DBGPlugInWinNt.cpp@ 73416

Last change on this file since 73416 was 73416, checked in by vboxsync, 6 years ago
DBGPlugInWinNt: Use DBGFR3ModInMem.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 34.7 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 73416 2018-08-01 09:36:37Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/err.h>
26	#include <VBox/param.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/string.h>
31	#include <iprt/formats/pecoff.h>
32	#include <iprt/formats/mz.h>
33
34
35	/*********************************************************************************************************************************
36	* Structures and Typedefs *
37	*********************************************************************************************************************************/
38
39	/** @name Internal WinNT structures
40	* @{ */
41	/**
42	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
43	* Tested with XP.
44	*/
45	typedef struct NTMTE32
46	{
47	struct
48	{
49	uint32_t Flink;
50	uint32_t Blink;
51	} InLoadOrderLinks,
52	InMemoryOrderModuleList,
53	InInitializationOrderModuleList;
54	uint32_t DllBase;
55	uint32_t EntryPoint;
56	/** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
57	* boot loader, for other images it looks like some kind of pointer. */
58	uint32_t SizeOfImage;
59	struct
60	{
61	uint16_t Length;
62	uint16_t MaximumLength;
63	uint32_t Buffer;
64	} FullDllName,
65	BaseDllName;
66	uint32_t Flags;
67	uint16_t LoadCount;
68	uint16_t TlsIndex;
69	/* ... there is more ... */
70	} NTMTE32;
71	typedef NTMTE32 *PNTMTE32;
72
73	/**
74	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
75	*/
76	typedef struct NTMTE64
77	{
78	struct
79	{
80	uint64_t Flink;
81	uint64_t Blink;
82	} InLoadOrderLinks, /*< 0x00 /
83	InMemoryOrderModuleList, /*< 0x10 /
84	InInitializationOrderModuleList; /*< 0x20 /
85	uint64_t DllBase; /*< 0x30 /
86	uint64_t EntryPoint; /*< 0x38 /
87	uint32_t SizeOfImage; /*< 0x40 /
88	uint32_t Alignment; /*< 0x44 /
89	struct
90	{
91	uint16_t Length; /*< 0x48,0x58 /
92	uint16_t MaximumLength; /*< 0x4a,0x5a /
93	uint32_t Alignment; /*< 0x4c,0x5c /
94	uint64_t Buffer; /*< 0x50,0x60 /
95	} FullDllName, /*< 0x48 /
96	BaseDllName; /*< 0x58 /
97	uint32_t Flags; /*< 0x68 /
98	uint16_t LoadCount; /*< 0x6c /
99	uint16_t TlsIndex; /*< 0x6e /
100	/* ... there is more ... */
101	} NTMTE64;
102	typedef NTMTE64 *PNTMTE64;
103
104	/** MTE union. */
105	typedef union NTMTE
106	{
107	NTMTE32 vX_32;
108	NTMTE64 vX_64;
109	} NTMTE;
110	typedef NTMTE *PNTMTE;
111
112
113	/**
114	* The essential bits of the KUSER_SHARED_DATA structure.
115	*/
116	typedef struct NTKUSERSHAREDDATA
117	{
118	uint32_t TickCountLowDeprecated;
119	uint32_t TickCountMultiplier;
120	struct
121	{
122	uint32_t LowPart;
123	int32_t High1Time;
124	int32_t High2Time;
125
126	} InterruptTime,
127	SystemTime,
128	TimeZoneBias;
129	uint16_t ImageNumberLow;
130	uint16_t ImageNumberHigh;
131	RTUTF16 NtSystemRoot[260];
132	uint32_t MaxStackTraceDepth;
133	uint32_t CryptoExponent;
134	uint32_t TimeZoneId;
135	uint32_t LargePageMinimum;
136	uint32_t Reserved2[7];
137	uint32_t NtProductType;
138	uint8_t ProductTypeIsValid;
139	uint8_t abPadding[3];
140	uint32_t NtMajorVersion;
141	uint32_t NtMinorVersion;
142	/* uint8_t ProcessorFeatures[64];
143	...
144	*/
145	} NTKUSERSHAREDDATA;
146	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
147
148	/** KI_USER_SHARED_DATA for i386 */
149	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
150	/** KI_USER_SHARED_DATA for AMD64 */
151	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
152
153	/** NTKUSERSHAREDDATA::NtProductType */
154	typedef enum NTPRODUCTTYPE
155	{
156	kNtProductType_Invalid = 0,
157	kNtProductType_WinNt = 1,
158	kNtProductType_LanManNt,
159	kNtProductType_Server
160	} NTPRODUCTTYPE;
161
162
163	/** NT image header union. */
164	typedef union NTHDRSU
165	{
166	IMAGE_NT_HEADERS32 vX_32;
167	IMAGE_NT_HEADERS64 vX_64;
168	} NTHDRS;
169	/** Pointer to NT image header union. */
170	typedef NTHDRS *PNTHDRS;
171	/** Pointer to const NT image header union. */
172	typedef NTHDRS const *PCNTHDRS;
173
174	/** @} */
175
176
177
178	typedef enum DBGDIGGERWINNTVER
179	{
180	DBGDIGGERWINNTVER_UNKNOWN,
181	DBGDIGGERWINNTVER_3_1,
182	DBGDIGGERWINNTVER_3_5,
183	DBGDIGGERWINNTVER_4_0,
184	DBGDIGGERWINNTVER_5_0,
185	DBGDIGGERWINNTVER_5_1,
186	DBGDIGGERWINNTVER_6_0
187	} DBGDIGGERWINNTVER;
188
189	/**
190	* WinNT guest OS digger instance data.
191	*/
192	typedef struct DBGDIGGERWINNT
193	{
194	/** Whether the information is valid or not.
195	* (For fending off illegal interface method calls.) */
196	bool fValid;
197	/** 32-bit (true) or 64-bit (false) */
198	bool f32Bit;
199	/** Set if NT 3.1 was detected.
200	* This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
201	bool fNt31;
202
203	/** The NT version. */
204	DBGDIGGERWINNTVER enmVer;
205	/** NTKUSERSHAREDDATA::NtProductType */
206	NTPRODUCTTYPE NtProductType;
207	/** NTKUSERSHAREDDATA::NtMajorVersion */
208	uint32_t NtMajorVersion;
209	/** NTKUSERSHAREDDATA::NtMinorVersion */
210	uint32_t NtMinorVersion;
211
212	/** The address of the ntoskrnl.exe image. */
213	DBGFADDRESS KernelAddr;
214	/** The address of the ntoskrnl.exe module table entry. */
215	DBGFADDRESS KernelMteAddr;
216	/** The address of PsLoadedModuleList. */
217	DBGFADDRESS PsLoadedModuleListAddr;
218	} DBGDIGGERWINNT;
219	/** Pointer to the linux guest OS digger instance data. */
220	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
221
222
223	/**
224	* The WinNT digger's loader reader instance data.
225	*/
226	typedef struct DBGDIGGERWINNTRDR
227	{
228	/** The VM handle (referenced). */
229	PUVM pUVM;
230	/** The image base. */
231	DBGFADDRESS ImageAddr;
232	/** The image size. */
233	uint32_t cbImage;
234	/** The file offset of the SizeOfImage field in the optional header if it
235	* needs patching, otherwise set to UINT32_MAX. */
236	uint32_t offSizeOfImage;
237	/** The correct image size. */
238	uint32_t cbCorrectImageSize;
239	/** Number of entries in the aMappings table. */
240	uint32_t cMappings;
241	/** Mapping hint. */
242	uint32_t iHint;
243	/** Mapping file offset to memory offsets, ordered by file offset. */
244	struct
245	{
246	/** The file offset. */
247	uint32_t offFile;
248	/** The size of this mapping. */
249	uint32_t cbMem;
250	/** The offset to the memory from the start of the image. */
251	uint32_t offMem;
252	} aMappings[1];
253	} DBGDIGGERWINNTRDR;
254	/** Pointer a WinNT loader reader instance data. */
255	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
256
257
258	/*********************************************************************************************************************************
259	* Defined Constants And Macros *
260	*********************************************************************************************************************************/
261	/** Validates a 32-bit Windows NT kernel address */
262	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
263	/** Validates a 64-bit Windows NT kernel address */
264	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
265	/** Validates a kernel address. */
266	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
267	/** Versioned and bitness wrapper. */
268	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
269
270	/** The length (in chars) of the kernel file name (no path). */
271	#define WINNT_KERNEL_BASE_NAME_LEN 12
272
273	/** WindowsNT on little endian ASCII systems. */
274	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
275
276
277	/*********************************************************************************************************************************
278	* Internal Functions *
279	*********************************************************************************************************************************/
280	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
281
282
283	/*********************************************************************************************************************************
284	* Global Variables *
285	*********************************************************************************************************************************/
286	/** Kernel names. */
287	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
288	{
289	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
290	};
291
292
293
294	/**
295	* Process a PE image found in guest memory.
296	*
297	* @param pThis The instance data.
298	* @param pUVM The user mode VM handle.
299	* @param pszName The image name.
300	* @param pImageAddr The image address.
301	* @param cbImage The size of the image.
302	* @param pbBuf Scratch buffer containing the first
303	* RT_MIN(cbBuf, cbImage) bytes of the image.
304	* @param cbBuf The scratch buffer size.
305	*/
306	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
307	PCDBGFADDRESS pImageAddr, uint32_t cbImage)
308	{
309	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
310
311	/*
312	* Do some basic validation first.
313	*/
314	if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
315	\|\| cbImage >= _1M * 256)
316	{
317	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
318	return;
319	}
320
321	/*
322	* Use the common in-memory module reader to create a debug module.
323	*/
324	RTERRINFOSTATIC ErrInfo;
325	RTDBGMOD hDbgMod = NIL_RTDBGMOD;
326	int rc = DBGFR3ModInMem(pUVM, pImageAddr, pThis->fNt31 ? DBGFMODINMEM_F_PE_NT31 : 0, pszName,
327	pThis->f32Bit ? RTLDRARCH_X86_32 : RTLDRARCH_AMD64, cbImage,
328	&hDbgMod, RTErrInfoInitStatic(&ErrInfo));
329	if (RT_SUCCESS(rc))
330	{
331	/*
332	* Tag the module.
333	*/
334	rc = RTDbgModSetTag(hDbgMod, DIG_WINNT_MOD_TAG);
335	AssertRC(rc);
336
337	/*
338	* Link the module.
339	*/
340	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
341	if (hAs != NIL_RTDBGAS)
342	rc = RTDbgAsModuleLink(hAs, hDbgMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
343	else
344	rc = VERR_INTERNAL_ERROR;
345	RTDbgModRelease(hDbgMod);
346	RTDbgAsRelease(hAs);
347	}
348	else if (RTErrInfoIsSet(&ErrInfo.Core))
349	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc - %s\n", pszName, rc, ErrInfo.Core.pszMsg));
350	else
351	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc\n", pszName, rc));
352	}
353
354
355	/**
356	* @copydoc DBGFOSREG::pfnQueryInterface
357	*/
358	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
359	{
360	RT_NOREF3(pUVM, pvData, enmIf);
361	return NULL;
362	}
363
364
365	/**
366	* @copydoc DBGFOSREG::pfnQueryVersion
367	*/
368	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
369	{
370	RT_NOREF1(pUVM);
371	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
372	Assert(pThis->fValid);
373	const char *pszNtProductType;
374	switch (pThis->NtProductType)
375	{
376	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
377	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
378	case kNtProductType_Server: pszNtProductType = "-Server"; break;
379	default: pszNtProductType = ""; break;
380	}
381	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
382	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
383	return VINF_SUCCESS;
384	}
385
386
387	/**
388	* @copydoc DBGFOSREG::pfnTerm
389	*/
390	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
391	{
392	RT_NOREF1(pUVM);
393	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
394	Assert(pThis->fValid);
395
396	/*
397	* As long as we're using our private LDR reader implementation,
398	* we must unlink and ditch the modules we created.
399	*/
400	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
401	if (hDbgAs != NIL_RTDBGAS)
402	{
403	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
404	while (iMod-- > 0)
405	{
406	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
407	if (hMod != NIL_RTDBGMOD)
408	{
409	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
410	{
411	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
412	AssertRC(rc);
413	}
414	RTDbgModRelease(hMod);
415	}
416	}
417	RTDbgAsRelease(hDbgAs);
418	}
419
420	pThis->fValid = false;
421	}
422
423
424	/**
425	* @copydoc DBGFOSREG::pfnRefresh
426	*/
427	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
428	{
429	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
430	NOREF(pThis);
431	Assert(pThis->fValid);
432
433	/*
434	* For now we'll flush and reload everything.
435	*/
436	dbgDiggerWinNtTerm(pUVM, pvData);
437
438	return dbgDiggerWinNtInit(pUVM, pvData);
439	}
440
441
442	/**
443	* @copydoc DBGFOSREG::pfnInit
444	*/
445	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
446	{
447	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
448	Assert(!pThis->fValid);
449
450	union
451	{
452	uint8_t au8[0x2000];
453	RTUTF16 wsz[0x2000/2];
454	NTKUSERSHAREDDATA UserSharedData;
455	} u;
456	DBGFADDRESS Addr;
457	int rc;
458
459	/*
460	* Figure the NT version.
461	*/
462	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
463	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
464	if (RT_SUCCESS(rc))
465	{
466	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
467	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
468	: kNtProductType_Invalid;
469	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
470	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
471	}
472	else if (pThis->fNt31)
473	{
474	pThis->NtProductType = kNtProductType_WinNt;
475	pThis->NtMajorVersion = 3;
476	pThis->NtMinorVersion = 1;
477	}
478	else
479	{
480	Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
481	return rc;
482	}
483
484	/*
485	* Dig out the module chain.
486	*/
487	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
488	Addr = pThis->KernelMteAddr;
489	do
490	{
491	/* Read the validate the MTE. */
492	NTMTE Mte;
493	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
494	if (RT_FAILURE(rc))
495	break;
496	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
497	{
498	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
499	break;
500	}
501	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
502	{
503	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
504	break;
505	}
506	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
507	{
508	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
509	break;
510	}
511	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
512	{
513	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
514	break;
515	}
516	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
517	{
518	Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
519	break;
520	}
521
522	uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
523	if ( !pThis->fNt31
524	&& ( cbImageMte > _256M
525	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
526	{
527	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
528	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
529	break;
530	}
531
532	/* Read the full name. */
533	DBGFADDRESS AddrName;
534	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
535	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
536	if (cbName < sizeof(u))
537	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
538	else
539	rc = VERR_OUT_OF_RANGE;
540	if (RT_FAILURE(rc))
541	{
542	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
543	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
544	if (cbName < sizeof(u))
545	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
546	else
547	rc = VERR_OUT_OF_RANGE;
548	}
549	if (RT_SUCCESS(rc))
550	{
551	u.wsz[cbName / 2] = '\0';
552
553	char *pszName;
554	rc = RTUtf16ToUtf8(u.wsz, &pszName);
555	if (RT_SUCCESS(rc))
556	{
557	/* Read the start of the PE image and pass it along to a worker. */
558	DBGFADDRESS ImageAddr;
559	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
560	dbgDiggerWinNtProcessImage(pThis, pUVM, pszName, &ImageAddr, cbImageMte);
561	RTStrFree(pszName);
562	}
563	}
564
565	/* next */
566	AddrPrev = Addr;
567	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
568	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
569	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
570
571	pThis->fValid = true;
572	return VINF_SUCCESS;
573	}
574
575
576	/**
577	* @copydoc DBGFOSREG::pfnProbe
578	*/
579	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
580	{
581	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
582	DBGFADDRESS Addr;
583	union
584	{
585	uint8_t au8[8192];
586	uint16_t au16[8192/2];
587	uint32_t au32[8192/4];
588	IMAGE_DOS_HEADER MzHdr;
589	RTUTF16 wsz[8192/2];
590	} u;
591
592	union
593	{
594	NTMTE32 v32;
595	NTMTE64 v64;
596	} uMte, uMte2, uMte3;
597
598	/*
599	* Look for the PAGELK section name that seems to be a part of all kernels.
600	* Then try find the module table entry for it. Since it's the first entry
601	* in the PsLoadedModuleList we can easily validate the list head and report
602	* success.
603	*
604	* Note! We ASSUME the section name is 8 byte aligned.
605	*/
606	CPUMMODE enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
607	uint64_t const uStart = enmMode == CPUMMODE_LONG ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
608	uint64_t const uEnd = enmMode == CPUMMODE_LONG ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
609	DBGFADDRESS KernelAddr;
610	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uStart);
611	KernelAddr.FlatPtr < uEnd;
612	KernelAddr.FlatPtr += PAGE_SIZE)
613	{
614	bool fNt31 = false;
615	DBGFADDRESS const RetryAddress = KernelAddr;
616	int rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
617	8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
618	if ( rc == VERR_DBGF_MEM_NOT_FOUND
619	&& enmMode != CPUMMODE_LONG)
620	{
621	/* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
622	following VirtualSize is zero, so check for that too. */
623	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
624	8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
625	fNt31 = true;
626	}
627	if (RT_FAILURE(rc))
628	break;
629	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
630
631	/* MZ + PE header. */
632	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
633	if ( RT_SUCCESS(rc)
634	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
635	&& !(u.MzHdr.e_lfanew & 0x7)
636	&& u.MzHdr.e_lfanew >= 0x080
637	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
638	{
639	if (enmMode != CPUMMODE_LONG)
640	{
641	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
642	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
643	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
644	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
645	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
646	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
647	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
648	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
649	)
650	{
651	/* Find the MTE. */
652	RT_ZERO(uMte);
653	uMte.v32.DllBase = KernelAddr.FlatPtr;
654	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
655	uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
656	DBGFADDRESS HitAddr;
657	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
658	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
659	while (RT_SUCCESS(rc))
660	{
661	/* check the name. */
662	DBGFADDRESS MteAddr = HitAddr;
663	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
664	&uMte2.v32, sizeof(uMte2.v32));
665	if ( RT_SUCCESS(rc)
666	&& uMte2.v32.DllBase == uMte.v32.DllBase
667	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
668	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
669	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
670	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
671	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
672	&& uMte2.v32.BaseDllName.Length <= 128
673	&& uMte2.v32.FullDllName.Length <= 260
674	)
675	{
676	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
677	u.wsz, uMte2.v32.BaseDllName.Length);
678	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
679	if ( RT_SUCCESS(rc)
680	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
681	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
682	)
683	)
684	{
685	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
686	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
687	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
688	if ( RT_SUCCESS(rc)
689	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
690	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
691	{
692	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
693	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
694	pThis->KernelAddr = KernelAddr;
695	pThis->KernelMteAddr = MteAddr;
696	pThis->PsLoadedModuleListAddr = Addr;
697	pThis->f32Bit = true;
698	pThis->fNt31 = fNt31;
699	return true;
700	}
701	}
702	else if (RT_SUCCESS(rc))
703	{
704	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
705	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
706	break; /* Not NT kernel */
707	}
708	}
709
710	/* next */
711	DBGFR3AddrAdd(&HitAddr, 4);
712	if (HitAddr.FlatPtr < uEnd)
713	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
714	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
715	else
716	rc = VERR_DBGF_MEM_NOT_FOUND;
717	}
718	}
719	}
720	else
721	{
722	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
723	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
724	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
725	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
726	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
727	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
728	== IMAGE_FILE_EXECUTABLE_IMAGE
729	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
730	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
731	)
732	{
733	/* Find the MTE. */
734	RT_ZERO(uMte.v64);
735	uMte.v64.DllBase = KernelAddr.FlatPtr;
736	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
737	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
738	DBGFADDRESS ScanAddr;
739	DBGFADDRESS HitAddr;
740	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
741	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
742	while (RT_SUCCESS(rc))
743	{
744	/* Read the start of the MTE and check some basic members. */
745	DBGFADDRESS MteAddr = HitAddr;
746	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
747	&uMte2.v64, sizeof(uMte2.v64));
748	if ( RT_SUCCESS(rc)
749	&& uMte2.v64.DllBase == uMte.v64.DllBase
750	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
751	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
752	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
753	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
754	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
755	&& uMte2.v64.BaseDllName.Length <= 128
756	&& uMte2.v64.FullDllName.Length <= 260
757	)
758	{
759	/* Try read the base name and compare with known NT kernel names. */
760	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
761	u.wsz, uMte2.v64.BaseDllName.Length);
762	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
763	if ( RT_SUCCESS(rc)
764	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
765	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
766	)
767	)
768	{
769	/* Read the link entry of the previous entry in the list and check that its
770	forward pointer points at the MTE we've found. */
771	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
772	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
773	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
774	if ( RT_SUCCESS(rc)
775	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
776	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
777	{
778	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
779	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
780	pThis->KernelAddr = KernelAddr;
781	pThis->KernelMteAddr = MteAddr;
782	pThis->PsLoadedModuleListAddr = Addr;
783	pThis->f32Bit = false;
784	pThis->fNt31 = false;
785	return true;
786	}
787	}
788	else if (RT_SUCCESS(rc))
789	{
790	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
791	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
792	break; /* Not NT kernel */
793	}
794	}
795
796	/* next */
797	DBGFR3AddrAdd(&HitAddr, 8);
798	if (HitAddr.FlatPtr < uEnd)
799	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
800	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
801	else
802	rc = VERR_DBGF_MEM_NOT_FOUND;
803	}
804	}
805	}
806	}
807	}
808	return false;
809	}
810
811
812	/**
813	* @copydoc DBGFOSREG::pfnDestruct
814	*/
815	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
816	{
817	RT_NOREF2(pUVM, pvData);
818	}
819
820
821	/**
822	* @copydoc DBGFOSREG::pfnConstruct
823	*/
824	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
825	{
826	RT_NOREF1(pUVM);
827	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
828	pThis->fValid = false;
829	pThis->f32Bit = false;
830	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
831	return VINF_SUCCESS;
832	}
833
834
835	const DBGFOSREG g_DBGDiggerWinNt =
836	{
837	/* .u32Magic = */ DBGFOSREG_MAGIC,
838	/* .fFlags = */ 0,
839	/* .cbData = */ sizeof(DBGDIGGERWINNT),
840	/* .szName = */ "WinNT",
841	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
842	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
843	/* .pfnProbe = */ dbgDiggerWinNtProbe,
844	/* .pfnInit = */ dbgDiggerWinNtInit,
845	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
846	/* .pfnTerm = */ dbgDiggerWinNtTerm,
847	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
848	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
849	/* .u32EndMagic = */ DBGFOSREG_MAGIC
850	};
851

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 73416

Download in other formats: