VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3ModInMem.cpp@ 84044

Last change on this file since 84044 was 83085, checked in by vboxsync, 4 years ago

IPRT,VMM,DBGPlugInDarwin: Implemented in-memory guest kernel and kext image loading for OS X / Mach-O. Requires LINKEDIT to not be jettisoned to work.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 44.2 KB
Line 
1/* $Id: DBGFR3ModInMem.cpp 83085 2020-02-15 21:19:54Z vboxsync $ */
2/** @file
3 * DBGFR3ModInMemPe - In memory PE module 'loader'.
4 */
5
6/*
7 * Copyright (C) 2009-2020 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_DBGF
23#include <VBox/vmm/dbgf.h>
24
25#include <VBox/err.h>
26#include <iprt/ctype.h>
27#include <iprt/ldr.h>
28#include <iprt/mem.h>
29#include <iprt/path.h>
30#include <iprt/string.h>
31#include <iprt/sort.h>
32#include <iprt/formats/pecoff.h>
33#include <iprt/formats/mz.h>
34#include <iprt/formats/elf.h>
35#include <iprt/formats/mach-o.h>
36
37
38/*********************************************************************************************************************************
39* Structures and Typedefs *
40*********************************************************************************************************************************/
41/** Entry for mapping file offset to memory location. */
42typedef struct DBGFMODINMEMMAPPING
43{
44 /** The file offset. */
45 uint32_t offFile;
46 /** The file size of this mapping. */
47 uint32_t cbFile;
48 /** The size of this mapping. */
49 uint32_t cbMem;
50 /** The offset to the memory from the start of the image.
51 * @note This can be negative (for mach_kernel). */
52 int32_t offMem;
53} DBGFMODINMEMMAPPING;
54typedef DBGFMODINMEMMAPPING *PDBGFMODINMEMMAPPING;
55typedef DBGFMODINMEMMAPPING const *PCDBGFMODINMEMMAPPING;
56
57/**
58 * Common in-memory reader instance data.
59 */
60typedef struct DBGFMODINMEMRDR
61{
62 /** The VM handle (referenced). */
63 PUVM pUVM;
64 /** The image base. */
65 DBGFADDRESS ImageAddr;
66 /** The file size, based on the offFile and cbFile of the last mapping. */
67 uint32_t cbFile;
68 /** Number of entries in the aMappings table. */
69 uint32_t cMappings;
70 /** Mapping hint. */
71 uint32_t iHint;
72 /** Mapping file offset to memory offsets, ordered by file offset. */
73 DBGFMODINMEMMAPPING aMappings[RT_FLEXIBLE_ARRAY_NESTED];
74} DBGFMODINMEMRDR;
75/** Pointer to the common instance data for an in-memory file reader. */
76typedef DBGFMODINMEMRDR *PDBGFMODINMEMRDR;
77
78/**
79 * The WinNT digger's loader reader instance data.
80 */
81typedef struct DBGFMODPERDR
82{
83 /** The VM handle (referenced). */
84 PUVM pUVM;
85 /** The image base. */
86 DBGFADDRESS ImageAddr;
87 /** The image size. */
88 uint32_t cbImage;
89 /** The file offset of the SizeOfImage field in the optional header if it
90 * needs patching, otherwise set to UINT32_MAX. */
91 uint32_t offSizeOfImage;
92 /** The correct image size. */
93 uint32_t cbCorrectImageSize;
94 /** Number of entries in the aMappings table. */
95 uint32_t cMappings;
96 /** Mapping hint. */
97 uint32_t iHint;
98 /** Mapping file offset to memory offsets, ordered by file offset. */
99 struct
100 {
101 /** The file offset. */
102 uint32_t offFile;
103 /** The size of this mapping. */
104 uint32_t cbMem;
105 /** The offset to the memory from the start of the image. */
106 uint32_t offMem;
107 } aMappings[1];
108} DBGFMODPERDR;
109/** Pointer a WinNT loader reader instance data. */
110typedef DBGFMODPERDR *PDBGFMODPERDR;
111
112/**
113 * Stack buffer.
114 */
115typedef union DBGFMODINMEMBUF
116{
117 uint8_t ab[0x2000];
118 IMAGE_DOS_HEADER DosHdr;
119 IMAGE_NT_HEADERS32 Nt32;
120 IMAGE_NT_HEADERS64 Nt64;
121 mach_header_64 MachoHdr;
122 DBGFMODINMEMMAPPING aMappings[0x2000 / sizeof(DBGFMODINMEMMAPPING)];
123} DBGFMODINMEMBUF;
124/** Pointer to stack buffer. */
125typedef DBGFMODINMEMBUF *PDBGFMODINMEMBUF;
126
127
128
129/**
130 * Normalizes a debug module name.
131 *
132 * @returns Normalized debug module name.
133 * @param pszName The name.
134 * @param pszBuf Buffer to use if work is needed.
135 * @param cbBuf Size of buffer.
136 */
137const char *dbgfR3ModNormalizeName(const char *pszName, char *pszBuf, size_t cbBuf)
138{
139 /*
140 * Skip to the filename in case someone gave us a full filename path.
141 */
142 pszName = RTPathFilenameEx(pszName, RTPATH_STR_F_STYLE_DOS);
143
144 /*
145 * Is it okay?
146 */
147 size_t cchName = strlen(pszName);
148 size_t off = 0;
149 for (;; off++)
150 {
151 char ch = pszName[off];
152 if (ch == '\0')
153 return pszName;
154 if (!RT_C_IS_ALNUM(ch) && ch != '_')
155 break;
156 }
157
158 /*
159 * It's no okay, so morph it.
160 */
161 if (cchName >= cbBuf)
162 cchName = cbBuf - 1;
163 for (off = 0; off < cchName; off++)
164 {
165 char ch = pszName[off];
166 if (!RT_C_IS_ALNUM(ch))
167 ch = '_';
168 pszBuf[off] = ch;
169 }
170 pszBuf[off] = '\0';
171
172 return pszBuf;
173}
174
175
176/**
177 * @callback_method_impl{PFNRTLDRRDRMEMREAD}
178 */
179static DECLCALLBACK(int) dbgfModInMemCommon_Read(void *pvBuf, size_t cb, size_t off, void *pvUser)
180{
181 PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
182 uint32_t offFile = (uint32_t)off;
183 AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
184
185 /*
186 * Set i to a mapping that starts at or before the specified offset.
187 * ASSUMING aMappings are sorted by offFile.
188 */
189 uint32_t i = pThis->iHint;
190 if (pThis->aMappings[i].offFile > offFile)
191 {
192 i = pThis->cMappings; /** @todo doesn't need to start from the end here... */
193 while (i-- > 0)
194 if (offFile >= pThis->aMappings[i].offFile)
195 break;
196 pThis->iHint = i;
197 }
198
199 while (cb > 0)
200 {
201 uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile
202 : pThis->aMappings[i].offFile + RT_MAX(pThis->aMappings[i].cbFile, pThis->aMappings[i].cbMem);
203 uint32_t offMap = offFile - pThis->aMappings[i].offFile;
204
205 /* Read file bits backed by memory. */
206 if (offMap < pThis->aMappings[i].cbMem)
207 {
208 uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
209 if (cbToRead > cb)
210 cbToRead = (uint32_t)cb;
211
212 DBGFADDRESS Addr = pThis->ImageAddr;
213 DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
214
215 int rc = DBGFR3MemRead(pThis->pUVM, 0 /*idCpu*/, &Addr, pvBuf, cbToRead);
216 if (RT_FAILURE(rc))
217 return rc;
218
219 /* Done? */
220 if (cbToRead == cb)
221 break;
222
223 offFile += cbToRead;
224 cb -= cbToRead;
225 pvBuf = (char *)pvBuf + cbToRead;
226 }
227
228 /* Mind the gap. */
229 if (offNextMap > offFile)
230 {
231 uint32_t cbZero = offNextMap - offFile;
232 if (cbZero > cb)
233 {
234 RT_BZERO(pvBuf, cb);
235 break;
236 }
237
238 RT_BZERO(pvBuf, cbZero);
239 offFile += cbZero;
240 cb -= cbZero;
241 pvBuf = (char *)pvBuf + cbZero;
242 }
243
244 pThis->iHint = ++i;
245 }
246
247 return VINF_SUCCESS;
248}
249
250
251/**
252 * @callback_method_impl{PFNRTLDRRDRMEMDTOR}
253 */
254static DECLCALLBACK(void) dbgfModInMemCommon_Dtor(void *pvUser, size_t cbImage)
255{
256 PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
257 RT_NOREF(cbImage);
258
259 VMR3ReleaseUVM(pThis->pUVM);
260 pThis->pUVM = NULL;
261
262 RTMemFree(pThis);
263}
264
265
266/**
267 * @callback_method_impl{FNRTSORTCMP}
268 */
269static DECLCALLBACK(int) dbgfModInMemCompMappings(void const *pvElement1, void const *pvElement2, void *pvUser)
270{
271 RT_NOREF(pvUser);
272 PCDBGFMODINMEMMAPPING pElement1 = (PCDBGFMODINMEMMAPPING)pvElement1;
273 PCDBGFMODINMEMMAPPING pElement2 = (PCDBGFMODINMEMMAPPING)pvElement2;
274 if (pElement1->offFile < pElement2->offFile)
275 return -1;
276 if (pElement1->offFile > pElement2->offFile)
277 return 1;
278 if (pElement1->cbFile < pElement2->cbFile)
279 return -1;
280 if (pElement1->cbFile > pElement2->cbFile)
281 return 1;
282 if (pElement1->offMem < pElement2->offMem)
283 return -1;
284 if (pElement1->offMem > pElement2->offMem)
285 return 1;
286 if (pElement1->cbMem < pElement2->cbMem)
287 return -1;
288 if (pElement1->cbMem > pElement2->cbMem)
289 return 1;
290 return 0;
291}
292
293
294static int dbgfModInMemCommon_Init(PDBGFMODINMEMRDR pThis, PUVM pUVM, PCDBGFADDRESS pImageAddr,PCDBGFMODINMEMMAPPING paMappings,
295 uint32_t cMappings, const char *pszName, RTLDRARCH enmArch,
296 PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
297{
298 /*
299 * Initialize the reader instance.
300 */
301 VMR3RetainUVM(pUVM);
302 pThis->pUVM = pUVM;
303 pThis->ImageAddr = *pImageAddr;
304 pThis->cMappings = cMappings;
305 pThis->iHint = 0;
306 memcpy(pThis->aMappings, paMappings, cMappings * sizeof(pThis->aMappings[0]));
307 RTSortShell(pThis->aMappings, cMappings, sizeof(pThis->aMappings[0]), dbgfModInMemCompMappings, NULL);
308 pThis->cbFile = pThis->aMappings[cMappings - 1].offFile + pThis->aMappings[cMappings - 1].cbFile;
309
310 /*
311 * Call the loader to open it.
312 * Note! destructore is always called.
313 */
314
315 RTLDRMOD hLdrMod;
316 int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, enmArch, pThis->cbFile,
317 dbgfModInMemCommon_Read, dbgfModInMemCommon_Dtor, pThis,
318 &hLdrMod, pErrInfo);
319 if (RT_SUCCESS(rc))
320 *phLdrMod = hLdrMod;
321 else
322 *phLdrMod = NIL_RTLDRMOD;
323 return rc;
324}
325
326
327/**
328 * Handles in-memory ELF images.
329 *
330 * @returns VBox status code.
331 * @param pUVM The user mode VM handle.
332 * @param pImageAddr The image address.
333 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
334 * @param pszName The module name, optional.
335 * @param pszFilename The image filename, optional.
336 * @param enmArch The image arch if we force it, pass
337 * RTLDRARCH_WHATEVER if you don't care.
338 * @param cbImage Image size. Pass 0 if not known.
339 * @param puBuf The header buffer.
340 * @param phDbgMod Where to return the resulting debug module on success.
341 * @param pErrInfo Where to return extended error info on failure.
342 */
343static int dbgfR3ModInMemElf(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
344 RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
345 PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
346{
347 RT_NOREF(pUVM, fFlags, pszName, pszFilename, enmArch, cbImage, puBuf, phDbgMod);
348 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Found ELF magic at %RGv", pImageAddr->FlatPtr);
349}
350
351
352/**
353 * Handles in-memory Mach-O images.
354 *
355 * @returns VBox status code.
356 * @param pUVM The user mode VM handle.
357 * @param pImageAddr The image address.
358 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
359 * @param pszName The module name, optional.
360 * @param pszFilename The image filename, optional.
361 * @param enmArch The image arch if we force it, pass
362 * RTLDRARCH_WHATEVER if you don't care.
363 * @param cbImage Image size. Pass 0 if not known.
364 * @param puBuf The header buffer.
365 * @param phDbgMod Where to return the resulting debug module on success.
366 * @param pErrInfo Where to return extended error info on failure.
367 */
368static int dbgfR3ModInMemMachO(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
369 RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
370 PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
371{
372 RT_NOREF(cbImage, fFlags);
373
374 /*
375 * Match up enmArch.
376 */
377 if (enmArch == RTLDRARCH_AMD64)
378 {
379 if (puBuf->MachoHdr.magic != IMAGE_MACHO64_SIGNATURE)
380 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but header is not 64-bit");
381 if (puBuf->MachoHdr.cputype != CPU_TYPE_X86_64)
382 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but cpu type is %#x instead of %#x",
383 puBuf->MachoHdr.cputype, CPU_TYPE_X86_64);
384 }
385 else if (enmArch == RTLDRARCH_X86_32)
386 {
387 if (puBuf->MachoHdr.magic != IMAGE_MACHO32_SIGNATURE)
388 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but header is not 32-bit");
389 if (puBuf->MachoHdr.cputype != CPU_TYPE_X86)
390 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but cpu type is %#x instead of %#x",
391 puBuf->MachoHdr.cputype, CPU_TYPE_X86);
392 }
393 else if (enmArch != RTLDRARCH_WHATEVER)
394 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unsupported enmArch value %s (%d)",
395 RTLdrArchName(enmArch), enmArch);
396
397 /*
398 * Guess the module name if not specified and make sure it conforms to DBGC expectations.
399 */
400 char szNormalized[128];
401 if (!pszName)
402 {
403 if (pszFilename)
404 pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS /*whatever*/);
405 if (!pszName)
406 {
407 RTStrPrintf(szNormalized, sizeof(szNormalized), "image_%#llx", (uint64_t)pImageAddr->FlatPtr);
408 pszName = szNormalized;
409 }
410 }
411 if (pszName != szNormalized)
412 pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
413
414 /*
415 * Read the load commands into memory, they follow the header. Refuse
416 * if there appear to be too many or too much of these.
417 */
418 uint32_t const cLoadCmds = puBuf->MachoHdr.ncmds;
419 uint32_t const cbLoadCmds = puBuf->MachoHdr.sizeofcmds;
420 if (cLoadCmds > _8K || cLoadCmds < 2)
421 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
422 "ncmds=%u is out of sensible range (2..8192)", cLoadCmds);
423 if (cbLoadCmds > _2M || cbLoadCmds < sizeof(load_command_t) * 2)
424 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
425 "cbLoadCmds=%#x is out of sensible range (8..2MiB)", cbLoadCmds);
426
427 uint8_t *pbLoadCmds = (uint8_t *)RTMemTmpAllocZ(cbLoadCmds);
428 AssertReturn(pbLoadCmds, VERR_NO_TMP_MEMORY);
429
430 uint32_t const cbHdr = puBuf->MachoHdr.magic == IMAGE_MACHO64_SIGNATURE ? sizeof(mach_header_64) : sizeof(mach_header_32);
431 DBGFADDRESS Addr = *pImageAddr;
432 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrAdd(&Addr, cbHdr), pbLoadCmds, cbLoadCmds);
433 if (RT_SUCCESS(rc))
434 {
435 /*
436 * Scan it for segments so we can tranlate file offsets to virtual
437 * memory locations.
438 */
439 RTUUID Uuid = RTUUID_INITIALIZE_NULL;
440 uint32_t cMappings = 0;
441 uint32_t offCmd = 0;
442 for (uint32_t iCmd = 0; iCmd < cLoadCmds; iCmd++)
443 {
444 load_command_t const *pCurCmd = (load_command_t const *)&pbLoadCmds[offCmd];
445 uint32_t const cbCurCmd = offCmd + sizeof(*pCurCmd) <= cbLoadCmds ? pCurCmd->cmdsize : sizeof(*pCurCmd);
446 if (offCmd + cbCurCmd > cbLoadCmds)
447 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
448 "Load command #%u @ %#x is out of bounds: size %#x, left %#x", iCmd, offCmd, cbCurCmd,
449 cbLoadCmds - offCmd);
450 else if (pCurCmd->cmd == LC_SEGMENT_64)
451 {
452 segment_command_64 const *pSeg = (segment_command_64 const *)pCurCmd;
453 if (cbCurCmd >= sizeof(*pSeg))
454 {
455 if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
456 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
457 else
458 {
459 puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
460 puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
461 puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
462 puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
463 cMappings++;
464 }
465 }
466 else
467 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
468 "Load command #%u @ %#x is too small for a 64-bit segment: %#x", iCmd, offCmd, cbCurCmd);
469 }
470 else if (pCurCmd->cmd == LC_SEGMENT_32)
471 {
472 segment_command_32 const *pSeg = (segment_command_32 const *)pCurCmd;
473 if (cbCurCmd >= sizeof(*pSeg))
474 {
475 if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
476 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
477 else
478 {
479 puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
480 puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
481 puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
482 puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
483 cMappings++;
484 }
485 }
486 else
487 rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
488 "Load command #%u @ %#x is too small for a 32-bit segment: %#x", iCmd, offCmd, cbCurCmd);
489 }
490 else if (pCurCmd->cmd == LC_UUID && cbCurCmd == sizeof(uuid_command_t))
491 memcpy(&Uuid, ((uuid_command_t const *)pCurCmd)->uuid, sizeof(Uuid));
492
493 if (RT_SUCCESS(rc))
494 offCmd += cbCurCmd;
495 else
496 break;
497 } /* for each command */
498
499 if (RT_SUCCESS(rc))
500 {
501 /*
502 * Create generic loader module instance (pThis is tied to it
503 * come rain come shine).
504 */
505 PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)RTMemAllocZVar(RT_UOFFSETOF_DYN(DBGFMODINMEMRDR, aMappings[cMappings]));
506 if (pThis)
507 {
508 RTLDRMOD hLdrMod;
509 rc = dbgfModInMemCommon_Init(pThis, pUVM, pImageAddr, puBuf->aMappings, cMappings,
510 pszName, enmArch, &hLdrMod, pErrInfo);
511 if (RT_FAILURE(rc))
512 hLdrMod = NIL_RTLDRMOD;
513
514 RTDBGMOD hMod;
515 rc = RTDbgModCreateFromMachOImage(&hMod, pszFilename ? pszFilename : pszName, pszName, enmArch,
516 &hLdrMod, 0 /*cbImage*/, 0, NULL, &Uuid, DBGFR3AsGetConfig(pUVM), fFlags);
517 if (RT_SUCCESS(rc))
518 *phDbgMod = hMod;
519#if 0 /** @todo later */
520 else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
521 {
522 /*
523 * Fallback is a container module.
524 */
525 rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
526 if (RT_SUCCESS(rc))
527 {
528 rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /*iSeg*/, 0, cbImage, 0 /*fFlags*/, NULL);
529 AssertRC(rc);
530 }
531 }
532#endif
533 if (hLdrMod != NIL_RTLDRMOD)
534 RTLdrClose(hLdrMod);
535 }
536 else
537 rc = VERR_NO_MEMORY;
538 }
539 }
540 else
541 RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read %#x bytes of load commands", cbLoadCmds);
542 RTMemTmpFree(pbLoadCmds);
543 return rc;
544}
545
546
547/**
548 * @callback_method_impl{PFNRTLDRRDRMEMREAD}
549 */
550static DECLCALLBACK(int) dbgfModInMemPeRdr_Read(void *pvBuf, size_t cb, size_t off, void *pvUser)
551{
552 PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
553 uint32_t offFile = (uint32_t)off;
554 AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
555
556 uint32_t i = pThis->iHint;
557 if (pThis->aMappings[i].offFile > offFile)
558 {
559 i = pThis->cMappings;
560 while (i-- > 0)
561 if (offFile >= pThis->aMappings[i].offFile)
562 break;
563 pThis->iHint = i;
564 }
565
566 while (cb > 0)
567 {
568 uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
569 uint32_t offMap = offFile - pThis->aMappings[i].offFile;
570
571 /* Read file bits backed by memory. */
572 if (offMap < pThis->aMappings[i].cbMem)
573 {
574 uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
575 if (cbToRead > cb)
576 cbToRead = (uint32_t)cb;
577
578 DBGFADDRESS Addr = pThis->ImageAddr;
579 DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
580
581 int rc = DBGFR3MemRead(pThis->pUVM, 0 /*idCpu*/, &Addr, pvBuf, cbToRead);
582 if (RT_FAILURE(rc))
583 return rc;
584
585 /* Apply SizeOfImage patch? */
586 if ( pThis->offSizeOfImage != UINT32_MAX
587 && offFile < pThis->offSizeOfImage + 4
588 && offFile + cbToRead > pThis->offSizeOfImage)
589 {
590 uint32_t SizeOfImage = pThis->cbCorrectImageSize;
591 uint32_t cbPatch = sizeof(SizeOfImage);
592 int32_t offPatch = pThis->offSizeOfImage - offFile;
593 uint8_t *pbPatch = (uint8_t *)pvBuf + offPatch;
594 if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
595 cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
596 while (cbPatch-- > 0)
597 {
598 if (offPatch >= 0)
599 *pbPatch = (uint8_t)SizeOfImage;
600 offPatch++;
601 pbPatch++;
602 SizeOfImage >>= 8;
603 }
604 }
605
606 /* Done? */
607 if (cbToRead == cb)
608 break;
609
610 offFile += cbToRead;
611 cb -= cbToRead;
612 pvBuf = (char *)pvBuf + cbToRead;
613 }
614
615 /* Mind the gap. */
616 if (offNextMap > offFile)
617 {
618 uint32_t cbZero = offNextMap - offFile;
619 if (cbZero > cb)
620 {
621 RT_BZERO(pvBuf, cb);
622 break;
623 }
624
625 RT_BZERO(pvBuf, cbZero);
626 offFile += cbZero;
627 cb -= cbZero;
628 pvBuf = (char *)pvBuf + cbZero;
629 }
630
631 pThis->iHint = ++i;
632 }
633
634 return VINF_SUCCESS;
635}
636
637
638/**
639 * @callback_method_impl{PFNRTLDRRDRMEMDTOR}
640 */
641static DECLCALLBACK(void) dbgfModInMemPeRdr_Dtor(void *pvUser, size_t cbImage)
642{
643 PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
644 RT_NOREF(cbImage);
645
646 VMR3ReleaseUVM(pThis->pUVM);
647 pThis->pUVM = NULL;
648 RTMemFree(pvUser);
649}
650
651
652/**
653 * Checks if the section headers look okay.
654 *
655 * @returns VBox status code.
656 * @param paShdrs Pointer to the section headers.
657 * @param cShdrs Number of headers.
658 * @param cbImage The image size reported by NT.
659 * @param cbImageFromHdr The image size by the linker in the header.
660 * @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
661 * no resource directory.
662 * @param cbSectAlign The section alignment specified in the header.
663 * @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
664 * @param pcbImageCorrect The corrected image size. This is derived from
665 * cbImage and virtual range of the section tables.
666 *
667 * The problem is that NT may choose to drop the
668 * last pages in images it loads early, starting at
669 * the resource directory. These images will have
670 * a page aligned cbImage.
671 *
672 * @param pErrInfo Where to return more error details.
673 */
674static int dbgfR3ModPeCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShdrs, uint32_t cShdrs, uint32_t cbImage,
675 uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
676 bool fNt31, uint32_t *pcbImageCorrect, PRTERRINFO pErrInfo)
677{
678 *pcbImageCorrect = cbImage;
679
680 for (uint32_t i = 0; i < cShdrs; i++)
681 {
682 if (!paShdrs[i].Name[0])
683 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Section header #%u has no name", i);
684
685 if (paShdrs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
686 continue;
687
688 /* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
689 /** @todo this isn't really perfect. cbImage is kind of wrong... */
690 uint32_t cbVirtual = paShdrs[i].Misc.VirtualSize;
691 if (cbVirtual == 0)
692 {
693 for (uint32_t j = i + 1; j < cShdrs; j++)
694 if ( !(paShdrs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
695 && paShdrs[j].VirtualAddress > paShdrs[i].VirtualAddress)
696 {
697 cbVirtual = paShdrs[j].VirtualAddress - paShdrs[i].VirtualAddress;
698 break;
699 }
700 if (!cbVirtual)
701 {
702 if (paShdrs[i].VirtualAddress < cbImageFromHdr)
703 cbVirtual = cbImageFromHdr - paShdrs[i].VirtualAddress;
704 else if (paShdrs[i].SizeOfRawData > 0)
705 cbVirtual = RT_ALIGN(paShdrs[i].SizeOfRawData, _4K);
706 }
707 }
708
709 /* Check that sizes are within the same range and that both sizes and
710 addresses are within reasonable limits. */
711 if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShdrs[i].SizeOfRawData, _64K)
712 || cbVirtual >= _1G
713 || paShdrs[i].SizeOfRawData >= _1G)
714 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
715 "Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!",
716 i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].SizeOfRawData);
717 uint32_t uRvaEnd = paShdrs[i].VirtualAddress + cbVirtual;
718 if (uRvaEnd >= _1G || uRvaEnd < paShdrs[i].VirtualAddress)
719 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
720 "Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!",
721 i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].VirtualAddress, uRvaEnd);
722
723 /* Check for images chopped off around '.rsrc'. */
724 if ( cbImage < uRvaEnd
725 && uRvaEnd >= uRvaRsrc)
726 cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
727
728 /* Check that the section is within the image. */
729 if (uRvaEnd > cbImage && fNt31)
730 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
731 "Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x",
732 i, paShdrs[i].VirtualAddress, uRvaEnd, cbImage);
733 }
734
735 Assert(*pcbImageCorrect == cbImage || !(*pcbImageCorrect & 0xfff));
736 *pcbImageCorrect = cbImage;
737 return VINF_SUCCESS;
738}
739
740
741/**
742 * Create a loader module for the in-guest-memory PE module.
743 */
744static int dbgfR3ModInMemPeCreateLdrMod(PUVM pUVM, uint32_t fFlags, const char *pszName, PCDBGFADDRESS pImageAddr,
745 uint32_t cbImage, uint32_t cbImageFromHdr, bool f32Bit,
746 uint32_t cShdrs, PCIMAGE_SECTION_HEADER paShdrs, uint32_t cbSectAlign,
747 uint32_t cDataDir, PCIMAGE_DATA_DIRECTORY paDataDir, uint32_t offHdrs,
748 PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
749{
750 /*
751 * Allocate and create a reader instance.
752 */
753 PDBGFMODPERDR pRdr = (PDBGFMODPERDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGFMODPERDR, aMappings[cShdrs + 2]));
754 if (!pRdr)
755 return VERR_NO_MEMORY;
756
757 VMR3RetainUVM(pUVM);
758 pRdr->pUVM = pUVM;
759 pRdr->ImageAddr = *pImageAddr;
760 pRdr->cbImage = cbImage;
761 pRdr->cbCorrectImageSize = cbImage;
762 pRdr->offSizeOfImage = UINT32_MAX;
763 pRdr->iHint = 0;
764
765 /*
766 * Use the section table to construct a more accurate view of the file/image.
767 */
768 uint32_t uRvaRsrc = UINT32_MAX;
769 if ( cDataDir > IMAGE_DIRECTORY_ENTRY_RESOURCE
770 && paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size > 0)
771 uRvaRsrc = paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
772
773 int rc = dbgfR3ModPeCheckSectHdrsAndImgSize(paShdrs, cShdrs, cbImage, cbImageFromHdr, uRvaRsrc, cbSectAlign,
774 RT_BOOL(fFlags & DBGFMODINMEM_F_PE_NT31), &pRdr->cbCorrectImageSize, pErrInfo);
775 if (RT_SUCCESS(rc))
776 {
777 pRdr->cMappings = 0;
778
779 for (uint32_t i = 0; i < cShdrs; i++)
780 if ( paShdrs[i].SizeOfRawData > 0
781 && paShdrs[i].PointerToRawData > 0)
782 {
783 uint32_t j = 1;
784 if (!pRdr->cMappings)
785 pRdr->cMappings++;
786 else
787 {
788 while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShdrs[i].PointerToRawData)
789 j++;
790 if (j < pRdr->cMappings)
791 memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
792 }
793 pRdr->aMappings[j].offFile = paShdrs[i].PointerToRawData;
794 pRdr->aMappings[j].offMem = paShdrs[i].VirtualAddress;
795 pRdr->aMappings[j].cbMem = i + 1 < cShdrs
796 ? paShdrs[i + 1].VirtualAddress - paShdrs[i].VirtualAddress
797 : paShdrs[i].Misc.VirtualSize;
798 if (j == pRdr->cMappings)
799 pRdr->cbImage = paShdrs[i].PointerToRawData + paShdrs[i].SizeOfRawData;
800 pRdr->cMappings++;
801 }
802
803 /* Insert the mapping of the headers that isn't covered by the section table. */
804 pRdr->aMappings[0].offFile = 0;
805 pRdr->aMappings[0].offMem = 0;
806 pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
807
808 int j = pRdr->cMappings - 1;
809 while (j-- > 0)
810 {
811 uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
812 if (pRdr->aMappings[j].cbMem > cbFile)
813 pRdr->aMappings[j].cbMem = cbFile;
814 }
815 }
816 else if (fFlags & DBGFMODINMEM_F_NO_READER_FALLBACK)
817 return rc;
818 else
819 {
820 /*
821 * Fallback, fake identity mapped file data.
822 */
823 pRdr->cMappings = 1;
824 pRdr->aMappings[0].offFile = 0;
825 pRdr->aMappings[0].offMem = 0;
826 pRdr->aMappings[0].cbMem = pRdr->cbImage;
827 }
828
829 /* Enable the SizeOfImage patching if necessary. */
830 if (pRdr->cbCorrectImageSize != cbImage)
831 {
832 Log(("dbgfR3ModInMemPeCreateLdrMod: The image is really %#x bytes long, not %#x as mapped by NT!\n",
833 pRdr->cbCorrectImageSize, cbImage));
834 pRdr->offSizeOfImage = f32Bit
835 ? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
836 : offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
837 }
838
839 /*
840 * Call the loader to open the PE image for debugging.
841 * Note! It always calls pfnDtor.
842 */
843 RTLDRMOD hLdrMod;
844 rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
845 dbgfModInMemPeRdr_Read, dbgfModInMemPeRdr_Dtor, pRdr,
846 &hLdrMod, pErrInfo);
847 if (RT_SUCCESS(rc))
848 *phLdrMod = hLdrMod;
849 else
850 *phLdrMod = NIL_RTLDRMOD;
851 return rc;
852}
853
854
855/**
856 * Handles in-memory PE images.
857 *
858 * @returns VBox status code.
859 * @param pUVM The user mode VM handle.
860 * @param pImageAddr The image address.
861 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
862 * @param pszName The module name, optional.
863 * @param pszFilename The image filename, optional.
864 * @param enmArch The image arch if we force it, pass
865 * RTLDRARCH_WHATEVER if you don't care.
866 * @param cbImage Image size. Pass 0 if not known.
867 * @param offPeHdrs Offset of the PE header.
868 * @param cbPeHdrsPart1 How read into uBuf at @a offPeHdrs.
869 * @param puBuf The header buffer.
870 * @param phDbgMod Where to return the resulting debug module on success.
871 * @param pErrInfo Where to return extended error info on failure.
872 */
873static int dbgfR3ModInMemPe(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
874 RTLDRARCH enmArch, uint32_t cbImage, uint32_t offPeHdrs, uint32_t cbPeHdrsPart1,
875 PDBGFMODINMEMBUF puBuf, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
876{
877 /*
878 * Read the optional header and the section table after validating the
879 * info we need from the file header.
880 */
881 /* Check the opt hdr size and number of sections as these are used to determine how much to read next. */
882 if ( puBuf->Nt32.FileHeader.SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER32)
883 || puBuf->Nt32.FileHeader.SizeOfOptionalHeader > sizeof(IMAGE_OPTIONAL_HEADER64) + 128)
884 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Invalid SizeOfOptionalHeader value: %#RX32",
885 puBuf->Nt32.FileHeader.SizeOfOptionalHeader);
886
887 if ( puBuf->Nt32.FileHeader.NumberOfSections < 1
888 || puBuf->Nt32.FileHeader.NumberOfSections > 190 /* what fits in our 8K buffer */)
889 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "NumberOfSections is out of range: %#RX32 (1..190)",
890 puBuf->Nt32.FileHeader.NumberOfSections);
891
892 /* Read the optional header and section table. */
893 uint32_t const cbHdrs = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
894 + puBuf->Nt32.FileHeader.SizeOfOptionalHeader
895 + puBuf->Nt32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
896 AssertReturn(cbHdrs <= sizeof(*puBuf), RTERRINFO_LOG_SET_F(pErrInfo, VERR_INTERNAL_ERROR_2, "cbHdrs=%#x", cbHdrs));
897
898 DBGFADDRESS PeHdrPart2Addr = *pImageAddr;
899 DBGFR3AddrAdd(&PeHdrPart2Addr, offPeHdrs + cbPeHdrsPart1);
900 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &PeHdrPart2Addr, &puBuf->ab[cbPeHdrsPart1], cbHdrs - cbPeHdrsPart1);
901 if (RT_FAILURE(rc))
902 return RTERRINFO_LOG_SET_F(pErrInfo, rc,
903 "Failed to read the second part of the PE headers at %RGv (off=%#RX32 + %#RX32): %Rrc",
904 PeHdrPart2Addr.FlatPtr, offPeHdrs, cbPeHdrsPart1, rc);
905
906 /*
907 * Check the image architecture and determine the bitness.
908 */
909 RTLDRARCH enmArchActual;
910 bool f32Bit;
911 switch (puBuf->Nt32.FileHeader.Machine)
912 {
913 case IMAGE_FILE_MACHINE_I386:
914 enmArchActual = RTLDRARCH_X86_32;
915 f32Bit = true;
916 break;
917 case IMAGE_FILE_MACHINE_AMD64:
918 enmArchActual = RTLDRARCH_AMD64;
919 f32Bit = false;
920 break;
921 case IMAGE_FILE_MACHINE_ARM:
922 case IMAGE_FILE_MACHINE_THUMB:
923 case IMAGE_FILE_MACHINE_ARMNT:
924 enmArchActual = RTLDRARCH_ARM32;
925 f32Bit = true;
926 break;
927 case IMAGE_FILE_MACHINE_ARM64:
928 enmArchActual = RTLDRARCH_ARM64;
929 f32Bit = false;
930 break;
931 default:
932 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unknown machine: %#x", puBuf->Nt32.FileHeader.Machine);
933 }
934 if ( enmArch != RTLDRARCH_WHATEVER
935 && enmArch != enmArchActual)
936 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Found %s expected %s",
937 RTLdrArchName(enmArchActual), RTLdrArchName(enmArch));
938
939 /*
940 * Check optional header magic and size.
941 */
942 uint16_t const uOptMagic = f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC;
943 if (puBuf->Nt32.OptionalHeader.Magic != uOptMagic)
944 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header magic: %#x (expected %#x)",
945 puBuf->Nt32.OptionalHeader.Magic, uOptMagic);
946
947 uint32_t const cDataDir = f32Bit ? puBuf->Nt32.OptionalHeader.NumberOfRvaAndSizes : puBuf->Nt64.OptionalHeader.NumberOfRvaAndSizes;
948 if ( cDataDir <= IMAGE_DIRECTORY_ENTRY_BASERELOC /* a bit random */
949 || cDataDir > 32 /* also random */)
950 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected data directory size: %#x", cDataDir);
951
952 uint32_t cbOptHdr = f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64);
953 cbOptHdr -= sizeof(IMAGE_DATA_DIRECTORY) * IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
954 cbOptHdr += sizeof(IMAGE_DATA_DIRECTORY) * cDataDir;
955 if (puBuf->Nt32.FileHeader.SizeOfOptionalHeader != cbOptHdr)
956 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header size: %#x (expected %#x)",
957 puBuf->Nt32.FileHeader.SizeOfOptionalHeader, cbOptHdr);
958
959 uint32_t const cbSectAlign = f32Bit ? puBuf->Nt32.OptionalHeader.SectionAlignment : puBuf->Nt64.OptionalHeader.SectionAlignment;
960 PCIMAGE_SECTION_HEADER pSHdrs = (PCIMAGE_SECTION_HEADER)((uintptr_t)&puBuf->Nt32.OptionalHeader + cbOptHdr);
961 PCIMAGE_DATA_DIRECTORY paDataDir = (PCIMAGE_DATA_DIRECTORY)((uintptr_t)pSHdrs - cDataDir * sizeof(IMAGE_DATA_DIRECTORY));
962
963 /*
964 * Establish the image size.
965 */
966 uint32_t cbImageFromHdr = f32Bit ? puBuf->Nt32.OptionalHeader.SizeOfImage : puBuf->Nt64.OptionalHeader.SizeOfImage;
967 if ( !cbImage
968 || (fFlags & DBGFMODINMEM_F_PE_NT31))
969 cbImage = RT_ALIGN(cbImageFromHdr, _4K);
970 else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
971 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_MISMATCH, "Image size mismatch: input=%#x header=%#x", cbImage, cbImageFromHdr);
972
973 /*
974 * Guess the module name if not specified and make sure it conforms to DBGC expectations.
975 */
976 if (!pszName)
977 {
978 if (pszFilename)
979 pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
980 /** @todo */
981 }
982
983 char szNormalized[128];
984 pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
985
986 /*
987 * Create the module using the in memory image first, falling back on cached image.
988 */
989 RTLDRMOD hLdrMod;
990 rc = dbgfR3ModInMemPeCreateLdrMod(pUVM, fFlags, pszName, pImageAddr, cbImage, cbImageFromHdr, f32Bit,
991 puBuf->Nt32.FileHeader.NumberOfSections, pSHdrs, cbSectAlign, cDataDir, paDataDir,
992 offPeHdrs, &hLdrMod, pErrInfo);
993 if (RT_FAILURE(rc))
994 hLdrMod = NIL_RTLDRMOD;
995
996 RTDBGMOD hMod;
997 rc = RTDbgModCreateFromPeImage(&hMod, pszFilename, pszName, &hLdrMod, cbImageFromHdr,
998 puBuf->Nt32.FileHeader.TimeDateStamp, DBGFR3AsGetConfig(pUVM));
999 if (RT_SUCCESS(rc))
1000 *phDbgMod = hMod;
1001 else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
1002 {
1003 /*
1004 * Fallback is a container module.
1005 */
1006 rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
1007 if (RT_SUCCESS(rc))
1008 {
1009 rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /*iSeg*/, 0, cbImage, 0 /*fFlags*/, NULL);
1010 AssertRC(rc);
1011 }
1012 }
1013 return rc;
1014}
1015
1016
1017
1018/**
1019 * Process a PE image found in guest memory.
1020 *
1021 * @param pUVM The user mode VM handle.
1022 * @param pImageAddr The image address.
1023 * @param fFlags Flags, DBGFMODINMEM_F_XXX.
1024 * @param pszName The module name, optional.
1025 * @param pszFilename The image filename, optional.
1026 * @param enmArch The image arch if we force it, pass
1027 * RTLDRARCH_WHATEVER if you don't care.
1028 * @param cbImage Image size. Pass 0 if not known.
1029 * @param phDbgMod Where to return the resulting debug module on success.
1030 * @param pErrInfo Where to return extended error info on failure.
1031 */
1032VMMR3DECL(int) DBGFR3ModInMem(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, const char *pszFilename,
1033 RTLDRARCH enmArch, uint32_t cbImage, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
1034{
1035 /*
1036 * Validate and adjust.
1037 */
1038 AssertPtrReturn(phDbgMod, VERR_INVALID_POINTER);
1039 *phDbgMod = NIL_RTDBGMOD;
1040 AssertPtrReturn(pImageAddr, VERR_INVALID_POINTER);
1041 AssertMsgReturn(cbImage == 0 || cbImage >= sizeof(IMAGE_NT_HEADERS32) + sizeof(IMAGE_DOS_HEADER),
1042 ("cbImage=%#x\n", cbImage), VERR_INVALID_PARAMETER);
1043 AssertMsgReturn(!(fFlags & ~DBGFMODINMEM_F_VALID_MASK), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
1044 if (enmArch == RTLDRARCH_HOST)
1045 enmArch = RTLdrGetHostArch();
1046
1047 /*
1048 * Look for an image header we can work with.
1049 */
1050 DBGFMODINMEMBUF uBuf;
1051 RT_ZERO(uBuf);
1052
1053 int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, pImageAddr, &uBuf, sizeof(uBuf.DosHdr));
1054 if (RT_FAILURE(rc))
1055 return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read DOS header at %RGv: %Rrc", pImageAddr->FlatPtr, rc);
1056
1057 if (uBuf.ab[0] == ELFMAG0 && uBuf.ab[1] == ELFMAG1 && uBuf.ab[2] == ELFMAG2 && uBuf.ab[3] == ELFMAG3)
1058 return dbgfR3ModInMemElf(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
1059
1060 if ( uBuf.MachoHdr.magic == IMAGE_MACHO64_SIGNATURE
1061 || uBuf.MachoHdr.magic == IMAGE_MACHO32_SIGNATURE)
1062 return dbgfR3ModInMemMachO(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
1063
1064 uint32_t offNewHdrs;
1065 if (uBuf.DosHdr.e_magic == IMAGE_DOS_SIGNATURE)
1066 {
1067 offNewHdrs = uBuf.DosHdr.e_lfanew;
1068 if ( offNewHdrs < 16
1069 || offNewHdrs > (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)))
1070 return RTERRINFO_LOG_SET_F(pErrInfo, rc, "e_lfanew value is out of range: %RX32 (16..%u)",
1071 offNewHdrs, (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)));
1072 }
1073 else if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
1074 offNewHdrs = 0;
1075 else
1076 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Unknown image magic at %RGv: %.8Rhxs",
1077 pImageAddr->FlatPtr, uBuf.ab);
1078
1079 /*
1080 * Read the next bit of header, assuming PE so stop at the end of
1081 * the COFF file header.
1082 */
1083 DBGFADDRESS PeHdrAddr = *pImageAddr;
1084 DBGFR3AddrAdd(&PeHdrAddr, offNewHdrs);
1085 uint32_t const cbPeHdrsPart1 = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader);
1086 rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, &PeHdrAddr, &uBuf, cbPeHdrsPart1);
1087 if (RT_FAILURE(rc))
1088 return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read PE/LX/NE headers at %RGv (off=%#RX32): %Rrc",
1089 PeHdrAddr.FlatPtr, offNewHdrs, rc);
1090
1091 if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
1092 return dbgfR3ModInMemPe(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, offNewHdrs, cbPeHdrsPart1,
1093 &uBuf, phDbgMod, pErrInfo);
1094
1095 return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "No PE/LX/NE header at %RGv (off=%#RX32): %.8Rhxs",
1096 PeHdrAddr.FlatPtr, offNewHdrs, uBuf.ab);
1097}
1098
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use