VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 73493

Last change on this file since 73493 was 73493, checked in by vboxsync, 6 years ago

DBGF,DBGPluInWinNt: Produce more useful module names (e.g. stuff that works in DBGC). [doxygen]

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 45.4 KB
Line 
1/* $Id: DBGPlugInWinNt.cpp 73493 2018-08-03 16:05:18Z vboxsync $ */
2/** @file
3 * DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4 */
5
6/*
7 * Copyright (C) 2009-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23#include "DBGPlugIns.h"
24#include <VBox/vmm/dbgf.h>
25#include <VBox/vmm/cpumctx.h>
26#include <VBox/vmm/mm.h>
27#include <VBox/err.h>
28#include <VBox/param.h>
29#include <iprt/ctype.h>
30#include <iprt/ldr.h>
31#include <iprt/mem.h>
32#include <iprt/path.h>
33#include <iprt/stream.h>
34#include <iprt/string.h>
35#include <iprt/formats/pecoff.h>
36#include <iprt/formats/mz.h>
37#include <iprt/nt/nt-structures.h>
38
39
40/*********************************************************************************************************************************
41* Structures and Typedefs *
42*********************************************************************************************************************************/
43
44/** @name Internal WinNT structures
45 * @{ */
46/**
47 * PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
48 * Tested with XP.
49 */
50typedef struct NTMTE32
51{
52 struct
53 {
54 uint32_t Flink;
55 uint32_t Blink;
56 } InLoadOrderLinks,
57 InMemoryOrderModuleList,
58 InInitializationOrderModuleList;
59 uint32_t DllBase;
60 uint32_t EntryPoint;
61 /** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
62 * boot loader, for other images it looks like some kind of pointer. */
63 uint32_t SizeOfImage;
64 struct
65 {
66 uint16_t Length;
67 uint16_t MaximumLength;
68 uint32_t Buffer;
69 } FullDllName,
70 BaseDllName;
71 uint32_t Flags;
72 uint16_t LoadCount;
73 uint16_t TlsIndex;
74 /* ... there is more ... */
75} NTMTE32;
76typedef NTMTE32 *PNTMTE32;
77
78/**
79 * PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
80 */
81typedef struct NTMTE64
82{
83 struct
84 {
85 uint64_t Flink;
86 uint64_t Blink;
87 } InLoadOrderLinks, /**< 0x00 */
88 InMemoryOrderModuleList, /**< 0x10 */
89 InInitializationOrderModuleList; /**< 0x20 */
90 uint64_t DllBase; /**< 0x30 */
91 uint64_t EntryPoint; /**< 0x38 */
92 uint32_t SizeOfImage; /**< 0x40 */
93 uint32_t Alignment; /**< 0x44 */
94 struct
95 {
96 uint16_t Length; /**< 0x48,0x58 */
97 uint16_t MaximumLength; /**< 0x4a,0x5a */
98 uint32_t Alignment; /**< 0x4c,0x5c */
99 uint64_t Buffer; /**< 0x50,0x60 */
100 } FullDllName, /**< 0x48 */
101 BaseDllName; /**< 0x58 */
102 uint32_t Flags; /**< 0x68 */
103 uint16_t LoadCount; /**< 0x6c */
104 uint16_t TlsIndex; /**< 0x6e */
105 /* ... there is more ... */
106} NTMTE64;
107typedef NTMTE64 *PNTMTE64;
108
109/** MTE union. */
110typedef union NTMTE
111{
112 NTMTE32 vX_32;
113 NTMTE64 vX_64;
114} NTMTE;
115typedef NTMTE *PNTMTE;
116
117
118/**
119 * The essential bits of the KUSER_SHARED_DATA structure.
120 */
121typedef struct NTKUSERSHAREDDATA
122{
123 uint32_t TickCountLowDeprecated;
124 uint32_t TickCountMultiplier;
125 struct
126 {
127 uint32_t LowPart;
128 int32_t High1Time;
129 int32_t High2Time;
130
131 } InterruptTime,
132 SystemTime,
133 TimeZoneBias;
134 uint16_t ImageNumberLow;
135 uint16_t ImageNumberHigh;
136 RTUTF16 NtSystemRoot[260];
137 uint32_t MaxStackTraceDepth;
138 uint32_t CryptoExponent;
139 uint32_t TimeZoneId;
140 uint32_t LargePageMinimum;
141 uint32_t Reserved2[7];
142 uint32_t NtProductType;
143 uint8_t ProductTypeIsValid;
144 uint8_t abPadding[3];
145 uint32_t NtMajorVersion;
146 uint32_t NtMinorVersion;
147 /* uint8_t ProcessorFeatures[64];
148 ...
149 */
150} NTKUSERSHAREDDATA;
151typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
152
153/** KI_USER_SHARED_DATA for i386 */
154#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
155/** KI_USER_SHARED_DATA for AMD64 */
156#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
157
158/** NTKUSERSHAREDDATA::NtProductType */
159typedef enum NTPRODUCTTYPE
160{
161 kNtProductType_Invalid = 0,
162 kNtProductType_WinNt = 1,
163 kNtProductType_LanManNt,
164 kNtProductType_Server
165} NTPRODUCTTYPE;
166
167
168/** NT image header union. */
169typedef union NTHDRSU
170{
171 IMAGE_NT_HEADERS32 vX_32;
172 IMAGE_NT_HEADERS64 vX_64;
173} NTHDRS;
174/** Pointer to NT image header union. */
175typedef NTHDRS *PNTHDRS;
176/** Pointer to const NT image header union. */
177typedef NTHDRS const *PCNTHDRS;
178
179/** @} */
180
181
182
183typedef enum DBGDIGGERWINNTVER
184{
185 DBGDIGGERWINNTVER_UNKNOWN,
186 DBGDIGGERWINNTVER_3_1,
187 DBGDIGGERWINNTVER_3_5,
188 DBGDIGGERWINNTVER_4_0,
189 DBGDIGGERWINNTVER_5_0,
190 DBGDIGGERWINNTVER_5_1,
191 DBGDIGGERWINNTVER_6_0
192} DBGDIGGERWINNTVER;
193
194/**
195 * WinNT guest OS digger instance data.
196 */
197typedef struct DBGDIGGERWINNT
198{
199 /** Whether the information is valid or not.
200 * (For fending off illegal interface method calls.) */
201 bool fValid;
202 /** 32-bit (true) or 64-bit (false) */
203 bool f32Bit;
204 /** Set if NT 3.1 was detected.
205 * This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
206 bool fNt31;
207
208 /** The NT version. */
209 DBGDIGGERWINNTVER enmVer;
210 /** NTKUSERSHAREDDATA::NtProductType */
211 NTPRODUCTTYPE NtProductType;
212 /** NTKUSERSHAREDDATA::NtMajorVersion */
213 uint32_t NtMajorVersion;
214 /** NTKUSERSHAREDDATA::NtMinorVersion */
215 uint32_t NtMinorVersion;
216
217 /** The address of the ntoskrnl.exe image. */
218 DBGFADDRESS KernelAddr;
219 /** The address of the ntoskrnl.exe module table entry. */
220 DBGFADDRESS KernelMteAddr;
221 /** The address of PsLoadedModuleList. */
222 DBGFADDRESS PsLoadedModuleListAddr;
223} DBGDIGGERWINNT;
224/** Pointer to the linux guest OS digger instance data. */
225typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
226
227
228/**
229 * The WinNT digger's loader reader instance data.
230 */
231typedef struct DBGDIGGERWINNTRDR
232{
233 /** The VM handle (referenced). */
234 PUVM pUVM;
235 /** The image base. */
236 DBGFADDRESS ImageAddr;
237 /** The image size. */
238 uint32_t cbImage;
239 /** The file offset of the SizeOfImage field in the optional header if it
240 * needs patching, otherwise set to UINT32_MAX. */
241 uint32_t offSizeOfImage;
242 /** The correct image size. */
243 uint32_t cbCorrectImageSize;
244 /** Number of entries in the aMappings table. */
245 uint32_t cMappings;
246 /** Mapping hint. */
247 uint32_t iHint;
248 /** Mapping file offset to memory offsets, ordered by file offset. */
249 struct
250 {
251 /** The file offset. */
252 uint32_t offFile;
253 /** The size of this mapping. */
254 uint32_t cbMem;
255 /** The offset to the memory from the start of the image. */
256 uint32_t offMem;
257 } aMappings[1];
258} DBGDIGGERWINNTRDR;
259/** Pointer a WinNT loader reader instance data. */
260typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
261
262
263/*********************************************************************************************************************************
264* Defined Constants And Macros *
265*********************************************************************************************************************************/
266/** Validates a 32-bit Windows NT kernel address */
267#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
268/** Validates a 64-bit Windows NT kernel address */
269#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
270/** Validates a kernel address. */
271#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
272/** Versioned and bitness wrapper. */
273#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
274
275/** The length (in chars) of the kernel file name (no path). */
276#define WINNT_KERNEL_BASE_NAME_LEN 12
277
278/** WindowsNT on little endian ASCII systems. */
279#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
280
281
282/*********************************************************************************************************************************
283* Internal Functions *
284*********************************************************************************************************************************/
285static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
286
287
288/*********************************************************************************************************************************
289* Global Variables *
290*********************************************************************************************************************************/
291/** Kernel names. */
292static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
293{
294 { 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
295};
296
297
298
299/**
300 * Process a PE image found in guest memory.
301 *
302 * @param pThis The instance data.
303 * @param pUVM The user mode VM handle.
304 * @param pszName The module name.
305 * @param pszFilename The image filename.
306 * @param pImageAddr The image address.
307 * @param cbImage The size of the image.
308 */
309static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName, const char *pszFilename,
310 PCDBGFADDRESS pImageAddr, uint32_t cbImage)
311{
312 LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
313
314 /*
315 * Do some basic validation first.
316 */
317 if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
318 || cbImage >= _1M * 256)
319 {
320 Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
321 return;
322 }
323
324 /*
325 * Use the common in-memory module reader to create a debug module.
326 */
327 RTERRINFOSTATIC ErrInfo;
328 RTDBGMOD hDbgMod = NIL_RTDBGMOD;
329 int rc = DBGFR3ModInMem(pUVM, pImageAddr, pThis->fNt31 ? DBGFMODINMEM_F_PE_NT31 : 0, pszName, pszFilename,
330 pThis->f32Bit ? RTLDRARCH_X86_32 : RTLDRARCH_AMD64, cbImage,
331 &hDbgMod, RTErrInfoInitStatic(&ErrInfo));
332 if (RT_SUCCESS(rc))
333 {
334 /*
335 * Tag the module.
336 */
337 rc = RTDbgModSetTag(hDbgMod, DIG_WINNT_MOD_TAG);
338 AssertRC(rc);
339
340 /*
341 * Link the module.
342 */
343 RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
344 if (hAs != NIL_RTDBGAS)
345 rc = RTDbgAsModuleLink(hAs, hDbgMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
346 else
347 rc = VERR_INTERNAL_ERROR;
348 RTDbgModRelease(hDbgMod);
349 RTDbgAsRelease(hAs);
350 }
351 else if (RTErrInfoIsSet(&ErrInfo.Core))
352 Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc - %s\n", pszName, rc, ErrInfo.Core.pszMsg));
353 else
354 Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc\n", pszName, rc));
355}
356
357
358/**
359 * Generate a debugger compatible module name from a filename.
360 *
361 * @returns Pointer to module name (doesn't need to be pszName).
362 * @param pszFilename The source filename.
363 * @param pszName Buffer to put the module name in.
364 * @param cbName Buffer size.
365 */
366static const char *dbgDiggerWintNtFilenameToModuleName(const char *pszFilename, char *pszName, size_t cbName)
367{
368 /* Skip to the filename part of the filename. :-) */
369 pszFilename = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
370
371 /* We try use 'nt' for the kernel. */
372 if ( RTStrICmpAscii(pszFilename, "ntoskrnl.exe") == 0
373 || RTStrICmpAscii(pszFilename, "ntkrnlmp.exe") == 0)
374 return "nt";
375
376
377 /* Drop the extension if .dll or .sys. */
378 size_t cchFilename = strlen(pszFilename);
379 if ( cchFilename > 4
380 && pszFilename[cchFilename - 4] == '.')
381 {
382 if ( RTStrICmpAscii(&pszFilename[cchFilename - 4], ".sys") == 0
383 || RTStrICmpAscii(&pszFilename[cchFilename - 4], ".dll") == 0)
384 cchFilename -= 4;
385 }
386
387 /* Copy and do replacements. */
388 if (cchFilename >= cbName)
389 cchFilename = cbName - 1;
390 size_t off;
391 for (off = 0; off < cchFilename; off++)
392 {
393 char ch = pszFilename[off];
394 if (!RT_C_IS_ALNUM(ch))
395 ch = '_';
396 pszName[off] = ch;
397 }
398 pszName[off] = '\0';
399 return pszName;
400}
401
402
403/**
404 * @copydoc DBGFOSREG::pfnStackUnwindAssist
405 */
406static DECLCALLBACK(int) dbgDiggerWinNtStackUnwindAssist(PUVM pUVM, void *pvData, VMCPUID idCpu, PDBGFSTACKFRAME pFrame,
407 PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx, RTDBGAS hAs,
408 uint64_t *puScratch)
409{
410 Assert(pInitialCtx);
411
412 /*
413 * We want to locate trap frames here. The trap frame structure contains
414 * the 64-bit IRET frame, so given unwind information it's easy to identify
415 * using the return type and frame address.
416 */
417 if (pFrame->fFlags & DBGFSTACKFRAME_FLAGS_64BIT)
418 {
419 /*
420 * Is this a trap frame? If so, try read the trap frame.
421 */
422 if ( pFrame->enmReturnType == RTDBGRETURNTYPE_IRET64
423 && !(pFrame->AddrFrame.FlatPtr & 0x7)
424 && WINNT64_VALID_ADDRESS(pFrame->AddrFrame.FlatPtr) )
425 {
426 KTRAP_FRAME_AMD64 TrapFrame;
427 RT_ZERO(TrapFrame);
428 uint64_t const uTrapFrameAddr = pFrame->AddrFrame.FlatPtr
429 - RT_UOFFSETOF(KTRAP_FRAME_AMD64, ErrCdOrXcptFrameOrS);
430 int rc = pState->pfnReadStack(pState, uTrapFrameAddr, sizeof(TrapFrame), &TrapFrame);
431 if (RT_SUCCESS(rc))
432 {
433 /* Valid? Not too much else we can check here (EFlags isn't
434 reliable in manually construct frames). */
435 if (TrapFrame.ExceptionActive <= 2)
436 {
437 pFrame->fFlags |= DBGFSTACKFRAME_FLAGS_TRAP_FRAME;
438
439 /*
440 * Add sure 'register' information from the frame to the frame.
441 *
442 * To avoid code duplication, we do this in two steps in a loop.
443 * The first iteration only figures out how many registers we're
444 * going to save and allocates room for them. The second iteration
445 * does the actual adding.
446 */
447 uint32_t cRegs = pFrame->cSureRegs;
448 PDBGFREGVALEX paSureRegs = NULL;
449#define ADD_REG_NAMED(a_Type, a_ValMemb, a_Value, a_pszName) do { \
450 if (paSureRegs) \
451 { \
452 paSureRegs[iReg].pszName = a_pszName;\
453 paSureRegs[iReg].enmReg = DBGFREG_END; \
454 paSureRegs[iReg].enmType = a_Type; \
455 paSureRegs[iReg].Value.a_ValMemb = (a_Value); \
456 } \
457 iReg++; \
458 } while (0)
459#define MAYBE_ADD_GREG(a_Value, a_enmReg, a_idxReg) do { \
460 if (!(pState->u.x86.Loaded.s.fRegs & RT_BIT(a_idxReg))) \
461 { \
462 if (paSureRegs) \
463 { \
464 pState->u.x86.Loaded.s.fRegs |= RT_BIT(a_idxReg); \
465 pState->u.x86.auRegs[a_idxReg] = (a_Value); \
466 paSureRegs[iReg].Value.u64 = (a_Value); \
467 paSureRegs[iReg].enmReg = a_enmReg; \
468 paSureRegs[iReg].enmType = DBGFREGVALTYPE_U64; \
469 paSureRegs[iReg].pszName = NULL; \
470 } \
471 iReg++; \
472 } \
473 } while (0)
474 for (unsigned iLoop = 0; iLoop < 2; iLoop++)
475 {
476 uint32_t iReg = pFrame->cSureRegs;
477 ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, uTrapFrameAddr, "TrapFrame");
478 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.ExceptionActive, "ExceptionActive");
479 if (TrapFrame.ExceptionActive == 0)
480 {
481 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.PreviousIrql, "PrevIrql");
482 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, (uint8_t)TrapFrame.ErrCdOrXcptFrameOrS, "IntNo");
483 }
484 else if ( TrapFrame.ExceptionActive == 1
485 && TrapFrame.FaultIndicator == ((TrapFrame.ErrCdOrXcptFrameOrS >> 1) & 0x9))
486 ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, TrapFrame.FaultAddrOrCtxRecOrTS, "cr2-probably");
487 if (TrapFrame.SegCs & X86_SEL_RPL)
488 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "UserMode");
489 else
490 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "KernelMode");
491 if (TrapFrame.ExceptionActive <= 1)
492 {
493 MAYBE_ADD_GREG(TrapFrame.Rax, DBGFREG_RAX, X86_GREG_xAX);
494 MAYBE_ADD_GREG(TrapFrame.Rcx, DBGFREG_RCX, X86_GREG_xCX);
495 MAYBE_ADD_GREG(TrapFrame.Rdx, DBGFREG_RDX, X86_GREG_xDX);
496 MAYBE_ADD_GREG(TrapFrame.R8, DBGFREG_R8, X86_GREG_x8);
497 MAYBE_ADD_GREG(TrapFrame.R9, DBGFREG_R9, X86_GREG_x9);
498 MAYBE_ADD_GREG(TrapFrame.R10, DBGFREG_R10, X86_GREG_x10);
499 MAYBE_ADD_GREG(TrapFrame.R11, DBGFREG_R11, X86_GREG_x11);
500 }
501 else if (TrapFrame.ExceptionActive == 2)
502 {
503 MAYBE_ADD_GREG(TrapFrame.Rbx, DBGFREG_RBX, X86_GREG_xBX);
504 MAYBE_ADD_GREG(TrapFrame.Rsi, DBGFREG_RSI, X86_GREG_xSI);
505 MAYBE_ADD_GREG(TrapFrame.Rdi, DBGFREG_RDI, X86_GREG_xDI);
506 }
507 // MAYBE_ADD_GREG(TrapFrame.Rbp, DBGFREG_RBP, X86_GREG_xBP); - KiInterrupt[Sub]Dispatch* may leave this invalid.
508
509 /* Done? */
510 if (iLoop > 0)
511 {
512 Assert(cRegs == iReg);
513 break;
514 }
515
516 /* Resize the array, zeroing the extension. */
517 if (pFrame->cSureRegs)
518 paSureRegs = (PDBGFREGVALEX)MMR3HeapRealloc(pFrame->paSureRegs, iReg * sizeof(paSureRegs[0]));
519 else
520 paSureRegs = (PDBGFREGVALEX)MMR3HeapAllocU(pUVM, MM_TAG_DBGF_STACK, iReg * sizeof(paSureRegs[0]));
521 AssertReturn(paSureRegs, VERR_NO_MEMORY);
522
523 pFrame->paSureRegs = paSureRegs;
524 RT_BZERO(&paSureRegs[pFrame->cSureRegs], (iReg - pFrame->cSureRegs) * sizeof(paSureRegs[0]));
525 cRegs = iReg;
526 }
527#undef ADD_REG_NAMED
528#undef MAYBE_ADD_GREG
529
530 /* Commit the register update. */
531 pFrame->cSureRegs = cRegs;
532 }
533 }
534 }
535 }
536
537 RT_NOREF(pUVM, pvData, idCpu, hAs, pInitialCtx, puScratch);
538 return VINF_SUCCESS;
539}
540
541
542/**
543 * @copydoc DBGFOSREG::pfnQueryInterface
544 */
545static DECLCALLBACK(void *) dbgDiggerWinNtQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
546{
547 RT_NOREF3(pUVM, pvData, enmIf);
548 return NULL;
549}
550
551
552/**
553 * @copydoc DBGFOSREG::pfnQueryVersion
554 */
555static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void *pvData, char *pszVersion, size_t cchVersion)
556{
557 RT_NOREF1(pUVM);
558 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
559 Assert(pThis->fValid);
560 const char *pszNtProductType;
561 switch (pThis->NtProductType)
562 {
563 case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
564 case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
565 case kNtProductType_Server: pszNtProductType = "-Server"; break;
566 default: pszNtProductType = ""; break;
567 }
568 RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
569 pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
570 return VINF_SUCCESS;
571}
572
573
574/**
575 * @copydoc DBGFOSREG::pfnTerm
576 */
577static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
578{
579 RT_NOREF1(pUVM);
580 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
581 Assert(pThis->fValid);
582
583 /*
584 * As long as we're using our private LDR reader implementation,
585 * we must unlink and ditch the modules we created.
586 */
587 RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
588 if (hDbgAs != NIL_RTDBGAS)
589 {
590 uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
591 while (iMod-- > 0)
592 {
593 RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
594 if (hMod != NIL_RTDBGMOD)
595 {
596 if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
597 {
598 int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
599 AssertRC(rc);
600 }
601 RTDbgModRelease(hMod);
602 }
603 }
604 RTDbgAsRelease(hDbgAs);
605 }
606
607 pThis->fValid = false;
608}
609
610
611/**
612 * @copydoc DBGFOSREG::pfnRefresh
613 */
614static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
615{
616 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
617 NOREF(pThis);
618 Assert(pThis->fValid);
619
620 /*
621 * For now we'll flush and reload everything.
622 */
623 dbgDiggerWinNtTerm(pUVM, pvData);
624
625 return dbgDiggerWinNtInit(pUVM, pvData);
626}
627
628
629/**
630 * @copydoc DBGFOSREG::pfnInit
631 */
632static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
633{
634 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
635 Assert(!pThis->fValid);
636
637 union
638 {
639 uint8_t au8[0x2000];
640 RTUTF16 wsz[0x2000/2];
641 NTKUSERSHAREDDATA UserSharedData;
642 } u;
643 DBGFADDRESS Addr;
644 int rc;
645
646 /*
647 * Figure the NT version.
648 */
649 DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
650 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &u, PAGE_SIZE);
651 if (RT_SUCCESS(rc))
652 {
653 pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
654 ? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
655 : kNtProductType_Invalid;
656 pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
657 pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
658 }
659 else if (pThis->fNt31)
660 {
661 pThis->NtProductType = kNtProductType_WinNt;
662 pThis->NtMajorVersion = 3;
663 pThis->NtMinorVersion = 1;
664 }
665 else
666 {
667 Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
668 return rc;
669 }
670
671 /*
672 * Dig out the module chain.
673 */
674 DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
675 Addr = pThis->KernelMteAddr;
676 do
677 {
678 /* Read the validate the MTE. */
679 NTMTE Mte;
680 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
681 if (RT_FAILURE(rc))
682 break;
683 if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
684 {
685 Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
686 break;
687 }
688 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
689 {
690 Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
691 break;
692 }
693 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
694 {
695 Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
696 break;
697 }
698 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
699 {
700 Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
701 break;
702 }
703 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
704 {
705 Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
706 break;
707 }
708
709 uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
710 if ( !pThis->fNt31
711 && ( cbImageMte > _256M
712 || WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
713 {
714 Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
715 Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
716 break;
717 }
718
719 /* Read the full name. */
720 DBGFADDRESS AddrName;
721 DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
722 uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
723 if (cbName < sizeof(u))
724 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
725 else
726 rc = VERR_OUT_OF_RANGE;
727 if (RT_FAILURE(rc))
728 {
729 DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
730 cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
731 if (cbName < sizeof(u))
732 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
733 else
734 rc = VERR_OUT_OF_RANGE;
735 }
736 if (RT_SUCCESS(rc))
737 {
738 u.wsz[cbName / 2] = '\0';
739
740 char *pszFilename;
741 rc = RTUtf16ToUtf8(u.wsz, &pszFilename);
742 if (RT_SUCCESS(rc))
743 {
744 char szModName[128];
745 const char *pszModName = dbgDiggerWintNtFilenameToModuleName(pszFilename, szModName, sizeof(szModName));
746
747 /* Read the start of the PE image and pass it along to a worker. */
748 DBGFADDRESS ImageAddr;
749 DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
750 dbgDiggerWinNtProcessImage(pThis, pUVM, pszModName, pszFilename, &ImageAddr, cbImageMte);
751 RTStrFree(pszFilename);
752 }
753 }
754
755 /* next */
756 AddrPrev = Addr;
757 DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
758 } while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
759 && Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
760
761 pThis->fValid = true;
762 return VINF_SUCCESS;
763}
764
765
766/**
767 * @copydoc DBGFOSREG::pfnProbe
768 */
769static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
770{
771 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
772 DBGFADDRESS Addr;
773 union
774 {
775 uint8_t au8[8192];
776 uint16_t au16[8192/2];
777 uint32_t au32[8192/4];
778 IMAGE_DOS_HEADER MzHdr;
779 RTUTF16 wsz[8192/2];
780 X86DESC64GATE a32Gates[X86_XCPT_PF + 1];
781 X86DESC64GATE a64Gates[X86_XCPT_PF + 1];
782 } u;
783
784 union
785 {
786 NTMTE32 v32;
787 NTMTE64 v64;
788 } uMte, uMte2, uMte3;
789
790 /*
791 * NT only runs in protected or long mode.
792 */
793 CPUMMODE const enmMode = DBGFR3CpuGetMode(pUVM, 0 /*idCpu*/);
794 if (enmMode != CPUMMODE_PROTECTED && enmMode != CPUMMODE_LONG)
795 return false;
796 bool const f64Bit = enmMode == CPUMMODE_LONG;
797 uint64_t const uStart = f64Bit ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
798 uint64_t const uEnd = f64Bit ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
799
800 /*
801 * To approximately locate the kernel we examine the IDTR handlers.
802 *
803 * The exception/trap/fault handlers are all in NT kernel image, we pick
804 * KiPageFault here.
805 */
806 uint64_t uIdtrBase = 0;
807 uint16_t uIdtrLimit = 0;
808 int rc = DBGFR3RegCpuQueryXdtr(pUVM, 0, DBGFREG_IDTR, &uIdtrBase, &uIdtrLimit);
809 AssertRCReturn(rc, false);
810
811 const uint16_t cbMinIdtr = (X86_XCPT_PF + 1) * (f64Bit ? sizeof(X86DESC64GATE) : sizeof(X86DESCGATE));
812 if (uIdtrLimit < cbMinIdtr)
813 return false;
814
815 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, uIdtrBase), &u, cbMinIdtr);
816 if (RT_FAILURE(rc))
817 return false;
818
819 uint64_t uKrnlStart = uStart;
820 uint64_t uKrnlEnd = uEnd;
821 if (f64Bit)
822 {
823 uint64_t uHandler = u.a64Gates[X86_XCPT_PF].u16OffsetLow
824 | ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16)
825 | ((uint64_t)u.a64Gates[X86_XCPT_PF].u32OffsetTop << 32);
826 if (uHandler < uStart || uHandler > uEnd)
827 return false;
828 uKrnlStart = (uHandler & ~(uint64_t)_4M) - _512M;
829 uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
830 }
831 else
832 {
833 uint32_t uHandler = u.a32Gates[X86_XCPT_PF].u16OffsetLow
834 | ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16);
835 if (uHandler < uStart || uHandler > uEnd)
836 return false;
837 uKrnlStart = (uHandler & ~(uint64_t)_4M) - _64M;
838 uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
839 }
840
841 /*
842 * Look for the PAGELK section name that seems to be a part of all kernels.
843 * Then try find the module table entry for it. Since it's the first entry
844 * in the PsLoadedModuleList we can easily validate the list head and report
845 * success.
846 *
847 * Note! We ASSUME the section name is 8 byte aligned.
848 */
849 DBGFADDRESS KernelAddr;
850 for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uKrnlStart);
851 KernelAddr.FlatPtr < uKrnlEnd;
852 KernelAddr.FlatPtr += PAGE_SIZE)
853 {
854 bool fNt31 = false;
855 DBGFADDRESS const RetryAddress = KernelAddr;
856 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
857 8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
858 if ( rc == VERR_DBGF_MEM_NOT_FOUND
859 && enmMode != CPUMMODE_LONG)
860 {
861 /* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
862 following VirtualSize is zero, so check for that too. */
863 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
864 8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
865 fNt31 = true;
866 }
867 if (RT_FAILURE(rc))
868 break;
869 DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
870
871 /* MZ + PE header. */
872 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &KernelAddr, &u, sizeof(u));
873 if ( RT_SUCCESS(rc)
874 && u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
875 && !(u.MzHdr.e_lfanew & 0x7)
876 && u.MzHdr.e_lfanew >= 0x080
877 && u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
878 {
879 if (enmMode != CPUMMODE_LONG)
880 {
881 IMAGE_NT_HEADERS32 const *pHdrs = (IMAGE_NT_HEADERS32 const *)&u.au8[u.MzHdr.e_lfanew];
882 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
883 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
884 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
885 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
886 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
887 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
888 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
889 )
890 {
891 /* Find the MTE. */
892 RT_ZERO(uMte);
893 uMte.v32.DllBase = KernelAddr.FlatPtr;
894 uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
895 uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
896 DBGFADDRESS HitAddr;
897 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
898 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
899 while (RT_SUCCESS(rc))
900 {
901 /* check the name. */
902 DBGFADDRESS MteAddr = HitAddr;
903 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
904 &uMte2.v32, sizeof(uMte2.v32));
905 if ( RT_SUCCESS(rc)
906 && uMte2.v32.DllBase == uMte.v32.DllBase
907 && uMte2.v32.EntryPoint == uMte.v32.EntryPoint
908 && uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
909 && WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
910 && WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
911 && WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
912 && uMte2.v32.BaseDllName.Length <= 128
913 && uMte2.v32.FullDllName.Length <= 260
914 )
915 {
916 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
917 u.wsz, uMte2.v32.BaseDllName.Length);
918 u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
919 if ( RT_SUCCESS(rc)
920 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
921 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
922 )
923 )
924 {
925 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
926 DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
927 &uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
928 if ( RT_SUCCESS(rc)
929 && uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
930 && WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
931 {
932 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
933 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
934 pThis->KernelAddr = KernelAddr;
935 pThis->KernelMteAddr = MteAddr;
936 pThis->PsLoadedModuleListAddr = Addr;
937 pThis->f32Bit = true;
938 pThis->fNt31 = fNt31;
939 return true;
940 }
941 }
942 else if (RT_SUCCESS(rc))
943 {
944 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
945 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
946 break; /* Not NT kernel */
947 }
948 }
949
950 /* next */
951 DBGFR3AddrAdd(&HitAddr, 4);
952 if (HitAddr.FlatPtr < uEnd)
953 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
954 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
955 else
956 rc = VERR_DBGF_MEM_NOT_FOUND;
957 }
958 }
959 }
960 else
961 {
962 IMAGE_NT_HEADERS64 const *pHdrs = (IMAGE_NT_HEADERS64 const *)&u.au8[u.MzHdr.e_lfanew];
963 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
964 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
965 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
966 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
967 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL))
968 == IMAGE_FILE_EXECUTABLE_IMAGE
969 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
970 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
971 )
972 {
973 /* Find the MTE. */
974 RT_ZERO(uMte.v64);
975 uMte.v64.DllBase = KernelAddr.FlatPtr;
976 uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
977 uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
978 DBGFADDRESS ScanAddr;
979 DBGFADDRESS HitAddr;
980 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
981 uEnd - uStart, 8 /*align*/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
982 while (RT_SUCCESS(rc))
983 {
984 /* Read the start of the MTE and check some basic members. */
985 DBGFADDRESS MteAddr = HitAddr;
986 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
987 &uMte2.v64, sizeof(uMte2.v64));
988 if ( RT_SUCCESS(rc)
989 && uMte2.v64.DllBase == uMte.v64.DllBase
990 && uMte2.v64.EntryPoint == uMte.v64.EntryPoint
991 && uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
992 && WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
993 && WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
994 && WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
995 && uMte2.v64.BaseDllName.Length <= 128
996 && uMte2.v64.FullDllName.Length <= 260
997 )
998 {
999 /* Try read the base name and compare with known NT kernel names. */
1000 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1001 u.wsz, uMte2.v64.BaseDllName.Length);
1002 u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1003 if ( RT_SUCCESS(rc)
1004 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1005 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1006 )
1007 )
1008 {
1009 /* Read the link entry of the previous entry in the list and check that its
1010 forward pointer points at the MTE we've found. */
1011 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/,
1012 DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1013 &uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1014 if ( RT_SUCCESS(rc)
1015 && uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1016 && WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1017 {
1018 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1019 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1020 pThis->KernelAddr = KernelAddr;
1021 pThis->KernelMteAddr = MteAddr;
1022 pThis->PsLoadedModuleListAddr = Addr;
1023 pThis->f32Bit = false;
1024 pThis->fNt31 = false;
1025 return true;
1026 }
1027 }
1028 else if (RT_SUCCESS(rc))
1029 {
1030 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1031 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1032 break; /* Not NT kernel */
1033 }
1034 }
1035
1036 /* next */
1037 DBGFR3AddrAdd(&HitAddr, 8);
1038 if (HitAddr.FlatPtr < uEnd)
1039 rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1040 8 /*align*/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1041 else
1042 rc = VERR_DBGF_MEM_NOT_FOUND;
1043 }
1044 }
1045 }
1046 }
1047 }
1048 return false;
1049}
1050
1051
1052/**
1053 * @copydoc DBGFOSREG::pfnDestruct
1054 */
1055static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1056{
1057 RT_NOREF2(pUVM, pvData);
1058}
1059
1060
1061/**
1062 * @copydoc DBGFOSREG::pfnConstruct
1063 */
1064static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1065{
1066 RT_NOREF1(pUVM);
1067 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1068 pThis->fValid = false;
1069 pThis->f32Bit = false;
1070 pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1071 return VINF_SUCCESS;
1072}
1073
1074
1075const DBGFOSREG g_DBGDiggerWinNt =
1076{
1077 /* .u32Magic = */ DBGFOSREG_MAGIC,
1078 /* .fFlags = */ 0,
1079 /* .cbData = */ sizeof(DBGDIGGERWINNT),
1080 /* .szName = */ "WinNT",
1081 /* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1082 /* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1083 /* .pfnProbe = */ dbgDiggerWinNtProbe,
1084 /* .pfnInit = */ dbgDiggerWinNtInit,
1085 /* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1086 /* .pfnTerm = */ dbgDiggerWinNtTerm,
1087 /* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1088 /* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1089 /* .pfnStackUnwindAssist = */ dbgDiggerWinNtStackUnwindAssist,
1090 /* .u32EndMagic = */ DBGFOSREG_MAGIC
1091};
1092
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette