VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3ModInMem.cpp

Last change on this file was 106061, checked in by vboxsync, 3 months ago

Copyright year updates by scm.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 44.6 KB
Line 
1/* $Id: DBGFR3ModInMem.cpp 106061 2024-09-16 14:03:52Z vboxsync $ */
2/** @file
3 * DBGFR3ModInMemPe - In memory PE module 'loader'.
4 */
5
6/*
7 * Copyright (C) 2009-2024 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_DBGF
33#include <VBox/vmm/dbgf.h>
34
35#include <VBox/err.h>
36#include <iprt/ctype.h>
37#include <iprt/ldr.h>
38#include <iprt/mem.h>
39#include <iprt/path.h>
40#include <iprt/string.h>
41#include <iprt/sort.h>
42#include <iprt/formats/pecoff.h>
43#include <iprt/formats/mz.h>
44#include <iprt/formats/elf.h>
45#include <iprt/formats/mach-o.h>
46
47
48/*********************************************************************************************************************************
49* Structures and Typedefs *
50*********************************************************************************************************************************/
51/** Entry for mapping file offset to memory location. */
52typedef struct DBGFMODINMEMMAPPING
53{
54 /** The file offset. */
55 uint32_t offFile;
56 /** The file size of this mapping. */
57 uint32_t cbFile;
58 /** The size of this mapping. */
59 uint32_t cbMem;
60 /** The offset to the memory from the start of the image.
61 * @note This can be negative (for mach_kernel). */
62 int32_t offMem;
63} DBGFMODINMEMMAPPING;
64typedef DBGFMODINMEMMAPPING *PDBGFMODINMEMMAPPING;
65typedef DBGFMODINMEMMAPPING const *PCDBGFMODINMEMMAPPING;
66
67/**
68 * Common in-memory reader instance data.
69 */
70typedef struct DBGFMODINMEMRDR
71{
72 /** The VM handle (referenced). */
73 PUVM pUVM;
74 /** The image base. */
75 DBGFADDRESS ImageAddr;
76 /** The file size, based on the offFile and cbFile of the last mapping. */
77 uint32_t cbFile;
78 /** Number of entries in the aMappings table. */
79 uint32_t cMappings;
80 /** Mapping hint. */
81 uint32_t iHint;
82 /** Mapping file offset to memory offsets, ordered by file offset. */
83 DBGFMODINMEMMAPPING aMappings[RT_FLEXIBLE_ARRAY_NESTED];
84} DBGFMODINMEMRDR;
85/** Pointer to the common instance data for an in-memory file reader. */
86typedef DBGFMODINMEMRDR *PDBGFMODINMEMRDR;
87
88/**
89 * The WinNT digger's loader reader instance data.
90 */
91typedef struct DBGFMODPERDR
92{
93 /** The VM handle (referenced). */
94 PUVM pUVM;
95 /** The image base. */
96 DBGFADDRESS ImageAddr;
97 /** The image size. */
98 uint32_t cbImage;
99 /** The file offset of the SizeOfImage field in the optional header if it
100 * needs patching, otherwise set to UINT32_MAX. */
101 uint32_t offSizeOfImage;
102 /** The correct image size. */
103 uint32_t cbCorrectImageSize;
104 /** Number of entries in the aMappings table. */
105 uint32_t cMappings;
106 /** Mapping hint. */
107 uint32_t iHint;
108 /** Mapping file offset to memory offsets, ordered by file offset. */
109 struct
110 {
111 /** The file offset. */
112 uint32_t offFile;
113 /** The size of this mapping. */
114 uint32_t cbMem;
115 /** The offset to the memory from the start of the image. */
116 uint32_t offMem;
117 } aMappings[1];
118} DBGFMODPERDR;
119/** Pointer a WinNT loader reader instance data. */
120typedef DBGFMODPERDR *PDBGFMODPERDR;
121
122/**
123 * Stack buffer.
124 */
125typedef union DBGFMODINMEMBUF
126{
127 uint8_t ab[0x2000];
128 IMAGE_DOS_HEADER DosHdr;
129 IMAGE_NT_HEADERS32 Nt32;
130 IMAGE_NT_HEADERS64 Nt64;
131 mach_header_64 MachoHdr;
132 DBGFMODINMEMMAPPING aMappings[0x2000 / sizeof(DBGFMODINMEMMAPPING)];
133} DBGFMODINMEMBUF;
134/** Pointer to stack buffer. */
135typedef DBGFMODINMEMBUF *PDBGFMODINMEMBUF;
136
137
138
139/**
140 * Normalizes a debug module name.
141 *
142 * @returns Normalized debug module name.
143 * @param pszName The name.
144 * @param pszBuf Buffer to use if work is needed.
145 * @param cbBuf Size of buffer.
146 */
147static const char *dbgfR3ModNormalizeName(const char *pszName, char *pszBuf, size_t cbBuf)
148{
149 /*
150 * Skip to the filename in case someone gave us a full filename path.
151 */
152 pszName = RTPathFilenameEx(pszName, RTPATH_STR_F_STYLE_DOS);
153
154 /*
155 * Is it okay?
156 */
157 size_t cchName = strlen(pszName);
158 size_t off = 0;
159 for (;; off++)
160 {
161 char ch = pszName[off];
162 if (ch == '\0')
163 return pszName;
164 if (!RT_C_IS_ALNUM(ch) && ch != '_')
165 break;
166 }
167
168 /*
169 * It's no okay, so morph it.
170 */
171 if (cchName >= cbBuf)
172 cchName = cbBuf - 1;
173 for (off = 0; off < cchName; off++)
174 {
175 char ch = pszName[off];
176 if (!RT_C_IS_ALNUM(ch))
177 ch = '_';
178 pszBuf[off] = ch;
179 }
180 pszBuf[off] = '\0';
181
182 return pszBuf;
183}
184
185
186/**
187 * @callback_method_impl{PFNRTLDRRDRMEMREAD}
188 */
189static DECLCALLBACK(int) dbgfModInMemCommon_Read(void *pvBuf, size_t cb, size_t off, void *pvUser)
190{
191 PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
192 uint32_t offFile = (uint32_t)off;
193 AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
194
195 /*
196 * Set i to a mapping that starts at or before the specified offset.
197 * ASSUMING aMappings are sorted by offFile.
198 */
199 uint32_t i = pThis->iHint;
200 if (pThis->aMappings[i].offFile > offFile)
201 {
202 i = pThis->cMappings; /** @todo doesn't need to start from the end here... */
203 while (i-- > 0)
204 if (offFile >= pThis->aMappings[i].offFile)
205 break;
206 pThis->iHint = i;
207 }
208
209 while (cb > 0)
210 {
211 uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile
212 : pThis->aMappings[i].offFile + RT_MAX(pThis->aMappings[i].cbFile, pThis->aMappings[i].cbMem);
213 uint32_t offMap = offFile - pThis->aMappings[i].offFile;
214
215 /* Read file bits backed by memory. */
216 if (offMap < pThis->aMappings[i].cbMem)
217 {
218 uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
219 if (cbToRead > cb)
220 cbToRead = (uint32_t)cb;
221
222 DBGFADDRESS Addr = pThis->ImageAddr;
223 DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
224
225 int rc = DBGFR3MemRead(pThis->pUVM, 0 /*idCpu*/, &Addr, pvBuf, cbToRead);
226 if (RT_FAILURE(rc))
227 return rc;
228
229 /* Done? */
230 if (cbToRead == cb)
231 break;
232
233 offFile += cbToRead;
234 cb -= cbToRead;
235 pvBuf = (char *)pvBuf + cbToRead;
236 }
237
238 /* Mind the gap. */
239 if (offNextMap > offFile)
240 {
241 uint32_t cbZero = offNextMap - offFile;
242 if (cbZero > cb)
243 {
244 RT_BZERO(pvBuf, cb);
245 break;
246 }
247
248 RT_BZERO(pvBuf, cbZero);
249 offFile += cbZero;
250 cb -= cbZero;
251 pvBuf = (char *)pvBuf + cbZero;
252 }
253
254 pThis->iHint = ++i;
255 }
256
257 return VINF_SUCCESS;
258}
259
260
261/**
262 * @callback_method_impl{PFNRTLDRRDRMEMDTOR}
263 */
264static DECLCALLBACK(void) dbgfModInMemCommon_Dtor(void *pvUser, size_t cbImage)
265{
266 PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
267 RT_NOREF(cbImage);
268
269 VMR3ReleaseUVM(pThis->pUVM);
270 pThis->pUVM = NULL;
271
272 RTMemFree(pThis);
273}
274
275
276/**
277 * @callback_method_impl{FNRTSORTCMP}
278 */
279static DECLCALLBACK(int) dbgfModInMemCompMappings(void const *pvElement1, void const *pvElement2, void *pvUser)
280{
281 RT_NOREF(pvUser);
282 PCDBGFMODINMEMMAPPING pElement1 = (PCDBGFMODINMEMMAPPING)pvElement1;
283 PCDBGFMODINMEMMAPPING pElement2 = (PCDBGFMODINMEMMAPPING)pvElement2;
284 if (pElement1->offFile < pElement2->offFile)
285 return -1;
286 if (pElement1->offFile > pElement2->offFile)
287 return 1;
288 if (pElement1->cbFile < pElement2->cbFile)
289 return -1;
290 if (pElement1->cbFile > pElement2->cbFile)
291 return 1;
292 if (pElement1->offMem < pElement2->offMem)
293 return -1;
294 if (pElement1->offMem > pElement2->offMem)
295 return 1;
296 if (pElement1->cbMem < pElement2->cbMem)
297 return -1;
298 if (pElement1->cbMem > pElement2->cbMem)
299 return 1;
300 return 0;
301}
302
303
304static int dbgfModInMemCommon_Init(PDBGFMODINMEMRDR pThis, PUVM pUVM, PCDBGFADDRESS pImageAddr,PCDBGFMODINMEMMAPPING paMappings,
305 uint32_t cMappings, const char *pszName, RTLDRARCH enmArch,
306 PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
307{
308 /*
309 * Initialize the reader instance.
310 */
311 VMR3RetainUVM(pUVM);
312 pThis->pUVM = pUVM;
313 pThis->ImageAddr = *pImageAddr;
314 pThis->cMappings = cMappings;
315 pThis->iHint = 0;
316 memcpy(pThis->aMappings, paMappings, cMappings * sizeof(pThis->aMappings[0]));
317 RTSortShell(pThis->aMappings, cMappings, sizeof(pThis->aMappings[0]), dbgfModInMemCompMappings, NULL);
318 pThis->cbFile = pThis->aMappings[cMappings - 1].offFile + pThis->aMappings[cMappings - 1].cbFile;
319
320 /*
321 * Call the loader to open it.
322 * Note! destructore is always called.
323 */
324
325 RTLDRMOD hLdrMod;
326 int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, enmArch, pThis->cbFile,
327 dbgfModInMemCommon_Read, dbgfModInMemCommon_Dtor, pThis,
328 &hLdrMod, pErrInfo);
329 if (RT_SUCCESS(rc))
330 *phLdrMod = hLdrMod;
331 else
332 *phLdrMod = NIL_RTLDRMOD;
333 return rc;
334}
335
336
337/**
338 * Handles in-memory ELF images.
339 *
340 * @returns VBox status code.
341 * @param pUVM The user mode VM handle.
342 * @param pImageAddr The image address.
343 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
344 * @param pszName The module name, optional.
345 * @param pszFilename The image filename, optional.
346 * @param enmArch The image arch if we force it, pass
347 * RTLDRARCH_WHATEVER if you don't care.
348 * @param cbImage Image size. Pass 0 if not known.
349 * @param puBuf The header buffer.
350 * @param phDbgMod Where to return the resulting debug module on success.
351 * @param pErrInfo Where to return extended error info on failure.
352 */
353static int dbgfR3ModInMemElf(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
354 RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
355 PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
356{
357 RT_NOREF(pUVM, fFlags, pszName, pszFilename, enmArch, cbImage, puBuf, phDbgMod);
358 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Found ELF magic at %RGv", pImageAddr->FlatPtr);
359}
360
361
362/**
363 * Handles in-memory Mach-O images.
364 *
365 * @returns VBox status code.
366 * @param pUVM The user mode VM handle.
367 * @param pImageAddr The image address.
368 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
369 * @param pszName The module name, optional.
370 * @param pszFilename The image filename, optional.
371 * @param enmArch The image arch if we force it, pass
372 * RTLDRARCH_WHATEVER if you don't care.
373 * @param cbImage Image size. Pass 0 if not known.
374 * @param puBuf The header buffer.
375 * @param phDbgMod Where to return the resulting debug module on success.
376 * @param pErrInfo Where to return extended error info on failure.
377 */
378static int dbgfR3ModInMemMachO(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
379 RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
380 PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
381{
382 RT_NOREF(cbImage, fFlags);
383
384 /*
385 * Match up enmArch.
386 */
387 if (enmArch == RTLDRARCH_AMD64)
388 {
389 if (puBuf->MachoHdr.magic != IMAGE_MACHO64_SIGNATURE)
390 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but header is not 64-bit");
391 if (puBuf->MachoHdr.cputype != CPU_TYPE_X86_64)
392 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but cpu type is %#x instead of %#x",
393 puBuf->MachoHdr.cputype, CPU_TYPE_X86_64);
394 }
395 else if (enmArch == RTLDRARCH_X86_32)
396 {
397 if (puBuf->MachoHdr.magic != IMAGE_MACHO32_SIGNATURE)
398 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but header is not 32-bit");
399 if (puBuf->MachoHdr.cputype != CPU_TYPE_X86)
400 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but cpu type is %#x instead of %#x",
401 puBuf->MachoHdr.cputype, CPU_TYPE_X86);
402 }
403 else if (enmArch != RTLDRARCH_WHATEVER)
404 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unsupported enmArch value %s (%d)",
405 RTLdrArchName(enmArch), enmArch);
406
407 /*
408 * Guess the module name if not specified and make sure it conforms to DBGC expectations.
409 */
410 char szNormalized[128];
411 if (!pszName)
412 {
413 if (pszFilename)
414 pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS /*whatever*/);
415 if (!pszName)
416 {
417 RTStrPrintf(szNormalized, sizeof(szNormalized), "image_%#llx", (uint64_t)pImageAddr->FlatPtr);
418 pszName = szNormalized;
419 }
420 }
421 if (pszName != szNormalized)
422 pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
423
424 /*
425 * Read the load commands into memory, they follow the header. Refuse
426 * if there appear to be too many or too much of these.
427 */
428 uint32_t const cLoadCmds = puBuf->MachoHdr.ncmds;
429 uint32_t const cbLoadCmds = puBuf->MachoHdr.sizeofcmds;
430 if (cLoadCmds > _8K || cLoadCmds < 2)
431 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
432 "ncmds=%u is out of sensible range (2..8192)", cLoadCmds);
433 if (cbLoadCmds > _2M || cbLoadCmds < sizeof(load_command_t) * 2)
434 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
435 "cbLoadCmds=%#x is out of sensible range (8..2MiB)", cbLoadCmds);
436
437 uint8_t *pbLoadCmds = (uint8_t *)RTMemTmpAllocZ(cbLoadCmds);
438 AssertReturn(pbLoadCmds, VERR_NO_TMP_MEMORY);
439
440 uint32_t const cbHdr = puBuf->MachoHdr.magic == IMAGE_MACHO64_SIGNATURE ? sizeof(mach_header_64) : sizeof(mach_header_32);
441 DBGFADDRESS Addr = *pImageAddr;
442 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrAdd(&Addr, cbHdr), pbLoadCmds, cbLoadCmds);
443 if (RT_SUCCESS(rc))
444 {
445 /*
446 * Scan it for segments so we can tranlate file offsets to virtual
447 * memory locations.
448 */
449 RTUUID Uuid = RTUUID_INITIALIZE_NULL;
450 uint32_t cMappings = 0;
451 uint32_t offCmd = 0;
452 for (uint32_t iCmd = 0; iCmd < cLoadCmds; iCmd++)
453 {
454 load_command_t const *pCurCmd = (load_command_t const *)&pbLoadCmds[offCmd];
455 uint32_t const cbCurCmd = offCmd + sizeof(*pCurCmd) <= cbLoadCmds ? pCurCmd->cmdsize : sizeof(*pCurCmd);
456 if (offCmd + cbCurCmd > cbLoadCmds)
457 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
458 "Load command #%u @ %#x is out of bounds: size %#x, left %#x", iCmd, offCmd, cbCurCmd,
459 cbLoadCmds - offCmd);
460 else if (pCurCmd->cmd == LC_SEGMENT_64)
461 {
462 segment_command_64 const *pSeg = (segment_command_64 const *)pCurCmd;
463 if (cbCurCmd >= sizeof(*pSeg))
464 {
465 if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
466 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
467 else
468 {
469 puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
470 puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
471 puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
472 puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
473 cMappings++;
474 }
475 }
476 else
477 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
478 "Load command #%u @ %#x is too small for a 64-bit segment: %#x", iCmd, offCmd, cbCurCmd);
479 }
480 else if (pCurCmd->cmd == LC_SEGMENT_32)
481 {
482 segment_command_32 const *pSeg = (segment_command_32 const *)pCurCmd;
483 if (cbCurCmd >= sizeof(*pSeg))
484 {
485 if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
486 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
487 else
488 {
489 puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
490 puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
491 puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
492 puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
493 cMappings++;
494 }
495 }
496 else
497 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
498 "Load command #%u @ %#x is too small for a 32-bit segment: %#x", iCmd, offCmd, cbCurCmd);
499 }
500 else if (pCurCmd->cmd == LC_UUID && cbCurCmd == sizeof(uuid_command_t))
501 memcpy(&Uuid, ((uuid_command_t const *)pCurCmd)->uuid, sizeof(Uuid));
502
503 if (RT_SUCCESS(rc))
504 offCmd += cbCurCmd;
505 else
506 break;
507 } /* for each command */
508
509 if (RT_SUCCESS(rc))
510 {
511 /*
512 * Create generic loader module instance (pThis is tied to it
513 * come rain come shine).
514 */
515 PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)RTMemAllocZVar(RT_UOFFSETOF_DYN(DBGFMODINMEMRDR, aMappings[cMappings]));
516 if (pThis)
517 {
518 RTLDRMOD hLdrMod;
519 rc = dbgfModInMemCommon_Init(pThis, pUVM, pImageAddr, puBuf->aMappings, cMappings,
520 pszName, enmArch, &hLdrMod, pErrInfo);
521 if (RT_SUCCESS(rc)) /* Don't bother if we don't have a handle. */
522 {
523 RTDBGMOD hMod;
524 rc = RTDbgModCreateFromMachOImage(&hMod, pszFilename ? pszFilename : pszName, pszName, enmArch,
525 &hLdrMod, 0 /*cbImage*/, 0, NULL, &Uuid, DBGFR3AsGetConfig(pUVM), fFlags);
526 if (RT_SUCCESS(rc))
527 *phDbgMod = hMod;
528 }
529 else
530 hLdrMod = NIL_RTLDRMOD;
531
532#if 0 /** @todo later */
533 if (RT_FAILURE(rc) && !(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
534 {
535 /*
536 * Fallback is a container module.
537 */
538 rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
539 if (RT_SUCCESS(rc))
540 {
541 rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /*iSeg*/, 0, cbImage, 0 /*fFlags*/, NULL);
542 AssertRC(rc);
543 }
544 }
545#endif
546 if (hLdrMod != NIL_RTLDRMOD)
547 RTLdrClose(hLdrMod);
548 }
549 else
550 rc = VERR_NO_MEMORY;
551 }
552 }
553 else
554 RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read %#x bytes of load commands", cbLoadCmds);
555 RTMemTmpFree(pbLoadCmds);
556 return rc;
557}
558
559
560/**
561 * @callback_method_impl{PFNRTLDRRDRMEMREAD}
562 */
563static DECLCALLBACK(int) dbgfModInMemPeRdr_Read(void *pvBuf, size_t cb, size_t off, void *pvUser)
564{
565 PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
566 uint32_t offFile = (uint32_t)off;
567 AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
568
569 uint32_t i = pThis->iHint;
570 if (pThis->aMappings[i].offFile > offFile)
571 {
572 i = pThis->cMappings;
573 while (i-- > 0)
574 if (offFile >= pThis->aMappings[i].offFile)
575 break;
576 pThis->iHint = i;
577 }
578
579 while (cb > 0)
580 {
581 uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
582 uint32_t offMap = offFile - pThis->aMappings[i].offFile;
583
584 /* Read file bits backed by memory. */
585 if (offMap < pThis->aMappings[i].cbMem)
586 {
587 uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
588 if (cbToRead > cb)
589 cbToRead = (uint32_t)cb;
590
591 DBGFADDRESS Addr = pThis->ImageAddr;
592 DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
593
594 int rc = DBGFR3MemRead(pThis->pUVM, 0 /*idCpu*/, &Addr, pvBuf, cbToRead);
595 if (RT_FAILURE(rc))
596 return rc;
597
598 /* Apply SizeOfImage patch? */
599 if ( pThis->offSizeOfImage != UINT32_MAX
600 && offFile < pThis->offSizeOfImage + 4
601 && offFile + cbToRead > pThis->offSizeOfImage)
602 {
603 uint32_t SizeOfImage = pThis->cbCorrectImageSize;
604 uint32_t cbPatch = sizeof(SizeOfImage);
605 int32_t offPatch = pThis->offSizeOfImage - offFile;
606 uint8_t *pbPatch = (uint8_t *)pvBuf + offPatch;
607 if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
608 cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
609 while (cbPatch-- > 0)
610 {
611 if (offPatch >= 0)
612 *pbPatch = (uint8_t)SizeOfImage;
613 offPatch++;
614 pbPatch++;
615 SizeOfImage >>= 8;
616 }
617 }
618
619 /* Done? */
620 if (cbToRead == cb)
621 break;
622
623 offFile += cbToRead;
624 cb -= cbToRead;
625 pvBuf = (char *)pvBuf + cbToRead;
626 }
627
628 /* Mind the gap. */
629 if (offNextMap > offFile)
630 {
631 uint32_t cbZero = offNextMap - offFile;
632 if (cbZero > cb)
633 {
634 RT_BZERO(pvBuf, cb);
635 break;
636 }
637
638 RT_BZERO(pvBuf, cbZero);
639 offFile += cbZero;
640 cb -= cbZero;
641 pvBuf = (char *)pvBuf + cbZero;
642 }
643
644 pThis->iHint = ++i;
645 }
646
647 return VINF_SUCCESS;
648}
649
650
651/**
652 * @callback_method_impl{PFNRTLDRRDRMEMDTOR}
653 */
654static DECLCALLBACK(void) dbgfModInMemPeRdr_Dtor(void *pvUser, size_t cbImage)
655{
656 PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
657 RT_NOREF(cbImage);
658
659 VMR3ReleaseUVM(pThis->pUVM);
660 pThis->pUVM = NULL;
661 RTMemFree(pvUser);
662}
663
664
665/**
666 * Checks if the section headers look okay.
667 *
668 * @returns VBox status code.
669 * @param paShdrs Pointer to the section headers.
670 * @param cShdrs Number of headers.
671 * @param cbImage The image size reported by NT.
672 * @param cbImageFromHdr The image size by the linker in the header.
673 * @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
674 * no resource directory.
675 * @param cbSectAlign The section alignment specified in the header.
676 * @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
677 * @param pcbImageCorrect The corrected image size. This is derived from
678 * cbImage and virtual range of the section tables.
679 *
680 * The problem is that NT may choose to drop the
681 * last pages in images it loads early, starting at
682 * the resource directory. These images will have
683 * a page aligned cbImage.
684 *
685 * @param pErrInfo Where to return more error details.
686 */
687static int dbgfR3ModPeCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShdrs, uint32_t cShdrs, uint32_t cbImage,
688 uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
689 bool fNt31, uint32_t *pcbImageCorrect, PRTERRINFO pErrInfo)
690{
691 *pcbImageCorrect = cbImage;
692
693 for (uint32_t i = 0; i < cShdrs; i++)
694 {
695 if (!paShdrs[i].Name[0])
696 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Section header #%u has no name", i);
697
698 if (paShdrs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
699 continue;
700
701 /* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
702 /** @todo this isn't really perfect. cbImage is kind of wrong... */
703 uint32_t cbVirtual = paShdrs[i].Misc.VirtualSize;
704 if (cbVirtual == 0)
705 {
706 for (uint32_t j = i + 1; j < cShdrs; j++)
707 if ( !(paShdrs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
708 && paShdrs[j].VirtualAddress > paShdrs[i].VirtualAddress)
709 {
710 cbVirtual = paShdrs[j].VirtualAddress - paShdrs[i].VirtualAddress;
711 break;
712 }
713 if (!cbVirtual)
714 {
715 if (paShdrs[i].VirtualAddress < cbImageFromHdr)
716 cbVirtual = cbImageFromHdr - paShdrs[i].VirtualAddress;
717 else if (paShdrs[i].SizeOfRawData > 0)
718 cbVirtual = RT_ALIGN(paShdrs[i].SizeOfRawData, _4K);
719 }
720 }
721
722 /* Check that sizes are within the same range and that both sizes and
723 addresses are within reasonable limits. */
724 if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShdrs[i].SizeOfRawData, _64K)
725 || cbVirtual >= _1G
726 || paShdrs[i].SizeOfRawData >= _1G)
727 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
728 "Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!",
729 i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].SizeOfRawData);
730 uint32_t uRvaEnd = paShdrs[i].VirtualAddress + cbVirtual;
731 if (uRvaEnd >= _1G || uRvaEnd < paShdrs[i].VirtualAddress)
732 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
733 "Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!",
734 i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].VirtualAddress, uRvaEnd);
735
736 /* Check for images chopped off around '.rsrc'. */
737 if ( cbImage < uRvaEnd
738 && uRvaEnd >= uRvaRsrc)
739 cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
740
741 /* Check that the section is within the image. */
742 if (uRvaEnd > cbImage && fNt31)
743 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
744 "Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x",
745 i, paShdrs[i].VirtualAddress, uRvaEnd, cbImage);
746 }
747
748 Assert(*pcbImageCorrect == cbImage || !(*pcbImageCorrect & 0xfff));
749 *pcbImageCorrect = cbImage;
750 return VINF_SUCCESS;
751}
752
753
754/**
755 * Create a loader module for the in-guest-memory PE module.
756 */
757static int dbgfR3ModInMemPeCreateLdrMod(PUVM pUVM, uint32_t fFlags, const char *pszName, PCDBGFADDRESS pImageAddr,
758 uint32_t cbImage, uint32_t cbImageFromHdr, bool f32Bit,
759 uint32_t cShdrs, PCIMAGE_SECTION_HEADER paShdrs, uint32_t cbSectAlign,
760 uint32_t cDataDir, PCIMAGE_DATA_DIRECTORY paDataDir, uint32_t offHdrs,
761 PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
762{
763 /*
764 * Allocate and create a reader instance.
765 */
766 PDBGFMODPERDR pRdr = (PDBGFMODPERDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGFMODPERDR, aMappings[cShdrs + 2]));
767 if (!pRdr)
768 return VERR_NO_MEMORY;
769
770 VMR3RetainUVM(pUVM);
771 pRdr->pUVM = pUVM;
772 pRdr->ImageAddr = *pImageAddr;
773 pRdr->cbImage = cbImage;
774 pRdr->cbCorrectImageSize = cbImage;
775 pRdr->offSizeOfImage = UINT32_MAX;
776 pRdr->iHint = 0;
777
778 /*
779 * Use the section table to construct a more accurate view of the file/image.
780 */
781 uint32_t uRvaRsrc = UINT32_MAX;
782 if ( cDataDir > IMAGE_DIRECTORY_ENTRY_RESOURCE
783 && paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size > 0)
784 uRvaRsrc = paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
785
786 int rc = dbgfR3ModPeCheckSectHdrsAndImgSize(paShdrs, cShdrs, cbImage, cbImageFromHdr, uRvaRsrc, cbSectAlign,
787 RT_BOOL(fFlags & DBGFMODINMEM_F_PE_NT31), &pRdr->cbCorrectImageSize, pErrInfo);
788 if (RT_SUCCESS(rc))
789 {
790 pRdr->cMappings = 0;
791
792 for (uint32_t i = 0; i < cShdrs; i++)
793 if ( paShdrs[i].SizeOfRawData > 0
794 && paShdrs[i].PointerToRawData > 0)
795 {
796 uint32_t j = 1;
797 if (!pRdr->cMappings)
798 pRdr->cMappings++;
799 else
800 {
801 while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShdrs[i].PointerToRawData)
802 j++;
803 if (j < pRdr->cMappings)
804 memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
805 }
806 pRdr->aMappings[j].offFile = paShdrs[i].PointerToRawData;
807 pRdr->aMappings[j].offMem = paShdrs[i].VirtualAddress;
808 pRdr->aMappings[j].cbMem = i + 1 < cShdrs
809 ? paShdrs[i + 1].VirtualAddress - paShdrs[i].VirtualAddress
810 : paShdrs[i].Misc.VirtualSize;
811 if (j == pRdr->cMappings)
812 pRdr->cbImage = paShdrs[i].PointerToRawData + paShdrs[i].SizeOfRawData;
813 pRdr->cMappings++;
814 }
815
816 /* Insert the mapping of the headers that isn't covered by the section table. */
817 pRdr->aMappings[0].offFile = 0;
818 pRdr->aMappings[0].offMem = 0;
819 pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
820
821 int j = pRdr->cMappings - 1;
822 while (j-- > 0)
823 {
824 uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
825 if (pRdr->aMappings[j].cbMem > cbFile)
826 pRdr->aMappings[j].cbMem = cbFile;
827 }
828 }
829 else if (fFlags & DBGFMODINMEM_F_NO_READER_FALLBACK)
830 return rc;
831 else
832 {
833 /*
834 * Fallback, fake identity mapped file data.
835 */
836 pRdr->cMappings = 1;
837 pRdr->aMappings[0].offFile = 0;
838 pRdr->aMappings[0].offMem = 0;
839 pRdr->aMappings[0].cbMem = pRdr->cbImage;
840 }
841
842 /* Enable the SizeOfImage patching if necessary. */
843 if (pRdr->cbCorrectImageSize != cbImage)
844 {
845 Log(("dbgfR3ModInMemPeCreateLdrMod: The image is really %#x bytes long, not %#x as mapped by NT!\n",
846 pRdr->cbCorrectImageSize, cbImage));
847 pRdr->offSizeOfImage = f32Bit
848 ? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
849 : offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
850 }
851
852 /*
853 * Call the loader to open the PE image for debugging.
854 * Note! It always calls pfnDtor.
855 */
856 RTLDRMOD hLdrMod;
857 rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
858 dbgfModInMemPeRdr_Read, dbgfModInMemPeRdr_Dtor, pRdr,
859 &hLdrMod, pErrInfo);
860 if (RT_SUCCESS(rc))
861 *phLdrMod = hLdrMod;
862 else
863 *phLdrMod = NIL_RTLDRMOD;
864 return rc;
865}
866
867
868/**
869 * Handles in-memory PE images.
870 *
871 * @returns VBox status code.
872 * @param pUVM The user mode VM handle.
873 * @param pImageAddr The image address.
874 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
875 * @param pszName The module name, optional.
876 * @param pszFilename The image filename, optional.
877 * @param enmArch The image arch if we force it, pass
878 * RTLDRARCH_WHATEVER if you don't care.
879 * @param cbImage Image size. Pass 0 if not known.
880 * @param offPeHdrs Offset of the PE header.
881 * @param cbPeHdrsPart1 How read into uBuf at @a offPeHdrs.
882 * @param puBuf The header buffer.
883 * @param phDbgMod Where to return the resulting debug module on success.
884 * @param pErrInfo Where to return extended error info on failure.
885 */
886static int dbgfR3ModInMemPe(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
887 RTLDRARCH enmArch, uint32_t cbImage, uint32_t offPeHdrs, uint32_t cbPeHdrsPart1,
888 PDBGFMODINMEMBUF puBuf, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
889{
890 /*
891 * Read the optional header and the section table after validating the
892 * info we need from the file header.
893 */
894 /* Check the opt hdr size and number of sections as these are used to determine how much to read next. */
895 if ( puBuf->Nt32.FileHeader.SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER32)
896 || puBuf->Nt32.FileHeader.SizeOfOptionalHeader > sizeof(IMAGE_OPTIONAL_HEADER64) + 128)
897 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Invalid SizeOfOptionalHeader value: %#RX32",
898 puBuf->Nt32.FileHeader.SizeOfOptionalHeader);
899
900 if ( puBuf->Nt32.FileHeader.NumberOfSections < 1
901 || puBuf->Nt32.FileHeader.NumberOfSections > 190 /* what fits in our 8K buffer */)
902 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "NumberOfSections is out of range: %#RX32 (1..190)",
903 puBuf->Nt32.FileHeader.NumberOfSections);
904
905 /* Read the optional header and section table. */
906 uint32_t const cbHdrs = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
907 + puBuf->Nt32.FileHeader.SizeOfOptionalHeader
908 + puBuf->Nt32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
909 AssertReturn(cbHdrs <= sizeof(*puBuf), RTERRINFO_LOG_SET_F(pErrInfo, VERR_INTERNAL_ERROR_2, "cbHdrs=%#x", cbHdrs));
910
911 DBGFADDRESS PeHdrPart2Addr = *pImageAddr;
912 DBGFR3AddrAdd(&PeHdrPart2Addr, offPeHdrs + cbPeHdrsPart1);
913 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &PeHdrPart2Addr, &puBuf->ab[cbPeHdrsPart1], cbHdrs - cbPeHdrsPart1);
914 if (RT_FAILURE(rc))
915 return RTERRINFO_LOG_SET_F(pErrInfo, rc,
916 "Failed to read the second part of the PE headers at %RGv (off=%#RX32 + %#RX32): %Rrc",
917 PeHdrPart2Addr.FlatPtr, offPeHdrs, cbPeHdrsPart1, rc);
918
919 /*
920 * Check the image architecture and determine the bitness.
921 */
922 RTLDRARCH enmArchActual;
923 bool f32Bit;
924 switch (puBuf->Nt32.FileHeader.Machine)
925 {
926 case IMAGE_FILE_MACHINE_I386:
927 enmArchActual = RTLDRARCH_X86_32;
928 f32Bit = true;
929 break;
930 case IMAGE_FILE_MACHINE_AMD64:
931 enmArchActual = RTLDRARCH_AMD64;
932 f32Bit = false;
933 break;
934 case IMAGE_FILE_MACHINE_ARM:
935 case IMAGE_FILE_MACHINE_THUMB:
936 case IMAGE_FILE_MACHINE_ARMNT:
937 enmArchActual = RTLDRARCH_ARM32;
938 f32Bit = true;
939 break;
940 case IMAGE_FILE_MACHINE_ARM64:
941 enmArchActual = RTLDRARCH_ARM64;
942 f32Bit = false;
943 break;
944 default:
945 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unknown machine: %#x", puBuf->Nt32.FileHeader.Machine);
946 }
947 if ( enmArch != RTLDRARCH_WHATEVER
948 && enmArch != enmArchActual)
949 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Found %s expected %s",
950 RTLdrArchName(enmArchActual), RTLdrArchName(enmArch));
951
952 /*
953 * Check optional header magic and size.
954 */
955 uint16_t const uOptMagic = f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC;
956 if (puBuf->Nt32.OptionalHeader.Magic != uOptMagic)
957 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header magic: %#x (expected %#x)",
958 puBuf->Nt32.OptionalHeader.Magic, uOptMagic);
959
960 uint32_t const cDataDir = f32Bit ? puBuf->Nt32.OptionalHeader.NumberOfRvaAndSizes : puBuf->Nt64.OptionalHeader.NumberOfRvaAndSizes;
961 if ( cDataDir <= IMAGE_DIRECTORY_ENTRY_BASERELOC /* a bit random */
962 || cDataDir > 32 /* also random */)
963 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected data directory size: %#x", cDataDir);
964
965 uint32_t cbOptHdr = f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64);
966 cbOptHdr -= sizeof(IMAGE_DATA_DIRECTORY) * IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
967 cbOptHdr += sizeof(IMAGE_DATA_DIRECTORY) * cDataDir;
968 if (puBuf->Nt32.FileHeader.SizeOfOptionalHeader != cbOptHdr)
969 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header size: %#x (expected %#x)",
970 puBuf->Nt32.FileHeader.SizeOfOptionalHeader, cbOptHdr);
971
972 uint32_t const cbSectAlign = f32Bit ? puBuf->Nt32.OptionalHeader.SectionAlignment : puBuf->Nt64.OptionalHeader.SectionAlignment;
973 PCIMAGE_SECTION_HEADER pSHdrs = (PCIMAGE_SECTION_HEADER)((uintptr_t)&puBuf->Nt32.OptionalHeader + cbOptHdr);
974 PCIMAGE_DATA_DIRECTORY paDataDir = (PCIMAGE_DATA_DIRECTORY)((uintptr_t)pSHdrs - cDataDir * sizeof(IMAGE_DATA_DIRECTORY));
975
976 /*
977 * Establish the image size.
978 */
979 uint32_t cbImageFromHdr = f32Bit ? puBuf->Nt32.OptionalHeader.SizeOfImage : puBuf->Nt64.OptionalHeader.SizeOfImage;
980 if ( !cbImage
981 || (fFlags & DBGFMODINMEM_F_PE_NT31))
982 cbImage = RT_ALIGN(cbImageFromHdr, _4K);
983 else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
984 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_MISMATCH, "Image size mismatch: input=%#x header=%#x", cbImage, cbImageFromHdr);
985
986 /*
987 * Guess the module name if not specified and make sure it conforms to DBGC expectations.
988 */
989 if (!pszName)
990 {
991 if (pszFilename)
992 pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
993 /** @todo */
994 }
995
996 char szNormalized[128];
997 pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
998
999 /*
1000 * Create the module using the in memory image first, falling back on cached image.
1001 */
1002 RTLDRMOD hLdrMod;
1003 rc = dbgfR3ModInMemPeCreateLdrMod(pUVM, fFlags, pszName, pImageAddr, cbImage, cbImageFromHdr, f32Bit,
1004 puBuf->Nt32.FileHeader.NumberOfSections, pSHdrs, cbSectAlign, cDataDir, paDataDir,
1005 offPeHdrs, &hLdrMod, pErrInfo);
1006 if (RT_FAILURE(rc))
1007 hLdrMod = NIL_RTLDRMOD;
1008
1009 RTDBGMOD hMod;
1010 rc = RTDbgModCreateFromPeImage(&hMod, pszFilename, pszName, &hLdrMod, cbImageFromHdr,
1011 puBuf->Nt32.FileHeader.TimeDateStamp, DBGFR3AsGetConfig(pUVM));
1012 if (RT_SUCCESS(rc))
1013 *phDbgMod = hMod;
1014 else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
1015 {
1016 /*
1017 * Fallback is a container module.
1018 */
1019 rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
1020 if (RT_SUCCESS(rc))
1021 {
1022 rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /*iSeg*/, 0, cbImage, 0 /*fFlags*/, NULL);
1023 AssertRC(rc);
1024 }
1025 }
1026 return rc;
1027}
1028
1029
1030
1031/**
1032 * Process a PE image found in guest memory.
1033 *
1034 * @param pUVM The user mode VM handle.
1035 * @param pImageAddr The image address.
1036 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
1037 * @param pszName The module name, optional.
1038 * @param pszFilename The image filename, optional.
1039 * @param enmArch The image arch if we force it, pass
1040 * RTLDRARCH_WHATEVER if you don't care.
1041 * @param cbImage Image size. Pass 0 if not known.
1042 * @param phDbgMod Where to return the resulting debug module on success.
1043 * @param pErrInfo Where to return extended error info on failure.
1044 */
1045VMMR3DECL(int) DBGFR3ModInMem(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
1046 RTLDRARCH enmArch, uint32_t cbImage, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
1047{
1048 /*
1049 * Validate and adjust.
1050 */
1051 AssertPtrReturn(phDbgMod, VERR_INVALID_POINTER);
1052 *phDbgMod = NIL_RTDBGMOD;
1053 AssertPtrReturn(pImageAddr, VERR_INVALID_POINTER);
1054 AssertMsgReturn(cbImage == 0 || cbImage >= sizeof(IMAGE_NT_HEADERS32) + sizeof(IMAGE_DOS_HEADER),
1055 ("cbImage=%#x\n", cbImage), VERR_INVALID_PARAMETER);
1056 AssertMsgReturn(!(fFlags & ~DBGFMODINMEM_F_VALID_MASK), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
1057 if (enmArch == RTLDRARCH_HOST)
1058 enmArch = RTLdrGetHostArch();
1059
1060 /*
1061 * Look for an image header we can work with.
1062 */
1063 DBGFMODINMEMBUF uBuf;
1064 RT_ZERO(uBuf);
1065
1066 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, pImageAddr, &uBuf, sizeof(uBuf.DosHdr));
1067 if (RT_FAILURE(rc))
1068 return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read DOS header at %RGv: %Rrc", pImageAddr->FlatPtr, rc);
1069
1070 if (uBuf.ab[0] == ELFMAG0 && uBuf.ab[1] == ELFMAG1 && uBuf.ab[2] == ELFMAG2 && uBuf.ab[3] == ELFMAG3)
1071 return dbgfR3ModInMemElf(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
1072
1073 if ( uBuf.MachoHdr.magic == IMAGE_MACHO64_SIGNATURE
1074 || uBuf.MachoHdr.magic == IMAGE_MACHO32_SIGNATURE)
1075 return dbgfR3ModInMemMachO(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
1076
1077 uint32_t offNewHdrs;
1078 if (uBuf.DosHdr.e_magic == IMAGE_DOS_SIGNATURE)
1079 {
1080 offNewHdrs = uBuf.DosHdr.e_lfanew;
1081 if ( offNewHdrs < 16
1082 || offNewHdrs > (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)))
1083 return RTERRINFO_LOG_SET_F(pErrInfo, rc, "e_lfanew value is out of range: %RX32 (16..%u)",
1084 offNewHdrs, (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)));
1085 }
1086 else if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
1087 offNewHdrs = 0;
1088 else
1089 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Unknown image magic at %RGv: %.8Rhxs",
1090 pImageAddr->FlatPtr, uBuf.ab);
1091
1092 /*
1093 * Read the next bit of header, assuming PE so stop at the end of
1094 * the COFF file header.
1095 */
1096 DBGFADDRESS PeHdrAddr = *pImageAddr;
1097 DBGFR3AddrAdd(&PeHdrAddr, offNewHdrs);
1098 uint32_t const cbPeHdrsPart1 = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader);
1099 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &PeHdrAddr, &uBuf, cbPeHdrsPart1);
1100 if (RT_FAILURE(rc))
1101 return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read PE/LX/NE headers at %RGv (off=%#RX32): %Rrc",
1102 PeHdrAddr.FlatPtr, offNewHdrs, rc);
1103
1104 if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
1105 return dbgfR3ModInMemPe(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, offNewHdrs, cbPeHdrsPart1,
1106 &uBuf, phDbgMod, pErrInfo);
1107
1108 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "No PE/LX/NE header at %RGv (off=%#RX32): %.8Rhxs",
1109 PeHdrAddr.FlatPtr, offNewHdrs, uBuf.ab);
1110}
1111
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette