VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 56986

Last change on this file since 56986 was 56986, checked in by vboxsync, 9 years ago

Debugger: Logging and assertion formatting fixes.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 46.5 KB
Line 
1/* $Id: DBGPlugInWinNt.cpp 56986 2015-07-18 22:12:53Z vboxsync $ */
2/** @file
3 * DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4 */
5
6/*
7 * Copyright (C) 2009-2015 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF ///@todo add new log group.
23#include "DBGPlugIns.h"
24#include <VBox/vmm/dbgf.h>
25#include <VBox/err.h>
26#include <VBox/param.h>
27#include <iprt/ldr.h>
28#include <iprt/mem.h>
29#include <iprt/stream.h>
30#include <iprt/string.h>
31
32#include "../Runtime/include/internal/ldrMZ.h" /* ugly */
33#include "../Runtime/include/internal/ldrPE.h" /* ugly */
34
35
36/*******************************************************************************
37* Structures and Typedefs *
38*******************************************************************************/
39
40/** @name Internal WinNT structures
41 * @{ */
42/**
43 * PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
44 * Tested with XP.
45 */
46typedef struct NTMTE32
47{
48 struct
49 {
50 uint32_t Flink;
51 uint32_t Blink;
52 } InLoadOrderLinks,
53 InMemoryOrderModuleList,
54 InInitializationOrderModuleList;
55 uint32_t DllBase;
56 uint32_t EntryPoint;
57 uint32_t SizeOfImage;
58 struct
59 {
60 uint16_t Length;
61 uint16_t MaximumLength;
62 uint32_t Buffer;
63 } FullDllName,
64 BaseDllName;
65 uint32_t Flags;
66 uint16_t LoadCount;
67 uint16_t TlsIndex;
68 /* ... there is more ... */
69} NTMTE32;
70typedef NTMTE32 *PNTMTE32;
71
72/**
73 * PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
74 * Tested with XP.
75 *
76 * @todo This is incomplete and just to get rid of warnings.
77 */
78typedef struct NTMTE64
79{
80 struct
81 {
82 uint64_t Flink;
83 uint64_t Blink;
84 } InLoadOrderLinks, /**< 0x00 */
85 InMemoryOrderModuleList, /**< 0x10 */
86 InInitializationOrderModuleList; /**< 0x20 */
87 uint64_t DllBase; /**< 0x30 */
88 uint64_t EntryPoint; /**< 0x38 */
89 uint32_t SizeOfImage; /**< 0x40 */
90 uint32_t Alignment; /**< 0x44 */
91 struct
92 {
93 uint16_t Length; /**< 0x48,0x58 */
94 uint16_t MaximumLength; /**< 0x4a,0x5a */
95 uint32_t Alignment; /**< 0x4c,0x5c */
96 uint64_t Buffer; /**< 0x50,0x60 */
97 } FullDllName, /**< 0x48 */
98 BaseDllName; /**< 0x58 */
99 uint32_t Flags; /**< 0x68 */
100 uint16_t LoadCount; /**< 0x6c */
101 uint16_t TlsIndex; /**< 0x6e */
102 /* ... there is more ... */
103} NTMTE64;
104typedef NTMTE64 *PNTMTE64;
105
106/** MTE union. */
107typedef union NTMTE
108{
109 NTMTE32 vX_32;
110 NTMTE64 vX_64;
111} NTMTE;
112typedef NTMTE *PNTMTE;
113
114
115/**
116 * The essential bits of the KUSER_SHARED_DATA structure.
117 */
118typedef struct NTKUSERSHAREDDATA
119{
120 uint32_t TickCountLowDeprecated;
121 uint32_t TickCountMultiplier;
122 struct
123 {
124 uint32_t LowPart;
125 int32_t High1Time;
126 int32_t High2Time;
127
128 } InterruptTime,
129 SystemTime,
130 TimeZoneBias;
131 uint16_t ImageNumberLow;
132 uint16_t ImageNumberHigh;
133 RTUTF16 NtSystemRoot[260];
134 uint32_t MaxStackTraceDepth;
135 uint32_t CryptoExponent;
136 uint32_t TimeZoneId;
137 uint32_t LargePageMinimum;
138 uint32_t Reserved2[7];
139 uint32_t NtProductType;
140 uint8_t ProductTypeIsValid;
141 uint8_t abPadding[3];
142 uint32_t NtMajorVersion;
143 uint32_t NtMinorVersion;
144 /* uint8_t ProcessorFeatures[64];
145 ...
146 */
147} NTKUSERSHAREDDATA;
148typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
149
150/** KI_USER_SHARED_DATA for i386 */
151#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
152/** KI_USER_SHARED_DATA for AMD64 */
153#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
154
155/** NTKUSERSHAREDDATA::NtProductType */
156typedef enum NTPRODUCTTYPE
157{
158 kNtProductType_Invalid = 0,
159 kNtProductType_WinNt = 1,
160 kNtProductType_LanManNt,
161 kNtProductType_Server
162} NTPRODUCTTYPE;
163
164
165/** NT image header union. */
166typedef union NTHDRSU
167{
168 IMAGE_NT_HEADERS32 vX_32;
169 IMAGE_NT_HEADERS64 vX_64;
170} NTHDRS;
171/** Pointer to NT image header union. */
172typedef NTHDRS *PNTHDRS;
173/** Pointer to const NT image header union. */
174typedef NTHDRS const *PCNTHDRS;
175
176/** @} */
177
178
179
180typedef enum DBGDIGGERWINNTVER
181{
182 DBGDIGGERWINNTVER_UNKNOWN,
183 DBGDIGGERWINNTVER_3_1,
184 DBGDIGGERWINNTVER_3_5,
185 DBGDIGGERWINNTVER_4_0,
186 DBGDIGGERWINNTVER_5_0,
187 DBGDIGGERWINNTVER_5_1,
188 DBGDIGGERWINNTVER_6_0
189} DBGDIGGERWINNTVER;
190
191/**
192 * WinNT guest OS digger instance data.
193 */
194typedef struct DBGDIGGERWINNT
195{
196 /** Whether the information is valid or not.
197 * (For fending off illegal interface method calls.) */
198 bool fValid;
199 /** 32-bit (true) or 64-bit (false) */
200 bool f32Bit;
201
202 /** The NT version. */
203 DBGDIGGERWINNTVER enmVer;
204 /** NTKUSERSHAREDDATA::NtProductType */
205 NTPRODUCTTYPE NtProductType;
206 /** NTKUSERSHAREDDATA::NtMajorVersion */
207 uint32_t NtMajorVersion;
208 /** NTKUSERSHAREDDATA::NtMinorVersion */
209 uint32_t NtMinorVersion;
210
211 /** The address of the ntoskrnl.exe image. */
212 DBGFADDRESS KernelAddr;
213 /** The address of the ntoskrnl.exe module table entry. */
214 DBGFADDRESS KernelMteAddr;
215 /** The address of PsLoadedModuleList. */
216 DBGFADDRESS PsLoadedModuleListAddr;
217} DBGDIGGERWINNT;
218/** Pointer to the linux guest OS digger instance data. */
219typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
220
221
222/**
223 * The WinNT digger's loader reader instance data.
224 */
225typedef struct DBGDIGGERWINNTRDR
226{
227 /** The VM handle (referenced). */
228 PUVM pUVM;
229 /** The image base. */
230 DBGFADDRESS ImageAddr;
231 /** The image size. */
232 uint32_t cbImage;
233 /** The file offset of the SizeOfImage field in the optional header if it
234 * needs patching, otherwise set to UINT32_MAX. */
235 uint32_t offSizeOfImage;
236 /** The correct image size. */
237 uint32_t cbCorrectImageSize;
238 /** Number of entries in the aMappings table. */
239 uint32_t cMappings;
240 /** Mapping hint. */
241 uint32_t iHint;
242 /** Mapping file offset to memory offsets, ordered by file offset. */
243 struct
244 {
245 /** The file offset. */
246 uint32_t offFile;
247 /** The size of this mapping. */
248 uint32_t cbMem;
249 /** The offset to the memory from the start of the image. */
250 uint32_t offMem;
251 } aMappings[1];
252} DBGDIGGERWINNTRDR;
253/** Pointer a WinNT loader reader instance data. */
254typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
255
256
257/*******************************************************************************
258* Defined Constants And Macros *
259*******************************************************************************/
260/** Validates a 32-bit Windows NT kernel address */
261#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
262/** Validates a 64-bit Windows NT kernel address */
263 #define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
264/** Validates a kernel address. */
265#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
266/** Versioned and bitness wrapper. */
267#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
268
269/** The length (in chars) of the kernel file name (no path). */
270#define WINNT_KERNEL_BASE_NAME_LEN 12
271
272/** WindowsNT on little endian ASCII systems. */
273#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
274
275
276/*******************************************************************************
277* Internal Functions *
278*******************************************************************************/
279static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
280
281
282/*******************************************************************************
283* Global Variables *
284*******************************************************************************/
285/** Kernel names. */
286static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
287{
288 { 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
289};
290
291
292
293/** @callback_method_impl{PFNRTLDRRDRMEMREAD} */
294static DECLCALLBACK(int) dbgDiggerWinNtRdr_Read(void *pvBuf, size_t cb, size_t off, void *pvUser)
295{
296 PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
297 uint32_t offFile = (uint32_t)off;
298 AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
299
300 uint32_t i = pThis->iHint;
301 if (pThis->aMappings[i].offFile > offFile)
302 {
303 i = pThis->cMappings;
304 while (i-- > 0)
305 if (offFile >= pThis->aMappings[i].offFile)
306 break;
307 pThis->iHint = i;
308 }
309
310 while (cb > 0)
311 {
312 uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
313 uint32_t offMap = offFile - pThis->aMappings[i].offFile;
314
315 /* Read file bits backed by memory. */
316 if (offMap < pThis->aMappings[i].cbMem)
317 {
318 uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
319 if (cbToRead > cb)
320 cbToRead = (uint32_t)cb;
321
322 DBGFADDRESS Addr = pThis->ImageAddr;
323 DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
324
325 int rc = DBGFR3MemRead(pThis->pUVM, 0 /*idCpu*/, &Addr, pvBuf, cbToRead);
326 if (RT_FAILURE(rc))
327 return rc;
328
329 /* Apply SizeOfImage patch? */
330 if ( pThis->offSizeOfImage != UINT32_MAX
331 && offFile < pThis->offSizeOfImage + 4
332 && offFile + cbToRead > pThis->offSizeOfImage)
333 {
334 uint32_t SizeOfImage = pThis->cbCorrectImageSize;
335 uint32_t cbPatch = sizeof(SizeOfImage);
336 int32_t offPatch = pThis->offSizeOfImage - offFile;
337 uint8_t *pbPatch = (uint8_t *)pvBuf + offPatch;
338 if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
339 cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
340 while (cbPatch-- > 0)
341 {
342 if (offPatch >= 0)
343 *pbPatch = (uint8_t)SizeOfImage;
344 offPatch++;
345 pbPatch++;
346 SizeOfImage >>= 8;
347 }
348 }
349
350 /* Done? */
351 if (cbToRead == cb)
352 break;
353
354 offFile += cbToRead;
355 cb -= cbToRead;
356 pvBuf = (char *)pvBuf + cbToRead;
357 }
358
359 /* Mind the gap. */
360 if (offNextMap > offFile)
361 {
362 uint32_t cbZero = offNextMap - offFile;
363 if (cbZero > cb)
364 {
365 RT_BZERO(pvBuf, cb);
366 break;
367 }
368
369 RT_BZERO(pvBuf, cbZero);
370 offFile += cbZero;
371 cb -= cbZero;
372 pvBuf = (char *)pvBuf + cbZero;
373 }
374
375 pThis->iHint = ++i;
376 }
377
378 return VINF_SUCCESS;
379}
380
381
382/** @callback_method_impl{PFNRTLDRRDRMEMDTOR} */
383static DECLCALLBACK(void) dbgDiggerWinNtRdr_Dtor(void *pvUser)
384{
385 PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
386
387 VMR3ReleaseUVM(pThis->pUVM);
388 pThis->pUVM = NULL;
389 RTMemFree(pvUser);
390}
391
392
393/**
394 * Checks if the section headers look okay.
395 *
396 * @returns true / false.
397 * @param paShs Pointer to the section headers.
398 * @param cShs Number of headers.
399 * @param cbImage The image size reported by NT.
400 * @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
401 * no resource directory.
402 * @param cbSectAlign The section alignment specified in the header.
403 * @param pcbImageCorrect The corrected image size. This is derived from
404 * cbImage and virtual range of the section tables.
405 *
406 * The problem is that NT may choose to drop the
407 * last pages in images it loads early, starting at
408 * the resource directory. These images will have
409 * a page aligned cbImage.
410 */
411static bool dbgDiggerWinNtCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShs, uint32_t cShs, uint32_t cbImage,
412 uint32_t uRvaRsrc, uint32_t cbSectAlign, uint32_t *pcbImageCorrect)
413{
414 *pcbImageCorrect = cbImage;
415
416 for (uint32_t i = 0; i < cShs; i++)
417 {
418 if (!paShs[i].Name[0])
419 {
420 Log(("DigWinNt: Section header #%u has no name\n", i));
421 return false;
422 }
423
424 if (paShs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
425 continue;
426
427 /* Check that sizes are within the same range and that both sizes and
428 addresses are within reasonable limits. */
429 if ( RT_ALIGN(paShs[i].Misc.VirtualSize, _64K) < RT_ALIGN(paShs[i].SizeOfRawData, _64K)
430 || paShs[i].Misc.VirtualSize >= _1G
431 || paShs[i].SizeOfRawData >= _1G)
432 {
433 Log(("DigWinNt: Section header #%u has a VirtualSize=%#x and SizeOfRawData=%#x, that's too much data!\n",
434 i, paShs[i].Misc.VirtualSize, paShs[i].SizeOfRawData));
435 return false;
436 }
437 uint32_t uRvaEnd = paShs[i].VirtualAddress + paShs[i].Misc.VirtualSize;
438 if (uRvaEnd >= _1G || uRvaEnd < paShs[i].VirtualAddress)
439 {
440 Log(("DigWinNt: Section header #%u has a VirtualSize=%#x and VirtualAddr=%#x, %#x in total, that's too much!\n",
441 i, paShs[i].Misc.VirtualSize, paShs[i].VirtualAddress, uRvaEnd));
442 return false;
443 }
444
445 /* Check for images chopped off around '.rsrc'. */
446 if ( cbImage < uRvaEnd
447 && uRvaEnd >= uRvaRsrc)
448 cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
449
450 /* Check that the section is within the image. */
451 if (uRvaEnd > cbImage)
452 {
453 Log(("DigWinNt: Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x\n",
454 i, paShs[i].VirtualAddress, uRvaEnd, cbImage));
455 return false;
456 }
457 }
458
459 Assert(*pcbImageCorrect == cbImage || !(*pcbImageCorrect & 0xfff));
460 *pcbImageCorrect = cbImage;
461 return true;
462}
463
464
465/**
466 * Create a loader module for the in-guest-memory PE module.
467 */
468static int dbgDiggerWinNtCreateLdrMod(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName, PCDBGFADDRESS pImageAddr,
469 uint32_t cbImage, uint8_t *pbBuf, size_t cbBuf,
470 uint32_t offHdrs, PCNTHDRS pHdrs, PRTLDRMOD phLdrMod)
471{
472 /*
473 * Allocate and create a reader instance.
474 */
475 uint32_t const cShs = WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections);
476 PDBGDIGGERWINNTRDR pRdr = (PDBGDIGGERWINNTRDR)RTMemAlloc(RT_OFFSETOF(DBGDIGGERWINNTRDR, aMappings[cShs + 2]));
477 if (!pRdr)
478 return VERR_NO_MEMORY;
479
480 VMR3RetainUVM(pUVM);
481 pRdr->pUVM = pUVM;
482 pRdr->ImageAddr = *pImageAddr;
483 pRdr->cbImage = cbImage;
484 pRdr->cbCorrectImageSize = cbImage;
485 pRdr->offSizeOfImage = UINT32_MAX;
486 pRdr->iHint = 0;
487
488 /*
489 * Use the section table to construct a more accurate view of the file/
490 * image if it's in the buffer (it should be).
491 */
492 uint32_t uRvaRsrc = UINT32_MAX;
493 if (WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).Size > 0)
494 uRvaRsrc = WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress;
495 uint32_t offShs = offHdrs
496 + ( pThis->f32Bit
497 ? pHdrs->vX_32.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
498 : pHdrs->vX_64.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader));
499 uint32_t cbShs = cShs * sizeof(IMAGE_SECTION_HEADER);
500 PCIMAGE_SECTION_HEADER paShs = (PCIMAGE_SECTION_HEADER)(pbBuf + offShs);
501 if ( offShs + cbShs <= RT_MIN(cbImage, cbBuf)
502 && dbgDiggerWinNtCheckSectHdrsAndImgSize(paShs, cShs, cbImage, uRvaRsrc,
503 WINNT_UNION(pThis, pHdrs, OptionalHeader.SectionAlignment),
504 &pRdr->cbCorrectImageSize))
505 {
506 pRdr->cMappings = 0;
507
508 for (uint32_t i = 0; i < cShs; i++)
509 if ( paShs[i].SizeOfRawData > 0
510 && paShs[i].PointerToRawData > 0)
511 {
512 uint32_t j = 1;
513 if (!pRdr->cMappings)
514 pRdr->cMappings++;
515 else
516 {
517 while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShs[i].PointerToRawData)
518 j++;
519 if (j < pRdr->cMappings)
520 memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
521 }
522 pRdr->aMappings[j].offFile = paShs[i].PointerToRawData;
523 pRdr->aMappings[j].offMem = paShs[i].VirtualAddress;
524 pRdr->aMappings[j].cbMem = i + 1 < cShs
525 ? paShs[i + 1].VirtualAddress - paShs[i].VirtualAddress
526 : paShs[i].Misc.VirtualSize;
527 if (j == pRdr->cMappings)
528 pRdr->cbImage = paShs[i].PointerToRawData + paShs[i].SizeOfRawData;
529 pRdr->cMappings++;
530 }
531
532 /* Insert the mapping of the headers that isn't covered by the section table. */
533 pRdr->aMappings[0].offFile = 0;
534 pRdr->aMappings[0].offMem = 0;
535 pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
536
537 int j = pRdr->cMappings - 1;
538 while (j-- > 0)
539 {
540 uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
541 if (pRdr->aMappings[j].cbMem > cbFile)
542 pRdr->aMappings[j].cbMem = cbFile;
543 }
544 }
545 else
546 {
547 /*
548 * Fallback, fake identity mapped file data.
549 */
550 pRdr->cMappings = 1;
551 pRdr->aMappings[0].offFile = 0;
552 pRdr->aMappings[0].offMem = 0;
553 pRdr->aMappings[0].cbMem = pRdr->cbImage;
554 }
555
556 /* Enable the SizeOfImage patching if necessary. */
557 if (pRdr->cbCorrectImageSize != cbImage)
558 {
559 Log(("DigWinNT: The image is really %#x bytes long, not %#x as mapped by NT!\n", pRdr->cbCorrectImageSize, cbImage));
560 pRdr->offSizeOfImage = pThis->f32Bit
561 ? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
562 : offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
563 }
564
565 /*
566 * Call the loader to open the PE image for debugging.
567 * Note! It always calls pfnDtor.
568 */
569 RTLDRMOD hLdrMod;
570 int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
571 dbgDiggerWinNtRdr_Read, dbgDiggerWinNtRdr_Dtor, pRdr,
572 &hLdrMod);
573 if (RT_SUCCESS(rc))
574 *phLdrMod = hLdrMod;
575 else
576 *phLdrMod = NIL_RTLDRMOD;
577 return rc;
578}
579
580
581/**
582 * Process a PE image found in guest memory.
583 *
584 * @param pThis The instance data.
585 * @param pUVM The user mode VM handle.
586 * @param pszName The image name.
587 * @param pImageAddr The image address.
588 * @param cbImage The size of the image.
589 * @param pbBuf Scratch buffer containing the first
590 * RT_MIN(cbBuf, cbImage) bytes of the image.
591 * @param cbBuf The scratch buffer size.
592 */
593static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
594 PCDBGFADDRESS pImageAddr, uint32_t cbImage,
595 uint8_t *pbBuf, size_t cbBuf)
596{
597 LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
598
599 /*
600 * Do some basic validation first.
601 * This is the usual exteremely verbose and messy code...
602 */
603 Assert(cbBuf >= sizeof(IMAGE_NT_HEADERS64));
604 if ( cbImage < sizeof(IMAGE_NT_HEADERS64)
605 || cbImage >= _1M * 256)
606 {
607 Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
608 return;
609 }
610
611 /* Dig out the NT/PE headers. */
612 IMAGE_DOS_HEADER const *pMzHdr = (IMAGE_DOS_HEADER const *)pbBuf;
613 PCNTHDRS pHdrs;
614 uint32_t offHdrs;
615 if (pMzHdr->e_magic != IMAGE_DOS_SIGNATURE)
616 {
617 offHdrs = 0;
618 pHdrs = (PCNTHDRS)pbBuf;
619 }
620 else if ( pMzHdr->e_lfanew >= cbImage
621 || pMzHdr->e_lfanew < sizeof(*pMzHdr)
622 || pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) > cbImage)
623 {
624 Log(("DigWinNt: %s: PE header to far into image: %#x cbImage=%#x\n", pszName, pMzHdr->e_lfanew, cbImage));
625 return;
626 }
627 else if ( pMzHdr->e_lfanew < cbBuf
628 && pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) <= cbBuf)
629 {
630 offHdrs = pMzHdr->e_lfanew;
631 pHdrs = (NTHDRS const *)(pbBuf + offHdrs);
632 }
633 else
634 {
635 Log(("DigWinNt: %s: PE header to far into image (lazy bird): %#x\n", pszName, pMzHdr->e_lfanew));
636 return;
637 }
638 if (pHdrs->vX_32.Signature != IMAGE_NT_SIGNATURE)
639 {
640 Log(("DigWinNt: %s: Bad PE signature: %#x\n", pszName, pHdrs->vX_32.Signature));
641 return;
642 }
643
644 /* The file header is the same on both archs */
645 if (pHdrs->vX_32.FileHeader.Machine != (pThis->f32Bit ? IMAGE_FILE_MACHINE_I386 : IMAGE_FILE_MACHINE_AMD64))
646 {
647 Log(("DigWinNt: %s: Invalid FH.Machine: %#x\n", pszName, pHdrs->vX_32.FileHeader.Machine));
648 return;
649 }
650 if (pHdrs->vX_32.FileHeader.SizeOfOptionalHeader != (pThis->f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
651 {
652 Log(("DigWinNt: %s: Invalid FH.SizeOfOptionalHeader: %#x\n", pszName, pHdrs->vX_32.FileHeader.SizeOfOptionalHeader));
653 return;
654 }
655 if (WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections) > 64)
656 {
657 Log(("DigWinNt: %s: Too many sections: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections)));
658 return;
659 }
660
661 const uint32_t TimeDateStamp = pHdrs->vX_32.FileHeader.TimeDateStamp;
662
663 /* The optional header is not... */
664 if (WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic) != (pThis->f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
665 {
666 Log(("DigWinNt: %s: Invalid OH.Magic: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic)));
667 return;
668 }
669 uint32_t cbImageFromHdr = WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage);
670 if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
671 {
672 Log(("DigWinNt: %s: Invalid OH.SizeOfImage: %#x, expected %#x\n", pszName, cbImageFromHdr, cbImage));
673 return;
674 }
675 if (WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes) != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
676 {
677 Log(("DigWinNt: %s: Invalid OH.NumberOfRvaAndSizes: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes)));
678 return;
679 }
680
681 /*
682 * Create the module using the in memory image first, falling back
683 * on cached image.
684 */
685 RTLDRMOD hLdrMod;
686 int rc = dbgDiggerWinNtCreateLdrMod(pThis, pUVM, pszName, pImageAddr, cbImage, pbBuf, cbBuf, offHdrs, pHdrs,
687 &hLdrMod);
688 if (RT_FAILURE(rc))
689 hLdrMod = NIL_RTLDRMOD;
690
691 RTDBGMOD hMod;
692 rc = RTDbgModCreateFromPeImage(&hMod, pszName, NULL, hLdrMod,
693 cbImageFromHdr, TimeDateStamp, DBGFR3AsGetConfig(pUVM));
694 if (RT_FAILURE(rc))
695 {
696 /*
697 * Final fallback is a container module.
698 */
699 rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
700 if (RT_FAILURE(rc))
701 return;
702
703 rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /*iSeg*/, 0, cbImage, 0 /*fFlags*/, NULL);
704 AssertRC(rc);
705 }
706
707 /* Tag the module. */
708 rc = RTDbgModSetTag(hMod, DIG_WINNT_MOD_TAG);
709 AssertRC(rc);
710
711 /*
712 * Link the module.
713 */
714 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
715 if (hAs != NIL_RTDBGAS)
716 rc = RTDbgAsModuleLink(hAs, hMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
717 else
718 rc = VERR_INTERNAL_ERROR;
719 RTDbgModRelease(hMod);
720 RTDbgAsRelease(hAs);
721}
722
723
724/**
725 * @copydoc DBGFOSREG::pfnQueryInterface
726 */
727static DECLCALLBACK(void *) dbgDiggerWinNtQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
728{
729 return NULL;
730}
731
732
733/**
734 * @copydoc DBGFOSREG::pfnQueryVersion
735 */
736static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void *pvData, char *pszVersion, size_t cchVersion)
737{
738 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
739 Assert(pThis->fValid);
740 const char *pszNtProductType;
741 switch (pThis->NtProductType)
742 {
743 case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
744 case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
745 case kNtProductType_Server: pszNtProductType = "-Server"; break;
746 default: pszNtProductType = ""; break;
747 }
748 RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
749 pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
750 return VINF_SUCCESS;
751}
752
753
754/**
755 * @copydoc DBGFOSREG::pfnTerm
756 */
757static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
758{
759 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
760 Assert(pThis->fValid);
761
762 pThis->fValid = false;
763}
764
765
766/**
767 * @copydoc DBGFOSREG::pfnRefresh
768 */
769static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
770{
771 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
772 NOREF(pThis);
773 Assert(pThis->fValid);
774
775 /*
776 * For now we'll flush and reload everything.
777 */
778 RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
779 if (hDbgAs != NIL_RTDBGAS)
780 {
781 uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
782 while (iMod-- > 0)
783 {
784 RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
785 if (hMod != NIL_RTDBGMOD)
786 {
787 if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
788 {
789 int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
790 AssertRC(rc);
791 }
792 RTDbgModRelease(hMod);
793 }
794 }
795 RTDbgAsRelease(hDbgAs);
796 }
797
798 dbgDiggerWinNtTerm(pUVM, pvData);
799 return dbgDiggerWinNtInit(pUVM, pvData);
800}
801
802
803/**
804 * @copydoc DBGFOSREG::pfnInit
805 */
806static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
807{
808 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
809 Assert(!pThis->fValid);
810
811 union
812 {
813 uint8_t au8[0x2000];
814 RTUTF16 wsz[0x2000/2];
815 NTKUSERSHAREDDATA UserSharedData;
816 } u;
817 DBGFADDRESS Addr;
818 int rc;
819
820 /*
821 * Figure the NT version.
822 */
823 DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
824 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &u, PAGE_SIZE);
825 if (RT_FAILURE(rc))
826 return rc;
827 pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
828 ? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
829 : kNtProductType_Invalid;
830 pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
831 pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
832
833 /*
834 * Dig out the module chain.
835 */
836 DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
837 Addr = pThis->KernelMteAddr;
838 do
839 {
840 /* Read the validate the MTE. */
841 NTMTE Mte;
842 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
843 if (RT_FAILURE(rc))
844 break;
845 if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
846 {
847 Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
848 break;
849 }
850 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
851 {
852 Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
853 break;
854 }
855 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
856 {
857 Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
858 break;
859 }
860 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
861 {
862 Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
863 break;
864 }
865 if ( !WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase))
866 || WINNT_UNION(pThis, &Mte, SizeOfImage) > _1M*256
867 || WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > WINNT_UNION(pThis, &Mte, SizeOfImage) )
868 {
869 Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
870 Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), WINNT_UNION(pThis, &Mte, SizeOfImage), WINNT_UNION(pThis, &Mte, DllBase)));
871 break;
872 }
873
874 /* Read the full name. */
875 DBGFADDRESS AddrName;
876 DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
877 uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
878 if (cbName < sizeof(u))
879 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
880 else
881 rc = VERR_OUT_OF_RANGE;
882 if (RT_FAILURE(rc))
883 {
884 DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
885 cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
886 if (cbName < sizeof(u))
887 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
888 else
889 rc = VERR_OUT_OF_RANGE;
890 }
891 if (RT_SUCCESS(rc))
892 {
893 u.wsz[cbName/2] = '\0';
894 char *pszName;
895 rc = RTUtf16ToUtf8(u.wsz, &pszName);
896 if (RT_SUCCESS(rc))
897 {
898 /* Read the start of the PE image and pass it along to a worker. */
899 DBGFADDRESS ImageAddr;
900 DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
901 uint32_t cbImageBuf = RT_MIN(sizeof(u), WINNT_UNION(pThis, &Mte, SizeOfImage));
902 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &ImageAddr, &u, cbImageBuf);
903 if (RT_SUCCESS(rc))
904 dbgDiggerWinNtProcessImage(pThis,
905 pUVM,
906 pszName,
907 &ImageAddr,
908 WINNT_UNION(pThis, &Mte, SizeOfImage),
909 &u.au8[0],
910 sizeof(u));
911 RTStrFree(pszName);
912 }
913 }
914
915 /* next */
916 AddrPrev = Addr;
917 DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
918 } while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
919 && Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
920
921 pThis->fValid = true;
922 return VINF_SUCCESS;
923}
924
925
926/**
927 * @copydoc DBGFOSREG::pfnProbe
928 */
929static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
930{
931 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
932 DBGFADDRESS Addr;
933 union
934 {
935 uint8_t au8[8192];
936 uint16_t au16[8192/2];
937 uint32_t au32[8192/4];
938 IMAGE_DOS_HEADER MzHdr;
939 RTUTF16 wsz[8192/2];
940 } u;
941
942 union
943 {
944 NTMTE32 v32;
945 NTMTE64 v64;
946 } uMte, uMte2, uMte3;
947
948 /*
949 * Look for the PAGELK section name that seems to be a part of all kernels.
950 * Then try find the module table entry for it. Since it's the first entry
951 * in the PsLoadedModuleList we can easily validate the list head and report
952 * success.
953 */
954 CPUMMODE enmMode = DBGFR3CpuGetMode(pUVM, 0 /*idCpu*/);
955 uint64_t const uStart = enmMode == CPUMMODE_LONG ? UINT64_C(0xfffff80000000000) : UINT32_C(0x80001000);
956 uint64_t const uEnd = enmMode == CPUMMODE_LONG ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
957 DBGFADDRESS KernelAddr;
958 for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uStart);
959 KernelAddr.FlatPtr < uEnd;
960 KernelAddr.FlatPtr += PAGE_SIZE)
961 {
962 int rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
963 1, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
964 if (RT_FAILURE(rc))
965 break;
966 DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
967
968 /* MZ + PE header. */
969 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &KernelAddr, &u, sizeof(u));
970 if ( RT_SUCCESS(rc)
971 && u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
972 && !(u.MzHdr.e_lfanew & 0x7)
973 && u.MzHdr.e_lfanew >= 0x080
974 && u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
975 {
976 if (enmMode != CPUMMODE_LONG)
977 {
978 IMAGE_NT_HEADERS32 const *pHdrs = (IMAGE_NT_HEADERS32 const *)&u.au8[u.MzHdr.e_lfanew];
979 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
980 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
981 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
982 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
983 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
984 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
985 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
986 )
987 {
988 /* Find the MTE. */
989 RT_ZERO(uMte);
990 uMte.v32.DllBase = KernelAddr.FlatPtr;
991 uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
992 uMte.v32.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
993 DBGFADDRESS HitAddr;
994 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
995 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
996 while (RT_SUCCESS(rc))
997 {
998 /* check the name. */
999 DBGFADDRESS MteAddr = HitAddr;
1000 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
1001 &uMte2.v32, sizeof(uMte2.v32));
1002 if ( RT_SUCCESS(rc)
1003 && uMte2.v32.DllBase == uMte.v32.DllBase
1004 && uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1005 && uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1006 && WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1007 && WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1008 && WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1009 && uMte2.v32.BaseDllName.Length <= 128
1010 && uMte2.v32.FullDllName.Length <= 260
1011 )
1012 {
1013 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1014 u.wsz, uMte2.v32.BaseDllName.Length);
1015 u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1016 if ( RT_SUCCESS(rc)
1017 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1018 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1019 )
1020 )
1021 {
1022 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
1023 DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
1024 &uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1025 if ( RT_SUCCESS(rc)
1026 && uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1027 && WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1028 {
1029 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1030 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1031 pThis->KernelAddr = KernelAddr;
1032 pThis->KernelMteAddr = MteAddr;
1033 pThis->PsLoadedModuleListAddr = Addr;
1034 pThis->f32Bit = true;
1035 return true;
1036 }
1037 }
1038 else if (RT_SUCCESS(rc))
1039 {
1040 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1041 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1042 break; /* Not NT kernel */
1043 }
1044 }
1045
1046 /* next */
1047 DBGFR3AddrAdd(&HitAddr, 4);
1048 if (HitAddr.FlatPtr < uEnd)
1049 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1050 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1051 else
1052 rc = VERR_DBGF_MEM_NOT_FOUND;
1053 }
1054 }
1055 }
1056 else
1057 {
1058 IMAGE_NT_HEADERS64 const *pHdrs = (IMAGE_NT_HEADERS64 const *)&u.au8[u.MzHdr.e_lfanew];
1059 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1060 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1061 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1062 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1063 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
1064 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1065 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1066 )
1067 {
1068 /* Find the MTE. */
1069 RT_ZERO(uMte.v64);
1070 uMte.v64.DllBase = KernelAddr.FlatPtr;
1071 uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1072 uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1073 DBGFADDRESS ScanAddr;
1074 DBGFADDRESS HitAddr;
1075 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1076 uEnd - uStart, 8 /*align*/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1077 while (RT_SUCCESS(rc))
1078 {
1079 /* check the name. */
1080 DBGFADDRESS MteAddr = HitAddr;
1081 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1082 &uMte2.v64, sizeof(uMte2.v64));
1083 if ( RT_SUCCESS(rc)
1084 && uMte2.v64.DllBase == uMte.v64.DllBase
1085 && uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1086 && uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1087 && WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1088 && WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1089 && WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1090 && uMte2.v64.BaseDllName.Length <= 128
1091 && uMte2.v64.FullDllName.Length <= 260
1092 )
1093 {
1094 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1095 u.wsz, uMte2.v64.BaseDllName.Length);
1096 u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1097 if ( RT_SUCCESS(rc)
1098 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1099 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1100 )
1101 )
1102 {
1103 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
1104 DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1105 &uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1106 if ( RT_SUCCESS(rc)
1107 && uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1108 && WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1109 {
1110 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1111 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1112 pThis->KernelAddr = KernelAddr;
1113 pThis->KernelMteAddr = MteAddr;
1114 pThis->PsLoadedModuleListAddr = Addr;
1115 pThis->f32Bit = false;
1116 return true;
1117 }
1118 }
1119 else if (RT_SUCCESS(rc))
1120 {
1121 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1122 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1123 break; /* Not NT kernel */
1124 }
1125 }
1126
1127 /* next */
1128 DBGFR3AddrAdd(&HitAddr, 8);
1129 if (HitAddr.FlatPtr < uEnd)
1130 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1131 8 /*align*/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1132 else
1133 rc = VERR_DBGF_MEM_NOT_FOUND;
1134 }
1135 }
1136 }
1137 }
1138 }
1139 return false;
1140}
1141
1142
1143/**
1144 * @copydoc DBGFOSREG::pfnDestruct
1145 */
1146static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1147{
1148
1149}
1150
1151
1152/**
1153 * @copydoc DBGFOSREG::pfnConstruct
1154 */
1155static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1156{
1157 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1158 pThis->fValid = false;
1159 pThis->f32Bit = false;
1160 pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1161 return VINF_SUCCESS;
1162}
1163
1164
1165const DBGFOSREG g_DBGDiggerWinNt =
1166{
1167 /* .u32Magic = */ DBGFOSREG_MAGIC,
1168 /* .fFlags = */ 0,
1169 /* .cbData = */ sizeof(DBGDIGGERWINNT),
1170 /* .szName = */ "WinNT",
1171 /* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1172 /* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1173 /* .pfnProbe = */ dbgDiggerWinNtProbe,
1174 /* .pfnInit = */ dbgDiggerWinNtInit,
1175 /* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1176 /* .pfnTerm = */ dbgDiggerWinNtTerm,
1177 /* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1178 /* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1179 /* .u32EndMagic = */ DBGFOSREG_MAGIC
1180};
1181
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette