VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 67981

Last change on this file since 67981 was 63567, checked in by vboxsync, 8 years ago

scm: cleaning up todos
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 47.6 KB
Line 
1/* $Id: DBGPlugInWinNt.cpp 63567 2016-08-16 14:06:54Z vboxsync $ */
2/** @file
3 * DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4 */
5
6/*
7 * Copyright (C) 2009-2016 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23#include "DBGPlugIns.h"
24#include <VBox/vmm/dbgf.h>
25#include <VBox/err.h>
26#include <VBox/param.h>
27#include <iprt/ldr.h>
28#include <iprt/mem.h>
29#include <iprt/stream.h>
30#include <iprt/string.h>
31#include <iprt/formats/pecoff.h>
32#include <iprt/formats/mz.h>
33
34
35/*********************************************************************************************************************************
36* Structures and Typedefs *
37*********************************************************************************************************************************/
38
39/** @name Internal WinNT structures
40 * @{ */
41/**
42 * PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
43 * Tested with XP.
44 */
45typedef struct NTMTE32
46{
47 struct
48 {
49 uint32_t Flink;
50 uint32_t Blink;
51 } InLoadOrderLinks,
52 InMemoryOrderModuleList,
53 InInitializationOrderModuleList;
54 uint32_t DllBase;
55 uint32_t EntryPoint;
56 uint32_t SizeOfImage;
57 struct
58 {
59 uint16_t Length;
60 uint16_t MaximumLength;
61 uint32_t Buffer;
62 } FullDllName,
63 BaseDllName;
64 uint32_t Flags;
65 uint16_t LoadCount;
66 uint16_t TlsIndex;
67 /* ... there is more ... */
68} NTMTE32;
69typedef NTMTE32 *PNTMTE32;
70
71/**
72 * PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
73 */
74typedef struct NTMTE64
75{
76 struct
77 {
78 uint64_t Flink;
79 uint64_t Blink;
80 } InLoadOrderLinks, /**< 0x00 */
81 InMemoryOrderModuleList, /**< 0x10 */
82 InInitializationOrderModuleList; /**< 0x20 */
83 uint64_t DllBase; /**< 0x30 */
84 uint64_t EntryPoint; /**< 0x38 */
85 uint32_t SizeOfImage; /**< 0x40 */
86 uint32_t Alignment; /**< 0x44 */
87 struct
88 {
89 uint16_t Length; /**< 0x48,0x58 */
90 uint16_t MaximumLength; /**< 0x4a,0x5a */
91 uint32_t Alignment; /**< 0x4c,0x5c */
92 uint64_t Buffer; /**< 0x50,0x60 */
93 } FullDllName, /**< 0x48 */
94 BaseDllName; /**< 0x58 */
95 uint32_t Flags; /**< 0x68 */
96 uint16_t LoadCount; /**< 0x6c */
97 uint16_t TlsIndex; /**< 0x6e */
98 /* ... there is more ... */
99} NTMTE64;
100typedef NTMTE64 *PNTMTE64;
101
102/** MTE union. */
103typedef union NTMTE
104{
105 NTMTE32 vX_32;
106 NTMTE64 vX_64;
107} NTMTE;
108typedef NTMTE *PNTMTE;
109
110
111/**
112 * The essential bits of the KUSER_SHARED_DATA structure.
113 */
114typedef struct NTKUSERSHAREDDATA
115{
116 uint32_t TickCountLowDeprecated;
117 uint32_t TickCountMultiplier;
118 struct
119 {
120 uint32_t LowPart;
121 int32_t High1Time;
122 int32_t High2Time;
123
124 } InterruptTime,
125 SystemTime,
126 TimeZoneBias;
127 uint16_t ImageNumberLow;
128 uint16_t ImageNumberHigh;
129 RTUTF16 NtSystemRoot[260];
130 uint32_t MaxStackTraceDepth;
131 uint32_t CryptoExponent;
132 uint32_t TimeZoneId;
133 uint32_t LargePageMinimum;
134 uint32_t Reserved2[7];
135 uint32_t NtProductType;
136 uint8_t ProductTypeIsValid;
137 uint8_t abPadding[3];
138 uint32_t NtMajorVersion;
139 uint32_t NtMinorVersion;
140 /* uint8_t ProcessorFeatures[64];
141 ...
142 */
143} NTKUSERSHAREDDATA;
144typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
145
146/** KI_USER_SHARED_DATA for i386 */
147#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
148/** KI_USER_SHARED_DATA for AMD64 */
149#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
150
151/** NTKUSERSHAREDDATA::NtProductType */
152typedef enum NTPRODUCTTYPE
153{
154 kNtProductType_Invalid = 0,
155 kNtProductType_WinNt = 1,
156 kNtProductType_LanManNt,
157 kNtProductType_Server
158} NTPRODUCTTYPE;
159
160
161/** NT image header union. */
162typedef union NTHDRSU
163{
164 IMAGE_NT_HEADERS32 vX_32;
165 IMAGE_NT_HEADERS64 vX_64;
166} NTHDRS;
167/** Pointer to NT image header union. */
168typedef NTHDRS *PNTHDRS;
169/** Pointer to const NT image header union. */
170typedef NTHDRS const *PCNTHDRS;
171
172/** @} */
173
174
175
176typedef enum DBGDIGGERWINNTVER
177{
178 DBGDIGGERWINNTVER_UNKNOWN,
179 DBGDIGGERWINNTVER_3_1,
180 DBGDIGGERWINNTVER_3_5,
181 DBGDIGGERWINNTVER_4_0,
182 DBGDIGGERWINNTVER_5_0,
183 DBGDIGGERWINNTVER_5_1,
184 DBGDIGGERWINNTVER_6_0
185} DBGDIGGERWINNTVER;
186
187/**
188 * WinNT guest OS digger instance data.
189 */
190typedef struct DBGDIGGERWINNT
191{
192 /** Whether the information is valid or not.
193 * (For fending off illegal interface method calls.) */
194 bool fValid;
195 /** 32-bit (true) or 64-bit (false) */
196 bool f32Bit;
197
198 /** The NT version. */
199 DBGDIGGERWINNTVER enmVer;
200 /** NTKUSERSHAREDDATA::NtProductType */
201 NTPRODUCTTYPE NtProductType;
202 /** NTKUSERSHAREDDATA::NtMajorVersion */
203 uint32_t NtMajorVersion;
204 /** NTKUSERSHAREDDATA::NtMinorVersion */
205 uint32_t NtMinorVersion;
206
207 /** The address of the ntoskrnl.exe image. */
208 DBGFADDRESS KernelAddr;
209 /** The address of the ntoskrnl.exe module table entry. */
210 DBGFADDRESS KernelMteAddr;
211 /** The address of PsLoadedModuleList. */
212 DBGFADDRESS PsLoadedModuleListAddr;
213} DBGDIGGERWINNT;
214/** Pointer to the linux guest OS digger instance data. */
215typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
216
217
218/**
219 * The WinNT digger's loader reader instance data.
220 */
221typedef struct DBGDIGGERWINNTRDR
222{
223 /** The VM handle (referenced). */
224 PUVM pUVM;
225 /** The image base. */
226 DBGFADDRESS ImageAddr;
227 /** The image size. */
228 uint32_t cbImage;
229 /** The file offset of the SizeOfImage field in the optional header if it
230 * needs patching, otherwise set to UINT32_MAX. */
231 uint32_t offSizeOfImage;
232 /** The correct image size. */
233 uint32_t cbCorrectImageSize;
234 /** Number of entries in the aMappings table. */
235 uint32_t cMappings;
236 /** Mapping hint. */
237 uint32_t iHint;
238 /** Mapping file offset to memory offsets, ordered by file offset. */
239 struct
240 {
241 /** The file offset. */
242 uint32_t offFile;
243 /** The size of this mapping. */
244 uint32_t cbMem;
245 /** The offset to the memory from the start of the image. */
246 uint32_t offMem;
247 } aMappings[1];
248} DBGDIGGERWINNTRDR;
249/** Pointer a WinNT loader reader instance data. */
250typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
251
252
253/*********************************************************************************************************************************
254* Defined Constants And Macros *
255*********************************************************************************************************************************/
256/** Validates a 32-bit Windows NT kernel address */
257#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
258/** Validates a 64-bit Windows NT kernel address */
259 #define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
260/** Validates a kernel address. */
261#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
262/** Versioned and bitness wrapper. */
263#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
264
265/** The length (in chars) of the kernel file name (no path). */
266#define WINNT_KERNEL_BASE_NAME_LEN 12
267
268/** WindowsNT on little endian ASCII systems. */
269#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
270
271
272/*********************************************************************************************************************************
273* Internal Functions *
274*********************************************************************************************************************************/
275static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
276
277
278/*********************************************************************************************************************************
279* Global Variables *
280*********************************************************************************************************************************/
281/** Kernel names. */
282static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
283{
284 { 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
285};
286
287
288
289/** @callback_method_impl{PFNRTLDRRDRMEMREAD} */
290static DECLCALLBACK(int) dbgDiggerWinNtRdr_Read(void *pvBuf, size_t cb, size_t off, void *pvUser)
291{
292 PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
293 uint32_t offFile = (uint32_t)off;
294 AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
295
296 uint32_t i = pThis->iHint;
297 if (pThis->aMappings[i].offFile > offFile)
298 {
299 i = pThis->cMappings;
300 while (i-- > 0)
301 if (offFile >= pThis->aMappings[i].offFile)
302 break;
303 pThis->iHint = i;
304 }
305
306 while (cb > 0)
307 {
308 uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
309 uint32_t offMap = offFile - pThis->aMappings[i].offFile;
310
311 /* Read file bits backed by memory. */
312 if (offMap < pThis->aMappings[i].cbMem)
313 {
314 uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
315 if (cbToRead > cb)
316 cbToRead = (uint32_t)cb;
317
318 DBGFADDRESS Addr = pThis->ImageAddr;
319 DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
320
321 int rc = DBGFR3MemRead(pThis->pUVM, 0 /*idCpu*/, &Addr, pvBuf, cbToRead);
322 if (RT_FAILURE(rc))
323 return rc;
324
325 /* Apply SizeOfImage patch? */
326 if ( pThis->offSizeOfImage != UINT32_MAX
327 && offFile < pThis->offSizeOfImage + 4
328 && offFile + cbToRead > pThis->offSizeOfImage)
329 {
330 uint32_t SizeOfImage = pThis->cbCorrectImageSize;
331 uint32_t cbPatch = sizeof(SizeOfImage);
332 int32_t offPatch = pThis->offSizeOfImage - offFile;
333 uint8_t *pbPatch = (uint8_t *)pvBuf + offPatch;
334 if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
335 cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
336 while (cbPatch-- > 0)
337 {
338 if (offPatch >= 0)
339 *pbPatch = (uint8_t)SizeOfImage;
340 offPatch++;
341 pbPatch++;
342 SizeOfImage >>= 8;
343 }
344 }
345
346 /* Done? */
347 if (cbToRead == cb)
348 break;
349
350 offFile += cbToRead;
351 cb -= cbToRead;
352 pvBuf = (char *)pvBuf + cbToRead;
353 }
354
355 /* Mind the gap. */
356 if (offNextMap > offFile)
357 {
358 uint32_t cbZero = offNextMap - offFile;
359 if (cbZero > cb)
360 {
361 RT_BZERO(pvBuf, cb);
362 break;
363 }
364
365 RT_BZERO(pvBuf, cbZero);
366 offFile += cbZero;
367 cb -= cbZero;
368 pvBuf = (char *)pvBuf + cbZero;
369 }
370
371 pThis->iHint = ++i;
372 }
373
374 return VINF_SUCCESS;
375}
376
377
378/** @callback_method_impl{PFNRTLDRRDRMEMDTOR} */
379static DECLCALLBACK(void) dbgDiggerWinNtRdr_Dtor(void *pvUser)
380{
381 PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
382
383 VMR3ReleaseUVM(pThis->pUVM);
384 pThis->pUVM = NULL;
385 RTMemFree(pvUser);
386}
387
388
389/**
390 * Checks if the section headers look okay.
391 *
392 * @returns true / false.
393 * @param paShs Pointer to the section headers.
394 * @param cShs Number of headers.
395 * @param cbImage The image size reported by NT.
396 * @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
397 * no resource directory.
398 * @param cbSectAlign The section alignment specified in the header.
399 * @param pcbImageCorrect The corrected image size. This is derived from
400 * cbImage and virtual range of the section tables.
401 *
402 * The problem is that NT may choose to drop the
403 * last pages in images it loads early, starting at
404 * the resource directory. These images will have
405 * a page aligned cbImage.
406 */
407static bool dbgDiggerWinNtCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShs, uint32_t cShs, uint32_t cbImage,
408 uint32_t uRvaRsrc, uint32_t cbSectAlign, uint32_t *pcbImageCorrect)
409{
410 *pcbImageCorrect = cbImage;
411
412 for (uint32_t i = 0; i < cShs; i++)
413 {
414 if (!paShs[i].Name[0])
415 {
416 Log(("DigWinNt: Section header #%u has no name\n", i));
417 return false;
418 }
419
420 if (paShs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
421 continue;
422
423 /* Check that sizes are within the same range and that both sizes and
424 addresses are within reasonable limits. */
425 if ( RT_ALIGN(paShs[i].Misc.VirtualSize, _64K) < RT_ALIGN(paShs[i].SizeOfRawData, _64K)
426 || paShs[i].Misc.VirtualSize >= _1G
427 || paShs[i].SizeOfRawData >= _1G)
428 {
429 Log(("DigWinNt: Section header #%u has a VirtualSize=%#x and SizeOfRawData=%#x, that's too much data!\n",
430 i, paShs[i].Misc.VirtualSize, paShs[i].SizeOfRawData));
431 return false;
432 }
433 uint32_t uRvaEnd = paShs[i].VirtualAddress + paShs[i].Misc.VirtualSize;
434 if (uRvaEnd >= _1G || uRvaEnd < paShs[i].VirtualAddress)
435 {
436 Log(("DigWinNt: Section header #%u has a VirtualSize=%#x and VirtualAddr=%#x, %#x in total, that's too much!\n",
437 i, paShs[i].Misc.VirtualSize, paShs[i].VirtualAddress, uRvaEnd));
438 return false;
439 }
440
441 /* Check for images chopped off around '.rsrc'. */
442 if ( cbImage < uRvaEnd
443 && uRvaEnd >= uRvaRsrc)
444 cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
445
446 /* Check that the section is within the image. */
447 if (uRvaEnd > cbImage)
448 {
449 Log(("DigWinNt: Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x\n",
450 i, paShs[i].VirtualAddress, uRvaEnd, cbImage));
451 return false;
452 }
453 }
454
455 Assert(*pcbImageCorrect == cbImage || !(*pcbImageCorrect & 0xfff));
456 *pcbImageCorrect = cbImage;
457 return true;
458}
459
460
461/**
462 * Create a loader module for the in-guest-memory PE module.
463 */
464static int dbgDiggerWinNtCreateLdrMod(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName, PCDBGFADDRESS pImageAddr,
465 uint32_t cbImage, uint8_t *pbBuf, size_t cbBuf,
466 uint32_t offHdrs, PCNTHDRS pHdrs, PRTLDRMOD phLdrMod)
467{
468 /*
469 * Allocate and create a reader instance.
470 */
471 uint32_t const cShs = WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections);
472 PDBGDIGGERWINNTRDR pRdr = (PDBGDIGGERWINNTRDR)RTMemAlloc(RT_OFFSETOF(DBGDIGGERWINNTRDR, aMappings[cShs + 2]));
473 if (!pRdr)
474 return VERR_NO_MEMORY;
475
476 VMR3RetainUVM(pUVM);
477 pRdr->pUVM = pUVM;
478 pRdr->ImageAddr = *pImageAddr;
479 pRdr->cbImage = cbImage;
480 pRdr->cbCorrectImageSize = cbImage;
481 pRdr->offSizeOfImage = UINT32_MAX;
482 pRdr->iHint = 0;
483
484 /*
485 * Use the section table to construct a more accurate view of the file/
486 * image if it's in the buffer (it should be).
487 */
488 uint32_t uRvaRsrc = UINT32_MAX;
489 if (WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).Size > 0)
490 uRvaRsrc = WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress;
491 uint32_t offShs = offHdrs
492 + ( pThis->f32Bit
493 ? pHdrs->vX_32.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
494 : pHdrs->vX_64.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader));
495 uint32_t cbShs = cShs * sizeof(IMAGE_SECTION_HEADER);
496 PCIMAGE_SECTION_HEADER paShs = (PCIMAGE_SECTION_HEADER)(pbBuf + offShs);
497 if ( offShs + cbShs <= RT_MIN(cbImage, cbBuf)
498 && dbgDiggerWinNtCheckSectHdrsAndImgSize(paShs, cShs, cbImage, uRvaRsrc,
499 WINNT_UNION(pThis, pHdrs, OptionalHeader.SectionAlignment),
500 &pRdr->cbCorrectImageSize))
501 {
502 pRdr->cMappings = 0;
503
504 for (uint32_t i = 0; i < cShs; i++)
505 if ( paShs[i].SizeOfRawData > 0
506 && paShs[i].PointerToRawData > 0)
507 {
508 uint32_t j = 1;
509 if (!pRdr->cMappings)
510 pRdr->cMappings++;
511 else
512 {
513 while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShs[i].PointerToRawData)
514 j++;
515 if (j < pRdr->cMappings)
516 memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
517 }
518 pRdr->aMappings[j].offFile = paShs[i].PointerToRawData;
519 pRdr->aMappings[j].offMem = paShs[i].VirtualAddress;
520 pRdr->aMappings[j].cbMem = i + 1 < cShs
521 ? paShs[i + 1].VirtualAddress - paShs[i].VirtualAddress
522 : paShs[i].Misc.VirtualSize;
523 if (j == pRdr->cMappings)
524 pRdr->cbImage = paShs[i].PointerToRawData + paShs[i].SizeOfRawData;
525 pRdr->cMappings++;
526 }
527
528 /* Insert the mapping of the headers that isn't covered by the section table. */
529 pRdr->aMappings[0].offFile = 0;
530 pRdr->aMappings[0].offMem = 0;
531 pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
532
533 int j = pRdr->cMappings - 1;
534 while (j-- > 0)
535 {
536 uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
537 if (pRdr->aMappings[j].cbMem > cbFile)
538 pRdr->aMappings[j].cbMem = cbFile;
539 }
540 }
541 else
542 {
543 /*
544 * Fallback, fake identity mapped file data.
545 */
546 pRdr->cMappings = 1;
547 pRdr->aMappings[0].offFile = 0;
548 pRdr->aMappings[0].offMem = 0;
549 pRdr->aMappings[0].cbMem = pRdr->cbImage;
550 }
551
552 /* Enable the SizeOfImage patching if necessary. */
553 if (pRdr->cbCorrectImageSize != cbImage)
554 {
555 Log(("DigWinNT: The image is really %#x bytes long, not %#x as mapped by NT!\n", pRdr->cbCorrectImageSize, cbImage));
556 pRdr->offSizeOfImage = pThis->f32Bit
557 ? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
558 : offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
559 }
560
561 /*
562 * Call the loader to open the PE image for debugging.
563 * Note! It always calls pfnDtor.
564 */
565 RTLDRMOD hLdrMod;
566 int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
567 dbgDiggerWinNtRdr_Read, dbgDiggerWinNtRdr_Dtor, pRdr,
568 &hLdrMod);
569 if (RT_SUCCESS(rc))
570 *phLdrMod = hLdrMod;
571 else
572 *phLdrMod = NIL_RTLDRMOD;
573 return rc;
574}
575
576
577/**
578 * Process a PE image found in guest memory.
579 *
580 * @param pThis The instance data.
581 * @param pUVM The user mode VM handle.
582 * @param pszName The image name.
583 * @param pImageAddr The image address.
584 * @param cbImage The size of the image.
585 * @param pbBuf Scratch buffer containing the first
586 * RT_MIN(cbBuf, cbImage) bytes of the image.
587 * @param cbBuf The scratch buffer size.
588 */
589static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
590 PCDBGFADDRESS pImageAddr, uint32_t cbImage,
591 uint8_t *pbBuf, size_t cbBuf)
592{
593 LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
594
595 /*
596 * Do some basic validation first.
597 * This is the usual exteremely verbose and messy code...
598 */
599 Assert(cbBuf >= sizeof(IMAGE_NT_HEADERS64));
600 if ( cbImage < sizeof(IMAGE_NT_HEADERS64)
601 || cbImage >= _1M * 256)
602 {
603 Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
604 return;
605 }
606
607 /* Dig out the NT/PE headers. */
608 IMAGE_DOS_HEADER const *pMzHdr = (IMAGE_DOS_HEADER const *)pbBuf;
609 PCNTHDRS pHdrs;
610 uint32_t offHdrs;
611 if (pMzHdr->e_magic != IMAGE_DOS_SIGNATURE)
612 {
613 offHdrs = 0;
614 pHdrs = (PCNTHDRS)pbBuf;
615 }
616 else if ( pMzHdr->e_lfanew >= cbImage
617 || pMzHdr->e_lfanew < sizeof(*pMzHdr)
618 || pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) > cbImage)
619 {
620 Log(("DigWinNt: %s: PE header to far into image: %#x cbImage=%#x\n", pszName, pMzHdr->e_lfanew, cbImage));
621 return;
622 }
623 else if ( pMzHdr->e_lfanew < cbBuf
624 && pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) <= cbBuf)
625 {
626 offHdrs = pMzHdr->e_lfanew;
627 pHdrs = (NTHDRS const *)(pbBuf + offHdrs);
628 }
629 else
630 {
631 Log(("DigWinNt: %s: PE header to far into image (lazy bird): %#x\n", pszName, pMzHdr->e_lfanew));
632 return;
633 }
634 if (pHdrs->vX_32.Signature != IMAGE_NT_SIGNATURE)
635 {
636 Log(("DigWinNt: %s: Bad PE signature: %#x\n", pszName, pHdrs->vX_32.Signature));
637 return;
638 }
639
640 /* The file header is the same on both archs */
641 if (pHdrs->vX_32.FileHeader.Machine != (pThis->f32Bit ? IMAGE_FILE_MACHINE_I386 : IMAGE_FILE_MACHINE_AMD64))
642 {
643 Log(("DigWinNt: %s: Invalid FH.Machine: %#x\n", pszName, pHdrs->vX_32.FileHeader.Machine));
644 return;
645 }
646 if (pHdrs->vX_32.FileHeader.SizeOfOptionalHeader != (pThis->f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
647 {
648 Log(("DigWinNt: %s: Invalid FH.SizeOfOptionalHeader: %#x\n", pszName, pHdrs->vX_32.FileHeader.SizeOfOptionalHeader));
649 return;
650 }
651 if (WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections) > 64)
652 {
653 Log(("DigWinNt: %s: Too many sections: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections)));
654 return;
655 }
656
657 const uint32_t TimeDateStamp = pHdrs->vX_32.FileHeader.TimeDateStamp;
658
659 /* The optional header is not... */
660 if (WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic) != (pThis->f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
661 {
662 Log(("DigWinNt: %s: Invalid OH.Magic: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic)));
663 return;
664 }
665 uint32_t cbImageFromHdr = WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage);
666 if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
667 {
668 Log(("DigWinNt: %s: Invalid OH.SizeOfImage: %#x, expected %#x\n", pszName, cbImageFromHdr, cbImage));
669 return;
670 }
671 if (WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes) != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
672 {
673 Log(("DigWinNt: %s: Invalid OH.NumberOfRvaAndSizes: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes)));
674 return;
675 }
676
677 /*
678 * Create the module using the in memory image first, falling back
679 * on cached image.
680 */
681 RTLDRMOD hLdrMod;
682 int rc = dbgDiggerWinNtCreateLdrMod(pThis, pUVM, pszName, pImageAddr, cbImage, pbBuf, cbBuf, offHdrs, pHdrs,
683 &hLdrMod);
684 if (RT_FAILURE(rc))
685 hLdrMod = NIL_RTLDRMOD;
686
687 RTDBGMOD hMod;
688 rc = RTDbgModCreateFromPeImage(&hMod, pszName, NULL, hLdrMod,
689 cbImageFromHdr, TimeDateStamp, DBGFR3AsGetConfig(pUVM));
690 if (RT_FAILURE(rc))
691 {
692 /*
693 * Final fallback is a container module.
694 */
695 rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
696 if (RT_FAILURE(rc))
697 return;
698
699 rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /*iSeg*/, 0, cbImage, 0 /*fFlags*/, NULL);
700 AssertRC(rc);
701 }
702
703 /* Tag the module. */
704 rc = RTDbgModSetTag(hMod, DIG_WINNT_MOD_TAG);
705 AssertRC(rc);
706
707 /*
708 * Link the module.
709 */
710 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
711 if (hAs != NIL_RTDBGAS)
712 rc = RTDbgAsModuleLink(hAs, hMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
713 else
714 rc = VERR_INTERNAL_ERROR;
715 RTDbgModRelease(hMod);
716 RTDbgAsRelease(hAs);
717}
718
719
720/**
721 * @copydoc DBGFOSREG::pfnQueryInterface
722 */
723static DECLCALLBACK(void *) dbgDiggerWinNtQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
724{
725 RT_NOREF3(pUVM, pvData, enmIf);
726 return NULL;
727}
728
729
730/**
731 * @copydoc DBGFOSREG::pfnQueryVersion
732 */
733static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void *pvData, char *pszVersion, size_t cchVersion)
734{
735 RT_NOREF1(pUVM);
736 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
737 Assert(pThis->fValid);
738 const char *pszNtProductType;
739 switch (pThis->NtProductType)
740 {
741 case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
742 case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
743 case kNtProductType_Server: pszNtProductType = "-Server"; break;
744 default: pszNtProductType = ""; break;
745 }
746 RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
747 pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
748 return VINF_SUCCESS;
749}
750
751
752/**
753 * @copydoc DBGFOSREG::pfnTerm
754 */
755static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
756{
757 RT_NOREF1(pUVM);
758 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
759 Assert(pThis->fValid);
760
761 pThis->fValid = false;
762}
763
764
765/**
766 * @copydoc DBGFOSREG::pfnRefresh
767 */
768static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
769{
770 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
771 NOREF(pThis);
772 Assert(pThis->fValid);
773
774 /*
775 * For now we'll flush and reload everything.
776 */
777 RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
778 if (hDbgAs != NIL_RTDBGAS)
779 {
780 uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
781 while (iMod-- > 0)
782 {
783 RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
784 if (hMod != NIL_RTDBGMOD)
785 {
786 if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
787 {
788 int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
789 AssertRC(rc);
790 }
791 RTDbgModRelease(hMod);
792 }
793 }
794 RTDbgAsRelease(hDbgAs);
795 }
796
797 dbgDiggerWinNtTerm(pUVM, pvData);
798 return dbgDiggerWinNtInit(pUVM, pvData);
799}
800
801
802/**
803 * @copydoc DBGFOSREG::pfnInit
804 */
805static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
806{
807 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
808 Assert(!pThis->fValid);
809
810 union
811 {
812 uint8_t au8[0x2000];
813 RTUTF16 wsz[0x2000/2];
814 NTKUSERSHAREDDATA UserSharedData;
815 } u;
816 DBGFADDRESS Addr;
817 int rc;
818
819 /*
820 * Figure the NT version.
821 */
822 DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
823 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &u, PAGE_SIZE);
824 if (RT_FAILURE(rc))
825 return rc;
826 pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
827 ? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
828 : kNtProductType_Invalid;
829 pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
830 pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
831
832 /*
833 * Dig out the module chain.
834 */
835 DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
836 Addr = pThis->KernelMteAddr;
837 do
838 {
839 /* Read the validate the MTE. */
840 NTMTE Mte;
841 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
842 if (RT_FAILURE(rc))
843 break;
844 if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
845 {
846 Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
847 break;
848 }
849 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
850 {
851 Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
852 break;
853 }
854 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
855 {
856 Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
857 break;
858 }
859 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
860 {
861 Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
862 break;
863 }
864 if ( !WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase))
865 || WINNT_UNION(pThis, &Mte, SizeOfImage) > _1M*256
866 || WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > WINNT_UNION(pThis, &Mte, SizeOfImage) )
867 {
868 Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
869 Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), WINNT_UNION(pThis, &Mte, SizeOfImage), WINNT_UNION(pThis, &Mte, DllBase)));
870 break;
871 }
872
873 /* Read the full name. */
874 DBGFADDRESS AddrName;
875 DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
876 uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
877 if (cbName < sizeof(u))
878 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
879 else
880 rc = VERR_OUT_OF_RANGE;
881 if (RT_FAILURE(rc))
882 {
883 DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
884 cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
885 if (cbName < sizeof(u))
886 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
887 else
888 rc = VERR_OUT_OF_RANGE;
889 }
890 if (RT_SUCCESS(rc))
891 {
892 u.wsz[cbName/2] = '\0';
893 char *pszName;
894 rc = RTUtf16ToUtf8(u.wsz, &pszName);
895 if (RT_SUCCESS(rc))
896 {
897 /* Read the start of the PE image and pass it along to a worker. */
898 DBGFADDRESS ImageAddr;
899 DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
900 uint32_t cbImageBuf = RT_MIN(sizeof(u), WINNT_UNION(pThis, &Mte, SizeOfImage));
901 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &ImageAddr, &u, cbImageBuf);
902 if (RT_SUCCESS(rc))
903 dbgDiggerWinNtProcessImage(pThis,
904 pUVM,
905 pszName,
906 &ImageAddr,
907 WINNT_UNION(pThis, &Mte, SizeOfImage),
908 &u.au8[0],
909 sizeof(u));
910 RTStrFree(pszName);
911 }
912 }
913
914 /* next */
915 AddrPrev = Addr;
916 DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
917 } while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
918 && Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
919
920 pThis->fValid = true;
921 return VINF_SUCCESS;
922}
923
924
925/**
926 * @copydoc DBGFOSREG::pfnProbe
927 */
928static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
929{
930 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
931 DBGFADDRESS Addr;
932 union
933 {
934 uint8_t au8[8192];
935 uint16_t au16[8192/2];
936 uint32_t au32[8192/4];
937 IMAGE_DOS_HEADER MzHdr;
938 RTUTF16 wsz[8192/2];
939 } u;
940
941 union
942 {
943 NTMTE32 v32;
944 NTMTE64 v64;
945 } uMte, uMte2, uMte3;
946
947 /*
948 * Look for the PAGELK section name that seems to be a part of all kernels.
949 * Then try find the module table entry for it. Since it's the first entry
950 * in the PsLoadedModuleList we can easily validate the list head and report
951 * success.
952 */
953 CPUMMODE enmMode = DBGFR3CpuGetMode(pUVM, 0 /*idCpu*/);
954 uint64_t const uStart = enmMode == CPUMMODE_LONG ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
955 uint64_t const uEnd = enmMode == CPUMMODE_LONG ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
956 DBGFADDRESS KernelAddr;
957 for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uStart);
958 KernelAddr.FlatPtr < uEnd;
959 KernelAddr.FlatPtr += PAGE_SIZE)
960 {
961 int rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
962 1, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
963 if (RT_FAILURE(rc))
964 break;
965 DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
966
967 /* MZ + PE header. */
968 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &KernelAddr, &u, sizeof(u));
969 if ( RT_SUCCESS(rc)
970 && u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
971 && !(u.MzHdr.e_lfanew & 0x7)
972 && u.MzHdr.e_lfanew >= 0x080
973 && u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
974 {
975 if (enmMode != CPUMMODE_LONG)
976 {
977 IMAGE_NT_HEADERS32 const *pHdrs = (IMAGE_NT_HEADERS32 const *)&u.au8[u.MzHdr.e_lfanew];
978 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
979 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
980 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
981 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
982 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
983 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
984 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
985 )
986 {
987 /* Find the MTE. */
988 RT_ZERO(uMte);
989 uMte.v32.DllBase = KernelAddr.FlatPtr;
990 uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
991 uMte.v32.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
992 DBGFADDRESS HitAddr;
993 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
994 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
995 while (RT_SUCCESS(rc))
996 {
997 /* check the name. */
998 DBGFADDRESS MteAddr = HitAddr;
999 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
1000 &uMte2.v32, sizeof(uMte2.v32));
1001 if ( RT_SUCCESS(rc)
1002 && uMte2.v32.DllBase == uMte.v32.DllBase
1003 && uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1004 && uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1005 && WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1006 && WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1007 && WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1008 && uMte2.v32.BaseDllName.Length <= 128
1009 && uMte2.v32.FullDllName.Length <= 260
1010 )
1011 {
1012 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1013 u.wsz, uMte2.v32.BaseDllName.Length);
1014 u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1015 if ( RT_SUCCESS(rc)
1016 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1017 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1018 )
1019 )
1020 {
1021 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
1022 DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
1023 &uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1024 if ( RT_SUCCESS(rc)
1025 && uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1026 && WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1027 {
1028 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1029 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1030 pThis->KernelAddr = KernelAddr;
1031 pThis->KernelMteAddr = MteAddr;
1032 pThis->PsLoadedModuleListAddr = Addr;
1033 pThis->f32Bit = true;
1034 return true;
1035 }
1036 }
1037 else if (RT_SUCCESS(rc))
1038 {
1039 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1040 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1041 break; /* Not NT kernel */
1042 }
1043 }
1044
1045 /* next */
1046 DBGFR3AddrAdd(&HitAddr, 4);
1047 if (HitAddr.FlatPtr < uEnd)
1048 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1049 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1050 else
1051 rc = VERR_DBGF_MEM_NOT_FOUND;
1052 }
1053 }
1054 }
1055 else
1056 {
1057 IMAGE_NT_HEADERS64 const *pHdrs = (IMAGE_NT_HEADERS64 const *)&u.au8[u.MzHdr.e_lfanew];
1058 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1059 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1060 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1061 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1062 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL))
1063 == IMAGE_FILE_EXECUTABLE_IMAGE
1064 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1065 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1066 )
1067 {
1068 /* Find the MTE. */
1069 RT_ZERO(uMte.v64);
1070 uMte.v64.DllBase = KernelAddr.FlatPtr;
1071 uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1072 uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1073 DBGFADDRESS ScanAddr;
1074 DBGFADDRESS HitAddr;
1075 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1076 uEnd - uStart, 8 /*align*/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1077 while (RT_SUCCESS(rc))
1078 {
1079 /* Read the start of the MTE and check some basic members. */
1080 DBGFADDRESS MteAddr = HitAddr;
1081 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1082 &uMte2.v64, sizeof(uMte2.v64));
1083 if ( RT_SUCCESS(rc)
1084 && uMte2.v64.DllBase == uMte.v64.DllBase
1085 && uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1086 && uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1087 && WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1088 && WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1089 && WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1090 && uMte2.v64.BaseDllName.Length <= 128
1091 && uMte2.v64.FullDllName.Length <= 260
1092 )
1093 {
1094 /* Try read the base name and compare with known NT kernel names. */
1095 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1096 u.wsz, uMte2.v64.BaseDllName.Length);
1097 u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1098 if ( RT_SUCCESS(rc)
1099 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1100 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1101 )
1102 )
1103 {
1104 /* Read the link entry of the previous entry in the list and check that its
1105 forward pointer points at the MTE we've found. */
1106 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
1107 DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1108 &uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1109 if ( RT_SUCCESS(rc)
1110 && uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1111 && WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1112 {
1113 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1114 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1115 pThis->KernelAddr = KernelAddr;
1116 pThis->KernelMteAddr = MteAddr;
1117 pThis->PsLoadedModuleListAddr = Addr;
1118 pThis->f32Bit = false;
1119 return true;
1120 }
1121 }
1122 else if (RT_SUCCESS(rc))
1123 {
1124 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1125 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1126 break; /* Not NT kernel */
1127 }
1128 }
1129
1130 /* next */
1131 DBGFR3AddrAdd(&HitAddr, 8);
1132 if (HitAddr.FlatPtr < uEnd)
1133 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1134 8 /*align*/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1135 else
1136 rc = VERR_DBGF_MEM_NOT_FOUND;
1137 }
1138 }
1139 }
1140 }
1141 }
1142 return false;
1143}
1144
1145
1146/**
1147 * @copydoc DBGFOSREG::pfnDestruct
1148 */
1149static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1150{
1151 RT_NOREF2(pUVM, pvData);
1152}
1153
1154
1155/**
1156 * @copydoc DBGFOSREG::pfnConstruct
1157 */
1158static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1159{
1160 RT_NOREF1(pUVM);
1161 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1162 pThis->fValid = false;
1163 pThis->f32Bit = false;
1164 pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1165 return VINF_SUCCESS;
1166}
1167
1168
1169const DBGFOSREG g_DBGDiggerWinNt =
1170{
1171 /* .u32Magic = */ DBGFOSREG_MAGIC,
1172 /* .fFlags = */ 0,
1173 /* .cbData = */ sizeof(DBGDIGGERWINNT),
1174 /* .szName = */ "WinNT",
1175 /* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1176 /* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1177 /* .pfnProbe = */ dbgDiggerWinNtProbe,
1178 /* .pfnInit = */ dbgDiggerWinNtInit,
1179 /* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1180 /* .pfnTerm = */ dbgDiggerWinNtTerm,
1181 /* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1182 /* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1183 /* .u32EndMagic = */ DBGFOSREG_MAGIC
1184};
1185
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use