DBGPlugInWinNt.cpp@ 73418

Last change on this file since 73418 was 73418, checked in by vboxsync, 6 years ago
DBGPlugInWinNt: Use the IDT[PF] handler to locate the NT kernel.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 36.5 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 73418 2018-08-01 11:10:29Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/err.h>
26	#include <VBox/param.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/string.h>
31	#include <iprt/formats/pecoff.h>
32	#include <iprt/formats/mz.h>
33
34
35	/*********************************************************************************************************************************
36	* Structures and Typedefs *
37	*********************************************************************************************************************************/
38
39	/** @name Internal WinNT structures
40	* @{ */
41	/**
42	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
43	* Tested with XP.
44	*/
45	typedef struct NTMTE32
46	{
47	struct
48	{
49	uint32_t Flink;
50	uint32_t Blink;
51	} InLoadOrderLinks,
52	InMemoryOrderModuleList,
53	InInitializationOrderModuleList;
54	uint32_t DllBase;
55	uint32_t EntryPoint;
56	/** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
57	* boot loader, for other images it looks like some kind of pointer. */
58	uint32_t SizeOfImage;
59	struct
60	{
61	uint16_t Length;
62	uint16_t MaximumLength;
63	uint32_t Buffer;
64	} FullDllName,
65	BaseDllName;
66	uint32_t Flags;
67	uint16_t LoadCount;
68	uint16_t TlsIndex;
69	/* ... there is more ... */
70	} NTMTE32;
71	typedef NTMTE32 *PNTMTE32;
72
73	/**
74	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
75	*/
76	typedef struct NTMTE64
77	{
78	struct
79	{
80	uint64_t Flink;
81	uint64_t Blink;
82	} InLoadOrderLinks, /*< 0x00 /
83	InMemoryOrderModuleList, /*< 0x10 /
84	InInitializationOrderModuleList; /*< 0x20 /
85	uint64_t DllBase; /*< 0x30 /
86	uint64_t EntryPoint; /*< 0x38 /
87	uint32_t SizeOfImage; /*< 0x40 /
88	uint32_t Alignment; /*< 0x44 /
89	struct
90	{
91	uint16_t Length; /*< 0x48,0x58 /
92	uint16_t MaximumLength; /*< 0x4a,0x5a /
93	uint32_t Alignment; /*< 0x4c,0x5c /
94	uint64_t Buffer; /*< 0x50,0x60 /
95	} FullDllName, /*< 0x48 /
96	BaseDllName; /*< 0x58 /
97	uint32_t Flags; /*< 0x68 /
98	uint16_t LoadCount; /*< 0x6c /
99	uint16_t TlsIndex; /*< 0x6e /
100	/* ... there is more ... */
101	} NTMTE64;
102	typedef NTMTE64 *PNTMTE64;
103
104	/** MTE union. */
105	typedef union NTMTE
106	{
107	NTMTE32 vX_32;
108	NTMTE64 vX_64;
109	} NTMTE;
110	typedef NTMTE *PNTMTE;
111
112
113	/**
114	* The essential bits of the KUSER_SHARED_DATA structure.
115	*/
116	typedef struct NTKUSERSHAREDDATA
117	{
118	uint32_t TickCountLowDeprecated;
119	uint32_t TickCountMultiplier;
120	struct
121	{
122	uint32_t LowPart;
123	int32_t High1Time;
124	int32_t High2Time;
125
126	} InterruptTime,
127	SystemTime,
128	TimeZoneBias;
129	uint16_t ImageNumberLow;
130	uint16_t ImageNumberHigh;
131	RTUTF16 NtSystemRoot[260];
132	uint32_t MaxStackTraceDepth;
133	uint32_t CryptoExponent;
134	uint32_t TimeZoneId;
135	uint32_t LargePageMinimum;
136	uint32_t Reserved2[7];
137	uint32_t NtProductType;
138	uint8_t ProductTypeIsValid;
139	uint8_t abPadding[3];
140	uint32_t NtMajorVersion;
141	uint32_t NtMinorVersion;
142	/* uint8_t ProcessorFeatures[64];
143	...
144	*/
145	} NTKUSERSHAREDDATA;
146	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
147
148	/** KI_USER_SHARED_DATA for i386 */
149	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
150	/** KI_USER_SHARED_DATA for AMD64 */
151	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
152
153	/** NTKUSERSHAREDDATA::NtProductType */
154	typedef enum NTPRODUCTTYPE
155	{
156	kNtProductType_Invalid = 0,
157	kNtProductType_WinNt = 1,
158	kNtProductType_LanManNt,
159	kNtProductType_Server
160	} NTPRODUCTTYPE;
161
162
163	/** NT image header union. */
164	typedef union NTHDRSU
165	{
166	IMAGE_NT_HEADERS32 vX_32;
167	IMAGE_NT_HEADERS64 vX_64;
168	} NTHDRS;
169	/** Pointer to NT image header union. */
170	typedef NTHDRS *PNTHDRS;
171	/** Pointer to const NT image header union. */
172	typedef NTHDRS const *PCNTHDRS;
173
174	/** @} */
175
176
177
178	typedef enum DBGDIGGERWINNTVER
179	{
180	DBGDIGGERWINNTVER_UNKNOWN,
181	DBGDIGGERWINNTVER_3_1,
182	DBGDIGGERWINNTVER_3_5,
183	DBGDIGGERWINNTVER_4_0,
184	DBGDIGGERWINNTVER_5_0,
185	DBGDIGGERWINNTVER_5_1,
186	DBGDIGGERWINNTVER_6_0
187	} DBGDIGGERWINNTVER;
188
189	/**
190	* WinNT guest OS digger instance data.
191	*/
192	typedef struct DBGDIGGERWINNT
193	{
194	/** Whether the information is valid or not.
195	* (For fending off illegal interface method calls.) */
196	bool fValid;
197	/** 32-bit (true) or 64-bit (false) */
198	bool f32Bit;
199	/** Set if NT 3.1 was detected.
200	* This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
201	bool fNt31;
202
203	/** The NT version. */
204	DBGDIGGERWINNTVER enmVer;
205	/** NTKUSERSHAREDDATA::NtProductType */
206	NTPRODUCTTYPE NtProductType;
207	/** NTKUSERSHAREDDATA::NtMajorVersion */
208	uint32_t NtMajorVersion;
209	/** NTKUSERSHAREDDATA::NtMinorVersion */
210	uint32_t NtMinorVersion;
211
212	/** The address of the ntoskrnl.exe image. */
213	DBGFADDRESS KernelAddr;
214	/** The address of the ntoskrnl.exe module table entry. */
215	DBGFADDRESS KernelMteAddr;
216	/** The address of PsLoadedModuleList. */
217	DBGFADDRESS PsLoadedModuleListAddr;
218	} DBGDIGGERWINNT;
219	/** Pointer to the linux guest OS digger instance data. */
220	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
221
222
223	/**
224	* The WinNT digger's loader reader instance data.
225	*/
226	typedef struct DBGDIGGERWINNTRDR
227	{
228	/** The VM handle (referenced). */
229	PUVM pUVM;
230	/** The image base. */
231	DBGFADDRESS ImageAddr;
232	/** The image size. */
233	uint32_t cbImage;
234	/** The file offset of the SizeOfImage field in the optional header if it
235	* needs patching, otherwise set to UINT32_MAX. */
236	uint32_t offSizeOfImage;
237	/** The correct image size. */
238	uint32_t cbCorrectImageSize;
239	/** Number of entries in the aMappings table. */
240	uint32_t cMappings;
241	/** Mapping hint. */
242	uint32_t iHint;
243	/** Mapping file offset to memory offsets, ordered by file offset. */
244	struct
245	{
246	/** The file offset. */
247	uint32_t offFile;
248	/** The size of this mapping. */
249	uint32_t cbMem;
250	/** The offset to the memory from the start of the image. */
251	uint32_t offMem;
252	} aMappings[1];
253	} DBGDIGGERWINNTRDR;
254	/** Pointer a WinNT loader reader instance data. */
255	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
256
257
258	/*********************************************************************************************************************************
259	* Defined Constants And Macros *
260	*********************************************************************************************************************************/
261	/** Validates a 32-bit Windows NT kernel address */
262	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
263	/** Validates a 64-bit Windows NT kernel address */
264	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
265	/** Validates a kernel address. */
266	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
267	/** Versioned and bitness wrapper. */
268	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
269
270	/** The length (in chars) of the kernel file name (no path). */
271	#define WINNT_KERNEL_BASE_NAME_LEN 12
272
273	/** WindowsNT on little endian ASCII systems. */
274	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
275
276
277	/*********************************************************************************************************************************
278	* Internal Functions *
279	*********************************************************************************************************************************/
280	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
281
282
283	/*********************************************************************************************************************************
284	* Global Variables *
285	*********************************************************************************************************************************/
286	/** Kernel names. */
287	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
288	{
289	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
290	};
291
292
293
294	/**
295	* Process a PE image found in guest memory.
296	*
297	* @param pThis The instance data.
298	* @param pUVM The user mode VM handle.
299	* @param pszName The image name.
300	* @param pImageAddr The image address.
301	* @param cbImage The size of the image.
302	* @param pbBuf Scratch buffer containing the first
303	* RT_MIN(cbBuf, cbImage) bytes of the image.
304	* @param cbBuf The scratch buffer size.
305	*/
306	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
307	PCDBGFADDRESS pImageAddr, uint32_t cbImage)
308	{
309	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
310
311	/*
312	* Do some basic validation first.
313	*/
314	if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
315	\|\| cbImage >= _1M * 256)
316	{
317	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
318	return;
319	}
320
321	/*
322	* Use the common in-memory module reader to create a debug module.
323	*/
324	RTERRINFOSTATIC ErrInfo;
325	RTDBGMOD hDbgMod = NIL_RTDBGMOD;
326	int rc = DBGFR3ModInMem(pUVM, pImageAddr, pThis->fNt31 ? DBGFMODINMEM_F_PE_NT31 : 0, pszName,
327	pThis->f32Bit ? RTLDRARCH_X86_32 : RTLDRARCH_AMD64, cbImage,
328	&hDbgMod, RTErrInfoInitStatic(&ErrInfo));
329	if (RT_SUCCESS(rc))
330	{
331	/*
332	* Tag the module.
333	*/
334	rc = RTDbgModSetTag(hDbgMod, DIG_WINNT_MOD_TAG);
335	AssertRC(rc);
336
337	/*
338	* Link the module.
339	*/
340	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
341	if (hAs != NIL_RTDBGAS)
342	rc = RTDbgAsModuleLink(hAs, hDbgMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
343	else
344	rc = VERR_INTERNAL_ERROR;
345	RTDbgModRelease(hDbgMod);
346	RTDbgAsRelease(hAs);
347	}
348	else if (RTErrInfoIsSet(&ErrInfo.Core))
349	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc - %s\n", pszName, rc, ErrInfo.Core.pszMsg));
350	else
351	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc\n", pszName, rc));
352	}
353
354
355	/**
356	* @copydoc DBGFOSREG::pfnQueryInterface
357	*/
358	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
359	{
360	RT_NOREF3(pUVM, pvData, enmIf);
361	return NULL;
362	}
363
364
365	/**
366	* @copydoc DBGFOSREG::pfnQueryVersion
367	*/
368	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
369	{
370	RT_NOREF1(pUVM);
371	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
372	Assert(pThis->fValid);
373	const char *pszNtProductType;
374	switch (pThis->NtProductType)
375	{
376	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
377	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
378	case kNtProductType_Server: pszNtProductType = "-Server"; break;
379	default: pszNtProductType = ""; break;
380	}
381	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
382	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
383	return VINF_SUCCESS;
384	}
385
386
387	/**
388	* @copydoc DBGFOSREG::pfnTerm
389	*/
390	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
391	{
392	RT_NOREF1(pUVM);
393	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
394	Assert(pThis->fValid);
395
396	/*
397	* As long as we're using our private LDR reader implementation,
398	* we must unlink and ditch the modules we created.
399	*/
400	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
401	if (hDbgAs != NIL_RTDBGAS)
402	{
403	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
404	while (iMod-- > 0)
405	{
406	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
407	if (hMod != NIL_RTDBGMOD)
408	{
409	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
410	{
411	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
412	AssertRC(rc);
413	}
414	RTDbgModRelease(hMod);
415	}
416	}
417	RTDbgAsRelease(hDbgAs);
418	}
419
420	pThis->fValid = false;
421	}
422
423
424	/**
425	* @copydoc DBGFOSREG::pfnRefresh
426	*/
427	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
428	{
429	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
430	NOREF(pThis);
431	Assert(pThis->fValid);
432
433	/*
434	* For now we'll flush and reload everything.
435	*/
436	dbgDiggerWinNtTerm(pUVM, pvData);
437
438	return dbgDiggerWinNtInit(pUVM, pvData);
439	}
440
441
442	/**
443	* @copydoc DBGFOSREG::pfnInit
444	*/
445	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
446	{
447	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
448	Assert(!pThis->fValid);
449
450	union
451	{
452	uint8_t au8[0x2000];
453	RTUTF16 wsz[0x2000/2];
454	NTKUSERSHAREDDATA UserSharedData;
455	} u;
456	DBGFADDRESS Addr;
457	int rc;
458
459	/*
460	* Figure the NT version.
461	*/
462	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
463	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
464	if (RT_SUCCESS(rc))
465	{
466	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
467	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
468	: kNtProductType_Invalid;
469	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
470	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
471	}
472	else if (pThis->fNt31)
473	{
474	pThis->NtProductType = kNtProductType_WinNt;
475	pThis->NtMajorVersion = 3;
476	pThis->NtMinorVersion = 1;
477	}
478	else
479	{
480	Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
481	return rc;
482	}
483
484	/*
485	* Dig out the module chain.
486	*/
487	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
488	Addr = pThis->KernelMteAddr;
489	do
490	{
491	/* Read the validate the MTE. */
492	NTMTE Mte;
493	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
494	if (RT_FAILURE(rc))
495	break;
496	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
497	{
498	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
499	break;
500	}
501	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
502	{
503	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
504	break;
505	}
506	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
507	{
508	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
509	break;
510	}
511	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
512	{
513	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
514	break;
515	}
516	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
517	{
518	Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
519	break;
520	}
521
522	uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
523	if ( !pThis->fNt31
524	&& ( cbImageMte > _256M
525	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
526	{
527	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
528	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
529	break;
530	}
531
532	/* Read the full name. */
533	DBGFADDRESS AddrName;
534	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
535	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
536	if (cbName < sizeof(u))
537	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
538	else
539	rc = VERR_OUT_OF_RANGE;
540	if (RT_FAILURE(rc))
541	{
542	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
543	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
544	if (cbName < sizeof(u))
545	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
546	else
547	rc = VERR_OUT_OF_RANGE;
548	}
549	if (RT_SUCCESS(rc))
550	{
551	u.wsz[cbName / 2] = '\0';
552
553	char *pszName;
554	rc = RTUtf16ToUtf8(u.wsz, &pszName);
555	if (RT_SUCCESS(rc))
556	{
557	/* Read the start of the PE image and pass it along to a worker. */
558	DBGFADDRESS ImageAddr;
559	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
560	dbgDiggerWinNtProcessImage(pThis, pUVM, pszName, &ImageAddr, cbImageMte);
561	RTStrFree(pszName);
562	}
563	}
564
565	/* next */
566	AddrPrev = Addr;
567	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
568	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
569	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
570
571	pThis->fValid = true;
572	return VINF_SUCCESS;
573	}
574
575
576	/**
577	* @copydoc DBGFOSREG::pfnProbe
578	*/
579	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
580	{
581	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
582	DBGFADDRESS Addr;
583	union
584	{
585	uint8_t au8[8192];
586	uint16_t au16[8192/2];
587	uint32_t au32[8192/4];
588	IMAGE_DOS_HEADER MzHdr;
589	RTUTF16 wsz[8192/2];
590	X86DESC64GATE a32Gates[X86_XCPT_PF + 1];
591	X86DESC64GATE a64Gates[X86_XCPT_PF + 1];
592	} u;
593
594	union
595	{
596	NTMTE32 v32;
597	NTMTE64 v64;
598	} uMte, uMte2, uMte3;
599
600	/*
601	* NT only runs in protected or long mode.
602	*/
603	CPUMMODE const enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
604	if (enmMode != CPUMMODE_PROTECTED && enmMode != CPUMMODE_LONG)
605	return false;
606	bool const f64Bit = enmMode == CPUMMODE_LONG;
607	uint64_t const uStart = f64Bit ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
608	uint64_t const uEnd = f64Bit ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
609
610	/*
611	* To approximately locate the kernel we examine the IDTR handlers.
612	*
613	* The exception/trap/fault handlers are all in NT kernel image, we pick
614	* KiPageFault here.
615	*/
616	uint64_t uIdtrBase = 0;
617	uint16_t uIdtrLimit = 0;
618	int rc = DBGFR3RegCpuQueryXdtr(pUVM, 0, DBGFREG_IDTR, &uIdtrBase, &uIdtrLimit);
619	AssertRCReturn(rc, false);
620
621	const uint16_t cbMinIdtr = (X86_XCPT_PF + 1) * (f64Bit ? sizeof(X86DESC64GATE) : sizeof(X86DESCGATE));
622	if (uIdtrLimit < cbMinIdtr)
623	return false;
624
625	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uIdtrBase), &u, cbMinIdtr);
626	if (RT_FAILURE(rc))
627	return false;
628
629	uint64_t uKrnlStart = uStart;
630	uint64_t uKrnlEnd = uEnd;
631	if (f64Bit)
632	{
633	uint64_t uHandler = u.a64Gates[X86_XCPT_PF].u16OffsetLow
634	\| ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16)
635	\| ((uint64_t)u.a64Gates[X86_XCPT_PF].u32OffsetTop << 32);
636	if (uHandler < uStart \|\| uHandler > uEnd)
637	return false;
638	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _512M;
639	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
640	}
641	else
642	{
643	uint32_t uHandler = u.a32Gates[X86_XCPT_PF].u16OffsetLow
644	\| ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16);
645	if (uHandler < uStart \|\| uHandler > uEnd)
646	return false;
647	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _64M;
648	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
649	}
650
651	/*
652	* Look for the PAGELK section name that seems to be a part of all kernels.
653	* Then try find the module table entry for it. Since it's the first entry
654	* in the PsLoadedModuleList we can easily validate the list head and report
655	* success.
656	*
657	* Note! We ASSUME the section name is 8 byte aligned.
658	*/
659	DBGFADDRESS KernelAddr;
660	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uKrnlStart);
661	KernelAddr.FlatPtr < uKrnlEnd;
662	KernelAddr.FlatPtr += PAGE_SIZE)
663	{
664	bool fNt31 = false;
665	DBGFADDRESS const RetryAddress = KernelAddr;
666	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
667	8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
668	if ( rc == VERR_DBGF_MEM_NOT_FOUND
669	&& enmMode != CPUMMODE_LONG)
670	{
671	/* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
672	following VirtualSize is zero, so check for that too. */
673	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
674	8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
675	fNt31 = true;
676	}
677	if (RT_FAILURE(rc))
678	break;
679	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
680
681	/* MZ + PE header. */
682	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
683	if ( RT_SUCCESS(rc)
684	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
685	&& !(u.MzHdr.e_lfanew & 0x7)
686	&& u.MzHdr.e_lfanew >= 0x080
687	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
688	{
689	if (enmMode != CPUMMODE_LONG)
690	{
691	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
692	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
693	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
694	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
695	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
696	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
697	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
698	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
699	)
700	{
701	/* Find the MTE. */
702	RT_ZERO(uMte);
703	uMte.v32.DllBase = KernelAddr.FlatPtr;
704	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
705	uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
706	DBGFADDRESS HitAddr;
707	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
708	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
709	while (RT_SUCCESS(rc))
710	{
711	/* check the name. */
712	DBGFADDRESS MteAddr = HitAddr;
713	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
714	&uMte2.v32, sizeof(uMte2.v32));
715	if ( RT_SUCCESS(rc)
716	&& uMte2.v32.DllBase == uMte.v32.DllBase
717	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
718	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
719	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
720	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
721	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
722	&& uMte2.v32.BaseDllName.Length <= 128
723	&& uMte2.v32.FullDllName.Length <= 260
724	)
725	{
726	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
727	u.wsz, uMte2.v32.BaseDllName.Length);
728	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
729	if ( RT_SUCCESS(rc)
730	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
731	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
732	)
733	)
734	{
735	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
736	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
737	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
738	if ( RT_SUCCESS(rc)
739	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
740	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
741	{
742	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
743	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
744	pThis->KernelAddr = KernelAddr;
745	pThis->KernelMteAddr = MteAddr;
746	pThis->PsLoadedModuleListAddr = Addr;
747	pThis->f32Bit = true;
748	pThis->fNt31 = fNt31;
749	return true;
750	}
751	}
752	else if (RT_SUCCESS(rc))
753	{
754	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
755	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
756	break; /* Not NT kernel */
757	}
758	}
759
760	/* next */
761	DBGFR3AddrAdd(&HitAddr, 4);
762	if (HitAddr.FlatPtr < uEnd)
763	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
764	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
765	else
766	rc = VERR_DBGF_MEM_NOT_FOUND;
767	}
768	}
769	}
770	else
771	{
772	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
773	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
774	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
775	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
776	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
777	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
778	== IMAGE_FILE_EXECUTABLE_IMAGE
779	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
780	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
781	)
782	{
783	/* Find the MTE. */
784	RT_ZERO(uMte.v64);
785	uMte.v64.DllBase = KernelAddr.FlatPtr;
786	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
787	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
788	DBGFADDRESS ScanAddr;
789	DBGFADDRESS HitAddr;
790	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
791	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
792	while (RT_SUCCESS(rc))
793	{
794	/* Read the start of the MTE and check some basic members. */
795	DBGFADDRESS MteAddr = HitAddr;
796	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
797	&uMte2.v64, sizeof(uMte2.v64));
798	if ( RT_SUCCESS(rc)
799	&& uMte2.v64.DllBase == uMte.v64.DllBase
800	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
801	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
802	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
803	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
804	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
805	&& uMte2.v64.BaseDllName.Length <= 128
806	&& uMte2.v64.FullDllName.Length <= 260
807	)
808	{
809	/* Try read the base name and compare with known NT kernel names. */
810	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
811	u.wsz, uMte2.v64.BaseDllName.Length);
812	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
813	if ( RT_SUCCESS(rc)
814	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
815	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
816	)
817	)
818	{
819	/* Read the link entry of the previous entry in the list and check that its
820	forward pointer points at the MTE we've found. */
821	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
822	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
823	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
824	if ( RT_SUCCESS(rc)
825	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
826	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
827	{
828	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
829	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
830	pThis->KernelAddr = KernelAddr;
831	pThis->KernelMteAddr = MteAddr;
832	pThis->PsLoadedModuleListAddr = Addr;
833	pThis->f32Bit = false;
834	pThis->fNt31 = false;
835	return true;
836	}
837	}
838	else if (RT_SUCCESS(rc))
839	{
840	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
841	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
842	break; /* Not NT kernel */
843	}
844	}
845
846	/* next */
847	DBGFR3AddrAdd(&HitAddr, 8);
848	if (HitAddr.FlatPtr < uEnd)
849	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
850	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
851	else
852	rc = VERR_DBGF_MEM_NOT_FOUND;
853	}
854	}
855	}
856	}
857	}
858	return false;
859	}
860
861
862	/**
863	* @copydoc DBGFOSREG::pfnDestruct
864	*/
865	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
866	{
867	RT_NOREF2(pUVM, pvData);
868	}
869
870
871	/**
872	* @copydoc DBGFOSREG::pfnConstruct
873	*/
874	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
875	{
876	RT_NOREF1(pUVM);
877	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
878	pThis->fValid = false;
879	pThis->f32Bit = false;
880	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
881	return VINF_SUCCESS;
882	}
883
884
885	const DBGFOSREG g_DBGDiggerWinNt =
886	{
887	/* .u32Magic = */ DBGFOSREG_MAGIC,
888	/* .fFlags = */ 0,
889	/* .cbData = */ sizeof(DBGDIGGERWINNT),
890	/* .szName = */ "WinNT",
891	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
892	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
893	/* .pfnProbe = */ dbgDiggerWinNtProbe,
894	/* .pfnInit = */ dbgDiggerWinNtInit,
895	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
896	/* .pfnTerm = */ dbgDiggerWinNtTerm,
897	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
898	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
899	/* .u32EndMagic = */ DBGFOSREG_MAGIC
900	};
901

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 73418

Download in other formats: