DBGPlugInDarwin.cpp@ 55628

Last change on this file since 55628 was 54394, checked in by vboxsync, 10 years ago
DBGPlugInDarwin: typo
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 35.2 KB

Line
1	/* $Id: DBGPlugInDarwin.cpp 54394 2015-02-23 17:33:09Z vboxsync $ */
2	/** @file
3	* DBGPlugInDarwin - Debugger and Guest OS Digger Plugin For Darwin / OS X.
4	*/
5
6	/*
7	* Copyright (C) 2008-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF ///@todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <iprt/string.h>
26	#include <iprt/mem.h>
27	#include <iprt/stream.h>
28	#include <iprt/uuid.h>
29	#include <iprt/ctype.h>
30	#include <iprt/formats/mach-o.h>
31
32
33	/*******************************************************************************
34	* Structures and Typedefs *
35	*******************************************************************************/
36
37	/** @name Internal Darwin structures
38	* @{ */
39
40	/**
41	* 32-bit darwin kernel module info structure (kmod_info_t).
42	*/
43	typedef struct OSX32_kmod_info
44	{
45	uint32_t next;
46	int32_t info_version;
47	uint32_t id;
48	char name[64];
49	char version[64];
50	int32_t reference_count;
51	uint32_t reference_list; /*< Points to kmod_reference_t. /
52	uint32_t address; /*< Where in memory the kext is loaded. /
53	uint32_t size;
54	uint32_t hdr_size;
55	uint32_t start; /*< Address of kmod_start_func_t. /
56	uint32_t stop; /*< Address of kmod_stop_func_t. /
57	} OSX32_kmod_info_t;
58
59	/**
60	* 32-bit darwin kernel module info structure (kmod_info_t).
61	*/
62	#pragma pack(1)
63	typedef struct OSX64_kmod_info
64	{
65	uint64_t next;
66	int32_t info_version;
67	uint32_t id;
68	char name[64];
69	char version[64];
70	int32_t reference_count;
71	uint64_t reference_list; /*< Points to kmod_reference_t. Misaligned, duh. /
72	uint64_t address; /*< Where in memory the kext is loaded. /
73	uint64_t size;
74	uint64_t hdr_size;
75	uint64_t start; /*< Address of kmod_start_func_t. /
76	uint64_t stop; /*< Address of kmod_stop_func_t. /
77	} OSX64_kmod_info_t;
78	#pragma pack()
79
80	/** The value of the info_version field. */
81	#define OSX_KMOD_INFO_VERSION INT32_C(1)
82
83	/** @} */
84
85
86	/**
87	* Linux guest OS digger instance data.
88	*/
89	typedef struct DBGDIGGERDARWIN
90	{
91	/** Whether the information is valid or not.
92	* (For fending off illegal interface method calls.) */
93	bool fValid;
94
95	/** Set if 64-bit kernel, clear if 32-bit.
96	* Set during probing. */
97	bool f64Bit;
98	/** The address of an kernel version string (there are several).
99	* This is set during probing. */
100	DBGFADDRESS AddrKernelVersion;
101	/** Kernel base address.
102	* This is set during probing. */
103	DBGFADDRESS AddrKernel;
104
105	/** The kernel message log interface. */
106	DBGFOSIDMESG IDmesg;
107	} DBGDIGGERDARWIN;
108	/** Pointer to the linux guest OS digger instance data. */
109	typedef DBGDIGGERDARWIN *PDBGDIGGERDARWIN;
110
111
112	/*******************************************************************************
113	* Defined Constants And Macros *
114	*******************************************************************************/
115	/** Validates a 32-bit darwin kernel address */
116	#define OSX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x00001000) && (Addr) < UINT32_C(0xfffff000))
117	/** Validates a 64-bit darwin kernel address */
118	#define OSX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
119	/** Validates a 32-bit or 64-bit darwin kernel address. */
120	#define OSX_VALID_ADDRESS(a_f64Bits, a_Addr) \
121	((a_f64Bits) ? OSX64_VALID_ADDRESS(a_Addr) : OSX32_VALID_ADDRESS(a_Addr))
122
123	/** AppleOsX on little endian ASCII systems. */
124	#define DIG_DARWIN_MOD_TAG UINT64_C(0x58734f656c707041)
125
126
127	/*******************************************************************************
128	* Internal Functions *
129	*******************************************************************************/
130	static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, void *pvData);
131
132
133	/**
134	* @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
135	*/
136	static DECLCALLBACK(int) dbgDiggerDarwinIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, uint32_t fFlags, uint32_t cMessages,
137	char pszBuf, size_t cbBuf, size_t pcbActual)
138	{
139	PDBGDIGGERDARWIN pData = RT_FROM_MEMBER(pThis, DBGDIGGERDARWIN, IDmesg);
140
141	if (cMessages < 1)
142	return VERR_INVALID_PARAMETER;
143
144	/*
145	* The 'msgbufp' variable points to a struct msgbuf (bsd/kern/subr_log.c).
146	*/
147	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
148	RTDBGMOD hMod;
149	int rc = RTDbgAsModuleByName(hAs, "mach_kernel", 0, &hMod);
150	if (RT_FAILURE(rc))
151	return VERR_NOT_FOUND;
152	RTDbgAsRelease(hAs);
153
154	DBGFADDRESS Addr;
155	RTGCPTR GCPtrMsgBufP = 0;
156	RTDBGSYMBOL SymInfo;
157	rc = RTDbgModSymbolByName(hMod, "_msgbufp", &SymInfo);
158	if (RT_SUCCESS(rc))
159	{
160	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, SymInfo.Value + pData->AddrKernel.FlatPtr),
161	&GCPtrMsgBufP, pData->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t));
162	if (RT_FAILURE(rc))
163	{
164	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read _msgbufp at %RGv: %Rrc\n", Addr.FlatPtr, rc));
165	return VERR_NOT_FOUND;
166	}
167	if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
168	{
169	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbufp: %RGv\n", GCPtrMsgBufP));
170	return VERR_NOT_FOUND;
171	}
172	}
173	else
174	{
175	rc = RTDbgModSymbolByName(hMod, "_msgbuf", &SymInfo);
176	if (RT_FAILURE(rc))
177	{
178	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to find _msgbufp and _msgbuf: %Rrc\n", rc));
179	return VERR_NOT_FOUND;
180	}
181	GCPtrMsgBufP = SymInfo.Value + pData->AddrKernel.FlatPtr;
182	if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
183	{
184	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbuf: %RGv\n", GCPtrMsgBufP));
185	return VERR_NOT_FOUND;
186	}
187	}
188
189	/*
190	* Read the msgbuf structure.
191	*/
192	struct
193	{
194	uint32_t msg_magic;
195	uint32_t msg_size;
196	uint32_t msg_bufx;
197	uint32_t msg_bufr;
198	uint64_t msg_bufc; /*< Size depends on windows size. /
199	} MsgBuf;
200	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrMsgBufP),
201	&MsgBuf, sizeof(MsgBuf) - (pData->f64Bit ? 0 : sizeof(uint32_t)) );
202	if (RT_FAILURE(rc))
203	{
204	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read msgbuf struct at %RGv: %Rrc\n", Addr.FlatPtr, rc));
205	return VERR_NOT_FOUND;
206	}
207	if (!pData->f64Bit)
208	MsgBuf.msg_bufc &= UINT32_MAX;
209
210	/*
211	* Validate the structure.
212	*/
213	if ( MsgBuf.msg_magic != UINT32_C(0x63061)
214	\|\| MsgBuf.msg_size < UINT32_C(4096)
215	\|\| MsgBuf.msg_size > 16*_1M
216	\|\| MsgBuf.msg_bufx > MsgBuf.msg_size
217	\|\| MsgBuf.msg_bufr > MsgBuf.msg_size
218	\|\| !OSX_VALID_ADDRESS(pData->f64Bit, MsgBuf.msg_bufc) )
219	{
220	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid MsgBuf data: magic=%#x size=%#x bufx=%#x bufr=%#x bufc=%RGv\n",
221	MsgBuf.msg_magic, MsgBuf.msg_size, MsgBuf.msg_bufx, MsgBuf.msg_bufr, MsgBuf.msg_bufc));
222	return VERR_INVALID_STATE;
223	}
224
225	/*
226	* Read the buffer.
227	*/
228	char pchMsgBuf = (char )RTMemAlloc(MsgBuf.msg_size);
229	if (!pchMsgBuf)
230	{
231	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Failed to allocate %#x bytes of memory for the log buffer\n",
232	MsgBuf.msg_size));
233	return VERR_INVALID_STATE;
234	}
235	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, MsgBuf.msg_bufc), pchMsgBuf, MsgBuf.msg_size);
236	if (RT_SUCCESS(rc))
237	{
238	/*
239	* Copy it out raw.
240	*/
241	uint32_t offDst = 0;
242	if (MsgBuf.msg_bufr < MsgBuf.msg_bufx)
243	{
244	/* Single chunk between the read and write offsets. */
245	uint32_t cbToCopy = MsgBuf.msg_bufx - MsgBuf.msg_bufr;
246	if (cbToCopy < cbBuf)
247	{
248	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbToCopy);
249	pszBuf[cbToCopy] = '\0';
250	rc = VINF_SUCCESS;
251	}
252	else
253	{
254	if (cbBuf)
255	{
256	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
257	pszBuf[cbBuf - 1] = '\0';
258	}
259	rc = VERR_BUFFER_OVERFLOW;
260	}
261	offDst = cbToCopy + 1;
262	}
263	else
264	{
265	/* Two chunks, read offset to end, start to write offset. */
266	uint32_t cbFirst = MsgBuf.msg_size - MsgBuf.msg_bufr;
267	uint32_t cbSecond = MsgBuf.msg_bufx;
268	if (cbFirst + cbSecond < cbBuf)
269	{
270	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
271	memcpy(&pszBuf[cbFirst], pchMsgBuf, cbSecond);
272	offDst = cbFirst + cbSecond;
273	pszBuf[offDst++] = '\0';
274	rc = VINF_SUCCESS;
275	}
276	else
277	{
278	offDst = cbFirst + cbSecond + 1;
279	if (cbFirst < cbBuf)
280	{
281	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
282	memcpy(&pszBuf[cbFirst], pchMsgBuf, cbBuf - cbFirst);
283	pszBuf[cbBuf - 1] = '\0';
284	}
285	else if (cbBuf)
286	{
287	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
288	pszBuf[cbBuf - 1] = '\0';
289	}
290	rc = VERR_BUFFER_OVERFLOW;
291	}
292	}
293
294	if (pcbActual)
295	*pcbActual = offDst;
296	}
297	else
298	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Error reading %#x bytes at %RGv: %Rrc\n", MsgBuf.msg_size, MsgBuf.msg_bufc));
299	RTMemFree(pchMsgBuf);
300	return rc;
301	}
302
303
304	/**
305	* @copydoc DBGFOSREG::pfnQueryInterface
306	*/
307	static DECLCALLBACK(void ) dbgDiggerDarwinQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
308	{
309	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
310	switch (enmIf)
311	{
312	case DBGFOSINTERFACE_DMESG:
313	return &pThis->IDmesg;
314
315	default:
316	return NULL;
317	}
318	}
319
320
321	/**
322	* @copydoc DBGFOSREG::pfnQueryVersion
323	*/
324	static DECLCALLBACK(int) dbgDiggerDarwinQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
325	{
326	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
327	Assert(pThis->fValid);
328
329	/*
330	* It's all in the linux banner.
331	*/
332	int rc = DBGFR3MemReadString(pUVM, 0, &pThis->AddrKernelVersion, pszVersion, cchVersion);
333	if (RT_SUCCESS(rc))
334	{
335	char *pszEnd = RTStrEnd(pszVersion, cchVersion);
336	AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
337	while ( pszEnd > pszVersion
338	&& RT_C_IS_SPACE(pszEnd[-1]))
339	pszEnd--;
340	*pszEnd = '\0';
341	}
342	else
343	RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
344
345	return rc;
346	}
347
348
349	/**
350	* @copydoc DBGFOSREG::pfnTerm
351	*/
352	static DECLCALLBACK(void) dbgDiggerDarwinTerm(PUVM pUVM, void *pvData)
353	{
354	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
355
356	pThis->fValid = false;
357	}
358
359
360	/**
361	* @copydoc DBGFOSREG::pfnRefresh
362	*/
363	static DECLCALLBACK(int) dbgDiggerDarwinRefresh(PUVM pUVM, void *pvData)
364	{
365	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
366	NOREF(pThis);
367	Assert(pThis->fValid);
368
369	/*
370	* For now we'll flush and reload everything.
371	*/
372	dbgDiggerDarwinTerm(pUVM, pvData);
373	return dbgDiggerDarwinInit(pUVM, pvData);
374	}
375
376
377	/**
378	* Helper function that validates a segment (or section) name.
379	*
380	* @returns true if valid, false if not.
381	* @param pszName The name string.
382	* @param cbName The size of the string, including terminator.
383	*/
384	static bool dbgDiggerDarwinIsValidSegOrSectName(const char *pszName, size_t cbName)
385	{
386	/* ascii chars */
387	char ch;
388	size_t off = 0;
389	while (off < cbName && (ch = pszName[off]))
390	{
391	if (RT_C_IS_CNTRL(ch) \|\| ch >= 127)
392	return false;
393	off++;
394	}
395
396	/* Not empty nor 100% full. */
397	if (off == 0 \|\| off == cbName)
398	return false;
399
400	/* remainder should be zeros. */
401	while (off < cbName)
402	{
403	if (pszName[off])
404	return false;
405	off++;
406	}
407
408	return true;
409	}
410
411
412	static int dbgDiggerDarwinAddModule(PDBGDIGGERDARWIN pThis, PUVM pUVM, uint64_t uModAddr, const char pszName, bool pf64Bit)
413	{
414	union
415	{
416	uint8_t ab[2 * X86_PAGE_4K_SIZE];
417	mach_header_64_t Hdr64;
418	mach_header_32_t Hdr32;
419	} uBuf;
420
421	/* Read the first page of the image. */
422	DBGFADDRESS ModAddr;
423	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr), uBuf.ab, X86_PAGE_4K_SIZE);
424	if (RT_FAILURE(rc))
425	return rc;
426
427	/* Validate the header. */
428	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
429	if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
430	&& uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
431	return VERR_INVALID_EXE_SIGNATURE;
432	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
433	bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
434	if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
435	return VERR_LDR_ARCH_MISMATCH;
436	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
437	if ( uBuf.Hdr32.filetype != MH_EXECUTE
438	&& uBuf.Hdr32.filetype != (f64Bit ? MH_KEXT_BUNDLE : MH_OBJECT))
439	return VERR_BAD_EXE_FORMAT;
440	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
441	if (uBuf.Hdr32.ncmds > 256)
442	return VERR_BAD_EXE_FORMAT;
443	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
444	if (uBuf.Hdr32.sizeofcmds > X86_PAGE_4K_SIZE * 2 - sizeof(mach_header_64_t))
445	return VERR_BAD_EXE_FORMAT;
446
447	/* Do we need to read a 2nd page to get all the load commands? If so, do it. */
448	if (uBuf.Hdr32.sizeofcmds + (f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)) > X86_PAGE_4K_SIZE)
449	{
450	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr + X86_PAGE_4K_SIZE),
451	&uBuf.ab[X86_PAGE_4K_SIZE], X86_PAGE_4K_SIZE);
452	if (RT_FAILURE(rc))
453	return rc;
454	}
455
456	/*
457	* Process the load commands.
458	*/
459	RTDBGSEGMENT aSegs[24];
460	uint32_t cSegs = 0;
461	RTUUID Uuid = RTUUID_INITIALIZE_NULL;
462	uint32_t cLeft = uBuf.Hdr32.ncmds;
463	uint32_t cbLeft = uBuf.Hdr32.sizeofcmds;
464	union
465	{
466	uint8_t const *pb;
467	load_command_t const *pGenric;
468	segment_command_32_t const *pSeg32;
469	segment_command_64_t const *pSeg64;
470	section_32_t const *pSect32;
471	section_64_t const *pSect64;
472	symtab_command_t const *pSymTab;
473	uuid_command_t const *pUuid;
474	} uLCmd;
475	uLCmd.pb = &uBuf.ab[f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)];
476
477	while (cLeft-- > 0)
478	{
479	uint32_t const cbCmd = uLCmd.pGenric->cmdsize;
480	if (cbCmd > cbLeft \|\| cbCmd < sizeof(load_command_t))
481	return VERR_BAD_EXE_FORMAT;
482
483	switch (uLCmd.pGenric->cmd)
484	{
485	case LC_SEGMENT_32:
486	if (cbCmd != sizeof(segment_command_32_t) + uLCmd.pSeg32->nsects * sizeof(section_32_t))
487	return VERR_BAD_EXE_FORMAT;
488	if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg32->segname, sizeof(uLCmd.pSeg32->segname)))
489	return VERR_INVALID_NAME;
490	if (!strcmp(uLCmd.pSeg32->segname, "__LINKEDIT"))
491	break; /* This usually is discarded or not loaded at all. */
492	if (cSegs >= RT_ELEMENTS(aSegs))
493	return VERR_BUFFER_OVERFLOW;
494	aSegs[cSegs].Address = uLCmd.pSeg32->vmaddr;
495	aSegs[cSegs].uRva = uLCmd.pSeg32->vmaddr - uModAddr;
496	aSegs[cSegs].cb = uLCmd.pSeg32->vmsize;
497	aSegs[cSegs].fFlags = uLCmd.pSeg32->flags; /* Abusing the flags field here... */
498	aSegs[cSegs].iSeg = cSegs;
499	AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg32->segname));
500	strcpy(aSegs[cSegs].szName, uLCmd.pSeg32->segname);
501	cSegs++;
502	break;
503
504	case LC_SEGMENT_64:
505	if (cbCmd != sizeof(segment_command_64_t) + uLCmd.pSeg64->nsects * sizeof(section_64_t))
506	return VERR_BAD_EXE_FORMAT;
507	if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg64->segname, sizeof(uLCmd.pSeg64->segname)))
508	return VERR_INVALID_NAME;
509	if (!strcmp(uLCmd.pSeg64->segname, "__LINKEDIT"))
510	break; /* This usually is discarded or not loaded at all. */
511	if (cSegs >= RT_ELEMENTS(aSegs))
512	return VERR_BUFFER_OVERFLOW;
513	aSegs[cSegs].Address = uLCmd.pSeg64->vmaddr;
514	aSegs[cSegs].uRva = uLCmd.pSeg64->vmaddr - uModAddr;
515	aSegs[cSegs].cb = uLCmd.pSeg64->vmsize;
516	aSegs[cSegs].fFlags = uLCmd.pSeg64->flags; /* Abusing the flags field here... */
517	aSegs[cSegs].iSeg = cSegs;
518	AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg64->segname));
519	strcpy(aSegs[cSegs].szName, uLCmd.pSeg64->segname);
520	cSegs++;
521	break;
522
523	case LC_UUID:
524	if (cbCmd != sizeof(uuid_command_t))
525	return VERR_BAD_EXE_FORMAT;
526	if (RTUuidIsNull((PCRTUUID)&uLCmd.pUuid->uuid[0]))
527	return VERR_BAD_EXE_FORMAT;
528	memcpy(&Uuid, &uLCmd.pUuid->uuid[0], sizeof(uLCmd.pUuid->uuid));
529	break;
530
531	default:
532	/* Current known max plus a lot of slack. */
533	if (uLCmd.pGenric->cmd > LC_DYLIB_CODE_SIGN_DRS + 32)
534	return VERR_BAD_EXE_FORMAT;
535	break;
536	}
537
538	/* next */
539	cbLeft -= cbCmd;
540	uLCmd.pb += cbCmd;
541	}
542
543	if (cbLeft != 0)
544	return VERR_BAD_EXE_FORMAT;
545
546	/*
547	* Some post processing checks.
548	*/
549	uint32_t iSeg;
550	for (iSeg = 0; iSeg < cSegs; iSeg++)
551	if (aSegs[iSeg].Address == uModAddr)
552	break;
553	if (iSeg >= cSegs)
554	return VERR_ADDRESS_CONFLICT;
555
556	/*
557	* Create a debug module.
558	*/
559	RTDBGMOD hMod;
560	rc = RTDbgModCreateFromMachOImage(&hMod, pszName, NULL, f64Bit ? RTLDRARCH_AMD64 : RTLDRARCH_X86_32, 0 /cbImage/,
561	cSegs, aSegs, &Uuid, DBGFR3AsGetConfig(pUVM), RTDBGMOD_F_NOT_DEFERRED);
562
563	if (RT_FAILURE(rc))
564	{
565	/*
566	* Final fallback is a container module.
567	*/
568	rc = RTDbgModCreate(&hMod, pszName, 0, 0);
569	if (RT_FAILURE(rc))
570	return rc;
571
572	uint64_t uRvaNext = 0;
573	for (iSeg = 0; iSeg < cSegs && RT_SUCCESS(rc); iSeg++)
574	{
575	if ( aSegs[iSeg].uRva > uRvaNext
576	&& aSegs[iSeg].uRva - uRvaNext < _1M)
577	uRvaNext = aSegs[iSeg].uRva;
578	rc = RTDbgModSegmentAdd(hMod, aSegs[iSeg].uRva, aSegs[iSeg].cb, aSegs[iSeg].szName, 0, NULL);
579	if (aSegs[iSeg].cb > 0 && RT_SUCCESS(rc))
580	{
581	char szTmp[RTDBG_SEGMENT_NAME_LENGTH + sizeof("_start")];
582	strcat(strcpy(szTmp, aSegs[iSeg].szName), "_start");
583	rc = RTDbgModSymbolAdd(hMod, szTmp, iSeg, 0 /uRva/, 0 /cb/, 0 /fFlags/, NULL);
584	}
585	uRvaNext += aSegs[iSeg].cb;
586	}
587
588	if (RT_FAILURE(rc))
589	{
590	RTDbgModRelease(hMod);
591	return rc;
592	}
593	}
594
595	/* Tag the module. */
596	rc = RTDbgModSetTag(hMod, DIG_DARWIN_MOD_TAG);
597	AssertRC(rc);
598
599	/*
600	* Link the module.
601	*/
602	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
603	if (hAs != NIL_RTDBGAS)
604	{
605	uint64_t uRvaNext = 0;
606	uint32_t cLinked = 0;
607	iSeg = cSegs;
608	while (iSeg-- > 0) /* HACK: Map in reverse order to avoid replacing __TEXT. */
609	if (aSegs[iSeg].cb)
610	{
611	/* Find matching segment in the debug module. */
612	uint32_t iDbgSeg = 0;
613	while (iDbgSeg < cSegs)
614	{
615	RTDBGSEGMENT SegInfo;
616	int rc3 = RTDbgModSegmentByIndex(hMod, iDbgSeg, &SegInfo);
617	if (RT_SUCCESS(rc3) && !strcmp(SegInfo.szName, aSegs[iSeg].szName))
618	break;
619	iDbgSeg++;
620	}
621	AssertMsgStmt(iDbgSeg < cSegs, ("%s\n", aSegs[iSeg].szName), continue);
622
623	/* Map it. */
624	int rc2 = RTDbgAsModuleLinkSeg(hAs, hMod, iDbgSeg, aSegs[iSeg].Address, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
625	if (RT_SUCCESS(rc2))
626	cLinked++;
627	else if (RT_SUCCESS(rc))
628	rc = rc2;
629	}
630	if (RT_FAILURE(rc) && cLinked != 0)
631	rc = -rc;
632	}
633	else
634	rc = VERR_INTERNAL_ERROR;
635
636	RTDbgModRelease(hMod);
637	RTDbgAsRelease(hAs);
638
639	if (pf64Bit)
640	*pf64Bit = f64Bit;
641	return rc;
642	}
643
644
645	static bool dbgDiggerDarwinIsValidName(const char *pszName)
646	{
647	char ch;
648	while ((ch = *pszName++) != '\0')
649	{
650	if (ch < 0x20 \|\| ch >= 127)
651	return false;
652	}
653	return true;
654	}
655
656
657	static bool dbgDiggerDarwinIsValidVersion(const char *pszVersion)
658	{
659	char ch;
660	while ((ch = *pszVersion++) != '\0')
661	{
662	if (ch < 0x20 \|\| ch >= 127)
663	return false;
664	}
665	return true;
666	}
667
668
669	/**
670	* @copydoc DBGFOSREG::pfnInit
671	*/
672	static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, void *pvData)
673	{
674	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
675	Assert(!pThis->fValid);
676
677	/*
678	* Add the kernel module.
679	*/
680	bool f64Bit;
681	int rc = dbgDiggerDarwinAddModule(pThis, pUVM, pThis->AddrKernel.FlatPtr, "mach_kernel", &f64Bit);
682	if (RT_SUCCESS(rc))
683	{
684	/*
685	* The list of modules can be found at the 'kmod' symbol, that means
686	* that we currently require some kind of symbol file for the kernel
687	* to be loaded at this point.
688	*
689	* Note! Could also use the 'gLoadedKextSummaries', but I don't think
690	* it's any easier to find without any kernel map than 'kmod'.
691	*/
692	RTDBGSYMBOL SymInfo;
693	rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!kmod", &SymInfo, NULL);
694	if (RT_FAILURE(rc))
695	rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!_kmod", &SymInfo, NULL);
696	if (RT_SUCCESS(rc))
697	{
698	DBGFADDRESS AddrModInfo;
699	DBGFR3AddrFromFlat(pUVM, &AddrModInfo, SymInfo.Value);
700
701	/* Read the variable. */
702	RTUINT64U uKmodValue = { 0 };
703	if (f64Bit)
704	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrModInfo, &uKmodValue.u, sizeof(uKmodValue.u));
705	else
706	rc = DBGFR3MemRead (pUVM, 0 /idCpu/, &AddrModInfo, &uKmodValue.s.Lo, sizeof(uKmodValue.s.Lo));
707	if (RT_SUCCESS(rc))
708	{
709	DBGFR3AddrFromFlat(pUVM, &AddrModInfo, uKmodValue.u);
710
711	/* Walk the list of modules. */
712	uint32_t cIterations = 0;
713	while (AddrModInfo.FlatPtr != 0)
714	{
715	/* Some extra loop conditions... */
716	if (!OSX_VALID_ADDRESS(f64Bit, AddrModInfo.FlatPtr))
717	{
718	Log(("OSXDig: Invalid kmod_info pointer: %RGv\n", AddrModInfo.FlatPtr));
719	break;
720	}
721	if (AddrModInfo.FlatPtr == uKmodValue.u && cIterations != 0)
722	{
723	Log(("OSXDig: kmod_info list looped back to the start.\n"));
724	break;
725	}
726	if (cIterations++ >= 2048)
727	{
728	Log(("OSXDig: Too many mod_info loops (%u)\n", cIterations));
729	break;
730	}
731
732	/*
733	* Read the kmod_info_t structure.
734	*/
735	union
736	{
737	OSX64_kmod_info_t Info64;
738	OSX32_kmod_info_t Info32;
739	} uMod;
740	RT_ZERO(uMod);
741	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrModInfo, &uMod,
742	f64Bit ? sizeof(uMod.Info64) : sizeof(uMod.Info32));
743	if (RT_FAILURE(rc))
744	{
745	Log(("OSXDig: Error reading kmod_info structure at %RGv: %Rrc\n", AddrModInfo.FlatPtr, rc));
746	break;
747	}
748
749	/*
750	* Validate the kmod_info_t structure.
751	*/
752	int32_t iInfoVer = f64Bit ? uMod.Info64.info_version : uMod.Info32.info_version;
753	if (iInfoVer != OSX_KMOD_INFO_VERSION)
754	{
755	Log(("OSXDig: kmod_info @%RGv: Bad info_version %d\n", AddrModInfo.FlatPtr, iInfoVer));
756	break;
757	}
758
759	const char *pszName = f64Bit ? uMod.Info64.name : uMod.Info32.name;
760	if ( !*pszName
761	\|\| !RTStrEnd(pszName, sizeof(uMod.Info64.name))
762	\|\| !dbgDiggerDarwinIsValidName(pszName) )
763	{
764	Log(("OSXDig: kmod_info @%RGv: Bad name '%.*s'\n", AddrModInfo.FlatPtr,
765	sizeof(uMod.Info64.name), pszName));
766	break;
767	}
768
769	const char *pszVersion = f64Bit ? uMod.Info64.version : uMod.Info32.version;
770	if ( !RTStrEnd(pszVersion, sizeof(uMod.Info64.version))
771	\|\| !dbgDiggerDarwinIsValidVersion(pszVersion) )
772	{
773	Log(("OSXDig: kmod_info @%RGv: Bad version '%.*s'\n", AddrModInfo.FlatPtr,
774	sizeof(uMod.Info64.version), pszVersion));
775	break;
776	}
777
778	int32_t cRefs = f64Bit ? uMod.Info64.reference_count : uMod.Info32.reference_count;
779	if (cRefs < -1 \|\| cRefs > 16384)
780	{
781	Log(("OSXDig: kmod_info @%RGv: Bad reference_count %d\n", AddrModInfo.FlatPtr, cRefs));
782	break;
783	}
784
785	uint64_t uImageAddr = f64Bit ? uMod.Info64.address : uMod.Info32.address;
786	if (!OSX_VALID_ADDRESS(f64Bit, uImageAddr))
787	{
788	Log(("OSXDig: kmod_info @%RGv: Bad address %#llx\n", AddrModInfo.FlatPtr, uImageAddr));
789	break;
790	}
791
792	uint64_t cbImage = f64Bit ? uMod.Info64.size : uMod.Info32.size;
793	if (cbImage > 64U*_1M)
794	{
795	Log(("OSXDig: kmod_info @%RGv: Bad size %#llx\n", AddrModInfo.FlatPtr, cbImage));
796	break;
797	}
798
799	uint64_t cbHdr = f64Bit ? uMod.Info64.hdr_size : uMod.Info32.hdr_size;
800	if (cbHdr > 16U*_1M)
801	{
802	Log(("OSXDig: kmod_info @%RGv: Bad hdr_size %#llx\n", AddrModInfo.FlatPtr, cbHdr));
803	break;
804	}
805
806	uint64_t uStartAddr = f64Bit ? uMod.Info64.start : uMod.Info32.start;
807	if (!uStartAddr && !OSX_VALID_ADDRESS(f64Bit, uStartAddr))
808	{
809	Log(("OSXDig: kmod_info @%RGv: Bad start function %#llx\n", AddrModInfo.FlatPtr, uStartAddr));
810	break;
811	}
812
813	uint64_t uStopAddr = f64Bit ? uMod.Info64.stop : uMod.Info32.stop;
814	if (!uStopAddr && !OSX_VALID_ADDRESS(f64Bit, uStopAddr))
815	{
816	Log(("OSXDig: kmod_info @%RGv: Bad stop function %#llx\n", AddrModInfo.FlatPtr, uStopAddr));
817	break;
818	}
819
820	/*
821	* Try add the module.
822	*/
823	Log(("OSXDig: kmod_info @%RGv: '%s' ver '%s', image @%#llx LB %#llx cbHdr=%#llx\n", AddrModInfo.FlatPtr,
824	pszName, pszVersion, uImageAddr, cbImage, cbHdr));
825	rc = dbgDiggerDarwinAddModule(pThis, pUVM, uImageAddr, pszName, NULL);
826
827
828	/*
829	* Advance to the next kmod_info entry.
830	*/
831	DBGFR3AddrFromFlat(pUVM, &AddrModInfo, f64Bit ? uMod.Info64.next : uMod.Info32.next);
832	}
833	}
834	else
835	Log(("OSXDig: Error reading the 'kmod' variable: %Rrc\n", rc));
836	}
837	else
838	Log(("OSXDig: Failed to locate the 'kmod' variable in mach_kernel.\n"));
839
840	pThis->fValid = true;
841	return VINF_SUCCESS;
842	}
843
844	return rc;
845	}
846
847
848	/**
849	* @copydoc DBGFOSREG::pfnProbe
850	*/
851	static DECLCALLBACK(bool) dbgDiggerDarwinProbe(PUVM pUVM, void *pvData)
852	{
853	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
854
855	/*
856	* Look for a section + segment combo that normally only occures in
857	* mach_kernel. Follow it up with probing of the rest of the executable
858	* header. We must search a largish area because the more recent versions
859	* of darwin have random load address for security raisins.
860	*/
861	static struct { uint64_t uStart, uEnd; } const s_aRanges[] =
862	{
863	/* 64-bit: */
864	{ UINT64_C(0xffffff8000000000), UINT64_C(0xffffff81ffffffff), },
865
866	/* 32-bit - always search for this because of the hybrid 32-bit kernel
867	with cpu in long mode that darwin used for a number of versions. */
868	{ UINT64_C(0x00001000), UINT64_C(0x0ffff000), }
869	};
870	for (unsigned iRange = DBGFR3CpuGetMode(pUVM, 0 /idCpu/) != CPUMMODE_LONG;
871	iRange < RT_ELEMENTS(s_aRanges);
872	iRange++)
873	{
874	DBGFADDRESS KernelAddr;
875	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, s_aRanges[iRange].uStart);
876	KernelAddr.FlatPtr < s_aRanges[iRange].uEnd;
877	KernelAddr.FlatPtr += X86_PAGE_4K_SIZE)
878	{
879	static const uint8_t s_abNeedle[16 + 16] =
880	{
881	'_','_','t','e','x','t', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::sectname */
882	'_','_','K','L','D', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::segname. */
883	};
884
885	int rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, s_aRanges[iRange].uEnd - KernelAddr.FlatPtr,
886	1, s_abNeedle, sizeof(s_abNeedle), &KernelAddr);
887	if (RT_FAILURE(rc))
888	break;
889	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & X86_PAGE_4K_OFFSET_MASK);
890
891	/*
892	* Read the first page of the image and check the headers.
893	*/
894	union
895	{
896	uint8_t ab[X86_PAGE_4K_SIZE];
897	mach_header_64_t Hdr64;
898	mach_header_32_t Hdr32;
899	} uBuf;
900	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, uBuf.ab, X86_PAGE_4K_SIZE);
901	if (RT_FAILURE(rc))
902	continue;
903	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
904	if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
905	&& uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
906	continue;
907	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
908	bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
909	if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
910	continue;
911	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
912	if (uBuf.Hdr32.filetype != MH_EXECUTE)
913	continue;
914	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
915	if (uBuf.Hdr32.ncmds > 256)
916	continue;
917	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
918	if (uBuf.Hdr32.sizeofcmds > X86_PAGE_4K_SIZE * 2 - sizeof(mach_header_64_t))
919	continue;
920
921	/* Seems good enough for now.
922
923	If the above causes false positives, check the segments and make
924	sure there is a kernel version string in the right one. */
925	pThis->AddrKernel = KernelAddr;
926	pThis->f64Bit = f64Bit;
927
928	/*
929	* Finally, find the kernel version string.
930	*/
931	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, 32*_1M, 1, RT_STR_TUPLE("Darwin Kernel Version"),
932	&pThis->AddrKernelVersion);
933	if (RT_FAILURE(rc))
934	DBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelVersion, 0);
935	return true;
936	}
937	}
938	return false;
939	}
940
941
942	/**
943	* @copydoc DBGFOSREG::pfnDestruct
944	*/
945	static DECLCALLBACK(void) dbgDiggerDarwinDestruct(PUVM pUVM, void *pvData)
946	{
947
948	}
949
950
951	/**
952	* @copydoc DBGFOSREG::pfnConstruct
953	*/
954	static DECLCALLBACK(int) dbgDiggerDarwinConstruct(PUVM pUVM, void *pvData)
955	{
956	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
957
958	pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
959	pThis->IDmesg.pfnQueryKernelLog = dbgDiggerDarwinIDmsg_QueryKernelLog;
960	pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
961
962	return VINF_SUCCESS;
963	}
964
965
966	const DBGFOSREG g_DBGDiggerDarwin =
967	{
968	/* .u32Magic = */ DBGFOSREG_MAGIC,
969	/* .fFlags = */ 0,
970	/* .cbData = */ sizeof(DBGDIGGERDARWIN),
971	/* .szName = */ "Darwin",
972	/* .pfnConstruct = */ dbgDiggerDarwinConstruct,
973	/* .pfnDestruct = */ dbgDiggerDarwinDestruct,
974	/* .pfnProbe = */ dbgDiggerDarwinProbe,
975	/* .pfnInit = */ dbgDiggerDarwinInit,
976	/* .pfnRefresh = */ dbgDiggerDarwinRefresh,
977	/* .pfnTerm = */ dbgDiggerDarwinTerm,
978	/* .pfnQueryVersion = */ dbgDiggerDarwinQueryVersion,
979	/* .pfnQueryInterface = */ dbgDiggerDarwinQueryInterface,
980	/* .u32EndMagic = */ DBGFOSREG_MAGIC
981	};
982

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInDarwin.cpp@ 55628

Download in other formats: