF_SUCCESS;
874	}
875
876
877	/**
878	* @copydoc DBGFOSREG::pfnProbe
879	*/
880	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
881	{
882	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
883	DBGFADDRESS Addr;
884	union
885	{
886	uint8_t au8[8192];
887	uint16_t au16[8192/2];
888	uint32_t au32[8192/4];
889	IMAGE_DOS_HEADER MzHdr;
890	RTUTF16 wsz[8192/2];
891	} u;
892
893	/*
894	* Look for the PAGELK section name that seems to be a part of all kernels.
895	* Then try find the module table entry for it. Since it's the first entry
896	* in the PsLoadedModuleList we can easily validate the list head and report
897	* success.
898	*/
899	CPUMMODE enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
900	if (enmMode == CPUMMODE_LONG)
901	{
902	/** @todo when 32-bit is working, add support for 64-bit windows nt. */
903	}
904	else
905	{
906	DBGFADDRESS KernelAddr;
907	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, UINT32_C(0x80001000));
908	KernelAddr.FlatPtr < UINT32_C(0xffff0000);
909	KernelAddr.FlatPtr += PAGE_SIZE)
910	{
911	int rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, UINT32_C(0xffff0000) - KernelAddr.FlatPtr,
912	1, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
913	if (RT_FAILURE(rc))
914	break;
915	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
916
917	/* MZ + PE header. */
918	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
919	if ( RT_SUCCESS(rc)
920	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
921	&& !(u.MzHdr.e_lfanew & 0x7)
922	&& u.MzHdr.e_lfanew >= 0x080
923	&& u.MzHdr.e_lfanew <= 0x200)
924	{
925	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
926	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
927	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
928	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
929	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
930	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
931	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
932	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
933	/** @todo need more ntoskrnl signs? */
934	)
935	{
936	/* Find the MTE. */
937	NTMTE32 Mte;
938	RT_ZERO(Mte);
939	Mte.DllBase = KernelAddr.FlatPtr;
940	Mte.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
941	Mte.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
942	DBGFADDRESS HitAddr;
943	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, UINT32_MAX - KernelAddr.FlatPtr,
944	4 /align/, &Mte.DllBase, 3 * sizeof(uint32_t), &HitAddr);
945	while (RT_SUCCESS(rc))
946	{
947	/* check the name. */
948	NTMTE32 Mte2;
949	DBGFADDRESS MteAddr = HitAddr;
950	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
951	&Mte2, sizeof(Mte2));
952	if ( RT_SUCCESS(rc)
953	&& Mte2.DllBase == Mte.DllBase
954	&& Mte2.EntryPoint == Mte.EntryPoint
955	&& Mte2.SizeOfImage == Mte.SizeOfImage
956	&& WINNT32_VALID_ADDRESS(Mte2.InLoadOrderLinks.Flink)
957	&& Mte2.InLoadOrderLinks.Blink > KernelAddr.FlatPtr /* list head inside ntoskrnl */
958	&& Mte2.InLoadOrderLinks.Blink < KernelAddr.FlatPtr + Mte.SizeOfImage
959	&& WINNT32_VALID_ADDRESS(Mte2.BaseDllName.Buffer)
960	&& WINNT32_VALID_ADDRESS(Mte2.FullDllName.Buffer)
961	&& Mte2.BaseDllName.Length <= Mte2.BaseDllName.MaximumLength
962	&& Mte2.BaseDllName.Length == WINNT_KERNEL_BASE_NAME_LEN * 2
963	&& Mte2.FullDllName.Length <= Mte2.FullDllName.MaximumLength
964	&& Mte2.FullDllName.Length <= 256
965	)
966	{
967	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, Mte2.BaseDllName.Buffer),
968	u.wsz, Mte2.BaseDllName.Length);
969	u.wsz[Mte2.BaseDllName.Length / 2] = '\0';
970	if ( RT_SUCCESS(rc)
971	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
972	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
973	)
974	)
975	{
976	NTMTE32 Mte3;
977	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, Mte2.InLoadOrderLinks.Blink),
978	&Mte3, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
979	if ( RT_SUCCESS(rc)
980	&& Mte3.InLoadOrderLinks.Flink == MteAddr.FlatPtr
981	&& WINNT32_VALID_ADDRESS(Mte3.InLoadOrderLinks.Blink) )
982	{
983	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
984	MteAddr.FlatPtr, KernelAddr.FlatPtr, Mte2.SizeOfImage, Addr.FlatPtr));
985	pThis->KernelAddr = KernelAddr;
986	pThis->KernelMteAddr = MteAddr;
987	pThis->PsLoadedModuleListAddr = Addr;
988	pThis->f32Bit = true;
989	return true;
990	}
991	}
992	}
993
994	/* next */
995	DBGFR3AddrAdd(&HitAddr, 4);
996	if (HitAddr.FlatPtr <= UINT32_C(0xfffff000))
997	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, UINT32_MAX - HitAddr.FlatPtr,
998	4 /align/, &Mte.DllBase, 3 * sizeof(uint32_t), &HitAddr);
999	else
1000	rc = VERR_DBGF_MEM_NOT_FOUND;
1001	}
1002	}
1003	}
1004	}
1005	}
1006	return false;
1007	}
1008
1009
1010	/**
1011	* @copydoc DBGFOSREG::pfnDestruct
1012	*/
1013	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1014	{
1015
1016	}
1017
1018
1019	/**
1020	* @copydoc DBGFOSREG::pfnConstruct
1021	*/
1022	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1023	{
1024	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1025	pThis->fValid = false;
1026	pThis->f32Bit = false;
1027	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1028	return VINF_SUCCESS;
1029	}
1030
1031
1032	const DBGFOSREG g_DBGDiggerWinNt =
1033	{
1034	/* .u32Magic = */ DBGFOSREG_MAGIC,
1035	/* .fFlags = */ 0,
1036	/* .cbData = */ sizeof(DBGDIGGERWINNT),
1037	/* .szName = */ "WinNT",
1038	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1039	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1040	/* .pfnProbe = */ dbgDiggerWinNtProbe,
1041	/* .pfnInit = */ dbgDiggerWinNtInit,
1042	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1043	/* .pfnTerm = */ dbgDiggerWinNtTerm,
1044	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1045	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1046	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1047	};
1048

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 46101

Download in other formats: