VirtualBox

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 94521

Last change on this file since 94521 was 93470, checked in by vboxsync, 2 years ago

DbgPlugInDiggers,VMM,Main: Refactored the diggers and related interfaces to work via the VMM function table. Removed non-working tstVBoxDbg (needs proper COM now). bugref:10072
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 60.7 KB
Line 
1/* $Id: DBGPlugInWinNt.cpp 93470 2022-01-27 23:51:28Z vboxsync $ */
2/** @file
3 * DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4 */
5
6/*
7 * Copyright (C) 2009-2022 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23#include "DBGPlugIns.h"
24#include <VBox/vmm/dbgf.h>
25#include <VBox/vmm/cpumctx.h>
26#include <VBox/vmm/mm.h>
27#include <VBox/vmm/vmmr3vtable.h>
28#include <VBox/err.h>
29#include <VBox/param.h>
30#include <iprt/ctype.h>
31#include <iprt/ldr.h>
32#include <iprt/mem.h>
33#include <iprt/path.h>
34#include <iprt/stream.h>
35#include <iprt/string.h>
36#include <iprt/utf16.h>
37#include <iprt/formats/pecoff.h>
38#include <iprt/formats/mz.h>
39#include <iprt/nt/nt-structures.h>
40
41
42/*********************************************************************************************************************************
43* Structures and Typedefs *
44*********************************************************************************************************************************/
45
46/** @name Internal WinNT structures
47 * @{ */
48/**
49 * PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
50 * Tested with XP.
51 */
52typedef struct NTMTE32
53{
54 struct
55 {
56 uint32_t Flink;
57 uint32_t Blink;
58 } InLoadOrderLinks,
59 InMemoryOrderModuleList,
60 InInitializationOrderModuleList;
61 uint32_t DllBase;
62 uint32_t EntryPoint;
63 /** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
64 * boot loader, for other images it looks like some kind of pointer. */
65 uint32_t SizeOfImage;
66 struct
67 {
68 uint16_t Length;
69 uint16_t MaximumLength;
70 uint32_t Buffer;
71 } FullDllName,
72 BaseDllName;
73 uint32_t Flags;
74 uint16_t LoadCount;
75 uint16_t TlsIndex;
76 /* ... there is more ... */
77} NTMTE32;
78typedef NTMTE32 *PNTMTE32;
79
80/**
81 * PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
82 */
83typedef struct NTMTE64
84{
85 struct
86 {
87 uint64_t Flink;
88 uint64_t Blink;
89 } InLoadOrderLinks, /**< 0x00 */
90 InMemoryOrderModuleList, /**< 0x10 */
91 InInitializationOrderModuleList; /**< 0x20 */
92 uint64_t DllBase; /**< 0x30 */
93 uint64_t EntryPoint; /**< 0x38 */
94 uint32_t SizeOfImage; /**< 0x40 */
95 uint32_t Alignment; /**< 0x44 */
96 struct
97 {
98 uint16_t Length; /**< 0x48,0x58 */
99 uint16_t MaximumLength; /**< 0x4a,0x5a */
100 uint32_t Alignment; /**< 0x4c,0x5c */
101 uint64_t Buffer; /**< 0x50,0x60 */
102 } FullDllName, /**< 0x48 */
103 BaseDllName; /**< 0x58 */
104 uint32_t Flags; /**< 0x68 */
105 uint16_t LoadCount; /**< 0x6c */
106 uint16_t TlsIndex; /**< 0x6e */
107 /* ... there is more ... */
108} NTMTE64;
109typedef NTMTE64 *PNTMTE64;
110
111/** MTE union. */
112typedef union NTMTE
113{
114 NTMTE32 vX_32;
115 NTMTE64 vX_64;
116} NTMTE;
117typedef NTMTE *PNTMTE;
118
119
120/**
121 * The essential bits of the KUSER_SHARED_DATA structure.
122 */
123typedef struct NTKUSERSHAREDDATA
124{
125 uint32_t TickCountLowDeprecated;
126 uint32_t TickCountMultiplier;
127 struct
128 {
129 uint32_t LowPart;
130 int32_t High1Time;
131 int32_t High2Time;
132
133 } InterruptTime,
134 SystemTime,
135 TimeZoneBias;
136 uint16_t ImageNumberLow;
137 uint16_t ImageNumberHigh;
138 RTUTF16 NtSystemRoot[260];
139 uint32_t MaxStackTraceDepth;
140 uint32_t CryptoExponent;
141 uint32_t TimeZoneId;
142 uint32_t LargePageMinimum;
143 uint32_t Reserved2[6];
144 uint32_t NtBuildNumber;
145 uint32_t NtProductType;
146 uint8_t ProductTypeIsValid;
147 uint8_t abPadding[3];
148 uint32_t NtMajorVersion;
149 uint32_t NtMinorVersion;
150 /* uint8_t ProcessorFeatures[64];
151 ...
152 */
153} NTKUSERSHAREDDATA;
154typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
155
156/** KI_USER_SHARED_DATA for i386 */
157#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
158/** KI_USER_SHARED_DATA for AMD64 */
159#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
160
161/** NTKUSERSHAREDDATA::NtProductType */
162typedef enum NTPRODUCTTYPE
163{
164 kNtProductType_Invalid = 0,
165 kNtProductType_WinNt = 1,
166 kNtProductType_LanManNt,
167 kNtProductType_Server
168} NTPRODUCTTYPE;
169
170
171/** NT image header union. */
172typedef union NTHDRSU
173{
174 IMAGE_NT_HEADERS32 vX_32;
175 IMAGE_NT_HEADERS64 vX_64;
176} NTHDRS;
177/** Pointer to NT image header union. */
178typedef NTHDRS *PNTHDRS;
179/** Pointer to const NT image header union. */
180typedef NTHDRS const *PCNTHDRS;
181
182
183/**
184 * NT KD version block.
185 */
186typedef struct NTKDVERSIONBLOCK
187{
188 uint16_t MajorVersion;
189 uint16_t MinorVersion;
190 uint8_t ProtocolVersion;
191 uint8_t KdSecondaryVersion;
192 uint16_t Flags;
193 uint16_t MachineType;
194 uint8_t MaxPacketType;
195 uint8_t MaxStateChange;
196 uint8_t MaxManipulate;
197 uint8_t Simulation;
198 uint16_t Unused;
199 uint64_t KernBase;
200 uint64_t PsLoadedModuleList;
201 uint64_t DebuggerDataList;
202} NTKDVERSIONBLOCK;
203/** Pointer to an NT KD version block. */
204typedef NTKDVERSIONBLOCK *PNTKDVERSIONBLOCK;
205/** Pointer to a const NT KD version block. */
206typedef const NTKDVERSIONBLOCK *PCNTKDVERSIONBLOCK;
207
208/** @} */
209
210
211
212typedef enum DBGDIGGERWINNTVER
213{
214 DBGDIGGERWINNTVER_UNKNOWN,
215 DBGDIGGERWINNTVER_3_1,
216 DBGDIGGERWINNTVER_3_5,
217 DBGDIGGERWINNTVER_4_0,
218 DBGDIGGERWINNTVER_5_0,
219 DBGDIGGERWINNTVER_5_1,
220 DBGDIGGERWINNTVER_6_0
221} DBGDIGGERWINNTVER;
222
223/**
224 * WinNT guest OS digger instance data.
225 */
226typedef struct DBGDIGGERWINNT
227{
228 /** Whether the information is valid or not.
229 * (For fending off illegal interface method calls.) */
230 bool fValid;
231 /** 32-bit (true) or 64-bit (false) */
232 bool f32Bit;
233 /** Set if NT 3.1 was detected.
234 * This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
235 bool fNt31;
236
237 /** The NT version. */
238 DBGDIGGERWINNTVER enmVer;
239 /** NTKUSERSHAREDDATA::NtProductType */
240 NTPRODUCTTYPE NtProductType;
241 /** NTKUSERSHAREDDATA::NtMajorVersion */
242 uint32_t NtMajorVersion;
243 /** NTKUSERSHAREDDATA::NtMinorVersion */
244 uint32_t NtMinorVersion;
245 /** NTKUSERSHAREDDATA::NtBuildNumber */
246 uint32_t NtBuildNumber;
247
248 /** The address of the ntoskrnl.exe image. */
249 DBGFADDRESS KernelAddr;
250 /** The address of the ntoskrnl.exe module table entry. */
251 DBGFADDRESS KernelMteAddr;
252 /** The address of PsLoadedModuleList. */
253 DBGFADDRESS PsLoadedModuleListAddr;
254
255 /** Array of detected KPCR addresses for each vCPU. */
256 PDBGFADDRESS paKpcrAddr;
257 /** Array of detected KPCRB addresses for each vCPU. */
258 PDBGFADDRESS paKpcrbAddr;
259
260 /** The Windows NT specifics interface. */
261 DBGFOSIWINNT IWinNt;
262} DBGDIGGERWINNT;
263/** Pointer to the linux guest OS digger instance data. */
264typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
265
266
267/**
268 * The WinNT digger's loader reader instance data.
269 */
270typedef struct DBGDIGGERWINNTRDR
271{
272 /** The VM handle (referenced). */
273 PUVM pUVM;
274 /** The image base. */
275 DBGFADDRESS ImageAddr;
276 /** The image size. */
277 uint32_t cbImage;
278 /** The file offset of the SizeOfImage field in the optional header if it
279 * needs patching, otherwise set to UINT32_MAX. */
280 uint32_t offSizeOfImage;
281 /** The correct image size. */
282 uint32_t cbCorrectImageSize;
283 /** Number of entries in the aMappings table. */
284 uint32_t cMappings;
285 /** Mapping hint. */
286 uint32_t iHint;
287 /** Mapping file offset to memory offsets, ordered by file offset. */
288 struct
289 {
290 /** The file offset. */
291 uint32_t offFile;
292 /** The size of this mapping. */
293 uint32_t cbMem;
294 /** The offset to the memory from the start of the image. */
295 uint32_t offMem;
296 } aMappings[1];
297} DBGDIGGERWINNTRDR;
298/** Pointer a WinNT loader reader instance data. */
299typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
300
301
302/*********************************************************************************************************************************
303* Defined Constants And Macros *
304*********************************************************************************************************************************/
305/** Validates a 32-bit Windows NT kernel address */
306#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
307/** Validates a 64-bit Windows NT kernel address */
308#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
309/** Validates a kernel address. */
310#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
311/** Versioned and bitness wrapper. */
312#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
313
314/** The length (in chars) of the kernel file name (no path). */
315#define WINNT_KERNEL_BASE_NAME_LEN 12
316
317/** WindowsNT on little endian ASCII systems. */
318#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
319
320
321/*********************************************************************************************************************************
322* Internal Functions *
323*********************************************************************************************************************************/
324static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData);
325
326
327/*********************************************************************************************************************************
328* Global Variables *
329*********************************************************************************************************************************/
330/** Kernel names. */
331static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
332{
333 { 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
334};
335
336
337
338/**
339 * Tries to resolve the KPCR and KPCRB addresses for each vCPU.
340 *
341 * @returns nothing.
342 * @param pThis The instance data.
343 * @param pUVM The user mode VM handle.
344 * @param pVMM The VMM function table.
345 */
346static void dbgDiggerWinNtResolveKpcr(PDBGDIGGERWINNT pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
347{
348 /*
349 * Getting at the KPCR and KPCRB is explained here:
350 * https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kpcr.htm
351 * Together with the available offsets from:
352 * https://github.com/tpn/winsdk-10/blob/master/Include/10.0.16299.0/shared/ksamd64.inc#L883
353 * we can verify that the found addresses are valid by cross checking that the GDTR and self reference
354 * match what we expect.
355 */
356 VMCPUID cCpus = pVMM->pfnDBGFR3CpuGetCount(pUVM);
357 pThis->paKpcrAddr = (PDBGFADDRESS)RTMemAllocZ(cCpus * 2 * sizeof(DBGFADDRESS));
358 if (RT_LIKELY(pThis->paKpcrAddr))
359 {
360 pThis->paKpcrbAddr = &pThis->paKpcrAddr[cCpus];
361
362 /* Work each CPU, unexpected values in each CPU make the whole thing fail to play safe. */
363 int rc = VINF_SUCCESS;
364 for (VMCPUID idCpu = 0; (idCpu < cCpus) && RT_SUCCESS(rc); idCpu++)
365 {
366 PDBGFADDRESS pKpcrAddr = &pThis->paKpcrAddr[idCpu];
367 PDBGFADDRESS pKpcrbAddr = &pThis->paKpcrbAddr[idCpu];
368
369 if (pThis->f32Bit)
370 {
371 /* Read FS base */
372 uint32_t GCPtrKpcrBase = 0;
373
374 rc = pVMM->pfnDBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_FS_BASE, &GCPtrKpcrBase);
375 if ( RT_SUCCESS(rc)
376 && WINNT32_VALID_ADDRESS(GCPtrKpcrBase))
377 {
378 /*
379 * Read the start of the KPCR (@todo Probably move this to a global header)
380 * and verify its content.
381 */
382 struct
383 {
384 uint8_t abOoi[28]; /* Out of interest */
385 uint32_t GCPtrSelf;
386 uint32_t GCPtrCurrentPrcb;
387 uint32_t u32Irql;
388 uint32_t u32Iir;
389 uint32_t u32IirActive;
390 uint32_t u32Idr;
391 uint32_t GCPtrKdVersionBlock;
392 uint32_t GCPtrIdt;
393 uint32_t GCPtrGdt;
394 uint32_t GCPtrTss;
395 } Kpcr;
396
397 LogFlow(("DigWinNt/KPCR[%u]: GS Base %RGv\n", idCpu, GCPtrKpcrBase));
398 pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrAddr, GCPtrKpcrBase);
399
400 rc = pVMM->pfnDBGFR3MemRead(pUVM, idCpu, pKpcrAddr, &Kpcr, sizeof(Kpcr));
401 if (RT_SUCCESS(rc))
402 {
403 uint32_t GCPtrGdt = 0;
404 uint32_t GCPtrIdt = 0;
405
406 rc = pVMM->pfnDBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_GDTR_BASE, &GCPtrGdt);
407 if (RT_SUCCESS(rc))
408 rc = pVMM->pfnDBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_IDTR_BASE, &GCPtrIdt);
409 if (RT_SUCCESS(rc))
410 {
411 if ( Kpcr.GCPtrGdt == GCPtrGdt
412 && Kpcr.GCPtrIdt == GCPtrIdt
413 && Kpcr.GCPtrSelf == pKpcrAddr->FlatPtr)
414 {
415 pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrbAddr, Kpcr.GCPtrCurrentPrcb);
416 LogRel(("DigWinNt/KPCR[%u]: KPCR=%RGv KPCRB=%RGv\n", idCpu, pKpcrAddr->FlatPtr, pKpcrbAddr->FlatPtr));
417
418 /*
419 * Try to extract the NT build number from the KD version block if it exists,
420 * the shared user data might have set it to 0.
421 *
422 * @todo We can use this method to get at the kern base and loaded module list if the other detection
423 * method fails (seen with Windows 10 x86).
424 * @todo On 32bit Windows the debugger data list is also always accessible this way contrary to
425 * the amd64 version where it is only available with "/debug on" set.
426 */
427 if (!pThis->NtBuildNumber)
428 {
429 NTKDVERSIONBLOCK KdVersBlock;
430 DBGFADDRESS AddrKdVersBlock;
431
432 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrKdVersBlock, Kpcr.GCPtrKdVersionBlock);
433 rc = pVMM->pfnDBGFR3MemRead(pUVM, idCpu, &AddrKdVersBlock, &KdVersBlock, sizeof(KdVersBlock));
434 if (RT_SUCCESS(rc))
435 pThis->NtBuildNumber = KdVersBlock.MinorVersion;
436 }
437 }
438 else
439 LogRel(("DigWinNt/KPCR[%u]: KPCR validation error GDT=(%RGv vs %RGv) KPCR=(%RGv vs %RGv)\n", idCpu,
440 Kpcr.GCPtrGdt, GCPtrGdt, Kpcr.GCPtrSelf, pKpcrAddr->FlatPtr));
441 }
442 else
443 LogRel(("DigWinNt/KPCR[%u]: Getting GDT or IDT base register failed with %Rrc\n", idCpu, rc));
444 }
445 }
446 else
447 LogRel(("DigWinNt/KPCR[%u]: Getting FS base register failed with %Rrc (%RGv)\n", idCpu, rc, GCPtrKpcrBase));
448 }
449 else
450 {
451 /* Read GS base which points to the base of the KPCR for each CPU. */
452 RTGCUINTPTR GCPtrTmp = 0;
453 rc = pVMM->pfnDBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_GS_BASE, &GCPtrTmp);
454 if ( RT_SUCCESS(rc)
455 && !WINNT64_VALID_ADDRESS(GCPtrTmp))
456 {
457 /*
458 * Could be a user address when we stopped the VM right in usermode,
459 * read the GS kernel base MSR instead.
460 */
461 rc = pVMM->pfnDBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_MSR_K8_KERNEL_GS_BASE, &GCPtrTmp);
462 }
463
464 if ( RT_SUCCESS(rc)
465 && WINNT64_VALID_ADDRESS(GCPtrTmp))
466 {
467 LogFlow(("DigWinNt/KPCR[%u]: GS Base %RGv\n", idCpu, GCPtrTmp));
468 pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrAddr, GCPtrTmp);
469
470 rc = pVMM->pfnDBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_GDTR_BASE, &GCPtrTmp);
471 if (RT_SUCCESS(rc))
472 {
473 /*
474 * Read the start of the KPCR (@todo Probably move this to a global header)
475 * and verify its content.
476 */
477 struct
478 {
479 RTGCUINTPTR GCPtrGdt;
480 RTGCUINTPTR GCPtrTss;
481 RTGCUINTPTR GCPtrUserRsp;
482 RTGCUINTPTR GCPtrSelf;
483 RTGCUINTPTR GCPtrCurrentPrcb;
484 } Kpcr;
485
486 rc = pVMM->pfnDBGFR3MemRead(pUVM, idCpu, pKpcrAddr, &Kpcr, sizeof(Kpcr));
487 if (RT_SUCCESS(rc))
488 {
489 if ( Kpcr.GCPtrGdt == GCPtrTmp
490 && Kpcr.GCPtrSelf == pKpcrAddr->FlatPtr
491 /** @todo && TSS */ )
492 {
493 pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrbAddr, Kpcr.GCPtrCurrentPrcb);
494 LogRel(("DigWinNt/KPCR[%u]: KPCR=%RGv KPCRB=%RGv\n", idCpu, pKpcrAddr->FlatPtr, pKpcrbAddr->FlatPtr));
495 }
496 else
497 LogRel(("DigWinNt/KPCR[%u]: KPCR validation error GDT=(%RGv vs %RGv) KPCR=(%RGv vs %RGv)\n", idCpu,
498 Kpcr.GCPtrGdt, GCPtrTmp, Kpcr.GCPtrSelf, pKpcrAddr->FlatPtr));
499 }
500 else
501 LogRel(("DigWinNt/KPCR[%u]: Reading KPCR start at %RGv failed with %Rrc\n", idCpu, pKpcrAddr->FlatPtr, rc));
502 }
503 else
504 LogRel(("DigWinNt/KPCR[%u]: Getting GDT base register failed with %Rrc\n", idCpu, rc));
505 }
506 else
507 LogRel(("DigWinNt/KPCR[%u]: Getting GS base register failed with %Rrc\n", idCpu, rc));
508 }
509 }
510
511 if (RT_FAILURE(rc))
512 {
513 LogRel(("DigWinNt/KPCR: Failed to detmine KPCR and KPCRB rc=%Rrc\n", rc));
514 RTMemFree(pThis->paKpcrAddr);
515 pThis->paKpcrAddr = NULL;
516 pThis->paKpcrbAddr = NULL;
517 }
518 }
519 else
520 LogRel(("DigWinNt/KPCR: Failed to allocate %u entries for the KPCR/KPCRB addresses\n", cCpus * 2));
521}
522
523
524/**
525 * Process a PE image found in guest memory.
526 *
527 * @param pThis The instance data.
528 * @param pUVM The user mode VM handle.
529 * @param pVMM The VMM function table.
530 * @param pszName The module name.
531 * @param pszFilename The image filename.
532 * @param pImageAddr The image address.
533 * @param cbImage The size of the image.
534 */
535static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, const char *pszName,
536 const char *pszFilename, PCDBGFADDRESS pImageAddr, uint32_t cbImage)
537{
538 LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
539
540 /*
541 * Do some basic validation first.
542 */
543 if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
544 || cbImage >= _1M * 256)
545 {
546 Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
547 return;
548 }
549
550 /*
551 * Use the common in-memory module reader to create a debug module.
552 */
553 RTERRINFOSTATIC ErrInfo;
554 RTDBGMOD hDbgMod = NIL_RTDBGMOD;
555 int rc = pVMM->pfnDBGFR3ModInMem(pUVM, pImageAddr, pThis->fNt31 ? DBGFMODINMEM_F_PE_NT31 : 0, pszName, pszFilename,
556 pThis->f32Bit ? RTLDRARCH_X86_32 : RTLDRARCH_AMD64, cbImage,
557 &hDbgMod, RTErrInfoInitStatic(&ErrInfo));
558 if (RT_SUCCESS(rc))
559 {
560 /*
561 * Tag the module.
562 */
563 rc = RTDbgModSetTag(hDbgMod, DIG_WINNT_MOD_TAG);
564 AssertRC(rc);
565
566 /*
567 * Link the module.
568 */
569 RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
570 if (hAs != NIL_RTDBGAS)
571 rc = RTDbgAsModuleLink(hAs, hDbgMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
572 else
573 rc = VERR_INTERNAL_ERROR;
574 RTDbgModRelease(hDbgMod);
575 RTDbgAsRelease(hAs);
576 }
577 else if (RTErrInfoIsSet(&ErrInfo.Core))
578 Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc - %s\n", pszName, rc, ErrInfo.Core.pszMsg));
579 else
580 Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc\n", pszName, rc));
581}
582
583
584/**
585 * Generate a debugger compatible module name from a filename.
586 *
587 * @returns Pointer to module name (doesn't need to be pszName).
588 * @param pszFilename The source filename.
589 * @param pszName Buffer to put the module name in.
590 * @param cbName Buffer size.
591 */
592static const char *dbgDiggerWintNtFilenameToModuleName(const char *pszFilename, char *pszName, size_t cbName)
593{
594 /* Skip to the filename part of the filename. :-) */
595 pszFilename = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
596
597 /* We try use 'nt' for the kernel. */
598 if ( RTStrICmpAscii(pszFilename, "ntoskrnl.exe") == 0
599 || RTStrICmpAscii(pszFilename, "ntkrnlmp.exe") == 0)
600 return "nt";
601
602
603 /* Drop the extension if .dll or .sys. */
604 size_t cchFilename = strlen(pszFilename);
605 if ( cchFilename > 4
606 && pszFilename[cchFilename - 4] == '.')
607 {
608 if ( RTStrICmpAscii(&pszFilename[cchFilename - 4], ".sys") == 0
609 || RTStrICmpAscii(&pszFilename[cchFilename - 4], ".dll") == 0)
610 cchFilename -= 4;
611 }
612
613 /* Copy and do replacements. */
614 if (cchFilename >= cbName)
615 cchFilename = cbName - 1;
616 size_t off;
617 for (off = 0; off < cchFilename; off++)
618 {
619 char ch = pszFilename[off];
620 if (!RT_C_IS_ALNUM(ch))
621 ch = '_';
622 pszName[off] = ch;
623 }
624 pszName[off] = '\0';
625 return pszName;
626}
627
628
629/**
630 * @interface_method_impl{DBGFOSIWINNT,pfnQueryVersion}
631 */
632static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryVersion(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
633 uint32_t *puVersMajor, uint32_t *puVersMinor,
634 uint32_t *puBuildNumber, bool *pf32Bit)
635{
636 PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
637 RT_NOREF(pUVM, pVMM);
638
639 if (puVersMajor)
640 *puVersMajor = pData->NtMajorVersion;
641 if (puVersMinor)
642 *puVersMinor = pData->NtMinorVersion;
643 if (puBuildNumber)
644 *puBuildNumber = pData->NtBuildNumber;
645 if (pf32Bit)
646 *pf32Bit = pData->f32Bit;
647 return VINF_SUCCESS;
648}
649
650
651/**
652 * @interface_method_impl{DBGFOSIWINNT,pfnQueryKernelPtrs}
653 */
654static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryKernelPtrs(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
655 PRTGCUINTPTR pGCPtrKernBase, PRTGCUINTPTR pGCPtrPsLoadedModuleList)
656{
657 PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
658 RT_NOREF(pUVM, pVMM);
659
660 *pGCPtrKernBase = pData->KernelAddr.FlatPtr;
661 *pGCPtrPsLoadedModuleList = pData->PsLoadedModuleListAddr.FlatPtr;
662 return VINF_SUCCESS;
663}
664
665
666/**
667 * @interface_method_impl{DBGFOSIWINNT,pfnQueryKpcrForVCpu}
668 */
669static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryKpcrForVCpu(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
670 VMCPUID idCpu, PRTGCUINTPTR pKpcr, PRTGCUINTPTR pKpcrb)
671{
672 PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
673
674 if (!pData->paKpcrAddr)
675 return VERR_NOT_SUPPORTED;
676
677 AssertReturn(idCpu < pVMM->pfnDBGFR3CpuGetCount(pUVM), VERR_INVALID_CPU_ID);
678
679 if (pKpcr)
680 *pKpcr = pData->paKpcrAddr[idCpu].FlatPtr;
681 if (pKpcrb)
682 *pKpcrb = pData->paKpcrbAddr[idCpu].FlatPtr;
683 return VINF_SUCCESS;
684}
685
686
687/**
688 * @interface_method_impl{DBGFOSIWINNT,pfnQueryCurThrdForVCpu}
689 */
690static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryCurThrdForVCpu(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
691 VMCPUID idCpu, PRTGCUINTPTR pCurThrd)
692{
693 PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
694
695 if (!pData->paKpcrAddr)
696 return VERR_NOT_SUPPORTED;
697
698 AssertReturn(idCpu < pVMM->pfnDBGFR3CpuGetCount(pUVM), VERR_INVALID_CPU_ID);
699
700 DBGFADDRESS AddrCurThrdPtr = pData->paKpcrbAddr[idCpu];
701 pVMM->pfnDBGFR3AddrAdd(&AddrCurThrdPtr, 0x08); /** @todo Make this prettier. */
702 return pVMM->pfnDBGFR3MemRead(pUVM, idCpu, &AddrCurThrdPtr, pCurThrd, sizeof(*pCurThrd));
703}
704
705
706/**
707 * @copydoc DBGFOSREG::pfnStackUnwindAssist
708 */
709static DECLCALLBACK(int) dbgDiggerWinNtStackUnwindAssist(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, VMCPUID idCpu,
710 PDBGFSTACKFRAME pFrame, PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx,
711 RTDBGAS hAs, uint64_t *puScratch)
712{
713 Assert(pInitialCtx);
714
715 /*
716 * We want to locate trap frames here. The trap frame structure contains
717 * the 64-bit IRET frame, so given unwind information it's easy to identify
718 * using the return type and frame address.
719 */
720 if (pFrame->fFlags & DBGFSTACKFRAME_FLAGS_64BIT)
721 {
722 /*
723 * Is this a trap frame? If so, try read the trap frame.
724 */
725 if ( pFrame->enmReturnType == RTDBGRETURNTYPE_IRET64
726 && !(pFrame->AddrFrame.FlatPtr & 0x7)
727 && WINNT64_VALID_ADDRESS(pFrame->AddrFrame.FlatPtr) )
728 {
729 KTRAP_FRAME_AMD64 TrapFrame;
730 RT_ZERO(TrapFrame);
731 uint64_t const uTrapFrameAddr = pFrame->AddrFrame.FlatPtr
732 - RT_UOFFSETOF(KTRAP_FRAME_AMD64, ErrCdOrXcptFrameOrS);
733 int rc = pState->pfnReadStack(pState, uTrapFrameAddr, sizeof(TrapFrame), &TrapFrame);
734 if (RT_SUCCESS(rc))
735 {
736 /* Valid? Not too much else we can check here (EFlags isn't
737 reliable in manually construct frames). */
738 if (TrapFrame.ExceptionActive <= 2)
739 {
740 pFrame->fFlags |= DBGFSTACKFRAME_FLAGS_TRAP_FRAME;
741
742 /*
743 * Add sure 'register' information from the frame to the frame.
744 *
745 * To avoid code duplication, we do this in two steps in a loop.
746 * The first iteration only figures out how many registers we're
747 * going to save and allocates room for them. The second iteration
748 * does the actual adding.
749 */
750 uint32_t cRegs = pFrame->cSureRegs;
751 PDBGFREGVALEX paSureRegs = NULL;
752#define ADD_REG_NAMED(a_Type, a_ValMemb, a_Value, a_pszName) do { \
753 if (paSureRegs) \
754 { \
755 paSureRegs[iReg].pszName = a_pszName;\
756 paSureRegs[iReg].enmReg = DBGFREG_END; \
757 paSureRegs[iReg].enmType = a_Type; \
758 paSureRegs[iReg].Value.a_ValMemb = (a_Value); \
759 } \
760 iReg++; \
761 } while (0)
762#define MAYBE_ADD_GREG(a_Value, a_enmReg, a_idxReg) do { \
763 if (!(pState->u.x86.Loaded.s.fRegs & RT_BIT(a_idxReg))) \
764 { \
765 if (paSureRegs) \
766 { \
767 pState->u.x86.Loaded.s.fRegs |= RT_BIT(a_idxReg); \
768 pState->u.x86.auRegs[a_idxReg] = (a_Value); \
769 paSureRegs[iReg].Value.u64 = (a_Value); \
770 paSureRegs[iReg].enmReg = a_enmReg; \
771 paSureRegs[iReg].enmType = DBGFREGVALTYPE_U64; \
772 paSureRegs[iReg].pszName = NULL; \
773 } \
774 iReg++; \
775 } \
776 } while (0)
777 for (unsigned iLoop = 0; iLoop < 2; iLoop++)
778 {
779 uint32_t iReg = pFrame->cSureRegs;
780 ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, uTrapFrameAddr, "TrapFrame");
781 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.ExceptionActive, "ExceptionActive");
782 if (TrapFrame.ExceptionActive == 0)
783 {
784 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.PreviousIrql, "PrevIrql");
785 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, (uint8_t)TrapFrame.ErrCdOrXcptFrameOrS, "IntNo");
786 }
787 else if ( TrapFrame.ExceptionActive == 1
788 && TrapFrame.FaultIndicator == ((TrapFrame.ErrCdOrXcptFrameOrS >> 1) & 0x9))
789 ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, TrapFrame.FaultAddrOrCtxRecOrTS, "cr2-probably");
790 if (TrapFrame.SegCs & X86_SEL_RPL)
791 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "UserMode");
792 else
793 ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "KernelMode");
794 if (TrapFrame.ExceptionActive <= 1)
795 {
796 MAYBE_ADD_GREG(TrapFrame.Rax, DBGFREG_RAX, X86_GREG_xAX);
797 MAYBE_ADD_GREG(TrapFrame.Rcx, DBGFREG_RCX, X86_GREG_xCX);
798 MAYBE_ADD_GREG(TrapFrame.Rdx, DBGFREG_RDX, X86_GREG_xDX);
799 MAYBE_ADD_GREG(TrapFrame.R8, DBGFREG_R8, X86_GREG_x8);
800 MAYBE_ADD_GREG(TrapFrame.R9, DBGFREG_R9, X86_GREG_x9);
801 MAYBE_ADD_GREG(TrapFrame.R10, DBGFREG_R10, X86_GREG_x10);
802 MAYBE_ADD_GREG(TrapFrame.R11, DBGFREG_R11, X86_GREG_x11);
803 }
804 else if (TrapFrame.ExceptionActive == 2)
805 {
806 MAYBE_ADD_GREG(TrapFrame.Rbx, DBGFREG_RBX, X86_GREG_xBX);
807 MAYBE_ADD_GREG(TrapFrame.Rsi, DBGFREG_RSI, X86_GREG_xSI);
808 MAYBE_ADD_GREG(TrapFrame.Rdi, DBGFREG_RDI, X86_GREG_xDI);
809 }
810 // MAYBE_ADD_GREG(TrapFrame.Rbp, DBGFREG_RBP, X86_GREG_xBP); - KiInterrupt[Sub]Dispatch* may leave this invalid.
811
812 /* Done? */
813 if (iLoop > 0)
814 {
815 Assert(cRegs == iReg);
816 break;
817 }
818
819 /* Resize the array, zeroing the extension. */
820 if (pFrame->cSureRegs)
821 paSureRegs = (PDBGFREGVALEX)pVMM->pfnMMR3HeapRealloc(pFrame->paSureRegs, iReg * sizeof(paSureRegs[0]));
822 else
823 paSureRegs = (PDBGFREGVALEX)pVMM->pfnMMR3HeapAllocU(pUVM, MM_TAG_DBGF_STACK, iReg * sizeof(paSureRegs[0]));
824 AssertReturn(paSureRegs, VERR_NO_MEMORY);
825
826 pFrame->paSureRegs = paSureRegs;
827 RT_BZERO(&paSureRegs[pFrame->cSureRegs], (iReg - pFrame->cSureRegs) * sizeof(paSureRegs[0]));
828 cRegs = iReg;
829 }
830#undef ADD_REG_NAMED
831#undef MAYBE_ADD_GREG
832
833 /* Commit the register update. */
834 pFrame->cSureRegs = cRegs;
835 }
836 }
837 }
838 }
839
840 RT_NOREF(pUVM, pVMM, pvData, idCpu, hAs, pInitialCtx, puScratch);
841 return VINF_SUCCESS;
842}
843
844
845/**
846 * @copydoc DBGFOSREG::pfnQueryInterface
847 */
848static DECLCALLBACK(void *) dbgDiggerWinNtQueryInterface(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, DBGFOSINTERFACE enmIf)
849{
850 RT_NOREF(pUVM, pVMM);
851 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
852
853 switch (enmIf)
854 {
855 case DBGFOSINTERFACE_WINNT:
856 return &pThis->IWinNt;
857 default:
858 return NULL;
859 }
860}
861
862
863/**
864 * @copydoc DBGFOSREG::pfnQueryVersion
865 */
866static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData,
867 char *pszVersion, size_t cchVersion)
868{
869 RT_NOREF(pUVM, pVMM);
870 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
871 Assert(pThis->fValid);
872
873 const char *pszNtProductType;
874 switch (pThis->NtProductType)
875 {
876 case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
877 case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
878 case kNtProductType_Server: pszNtProductType = "-Server"; break;
879 default: pszNtProductType = ""; break;
880 }
881
882 RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s (BuildNumber %u)", pThis->NtMajorVersion, pThis->NtMinorVersion,
883 pThis->f32Bit ? "x86" : "AMD64", pszNtProductType, pThis->NtBuildNumber);
884 return VINF_SUCCESS;
885}
886
887
888/**
889 * @copydoc DBGFOSREG::pfnTerm
890 */
891static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
892{
893 RT_NOREF1(pUVM);
894 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
895 Assert(pThis->fValid);
896
897 /*
898 * As long as we're using our private LDR reader implementation,
899 * we must unlink and ditch the modules we created.
900 */
901 RTDBGAS hDbgAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
902 if (hDbgAs != NIL_RTDBGAS)
903 {
904 uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
905 while (iMod-- > 0)
906 {
907 RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
908 if (hMod != NIL_RTDBGMOD)
909 {
910 if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
911 {
912 int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
913 AssertRC(rc);
914 }
915 RTDbgModRelease(hMod);
916 }
917 }
918 RTDbgAsRelease(hDbgAs);
919 }
920
921 if (pThis->paKpcrAddr)
922 RTMemFree(pThis->paKpcrAddr);
923 /* pThis->paKpcrbAddr comes from the same allocation as pThis->paKpcrAddr. */
924
925 pThis->paKpcrAddr = NULL;
926 pThis->paKpcrbAddr = NULL;
927
928 pThis->fValid = false;
929}
930
931
932/**
933 * @copydoc DBGFOSREG::pfnRefresh
934 */
935static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
936{
937 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
938 NOREF(pThis);
939 Assert(pThis->fValid);
940
941 /*
942 * For now we'll flush and reload everything.
943 */
944 dbgDiggerWinNtTerm(pUVM, pVMM, pvData);
945
946 return dbgDiggerWinNtInit(pUVM, pVMM, pvData);
947}
948
949
950/**
951 * @copydoc DBGFOSREG::pfnInit
952 */
953static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
954{
955 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
956 Assert(!pThis->fValid);
957
958 union
959 {
960 uint8_t au8[0x2000];
961 RTUTF16 wsz[0x2000/2];
962 NTKUSERSHAREDDATA UserSharedData;
963 } u;
964 DBGFADDRESS Addr;
965 int rc;
966
967 /*
968 * Figure the NT version.
969 */
970 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
971 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &u, PAGE_SIZE);
972 if (RT_SUCCESS(rc))
973 {
974 pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
975 ? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
976 : kNtProductType_Invalid;
977 pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
978 pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
979 pThis->NtBuildNumber = u.UserSharedData.NtBuildNumber;
980 }
981 else if (pThis->fNt31)
982 {
983 pThis->NtProductType = kNtProductType_WinNt;
984 pThis->NtMajorVersion = 3;
985 pThis->NtMinorVersion = 1;
986 pThis->NtBuildNumber = 0;
987 }
988 else
989 {
990 Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
991 return rc;
992 }
993
994 /*
995 * Dig out the module chain.
996 */
997 DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
998 Addr = pThis->KernelMteAddr;
999 do
1000 {
1001 /* Read the validate the MTE. */
1002 NTMTE Mte;
1003 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
1004 if (RT_FAILURE(rc))
1005 break;
1006 if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
1007 {
1008 Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
1009 break;
1010 }
1011 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
1012 {
1013 Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
1014 break;
1015 }
1016 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
1017 {
1018 Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
1019 break;
1020 }
1021 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
1022 {
1023 Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
1024 break;
1025 }
1026 if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
1027 {
1028 Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
1029 break;
1030 }
1031
1032 uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
1033 if ( !pThis->fNt31
1034 && ( cbImageMte > _256M
1035 || WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
1036 {
1037 Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
1038 Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
1039 break;
1040 }
1041
1042 /* Read the full name. */
1043 DBGFADDRESS AddrName;
1044 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
1045 uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
1046 if (cbName < sizeof(u))
1047 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
1048 else
1049 rc = VERR_OUT_OF_RANGE;
1050 if (RT_FAILURE(rc))
1051 {
1052 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
1053 cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
1054 if (cbName < sizeof(u))
1055 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &AddrName, &u, cbName);
1056 else
1057 rc = VERR_OUT_OF_RANGE;
1058 }
1059 if (RT_SUCCESS(rc))
1060 {
1061 u.wsz[cbName / 2] = '\0';
1062
1063 char *pszFilename;
1064 rc = RTUtf16ToUtf8(u.wsz, &pszFilename);
1065 if (RT_SUCCESS(rc))
1066 {
1067 char szModName[128];
1068 const char *pszModName = dbgDiggerWintNtFilenameToModuleName(pszFilename, szModName, sizeof(szModName));
1069
1070 /* Read the start of the PE image and pass it along to a worker. */
1071 DBGFADDRESS ImageAddr;
1072 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
1073 dbgDiggerWinNtProcessImage(pThis, pUVM, pVMM, pszModName, pszFilename, &ImageAddr, cbImageMte);
1074 RTStrFree(pszFilename);
1075 }
1076 }
1077
1078 /* next */
1079 AddrPrev = Addr;
1080 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
1081 } while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
1082 && Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
1083
1084 /* Try resolving the KPCR and KPCRB addresses for each vCPU. */
1085 dbgDiggerWinNtResolveKpcr(pThis, pUVM, pVMM);
1086
1087 pThis->fValid = true;
1088 return VINF_SUCCESS;
1089}
1090
1091
1092/**
1093 * @copydoc DBGFOSREG::pfnProbe
1094 */
1095static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1096{
1097 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1098 DBGFADDRESS Addr;
1099 union
1100 {
1101 uint8_t au8[8192];
1102 uint16_t au16[8192/2];
1103 uint32_t au32[8192/4];
1104 IMAGE_DOS_HEADER MzHdr;
1105 RTUTF16 wsz[8192/2];
1106 X86DESCGATE a32Gates[X86_XCPT_PF + 1];
1107 X86DESC64GATE a64Gates[X86_XCPT_PF + 1];
1108 } u;
1109
1110 union
1111 {
1112 NTMTE32 v32;
1113 NTMTE64 v64;
1114 } uMte, uMte2, uMte3;
1115
1116 /*
1117 * NT only runs in protected or long mode.
1118 */
1119 CPUMMODE const enmMode = pVMM->pfnDBGFR3CpuGetMode(pUVM, 0 /*idCpu*/);
1120 if (enmMode != CPUMMODE_PROTECTED && enmMode != CPUMMODE_LONG)
1121 return false;
1122 bool const f64Bit = enmMode == CPUMMODE_LONG;
1123 uint64_t const uStart = f64Bit ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
1124 uint64_t const uEnd = f64Bit ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
1125
1126 /*
1127 * To approximately locate the kernel we examine the IDTR handlers.
1128 *
1129 * The exception/trap/fault handlers are all in NT kernel image, we pick
1130 * KiPageFault here.
1131 */
1132 uint64_t uIdtrBase = 0;
1133 uint16_t uIdtrLimit = 0;
1134 int rc = pVMM->pfnDBGFR3RegCpuQueryXdtr(pUVM, 0, DBGFREG_IDTR, &uIdtrBase, &uIdtrLimit);
1135 AssertRCReturn(rc, false);
1136
1137 const uint16_t cbMinIdtr = (X86_XCPT_PF + 1) * (f64Bit ? sizeof(X86DESC64GATE) : sizeof(X86DESCGATE));
1138 if (uIdtrLimit < cbMinIdtr)
1139 return false;
1140
1141 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uIdtrBase), &u, cbMinIdtr);
1142 if (RT_FAILURE(rc))
1143 return false;
1144
1145 uint64_t uKrnlStart = uStart;
1146 uint64_t uKrnlEnd = uEnd;
1147 if (f64Bit)
1148 {
1149 uint64_t uHandler = u.a64Gates[X86_XCPT_PF].u16OffsetLow
1150 | ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16)
1151 | ((uint64_t)u.a64Gates[X86_XCPT_PF].u32OffsetTop << 32);
1152 if (uHandler < uStart || uHandler > uEnd)
1153 return false;
1154 uKrnlStart = (uHandler & ~(uint64_t)_4M) - _512M;
1155 uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
1156 }
1157 else
1158 {
1159 uint32_t uHandler = RT_MAKE_U32(u.a32Gates[X86_XCPT_PF].u16OffsetLow, u.a32Gates[X86_XCPT_PF].u16OffsetHigh);
1160 if (uHandler < uStart || uHandler > uEnd)
1161 return false;
1162 uKrnlStart = (uHandler & ~(uint64_t)_4M) - _64M;
1163 uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
1164 }
1165
1166 /*
1167 * Look for the PAGELK section name that seems to be a part of all kernels.
1168 * Then try find the module table entry for it. Since it's the first entry
1169 * in the PsLoadedModuleList we can easily validate the list head and report
1170 * success.
1171 *
1172 * Note! We ASSUME the section name is 8 byte aligned.
1173 */
1174 DBGFADDRESS KernelAddr;
1175 for (pVMM->pfnDBGFR3AddrFromFlat(pUVM, &KernelAddr, uKrnlStart);
1176 KernelAddr.FlatPtr < uKrnlEnd;
1177 KernelAddr.FlatPtr += PAGE_SIZE)
1178 {
1179 bool fNt31 = false;
1180 DBGFADDRESS const RetryAddress = KernelAddr;
1181 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1182 8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
1183 if ( rc == VERR_DBGF_MEM_NOT_FOUND
1184 && enmMode != CPUMMODE_LONG)
1185 {
1186 /* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
1187 following VirtualSize is zero, so check for that too. */
1188 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
1189 8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
1190 fNt31 = true;
1191 }
1192 if (RT_FAILURE(rc))
1193 break;
1194 pVMM->pfnDBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
1195
1196 /* MZ + PE header. */
1197 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/, &KernelAddr, &u, sizeof(u));
1198 if ( RT_SUCCESS(rc)
1199 && u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
1200 && !(u.MzHdr.e_lfanew & 0x7)
1201 && u.MzHdr.e_lfanew >= 0x080
1202 && u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
1203 {
1204 if (enmMode != CPUMMODE_LONG)
1205 {
1206 IMAGE_NT_HEADERS32 const *pHdrs = (IMAGE_NT_HEADERS32 const *)&u.au8[u.MzHdr.e_lfanew];
1207 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1208 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
1209 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1210 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1211 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
1212 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
1213 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1214 )
1215 {
1216 /* Find the MTE. */
1217 RT_ZERO(uMte);
1218 uMte.v32.DllBase = KernelAddr.FlatPtr;
1219 uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1220 uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
1221 DBGFADDRESS HitAddr;
1222 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1223 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1224 while (RT_SUCCESS(rc))
1225 {
1226 /* check the name. */
1227 DBGFADDRESS MteAddr = HitAddr;
1228 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1229 pVMM->pfnDBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
1230 &uMte2.v32, sizeof(uMte2.v32));
1231 if ( RT_SUCCESS(rc)
1232 && uMte2.v32.DllBase == uMte.v32.DllBase
1233 && uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1234 && uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1235 && WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1236 && WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1237 && WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1238 && uMte2.v32.BaseDllName.Length <= 128
1239 && uMte2.v32.FullDllName.Length <= 260
1240 )
1241 {
1242 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1243 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1244 u.wsz, uMte2.v32.BaseDllName.Length);
1245 u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1246 if ( RT_SUCCESS(rc)
1247 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1248 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1249 )
1250 )
1251 {
1252 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1253 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1254 uMte2.v32.InLoadOrderLinks.Blink),
1255 &uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1256 if ( RT_SUCCESS(rc)
1257 && uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1258 && WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1259 {
1260 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1261 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1262 pThis->KernelAddr = KernelAddr;
1263 pThis->KernelMteAddr = MteAddr;
1264 pThis->PsLoadedModuleListAddr = Addr;
1265 pThis->f32Bit = true;
1266 pThis->fNt31 = fNt31;
1267 return true;
1268 }
1269 }
1270 else if (RT_SUCCESS(rc))
1271 {
1272 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1273 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1274 break; /* Not NT kernel */
1275 }
1276 }
1277
1278 /* next */
1279 pVMM->pfnDBGFR3AddrAdd(&HitAddr, 4);
1280 if (HitAddr.FlatPtr < uEnd)
1281 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1282 4 /*align*/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1283 else
1284 rc = VERR_DBGF_MEM_NOT_FOUND;
1285 }
1286 }
1287 }
1288 else
1289 {
1290 IMAGE_NT_HEADERS64 const *pHdrs = (IMAGE_NT_HEADERS64 const *)&u.au8[u.MzHdr.e_lfanew];
1291 if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1292 && pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1293 && pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1294 && pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1295 && (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_DLL))
1296 == IMAGE_FILE_EXECUTABLE_IMAGE
1297 && pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1298 && pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1299 )
1300 {
1301 /* Find the MTE. */
1302 RT_ZERO(uMte.v64);
1303 uMte.v64.DllBase = KernelAddr.FlatPtr;
1304 uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1305 uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1306 DBGFADDRESS ScanAddr;
1307 DBGFADDRESS HitAddr;
1308 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1309 uEnd - uStart, 8 /*align*/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1310 while (RT_SUCCESS(rc))
1311 {
1312 /* Read the start of the MTE and check some basic members. */
1313 DBGFADDRESS MteAddr = HitAddr;
1314 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1315 pVMM->pfnDBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1316 &uMte2.v64, sizeof(uMte2.v64));
1317 if ( RT_SUCCESS(rc)
1318 && uMte2.v64.DllBase == uMte.v64.DllBase
1319 && uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1320 && uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1321 && WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1322 && WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1323 && WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1324 && uMte2.v64.BaseDllName.Length <= 128
1325 && uMte2.v64.FullDllName.Length <= 260
1326 )
1327 {
1328 /* Try read the base name and compare with known NT kernel names. */
1329 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1330 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1331 u.wsz, uMte2.v64.BaseDllName.Length);
1332 u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1333 if ( RT_SUCCESS(rc)
1334 && ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1335 /* || !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1336 )
1337 )
1338 {
1339 /* Read the link entry of the previous entry in the list and check that its
1340 forward pointer points at the MTE we've found. */
1341 rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /*idCpu*/,
1342 pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1343 uMte2.v64.InLoadOrderLinks.Blink),
1344 &uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1345 if ( RT_SUCCESS(rc)
1346 && uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1347 && WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1348 {
1349 Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1350 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1351 pThis->KernelAddr = KernelAddr;
1352 pThis->KernelMteAddr = MteAddr;
1353 pThis->PsLoadedModuleListAddr = Addr;
1354 pThis->f32Bit = false;
1355 pThis->fNt31 = false;
1356 return true;
1357 }
1358 }
1359 else if (RT_SUCCESS(rc))
1360 {
1361 Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1362 MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1363 break; /* Not NT kernel */
1364 }
1365 }
1366
1367 /* next */
1368 pVMM->pfnDBGFR3AddrAdd(&HitAddr, 8);
1369 if (HitAddr.FlatPtr < uEnd)
1370 rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /*idCpu*/, &HitAddr, uEnd - HitAddr.FlatPtr,
1371 8 /*align*/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1372 else
1373 rc = VERR_DBGF_MEM_NOT_FOUND;
1374 }
1375 }
1376 }
1377 }
1378 }
1379 return false;
1380}
1381
1382
1383/**
1384 * @copydoc DBGFOSREG::pfnDestruct
1385 */
1386static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1387{
1388 RT_NOREF(pUVM, pVMM, pvData);
1389}
1390
1391
1392/**
1393 * @copydoc DBGFOSREG::pfnConstruct
1394 */
1395static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1396{
1397 RT_NOREF(pUVM, pVMM);
1398 PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1399 pThis->fValid = false;
1400 pThis->f32Bit = false;
1401 pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1402
1403 pThis->IWinNt.u32Magic = DBGFOSIWINNT_MAGIC;
1404 pThis->IWinNt.pfnQueryVersion = dbgDiggerWinNtIWinNt_QueryVersion;
1405 pThis->IWinNt.pfnQueryKernelPtrs = dbgDiggerWinNtIWinNt_QueryKernelPtrs;
1406 pThis->IWinNt.pfnQueryKpcrForVCpu = dbgDiggerWinNtIWinNt_QueryKpcrForVCpu;
1407 pThis->IWinNt.pfnQueryCurThrdForVCpu = dbgDiggerWinNtIWinNt_QueryCurThrdForVCpu;
1408 pThis->IWinNt.u32EndMagic = DBGFOSIWINNT_MAGIC;
1409
1410 return VINF_SUCCESS;
1411}
1412
1413
1414const DBGFOSREG g_DBGDiggerWinNt =
1415{
1416 /* .u32Magic = */ DBGFOSREG_MAGIC,
1417 /* .fFlags = */ 0,
1418 /* .cbData = */ sizeof(DBGDIGGERWINNT),
1419 /* .szName = */ "WinNT",
1420 /* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1421 /* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1422 /* .pfnProbe = */ dbgDiggerWinNtProbe,
1423 /* .pfnInit = */ dbgDiggerWinNtInit,
1424 /* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1425 /* .pfnTerm = */ dbgDiggerWinNtTerm,
1426 /* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1427 /* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1428 /* .pfnStackUnwindAssist = */ dbgDiggerWinNtStackUnwindAssist,
1429 /* .u32EndMagic = */ DBGFOSREG_MAGIC
1430};
1431
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use