VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 70772

Last change on this file since 70772 was 70338, checked in by vboxsync, 6 years ago

DBGPlugInWinNt.cpp: Detect NT 3.1. NTMTE32.SizeOfImage is used differently, VirtualSize absent, no KUSER_SHARED_DATA. Not perfect yet.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 50.7 KB
Line 
1/* $Id: DBGPlugInWinNt.cpp 70338 2017-12-25 17:38:40Z vboxsync $ */
2/** @file
3 * DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4 */
5
6/*
7 * Copyright (C) 2009-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23#include "DBGPlugIns.h"
24#include <VBox/vmm/dbgf.h>
25#include <VBox/err.h>
26#include <VBox/param.h>
27#include <iprt/ldr.h>
28#include <iprt/mem.h>
29#include <iprt/stream.h>
30#include <iprt/string.h>
31#include <iprt/formats/pecoff.h>
32#include <iprt/formats/mz.h>
33
34
35/*********************************************************************************************************************************
36* Structures and Typedefs *
37*********************************************************************************************************************************/
38
39/** @name Internal WinNT structures
40 * @{ */
41/**
42 * PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
43 * Tested with XP.
44 */
45typedef struct NTMTE32
46{
47 struct
48 {
49 uint32_t Flink;
50 uint32_t Blink;
51 } InLoadOrderLinks,
52 InMemoryOrderModuleList,
53 InInitializationOrderModuleList;
54 uint32_t DllBase;
55 uint32_t EntryPoint;
56 /** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
57 * boot loader, for other images it looks like some kind of pointer. */
58 uint32_t SizeOfImage;
59 struct
60 {
61 uint16_t Length;
62 uint16_t MaximumLength;
63 uint32_t Buffer;
64 } FullDllName,
65 BaseDllName;
66 uint32_t Flags;
67 uint16_t LoadCount;
68 uint16_t TlsIndex;
69 /* ... there is more ... */
70} NTMTE32;
71typedef NTMTE32 *PNTMTE32;
72
73/**
74 * PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
75 */
76typedef struct NTMTE64
77{
78 struct
79 {
80 uint64_t Flink;
81 uint64_t Blink;
82 } InLoadOrderLinks, /**< 0x00 */
83 InMemoryOrderModuleList, /**< 0x10 */
84 InInitializationOrderModuleList; /**< 0x20 */
85 uint64_t DllBase; /**< 0x30 */
86 uint64_t EntryPoint; /**< 0x38 */
87 uint32_t SizeOfImage; /**< 0x40 */
88 uint32_t Alignment; /**< 0x44 */
89 struct
90 {
91 uint16_t Length; /**< 0x48,0x58 */
92 uint16_t MaximumLength; /**< 0x4a,0x5a */
93 uint32_t Alignment; /**< 0x4c,0x5c */
94 uint64_t Buffer; /**< 0x50,0x60 */
95 } FullDllName, /**< 0x48 */
96 BaseDllName; /**< 0x58 */
97 uint32_t Flags; /**< 0x68 */
98 uint16_t LoadCount; /**< 0x6c */
99 uint16_t TlsIndex; /**< 0x6e */
100 /* ... there is more ... */
101} NTMTE64;
102typedef NTMTE64 *PNTMTE64;
103
104/** MTE union. */
105typedef union NTMTE
106{
107 NTMTE32 vX_32;
108 NTMTE64 vX_64;
109} NTMTE;
110typedef NTMTE *PNTMTE;
111
112
113/**
114 * The essential bits of the KUSER_SHARED_DATA structure.
115 */
116typedef struct NTKUSERSHAREDDATA
117{
118 uint32_t TickCountLowDeprecated;
119 uint32_t TickCountMultiplier;
120 struct
121 {
122 uint32_t LowPart;
123 int32_t High1Time;
124 int32_t High2Time;
125
126 } InterruptTime,
127 SystemTime,
128 TimeZoneBias;
129 uint16_t ImageNumberLow;
130 uint16_t ImageNumberHigh;
131 RTUTF16 NtSystemRoot[260];
132 uint32_t MaxStackTraceDepth;
133 uint32_t CryptoExponent;
134 uint32_t TimeZoneId;
135 uint32_t LargePageMinimum;
136 uint32_t Reserved2[7];
137 uint32_t NtProductType;
138 uint8_t ProductTypeIsValid;
139 uint8_t abPadding[3];
140 uint32_t NtMajorVersion;
141 uint32_t NtMinorVersion;
142 /* uint8_t ProcessorFeatures[64];
143 ...
144 */
145} NTKUSERSHAREDDATA;
146typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
147
148/** KI_USER_SHARED_DATA for i386 */
149#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
150/** KI_USER_SHARED_DATA for AMD64 */
151#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
152
153/** NTKUSERSHAREDDATA::NtProductType */
154typedef enum NTPRODUCTTYPE
155{
156 kNtProductType_Invalid = 0,
157 kNtProductType_WinNt = 1,
158 kNtProductType_LanManNt,
159 kNtProductType_Server
160} NTPRODUCTTYPE;
161
162
163/** NT image header union. */
164typedef union NTHDRSU
165{
166 IMAGE_NT_HEADERS32 vX_32;
167 IMAGE_NT_HEADERS64 vX_64;
168} NTHDRS;
169/** Pointer to NT image header union. */
170typedef NTHDRS *PNTHDRS;
171/** Pointer to const NT image header union. */
172typedef NTHDRS const *PCNTHDRS;
173
174/** @} */
175
176
177
178typedef enum DBGDIGGERWINNTVER
179{
180 DBGDIGGERWINNTVER_UNKNOWN,
181 DBGDIGGERWINNTVER_3_1,
182 DBGDIGGERWINNTVER_3_5,
183 DBGDIGGERWINNTVER_4_0,
184 DBGDIGGERWINNTVER_5_0,
185 DBGDIGGERWINNTVER_5_1,
186 DBGDIGGERWINNTVER_6_0
187} DBGDIGGERWINNTVER;
188
189/**
190 * WinNT guest OS digger instance data.
191 */
192typedef struct DBGDIGGERWINNT
193{
194 /** Whether the information is valid or not.
195 * (For fending off illegal interface method calls.) */
196 bool fValid;
197 /** 32-bit (true) or 64-bit (false) */
198 bool f32Bit;
199 /** Set if NT 3.1 was detected.
200 * This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
201 bool fNt31;
202
203 /** The NT version. */
204 DBGDIGGERWINNTVER enmVer;
205 /** NTKUSERSHAREDDATA::NtProductType */
206 NTPRODUCTTYPE NtProductType;
207 /** NTKUSERSHAREDDATA::NtMajorVersion */
208 uint32_t NtMajorVersion;
209 /** NTKUSERSHAREDDATA::NtMinorVersion */
210 uint32_t NtMinorVersion;
211
212 /** The address of the ntoskrnl.exe image. */
213 DBGFADDRESS KernelAddr;
214 /** The address of the ntoskrnl.exe module table entry. */
215 DBGFADDRESS KernelMteAddr;
216 /** The address of PsLoadedModuleList. */
217 DBGFADDRESS PsLoadedModuleListAddr;
218} DBGDIGGERWINNT;
219/** Pointer to the linux guest OS digger instance data. */
220typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
221
222
223/**
224 * The WinNT digger's loader reader instance data.
225 */
226typedef struct DBGDIGGERWINNTRDR
227{
228 /** The VM handle (referenced). */
229 PUVM pUVM;
230 /** The image base. */
231 DBGFADDRESS ImageAddr;
232 /** The image size. */
233 uint32_t cbImage;
234 /** The file offset of the SizeOfImage field in the optional header if it
235 * needs patching, otherwise set to UINT32_MAX. */
236 uint32_t offSizeOfImage;
237 /** The correct image size. */
238 uint32_t cbCorrectImageSize;
239 /** Number of entries in the aMappings table. */
240 uint32_t cMappings;
241 /** Mapping hint. */
242 uint32_t iHint;
243 /** Mapping file offset to memory offsets, ordered by file offset. */
244 struct
245 {
246 /** The file offset. */
247 uint32_t offFile;
248 /** The size of this mapping. */
249 uint32_t cbMem;
250 /** The offset to the memory from the start of the image. */
251 uint32_t offMem;
252 } aMappings[1];
253} DBGDIGGERWINNTRDR;
254/** Pointer a WinNT loader reader instance data. */
255typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
256
257
258/*********************************************************************************************************************************
259* Defined Constants And Macros *
260*********************************************************************************************************************************/
261/** Validates a 32-bit Windows NT kernel address */
262#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
263/** Validates a 64-bit Windows NT kernel address */
264 #define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
265/** Validates a kernel address. */
266#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
267/** Versioned and bitness wrapper. */
268#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
269
270/** The length (in chars) of the kernel file name (no path). */
271#define WINNT_KERNEL_BASE_NAME_LEN 12
272
273/** WindowsNT on little endian ASCII systems. */
274#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
275
276
277/*********************************************************************************************************************************
278* Internal Functions *
279*********************************************************************************************************************************/
280static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
281
282
283/*********************************************************************************************************************************
284* Global Variables *
285*********************************************************************************************************************************/
286/** Kernel names. */
287static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
288{
289 { 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
290};
291
292
293
294/** @callback_method_impl{PFNRTLDRRDRMEMREAD} */
295static DECLCALLBACK(int) dbgDiggerWinNtRdr_Read(void *pvBuf, size_t cb, size_t off, void *pvUser)
296{
297 PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
298 uint32_t offFile = (uint32_t)off;
299 AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
300
301 uint32_t i = pThis->iHint;
302 if (pThis->aMappings[i].offFile > offFile)
303 {
304 i = pThis->cMappings;
305 while (i-- > 0)
306 if (offFile >= pThis->aMappings[i].offFile)
307 break;
308 pThis->iHint = i;
309 }
310
311 while (cb > 0)
312 {
313 uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
314 uint32_t offMap = offFile - pThis->aMappings[i].offFile;
315
316 /* Read file bits backed by memory. */
317 if (offMap < pThis->aMappings[i].cbMem)
318 {
319 uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
320 if (cbToRead > cb)
321 cbToRead = (uint32_t)cb;
322
323 DBGFADDRESS Addr = pThis->ImageAddr;
324 DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
325
326 int rc = DBGFR3MemRead(pThis->pUVM, 0 /*idCpu*/, &Addr, pvBuf, cbToRead);
327 if (RT_FAILURE(rc))
328 return rc;
329
330 /* Apply SizeOfImage patch? */
331 if ( pThis->offSizeOfImage != UINT32_MAX
332 && offFile < pThis->offSizeOfImage + 4
333 && offFile + cbToRead > pThis->offSizeOfImage)
334 {
335 uint32_t SizeOfImage = pThis->cbCorrectImageSize;
336 uint32_t cbPatch = sizeof(SizeOfImage);
337 int32_t offPatch = pThis->offSizeOfImage - offFile;
338 uint8_t *pbPatch = (uint8_t *)pvBuf + offPatch;
339 if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
340 cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
341 while (cbPatch-- > 0)
342 {
343 if (offPatch >= 0)
344 *pbPatch = (uint8_t)SizeOfImage;
345 offPatch++;
346 pbPatch++;
347 SizeOfImage >>= 8;
348 }
349 }
350
351 /* Done? */
352 if (cbToRead == cb)
353 break;
354
355 offFile += cbToRead;
356 cb -= cbToRead;
357 pvBuf = (char *)pvBuf + cbToRead;
358 }
359
360 /* Mind the gap. */
361 if (offNextMap > offFile)
362 {
363 uint32_t cbZero = offNextMap - offFile;
364 if (cbZero > cb)
365 {
366 RT_BZERO(pvBuf, cb);
367 break;
368 }
369
370 RT_BZERO(pvBuf, cbZero);
371 offFile += cbZero;
372 cb -= cbZero;
373 pvBuf = (char *)pvBuf + cbZero;
374 }
375
376 pThis->iHint = ++i;
377 }
378
379 return VINF_SUCCESS;
380}
381
382
383/** @callback_method_impl{PFNRTLDRRDRMEMDTOR} */
384static DECLCALLBACK(void) dbgDiggerWinNtRdr_Dtor(void *pvUser)
385{
386 PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
387
388 VMR3ReleaseUVM(pThis->pUVM);
389 pThis->pUVM = NULL;
390 RTMemFree(pvUser);
391}
392
393
394/**
395 * Checks if the section headers look okay.
396 *
397 * @returns true / false.
398 * @param paShs Pointer to the section headers.
399 * @param cShs Number of headers.
400 * @param cbImage The image size reported by NT.
401 * @param cbImageFromHdr The image size by the linker in the header.
402 * @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
403 * no resource directory.
404 * @param cbSectAlign The section alignment specified in the header.
405 * @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
406 * @param pcbImageCorrect The corrected image size. This is derived from
407 * cbImage and virtual range of the section tables.
408 *
409 * The problem is that NT may choose to drop the
410 * last pages in images it loads early, starting at
411 * the resource directory. These images will have
412 * a page aligned cbImage.
413 */
414static bool dbgDiggerWinNtCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShs, uint32_t cShs, uint32_t cbImage,
415 uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
416 bool fNt31, uint32_t *pcbImageCorrect)
417{
418 *pcbImageCorrect = cbImage;
419
420 for (uint32_t i = 0; i < cShs; i++)
421 {
422 if (!paShs[i].Name[0])
423 {
424 Log(("DigWinNt: Section header #%u has no name\n", i));
425 return false;
426 }
427
428 if (paShs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
429 continue;
430
431 /* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
432 /** @todo this isn't really perfect. cbImage is kind of wrong... */
433 uint32_t cbVirtual = paShs[i].Misc.VirtualSize;
434 if (cbVirtual == 0)
435 {
436 for (uint32_t j = i + 1; j < cShs; j++)
437 if (!(paShs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
438 && paShs[j].VirtualAddress > paShs[i].VirtualAddress)
439 {
440 cbVirtual = paShs[j].VirtualAddress - paShs[i].VirtualAddress;
441 break;
442 }
443 if (!cbVirtual)
444 {
445 if (paShs[i].VirtualAddress < cbImageFromHdr)
446 cbVirtual = cbImageFromHdr - paShs[i].VirtualAddress;
447 else if (paShs[i].SizeOfRawData > 0)
448 cbVirtual = RT_ALIGN(paShs[i].SizeOfRawData, _4K);
449 }
450 }
451
452 /* Check that sizes are within the same range and that both sizes and
453 addresses are within reasonable limits. */
454 if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShs[i].SizeOfRawData, _64K)
455 || cbVirtual >= _1G
456 || paShs[i].SizeOfRawData >= _1G)
457 {
458 Log(("DigWinNt: Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!\n",
459 i, paShs[i].Name, cbVirtual, paShs[i].Misc.VirtualSize, paShs[i].SizeOfRawData));
460 return false;
461 }
462 uint32_t uRvaEnd = paShs[i].VirtualAddress + cbVirtual;
463 if (uRvaEnd >= _1G || uRvaEnd < paShs[i].VirtualAddress)
464 {
465 Log(("DigWinNt: Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!\n",
466 i, paShs[i].Name, cbVirtual, paShs[i].Misc.VirtualSize, paShs[i].VirtualAddress, uRvaEnd));
467 return false;
468 }
469
470 /* Check for images chopped off around '.rsrc'. */
471 if ( cbImage < uRvaEnd
472 && uRvaEnd >= uRvaRsrc)
473 cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
474
475 /* Check that the section is within the image. */
476 if (uRvaEnd > cbImage && fNt31)
477 {
478 Log(("DigWinNt: Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x\n",
479 i, paShs[i].VirtualAddress, uRvaEnd, cbImage));
480 return false;
481 }
482 }
483
484 Assert(*pcbImageCorrect == cbImage || !(*pcbImageCorrect & 0xfff));
485 *pcbImageCorrect = cbImage;
486 return true;
487}
488
489
490/**
491 * Create a loader module for the in-guest-memory PE module.
492 */
493static int dbgDiggerWinNtCreateLdrMod(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName, PCDBGFADDRESS pImageAddr,
494 uint32_t cbImage, uint8_t *pbBuf, size_t cbBuf,
495 uint32_t offHdrs, PCNTHDRS pHdrs, PRTLDRMOD phLdrMod)
496{
497 /*
498 * Allocate and create a reader instance.
499 */
500 uint32_t const cShs = WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections);
501 PDBGDIGGERWINNTRDR pRdr = (PDBGDIGGERWINNTRDR)RTMemAlloc(RT_OFFSETOF(DBGDIGGERWINNTRDR, aMappings[cShs + 2]));
502 if (!pRdr)
503 return VERR_NO_MEMORY;
504
505 VMR3RetainUVM(pUVM);
506 pRdr->pUVM = pUVM;
507 pRdr->ImageAddr = *pImageAddr;
508 pRdr->cbImage = cbImage;
509 pRdr->cbCorrectImageSize = cbImage;
510 pRdr->offSizeOfImage = UINT32_MAX;
511 pRdr->iHint = 0;
512
513 /*
514 * Use the section table to construct a more accurate view of the file/
515 * image if it's in the buffer (it should be).
516 */
517 uint32_t uRvaRsrc = UINT32_MAX;
518 if (WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).Size > 0)
519 uRvaRsrc = WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress;
520 uint32_t offShs = offHdrs
521 + ( pThis->f32Bit
522 ? pHdrs->vX_32.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
523 : pHdrs->vX_64.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader));
524 uint32_t cbShs = cShs * sizeof(IMAGE_SECTION_HEADER);
525 PCIMAGE_SECTION_HEADER paShs = (PCIMAGE_SECTION_HEADER)(pbBuf + offShs);
526 if ( offShs + cbShs <= RT_MIN(cbImage, cbBuf)
527 && dbgDiggerWinNtCheckSectHdrsAndImgSize(paShs, cShs, cbImage, WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage),
528 uRvaRsrc, WINNT_UNION(pThis, pHdrs, OptionalHeader.SectionAlignment),
529 pThis->fNt31, &pRdr->cbCorrectImageSize))
530 {
531 pRdr->cMappings = 0;
532
533 for (uint32_t i = 0; i < cShs; i++)
534 if ( paShs[i].SizeOfRawData > 0
535 && paShs[i].PointerToRawData > 0)
536 {
537 uint32_t j = 1;
538 if (!pRdr->cMappings)
539 pRdr->cMappings++;
540 else
541 {
542 while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShs[i].PointerToRawData)
543 j++;
544 if (j < pRdr->cMappings)
545 memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
546 }
547 pRdr->aMappings[j].offFile = paShs[i].PointerToRawData;
548 pRdr->aMappings[j].offMem = paShs[i].VirtualAddress;
549 pRdr->aMappings[j].cbMem = i + 1 < cShs
550 ? paShs[i + 1].VirtualAddress - paShs[i].VirtualAddress
551 : paShs[i].Misc.VirtualSize;
552 if (j == pRdr->cMappings)
553 pRdr->cbImage = paShs[i].PointerToRawData + paShs[i].SizeOfRawData;
554 pRdr->cMappings++;
555 }
556
557 /* Insert the mapping of the headers that isn't covered by the section table. */
558 pRdr->aMappings[0].offFile = 0;
559 pRdr->aMappings[0].offMem = 0;
560 pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
561
562 int j = pRdr->cMappings - 1;
563 while (j-- > 0)
564 {
565 uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
566 if (pRdr->aMappings[j].cbMem > cbFile)
567 pRdr->aMappings[j].cbMem = cbFile;
568 }
569 }
570 else
571 {
572 /*
573 * Fallback, fake identity mapped file data.
574 */
575 pRdr->cMappings = 1;
576 pRdr->aMappings[0].offFile = 0;
577 pRdr->aMappings[0].offMem = 0;
578 pRdr->aMappings[0].cbMem = pRdr->cbImage;
579 }
580
581 /* Enable the SizeOfImage patching if necessary. */
582 if (pRdr->cbCorrectImageSize != cbImage)
583 {
584 Log(("DigWinNT: The image is really %#x bytes long, not %#x as mapped by NT!\n", pRdr->cbCorrectImageSize, cbImage));
585 pRdr->offSizeOfImage = pThis->f32Bit
586 ? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
587 : offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
588 }
589
590 /*
591 * Call the loader to open the PE image for debugging.
592 * Note! It always calls pfnDtor.
593 */
594 RTLDRMOD hLdrMod;
595 int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
596 dbgDiggerWinNtRdr_Read, dbgDiggerWinNtRdr_Dtor, pRdr,
597 &hLdrMod);
598 if (RT_SUCCESS(rc))
599 *phLdrMod = hLdrMod;
600 else
601 *phLdrMod = NIL_RTLDRMOD;
602 return rc;
603}
604
605
606/**
607 * Process a PE image found in guest memory.
608 *
609 * @param pThis The instance data.
610 * @param pUVM The user mode VM handle.
611 * @param pszName The image name.
612 * @param pImageAddr The image address.
613 * @param cbImage The size of the image.
614 * @param pbBuf Scratch buffer containing the first
615 * RT_MIN(cbBuf, cbImage) bytes of the image.
616 * @param cbBuf The scratch buffer size.
617 */
618static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
619 PCDBGFADDRESS pImageAddr, uint32_t cbImage,
620 uint8_t *pbBuf, size_t cbBuf)
621{
622 LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
623
624 /*
625 * NT 3.1 doesn't set the image size in the MTEs, so a little
626 * bit of tweaking is necessary here.
627 */
628 uint32_t const cbImageValidate = !pThis->fNt31 ? cbImage : _64M;
629
630 /*
631 * Do some basic validation first.
632 * This is the usual exteremely verbose and messy code...
633 */
634 Assert(cbBuf >= sizeof(IMAGE_NT_HEADERS64));
635 if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
636 || cbImage >= _1M * 256)
637 {
638 Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
639 return;
640 }
641
642 /* Dig out the NT/PE headers. */
643 IMAGE_DOS_HEADER const *pMzHdr = (IMAGE_DOS_HEADER const *)pbBuf;
644 PCNTHDRS pHdrs;
645 uint32_t offHdrs;
646 if (pMzHdr->e_magic != IMAGE_DOS_SIGNATURE)
647 {
648 offHdrs = 0;
649 pHdrs = (PCNTHDRS)pbBuf;
650 }
651 else if ( pMzHdr->e_lfanew >= cbImageValidate
652 || pMzHdr->e_lfanew < sizeof(*pMzHdr)
653 || pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) > cbImageValidate)
654 {
655 Log(("DigWinNt: %s: PE header to far into image: %#x cbImage=%#x\n", pszName, pMzHdr->e_lfanew, cbImage));
656 return;
657 }
658 else if ( pMzHdr->e_lfanew < cbBuf
659 && pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) <= cbBuf)
660 {
661 offHdrs = pMzHdr->e_lfanew;
662 pHdrs = (NTHDRS const *)(pbBuf + offHdrs);
663 }
664 else
665 {
666 Log(("DigWinNt: %s: PE header to far into image (lazy bird): %#x\n", pszName, pMzHdr->e_lfanew));
667 return;
668 }
669 if (pHdrs->vX_32.Signature != IMAGE_NT_SIGNATURE)
670 {
671 Log(("DigWinNt: %s: Bad PE signature: %#x\n", pszName, pHdrs->vX_32.Signature));
672 return;
673 }
674
675 /* The file header is the same on both archs */
676 if (pHdrs->vX_32.FileHeader.Machine != (pThis->f32Bit ? IMAGE_FILE_MACHINE_I386 : IMAGE_FILE_MACHINE_AMD64))
677 {
678 Log(("DigWinNt: %s: Invalid FH.Machine: %#x\n", pszName, pHdrs->vX_32.FileHeader.Machine));
679 return;
680 }
681 if (pHdrs->vX_32.FileHeader.SizeOfOptionalHeader != (pThis->f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
682 {
683 Log(("DigWinNt: %s: Invalid FH.SizeOfOptionalHeader: %#x\n", pszName, pHdrs->vX_32.FileHeader.SizeOfOptionalHeader));
684 return;
685 }
686 if (WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections) > 64)
687 {
688 Log(("DigWinNt: %s: Too many sections: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections)));
689 return;
690 }
691
692 const uint32_t TimeDateStamp = pHdrs->vX_32.FileHeader.TimeDateStamp;
693
694 /* The optional header is not... */
695 if (WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic) != (pThis->f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
696 {
697 Log(("DigWinNt: %s: Invalid OH.Magic: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic)));
698 return;
699 }
700 uint32_t cbImageFromHdr = WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage);
701 if (pThis->fNt31)
702 cbImage = RT_ALIGN(cbImageFromHdr, _4K);
703 else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
704 {
705 Log(("DigWinNt: %s: Invalid OH.SizeOfImage: %#x, expected %#x\n", pszName, cbImageFromHdr, cbImage));
706 return;
707 }
708 if (WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes) != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
709 {
710 Log(("DigWinNt: %s: Invalid OH.NumberOfRvaAndSizes: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes)));
711 return;
712 }
713
714 /*
715 * Create the module using the in memory image first, falling back
716 * on cached image.
717 */
718 RTLDRMOD hLdrMod;
719 int rc = dbgDiggerWinNtCreateLdrMod(pThis, pUVM, pszName, pImageAddr, cbImage, pbBuf, cbBuf, offHdrs, pHdrs,
720 &hLdrMod);
721 if (RT_FAILURE(rc))
722 hLdrMod = NIL_RTLDRMOD;
723
724 RTDBGMOD hMod;
725 rc = RTDbgModCreateFromPeImage(&hMod, pszName, NULL, hLdrMod,
726 cbImageFromHdr, TimeDateStamp, DBGFR3AsGetConfig(pUVM));
727 if (RT_FAILURE(rc))
728 {
729 /*
730 * Final fallback is a container module.
731 */
732 rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
733 if (RT_FAILURE(rc))
734 return;
735
736 rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /*iSeg*/, 0, cbImage, 0 /*fFlags*/, NULL);
737 AssertRC(rc);
738 }
739
740 /* Tag the module. */
741 rc = RTDbgModSetTag(hMod, DIG_WINNT_MOD_TAG);
742 AssertRC(rc);
743
744 /*
745 * Link the module.
746 */
747 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
748 if (hAs != NIL_RTDBGAS)
749 rc = RTDbgAsModuleLink(hAs, hMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
750 else
751 rc = VERR_INTERNAL_ERROR;
752 RTDbgModRelease(hMod);
753 RTDbgAsRelease(hAs);
754}
755
756
757/**
758 * @copydoc DBGFOSREG::pfnQueryInterface
759 */
760static DECLCALLBACK(void *) dbgDiggerWinNtQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
761{
762 RT_NOREF3(pUVM, pvData, enmIf);
763 return NULL;
764}
765
766
767/**
768 * @copydoc DBGFOSREG::pfnQueryVersion
769 */
770static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void *pvData, char *pszVersion, size_t cchVersion)
771{
772 RT_NOREF1(pUVM);
773 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
774 Assert(pThis->fValid);
775 const char *pszNtProductType;
776 switch (pThis->NtProductType)
777 {
778 case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
779 case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
780 case kNtProductType_Server: pszNtProductType = "-Server"; break;
781 default: pszNtProductType = ""; break;
782 }
783 RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
784 pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
785 return VINF_SUCCESS;
786}
787
788
789/**
790 * @copydoc DBGFOSREG::pfnTerm
791 */
792static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
793{
794 RT_NOREF1(pUVM);
795 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
796 Assert(pThis->fValid);
797
798 pThis->fValid = false;
799}
800
801
802/**
803 * @copydoc DBGFOSREG::pfnRefresh
804 */
805static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
806{
807 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
808 NOREF(pThis);
809 Assert(pThis->fValid);
810
811 /*
812 * For now we'll flush and reload everything.
813 */
814 RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
815 if (hDbgAs != NIL_RTDBGAS)
816 {
817 uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
818 while (iMod-- > 0)
819 {
820 RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
821 if (hMod != NIL_RTDBGMOD)
822 {
823 if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
824 {
825 int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
826 AssertRC(rc);
827 }
828 RTDbgModRelease(hMod);
829 }
830 }
831 RTDbgAsRelease(hDbgAs);
832 }
833
834 dbgDiggerWinNtTerm(pUVM, pvData);
835 return dbgDiggerWinNtInit(pUVM, pvData);
836}
837
838
839/**
840 * @copydoc DBGFOSREG::pfnInit
841 */
842static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
843{
844 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
845 Assert(!pThis->fValid);
846
847 union
848 {
849 uint8_t au8[0x2000];
850 RTUTF16 wsz[0x2000/2];
851 NTKUSERSHAREDDATA UserSharedData;
852 } u;
853 DBGFADDRESS Addr;
854 int rc;
855
856 /*
857 * Figure the NT version.
858 */
859 DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
860 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &u, PAGE_SIZE);
861 if (RT_SUCCESS(rc))
862 {
863 pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
864 ? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
865 : kNtProductType_Invalid;
866 pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
867 pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
868 }
869 else if (pThis->fNt31)
870 {
871 pThis->NtProductType = kNtProductType_WinNt;
872 pThis->NtMajorVersion = 3;
873 pThis->NtMinorVersion = 1;
874 }
875 else
876 {
877 Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
878 return rc;
879 }
880
881 /*
882 * Dig out the module chain.
883 */
884 DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
885 Addr = pThis->KernelMteAddr;
886 do
887 {
888 /* Read the validate the MTE. */
889 NTMTE Mte;
890 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
891 if (RT_FAILURE(rc))
892 break;
893 if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
894 {
895 Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
896 break;
897 }
898 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
899 {
900 Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
901 break;
902 }
903 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
904 {
905 Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
906 break;
907 }
908 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
909 {
910 Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
911 break;
912 }
913 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
914 {
915 Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
916 break;
917 }
918
919 uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
920 if ( !pThis->fNt31
921 && ( cbImageMte > _256M
922 || WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
923 {
924 Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
925 Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
926 break;
927 }
928
929 /* Read the full name. */
930 DBGFADDRESS AddrName;
931 DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
932 uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
933 if (cbName < sizeof(u))
934 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
935 else
936 rc = VERR_OUT_OF_RANGE;
937 if (RT_FAILURE(rc))
938 {
939 DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
940 cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
941 if (cbName < sizeof(u))
942 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
943 else
944 rc = VERR_OUT_OF_RANGE;
945 }
946 if (RT_SUCCESS(rc))
947 {
948 u.wsz[cbName/2] = '\0';
949 char *pszName;
950 rc = RTUtf16ToUtf8(u.wsz, &pszName);
951 if (RT_SUCCESS(rc))
952 {
953 /* Read the start of the PE image and pass it along to a worker. */
954 DBGFADDRESS ImageAddr;
955 DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
956 uint32_t cbImageBuf = RT_MIN(sizeof(u), RT_MAX(cbImageMte, _4K));
957 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &ImageAddr, &u, cbImageBuf);
958 if (RT_SUCCESS(rc))
959 dbgDiggerWinNtProcessImage(pThis,
960 pUVM,
961 pszName,
962 &ImageAddr,
963 cbImageMte,
964 &u.au8[0],
965 sizeof(u));
966 RTStrFree(pszName);
967 }
968 }
969
970 /* next */
971 AddrPrev = Addr;
972 DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
973 } while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
974 && Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
975
976 pThis->fValid = true;
977 return VINF_SUCCESS;
978}
979
980
981/**
982 * @copydoc DBGFOSREG::pfnProbe
983 */
984static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
985{
986 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
987 DBGFADDRESS Addr;
988 union
989 {
990 uint8_t au8[8192];
991 uint16_t au16[8192/2];
992 uint32_t au32[8192/4];
993 IMAGE_DOS_HEADER MzHdr;
994 RTUTF16 wsz[8192/2];
995 } u;
996
997 union
998 {
999 NTMTE32 v32;
1000 NTMTE64 v64;
1001 } uMte, uMte2, uMte3;
1002
1003 /*
1004 * Look for the PAGELK section name that seems to be a part of all kernels.
1005 * Then try find the module table entry for it. Since it's the first entry
1006 * in the PsLoadedModuleList we can easily validate the list head and report
1007 * success.
1008 *
1009 * Note! We ASSUME the section name is 8 byte aligned.
1010 */
1011 CPUMMODE enmMode = DBGFR3CpuGetMode(pUVM, 0 /*idCpu*/);
1012 uint64_t const uStart = enmMode == CPUMMODE_LONG ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
1013 uint64_t const uEnd = enmMode == CPUMMODE_LONG ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
1014 DBGFADDRESS KernelAddr;
1015 for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uStart);
1016 KernelAddr.FlatPtr < uEnd;
1017 KernelAddr.FlatPtr += PAGE_SIZE)
1018 {
1019 bool fNt31 = false;
1020 DBGFADDRESS const RetryAddress = KernelAddr;
1021 int rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1022 8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
1023 if ( rc == VERR_DBGF_MEM_NOT_FOUND
1024 && enmMode != CPUMMODE_LONG)
1025 {
1026 /* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
1027 following VirtualSize is zero, so check for that too. */
1028 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
1029 8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
1030 fNt31 = true;
1031 }
1032 if (RT_FAILURE(rc))
1033 break;
1034 DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
1035
1036 /* MZ + PE header. */
1037 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &KernelAddr, &u, sizeof(u));
1038 if ( RT_SUCCESS(rc)
1039 && u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
1040 && !(u.MzHdr.e_lfanew & 0x7)
1041 && u.MzHdr.e_lfanew >= 0x080
1042 && u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
1043 {
1044 if (enmMode != CPUMMODE_LONG)
1045 {
1046 IMAGE_NT_HEADERS32 const *pHdrs = (IMAGE_NT_HEADERS32 const *)&u.au8[u.MzHdr.e_lfanew];
1047 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1048 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
1049 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1050 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1051 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
1052 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
1053 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1054 )
1055 {
1056 /* Find the MTE. */
1057 RT_ZERO(uMte);
1058 uMte.v32.DllBase = KernelAddr.FlatPtr;
1059 uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1060 uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
1061 DBGFADDRESS HitAddr;
1062 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1063 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1064 while (RT_SUCCESS(rc))
1065 {
1066 /* check the name. */
1067 DBGFADDRESS MteAddr = HitAddr;
1068 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
1069 &uMte2.v32, sizeof(uMte2.v32));
1070 if ( RT_SUCCESS(rc)
1071 && uMte2.v32.DllBase == uMte.v32.DllBase
1072 && uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1073 && uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1074 && WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1075 && WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1076 && WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1077 && uMte2.v32.BaseDllName.Length <= 128
1078 && uMte2.v32.FullDllName.Length <= 260
1079 )
1080 {
1081 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1082 u.wsz, uMte2.v32.BaseDllName.Length);
1083 u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1084 if ( RT_SUCCESS(rc)
1085 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1086 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1087 )
1088 )
1089 {
1090 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
1091 DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
1092 &uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1093 if ( RT_SUCCESS(rc)
1094 && uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1095 && WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1096 {
1097 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1098 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1099 pThis->KernelAddr = KernelAddr;
1100 pThis->KernelMteAddr = MteAddr;
1101 pThis->PsLoadedModuleListAddr = Addr;
1102 pThis->f32Bit = true;
1103 pThis->fNt31 = fNt31;
1104 return true;
1105 }
1106 }
1107 else if (RT_SUCCESS(rc))
1108 {
1109 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1110 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1111 break; /* Not NT kernel */
1112 }
1113 }
1114
1115 /* next */
1116 DBGFR3AddrAdd(&HitAddr, 4);
1117 if (HitAddr.FlatPtr < uEnd)
1118 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1119 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1120 else
1121 rc = VERR_DBGF_MEM_NOT_FOUND;
1122 }
1123 }
1124 }
1125 else
1126 {
1127 IMAGE_NT_HEADERS64 const *pHdrs = (IMAGE_NT_HEADERS64 const *)&u.au8[u.MzHdr.e_lfanew];
1128 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1129 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1130 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1131 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1132 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL))
1133 == IMAGE_FILE_EXECUTABLE_IMAGE
1134 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1135 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1136 )
1137 {
1138 /* Find the MTE. */
1139 RT_ZERO(uMte.v64);
1140 uMte.v64.DllBase = KernelAddr.FlatPtr;
1141 uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1142 uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1143 DBGFADDRESS ScanAddr;
1144 DBGFADDRESS HitAddr;
1145 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1146 uEnd - uStart, 8 /*align*/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1147 while (RT_SUCCESS(rc))
1148 {
1149 /* Read the start of the MTE and check some basic members. */
1150 DBGFADDRESS MteAddr = HitAddr;
1151 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1152 &uMte2.v64, sizeof(uMte2.v64));
1153 if ( RT_SUCCESS(rc)
1154 && uMte2.v64.DllBase == uMte.v64.DllBase
1155 && uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1156 && uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1157 && WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1158 && WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1159 && WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1160 && uMte2.v64.BaseDllName.Length <= 128
1161 && uMte2.v64.FullDllName.Length <= 260
1162 )
1163 {
1164 /* Try read the base name and compare with known NT kernel names. */
1165 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1166 u.wsz, uMte2.v64.BaseDllName.Length);
1167 u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1168 if ( RT_SUCCESS(rc)
1169 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1170 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1171 )
1172 )
1173 {
1174 /* Read the link entry of the previous entry in the list and check that its
1175 forward pointer points at the MTE we've found. */
1176 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
1177 DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1178 &uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1179 if ( RT_SUCCESS(rc)
1180 && uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1181 && WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1182 {
1183 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1184 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1185 pThis->KernelAddr = KernelAddr;
1186 pThis->KernelMteAddr = MteAddr;
1187 pThis->PsLoadedModuleListAddr = Addr;
1188 pThis->f32Bit = false;
1189 pThis->fNt31 = false;
1190 return true;
1191 }
1192 }
1193 else if (RT_SUCCESS(rc))
1194 {
1195 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1196 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1197 break; /* Not NT kernel */
1198 }
1199 }
1200
1201 /* next */
1202 DBGFR3AddrAdd(&HitAddr, 8);
1203 if (HitAddr.FlatPtr < uEnd)
1204 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1205 8 /*align*/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1206 else
1207 rc = VERR_DBGF_MEM_NOT_FOUND;
1208 }
1209 }
1210 }
1211 }
1212 }
1213 return false;
1214}
1215
1216
1217/**
1218 * @copydoc DBGFOSREG::pfnDestruct
1219 */
1220static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1221{
1222 RT_NOREF2(pUVM, pvData);
1223}
1224
1225
1226/**
1227 * @copydoc DBGFOSREG::pfnConstruct
1228 */
1229static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1230{
1231 RT_NOREF1(pUVM);
1232 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1233 pThis->fValid = false;
1234 pThis->f32Bit = false;
1235 pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1236 return VINF_SUCCESS;
1237}
1238
1239
1240const DBGFOSREG g_DBGDiggerWinNt =
1241{
1242 /* .u32Magic = */ DBGFOSREG_MAGIC,
1243 /* .fFlags = */ 0,
1244 /* .cbData = */ sizeof(DBGDIGGERWINNT),
1245 /* .szName = */ "WinNT",
1246 /* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1247 /* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1248 /* .pfnProbe = */ dbgDiggerWinNtProbe,
1249 /* .pfnInit = */ dbgDiggerWinNtInit,
1250 /* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1251 /* .pfnTerm = */ dbgDiggerWinNtTerm,
1252 /* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1253 /* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1254 /* .u32EndMagic = */ DBGFOSREG_MAGIC
1255};
1256
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use