VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3ModInMem.cpp@ 74795

Last change on this file since 74795 was 73491, checked in by vboxsync, 6 years ago

DBGF,DBGPluInWinNt: Produce more useful module names (e.g. stuff that works in DBGC).
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 28.9 KB
Line 
1/* $Id: DBGFR3ModInMem.cpp 73491 2018-08-03 14:51:55Z vboxsync $ */
2/** @file
3 * DBGFR3ModInMemPe - In memory PE module 'loader'.
4 */
5
6/*
7 * Copyright (C) 2009-2018 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF
23#include <VBox/vmm/dbgf.h>
24
25#include <VBox/err.h>
26#include <iprt/ctype.h>
27#include <iprt/ldr.h>
28#include <iprt/mem.h>
29#include <iprt/path.h>
30#include <iprt/string.h>
31#include <iprt/formats/pecoff.h>
32#include <iprt/formats/mz.h>
33#include <iprt/formats/elf.h>
34
35
36/*********************************************************************************************************************************
37* Structures and Typedefs *
38*********************************************************************************************************************************/
39/**
40 * The WinNT digger's loader reader instance data.
41 */
42typedef struct DBGFMODPERDR
43{
44 /** The VM handle (referenced). */
45 PUVM pUVM;
46 /** The image base. */
47 DBGFADDRESS ImageAddr;
48 /** The image size. */
49 uint32_t cbImage;
50 /** The file offset of the SizeOfImage field in the optional header if it
51 * needs patching, otherwise set to UINT32_MAX. */
52 uint32_t offSizeOfImage;
53 /** The correct image size. */
54 uint32_t cbCorrectImageSize;
55 /** Number of entries in the aMappings table. */
56 uint32_t cMappings;
57 /** Mapping hint. */
58 uint32_t iHint;
59 /** Mapping file offset to memory offsets, ordered by file offset. */
60 struct
61 {
62 /** The file offset. */
63 uint32_t offFile;
64 /** The size of this mapping. */
65 uint32_t cbMem;
66 /** The offset to the memory from the start of the image. */
67 uint32_t offMem;
68 } aMappings[1];
69} DBGFMODPERDR;
70/** Pointer a WinNT loader reader instance data. */
71typedef DBGFMODPERDR *PDBGFMODPERDR;
72
73/**
74 * Stack buffer.
75 */
76typedef union DBGFMODINMEMBUF
77{
78 uint8_t ab[0x2000];
79 IMAGE_DOS_HEADER DosHdr;
80 IMAGE_NT_HEADERS32 Nt32;
81 IMAGE_NT_HEADERS64 Nt64;
82} DBGFMODINMEMBUF;
83/** Pointer to stack buffer. */
84typedef DBGFMODINMEMBUF *PDBGFMODINMEMBUF;
85
86
87
88/**
89 * Normalizes a debug module name.
90 *
91 * @returns Normalized debug module name.
92 * @param pszName The name.
93 * @param pszBuf Buffer to use if work is needed.
94 * @param cbBuf Size of buffer.
95 */
96const char *dbgfR3ModNormalizeName(const char *pszName, char *pszBuf, size_t cbBuf)
97{
98 /*
99 * Skip to the filename in case someone gave us a full filename path.
100 */
101 pszName = RTPathFilenameEx(pszName, RTPATH_STR_F_STYLE_DOS);
102
103 /*
104 * Is it okay?
105 */
106 size_t cchName = strlen(pszName);
107 size_t off = 0;
108 for (;; off++)
109 {
110 char ch = pszName[off];
111 if (ch == '\0')
112 return pszName;
113 if (!RT_C_IS_ALNUM(ch) && ch != '_')
114 break;
115 }
116
117 /*
118 * It's no okay, so morph it.
119 */
120 if (cchName >= cbBuf)
121 cchName = cbBuf - 1;
122 for (off = 0; off < cchName; off++)
123 {
124 char ch = pszName[off];
125 if (!RT_C_IS_ALNUM(ch))
126 ch = '_';
127 pszBuf[off] = ch;
128 }
129 pszBuf[off] = '\0';
130
131 return pszBuf;
132}
133
134
135/**
136 * Handles in-memory ELF images.
137 *
138 * @returns VBox status code.
139 * @param pUVM The user mode VM handle.
140 * @param pImageAddr The image address.
141 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
142 * @param pszName The module name, optional.
143 * @param pszFilename The image filename, optional.
144 * @param enmArch The image arch if we force it, pass
145 * RTLDRARCH_WHATEVER if you don't care.
146 * @param cbImage Image size. Pass 0 if not known.
147 * @param puBuf The header buffer.
148 * @param phDbgMod Where to return the resulting debug module on success.
149 * @param pErrInfo Where to return extended error info on failure.
150 */
151static int dbgfR3ModInMemElf(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
152 RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
153 PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
154{
155 RT_NOREF(pUVM, fFlags, pszName, pszFilename, enmArch, cbImage, puBuf, phDbgMod);
156 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Found ELF magic at %RGv", pImageAddr->FlatPtr);
157}
158
159
160/**
161 * @callback_method_impl{PFNRTLDRRDRMEMREAD}
162 */
163static DECLCALLBACK(int) dbgfModInMemPeRdr_Read(void *pvBuf, size_t cb, size_t off, void *pvUser)
164{
165 PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
166 uint32_t offFile = (uint32_t)off;
167 AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
168
169 uint32_t i = pThis->iHint;
170 if (pThis->aMappings[i].offFile > offFile)
171 {
172 i = pThis->cMappings;
173 while (i-- > 0)
174 if (offFile >= pThis->aMappings[i].offFile)
175 break;
176 pThis->iHint = i;
177 }
178
179 while (cb > 0)
180 {
181 uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
182 uint32_t offMap = offFile - pThis->aMappings[i].offFile;
183
184 /* Read file bits backed by memory. */
185 if (offMap < pThis->aMappings[i].cbMem)
186 {
187 uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
188 if (cbToRead > cb)
189 cbToRead = (uint32_t)cb;
190
191 DBGFADDRESS Addr = pThis->ImageAddr;
192 DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
193
194 int rc = DBGFR3MemRead(pThis->pUVM, 0 /*idCpu*/, &Addr, pvBuf, cbToRead);
195 if (RT_FAILURE(rc))
196 return rc;
197
198 /* Apply SizeOfImage patch? */
199 if ( pThis->offSizeOfImage != UINT32_MAX
200 && offFile < pThis->offSizeOfImage + 4
201 && offFile + cbToRead > pThis->offSizeOfImage)
202 {
203 uint32_t SizeOfImage = pThis->cbCorrectImageSize;
204 uint32_t cbPatch = sizeof(SizeOfImage);
205 int32_t offPatch = pThis->offSizeOfImage - offFile;
206 uint8_t *pbPatch = (uint8_t *)pvBuf + offPatch;
207 if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
208 cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
209 while (cbPatch-- > 0)
210 {
211 if (offPatch >= 0)
212 *pbPatch = (uint8_t)SizeOfImage;
213 offPatch++;
214 pbPatch++;
215 SizeOfImage >>= 8;
216 }
217 }
218
219 /* Done? */
220 if (cbToRead == cb)
221 break;
222
223 offFile += cbToRead;
224 cb -= cbToRead;
225 pvBuf = (char *)pvBuf + cbToRead;
226 }
227
228 /* Mind the gap. */
229 if (offNextMap > offFile)
230 {
231 uint32_t cbZero = offNextMap - offFile;
232 if (cbZero > cb)
233 {
234 RT_BZERO(pvBuf, cb);
235 break;
236 }
237
238 RT_BZERO(pvBuf, cbZero);
239 offFile += cbZero;
240 cb -= cbZero;
241 pvBuf = (char *)pvBuf + cbZero;
242 }
243
244 pThis->iHint = ++i;
245 }
246
247 return VINF_SUCCESS;
248}
249
250
251/**
252 * @callback_method_impl{PFNRTLDRRDRMEMDTOR}
253 */
254static DECLCALLBACK(void) dbgfModInMemPeRdr_Dtor(void *pvUser)
255{
256 PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
257
258 VMR3ReleaseUVM(pThis->pUVM);
259 pThis->pUVM = NULL;
260 RTMemFree(pvUser);
261}
262
263
264/**
265 * Checks if the section headers look okay.
266 *
267 * @returns VBox status code.
268 * @param paShdrs Pointer to the section headers.
269 * @param cShdrs Number of headers.
270 * @param cbImage The image size reported by NT.
271 * @param cbImageFromHdr The image size by the linker in the header.
272 * @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
273 * no resource directory.
274 * @param cbSectAlign The section alignment specified in the header.
275 * @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
276 * @param pcbImageCorrect The corrected image size. This is derived from
277 * cbImage and virtual range of the section tables.
278 *
279 * The problem is that NT may choose to drop the
280 * last pages in images it loads early, starting at
281 * the resource directory. These images will have
282 * a page aligned cbImage.
283 *
284 * @param pErrInfo Where to return more error details.
285 */
286static int dbgfR3ModPeCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShdrs, uint32_t cShdrs, uint32_t cbImage,
287 uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
288 bool fNt31, uint32_t *pcbImageCorrect, PRTERRINFO pErrInfo)
289{
290 *pcbImageCorrect = cbImage;
291
292 for (uint32_t i = 0; i < cShdrs; i++)
293 {
294 if (!paShdrs[i].Name[0])
295 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Section header #%u has no name", i);
296
297 if (paShdrs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
298 continue;
299
300 /* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
301 /** @todo this isn't really perfect. cbImage is kind of wrong... */
302 uint32_t cbVirtual = paShdrs[i].Misc.VirtualSize;
303 if (cbVirtual == 0)
304 {
305 for (uint32_t j = i + 1; j < cShdrs; j++)
306 if ( !(paShdrs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
307 && paShdrs[j].VirtualAddress > paShdrs[i].VirtualAddress)
308 {
309 cbVirtual = paShdrs[j].VirtualAddress - paShdrs[i].VirtualAddress;
310 break;
311 }
312 if (!cbVirtual)
313 {
314 if (paShdrs[i].VirtualAddress < cbImageFromHdr)
315 cbVirtual = cbImageFromHdr - paShdrs[i].VirtualAddress;
316 else if (paShdrs[i].SizeOfRawData > 0)
317 cbVirtual = RT_ALIGN(paShdrs[i].SizeOfRawData, _4K);
318 }
319 }
320
321 /* Check that sizes are within the same range and that both sizes and
322 addresses are within reasonable limits. */
323 if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShdrs[i].SizeOfRawData, _64K)
324 || cbVirtual >= _1G
325 || paShdrs[i].SizeOfRawData >= _1G)
326 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
327 "Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!",
328 i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].SizeOfRawData);
329 uint32_t uRvaEnd = paShdrs[i].VirtualAddress + cbVirtual;
330 if (uRvaEnd >= _1G || uRvaEnd < paShdrs[i].VirtualAddress)
331 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
332 "Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!",
333 i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].VirtualAddress, uRvaEnd);
334
335 /* Check for images chopped off around '.rsrc'. */
336 if ( cbImage < uRvaEnd
337 && uRvaEnd >= uRvaRsrc)
338 cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
339
340 /* Check that the section is within the image. */
341 if (uRvaEnd > cbImage && fNt31)
342 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
343 "Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x",
344 i, paShdrs[i].VirtualAddress, uRvaEnd, cbImage);
345 }
346
347 Assert(*pcbImageCorrect == cbImage || !(*pcbImageCorrect & 0xfff));
348 *pcbImageCorrect = cbImage;
349 return VINF_SUCCESS;
350}
351
352
353/**
354 * Create a loader module for the in-guest-memory PE module.
355 */
356static int dbgfR3ModInMemPeCreateLdrMod(PUVM pUVM, uint32_t fFlags, const char *pszName, PCDBGFADDRESS pImageAddr,
357 uint32_t cbImage, uint32_t cbImageFromHdr, bool f32Bit,
358 uint32_t cShdrs, PCIMAGE_SECTION_HEADER paShdrs, uint32_t cbSectAlign,
359 uint32_t cDataDir, PCIMAGE_DATA_DIRECTORY paDataDir, uint32_t offHdrs,
360 PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
361{
362 /*
363 * Allocate and create a reader instance.
364 */
365 PDBGFMODPERDR pRdr = (PDBGFMODPERDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGFMODPERDR, aMappings[cShdrs + 2]));
366 if (!pRdr)
367 return VERR_NO_MEMORY;
368
369 VMR3RetainUVM(pUVM);
370 pRdr->pUVM = pUVM;
371 pRdr->ImageAddr = *pImageAddr;
372 pRdr->cbImage = cbImage;
373 pRdr->cbCorrectImageSize = cbImage;
374 pRdr->offSizeOfImage = UINT32_MAX;
375 pRdr->iHint = 0;
376
377 /*
378 * Use the section table to construct a more accurate view of the file/image.
379 */
380 uint32_t uRvaRsrc = UINT32_MAX;
381 if ( cDataDir > IMAGE_DIRECTORY_ENTRY_RESOURCE
382 && paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size > 0)
383 uRvaRsrc = paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
384
385 int rc = dbgfR3ModPeCheckSectHdrsAndImgSize(paShdrs, cShdrs, cbImage, cbImageFromHdr, uRvaRsrc, cbSectAlign,
386 RT_BOOL(fFlags & DBGFMODINMEM_F_PE_NT31), &pRdr->cbCorrectImageSize, pErrInfo);
387 if (RT_SUCCESS(rc))
388 {
389 pRdr->cMappings = 0;
390
391 for (uint32_t i = 0; i < cShdrs; i++)
392 if ( paShdrs[i].SizeOfRawData > 0
393 && paShdrs[i].PointerToRawData > 0)
394 {
395 uint32_t j = 1;
396 if (!pRdr->cMappings)
397 pRdr->cMappings++;
398 else
399 {
400 while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShdrs[i].PointerToRawData)
401 j++;
402 if (j < pRdr->cMappings)
403 memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
404 }
405 pRdr->aMappings[j].offFile = paShdrs[i].PointerToRawData;
406 pRdr->aMappings[j].offMem = paShdrs[i].VirtualAddress;
407 pRdr->aMappings[j].cbMem = i + 1 < cShdrs
408 ? paShdrs[i + 1].VirtualAddress - paShdrs[i].VirtualAddress
409 : paShdrs[i].Misc.VirtualSize;
410 if (j == pRdr->cMappings)
411 pRdr->cbImage = paShdrs[i].PointerToRawData + paShdrs[i].SizeOfRawData;
412 pRdr->cMappings++;
413 }
414
415 /* Insert the mapping of the headers that isn't covered by the section table. */
416 pRdr->aMappings[0].offFile = 0;
417 pRdr->aMappings[0].offMem = 0;
418 pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
419
420 int j = pRdr->cMappings - 1;
421 while (j-- > 0)
422 {
423 uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
424 if (pRdr->aMappings[j].cbMem > cbFile)
425 pRdr->aMappings[j].cbMem = cbFile;
426 }
427 }
428 else if (fFlags & DBGFMODINMEM_F_NO_READER_FALLBACK)
429 return rc;
430 else
431 {
432 /*
433 * Fallback, fake identity mapped file data.
434 */
435 pRdr->cMappings = 1;
436 pRdr->aMappings[0].offFile = 0;
437 pRdr->aMappings[0].offMem = 0;
438 pRdr->aMappings[0].cbMem = pRdr->cbImage;
439 }
440
441 /* Enable the SizeOfImage patching if necessary. */
442 if (pRdr->cbCorrectImageSize != cbImage)
443 {
444 Log(("dbgfR3ModInMemPeCreateLdrMod: The image is really %#x bytes long, not %#x as mapped by NT!\n",
445 pRdr->cbCorrectImageSize, cbImage));
446 pRdr->offSizeOfImage = f32Bit
447 ? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
448 : offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
449 }
450
451 /*
452 * Call the loader to open the PE image for debugging.
453 * Note! It always calls pfnDtor.
454 */
455 RTLDRMOD hLdrMod;
456 rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
457 dbgfModInMemPeRdr_Read, dbgfModInMemPeRdr_Dtor, pRdr,
458 &hLdrMod, pErrInfo);
459 if (RT_SUCCESS(rc))
460 *phLdrMod = hLdrMod;
461 else
462 *phLdrMod = NIL_RTLDRMOD;
463 return rc;
464}
465
466
467/**
468 * Handles in-memory PE images.
469 *
470 * @returns VBox status code.
471 * @param pUVM The user mode VM handle.
472 * @param pImageAddr The image address.
473 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
474 * @param pszName The module name, optional.
475 * @param pszFilename The image filename, optional.
476 * @param enmArch The image arch if we force it, pass
477 * RTLDRARCH_WHATEVER if you don't care.
478 * @param cbImage Image size. Pass 0 if not known.
479 * @param offPeHdrs Offset of the PE header.
480 * @param cbPeHdrsPart1 How read into uBuf at @a offPeHdrs.
481 * @param puBuf The header buffer.
482 * @param phDbgMod Where to return the resulting debug module on success.
483 * @param pErrInfo Where to return extended error info on failure.
484 */
485static int dbgfR3ModInMemPe(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
486 RTLDRARCH enmArch, uint32_t cbImage, uint32_t offPeHdrs, uint32_t cbPeHdrsPart1,
487 PDBGFMODINMEMBUF puBuf, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
488{
489 /*
490 * Read the optional header and the section table after validating the
491 * info we need from the file header.
492 */
493 /* Check the opt hdr size and number of sections as these are used to determine how much to read next. */
494 if ( puBuf->Nt32.FileHeader.SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER32)
495 || puBuf->Nt32.FileHeader.SizeOfOptionalHeader > sizeof(IMAGE_OPTIONAL_HEADER64) + 128)
496 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Invalid SizeOfOptionalHeader value: %#RX32",
497 puBuf->Nt32.FileHeader.SizeOfOptionalHeader);
498
499 if ( puBuf->Nt32.FileHeader.NumberOfSections < 1
500 || puBuf->Nt32.FileHeader.NumberOfSections > 190 /* what fits in our 8K buffer */)
501 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "NumberOfSections is out of range: %#RX32 (1..190)",
502 puBuf->Nt32.FileHeader.NumberOfSections);
503
504 /* Read the optional header and section table. */
505 uint32_t const cbHdrs = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
506 + puBuf->Nt32.FileHeader.SizeOfOptionalHeader
507 + puBuf->Nt32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
508 AssertReturn(cbHdrs <= sizeof(*puBuf), RTERRINFO_LOG_SET_F(pErrInfo, VERR_INTERNAL_ERROR_2, "cbHdrs=%#x", cbHdrs));
509
510 DBGFADDRESS PeHdrPart2Addr = *pImageAddr;
511 DBGFR3AddrAdd(&PeHdrPart2Addr, offPeHdrs + cbPeHdrsPart1);
512 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &PeHdrPart2Addr, &puBuf->ab[cbPeHdrsPart1], cbHdrs - cbPeHdrsPart1);
513 if (RT_FAILURE(rc))
514 return RTERRINFO_LOG_SET_F(pErrInfo, rc,
515 "Failed to read the second part of the PE headers at %RGv (off=%#RX32 + %#RX32): %Rrc",
516 PeHdrPart2Addr.FlatPtr, offPeHdrs, cbPeHdrsPart1, rc);
517
518 /*
519 * Check the image architecture and determine the bitness.
520 */
521 RTLDRARCH enmArchActual;
522 bool f32Bit;
523 switch (puBuf->Nt32.FileHeader.Machine)
524 {
525 case IMAGE_FILE_MACHINE_I386:
526 enmArchActual = RTLDRARCH_X86_32;
527 f32Bit = true;
528 break;
529 case IMAGE_FILE_MACHINE_AMD64:
530 enmArchActual = RTLDRARCH_AMD64;
531 f32Bit = false;
532 break;
533 case IMAGE_FILE_MACHINE_ARM:
534 case IMAGE_FILE_MACHINE_THUMB:
535 case IMAGE_FILE_MACHINE_ARMNT:
536 enmArchActual = RTLDRARCH_ARM32;
537 f32Bit = true;
538 break;
539 case IMAGE_FILE_MACHINE_ARM64:
540 enmArchActual = RTLDRARCH_ARM64;
541 f32Bit = false;
542 break;
543 default:
544 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unknown machine: %#x", puBuf->Nt32.FileHeader.Machine);
545 }
546 if ( enmArch != RTLDRARCH_WHATEVER
547 && enmArch != enmArchActual)
548 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Found %s expected %s",
549 RTLdrArchName(enmArchActual), RTLdrArchName(enmArch));
550
551 /*
552 * Check optional header magic and size.
553 */
554 uint16_t const uOptMagic = f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC;
555 if (puBuf->Nt32.OptionalHeader.Magic != uOptMagic)
556 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header magic: %#x (expected %#x)",
557 puBuf->Nt32.OptionalHeader.Magic, uOptMagic);
558
559 uint32_t const cDataDir = f32Bit ? puBuf->Nt32.OptionalHeader.NumberOfRvaAndSizes : puBuf->Nt64.OptionalHeader.NumberOfRvaAndSizes;
560 if ( cDataDir <= IMAGE_DIRECTORY_ENTRY_BASERELOC /* a bit random */
561 || cDataDir > 32 /* also random */)
562 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected data directory size: %#x", cDataDir);
563
564 uint32_t cbOptHdr = f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64);
565 cbOptHdr -= sizeof(IMAGE_DATA_DIRECTORY) * IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
566 cbOptHdr += sizeof(IMAGE_DATA_DIRECTORY) * cDataDir;
567 if (puBuf->Nt32.FileHeader.SizeOfOptionalHeader != cbOptHdr)
568 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header size: %#x (expected %#x)",
569 puBuf->Nt32.FileHeader.SizeOfOptionalHeader, cbOptHdr);
570
571 uint32_t const cbSectAlign = f32Bit ? puBuf->Nt32.OptionalHeader.SectionAlignment : puBuf->Nt64.OptionalHeader.SectionAlignment;
572 PCIMAGE_SECTION_HEADER pSHdrs = (PCIMAGE_SECTION_HEADER)((uintptr_t)&puBuf->Nt32.OptionalHeader + cbOptHdr);
573 PCIMAGE_DATA_DIRECTORY paDataDir = (PCIMAGE_DATA_DIRECTORY)((uintptr_t)pSHdrs - cDataDir * sizeof(IMAGE_DATA_DIRECTORY));
574
575 /*
576 * Establish the image size.
577 */
578 uint32_t cbImageFromHdr = f32Bit ? puBuf->Nt32.OptionalHeader.SizeOfImage : puBuf->Nt64.OptionalHeader.SizeOfImage;
579 if ( !cbImage
580 || (fFlags & DBGFMODINMEM_F_PE_NT31))
581 cbImage = RT_ALIGN(cbImageFromHdr, _4K);
582 else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
583 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_MISMATCH, "Image size mismatch: input=%#x header=%#x", cbImage, cbImageFromHdr);
584
585 /*
586 * Guess the module name if not specified and make sure it conforms to DBGC expectations.
587 */
588 if (!pszName)
589 {
590 if (pszFilename)
591 pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
592 /** @todo */
593 }
594
595 char szNormalized[128];
596 pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
597
598 /*
599 * Create the module using the in memory image first, falling back on cached image.
600 */
601 RTLDRMOD hLdrMod;
602 rc = dbgfR3ModInMemPeCreateLdrMod(pUVM, fFlags, pszName, pImageAddr, cbImage, cbImageFromHdr, f32Bit,
603 puBuf->Nt32.FileHeader.NumberOfSections, pSHdrs, cbSectAlign, cDataDir, paDataDir,
604 offPeHdrs, &hLdrMod, pErrInfo);
605 if (RT_FAILURE(rc))
606 hLdrMod = NIL_RTLDRMOD;
607
608 RTDBGMOD hMod;
609 rc = RTDbgModCreateFromPeImage(&hMod, pszFilename, pszName, &hLdrMod, cbImageFromHdr,
610 puBuf->Nt32.FileHeader.TimeDateStamp, DBGFR3AsGetConfig(pUVM));
611 if (RT_SUCCESS(rc))
612 *phDbgMod = hMod;
613 else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
614 {
615 /*
616 * Fallback is a container module.
617 */
618 rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
619 if (RT_SUCCESS(rc))
620 {
621 rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /*iSeg*/, 0, cbImage, 0 /*fFlags*/, NULL);
622 AssertRC(rc);
623 }
624 }
625 return rc;
626}
627
628
629
630/**
631 * Process a PE image found in guest memory.
632 *
633 * @param pUVM The user mode VM handle.
634 * @param pImageAddr The image address.
635 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
636 * @param pszName The module name, optional.
637 * @param pszFilename The image filename, optional.
638 * @param enmArch The image arch if we force it, pass
639 * RTLDRARCH_WHATEVER if you don't care.
640 * @param cbImage Image size. Pass 0 if not known.
641 * @param phDbgMod Where to return the resulting debug module on success.
642 * @param pErrInfo Where to return extended error info on failure.
643 */
644VMMR3DECL(int) DBGFR3ModInMem(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
645 RTLDRARCH enmArch, uint32_t cbImage, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
646{
647 /*
648 * Validate and adjust.
649 */
650 AssertPtrReturn(phDbgMod, VERR_INVALID_POINTER);
651 *phDbgMod = NIL_RTDBGMOD;
652 AssertPtrReturn(pImageAddr, VERR_INVALID_POINTER);
653 AssertMsgReturn(cbImage == 0 || cbImage >= sizeof(IMAGE_NT_HEADERS32) + sizeof(IMAGE_DOS_HEADER),
654 ("cbImage=%#x\n", cbImage), VERR_INVALID_PARAMETER);
655 AssertMsgReturn(!(fFlags & ~DBGFMODINMEM_F_VALID_MASK), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
656 if (enmArch == RTLDRARCH_HOST)
657 enmArch = RTLdrGetHostArch();
658
659 /*
660 * Look for an image header we can work with.
661 */
662 DBGFMODINMEMBUF uBuf;
663 RT_ZERO(uBuf);
664
665 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, pImageAddr, &uBuf, sizeof(uBuf.DosHdr));
666 if (RT_FAILURE(rc))
667 return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read DOS header at %RGv: %Rrc", pImageAddr->FlatPtr, rc);
668
669 if (uBuf.ab[0] == ELFMAG0 && uBuf.ab[1] == ELFMAG1 && uBuf.ab[2] == ELFMAG2 && uBuf.ab[3] == ELFMAG3)
670 return dbgfR3ModInMemElf(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
671
672 uint32_t offNewHdrs;
673 if (uBuf.DosHdr.e_magic == IMAGE_DOS_SIGNATURE)
674 {
675 offNewHdrs = uBuf.DosHdr.e_lfanew;
676 if ( offNewHdrs < 16
677 || offNewHdrs > (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)))
678 return RTERRINFO_LOG_SET_F(pErrInfo, rc, "e_lfanew value is out of range: %RX32 (16..%u)",
679 offNewHdrs, (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)));
680 }
681 else if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
682 offNewHdrs = 0;
683 else
684 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Unknown image magic at %RGv: %.8Rhxs",
685 pImageAddr->FlatPtr, uBuf.ab);
686
687 /*
688 * Read the next bit of header, assuming PE so stop at the end of
689 * the COFF file header.
690 */
691 DBGFADDRESS PeHdrAddr = *pImageAddr;
692 DBGFR3AddrAdd(&PeHdrAddr, offNewHdrs);
693 uint32_t const cbPeHdrsPart1 = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader);
694 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &PeHdrAddr, &uBuf, cbPeHdrsPart1);
695 if (RT_FAILURE(rc))
696 return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read PE/LX/NE headers at %RGv (off=%#RX32): %Rrc",
697 PeHdrAddr.FlatPtr, offNewHdrs, rc);
698
699 if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
700 return dbgfR3ModInMemPe(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, offNewHdrs, cbPeHdrsPart1,
701 &uBuf, phDbgMod, pErrInfo);
702
703 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "No PE/LX/NE header at %RGv (off=%#RX32): %.8Rhxs",
704 PeHdrAddr.FlatPtr, offNewHdrs, uBuf.ab);
705}
706
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use