DBGPlugInWinNt.cpp@ 73413

Last change on this file since 73413 was 73413, checked in by vboxsync, 6 years ago
DBGPlugInWinNt.cpp: Must unlink all our modules during termination of we risk crashing when the private loader reader instance is closed, due to our plugin being unloaded.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 50.9 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 73413 2018-07-31 16:58:20Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/err.h>
26	#include <VBox/param.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/string.h>
31	#include <iprt/formats/pecoff.h>
32	#include <iprt/formats/mz.h>
33
34
35	/*********************************************************************************************************************************
36	* Structures and Typedefs *
37	*********************************************************************************************************************************/
38
39	/** @name Internal WinNT structures
40	* @{ */
41	/**
42	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
43	* Tested with XP.
44	*/
45	typedef struct NTMTE32
46	{
47	struct
48	{
49	uint32_t Flink;
50	uint32_t Blink;
51	} InLoadOrderLinks,
52	InMemoryOrderModuleList,
53	InInitializationOrderModuleList;
54	uint32_t DllBase;
55	uint32_t EntryPoint;
56	/** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
57	* boot loader, for other images it looks like some kind of pointer. */
58	uint32_t SizeOfImage;
59	struct
60	{
61	uint16_t Length;
62	uint16_t MaximumLength;
63	uint32_t Buffer;
64	} FullDllName,
65	BaseDllName;
66	uint32_t Flags;
67	uint16_t LoadCount;
68	uint16_t TlsIndex;
69	/* ... there is more ... */
70	} NTMTE32;
71	typedef NTMTE32 *PNTMTE32;
72
73	/**
74	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
75	*/
76	typedef struct NTMTE64
77	{
78	struct
79	{
80	uint64_t Flink;
81	uint64_t Blink;
82	} InLoadOrderLinks, /*< 0x00 /
83	InMemoryOrderModuleList, /*< 0x10 /
84	InInitializationOrderModuleList; /*< 0x20 /
85	uint64_t DllBase; /*< 0x30 /
86	uint64_t EntryPoint; /*< 0x38 /
87	uint32_t SizeOfImage; /*< 0x40 /
88	uint32_t Alignment; /*< 0x44 /
89	struct
90	{
91	uint16_t Length; /*< 0x48,0x58 /
92	uint16_t MaximumLength; /*< 0x4a,0x5a /
93	uint32_t Alignment; /*< 0x4c,0x5c /
94	uint64_t Buffer; /*< 0x50,0x60 /
95	} FullDllName, /*< 0x48 /
96	BaseDllName; /*< 0x58 /
97	uint32_t Flags; /*< 0x68 /
98	uint16_t LoadCount; /*< 0x6c /
99	uint16_t TlsIndex; /*< 0x6e /
100	/* ... there is more ... */
101	} NTMTE64;
102	typedef NTMTE64 *PNTMTE64;
103
104	/** MTE union. */
105	typedef union NTMTE
106	{
107	NTMTE32 vX_32;
108	NTMTE64 vX_64;
109	} NTMTE;
110	typedef NTMTE *PNTMTE;
111
112
113	/**
114	* The essential bits of the KUSER_SHARED_DATA structure.
115	*/
116	typedef struct NTKUSERSHAREDDATA
117	{
118	uint32_t TickCountLowDeprecated;
119	uint32_t TickCountMultiplier;
120	struct
121	{
122	uint32_t LowPart;
123	int32_t High1Time;
124	int32_t High2Time;
125
126	} InterruptTime,
127	SystemTime,
128	TimeZoneBias;
129	uint16_t ImageNumberLow;
130	uint16_t ImageNumberHigh;
131	RTUTF16 NtSystemRoot[260];
132	uint32_t MaxStackTraceDepth;
133	uint32_t CryptoExponent;
134	uint32_t TimeZoneId;
135	uint32_t LargePageMinimum;
136	uint32_t Reserved2[7];
137	uint32_t NtProductType;
138	uint8_t ProductTypeIsValid;
139	uint8_t abPadding[3];
140	uint32_t NtMajorVersion;
141	uint32_t NtMinorVersion;
142	/* uint8_t ProcessorFeatures[64];
143	...
144	*/
145	} NTKUSERSHAREDDATA;
146	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
147
148	/** KI_USER_SHARED_DATA for i386 */
149	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
150	/** KI_USER_SHARED_DATA for AMD64 */
151	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
152
153	/** NTKUSERSHAREDDATA::NtProductType */
154	typedef enum NTPRODUCTTYPE
155	{
156	kNtProductType_Invalid = 0,
157	kNtProductType_WinNt = 1,
158	kNtProductType_LanManNt,
159	kNtProductType_Server
160	} NTPRODUCTTYPE;
161
162
163	/** NT image header union. */
164	typedef union NTHDRSU
165	{
166	IMAGE_NT_HEADERS32 vX_32;
167	IMAGE_NT_HEADERS64 vX_64;
168	} NTHDRS;
169	/** Pointer to NT image header union. */
170	typedef NTHDRS *PNTHDRS;
171	/** Pointer to const NT image header union. */
172	typedef NTHDRS const *PCNTHDRS;
173
174	/** @} */
175
176
177
178	typedef enum DBGDIGGERWINNTVER
179	{
180	DBGDIGGERWINNTVER_UNKNOWN,
181	DBGDIGGERWINNTVER_3_1,
182	DBGDIGGERWINNTVER_3_5,
183	DBGDIGGERWINNTVER_4_0,
184	DBGDIGGERWINNTVER_5_0,
185	DBGDIGGERWINNTVER_5_1,
186	DBGDIGGERWINNTVER_6_0
187	} DBGDIGGERWINNTVER;
188
189	/**
190	* WinNT guest OS digger instance data.
191	*/
192	typedef struct DBGDIGGERWINNT
193	{
194	/** Whether the information is valid or not.
195	* (For fending off illegal interface method calls.) */
196	bool fValid;
197	/** 32-bit (true) or 64-bit (false) */
198	bool f32Bit;
199	/** Set if NT 3.1 was detected.
200	* This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
201	bool fNt31;
202
203	/** The NT version. */
204	DBGDIGGERWINNTVER enmVer;
205	/** NTKUSERSHAREDDATA::NtProductType */
206	NTPRODUCTTYPE NtProductType;
207	/** NTKUSERSHAREDDATA::NtMajorVersion */
208	uint32_t NtMajorVersion;
209	/** NTKUSERSHAREDDATA::NtMinorVersion */
210	uint32_t NtMinorVersion;
211
212	/** The address of the ntoskrnl.exe image. */
213	DBGFADDRESS KernelAddr;
214	/** The address of the ntoskrnl.exe module table entry. */
215	DBGFADDRESS KernelMteAddr;
216	/** The address of PsLoadedModuleList. */
217	DBGFADDRESS PsLoadedModuleListAddr;
218	} DBGDIGGERWINNT;
219	/** Pointer to the linux guest OS digger instance data. */
220	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
221
222
223	/**
224	* The WinNT digger's loader reader instance data.
225	*/
226	typedef struct DBGDIGGERWINNTRDR
227	{
228	/** The VM handle (referenced). */
229	PUVM pUVM;
230	/** The image base. */
231	DBGFADDRESS ImageAddr;
232	/** The image size. */
233	uint32_t cbImage;
234	/** The file offset of the SizeOfImage field in the optional header if it
235	* needs patching, otherwise set to UINT32_MAX. */
236	uint32_t offSizeOfImage;
237	/** The correct image size. */
238	uint32_t cbCorrectImageSize;
239	/** Number of entries in the aMappings table. */
240	uint32_t cMappings;
241	/** Mapping hint. */
242	uint32_t iHint;
243	/** Mapping file offset to memory offsets, ordered by file offset. */
244	struct
245	{
246	/** The file offset. */
247	uint32_t offFile;
248	/** The size of this mapping. */
249	uint32_t cbMem;
250	/** The offset to the memory from the start of the image. */
251	uint32_t offMem;
252	} aMappings[1];
253	} DBGDIGGERWINNTRDR;
254	/** Pointer a WinNT loader reader instance data. */
255	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
256
257
258	/*********************************************************************************************************************************
259	* Defined Constants And Macros *
260	*********************************************************************************************************************************/
261	/** Validates a 32-bit Windows NT kernel address */
262	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
263	/** Validates a 64-bit Windows NT kernel address */
264	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
265	/** Validates a kernel address. */
266	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
267	/** Versioned and bitness wrapper. */
268	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
269
270	/** The length (in chars) of the kernel file name (no path). */
271	#define WINNT_KERNEL_BASE_NAME_LEN 12
272
273	/** WindowsNT on little endian ASCII systems. */
274	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
275
276
277	/*********************************************************************************************************************************
278	* Internal Functions *
279	*********************************************************************************************************************************/
280	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
281
282
283	/*********************************************************************************************************************************
284	* Global Variables *
285	*********************************************************************************************************************************/
286	/** Kernel names. */
287	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
288	{
289	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
290	};
291
292
293
294	/** @callback_method_impl{PFNRTLDRRDRMEMREAD} */
295	static DECLCALLBACK(int) dbgDiggerWinNtRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
296	{
297	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
298	uint32_t offFile = (uint32_t)off;
299	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
300
301	uint32_t i = pThis->iHint;
302	if (pThis->aMappings[i].offFile > offFile)
303	{
304	i = pThis->cMappings;
305	while (i-- > 0)
306	if (offFile >= pThis->aMappings[i].offFile)
307	break;
308	pThis->iHint = i;
309	}
310
311	while (cb > 0)
312	{
313	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
314	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
315
316	/* Read file bits backed by memory. */
317	if (offMap < pThis->aMappings[i].cbMem)
318	{
319	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
320	if (cbToRead > cb)
321	cbToRead = (uint32_t)cb;
322
323	DBGFADDRESS Addr = pThis->ImageAddr;
324	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
325
326	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
327	if (RT_FAILURE(rc))
328	return rc;
329
330	/* Apply SizeOfImage patch? */
331	if ( pThis->offSizeOfImage != UINT32_MAX
332	&& offFile < pThis->offSizeOfImage + 4
333	&& offFile + cbToRead > pThis->offSizeOfImage)
334	{
335	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
336	uint32_t cbPatch = sizeof(SizeOfImage);
337	int32_t offPatch = pThis->offSizeOfImage - offFile;
338	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
339	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
340	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
341	while (cbPatch-- > 0)
342	{
343	if (offPatch >= 0)
344	*pbPatch = (uint8_t)SizeOfImage;
345	offPatch++;
346	pbPatch++;
347	SizeOfImage >>= 8;
348	}
349	}
350
351	/* Done? */
352	if (cbToRead == cb)
353	break;
354
355	offFile += cbToRead;
356	cb -= cbToRead;
357	pvBuf = (char *)pvBuf + cbToRead;
358	}
359
360	/* Mind the gap. */
361	if (offNextMap > offFile)
362	{
363	uint32_t cbZero = offNextMap - offFile;
364	if (cbZero > cb)
365	{
366	RT_BZERO(pvBuf, cb);
367	break;
368	}
369
370	RT_BZERO(pvBuf, cbZero);
371	offFile += cbZero;
372	cb -= cbZero;
373	pvBuf = (char *)pvBuf + cbZero;
374	}
375
376	pThis->iHint = ++i;
377	}
378
379	return VINF_SUCCESS;
380	}
381
382
383	/** @callback_method_impl{PFNRTLDRRDRMEMDTOR} */
384	static DECLCALLBACK(void) dbgDiggerWinNtRdr_Dtor(void *pvUser)
385	{
386	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
387
388	VMR3ReleaseUVM(pThis->pUVM);
389	pThis->pUVM = NULL;
390	RTMemFree(pvUser);
391	}
392
393
394	/**
395	* Checks if the section headers look okay.
396	*
397	* @returns true / false.
398	* @param paShs Pointer to the section headers.
399	* @param cShs Number of headers.
400	* @param cbImage The image size reported by NT.
401	* @param cbImageFromHdr The image size by the linker in the header.
402	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
403	* no resource directory.
404	* @param cbSectAlign The section alignment specified in the header.
405	* @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
406	* @param pcbImageCorrect The corrected image size. This is derived from
407	* cbImage and virtual range of the section tables.
408	*
409	* The problem is that NT may choose to drop the
410	* last pages in images it loads early, starting at
411	* the resource directory. These images will have
412	* a page aligned cbImage.
413	*/
414	static bool dbgDiggerWinNtCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShs, uint32_t cShs, uint32_t cbImage,
415	uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
416	bool fNt31, uint32_t *pcbImageCorrect)
417	{
418	*pcbImageCorrect = cbImage;
419
420	for (uint32_t i = 0; i < cShs; i++)
421	{
422	if (!paShs[i].Name[0])
423	{
424	Log(("DigWinNt: Section header #%u has no name\n", i));
425	return false;
426	}
427
428	if (paShs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
429	continue;
430
431	/* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
432	/** @todo this isn't really perfect. cbImage is kind of wrong... */
433	uint32_t cbVirtual = paShs[i].Misc.VirtualSize;
434	if (cbVirtual == 0)
435	{
436	for (uint32_t j = i + 1; j < cShs; j++)
437	if (!(paShs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
438	&& paShs[j].VirtualAddress > paShs[i].VirtualAddress)
439	{
440	cbVirtual = paShs[j].VirtualAddress - paShs[i].VirtualAddress;
441	break;
442	}
443	if (!cbVirtual)
444	{
445	if (paShs[i].VirtualAddress < cbImageFromHdr)
446	cbVirtual = cbImageFromHdr - paShs[i].VirtualAddress;
447	else if (paShs[i].SizeOfRawData > 0)
448	cbVirtual = RT_ALIGN(paShs[i].SizeOfRawData, _4K);
449	}
450	}
451
452	/* Check that sizes are within the same range and that both sizes and
453	addresses are within reasonable limits. */
454	if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShs[i].SizeOfRawData, _64K)
455	\|\| cbVirtual >= _1G
456	\|\| paShs[i].SizeOfRawData >= _1G)
457	{
458	Log(("DigWinNt: Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!\n",
459	i, paShs[i].Name, cbVirtual, paShs[i].Misc.VirtualSize, paShs[i].SizeOfRawData));
460	return false;
461	}
462	uint32_t uRvaEnd = paShs[i].VirtualAddress + cbVirtual;
463	if (uRvaEnd >= _1G \|\| uRvaEnd < paShs[i].VirtualAddress)
464	{
465	Log(("DigWinNt: Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!\n",
466	i, paShs[i].Name, cbVirtual, paShs[i].Misc.VirtualSize, paShs[i].VirtualAddress, uRvaEnd));
467	return false;
468	}
469
470	/* Check for images chopped off around '.rsrc'. */
471	if ( cbImage < uRvaEnd
472	&& uRvaEnd >= uRvaRsrc)
473	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
474
475	/* Check that the section is within the image. */
476	if (uRvaEnd > cbImage && fNt31)
477	{
478	Log(("DigWinNt: Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x\n",
479	i, paShs[i].VirtualAddress, uRvaEnd, cbImage));
480	return false;
481	}
482	}
483
484	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
485	*pcbImageCorrect = cbImage;
486	return true;
487	}
488
489
490	/**
491	* Create a loader module for the in-guest-memory PE module.
492	*/
493	static int dbgDiggerWinNtCreateLdrMod(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName, PCDBGFADDRESS pImageAddr,
494	uint32_t cbImage, uint8_t *pbBuf, size_t cbBuf,
495	uint32_t offHdrs, PCNTHDRS pHdrs, PRTLDRMOD phLdrMod)
496	{
497	/*
498	* Allocate and create a reader instance.
499	*/
500	uint32_t const cShs = WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections);
501	PDBGDIGGERWINNTRDR pRdr = (PDBGDIGGERWINNTRDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGDIGGERWINNTRDR, aMappings[cShs + 2]));
502	if (!pRdr)
503	return VERR_NO_MEMORY;
504
505	VMR3RetainUVM(pUVM);
506	pRdr->pUVM = pUVM;
507	pRdr->ImageAddr = *pImageAddr;
508	pRdr->cbImage = cbImage;
509	pRdr->cbCorrectImageSize = cbImage;
510	pRdr->offSizeOfImage = UINT32_MAX;
511	pRdr->iHint = 0;
512
513	/*
514	* Use the section table to construct a more accurate view of the file/
515	* image if it's in the buffer (it should be).
516	*/
517	uint32_t uRvaRsrc = UINT32_MAX;
518	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).Size > 0)
519	uRvaRsrc = WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress;
520	uint32_t offShs = offHdrs
521	+ ( pThis->f32Bit
522	? pHdrs->vX_32.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
523	: pHdrs->vX_64.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader));
524	uint32_t cbShs = cShs * sizeof(IMAGE_SECTION_HEADER);
525	PCIMAGE_SECTION_HEADER paShs = (PCIMAGE_SECTION_HEADER)(pbBuf + offShs);
526	if ( offShs + cbShs <= RT_MIN(cbImage, cbBuf)
527	&& dbgDiggerWinNtCheckSectHdrsAndImgSize(paShs, cShs, cbImage, WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage),
528	uRvaRsrc, WINNT_UNION(pThis, pHdrs, OptionalHeader.SectionAlignment),
529	pThis->fNt31, &pRdr->cbCorrectImageSize))
530	{
531	pRdr->cMappings = 0;
532
533	for (uint32_t i = 0; i < cShs; i++)
534	if ( paShs[i].SizeOfRawData > 0
535	&& paShs[i].PointerToRawData > 0)
536	{
537	uint32_t j = 1;
538	if (!pRdr->cMappings)
539	pRdr->cMappings++;
540	else
541	{
542	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShs[i].PointerToRawData)
543	j++;
544	if (j < pRdr->cMappings)
545	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
546	}
547	pRdr->aMappings[j].offFile = paShs[i].PointerToRawData;
548	pRdr->aMappings[j].offMem = paShs[i].VirtualAddress;
549	pRdr->aMappings[j].cbMem = i + 1 < cShs
550	? paShs[i + 1].VirtualAddress - paShs[i].VirtualAddress
551	: paShs[i].Misc.VirtualSize;
552	if (j == pRdr->cMappings)
553	pRdr->cbImage = paShs[i].PointerToRawData + paShs[i].SizeOfRawData;
554	pRdr->cMappings++;
555	}
556
557	/* Insert the mapping of the headers that isn't covered by the section table. */
558	pRdr->aMappings[0].offFile = 0;
559	pRdr->aMappings[0].offMem = 0;
560	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
561
562	int j = pRdr->cMappings - 1;
563	while (j-- > 0)
564	{
565	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
566	if (pRdr->aMappings[j].cbMem > cbFile)
567	pRdr->aMappings[j].cbMem = cbFile;
568	}
569	}
570	else
571	{
572	/*
573	* Fallback, fake identity mapped file data.
574	*/
575	pRdr->cMappings = 1;
576	pRdr->aMappings[0].offFile = 0;
577	pRdr->aMappings[0].offMem = 0;
578	pRdr->aMappings[0].cbMem = pRdr->cbImage;
579	}
580
581	/* Enable the SizeOfImage patching if necessary. */
582	if (pRdr->cbCorrectImageSize != cbImage)
583	{
584	Log(("DigWinNT: The image is really %#x bytes long, not %#x as mapped by NT!\n", pRdr->cbCorrectImageSize, cbImage));
585	pRdr->offSizeOfImage = pThis->f32Bit
586	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
587	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
588	}
589
590	/*
591	* Call the loader to open the PE image for debugging.
592	* Note! It always calls pfnDtor.
593	*/
594	RTLDRMOD hLdrMod;
595	int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
596	dbgDiggerWinNtRdr_Read, dbgDiggerWinNtRdr_Dtor, pRdr,
597	&hLdrMod, NULL);
598	if (RT_SUCCESS(rc))
599	*phLdrMod = hLdrMod;
600	else
601	*phLdrMod = NIL_RTLDRMOD;
602	return rc;
603	}
604
605
606	/**
607	* Process a PE image found in guest memory.
608	*
609	* @param pThis The instance data.
610	* @param pUVM The user mode VM handle.
611	* @param pszName The image name.
612	* @param pImageAddr The image address.
613	* @param cbImage The size of the image.
614	* @param pbBuf Scratch buffer containing the first
615	* RT_MIN(cbBuf, cbImage) bytes of the image.
616	* @param cbBuf The scratch buffer size.
617	*/
618	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
619	PCDBGFADDRESS pImageAddr, uint32_t cbImage,
620	uint8_t *pbBuf, size_t cbBuf)
621	{
622	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
623
624	/*
625	* NT 3.1 doesn't set the image size in the MTEs, so a little
626	* bit of tweaking is necessary here.
627	*/
628	uint32_t const cbImageValidate = !pThis->fNt31 ? cbImage : _64M;
629
630	/*
631	* Do some basic validation first.
632	* This is the usual exteremely verbose and messy code...
633	*/
634	Assert(cbBuf >= sizeof(IMAGE_NT_HEADERS64));
635	if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
636	\|\| cbImage >= _1M * 256)
637	{
638	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
639	return;
640	}
641
642	/* Dig out the NT/PE headers. */
643	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbBuf;
644	PCNTHDRS pHdrs;
645	uint32_t offHdrs;
646	if (pMzHdr->e_magic != IMAGE_DOS_SIGNATURE)
647	{
648	offHdrs = 0;
649	pHdrs = (PCNTHDRS)pbBuf;
650	}
651	else if ( pMzHdr->e_lfanew >= cbImageValidate
652	\|\| pMzHdr->e_lfanew < sizeof(*pMzHdr)
653	\|\| pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) > cbImageValidate)
654	{
655	Log(("DigWinNt: %s: PE header to far into image: %#x cbImage=%#x\n", pszName, pMzHdr->e_lfanew, cbImage));
656	return;
657	}
658	else if ( pMzHdr->e_lfanew < cbBuf
659	&& pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) <= cbBuf)
660	{
661	offHdrs = pMzHdr->e_lfanew;
662	pHdrs = (NTHDRS const *)(pbBuf + offHdrs);
663	}
664	else
665	{
666	Log(("DigWinNt: %s: PE header to far into image (lazy bird): %#x\n", pszName, pMzHdr->e_lfanew));
667	return;
668	}
669	if (pHdrs->vX_32.Signature != IMAGE_NT_SIGNATURE)
670	{
671	Log(("DigWinNt: %s: Bad PE signature: %#x\n", pszName, pHdrs->vX_32.Signature));
672	return;
673	}
674
675	/* The file header is the same on both archs */
676	if (pHdrs->vX_32.FileHeader.Machine != (pThis->f32Bit ? IMAGE_FILE_MACHINE_I386 : IMAGE_FILE_MACHINE_AMD64))
677	{
678	Log(("DigWinNt: %s: Invalid FH.Machine: %#x\n", pszName, pHdrs->vX_32.FileHeader.Machine));
679	return;
680	}
681	if (pHdrs->vX_32.FileHeader.SizeOfOptionalHeader != (pThis->f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
682	{
683	Log(("DigWinNt: %s: Invalid FH.SizeOfOptionalHeader: %#x\n", pszName, pHdrs->vX_32.FileHeader.SizeOfOptionalHeader));
684	return;
685	}
686	if (WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections) > 64)
687	{
688	Log(("DigWinNt: %s: Too many sections: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections)));
689	return;
690	}
691
692	const uint32_t TimeDateStamp = pHdrs->vX_32.FileHeader.TimeDateStamp;
693
694	/* The optional header is not... */
695	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic) != (pThis->f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
696	{
697	Log(("DigWinNt: %s: Invalid OH.Magic: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic)));
698	return;
699	}
700	uint32_t cbImageFromHdr = WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage);
701	if (pThis->fNt31)
702	cbImage = RT_ALIGN(cbImageFromHdr, _4K);
703	else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
704	{
705	Log(("DigWinNt: %s: Invalid OH.SizeOfImage: %#x, expected %#x\n", pszName, cbImageFromHdr, cbImage));
706	return;
707	}
708	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes) != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
709	{
710	Log(("DigWinNt: %s: Invalid OH.NumberOfRvaAndSizes: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes)));
711	return;
712	}
713
714	/*
715	* Create the module using the in memory image first, falling back
716	* on cached image.
717	*/
718	RTLDRMOD hLdrMod;
719	int rc = dbgDiggerWinNtCreateLdrMod(pThis, pUVM, pszName, pImageAddr, cbImage, pbBuf, cbBuf, offHdrs, pHdrs,
720	&hLdrMod);
721	if (RT_FAILURE(rc))
722	hLdrMod = NIL_RTLDRMOD;
723
724	RTDBGMOD hMod;
725	rc = RTDbgModCreateFromPeImage(&hMod, pszName, NULL, &hLdrMod,
726	cbImageFromHdr, TimeDateStamp, DBGFR3AsGetConfig(pUVM));
727	if (RT_FAILURE(rc))
728	{
729	/*
730	* Final fallback is a container module.
731	*/
732	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
733	if (RT_FAILURE(rc))
734	return;
735
736	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
737	AssertRC(rc);
738	}
739
740	/* Tag the module. */
741	rc = RTDbgModSetTag(hMod, DIG_WINNT_MOD_TAG);
742	AssertRC(rc);
743
744	/*
745	* Link the module.
746	*/
747	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
748	if (hAs != NIL_RTDBGAS)
749	rc = RTDbgAsModuleLink(hAs, hMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
750	else
751	rc = VERR_INTERNAL_ERROR;
752	RTDbgModRelease(hMod);
753	RTDbgAsRelease(hAs);
754	if (hLdrMod != NIL_RTLDRMOD)
755	RTLdrClose(hLdrMod);
756	}
757
758
759	/**
760	* @copydoc DBGFOSREG::pfnQueryInterface
761	*/
762	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
763	{
764	RT_NOREF3(pUVM, pvData, enmIf);
765	return NULL;
766	}
767
768
769	/**
770	* @copydoc DBGFOSREG::pfnQueryVersion
771	*/
772	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
773	{
774	RT_NOREF1(pUVM);
775	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
776	Assert(pThis->fValid);
777	const char *pszNtProductType;
778	switch (pThis->NtProductType)
779	{
780	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
781	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
782	case kNtProductType_Server: pszNtProductType = "-Server"; break;
783	default: pszNtProductType = ""; break;
784	}
785	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
786	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
787	return VINF_SUCCESS;
788	}
789
790
791	/**
792	* @copydoc DBGFOSREG::pfnTerm
793	*/
794	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
795	{
796	RT_NOREF1(pUVM);
797	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
798	Assert(pThis->fValid);
799
800	/*
801	* As long as we're using our private LDR reader implementation,
802	* we must unlink and ditch the modules we created.
803	*/
804	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
805	if (hDbgAs != NIL_RTDBGAS)
806	{
807	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
808	while (iMod-- > 0)
809	{
810	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
811	if (hMod != NIL_RTDBGMOD)
812	{
813	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
814	{
815	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
816	AssertRC(rc);
817	}
818	RTDbgModRelease(hMod);
819	}
820	}
821	RTDbgAsRelease(hDbgAs);
822	}
823
824	pThis->fValid = false;
825	}
826
827
828	/**
829	* @copydoc DBGFOSREG::pfnRefresh
830	*/
831	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
832	{
833	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
834	NOREF(pThis);
835	Assert(pThis->fValid);
836
837	/*
838	* For now we'll flush and reload everything.
839	*/
840	dbgDiggerWinNtTerm(pUVM, pvData);
841
842	return dbgDiggerWinNtInit(pUVM, pvData);
843	}
844
845
846	/**
847	* @copydoc DBGFOSREG::pfnInit
848	*/
849	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
850	{
851	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
852	Assert(!pThis->fValid);
853
854	union
855	{
856	uint8_t au8[0x2000];
857	RTUTF16 wsz[0x2000/2];
858	NTKUSERSHAREDDATA UserSharedData;
859	} u;
860	DBGFADDRESS Addr;
861	int rc;
862
863	/*
864	* Figure the NT version.
865	*/
866	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
867	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
868	if (RT_SUCCESS(rc))
869	{
870	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
871	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
872	: kNtProductType_Invalid;
873	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
874	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
875	}
876	else if (pThis->fNt31)
877	{
878	pThis->NtProductType = kNtProductType_WinNt;
879	pThis->NtMajorVersion = 3;
880	pThis->NtMinorVersion = 1;
881	}
882	else
883	{
884	Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
885	return rc;
886	}
887
888	/*
889	* Dig out the module chain.
890	*/
891	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
892	Addr = pThis->KernelMteAddr;
893	do
894	{
895	/* Read the validate the MTE. */
896	NTMTE Mte;
897	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
898	if (RT_FAILURE(rc))
899	break;
900	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
901	{
902	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
903	break;
904	}
905	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
906	{
907	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
908	break;
909	}
910	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
911	{
912	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
913	break;
914	}
915	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
916	{
917	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
918	break;
919	}
920	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
921	{
922	Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
923	break;
924	}
925
926	uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
927	if ( !pThis->fNt31
928	&& ( cbImageMte > _256M
929	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
930	{
931	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
932	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
933	break;
934	}
935
936	/* Read the full name. */
937	DBGFADDRESS AddrName;
938	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
939	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
940	if (cbName < sizeof(u))
941	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
942	else
943	rc = VERR_OUT_OF_RANGE;
944	if (RT_FAILURE(rc))
945	{
946	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
947	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
948	if (cbName < sizeof(u))
949	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
950	else
951	rc = VERR_OUT_OF_RANGE;
952	}
953	if (RT_SUCCESS(rc))
954	{
955	u.wsz[cbName/2] = '\0';
956	char *pszName;
957	rc = RTUtf16ToUtf8(u.wsz, &pszName);
958	if (RT_SUCCESS(rc))
959	{
960	/* Read the start of the PE image and pass it along to a worker. */
961	DBGFADDRESS ImageAddr;
962	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
963	uint32_t cbImageBuf = RT_MIN(sizeof(u), RT_MAX(cbImageMte, _4K));
964	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &ImageAddr, &u, cbImageBuf);
965	if (RT_SUCCESS(rc))
966	dbgDiggerWinNtProcessImage(pThis,
967	pUVM,
968	pszName,
969	&ImageAddr,
970	cbImageMte,
971	&u.au8[0],
972	sizeof(u));
973	RTStrFree(pszName);
974	}
975	}
976
977	/* next */
978	AddrPrev = Addr;
979	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
980	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
981	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
982
983	pThis->fValid = true;
984	return VINF_SUCCESS;
985	}
986
987
988	/**
989	* @copydoc DBGFOSREG::pfnProbe
990	*/
991	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
992	{
993	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
994	DBGFADDRESS Addr;
995	union
996	{
997	uint8_t au8[8192];
998	uint16_t au16[8192/2];
999	uint32_t au32[8192/4];
1000	IMAGE_DOS_HEADER MzHdr;
1001	RTUTF16 wsz[8192/2];
1002	} u;
1003
1004	union
1005	{
1006	NTMTE32 v32;
1007	NTMTE64 v64;
1008	} uMte, uMte2, uMte3;
1009
1010	/*
1011	* Look for the PAGELK section name that seems to be a part of all kernels.
1012	* Then try find the module table entry for it. Since it's the first entry
1013	* in the PsLoadedModuleList we can easily validate the list head and report
1014	* success.
1015	*
1016	* Note! We ASSUME the section name is 8 byte aligned.
1017	*/
1018	CPUMMODE enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
1019	uint64_t const uStart = enmMode == CPUMMODE_LONG ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
1020	uint64_t const uEnd = enmMode == CPUMMODE_LONG ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
1021	DBGFADDRESS KernelAddr;
1022	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uStart);
1023	KernelAddr.FlatPtr < uEnd;
1024	KernelAddr.FlatPtr += PAGE_SIZE)
1025	{
1026	bool fNt31 = false;
1027	DBGFADDRESS const RetryAddress = KernelAddr;
1028	int rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1029	8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
1030	if ( rc == VERR_DBGF_MEM_NOT_FOUND
1031	&& enmMode != CPUMMODE_LONG)
1032	{
1033	/* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
1034	following VirtualSize is zero, so check for that too. */
1035	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
1036	8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
1037	fNt31 = true;
1038	}
1039	if (RT_FAILURE(rc))
1040	break;
1041	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
1042
1043	/* MZ + PE header. */
1044	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
1045	if ( RT_SUCCESS(rc)
1046	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
1047	&& !(u.MzHdr.e_lfanew & 0x7)
1048	&& u.MzHdr.e_lfanew >= 0x080
1049	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
1050	{
1051	if (enmMode != CPUMMODE_LONG)
1052	{
1053	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
1054	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1055	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
1056	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1057	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1058	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
1059	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
1060	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1061	)
1062	{
1063	/* Find the MTE. */
1064	RT_ZERO(uMte);
1065	uMte.v32.DllBase = KernelAddr.FlatPtr;
1066	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1067	uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
1068	DBGFADDRESS HitAddr;
1069	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1070	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1071	while (RT_SUCCESS(rc))
1072	{
1073	/* check the name. */
1074	DBGFADDRESS MteAddr = HitAddr;
1075	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
1076	&uMte2.v32, sizeof(uMte2.v32));
1077	if ( RT_SUCCESS(rc)
1078	&& uMte2.v32.DllBase == uMte.v32.DllBase
1079	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1080	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1081	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1082	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1083	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1084	&& uMte2.v32.BaseDllName.Length <= 128
1085	&& uMte2.v32.FullDllName.Length <= 260
1086	)
1087	{
1088	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1089	u.wsz, uMte2.v32.BaseDllName.Length);
1090	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1091	if ( RT_SUCCESS(rc)
1092	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1093	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1094	)
1095	)
1096	{
1097	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1098	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
1099	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1100	if ( RT_SUCCESS(rc)
1101	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1102	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1103	{
1104	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1105	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1106	pThis->KernelAddr = KernelAddr;
1107	pThis->KernelMteAddr = MteAddr;
1108	pThis->PsLoadedModuleListAddr = Addr;
1109	pThis->f32Bit = true;
1110	pThis->fNt31 = fNt31;
1111	return true;
1112	}
1113	}
1114	else if (RT_SUCCESS(rc))
1115	{
1116	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1117	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1118	break; /* Not NT kernel */
1119	}
1120	}
1121
1122	/* next */
1123	DBGFR3AddrAdd(&HitAddr, 4);
1124	if (HitAddr.FlatPtr < uEnd)
1125	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1126	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1127	else
1128	rc = VERR_DBGF_MEM_NOT_FOUND;
1129	}
1130	}
1131	}
1132	else
1133	{
1134	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
1135	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1136	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1137	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1138	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1139	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
1140	== IMAGE_FILE_EXECUTABLE_IMAGE
1141	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1142	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1143	)
1144	{
1145	/* Find the MTE. */
1146	RT_ZERO(uMte.v64);
1147	uMte.v64.DllBase = KernelAddr.FlatPtr;
1148	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1149	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1150	DBGFADDRESS ScanAddr;
1151	DBGFADDRESS HitAddr;
1152	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1153	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1154	while (RT_SUCCESS(rc))
1155	{
1156	/* Read the start of the MTE and check some basic members. */
1157	DBGFADDRESS MteAddr = HitAddr;
1158	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1159	&uMte2.v64, sizeof(uMte2.v64));
1160	if ( RT_SUCCESS(rc)
1161	&& uMte2.v64.DllBase == uMte.v64.DllBase
1162	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1163	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1164	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1165	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1166	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1167	&& uMte2.v64.BaseDllName.Length <= 128
1168	&& uMte2.v64.FullDllName.Length <= 260
1169	)
1170	{
1171	/* Try read the base name and compare with known NT kernel names. */
1172	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1173	u.wsz, uMte2.v64.BaseDllName.Length);
1174	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1175	if ( RT_SUCCESS(rc)
1176	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1177	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1178	)
1179	)
1180	{
1181	/* Read the link entry of the previous entry in the list and check that its
1182	forward pointer points at the MTE we've found. */
1183	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1184	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1185	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1186	if ( RT_SUCCESS(rc)
1187	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1188	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1189	{
1190	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1191	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1192	pThis->KernelAddr = KernelAddr;
1193	pThis->KernelMteAddr = MteAddr;
1194	pThis->PsLoadedModuleListAddr = Addr;
1195	pThis->f32Bit = false;
1196	pThis->fNt31 = false;
1197	return true;
1198	}
1199	}
1200	else if (RT_SUCCESS(rc))
1201	{
1202	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1203	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1204	break; /* Not NT kernel */
1205	}
1206	}
1207
1208	/* next */
1209	DBGFR3AddrAdd(&HitAddr, 8);
1210	if (HitAddr.FlatPtr < uEnd)
1211	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1212	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1213	else
1214	rc = VERR_DBGF_MEM_NOT_FOUND;
1215	}
1216	}
1217	}
1218	}
1219	}
1220	return false;
1221	}
1222
1223
1224	/**
1225	* @copydoc DBGFOSREG::pfnDestruct
1226	*/
1227	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1228	{
1229	RT_NOREF2(pUVM, pvData);
1230	}
1231
1232
1233	/**
1234	* @copydoc DBGFOSREG::pfnConstruct
1235	*/
1236	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1237	{
1238	RT_NOREF1(pUVM);
1239	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1240	pThis->fValid = false;
1241	pThis->f32Bit = false;
1242	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1243	return VINF_SUCCESS;
1244	}
1245
1246
1247	const DBGFOSREG g_DBGDiggerWinNt =
1248	{
1249	/* .u32Magic = */ DBGFOSREG_MAGIC,
1250	/* .fFlags = */ 0,
1251	/* .cbData = */ sizeof(DBGDIGGERWINNT),
1252	/* .szName = */ "WinNT",
1253	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1254	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1255	/* .pfnProbe = */ dbgDiggerWinNtProbe,
1256	/* .pfnInit = */ dbgDiggerWinNtInit,
1257	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1258	/* .pfnTerm = */ dbgDiggerWinNtTerm,
1259	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1260	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1261	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1262	};
1263

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 73413

Download in other formats: