DBGPlugInWinNt.cpp@ 73419

Last change on this file since 73419 was 73419, checked in by vboxsync, 6 years ago
DBGPlugInNt: doxygen fix
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 36.3 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 73419 2018-08-01 11:18:54Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/err.h>
26	#include <VBox/param.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/string.h>
31	#include <iprt/formats/pecoff.h>
32	#include <iprt/formats/mz.h>
33
34
35	/*********************************************************************************************************************************
36	* Structures and Typedefs *
37	*********************************************************************************************************************************/
38
39	/** @name Internal WinNT structures
40	* @{ */
41	/**
42	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
43	* Tested with XP.
44	*/
45	typedef struct NTMTE32
46	{
47	struct
48	{
49	uint32_t Flink;
50	uint32_t Blink;
51	} InLoadOrderLinks,
52	InMemoryOrderModuleList,
53	InInitializationOrderModuleList;
54	uint32_t DllBase;
55	uint32_t EntryPoint;
56	/** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
57	* boot loader, for other images it looks like some kind of pointer. */
58	uint32_t SizeOfImage;
59	struct
60	{
61	uint16_t Length;
62	uint16_t MaximumLength;
63	uint32_t Buffer;
64	} FullDllName,
65	BaseDllName;
66	uint32_t Flags;
67	uint16_t LoadCount;
68	uint16_t TlsIndex;
69	/* ... there is more ... */
70	} NTMTE32;
71	typedef NTMTE32 *PNTMTE32;
72
73	/**
74	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
75	*/
76	typedef struct NTMTE64
77	{
78	struct
79	{
80	uint64_t Flink;
81	uint64_t Blink;
82	} InLoadOrderLinks, /*< 0x00 /
83	InMemoryOrderModuleList, /*< 0x10 /
84	InInitializationOrderModuleList; /*< 0x20 /
85	uint64_t DllBase; /*< 0x30 /
86	uint64_t EntryPoint; /*< 0x38 /
87	uint32_t SizeOfImage; /*< 0x40 /
88	uint32_t Alignment; /*< 0x44 /
89	struct
90	{
91	uint16_t Length; /*< 0x48,0x58 /
92	uint16_t MaximumLength; /*< 0x4a,0x5a /
93	uint32_t Alignment; /*< 0x4c,0x5c /
94	uint64_t Buffer; /*< 0x50,0x60 /
95	} FullDllName, /*< 0x48 /
96	BaseDllName; /*< 0x58 /
97	uint32_t Flags; /*< 0x68 /
98	uint16_t LoadCount; /*< 0x6c /
99	uint16_t TlsIndex; /*< 0x6e /
100	/* ... there is more ... */
101	} NTMTE64;
102	typedef NTMTE64 *PNTMTE64;
103
104	/** MTE union. */
105	typedef union NTMTE
106	{
107	NTMTE32 vX_32;
108	NTMTE64 vX_64;
109	} NTMTE;
110	typedef NTMTE *PNTMTE;
111
112
113	/**
114	* The essential bits of the KUSER_SHARED_DATA structure.
115	*/
116	typedef struct NTKUSERSHAREDDATA
117	{
118	uint32_t TickCountLowDeprecated;
119	uint32_t TickCountMultiplier;
120	struct
121	{
122	uint32_t LowPart;
123	int32_t High1Time;
124	int32_t High2Time;
125
126	} InterruptTime,
127	SystemTime,
128	TimeZoneBias;
129	uint16_t ImageNumberLow;
130	uint16_t ImageNumberHigh;
131	RTUTF16 NtSystemRoot[260];
132	uint32_t MaxStackTraceDepth;
133	uint32_t CryptoExponent;
134	uint32_t TimeZoneId;
135	uint32_t LargePageMinimum;
136	uint32_t Reserved2[7];
137	uint32_t NtProductType;
138	uint8_t ProductTypeIsValid;
139	uint8_t abPadding[3];
140	uint32_t NtMajorVersion;
141	uint32_t NtMinorVersion;
142	/* uint8_t ProcessorFeatures[64];
143	...
144	*/
145	} NTKUSERSHAREDDATA;
146	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
147
148	/** KI_USER_SHARED_DATA for i386 */
149	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
150	/** KI_USER_SHARED_DATA for AMD64 */
151	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
152
153	/** NTKUSERSHAREDDATA::NtProductType */
154	typedef enum NTPRODUCTTYPE
155	{
156	kNtProductType_Invalid = 0,
157	kNtProductType_WinNt = 1,
158	kNtProductType_LanManNt,
159	kNtProductType_Server
160	} NTPRODUCTTYPE;
161
162
163	/** NT image header union. */
164	typedef union NTHDRSU
165	{
166	IMAGE_NT_HEADERS32 vX_32;
167	IMAGE_NT_HEADERS64 vX_64;
168	} NTHDRS;
169	/** Pointer to NT image header union. */
170	typedef NTHDRS *PNTHDRS;
171	/** Pointer to const NT image header union. */
172	typedef NTHDRS const *PCNTHDRS;
173
174	/** @} */
175
176
177
178	typedef enum DBGDIGGERWINNTVER
179	{
180	DBGDIGGERWINNTVER_UNKNOWN,
181	DBGDIGGERWINNTVER_3_1,
182	DBGDIGGERWINNTVER_3_5,
183	DBGDIGGERWINNTVER_4_0,
184	DBGDIGGERWINNTVER_5_0,
185	DBGDIGGERWINNTVER_5_1,
186	DBGDIGGERWINNTVER_6_0
187	} DBGDIGGERWINNTVER;
188
189	/**
190	* WinNT guest OS digger instance data.
191	*/
192	typedef struct DBGDIGGERWINNT
193	{
194	/** Whether the information is valid or not.
195	* (For fending off illegal interface method calls.) */
196	bool fValid;
197	/** 32-bit (true) or 64-bit (false) */
198	bool f32Bit;
199	/** Set if NT 3.1 was detected.
200	* This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
201	bool fNt31;
202
203	/** The NT version. */
204	DBGDIGGERWINNTVER enmVer;
205	/** NTKUSERSHAREDDATA::NtProductType */
206	NTPRODUCTTYPE NtProductType;
207	/** NTKUSERSHAREDDATA::NtMajorVersion */
208	uint32_t NtMajorVersion;
209	/** NTKUSERSHAREDDATA::NtMinorVersion */
210	uint32_t NtMinorVersion;
211
212	/** The address of the ntoskrnl.exe image. */
213	DBGFADDRESS KernelAddr;
214	/** The address of the ntoskrnl.exe module table entry. */
215	DBGFADDRESS KernelMteAddr;
216	/** The address of PsLoadedModuleList. */
217	DBGFADDRESS PsLoadedModuleListAddr;
218	} DBGDIGGERWINNT;
219	/** Pointer to the linux guest OS digger instance data. */
220	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
221
222
223	/**
224	* The WinNT digger's loader reader instance data.
225	*/
226	typedef struct DBGDIGGERWINNTRDR
227	{
228	/** The VM handle (referenced). */
229	PUVM pUVM;
230	/** The image base. */
231	DBGFADDRESS ImageAddr;
232	/** The image size. */
233	uint32_t cbImage;
234	/** The file offset of the SizeOfImage field in the optional header if it
235	* needs patching, otherwise set to UINT32_MAX. */
236	uint32_t offSizeOfImage;
237	/** The correct image size. */
238	uint32_t cbCorrectImageSize;
239	/** Number of entries in the aMappings table. */
240	uint32_t cMappings;
241	/** Mapping hint. */
242	uint32_t iHint;
243	/** Mapping file offset to memory offsets, ordered by file offset. */
244	struct
245	{
246	/** The file offset. */
247	uint32_t offFile;
248	/** The size of this mapping. */
249	uint32_t cbMem;
250	/** The offset to the memory from the start of the image. */
251	uint32_t offMem;
252	} aMappings[1];
253	} DBGDIGGERWINNTRDR;
254	/** Pointer a WinNT loader reader instance data. */
255	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
256
257
258	/*********************************************************************************************************************************
259	* Defined Constants And Macros *
260	*********************************************************************************************************************************/
261	/** Validates a 32-bit Windows NT kernel address */
262	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
263	/** Validates a 64-bit Windows NT kernel address */
264	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
265	/** Validates a kernel address. */
266	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
267	/** Versioned and bitness wrapper. */
268	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
269
270	/** The length (in chars) of the kernel file name (no path). */
271	#define WINNT_KERNEL_BASE_NAME_LEN 12
272
273	/** WindowsNT on little endian ASCII systems. */
274	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
275
276
277	/*********************************************************************************************************************************
278	* Internal Functions *
279	*********************************************************************************************************************************/
280	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
281
282
283	/*********************************************************************************************************************************
284	* Global Variables *
285	*********************************************************************************************************************************/
286	/** Kernel names. */
287	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
288	{
289	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
290	};
291
292
293
294	/**
295	* Process a PE image found in guest memory.
296	*
297	* @param pThis The instance data.
298	* @param pUVM The user mode VM handle.
299	* @param pszName The image name.
300	* @param pImageAddr The image address.
301	* @param cbImage The size of the image.
302	*/
303	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
304	PCDBGFADDRESS pImageAddr, uint32_t cbImage)
305	{
306	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
307
308	/*
309	* Do some basic validation first.
310	*/
311	if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
312	\|\| cbImage >= _1M * 256)
313	{
314	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
315	return;
316	}
317
318	/*
319	* Use the common in-memory module reader to create a debug module.
320	*/
321	RTERRINFOSTATIC ErrInfo;
322	RTDBGMOD hDbgMod = NIL_RTDBGMOD;
323	int rc = DBGFR3ModInMem(pUVM, pImageAddr, pThis->fNt31 ? DBGFMODINMEM_F_PE_NT31 : 0, pszName,
324	pThis->f32Bit ? RTLDRARCH_X86_32 : RTLDRARCH_AMD64, cbImage,
325	&hDbgMod, RTErrInfoInitStatic(&ErrInfo));
326	if (RT_SUCCESS(rc))
327	{
328	/*
329	* Tag the module.
330	*/
331	rc = RTDbgModSetTag(hDbgMod, DIG_WINNT_MOD_TAG);
332	AssertRC(rc);
333
334	/*
335	* Link the module.
336	*/
337	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
338	if (hAs != NIL_RTDBGAS)
339	rc = RTDbgAsModuleLink(hAs, hDbgMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
340	else
341	rc = VERR_INTERNAL_ERROR;
342	RTDbgModRelease(hDbgMod);
343	RTDbgAsRelease(hAs);
344	}
345	else if (RTErrInfoIsSet(&ErrInfo.Core))
346	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc - %s\n", pszName, rc, ErrInfo.Core.pszMsg));
347	else
348	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc\n", pszName, rc));
349	}
350
351
352	/**
353	* @copydoc DBGFOSREG::pfnQueryInterface
354	*/
355	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
356	{
357	RT_NOREF3(pUVM, pvData, enmIf);
358	return NULL;
359	}
360
361
362	/**
363	* @copydoc DBGFOSREG::pfnQueryVersion
364	*/
365	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
366	{
367	RT_NOREF1(pUVM);
368	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
369	Assert(pThis->fValid);
370	const char *pszNtProductType;
371	switch (pThis->NtProductType)
372	{
373	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
374	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
375	case kNtProductType_Server: pszNtProductType = "-Server"; break;
376	default: pszNtProductType = ""; break;
377	}
378	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
379	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
380	return VINF_SUCCESS;
381	}
382
383
384	/**
385	* @copydoc DBGFOSREG::pfnTerm
386	*/
387	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
388	{
389	RT_NOREF1(pUVM);
390	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
391	Assert(pThis->fValid);
392
393	/*
394	* As long as we're using our private LDR reader implementation,
395	* we must unlink and ditch the modules we created.
396	*/
397	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
398	if (hDbgAs != NIL_RTDBGAS)
399	{
400	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
401	while (iMod-- > 0)
402	{
403	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
404	if (hMod != NIL_RTDBGMOD)
405	{
406	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
407	{
408	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
409	AssertRC(rc);
410	}
411	RTDbgModRelease(hMod);
412	}
413	}
414	RTDbgAsRelease(hDbgAs);
415	}
416
417	pThis->fValid = false;
418	}
419
420
421	/**
422	* @copydoc DBGFOSREG::pfnRefresh
423	*/
424	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
425	{
426	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
427	NOREF(pThis);
428	Assert(pThis->fValid);
429
430	/*
431	* For now we'll flush and reload everything.
432	*/
433	dbgDiggerWinNtTerm(pUVM, pvData);
434
435	return dbgDiggerWinNtInit(pUVM, pvData);
436	}
437
438
439	/**
440	* @copydoc DBGFOSREG::pfnInit
441	*/
442	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
443	{
444	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
445	Assert(!pThis->fValid);
446
447	union
448	{
449	uint8_t au8[0x2000];
450	RTUTF16 wsz[0x2000/2];
451	NTKUSERSHAREDDATA UserSharedData;
452	} u;
453	DBGFADDRESS Addr;
454	int rc;
455
456	/*
457	* Figure the NT version.
458	*/
459	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
460	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
461	if (RT_SUCCESS(rc))
462	{
463	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
464	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
465	: kNtProductType_Invalid;
466	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
467	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
468	}
469	else if (pThis->fNt31)
470	{
471	pThis->NtProductType = kNtProductType_WinNt;
472	pThis->NtMajorVersion = 3;
473	pThis->NtMinorVersion = 1;
474	}
475	else
476	{
477	Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
478	return rc;
479	}
480
481	/*
482	* Dig out the module chain.
483	*/
484	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
485	Addr = pThis->KernelMteAddr;
486	do
487	{
488	/* Read the validate the MTE. */
489	NTMTE Mte;
490	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
491	if (RT_FAILURE(rc))
492	break;
493	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
494	{
495	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
496	break;
497	}
498	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
499	{
500	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
501	break;
502	}
503	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
504	{
505	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
506	break;
507	}
508	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
509	{
510	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
511	break;
512	}
513	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
514	{
515	Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
516	break;
517	}
518
519	uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
520	if ( !pThis->fNt31
521	&& ( cbImageMte > _256M
522	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
523	{
524	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
525	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
526	break;
527	}
528
529	/* Read the full name. */
530	DBGFADDRESS AddrName;
531	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
532	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
533	if (cbName < sizeof(u))
534	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
535	else
536	rc = VERR_OUT_OF_RANGE;
537	if (RT_FAILURE(rc))
538	{
539	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
540	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
541	if (cbName < sizeof(u))
542	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
543	else
544	rc = VERR_OUT_OF_RANGE;
545	}
546	if (RT_SUCCESS(rc))
547	{
548	u.wsz[cbName / 2] = '\0';
549
550	char *pszName;
551	rc = RTUtf16ToUtf8(u.wsz, &pszName);
552	if (RT_SUCCESS(rc))
553	{
554	/* Read the start of the PE image and pass it along to a worker. */
555	DBGFADDRESS ImageAddr;
556	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
557	dbgDiggerWinNtProcessImage(pThis, pUVM, pszName, &ImageAddr, cbImageMte);
558	RTStrFree(pszName);
559	}
560	}
561
562	/* next */
563	AddrPrev = Addr;
564	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
565	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
566	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
567
568	pThis->fValid = true;
569	return VINF_SUCCESS;
570	}
571
572
573	/**
574	* @copydoc DBGFOSREG::pfnProbe
575	*/
576	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
577	{
578	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
579	DBGFADDRESS Addr;
580	union
581	{
582	uint8_t au8[8192];
583	uint16_t au16[8192/2];
584	uint32_t au32[8192/4];
585	IMAGE_DOS_HEADER MzHdr;
586	RTUTF16 wsz[8192/2];
587	X86DESC64GATE a32Gates[X86_XCPT_PF + 1];
588	X86DESC64GATE a64Gates[X86_XCPT_PF + 1];
589	} u;
590
591	union
592	{
593	NTMTE32 v32;
594	NTMTE64 v64;
595	} uMte, uMte2, uMte3;
596
597	/*
598	* NT only runs in protected or long mode.
599	*/
600	CPUMMODE const enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
601	if (enmMode != CPUMMODE_PROTECTED && enmMode != CPUMMODE_LONG)
602	return false;
603	bool const f64Bit = enmMode == CPUMMODE_LONG;
604	uint64_t const uStart = f64Bit ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
605	uint64_t const uEnd = f64Bit ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
606
607	/*
608	* To approximately locate the kernel we examine the IDTR handlers.
609	*
610	* The exception/trap/fault handlers are all in NT kernel image, we pick
611	* KiPageFault here.
612	*/
613	uint64_t uIdtrBase = 0;
614	uint16_t uIdtrLimit = 0;
615	int rc = DBGFR3RegCpuQueryXdtr(pUVM, 0, DBGFREG_IDTR, &uIdtrBase, &uIdtrLimit);
616	AssertRCReturn(rc, false);
617
618	const uint16_t cbMinIdtr = (X86_XCPT_PF + 1) * (f64Bit ? sizeof(X86DESC64GATE) : sizeof(X86DESCGATE));
619	if (uIdtrLimit < cbMinIdtr)
620	return false;
621
622	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uIdtrBase), &u, cbMinIdtr);
623	if (RT_FAILURE(rc))
624	return false;
625
626	uint64_t uKrnlStart = uStart;
627	uint64_t uKrnlEnd = uEnd;
628	if (f64Bit)
629	{
630	uint64_t uHandler = u.a64Gates[X86_XCPT_PF].u16OffsetLow
631	\| ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16)
632	\| ((uint64_t)u.a64Gates[X86_XCPT_PF].u32OffsetTop << 32);
633	if (uHandler < uStart \|\| uHandler > uEnd)
634	return false;
635	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _512M;
636	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
637	}
638	else
639	{
640	uint32_t uHandler = u.a32Gates[X86_XCPT_PF].u16OffsetLow
641	\| ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16);
642	if (uHandler < uStart \|\| uHandler > uEnd)
643	return false;
644	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _64M;
645	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
646	}
647
648	/*
649	* Look for the PAGELK section name that seems to be a part of all kernels.
650	* Then try find the module table entry for it. Since it's the first entry
651	* in the PsLoadedModuleList we can easily validate the list head and report
652	* success.
653	*
654	* Note! We ASSUME the section name is 8 byte aligned.
655	*/
656	DBGFADDRESS KernelAddr;
657	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uKrnlStart);
658	KernelAddr.FlatPtr < uKrnlEnd;
659	KernelAddr.FlatPtr += PAGE_SIZE)
660	{
661	bool fNt31 = false;
662	DBGFADDRESS const RetryAddress = KernelAddr;
663	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
664	8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
665	if ( rc == VERR_DBGF_MEM_NOT_FOUND
666	&& enmMode != CPUMMODE_LONG)
667	{
668	/* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
669	following VirtualSize is zero, so check for that too. */
670	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
671	8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
672	fNt31 = true;
673	}
674	if (RT_FAILURE(rc))
675	break;
676	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
677
678	/* MZ + PE header. */
679	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
680	if ( RT_SUCCESS(rc)
681	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
682	&& !(u.MzHdr.e_lfanew & 0x7)
683	&& u.MzHdr.e_lfanew >= 0x080
684	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
685	{
686	if (enmMode != CPUMMODE_LONG)
687	{
688	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
689	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
690	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
691	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
692	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
693	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
694	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
695	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
696	)
697	{
698	/* Find the MTE. */
699	RT_ZERO(uMte);
700	uMte.v32.DllBase = KernelAddr.FlatPtr;
701	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
702	uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
703	DBGFADDRESS HitAddr;
704	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
705	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
706	while (RT_SUCCESS(rc))
707	{
708	/* check the name. */
709	DBGFADDRESS MteAddr = HitAddr;
710	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
711	&uMte2.v32, sizeof(uMte2.v32));
712	if ( RT_SUCCESS(rc)
713	&& uMte2.v32.DllBase == uMte.v32.DllBase
714	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
715	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
716	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
717	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
718	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
719	&& uMte2.v32.BaseDllName.Length <= 128
720	&& uMte2.v32.FullDllName.Length <= 260
721	)
722	{
723	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
724	u.wsz, uMte2.v32.BaseDllName.Length);
725	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
726	if ( RT_SUCCESS(rc)
727	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
728	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
729	)
730	)
731	{
732	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
733	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
734	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
735	if ( RT_SUCCESS(rc)
736	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
737	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
738	{
739	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
740	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
741	pThis->KernelAddr = KernelAddr;
742	pThis->KernelMteAddr = MteAddr;
743	pThis->PsLoadedModuleListAddr = Addr;
744	pThis->f32Bit = true;
745	pThis->fNt31 = fNt31;
746	return true;
747	}
748	}
749	else if (RT_SUCCESS(rc))
750	{
751	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
752	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
753	break; /* Not NT kernel */
754	}
755	}
756
757	/* next */
758	DBGFR3AddrAdd(&HitAddr, 4);
759	if (HitAddr.FlatPtr < uEnd)
760	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
761	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
762	else
763	rc = VERR_DBGF_MEM_NOT_FOUND;
764	}
765	}
766	}
767	else
768	{
769	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
770	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
771	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
772	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
773	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
774	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
775	== IMAGE_FILE_EXECUTABLE_IMAGE
776	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
777	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
778	)
779	{
780	/* Find the MTE. */
781	RT_ZERO(uMte.v64);
782	uMte.v64.DllBase = KernelAddr.FlatPtr;
783	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
784	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
785	DBGFADDRESS ScanAddr;
786	DBGFADDRESS HitAddr;
787	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
788	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
789	while (RT_SUCCESS(rc))
790	{
791	/* Read the start of the MTE and check some basic members. */
792	DBGFADDRESS MteAddr = HitAddr;
793	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
794	&uMte2.v64, sizeof(uMte2.v64));
795	if ( RT_SUCCESS(rc)
796	&& uMte2.v64.DllBase == uMte.v64.DllBase
797	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
798	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
799	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
800	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
801	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
802	&& uMte2.v64.BaseDllName.Length <= 128
803	&& uMte2.v64.FullDllName.Length <= 260
804	)
805	{
806	/* Try read the base name and compare with known NT kernel names. */
807	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
808	u.wsz, uMte2.v64.BaseDllName.Length);
809	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
810	if ( RT_SUCCESS(rc)
811	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
812	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
813	)
814	)
815	{
816	/* Read the link entry of the previous entry in the list and check that its
817	forward pointer points at the MTE we've found. */
818	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
819	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
820	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
821	if ( RT_SUCCESS(rc)
822	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
823	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
824	{
825	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
826	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
827	pThis->KernelAddr = KernelAddr;
828	pThis->KernelMteAddr = MteAddr;
829	pThis->PsLoadedModuleListAddr = Addr;
830	pThis->f32Bit = false;
831	pThis->fNt31 = false;
832	return true;
833	}
834	}
835	else if (RT_SUCCESS(rc))
836	{
837	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
838	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
839	break; /* Not NT kernel */
840	}
841	}
842
843	/* next */
844	DBGFR3AddrAdd(&HitAddr, 8);
845	if (HitAddr.FlatPtr < uEnd)
846	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
847	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
848	else
849	rc = VERR_DBGF_MEM_NOT_FOUND;
850	}
851	}
852	}
853	}
854	}
855	return false;
856	}
857
858
859	/**
860	* @copydoc DBGFOSREG::pfnDestruct
861	*/
862	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
863	{
864	RT_NOREF2(pUVM, pvData);
865	}
866
867
868	/**
869	* @copydoc DBGFOSREG::pfnConstruct
870	*/
871	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
872	{
873	RT_NOREF1(pUVM);
874	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
875	pThis->fValid = false;
876	pThis->f32Bit = false;
877	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
878	return VINF_SUCCESS;
879	}
880
881
882	const DBGFOSREG g_DBGDiggerWinNt =
883	{
884	/* .u32Magic = */ DBGFOSREG_MAGIC,
885	/* .fFlags = */ 0,
886	/* .cbData = */ sizeof(DBGDIGGERWINNT),
887	/* .szName = */ "WinNT",
888	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
889	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
890	/* .pfnProbe = */ dbgDiggerWinNtProbe,
891	/* .pfnInit = */ dbgDiggerWinNtInit,
892	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
893	/* .pfnTerm = */ dbgDiggerWinNtTerm,
894	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
895	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
896	/* .u32EndMagic = */ DBGFOSREG_MAGIC
897	};
898

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 73419

Download in other formats: