DBGFR3ModInMem.cpp

Last change on this file was 106061, checked in by vboxsync, 6 weeks ago
Copyright year updates by scm.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 44.6 KB

Rev	Line
[31510]	1	/* $Id: DBGFR3ModInMem.cpp 106061 2024-09-16 14:03:52Z vboxsync $ */
	2	/** @file
[73150]	3	* DBGFR3ModInMemPe - In memory PE module 'loader'.
[31510]	4	*/
	5
	6	/*
[106061]	7	* Copyright (C) 2009-2024 Oracle and/or its affiliates.
[31510]	8	*
[96407]	9	* This file is part of VirtualBox base platform packages, as
	10	* available from https://www.virtualbox.org.
	11	*
	12	* This program is free software; you can redistribute it and/or
	13	* modify it under the terms of the GNU General Public License
	14	* as published by the Free Software Foundation, in version 3 of the
	15	* License.
	16	*
	17	* This program is distributed in the hope that it will be useful, but
	18	* WITHOUT ANY WARRANTY; without even the implied warranty of
	19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	20	* General Public License for more details.
	21	*
	22	* You should have received a copy of the GNU General Public License
	23	* along with this program; if not, see <https://www.gnu.org/licenses>.
	24	*
	25	* SPDX-License-Identifier: GPL-3.0-only
[31510]	26	*/
	27
	28
[57358]	29	/*********************************************************************************************************************************
	30	* Header Files *
	31	*********************************************************************************************************************************/
[73150]	32	#define LOG_GROUP LOG_GROUP_DBGF
[35346]	33	#include <VBox/vmm/dbgf.h>
[73150]	34
[31510]	35	#include <VBox/err.h>
[73491]	36	#include <iprt/ctype.h>
[46083]	37	#include <iprt/ldr.h>
[31510]	38	#include <iprt/mem.h>
[73491]	39	#include <iprt/path.h>
[46083]	40	#include <iprt/string.h>
[83085]	41	#include <iprt/sort.h>
[58742]	42	#include <iprt/formats/pecoff.h>
	43	#include <iprt/formats/mz.h>
[73150]	44	#include <iprt/formats/elf.h>
[83085]	45	#include <iprt/formats/mach-o.h>
[31510]	46
	47
[57358]	48	/*********************************************************************************************************************************
	49	* Structures and Typedefs *
	50	*********************************************************************************************************************************/
[83085]	51	/** Entry for mapping file offset to memory location. */
	52	typedef struct DBGFMODINMEMMAPPING
	53	{
	54	/** The file offset. */
	55	uint32_t offFile;
	56	/** The file size of this mapping. */
	57	uint32_t cbFile;
	58	/** The size of this mapping. */
	59	uint32_t cbMem;
	60	/** The offset to the memory from the start of the image.
	61	* @note This can be negative (for mach_kernel). */
	62	int32_t offMem;
	63	} DBGFMODINMEMMAPPING;
	64	typedef DBGFMODINMEMMAPPING *PDBGFMODINMEMMAPPING;
	65	typedef DBGFMODINMEMMAPPING const *PCDBGFMODINMEMMAPPING;
	66
[31510]	67	/**
[83085]	68	* Common in-memory reader instance data.
	69	*/
	70	typedef struct DBGFMODINMEMRDR
	71	{
	72	/** The VM handle (referenced). */
	73	PUVM pUVM;
	74	/** The image base. */
	75	DBGFADDRESS ImageAddr;
	76	/** The file size, based on the offFile and cbFile of the last mapping. */
	77	uint32_t cbFile;
	78	/** Number of entries in the aMappings table. */
	79	uint32_t cMappings;
	80	/** Mapping hint. */
	81	uint32_t iHint;
	82	/** Mapping file offset to memory offsets, ordered by file offset. */
	83	DBGFMODINMEMMAPPING aMappings[RT_FLEXIBLE_ARRAY_NESTED];
	84	} DBGFMODINMEMRDR;
	85	/** Pointer to the common instance data for an in-memory file reader. */
	86	typedef DBGFMODINMEMRDR *PDBGFMODINMEMRDR;
	87
	88	/**
[46083]	89	* The WinNT digger's loader reader instance data.
	90	*/
[73150]	91	typedef struct DBGFMODPERDR
[46083]	92	{
	93	/** The VM handle (referenced). */
	94	PUVM pUVM;
	95	/** The image base. */
	96	DBGFADDRESS ImageAddr;
	97	/** The image size. */
	98	uint32_t cbImage;
[46101]	99	/** The file offset of the SizeOfImage field in the optional header if it
	100	* needs patching, otherwise set to UINT32_MAX. */
	101	uint32_t offSizeOfImage;
	102	/** The correct image size. */
	103	uint32_t cbCorrectImageSize;
[46083]	104	/** Number of entries in the aMappings table. */
	105	uint32_t cMappings;
	106	/** Mapping hint. */
	107	uint32_t iHint;
	108	/** Mapping file offset to memory offsets, ordered by file offset. */
	109	struct
	110	{
	111	/** The file offset. */
	112	uint32_t offFile;
	113	/** The size of this mapping. */
	114	uint32_t cbMem;
	115	/** The offset to the memory from the start of the image. */
	116	uint32_t offMem;
	117	} aMappings[1];
[73150]	118	} DBGFMODPERDR;
[46083]	119	/** Pointer a WinNT loader reader instance data. */
[73150]	120	typedef DBGFMODPERDR *PDBGFMODPERDR;
[46083]	121
[73150]	122	/**
	123	* Stack buffer.
	124	*/
	125	typedef union DBGFMODINMEMBUF
	126	{
	127	uint8_t ab[0x2000];
	128	IMAGE_DOS_HEADER DosHdr;
	129	IMAGE_NT_HEADERS32 Nt32;
	130	IMAGE_NT_HEADERS64 Nt64;
[83085]	131	mach_header_64 MachoHdr;
	132	DBGFMODINMEMMAPPING aMappings[0x2000 / sizeof(DBGFMODINMEMMAPPING)];
[73150]	133	} DBGFMODINMEMBUF;
	134	/** Pointer to stack buffer. */
	135	typedef DBGFMODINMEMBUF *PDBGFMODINMEMBUF;
[46083]	136
[31510]	137
	138
[73150]	139	/**
[73491]	140	* Normalizes a debug module name.
	141	*
	142	* @returns Normalized debug module name.
	143	* @param pszName The name.
	144	* @param pszBuf Buffer to use if work is needed.
	145	* @param cbBuf Size of buffer.
	146	*/
[99775]	147	static const char dbgfR3ModNormalizeName(const char pszName, char *pszBuf, size_t cbBuf)
[73491]	148	{
	149	/*
	150	* Skip to the filename in case someone gave us a full filename path.
	151	*/
	152	pszName = RTPathFilenameEx(pszName, RTPATH_STR_F_STYLE_DOS);
	153
	154	/*
	155	* Is it okay?
	156	*/
	157	size_t cchName = strlen(pszName);
	158	size_t off = 0;
	159	for (;; off++)
	160	{
	161	char ch = pszName[off];
	162	if (ch == '\0')
	163	return pszName;
	164	if (!RT_C_IS_ALNUM(ch) && ch != '_')
	165	break;
	166	}
	167
	168	/*
	169	* It's no okay, so morph it.
	170	*/
	171	if (cchName >= cbBuf)
	172	cchName = cbBuf - 1;
	173	for (off = 0; off < cchName; off++)
	174	{
	175	char ch = pszName[off];
	176	if (!RT_C_IS_ALNUM(ch))
	177	ch = '_';
	178	pszBuf[off] = ch;
	179	}
	180	pszBuf[off] = '\0';
	181
	182	return pszBuf;
	183	}
	184
	185
	186	/**
[83085]	187	* @callback_method_impl{PFNRTLDRRDRMEMREAD}
	188	*/
	189	static DECLCALLBACK(int) dbgfModInMemCommon_Read(void pvBuf, size_t cb, size_t off, void pvUser)
	190	{
	191	PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
	192	uint32_t offFile = (uint32_t)off;
	193	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
	194
	195	/*
	196	* Set i to a mapping that starts at or before the specified offset.
	197	* ASSUMING aMappings are sorted by offFile.
	198	*/
	199	uint32_t i = pThis->iHint;
	200	if (pThis->aMappings[i].offFile > offFile)
	201	{
	202	i = pThis->cMappings; /** @todo doesn't need to start from the end here... */
	203	while (i-- > 0)
	204	if (offFile >= pThis->aMappings[i].offFile)
	205	break;
	206	pThis->iHint = i;
	207	}
	208
	209	while (cb > 0)
	210	{
	211	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile
	212	: pThis->aMappings[i].offFile + RT_MAX(pThis->aMappings[i].cbFile, pThis->aMappings[i].cbMem);
	213	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
	214
	215	/* Read file bits backed by memory. */
	216	if (offMap < pThis->aMappings[i].cbMem)
	217	{
	218	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
	219	if (cbToRead > cb)
	220	cbToRead = (uint32_t)cb;
	221
	222	DBGFADDRESS Addr = pThis->ImageAddr;
	223	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
	224
	225	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
	226	if (RT_FAILURE(rc))
	227	return rc;
	228
	229	/* Done? */
	230	if (cbToRead == cb)
	231	break;
	232
	233	offFile += cbToRead;
	234	cb -= cbToRead;
	235	pvBuf = (char *)pvBuf + cbToRead;
	236	}
	237
	238	/* Mind the gap. */
	239	if (offNextMap > offFile)
	240	{
	241	uint32_t cbZero = offNextMap - offFile;
	242	if (cbZero > cb)
	243	{
	244	RT_BZERO(pvBuf, cb);
	245	break;
	246	}
	247
	248	RT_BZERO(pvBuf, cbZero);
	249	offFile += cbZero;
	250	cb -= cbZero;
	251	pvBuf = (char *)pvBuf + cbZero;
	252	}
	253
	254	pThis->iHint = ++i;
	255	}
	256
	257	return VINF_SUCCESS;
	258	}
	259
	260
	261	/**
	262	* @callback_method_impl{PFNRTLDRRDRMEMDTOR}
	263	*/
	264	static DECLCALLBACK(void) dbgfModInMemCommon_Dtor(void *pvUser, size_t cbImage)
	265	{
	266	PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
	267	RT_NOREF(cbImage);
	268
	269	VMR3ReleaseUVM(pThis->pUVM);
	270	pThis->pUVM = NULL;
	271
	272	RTMemFree(pThis);
	273	}
	274
	275
	276	/**
	277	* @callback_method_impl{FNRTSORTCMP}
	278	*/
	279	static DECLCALLBACK(int) dbgfModInMemCompMappings(void const pvElement1, void const pvElement2, void *pvUser)
	280	{
	281	RT_NOREF(pvUser);
	282	PCDBGFMODINMEMMAPPING pElement1 = (PCDBGFMODINMEMMAPPING)pvElement1;
	283	PCDBGFMODINMEMMAPPING pElement2 = (PCDBGFMODINMEMMAPPING)pvElement2;
	284	if (pElement1->offFile < pElement2->offFile)
	285	return -1;
	286	if (pElement1->offFile > pElement2->offFile)
	287	return 1;
	288	if (pElement1->cbFile < pElement2->cbFile)
	289	return -1;
	290	if (pElement1->cbFile > pElement2->cbFile)
	291	return 1;
	292	if (pElement1->offMem < pElement2->offMem)
	293	return -1;
	294	if (pElement1->offMem > pElement2->offMem)
	295	return 1;
	296	if (pElement1->cbMem < pElement2->cbMem)
	297	return -1;
	298	if (pElement1->cbMem > pElement2->cbMem)
	299	return 1;
	300	return 0;
	301	}
	302
	303
	304	static int dbgfModInMemCommon_Init(PDBGFMODINMEMRDR pThis, PUVM pUVM, PCDBGFADDRESS pImageAddr,PCDBGFMODINMEMMAPPING paMappings,
	305	uint32_t cMappings, const char *pszName, RTLDRARCH enmArch,
	306	PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
	307	{
	308	/*
	309	* Initialize the reader instance.
	310	*/
	311	VMR3RetainUVM(pUVM);
	312	pThis->pUVM = pUVM;
	313	pThis->ImageAddr = *pImageAddr;
	314	pThis->cMappings = cMappings;
	315	pThis->iHint = 0;
	316	memcpy(pThis->aMappings, paMappings, cMappings * sizeof(pThis->aMappings[0]));
	317	RTSortShell(pThis->aMappings, cMappings, sizeof(pThis->aMappings[0]), dbgfModInMemCompMappings, NULL);
	318	pThis->cbFile = pThis->aMappings[cMappings - 1].offFile + pThis->aMappings[cMappings - 1].cbFile;
	319
	320	/*
	321	* Call the loader to open it.
	322	* Note! destructore is always called.
	323	*/
	324
	325	RTLDRMOD hLdrMod;
	326	int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, enmArch, pThis->cbFile,
	327	dbgfModInMemCommon_Read, dbgfModInMemCommon_Dtor, pThis,
	328	&hLdrMod, pErrInfo);
	329	if (RT_SUCCESS(rc))
	330	*phLdrMod = hLdrMod;
	331	else
	332	*phLdrMod = NIL_RTLDRMOD;
	333	return rc;
	334	}
	335
	336
	337	/**
[73150]	338	* Handles in-memory ELF images.
	339	*
	340	* @returns VBox status code.
	341	* @param pUVM The user mode VM handle.
	342	* @param pImageAddr The image address.
	343	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
[73491]	344	* @param pszName The module name, optional.
	345	* @param pszFilename The image filename, optional.
[73150]	346	* @param enmArch The image arch if we force it, pass
	347	* RTLDRARCH_WHATEVER if you don't care.
	348	* @param cbImage Image size. Pass 0 if not known.
	349	* @param puBuf The header buffer.
	350	* @param phDbgMod Where to return the resulting debug module on success.
	351	* @param pErrInfo Where to return extended error info on failure.
	352	*/
[73491]	353	static int dbgfR3ModInMemElf(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
[73150]	354	RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
	355	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
[31510]	356	{
[73491]	357	RT_NOREF(pUVM, fFlags, pszName, pszFilename, enmArch, cbImage, puBuf, phDbgMod);
[73150]	358	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Found ELF magic at %RGv", pImageAddr->FlatPtr);
	359	}
[31510]	360
	361
[73150]	362	/**
[83085]	363	* Handles in-memory Mach-O images.
	364	*
	365	* @returns VBox status code.
	366	* @param pUVM The user mode VM handle.
	367	* @param pImageAddr The image address.
	368	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
	369	* @param pszName The module name, optional.
	370	* @param pszFilename The image filename, optional.
	371	* @param enmArch The image arch if we force it, pass
	372	* RTLDRARCH_WHATEVER if you don't care.
	373	* @param cbImage Image size. Pass 0 if not known.
	374	* @param puBuf The header buffer.
	375	* @param phDbgMod Where to return the resulting debug module on success.
	376	* @param pErrInfo Where to return extended error info on failure.
	377	*/
	378	static int dbgfR3ModInMemMachO(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
	379	RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
	380	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
	381	{
	382	RT_NOREF(cbImage, fFlags);
	383
	384	/*
	385	* Match up enmArch.
	386	*/
	387	if (enmArch == RTLDRARCH_AMD64)
	388	{
	389	if (puBuf->MachoHdr.magic != IMAGE_MACHO64_SIGNATURE)
	390	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but header is not 64-bit");
	391	if (puBuf->MachoHdr.cputype != CPU_TYPE_X86_64)
	392	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but cpu type is %#x instead of %#x",
	393	puBuf->MachoHdr.cputype, CPU_TYPE_X86_64);
	394	}
	395	else if (enmArch == RTLDRARCH_X86_32)
	396	{
	397	if (puBuf->MachoHdr.magic != IMAGE_MACHO32_SIGNATURE)
	398	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but header is not 32-bit");
	399	if (puBuf->MachoHdr.cputype != CPU_TYPE_X86)
	400	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but cpu type is %#x instead of %#x",
	401	puBuf->MachoHdr.cputype, CPU_TYPE_X86);
	402	}
	403	else if (enmArch != RTLDRARCH_WHATEVER)
	404	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unsupported enmArch value %s (%d)",
	405	RTLdrArchName(enmArch), enmArch);
	406
	407	/*
	408	* Guess the module name if not specified and make sure it conforms to DBGC expectations.
	409	*/
	410	char szNormalized[128];
	411	if (!pszName)
	412	{
	413	if (pszFilename)
	414	pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS /whatever/);
	415	if (!pszName)
	416	{
	417	RTStrPrintf(szNormalized, sizeof(szNormalized), "image_%#llx", (uint64_t)pImageAddr->FlatPtr);
	418	pszName = szNormalized;
	419	}
	420	}
	421	if (pszName != szNormalized)
	422	pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
	423
	424	/*
	425	* Read the load commands into memory, they follow the header. Refuse
	426	* if there appear to be too many or too much of these.
	427	*/
	428	uint32_t const cLoadCmds = puBuf->MachoHdr.ncmds;
	429	uint32_t const cbLoadCmds = puBuf->MachoHdr.sizeofcmds;
	430	if (cLoadCmds > _8K \|\| cLoadCmds < 2)
	431	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
	432	"ncmds=%u is out of sensible range (2..8192)", cLoadCmds);
	433	if (cbLoadCmds > _2M \|\| cbLoadCmds < sizeof(load_command_t) * 2)
	434	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
	435	"cbLoadCmds=%#x is out of sensible range (8..2MiB)", cbLoadCmds);
	436
	437	uint8_t pbLoadCmds = (uint8_t )RTMemTmpAllocZ(cbLoadCmds);
	438	AssertReturn(pbLoadCmds, VERR_NO_TMP_MEMORY);
	439
	440	uint32_t const cbHdr = puBuf->MachoHdr.magic == IMAGE_MACHO64_SIGNATURE ? sizeof(mach_header_64) : sizeof(mach_header_32);
	441	DBGFADDRESS Addr = *pImageAddr;
	442	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrAdd(&Addr, cbHdr), pbLoadCmds, cbLoadCmds);
	443	if (RT_SUCCESS(rc))
	444	{
	445	/*
	446	* Scan it for segments so we can tranlate file offsets to virtual
	447	* memory locations.
	448	*/
	449	RTUUID Uuid = RTUUID_INITIALIZE_NULL;
	450	uint32_t cMappings = 0;
	451	uint32_t offCmd = 0;
	452	for (uint32_t iCmd = 0; iCmd < cLoadCmds; iCmd++)
	453	{
	454	load_command_t const pCurCmd = (load_command_t const )&pbLoadCmds[offCmd];
	455	uint32_t const cbCurCmd = offCmd + sizeof(pCurCmd) <= cbLoadCmds ? pCurCmd->cmdsize : sizeof(pCurCmd);
	456	if (offCmd + cbCurCmd > cbLoadCmds)
	457	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
	458	"Load command #%u @ %#x is out of bounds: size %#x, left %#x", iCmd, offCmd, cbCurCmd,
	459	cbLoadCmds - offCmd);
	460	else if (pCurCmd->cmd == LC_SEGMENT_64)
	461	{
	462	segment_command_64 const pSeg = (segment_command_64 const )pCurCmd;
	463	if (cbCurCmd >= sizeof(*pSeg))
	464	{
	465	if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
	466	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
	467	else
	468	{
	469	puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
	470	puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
	471	puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
	472	puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
	473	cMappings++;
	474	}
	475	}
	476	else
	477	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
	478	"Load command #%u @ %#x is too small for a 64-bit segment: %#x", iCmd, offCmd, cbCurCmd);
	479	}
	480	else if (pCurCmd->cmd == LC_SEGMENT_32)
	481	{
	482	segment_command_32 const pSeg = (segment_command_32 const )pCurCmd;
	483	if (cbCurCmd >= sizeof(*pSeg))
	484	{
	485	if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
	486	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
	487	else
	488	{
	489	puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
	490	puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
	491	puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
	492	puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
	493	cMappings++;
	494	}
	495	}
	496	else
	497	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
	498	"Load command #%u @ %#x is too small for a 32-bit segment: %#x", iCmd, offCmd, cbCurCmd);
	499	}
	500	else if (pCurCmd->cmd == LC_UUID && cbCurCmd == sizeof(uuid_command_t))
	501	memcpy(&Uuid, ((uuid_command_t const *)pCurCmd)->uuid, sizeof(Uuid));
	502
	503	if (RT_SUCCESS(rc))
	504	offCmd += cbCurCmd;
	505	else
	506	break;
	507	} /* for each command */
	508
	509	if (RT_SUCCESS(rc))
	510	{
	511	/*
	512	* Create generic loader module instance (pThis is tied to it
	513	* come rain come shine).
	514	*/
	515	PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)RTMemAllocZVar(RT_UOFFSETOF_DYN(DBGFMODINMEMRDR, aMappings[cMappings]));
	516	if (pThis)
	517	{
	518	RTLDRMOD hLdrMod;
	519	rc = dbgfModInMemCommon_Init(pThis, pUVM, pImageAddr, puBuf->aMappings, cMappings,
	520	pszName, enmArch, &hLdrMod, pErrInfo);
[85969]	521	if (RT_SUCCESS(rc)) /* Don't bother if we don't have a handle. */
	522	{
	523	RTDBGMOD hMod;
	524	rc = RTDbgModCreateFromMachOImage(&hMod, pszFilename ? pszFilename : pszName, pszName, enmArch,
	525	&hLdrMod, 0 /cbImage/, 0, NULL, &Uuid, DBGFR3AsGetConfig(pUVM), fFlags);
	526	if (RT_SUCCESS(rc))
	527	*phDbgMod = hMod;
	528	}
	529	else
[83085]	530	hLdrMod = NIL_RTLDRMOD;
	531
	532	#if 0 /** @todo later */
[85969]	533	if (RT_FAILURE(rc) && !(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
[83085]	534	{
	535	/*
	536	* Fallback is a container module.
	537	*/
	538	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
	539	if (RT_SUCCESS(rc))
	540	{
	541	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
	542	AssertRC(rc);
	543	}
	544	}
	545	#endif
	546	if (hLdrMod != NIL_RTLDRMOD)
	547	RTLdrClose(hLdrMod);
	548	}
	549	else
	550	rc = VERR_NO_MEMORY;
	551	}
	552	}
	553	else
	554	RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read %#x bytes of load commands", cbLoadCmds);
	555	RTMemTmpFree(pbLoadCmds);
	556	return rc;
	557	}
	558
	559
	560	/**
[73150]	561	* @callback_method_impl{PFNRTLDRRDRMEMREAD}
	562	*/
	563	static DECLCALLBACK(int) dbgfModInMemPeRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
[46083]	564	{
[73150]	565	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
	566	uint32_t offFile = (uint32_t)off;
[46101]	567	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
[46083]	568
	569	uint32_t i = pThis->iHint;
[46101]	570	if (pThis->aMappings[i].offFile > offFile)
[46083]	571	{
	572	i = pThis->cMappings;
	573	while (i-- > 0)
[46101]	574	if (offFile >= pThis->aMappings[i].offFile)
[46083]	575	break;
	576	pThis->iHint = i;
	577	}
	578
	579	while (cb > 0)
	580	{
	581	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
[46101]	582	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
[46083]	583
	584	/* Read file bits backed by memory. */
[46101]	585	if (offMap < pThis->aMappings[i].cbMem)
[46083]	586	{
	587	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
	588	if (cbToRead > cb)
	589	cbToRead = (uint32_t)cb;
	590
	591	DBGFADDRESS Addr = pThis->ImageAddr;
	592	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
	593
	594	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
	595	if (RT_FAILURE(rc))
	596	return rc;
[46101]	597
[46108]	598	/* Apply SizeOfImage patch? */
[46101]	599	if ( pThis->offSizeOfImage != UINT32_MAX
	600	&& offFile < pThis->offSizeOfImage + 4
	601	&& offFile + cbToRead > pThis->offSizeOfImage)
	602	{
	603	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
[46108]	604	uint32_t cbPatch = sizeof(SizeOfImage);
[46101]	605	int32_t offPatch = pThis->offSizeOfImage - offFile;
	606	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
	607	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
	608	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
	609	while (cbPatch-- > 0)
	610	{
	611	if (offPatch >= 0)
	612	*pbPatch = (uint8_t)SizeOfImage;
	613	offPatch++;
	614	pbPatch++;
	615	SizeOfImage >>= 8;
	616	}
	617	}
	618
	619	/* Done? */
[46083]	620	if (cbToRead == cb)
	621	break;
	622
[46101]	623	offFile += cbToRead;
	624	cb -= cbToRead;
	625	pvBuf = (char *)pvBuf + cbToRead;
[46083]	626	}
	627
	628	/* Mind the gap. */
[46101]	629	if (offNextMap > offFile)
[46083]	630	{
[46101]	631	uint32_t cbZero = offNextMap - offFile;
[46083]	632	if (cbZero > cb)
	633	{
	634	RT_BZERO(pvBuf, cb);
	635	break;
	636	}
	637
	638	RT_BZERO(pvBuf, cbZero);
[46101]	639	offFile += cbZero;
	640	cb -= cbZero;
	641	pvBuf = (char *)pvBuf + cbZero;
[46083]	642	}
	643
	644	pThis->iHint = ++i;
	645	}
	646
	647	return VINF_SUCCESS;
	648	}
	649
	650
[73150]	651	/**
	652	* @callback_method_impl{PFNRTLDRRDRMEMDTOR}
	653	*/
[75049]	654	static DECLCALLBACK(void) dbgfModInMemPeRdr_Dtor(void *pvUser, size_t cbImage)
[46083]	655	{
[73150]	656	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
[75049]	657	RT_NOREF(cbImage);
[46083]	658
	659	VMR3ReleaseUVM(pThis->pUVM);
	660	pThis->pUVM = NULL;
	661	RTMemFree(pvUser);
	662	}
	663
	664
[31510]	665	/**
[46101]	666	* Checks if the section headers look okay.
	667	*
[73150]	668	* @returns VBox status code.
	669	* @param paShdrs Pointer to the section headers.
	670	* @param cShdrs Number of headers.
[46108]	671	* @param cbImage The image size reported by NT.
[70338]	672	* @param cbImageFromHdr The image size by the linker in the header.
[46108]	673	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
	674	* no resource directory.
	675	* @param cbSectAlign The section alignment specified in the header.
[70338]	676	* @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
[46108]	677	* @param pcbImageCorrect The corrected image size. This is derived from
	678	* cbImage and virtual range of the section tables.
	679	*
	680	* The problem is that NT may choose to drop the
	681	* last pages in images it loads early, starting at
	682	* the resource directory. These images will have
	683	* a page aligned cbImage.
[73150]	684	*
	685	* @param pErrInfo Where to return more error details.
[46101]	686	*/
[73150]	687	static int dbgfR3ModPeCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShdrs, uint32_t cShdrs, uint32_t cbImage,
	688	uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
	689	bool fNt31, uint32_t *pcbImageCorrect, PRTERRINFO pErrInfo)
[46101]	690	{
[46108]	691	*pcbImageCorrect = cbImage;
	692
[73150]	693	for (uint32_t i = 0; i < cShdrs; i++)
[46101]	694	{
[73150]	695	if (!paShdrs[i].Name[0])
	696	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Section header #%u has no name", i);
[46101]	697
[73150]	698	if (paShdrs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
[46101]	699	continue;
[46108]	700
[70338]	701	/* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
	702	/** @todo this isn't really perfect. cbImage is kind of wrong... */
[73150]	703	uint32_t cbVirtual = paShdrs[i].Misc.VirtualSize;
[70338]	704	if (cbVirtual == 0)
	705	{
[73150]	706	for (uint32_t j = i + 1; j < cShdrs; j++)
	707	if ( !(paShdrs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
	708	&& paShdrs[j].VirtualAddress > paShdrs[i].VirtualAddress)
[70338]	709	{
[73150]	710	cbVirtual = paShdrs[j].VirtualAddress - paShdrs[i].VirtualAddress;
[70338]	711	break;
	712	}
	713	if (!cbVirtual)
	714	{
[73150]	715	if (paShdrs[i].VirtualAddress < cbImageFromHdr)
	716	cbVirtual = cbImageFromHdr - paShdrs[i].VirtualAddress;
	717	else if (paShdrs[i].SizeOfRawData > 0)
	718	cbVirtual = RT_ALIGN(paShdrs[i].SizeOfRawData, _4K);
[70338]	719	}
	720	}
	721
[46108]	722	/* Check that sizes are within the same range and that both sizes and
	723	addresses are within reasonable limits. */
[73150]	724	if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShdrs[i].SizeOfRawData, _64K)
[70338]	725	\|\| cbVirtual >= _1G
[73150]	726	\|\| paShdrs[i].SizeOfRawData >= _1G)
	727	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
	728	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!",
	729	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].SizeOfRawData);
	730	uint32_t uRvaEnd = paShdrs[i].VirtualAddress + cbVirtual;
	731	if (uRvaEnd >= _1G \|\| uRvaEnd < paShdrs[i].VirtualAddress)
	732	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
	733	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!",
	734	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].VirtualAddress, uRvaEnd);
[46108]	735
	736	/* Check for images chopped off around '.rsrc'. */
	737	if ( cbImage < uRvaEnd
	738	&& uRvaEnd >= uRvaRsrc)
	739	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
	740
	741	/* Check that the section is within the image. */
[70338]	742	if (uRvaEnd > cbImage && fNt31)
[73150]	743	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
	744	"Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x",
	745	i, paShdrs[i].VirtualAddress, uRvaEnd, cbImage);
[46101]	746	}
[46108]	747
	748	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
	749	*pcbImageCorrect = cbImage;
[73150]	750	return VINF_SUCCESS;
[46101]	751	}
	752
	753
	754	/**
	755	* Create a loader module for the in-guest-memory PE module.
	756	*/
[73150]	757	static int dbgfR3ModInMemPeCreateLdrMod(PUVM pUVM, uint32_t fFlags, const char *pszName, PCDBGFADDRESS pImageAddr,
	758	uint32_t cbImage, uint32_t cbImageFromHdr, bool f32Bit,
	759	uint32_t cShdrs, PCIMAGE_SECTION_HEADER paShdrs, uint32_t cbSectAlign,
	760	uint32_t cDataDir, PCIMAGE_DATA_DIRECTORY paDataDir, uint32_t offHdrs,
	761	PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
[46101]	762	{
	763	/*
	764	* Allocate and create a reader instance.
	765	*/
[73150]	766	PDBGFMODPERDR pRdr = (PDBGFMODPERDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGFMODPERDR, aMappings[cShdrs + 2]));
[46101]	767	if (!pRdr)
	768	return VERR_NO_MEMORY;
	769
	770	VMR3RetainUVM(pUVM);
	771	pRdr->pUVM = pUVM;
	772	pRdr->ImageAddr = *pImageAddr;
	773	pRdr->cbImage = cbImage;
	774	pRdr->cbCorrectImageSize = cbImage;
	775	pRdr->offSizeOfImage = UINT32_MAX;
	776	pRdr->iHint = 0;
	777
	778	/*
[73150]	779	* Use the section table to construct a more accurate view of the file/image.
[46101]	780	*/
[46108]	781	uint32_t uRvaRsrc = UINT32_MAX;
[73150]	782	if ( cDataDir > IMAGE_DIRECTORY_ENTRY_RESOURCE
	783	&& paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size > 0)
	784	uRvaRsrc = paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
	785
	786	int rc = dbgfR3ModPeCheckSectHdrsAndImgSize(paShdrs, cShdrs, cbImage, cbImageFromHdr, uRvaRsrc, cbSectAlign,
	787	RT_BOOL(fFlags & DBGFMODINMEM_F_PE_NT31), &pRdr->cbCorrectImageSize, pErrInfo);
	788	if (RT_SUCCESS(rc))
[46101]	789	{
	790	pRdr->cMappings = 0;
	791
[73150]	792	for (uint32_t i = 0; i < cShdrs; i++)
	793	if ( paShdrs[i].SizeOfRawData > 0
	794	&& paShdrs[i].PointerToRawData > 0)
[46101]	795	{
	796	uint32_t j = 1;
	797	if (!pRdr->cMappings)
	798	pRdr->cMappings++;
	799	else
	800	{
[73150]	801	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShdrs[i].PointerToRawData)
[46101]	802	j++;
	803	if (j < pRdr->cMappings)
	804	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
	805	}
[73150]	806	pRdr->aMappings[j].offFile = paShdrs[i].PointerToRawData;
	807	pRdr->aMappings[j].offMem = paShdrs[i].VirtualAddress;
	808	pRdr->aMappings[j].cbMem = i + 1 < cShdrs
	809	? paShdrs[i + 1].VirtualAddress - paShdrs[i].VirtualAddress
	810	: paShdrs[i].Misc.VirtualSize;
[46101]	811	if (j == pRdr->cMappings)
[73150]	812	pRdr->cbImage = paShdrs[i].PointerToRawData + paShdrs[i].SizeOfRawData;
[46101]	813	pRdr->cMappings++;
	814	}
	815
	816	/* Insert the mapping of the headers that isn't covered by the section table. */
	817	pRdr->aMappings[0].offFile = 0;
	818	pRdr->aMappings[0].offMem = 0;
	819	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
	820
	821	int j = pRdr->cMappings - 1;
	822	while (j-- > 0)
	823	{
	824	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
	825	if (pRdr->aMappings[j].cbMem > cbFile)
	826	pRdr->aMappings[j].cbMem = cbFile;
	827	}
	828	}
[73150]	829	else if (fFlags & DBGFMODINMEM_F_NO_READER_FALLBACK)
	830	return rc;
[46101]	831	else
	832	{
	833	/*
	834	* Fallback, fake identity mapped file data.
	835	*/
	836	pRdr->cMappings = 1;
	837	pRdr->aMappings[0].offFile = 0;
	838	pRdr->aMappings[0].offMem = 0;
	839	pRdr->aMappings[0].cbMem = pRdr->cbImage;
	840	}
	841
[46108]	842	/* Enable the SizeOfImage patching if necessary. */
	843	if (pRdr->cbCorrectImageSize != cbImage)
	844	{
[73150]	845	Log(("dbgfR3ModInMemPeCreateLdrMod: The image is really %#x bytes long, not %#x as mapped by NT!\n",
	846	pRdr->cbCorrectImageSize, cbImage));
	847	pRdr->offSizeOfImage = f32Bit
[46108]	848	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
	849	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
	850	}
	851
[46101]	852	/*
	853	* Call the loader to open the PE image for debugging.
	854	* Note! It always calls pfnDtor.
	855	*/
	856	RTLDRMOD hLdrMod;
[73150]	857	rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
	858	dbgfModInMemPeRdr_Read, dbgfModInMemPeRdr_Dtor, pRdr,
	859	&hLdrMod, pErrInfo);
[46101]	860	if (RT_SUCCESS(rc))
	861	*phLdrMod = hLdrMod;
	862	else
	863	*phLdrMod = NIL_RTLDRMOD;
	864	return rc;
	865	}
	866
	867
	868	/**
[73150]	869	* Handles in-memory PE images.
[31510]	870	*
[73150]	871	* @returns VBox status code.
[44399]	872	* @param pUVM The user mode VM handle.
	873	* @param pImageAddr The image address.
[73150]	874	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
[73491]	875	* @param pszName The module name, optional.
	876	* @param pszFilename The image filename, optional.
[73150]	877	* @param enmArch The image arch if we force it, pass
	878	* RTLDRARCH_WHATEVER if you don't care.
	879	* @param cbImage Image size. Pass 0 if not known.
	880	* @param offPeHdrs Offset of the PE header.
	881	* @param cbPeHdrsPart1 How read into uBuf at @a offPeHdrs.
	882	* @param puBuf The header buffer.
	883	* @param phDbgMod Where to return the resulting debug module on success.
	884	* @param pErrInfo Where to return extended error info on failure.
[31510]	885	*/
[73491]	886	static int dbgfR3ModInMemPe(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
	887	RTLDRARCH enmArch, uint32_t cbImage, uint32_t offPeHdrs, uint32_t cbPeHdrsPart1,
	888	PDBGFMODINMEMBUF puBuf, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
[31510]	889	{
	890	/*
[73150]	891	* Read the optional header and the section table after validating the
	892	* info we need from the file header.
[70338]	893	*/
[73150]	894	/* Check the opt hdr size and number of sections as these are used to determine how much to read next. */
	895	if ( puBuf->Nt32.FileHeader.SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER32)
	896	\|\| puBuf->Nt32.FileHeader.SizeOfOptionalHeader > sizeof(IMAGE_OPTIONAL_HEADER64) + 128)
	897	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Invalid SizeOfOptionalHeader value: %#RX32",
	898	puBuf->Nt32.FileHeader.SizeOfOptionalHeader);
[70338]	899
[73150]	900	if ( puBuf->Nt32.FileHeader.NumberOfSections < 1
	901	\|\| puBuf->Nt32.FileHeader.NumberOfSections > 190 /* what fits in our 8K buffer */)
	902	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "NumberOfSections is out of range: %#RX32 (1..190)",
	903	puBuf->Nt32.FileHeader.NumberOfSections);
	904
	905	/* Read the optional header and section table. */
	906	uint32_t const cbHdrs = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
	907	+ puBuf->Nt32.FileHeader.SizeOfOptionalHeader
	908	+ puBuf->Nt32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
	909	AssertReturn(cbHdrs <= sizeof(*puBuf), RTERRINFO_LOG_SET_F(pErrInfo, VERR_INTERNAL_ERROR_2, "cbHdrs=%#x", cbHdrs));
	910
	911	DBGFADDRESS PeHdrPart2Addr = *pImageAddr;
	912	DBGFR3AddrAdd(&PeHdrPart2Addr, offPeHdrs + cbPeHdrsPart1);
	913	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrPart2Addr, &puBuf->ab[cbPeHdrsPart1], cbHdrs - cbPeHdrsPart1);
	914	if (RT_FAILURE(rc))
	915	return RTERRINFO_LOG_SET_F(pErrInfo, rc,
	916	"Failed to read the second part of the PE headers at %RGv (off=%#RX32 + %#RX32): %Rrc",
	917	PeHdrPart2Addr.FlatPtr, offPeHdrs, cbPeHdrsPart1, rc);
	918
[70338]	919	/*
[73150]	920	* Check the image architecture and determine the bitness.
[31510]	921	*/
[73150]	922	RTLDRARCH enmArchActual;
	923	bool f32Bit;
	924	switch (puBuf->Nt32.FileHeader.Machine)
[31510]	925	{
[73150]	926	case IMAGE_FILE_MACHINE_I386:
	927	enmArchActual = RTLDRARCH_X86_32;
	928	f32Bit = true;
	929	break;
	930	case IMAGE_FILE_MACHINE_AMD64:
	931	enmArchActual = RTLDRARCH_AMD64;
	932	f32Bit = false;
	933	break;
	934	case IMAGE_FILE_MACHINE_ARM:
	935	case IMAGE_FILE_MACHINE_THUMB:
	936	case IMAGE_FILE_MACHINE_ARMNT:
	937	enmArchActual = RTLDRARCH_ARM32;
	938	f32Bit = true;
	939	break;
	940	case IMAGE_FILE_MACHINE_ARM64:
	941	enmArchActual = RTLDRARCH_ARM64;
	942	f32Bit = false;
	943	break;
	944	default:
	945	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unknown machine: %#x", puBuf->Nt32.FileHeader.Machine);
[31510]	946	}
[73150]	947	if ( enmArch != RTLDRARCH_WHATEVER
	948	&& enmArch != enmArchActual)
	949	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Found %s expected %s",
	950	RTLdrArchName(enmArchActual), RTLdrArchName(enmArch));
[31510]	951
[73150]	952	/*
	953	* Check optional header magic and size.
	954	*/
	955	uint16_t const uOptMagic = f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC;
	956	if (puBuf->Nt32.OptionalHeader.Magic != uOptMagic)
	957	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header magic: %#x (expected %#x)",
	958	puBuf->Nt32.OptionalHeader.Magic, uOptMagic);
[31510]	959
[73150]	960	uint32_t const cDataDir = f32Bit ? puBuf->Nt32.OptionalHeader.NumberOfRvaAndSizes : puBuf->Nt64.OptionalHeader.NumberOfRvaAndSizes;
	961	if ( cDataDir <= IMAGE_DIRECTORY_ENTRY_BASERELOC /* a bit random */
	962	\|\| cDataDir > 32 /* also random */)
	963	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected data directory size: %#x", cDataDir);
[46101]	964
[73150]	965	uint32_t cbOptHdr = f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64);
	966	cbOptHdr -= sizeof(IMAGE_DATA_DIRECTORY) * IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
	967	cbOptHdr += sizeof(IMAGE_DATA_DIRECTORY) * cDataDir;
	968	if (puBuf->Nt32.FileHeader.SizeOfOptionalHeader != cbOptHdr)
	969	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header size: %#x (expected %#x)",
	970	puBuf->Nt32.FileHeader.SizeOfOptionalHeader, cbOptHdr);
[31510]	971
[73150]	972	uint32_t const cbSectAlign = f32Bit ? puBuf->Nt32.OptionalHeader.SectionAlignment : puBuf->Nt64.OptionalHeader.SectionAlignment;
	973	PCIMAGE_SECTION_HEADER pSHdrs = (PCIMAGE_SECTION_HEADER)((uintptr_t)&puBuf->Nt32.OptionalHeader + cbOptHdr);
	974	PCIMAGE_DATA_DIRECTORY paDataDir = (PCIMAGE_DATA_DIRECTORY)((uintptr_t)pSHdrs - cDataDir * sizeof(IMAGE_DATA_DIRECTORY));
	975
	976	/*
	977	* Establish the image size.
	978	*/
	979	uint32_t cbImageFromHdr = f32Bit ? puBuf->Nt32.OptionalHeader.SizeOfImage : puBuf->Nt64.OptionalHeader.SizeOfImage;
	980	if ( !cbImage
	981	\|\| (fFlags & DBGFMODINMEM_F_PE_NT31))
[70338]	982	cbImage = RT_ALIGN(cbImageFromHdr, _4K);
	983	else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
[73150]	984	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_MISMATCH, "Image size mismatch: input=%#x header=%#x", cbImage, cbImageFromHdr);
	985
	986	/*
[73491]	987	* Guess the module name if not specified and make sure it conforms to DBGC expectations.
[73150]	988	*/
	989	if (!pszName)
[31510]	990	{
[73491]	991	if (pszFilename)
	992	pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
[73150]	993	/** @todo */
[31510]	994	}
	995
[73491]	996	char szNormalized[128];
	997	pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
	998
[31510]	999	/*
[73150]	1000	* Create the module using the in memory image first, falling back on cached image.
[31510]	1001	*/
[46101]	1002	RTLDRMOD hLdrMod;
[73150]	1003	rc = dbgfR3ModInMemPeCreateLdrMod(pUVM, fFlags, pszName, pImageAddr, cbImage, cbImageFromHdr, f32Bit,
	1004	puBuf->Nt32.FileHeader.NumberOfSections, pSHdrs, cbSectAlign, cDataDir, paDataDir,
	1005	offPeHdrs, &hLdrMod, pErrInfo);
[46101]	1006	if (RT_FAILURE(rc))
	1007	hLdrMod = NIL_RTLDRMOD;
	1008
[31510]	1009	RTDBGMOD hMod;
[73491]	1010	rc = RTDbgModCreateFromPeImage(&hMod, pszFilename, pszName, &hLdrMod, cbImageFromHdr,
[73150]	1011	puBuf->Nt32.FileHeader.TimeDateStamp, DBGFR3AsGetConfig(pUVM));
	1012	if (RT_SUCCESS(rc))
	1013	*phDbgMod = hMod;
	1014	else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
[45994]	1015	{
[46083]	1016	/*
[73150]	1017	* Fallback is a container module.
[46083]	1018	*/
[46101]	1019	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
[73150]	1020	if (RT_SUCCESS(rc))
[31510]	1021	{
[73150]	1022	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
	1023	AssertRC(rc);
[31510]	1024	}
	1025	}
[73150]	1026	return rc;
[31510]	1027	}
	1028
	1029
[73150]	1030
[31510]	1031	/**
[73150]	1032	* Process a PE image found in guest memory.
	1033	*
	1034	* @param pUVM The user mode VM handle.
	1035	* @param pImageAddr The image address.
	1036	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
[73491]	1037	* @param pszName The module name, optional.
	1038	* @param pszFilename The image filename, optional.
[73150]	1039	* @param enmArch The image arch if we force it, pass
	1040	* RTLDRARCH_WHATEVER if you don't care.
	1041	* @param cbImage Image size. Pass 0 if not known.
	1042	* @param phDbgMod Where to return the resulting debug module on success.
	1043	* @param pErrInfo Where to return extended error info on failure.
[31510]	1044	*/
[73491]	1045	VMMR3DECL(int) DBGFR3ModInMem(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
[73150]	1046	RTLDRARCH enmArch, uint32_t cbImage, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
[31510]	1047	{
	1048	/*
[73150]	1049	* Validate and adjust.
[31510]	1050	*/
[73150]	1051	AssertPtrReturn(phDbgMod, VERR_INVALID_POINTER);
	1052	*phDbgMod = NIL_RTDBGMOD;
	1053	AssertPtrReturn(pImageAddr, VERR_INVALID_POINTER);
	1054	AssertMsgReturn(cbImage == 0 \|\| cbImage >= sizeof(IMAGE_NT_HEADERS32) + sizeof(IMAGE_DOS_HEADER),
	1055	("cbImage=%#x\n", cbImage), VERR_INVALID_PARAMETER);
	1056	AssertMsgReturn(!(fFlags & ~DBGFMODINMEM_F_VALID_MASK), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
	1057	if (enmArch == RTLDRARCH_HOST)
	1058	enmArch = RTLdrGetHostArch();
[31510]	1059
	1060	/*
[73150]	1061	* Look for an image header we can work with.
[31510]	1062	*/
[73150]	1063	DBGFMODINMEMBUF uBuf;
	1064	RT_ZERO(uBuf);
[70338]	1065
[73150]	1066	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, pImageAddr, &uBuf, sizeof(uBuf.DosHdr));
	1067	if (RT_FAILURE(rc))
	1068	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read DOS header at %RGv: %Rrc", pImageAddr->FlatPtr, rc);
[31510]	1069
[73150]	1070	if (uBuf.ab[0] == ELFMAG0 && uBuf.ab[1] == ELFMAG1 && uBuf.ab[2] == ELFMAG2 && uBuf.ab[3] == ELFMAG3)
[73491]	1071	return dbgfR3ModInMemElf(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
[31510]	1072
[83085]	1073	if ( uBuf.MachoHdr.magic == IMAGE_MACHO64_SIGNATURE
	1074	\|\| uBuf.MachoHdr.magic == IMAGE_MACHO32_SIGNATURE)
	1075	return dbgfR3ModInMemMachO(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
	1076
[73150]	1077	uint32_t offNewHdrs;
	1078	if (uBuf.DosHdr.e_magic == IMAGE_DOS_SIGNATURE)
[31510]	1079	{
[73150]	1080	offNewHdrs = uBuf.DosHdr.e_lfanew;
	1081	if ( offNewHdrs < 16
	1082	\|\| offNewHdrs > (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)))
	1083	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "e_lfanew value is out of range: %RX32 (16..%u)",
	1084	offNewHdrs, (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)));
	1085	}
	1086	else if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
	1087	offNewHdrs = 0;
	1088	else
	1089	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Unknown image magic at %RGv: %.8Rhxs",
	1090	pImageAddr->FlatPtr, uBuf.ab);
[31510]	1091
	1092	/*
[73150]	1093	* Read the next bit of header, assuming PE so stop at the end of
	1094	* the COFF file header.
[31510]	1095	*/
[73150]	1096	DBGFADDRESS PeHdrAddr = *pImageAddr;
	1097	DBGFR3AddrAdd(&PeHdrAddr, offNewHdrs);
	1098	uint32_t const cbPeHdrsPart1 = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader);
	1099	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrAddr, &uBuf, cbPeHdrsPart1);
	1100	if (RT_FAILURE(rc))
	1101	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read PE/LX/NE headers at %RGv (off=%#RX32): %Rrc",
	1102	PeHdrAddr.FlatPtr, offNewHdrs, rc);
[46127]	1103
[73150]	1104	if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
[73491]	1105	return dbgfR3ModInMemPe(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, offNewHdrs, cbPeHdrsPart1,
	1106	&uBuf, phDbgMod, pErrInfo);
[31510]	1107
[73150]	1108	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "No PE/LX/NE header at %RGv (off=%#RX32): %.8Rhxs",
	1109	PeHdrAddr.FlatPtr, offNewHdrs, uBuf.ab);
[31510]	1110	}
	1111

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3ModInMem.cpp

Download in other formats: