DBGPlugInDarwin.cpp@ 78376

Last change on this file since 78376 was 76553, checked in by vboxsync, 6 years ago
scm --update-copyright-year
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 36.6 KB

Line
1	/* $Id: DBGPlugInDarwin.cpp 76553 2019-01-01 01:45:53Z vboxsync $ */
2	/** @file
3	* DBGPlugInDarwin - Debugger and Guest OS Digger Plugin For Darwin / OS X.
4	*/
5
6	/*
7	* Copyright (C) 2008-2019 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <iprt/err.h>
26	#include <iprt/mem.h>
27	#include <iprt/stream.h>
28	#include <iprt/string.h>
29	#include <iprt/uuid.h>
30	#include <iprt/ctype.h>
31	#include <iprt/formats/mach-o.h>
32
33
34	/*********************************************************************************************************************************
35	* Structures and Typedefs *
36	*********************************************************************************************************************************/
37
38	/** @name Internal Darwin structures
39	* @{ */
40
41	/**
42	* 32-bit darwin kernel module info structure (kmod_info_t).
43	*/
44	typedef struct OSX32_kmod_info
45	{
46	uint32_t next;
47	int32_t info_version;
48	uint32_t id;
49	char name[64];
50	char version[64];
51	int32_t reference_count;
52	uint32_t reference_list; /*< Points to kmod_reference_t. /
53	uint32_t address; /*< Where in memory the kext is loaded. /
54	uint32_t size;
55	uint32_t hdr_size;
56	uint32_t start; /*< Address of kmod_start_func_t. /
57	uint32_t stop; /*< Address of kmod_stop_func_t. /
58	} OSX32_kmod_info_t;
59
60	/**
61	* 32-bit darwin kernel module info structure (kmod_info_t).
62	*/
63	#pragma pack(1)
64	typedef struct OSX64_kmod_info
65	{
66	uint64_t next;
67	int32_t info_version;
68	uint32_t id;
69	char name[64];
70	char version[64];
71	int32_t reference_count;
72	uint64_t reference_list; /*< Points to kmod_reference_t. Misaligned, duh. /
73	uint64_t address; /*< Where in memory the kext is loaded. /
74	uint64_t size;
75	uint64_t hdr_size;
76	uint64_t start; /*< Address of kmod_start_func_t. /
77	uint64_t stop; /*< Address of kmod_stop_func_t. /
78	} OSX64_kmod_info_t;
79	#pragma pack()
80
81	/** The value of the info_version field. */
82	#define OSX_KMOD_INFO_VERSION INT32_C(1)
83
84	/** @} */
85
86
87	/**
88	* Linux guest OS digger instance data.
89	*/
90	typedef struct DBGDIGGERDARWIN
91	{
92	/** Whether the information is valid or not.
93	* (For fending off illegal interface method calls.) */
94	bool fValid;
95
96	/** Set if 64-bit kernel, clear if 32-bit.
97	* Set during probing. */
98	bool f64Bit;
99	/** The address of an kernel version string (there are several).
100	* This is set during probing. */
101	DBGFADDRESS AddrKernelVersion;
102	/** Kernel base address.
103	* This is set during probing. */
104	DBGFADDRESS AddrKernel;
105
106	/** The kernel message log interface. */
107	DBGFOSIDMESG IDmesg;
108	} DBGDIGGERDARWIN;
109	/** Pointer to the linux guest OS digger instance data. */
110	typedef DBGDIGGERDARWIN *PDBGDIGGERDARWIN;
111
112
113	/*********************************************************************************************************************************
114	* Defined Constants And Macros *
115	*********************************************************************************************************************************/
116	/** Validates a 32-bit darwin kernel address */
117	#define OSX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x00001000) && (Addr) < UINT32_C(0xfffff000))
118	/** Validates a 64-bit darwin kernel address */
119	#define OSX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
120	/** Validates a 32-bit or 64-bit darwin kernel address. */
121	#define OSX_VALID_ADDRESS(a_f64Bits, a_Addr) \
122	((a_f64Bits) ? OSX64_VALID_ADDRESS(a_Addr) : OSX32_VALID_ADDRESS(a_Addr))
123
124	/** AppleOsX on little endian ASCII systems. */
125	#define DIG_DARWIN_MOD_TAG UINT64_C(0x58734f656c707041)
126
127
128	/*********************************************************************************************************************************
129	* Internal Functions *
130	*********************************************************************************************************************************/
131	static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, void *pvData);
132
133
134
135	/**
136	* @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
137	*/
138	static DECLCALLBACK(int) dbgDiggerDarwinIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, uint32_t fFlags, uint32_t cMessages,
139	char pszBuf, size_t cbBuf, size_t pcbActual)
140	{
141	RT_NOREF1(fFlags);
142	PDBGDIGGERDARWIN pData = RT_FROM_MEMBER(pThis, DBGDIGGERDARWIN, IDmesg);
143
144	if (cMessages < 1)
145	return VERR_INVALID_PARAMETER;
146
147	/*
148	* The 'msgbufp' variable points to a struct msgbuf (bsd/kern/subr_log.c).
149	*/
150	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
151	RTDBGMOD hMod;
152	int rc = RTDbgAsModuleByName(hAs, "mach_kernel", 0, &hMod);
153	if (RT_FAILURE(rc))
154	return VERR_NOT_FOUND;
155	RTDbgAsRelease(hAs);
156
157	DBGFADDRESS Addr;
158	RTGCPTR GCPtrMsgBufP = 0;
159	RTDBGSYMBOL SymInfo;
160	rc = RTDbgModSymbolByName(hMod, "_msgbufp", &SymInfo);
161	if (RT_SUCCESS(rc))
162	{
163	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, SymInfo.Value + pData->AddrKernel.FlatPtr),
164	&GCPtrMsgBufP, pData->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t));
165	if (RT_FAILURE(rc))
166	{
167	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read _msgbufp at %RGv: %Rrc\n", Addr.FlatPtr, rc));
168	return VERR_NOT_FOUND;
169	}
170	if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
171	{
172	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbufp: %RGv\n", GCPtrMsgBufP));
173	return VERR_NOT_FOUND;
174	}
175	}
176	else
177	{
178	rc = RTDbgModSymbolByName(hMod, "_msgbuf", &SymInfo);
179	if (RT_FAILURE(rc))
180	{
181	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to find _msgbufp and _msgbuf: %Rrc\n", rc));
182	return VERR_NOT_FOUND;
183	}
184	GCPtrMsgBufP = SymInfo.Value + pData->AddrKernel.FlatPtr;
185	if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
186	{
187	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbuf: %RGv\n", GCPtrMsgBufP));
188	return VERR_NOT_FOUND;
189	}
190	}
191
192	/*
193	* Read the msgbuf structure.
194	*/
195	struct
196	{
197	uint32_t msg_magic;
198	uint32_t msg_size;
199	uint32_t msg_bufx;
200	uint32_t msg_bufr;
201	uint64_t msg_bufc; /*< Size depends on windows size. /
202	} MsgBuf;
203	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, GCPtrMsgBufP),
204	&MsgBuf, sizeof(MsgBuf) - (pData->f64Bit ? 0 : sizeof(uint32_t)) );
205	if (RT_FAILURE(rc))
206	{
207	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read msgbuf struct at %RGv: %Rrc\n", Addr.FlatPtr, rc));
208	return VERR_NOT_FOUND;
209	}
210	if (!pData->f64Bit)
211	MsgBuf.msg_bufc &= UINT32_MAX;
212
213	/*
214	* Validate the structure.
215	*/
216	if ( MsgBuf.msg_magic != UINT32_C(0x63061)
217	\|\| MsgBuf.msg_size < UINT32_C(4096)
218	\|\| MsgBuf.msg_size > 16*_1M
219	\|\| MsgBuf.msg_bufx > MsgBuf.msg_size
220	\|\| MsgBuf.msg_bufr > MsgBuf.msg_size
221	\|\| !OSX_VALID_ADDRESS(pData->f64Bit, MsgBuf.msg_bufc) )
222	{
223	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid MsgBuf data: magic=%#x size=%#x bufx=%#x bufr=%#x bufc=%RGv\n",
224	MsgBuf.msg_magic, MsgBuf.msg_size, MsgBuf.msg_bufx, MsgBuf.msg_bufr, MsgBuf.msg_bufc));
225	return VERR_INVALID_STATE;
226	}
227
228	/*
229	* Read the buffer.
230	*/
231	char pchMsgBuf = (char )RTMemAlloc(MsgBuf.msg_size);
232	if (!pchMsgBuf)
233	{
234	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Failed to allocate %#x bytes of memory for the log buffer\n",
235	MsgBuf.msg_size));
236	return VERR_INVALID_STATE;
237	}
238	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, MsgBuf.msg_bufc), pchMsgBuf, MsgBuf.msg_size);
239	if (RT_SUCCESS(rc))
240	{
241	/*
242	* Copy it out raw.
243	*/
244	uint32_t offDst = 0;
245	if (MsgBuf.msg_bufr < MsgBuf.msg_bufx)
246	{
247	/* Single chunk between the read and write offsets. */
248	uint32_t cbToCopy = MsgBuf.msg_bufx - MsgBuf.msg_bufr;
249	if (cbToCopy < cbBuf)
250	{
251	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbToCopy);
252	pszBuf[cbToCopy] = '\0';
253	rc = VINF_SUCCESS;
254	}
255	else
256	{
257	if (cbBuf)
258	{
259	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
260	pszBuf[cbBuf - 1] = '\0';
261	}
262	rc = VERR_BUFFER_OVERFLOW;
263	}
264	offDst = cbToCopy + 1;
265	}
266	else
267	{
268	/* Two chunks, read offset to end, start to write offset. */
269	uint32_t cbFirst = MsgBuf.msg_size - MsgBuf.msg_bufr;
270	uint32_t cbSecond = MsgBuf.msg_bufx;
271	if (cbFirst + cbSecond < cbBuf)
272	{
273	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
274	memcpy(&pszBuf[cbFirst], pchMsgBuf, cbSecond);
275	offDst = cbFirst + cbSecond;
276	pszBuf[offDst++] = '\0';
277	rc = VINF_SUCCESS;
278	}
279	else
280	{
281	offDst = cbFirst + cbSecond + 1;
282	if (cbFirst < cbBuf)
283	{
284	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
285	memcpy(&pszBuf[cbFirst], pchMsgBuf, cbBuf - cbFirst);
286	pszBuf[cbBuf - 1] = '\0';
287	}
288	else if (cbBuf)
289	{
290	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
291	pszBuf[cbBuf - 1] = '\0';
292	}
293	rc = VERR_BUFFER_OVERFLOW;
294	}
295	}
296
297	if (pcbActual)
298	*pcbActual = offDst;
299	}
300	else
301	Log(("dbgDiggerDarwinIDmsg_QueryKernelLog: Error reading %#x bytes at %RGv: %Rrc\n", MsgBuf.msg_size, MsgBuf.msg_bufc, rc));
302	RTMemFree(pchMsgBuf);
303	return rc;
304	}
305
306
307	/**
308	* @copydoc DBGFOSREG::pfnStackUnwindAssist
309	*/
310	static DECLCALLBACK(int) dbgDiggerDarwinStackUnwindAssist(PUVM pUVM, void *pvData, VMCPUID idCpu, PDBGFSTACKFRAME pFrame,
311	PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx, RTDBGAS hAs,
312	uint64_t *puScratch)
313	{
314	RT_NOREF(pUVM, pvData, idCpu, pFrame, pState, pInitialCtx, hAs, puScratch);
315	return VINF_SUCCESS;
316	}
317
318
319	/**
320	* @copydoc DBGFOSREG::pfnQueryInterface
321	*/
322	static DECLCALLBACK(void ) dbgDiggerDarwinQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
323	{
324	RT_NOREF1(pUVM);
325	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
326	switch (enmIf)
327	{
328	case DBGFOSINTERFACE_DMESG:
329	return &pThis->IDmesg;
330
331	default:
332	return NULL;
333	}
334	}
335
336
337	/**
338	* @copydoc DBGFOSREG::pfnQueryVersion
339	*/
340	static DECLCALLBACK(int) dbgDiggerDarwinQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
341	{
342	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
343	Assert(pThis->fValid);
344
345	/*
346	* It's all in the linux banner.
347	*/
348	int rc = DBGFR3MemReadString(pUVM, 0, &pThis->AddrKernelVersion, pszVersion, cchVersion);
349	if (RT_SUCCESS(rc))
350	{
351	char *pszEnd = RTStrEnd(pszVersion, cchVersion);
352	AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
353	while ( pszEnd > pszVersion
354	&& RT_C_IS_SPACE(pszEnd[-1]))
355	pszEnd--;
356	*pszEnd = '\0';
357	}
358	else
359	RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
360
361	return rc;
362	}
363
364
365	/**
366	* @copydoc DBGFOSREG::pfnTerm
367	*/
368	static DECLCALLBACK(void) dbgDiggerDarwinTerm(PUVM pUVM, void *pvData)
369	{
370	RT_NOREF1(pUVM);
371	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
372
373	pThis->fValid = false;
374	}
375
376
377	/**
378	* @copydoc DBGFOSREG::pfnRefresh
379	*/
380	static DECLCALLBACK(int) dbgDiggerDarwinRefresh(PUVM pUVM, void *pvData)
381	{
382	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
383	NOREF(pThis);
384	Assert(pThis->fValid);
385
386	/*
387	* For now we'll flush and reload everything.
388	*/
389	dbgDiggerDarwinTerm(pUVM, pvData);
390	return dbgDiggerDarwinInit(pUVM, pvData);
391	}
392
393
394	/**
395	* Helper function that validates a segment (or section) name.
396	*
397	* @returns true if valid, false if not.
398	* @param pszName The name string.
399	* @param cbName The size of the string, including terminator.
400	*/
401	static bool dbgDiggerDarwinIsValidSegOrSectName(const char *pszName, size_t cbName)
402	{
403	/* ascii chars */
404	char ch;
405	size_t off = 0;
406	while (off < cbName && (ch = pszName[off]))
407	{
408	if (RT_C_IS_CNTRL(ch) \|\| ch >= 127)
409	return false;
410	off++;
411	}
412
413	/* Not empty nor 100% full. */
414	if (off == 0 \|\| off == cbName)
415	return false;
416
417	/* remainder should be zeros. */
418	while (off < cbName)
419	{
420	if (pszName[off])
421	return false;
422	off++;
423	}
424
425	return true;
426	}
427
428
429	static int dbgDiggerDarwinAddModule(PDBGDIGGERDARWIN pThis, PUVM pUVM, uint64_t uModAddr, const char pszName, bool pf64Bit)
430	{
431	RT_NOREF1(pThis);
432	union
433	{
434	uint8_t ab[2 * X86_PAGE_4K_SIZE];
435	mach_header_64_t Hdr64;
436	mach_header_32_t Hdr32;
437	} uBuf;
438
439	/* Read the first page of the image. */
440	DBGFADDRESS ModAddr;
441	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr), uBuf.ab, X86_PAGE_4K_SIZE);
442	if (RT_FAILURE(rc))
443	return rc;
444
445	/* Validate the header. */
446	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
447	if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
448	&& uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
449	return VERR_INVALID_EXE_SIGNATURE;
450	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
451	bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
452	if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
453	return VERR_LDR_ARCH_MISMATCH;
454	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
455	if ( uBuf.Hdr32.filetype != MH_EXECUTE
456	&& uBuf.Hdr32.filetype != (f64Bit ? MH_KEXT_BUNDLE : MH_OBJECT))
457	return VERR_BAD_EXE_FORMAT;
458	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
459	if (uBuf.Hdr32.ncmds > 256)
460	return VERR_BAD_EXE_FORMAT;
461	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
462	if (uBuf.Hdr32.sizeofcmds > X86_PAGE_4K_SIZE * 2 - sizeof(mach_header_64_t))
463	return VERR_BAD_EXE_FORMAT;
464
465	/* Do we need to read a 2nd page to get all the load commands? If so, do it. */
466	if (uBuf.Hdr32.sizeofcmds + (f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)) > X86_PAGE_4K_SIZE)
467	{
468	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr + X86_PAGE_4K_SIZE),
469	&uBuf.ab[X86_PAGE_4K_SIZE], X86_PAGE_4K_SIZE);
470	if (RT_FAILURE(rc))
471	return rc;
472	}
473
474	/*
475	* Process the load commands.
476	*/
477	RTDBGSEGMENT aSegs[24];
478	uint32_t cSegs = 0;
479	RTUUID Uuid = RTUUID_INITIALIZE_NULL;
480	uint32_t cLeft = uBuf.Hdr32.ncmds;
481	uint32_t cbLeft = uBuf.Hdr32.sizeofcmds;
482	union
483	{
484	uint8_t const *pb;
485	load_command_t const *pGenric;
486	segment_command_32_t const *pSeg32;
487	segment_command_64_t const *pSeg64;
488	section_32_t const *pSect32;
489	section_64_t const *pSect64;
490	symtab_command_t const *pSymTab;
491	uuid_command_t const *pUuid;
492	} uLCmd;
493	uLCmd.pb = &uBuf.ab[f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)];
494
495	while (cLeft-- > 0)
496	{
497	uint32_t const cbCmd = uLCmd.pGenric->cmdsize;
498	if (cbCmd > cbLeft \|\| cbCmd < sizeof(load_command_t))
499	return VERR_BAD_EXE_FORMAT;
500
501	switch (uLCmd.pGenric->cmd)
502	{
503	case LC_SEGMENT_32:
504	if (cbCmd != sizeof(segment_command_32_t) + uLCmd.pSeg32->nsects * sizeof(section_32_t))
505	return VERR_BAD_EXE_FORMAT;
506	if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg32->segname, sizeof(uLCmd.pSeg32->segname)))
507	return VERR_INVALID_NAME;
508	if (!strcmp(uLCmd.pSeg32->segname, "__LINKEDIT"))
509	break; /* This usually is discarded or not loaded at all. */
510	if (cSegs >= RT_ELEMENTS(aSegs))
511	return VERR_BUFFER_OVERFLOW;
512	aSegs[cSegs].Address = uLCmd.pSeg32->vmaddr;
513	aSegs[cSegs].uRva = uLCmd.pSeg32->vmaddr - uModAddr;
514	aSegs[cSegs].cb = uLCmd.pSeg32->vmsize;
515	aSegs[cSegs].fFlags = uLCmd.pSeg32->flags; /* Abusing the flags field here... */
516	aSegs[cSegs].iSeg = cSegs;
517	AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg32->segname));
518	strcpy(aSegs[cSegs].szName, uLCmd.pSeg32->segname);
519	cSegs++;
520	break;
521
522	case LC_SEGMENT_64:
523	if (cbCmd != sizeof(segment_command_64_t) + uLCmd.pSeg64->nsects * sizeof(section_64_t))
524	return VERR_BAD_EXE_FORMAT;
525	if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg64->segname, sizeof(uLCmd.pSeg64->segname)))
526	return VERR_INVALID_NAME;
527	if (!strcmp(uLCmd.pSeg64->segname, "__LINKEDIT"))
528	break; /* This usually is discarded or not loaded at all. */
529	if (cSegs >= RT_ELEMENTS(aSegs))
530	return VERR_BUFFER_OVERFLOW;
531	aSegs[cSegs].Address = uLCmd.pSeg64->vmaddr;
532	aSegs[cSegs].uRva = uLCmd.pSeg64->vmaddr - uModAddr;
533	aSegs[cSegs].cb = uLCmd.pSeg64->vmsize;
534	aSegs[cSegs].fFlags = uLCmd.pSeg64->flags; /* Abusing the flags field here... */
535	aSegs[cSegs].iSeg = cSegs;
536	AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg64->segname));
537	strcpy(aSegs[cSegs].szName, uLCmd.pSeg64->segname);
538	cSegs++;
539	break;
540
541	case LC_UUID:
542	if (cbCmd != sizeof(uuid_command_t))
543	return VERR_BAD_EXE_FORMAT;
544	if (RTUuidIsNull((PCRTUUID)&uLCmd.pUuid->uuid[0]))
545	return VERR_BAD_EXE_FORMAT;
546	memcpy(&Uuid, &uLCmd.pUuid->uuid[0], sizeof(uLCmd.pUuid->uuid));
547	break;
548
549	default:
550	/* Current known max plus a lot of slack. */
551	if (uLCmd.pGenric->cmd > LC_DYLIB_CODE_SIGN_DRS + 32)
552	return VERR_BAD_EXE_FORMAT;
553	break;
554	}
555
556	/* next */
557	cbLeft -= cbCmd;
558	uLCmd.pb += cbCmd;
559	}
560
561	if (cbLeft != 0)
562	return VERR_BAD_EXE_FORMAT;
563
564	/*
565	* Some post processing checks.
566	*/
567	uint32_t iSeg;
568	for (iSeg = 0; iSeg < cSegs; iSeg++)
569	if (aSegs[iSeg].Address == uModAddr)
570	break;
571	if (iSeg >= cSegs)
572	return VERR_ADDRESS_CONFLICT;
573
574	/*
575	* Create a debug module.
576	*/
577	RTDBGMOD hMod;
578	rc = RTDbgModCreateFromMachOImage(&hMod, pszName, NULL, f64Bit ? RTLDRARCH_AMD64 : RTLDRARCH_X86_32, 0 /cbImage/,
579	cSegs, aSegs, &Uuid, DBGFR3AsGetConfig(pUVM), RTDBGMOD_F_NOT_DEFERRED);
580
581	if (RT_FAILURE(rc))
582	{
583	/*
584	* Final fallback is a container module.
585	*/
586	rc = RTDbgModCreate(&hMod, pszName, 0, 0);
587	if (RT_FAILURE(rc))
588	return rc;
589
590	uint64_t uRvaNext = 0;
591	for (iSeg = 0; iSeg < cSegs && RT_SUCCESS(rc); iSeg++)
592	{
593	if ( aSegs[iSeg].uRva > uRvaNext
594	&& aSegs[iSeg].uRva - uRvaNext < _1M)
595	uRvaNext = aSegs[iSeg].uRva;
596	rc = RTDbgModSegmentAdd(hMod, aSegs[iSeg].uRva, aSegs[iSeg].cb, aSegs[iSeg].szName, 0, NULL);
597	if (aSegs[iSeg].cb > 0 && RT_SUCCESS(rc))
598	{
599	char szTmp[RTDBG_SEGMENT_NAME_LENGTH + sizeof("_start")];
600	strcat(strcpy(szTmp, aSegs[iSeg].szName), "_start");
601	rc = RTDbgModSymbolAdd(hMod, szTmp, iSeg, 0 /uRva/, 0 /cb/, 0 /fFlags/, NULL);
602	}
603	uRvaNext += aSegs[iSeg].cb;
604	}
605
606	if (RT_FAILURE(rc))
607	{
608	RTDbgModRelease(hMod);
609	return rc;
610	}
611	}
612
613	/* Tag the module. */
614	rc = RTDbgModSetTag(hMod, DIG_DARWIN_MOD_TAG);
615	AssertRC(rc);
616
617	/*
618	* Link the module.
619	*/
620	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
621	if (hAs != NIL_RTDBGAS)
622	{
623	//uint64_t uRvaNext = 0; - what was this?
624	uint32_t cLinked = 0;
625	iSeg = cSegs;
626	while (iSeg-- > 0) /* HACK: Map in reverse order to avoid replacing __TEXT. */
627	if (aSegs[iSeg].cb)
628	{
629	/* Find matching segment in the debug module. */
630	uint32_t iDbgSeg = 0;
631	while (iDbgSeg < cSegs)
632	{
633	RTDBGSEGMENT SegInfo;
634	int rc3 = RTDbgModSegmentByIndex(hMod, iDbgSeg, &SegInfo);
635	if (RT_SUCCESS(rc3) && !strcmp(SegInfo.szName, aSegs[iSeg].szName))
636	break;
637	iDbgSeg++;
638	}
639	AssertMsgStmt(iDbgSeg < cSegs, ("%s\n", aSegs[iSeg].szName), continue);
640
641	/* Map it. */
642	int rc2 = RTDbgAsModuleLinkSeg(hAs, hMod, iDbgSeg, aSegs[iSeg].Address, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
643	if (RT_SUCCESS(rc2))
644	cLinked++;
645	else if (RT_SUCCESS(rc))
646	rc = rc2;
647	}
648	if (RT_FAILURE(rc) && cLinked != 0)
649	rc = -rc;
650	}
651	else
652	rc = VERR_INTERNAL_ERROR;
653
654	RTDbgModRelease(hMod);
655	RTDbgAsRelease(hAs);
656
657	if (pf64Bit)
658	*pf64Bit = f64Bit;
659	return rc;
660	}
661
662
663	static bool dbgDiggerDarwinIsValidName(const char *pszName)
664	{
665	char ch;
666	while ((ch = *pszName++) != '\0')
667	{
668	if (ch < 0x20 \|\| ch >= 127)
669	return false;
670	}
671	return true;
672	}
673
674
675	static bool dbgDiggerDarwinIsValidVersion(const char *pszVersion)
676	{
677	char ch;
678	while ((ch = *pszVersion++) != '\0')
679	{
680	if (ch < 0x20 \|\| ch >= 127)
681	return false;
682	}
683	return true;
684	}
685
686
687	/**
688	* @copydoc DBGFOSREG::pfnInit
689	*/
690	static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, void *pvData)
691	{
692	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
693	Assert(!pThis->fValid);
694
695	/*
696	* Add the kernel module.
697	*/
698	bool f64Bit;
699	int rc = dbgDiggerDarwinAddModule(pThis, pUVM, pThis->AddrKernel.FlatPtr, "mach_kernel", &f64Bit);
700	if (RT_SUCCESS(rc))
701	{
702	/*
703	* The list of modules can be found at the 'kmod' symbol, that means
704	* that we currently require some kind of symbol file for the kernel
705	* to be loaded at this point.
706	*
707	* Note! Could also use the 'gLoadedKextSummaries', but I don't think
708	* it's any easier to find without any kernel map than 'kmod'.
709	*/
710	RTDBGSYMBOL SymInfo;
711	rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!kmod", &SymInfo, NULL);
712	if (RT_FAILURE(rc))
713	rc = DBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!_kmod", &SymInfo, NULL);
714	if (RT_SUCCESS(rc))
715	{
716	DBGFADDRESS AddrModInfo;
717	DBGFR3AddrFromFlat(pUVM, &AddrModInfo, SymInfo.Value);
718
719	/* Read the variable. */
720	RTUINT64U uKmodValue = { 0 };
721	if (f64Bit)
722	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrModInfo, &uKmodValue.u, sizeof(uKmodValue.u));
723	else
724	rc = DBGFR3MemRead (pUVM, 0 /idCpu/, &AddrModInfo, &uKmodValue.s.Lo, sizeof(uKmodValue.s.Lo));
725	if (RT_SUCCESS(rc))
726	{
727	DBGFR3AddrFromFlat(pUVM, &AddrModInfo, uKmodValue.u);
728
729	/* Walk the list of modules. */
730	uint32_t cIterations = 0;
731	while (AddrModInfo.FlatPtr != 0)
732	{
733	/* Some extra loop conditions... */
734	if (!OSX_VALID_ADDRESS(f64Bit, AddrModInfo.FlatPtr))
735	{
736	Log(("OSXDig: Invalid kmod_info pointer: %RGv\n", AddrModInfo.FlatPtr));
737	break;
738	}
739	if (AddrModInfo.FlatPtr == uKmodValue.u && cIterations != 0)
740	{
741	Log(("OSXDig: kmod_info list looped back to the start.\n"));
742	break;
743	}
744	if (cIterations++ >= 2048)
745	{
746	Log(("OSXDig: Too many mod_info loops (%u)\n", cIterations));
747	break;
748	}
749
750	/*
751	* Read the kmod_info_t structure.
752	*/
753	union
754	{
755	OSX64_kmod_info_t Info64;
756	OSX32_kmod_info_t Info32;
757	} uMod;
758	RT_ZERO(uMod);
759	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrModInfo, &uMod,
760	f64Bit ? sizeof(uMod.Info64) : sizeof(uMod.Info32));
761	if (RT_FAILURE(rc))
762	{
763	Log(("OSXDig: Error reading kmod_info structure at %RGv: %Rrc\n", AddrModInfo.FlatPtr, rc));
764	break;
765	}
766
767	/*
768	* Validate the kmod_info_t structure.
769	*/
770	int32_t iInfoVer = f64Bit ? uMod.Info64.info_version : uMod.Info32.info_version;
771	if (iInfoVer != OSX_KMOD_INFO_VERSION)
772	{
773	Log(("OSXDig: kmod_info @%RGv: Bad info_version %d\n", AddrModInfo.FlatPtr, iInfoVer));
774	break;
775	}
776
777	const char *pszName = f64Bit ? uMod.Info64.name : uMod.Info32.name;
778	if ( !*pszName
779	\|\| !RTStrEnd(pszName, sizeof(uMod.Info64.name))
780	\|\| !dbgDiggerDarwinIsValidName(pszName) )
781	{
782	Log(("OSXDig: kmod_info @%RGv: Bad name '%.*s'\n", AddrModInfo.FlatPtr,
783	sizeof(uMod.Info64.name), pszName));
784	break;
785	}
786
787	const char *pszVersion = f64Bit ? uMod.Info64.version : uMod.Info32.version;
788	if ( !RTStrEnd(pszVersion, sizeof(uMod.Info64.version))
789	\|\| !dbgDiggerDarwinIsValidVersion(pszVersion) )
790	{
791	Log(("OSXDig: kmod_info @%RGv: Bad version '%.*s'\n", AddrModInfo.FlatPtr,
792	sizeof(uMod.Info64.version), pszVersion));
793	break;
794	}
795
796	int32_t cRefs = f64Bit ? uMod.Info64.reference_count : uMod.Info32.reference_count;
797	if (cRefs < -1 \|\| cRefs > 16384)
798	{
799	Log(("OSXDig: kmod_info @%RGv: Bad reference_count %d\n", AddrModInfo.FlatPtr, cRefs));
800	break;
801	}
802
803	uint64_t uImageAddr = f64Bit ? uMod.Info64.address : uMod.Info32.address;
804	if (!OSX_VALID_ADDRESS(f64Bit, uImageAddr))
805	{
806	Log(("OSXDig: kmod_info @%RGv: Bad address %#llx\n", AddrModInfo.FlatPtr, uImageAddr));
807	break;
808	}
809
810	uint64_t cbImage = f64Bit ? uMod.Info64.size : uMod.Info32.size;
811	if (cbImage > 64U*_1M)
812	{
813	Log(("OSXDig: kmod_info @%RGv: Bad size %#llx\n", AddrModInfo.FlatPtr, cbImage));
814	break;
815	}
816
817	uint64_t cbHdr = f64Bit ? uMod.Info64.hdr_size : uMod.Info32.hdr_size;
818	if (cbHdr > 16U*_1M)
819	{
820	Log(("OSXDig: kmod_info @%RGv: Bad hdr_size %#llx\n", AddrModInfo.FlatPtr, cbHdr));
821	break;
822	}
823
824	uint64_t uStartAddr = f64Bit ? uMod.Info64.start : uMod.Info32.start;
825	if (!uStartAddr && !OSX_VALID_ADDRESS(f64Bit, uStartAddr))
826	{
827	Log(("OSXDig: kmod_info @%RGv: Bad start function %#llx\n", AddrModInfo.FlatPtr, uStartAddr));
828	break;
829	}
830
831	uint64_t uStopAddr = f64Bit ? uMod.Info64.stop : uMod.Info32.stop;
832	if (!uStopAddr && !OSX_VALID_ADDRESS(f64Bit, uStopAddr))
833	{
834	Log(("OSXDig: kmod_info @%RGv: Bad stop function %#llx\n", AddrModInfo.FlatPtr, uStopAddr));
835	break;
836	}
837
838	/*
839	* Try add the module.
840	*/
841	Log(("OSXDig: kmod_info @%RGv: '%s' ver '%s', image @%#llx LB %#llx cbHdr=%#llx\n", AddrModInfo.FlatPtr,
842	pszName, pszVersion, uImageAddr, cbImage, cbHdr));
843	rc = dbgDiggerDarwinAddModule(pThis, pUVM, uImageAddr, pszName, NULL);
844
845
846	/*
847	* Advance to the next kmod_info entry.
848	*/
849	DBGFR3AddrFromFlat(pUVM, &AddrModInfo, f64Bit ? uMod.Info64.next : uMod.Info32.next);
850	}
851	}
852	else
853	Log(("OSXDig: Error reading the 'kmod' variable: %Rrc\n", rc));
854	}
855	else
856	Log(("OSXDig: Failed to locate the 'kmod' variable in mach_kernel.\n"));
857
858	pThis->fValid = true;
859	return VINF_SUCCESS;
860	}
861
862	return rc;
863	}
864
865
866	/**
867	* @copydoc DBGFOSREG::pfnProbe
868	*/
869	static DECLCALLBACK(bool) dbgDiggerDarwinProbe(PUVM pUVM, void *pvData)
870	{
871	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
872
873	/*
874	* Look for a section + segment combo that normally only occures in
875	* mach_kernel. Follow it up with probing of the rest of the executable
876	* header. We must search a largish area because the more recent versions
877	* of darwin have random load address for security raisins.
878	*/
879	static struct { uint64_t uStart, uEnd; } const s_aRanges[] =
880	{
881	/* 64-bit: */
882	{ UINT64_C(0xffffff8000000000), UINT64_C(0xffffff81ffffffff), },
883
884	/* 32-bit - always search for this because of the hybrid 32-bit kernel
885	with cpu in long mode that darwin used for a number of versions. */
886	{ UINT64_C(0x00001000), UINT64_C(0x0ffff000), }
887	};
888	for (unsigned iRange = DBGFR3CpuGetMode(pUVM, 0 /idCpu/) != CPUMMODE_LONG;
889	iRange < RT_ELEMENTS(s_aRanges);
890	iRange++)
891	{
892	DBGFADDRESS KernelAddr;
893	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, s_aRanges[iRange].uStart);
894	KernelAddr.FlatPtr < s_aRanges[iRange].uEnd;
895	KernelAddr.FlatPtr += X86_PAGE_4K_SIZE)
896	{
897	static const uint8_t s_abNeedle[16 + 16] =
898	{
899	'_','_','t','e','x','t', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::sectname */
900	'_','_','K','L','D', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::segname. */
901	};
902
903	int rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, s_aRanges[iRange].uEnd - KernelAddr.FlatPtr,
904	1, s_abNeedle, sizeof(s_abNeedle), &KernelAddr);
905	if (RT_FAILURE(rc))
906	break;
907	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & X86_PAGE_4K_OFFSET_MASK);
908
909	/*
910	* Read the first page of the image and check the headers.
911	*/
912	union
913	{
914	uint8_t ab[X86_PAGE_4K_SIZE];
915	mach_header_64_t Hdr64;
916	mach_header_32_t Hdr32;
917	} uBuf;
918	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, uBuf.ab, X86_PAGE_4K_SIZE);
919	if (RT_FAILURE(rc))
920	continue;
921	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
922	if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
923	&& uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
924	continue;
925	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
926	bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
927	if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
928	continue;
929	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
930	if (uBuf.Hdr32.filetype != MH_EXECUTE)
931	continue;
932	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
933	if (uBuf.Hdr32.ncmds > 256)
934	continue;
935	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
936	if (uBuf.Hdr32.sizeofcmds > X86_PAGE_4K_SIZE * 2 - sizeof(mach_header_64_t))
937	continue;
938
939	/* Seems good enough for now.
940
941	If the above causes false positives, check the segments and make
942	sure there is a kernel version string in the right one. */
943	pThis->AddrKernel = KernelAddr;
944	pThis->f64Bit = f64Bit;
945
946	/*
947	* Finally, find the kernel version string.
948	*/
949	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, 32*_1M, 1, RT_STR_TUPLE("Darwin Kernel Version"),
950	&pThis->AddrKernelVersion);
951	if (RT_FAILURE(rc))
952	DBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelVersion, 0);
953	return true;
954	}
955	}
956	return false;
957	}
958
959
960	/**
961	* @copydoc DBGFOSREG::pfnDestruct
962	*/
963	static DECLCALLBACK(void) dbgDiggerDarwinDestruct(PUVM pUVM, void *pvData)
964	{
965	RT_NOREF2(pUVM, pvData);
966
967	}
968
969
970	/**
971	* @copydoc DBGFOSREG::pfnConstruct
972	*/
973	static DECLCALLBACK(int) dbgDiggerDarwinConstruct(PUVM pUVM, void *pvData)
974	{
975	RT_NOREF1(pUVM);
976	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
977
978	pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
979	pThis->IDmesg.pfnQueryKernelLog = dbgDiggerDarwinIDmsg_QueryKernelLog;
980	pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
981
982	return VINF_SUCCESS;
983	}
984
985
986	const DBGFOSREG g_DBGDiggerDarwin =
987	{
988	/* .u32Magic = */ DBGFOSREG_MAGIC,
989	/* .fFlags = */ 0,
990	/* .cbData = */ sizeof(DBGDIGGERDARWIN),
991	/* .szName = */ "Darwin",
992	/* .pfnConstruct = */ dbgDiggerDarwinConstruct,
993	/* .pfnDestruct = */ dbgDiggerDarwinDestruct,
994	/* .pfnProbe = */ dbgDiggerDarwinProbe,
995	/* .pfnInit = */ dbgDiggerDarwinInit,
996	/* .pfnRefresh = */ dbgDiggerDarwinRefresh,
997	/* .pfnTerm = */ dbgDiggerDarwinTerm,
998	/* .pfnQueryVersion = */ dbgDiggerDarwinQueryVersion,
999	/* .pfnQueryInterface = */ dbgDiggerDarwinQueryInterface,
1000	/* .pfnStackUnwindAssist = */ dbgDiggerDarwinStackUnwindAssist,
1001	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1002	};
1003

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInDarwin.cpp@ 78376

Download in other formats: