DBGPlugInWinNt.cpp@ 74882

Last change on this file since 74882 was 73493, checked in by vboxsync, 6 years ago
DBGF,DBGPluInWinNt: Produce more useful module names (e.g. stuff that works in DBGC). [doxygen]
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 45.4 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 73493 2018-08-03 16:05:18Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/vmm/cpumctx.h>
26	#include <VBox/vmm/mm.h>
27	#include <VBox/err.h>
28	#include <VBox/param.h>
29	#include <iprt/ctype.h>
30	#include <iprt/ldr.h>
31	#include <iprt/mem.h>
32	#include <iprt/path.h>
33	#include <iprt/stream.h>
34	#include <iprt/string.h>
35	#include <iprt/formats/pecoff.h>
36	#include <iprt/formats/mz.h>
37	#include <iprt/nt/nt-structures.h>
38
39
40	/*********************************************************************************************************************************
41	* Structures and Typedefs *
42	*********************************************************************************************************************************/
43
44	/** @name Internal WinNT structures
45	* @{ */
46	/**
47	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
48	* Tested with XP.
49	*/
50	typedef struct NTMTE32
51	{
52	struct
53	{
54	uint32_t Flink;
55	uint32_t Blink;
56	} InLoadOrderLinks,
57	InMemoryOrderModuleList,
58	InInitializationOrderModuleList;
59	uint32_t DllBase;
60	uint32_t EntryPoint;
61	/** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
62	* boot loader, for other images it looks like some kind of pointer. */
63	uint32_t SizeOfImage;
64	struct
65	{
66	uint16_t Length;
67	uint16_t MaximumLength;
68	uint32_t Buffer;
69	} FullDllName,
70	BaseDllName;
71	uint32_t Flags;
72	uint16_t LoadCount;
73	uint16_t TlsIndex;
74	/* ... there is more ... */
75	} NTMTE32;
76	typedef NTMTE32 *PNTMTE32;
77
78	/**
79	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
80	*/
81	typedef struct NTMTE64
82	{
83	struct
84	{
85	uint64_t Flink;
86	uint64_t Blink;
87	} InLoadOrderLinks, /*< 0x00 /
88	InMemoryOrderModuleList, /*< 0x10 /
89	InInitializationOrderModuleList; /*< 0x20 /
90	uint64_t DllBase; /*< 0x30 /
91	uint64_t EntryPoint; /*< 0x38 /
92	uint32_t SizeOfImage; /*< 0x40 /
93	uint32_t Alignment; /*< 0x44 /
94	struct
95	{
96	uint16_t Length; /*< 0x48,0x58 /
97	uint16_t MaximumLength; /*< 0x4a,0x5a /
98	uint32_t Alignment; /*< 0x4c,0x5c /
99	uint64_t Buffer; /*< 0x50,0x60 /
100	} FullDllName, /*< 0x48 /
101	BaseDllName; /*< 0x58 /
102	uint32_t Flags; /*< 0x68 /
103	uint16_t LoadCount; /*< 0x6c /
104	uint16_t TlsIndex; /*< 0x6e /
105	/* ... there is more ... */
106	} NTMTE64;
107	typedef NTMTE64 *PNTMTE64;
108
109	/** MTE union. */
110	typedef union NTMTE
111	{
112	NTMTE32 vX_32;
113	NTMTE64 vX_64;
114	} NTMTE;
115	typedef NTMTE *PNTMTE;
116
117
118	/**
119	* The essential bits of the KUSER_SHARED_DATA structure.
120	*/
121	typedef struct NTKUSERSHAREDDATA
122	{
123	uint32_t TickCountLowDeprecated;
124	uint32_t TickCountMultiplier;
125	struct
126	{
127	uint32_t LowPart;
128	int32_t High1Time;
129	int32_t High2Time;
130
131	} InterruptTime,
132	SystemTime,
133	TimeZoneBias;
134	uint16_t ImageNumberLow;
135	uint16_t ImageNumberHigh;
136	RTUTF16 NtSystemRoot[260];
137	uint32_t MaxStackTraceDepth;
138	uint32_t CryptoExponent;
139	uint32_t TimeZoneId;
140	uint32_t LargePageMinimum;
141	uint32_t Reserved2[7];
142	uint32_t NtProductType;
143	uint8_t ProductTypeIsValid;
144	uint8_t abPadding[3];
145	uint32_t NtMajorVersion;
146	uint32_t NtMinorVersion;
147	/* uint8_t ProcessorFeatures[64];
148	...
149	*/
150	} NTKUSERSHAREDDATA;
151	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
152
153	/** KI_USER_SHARED_DATA for i386 */
154	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
155	/** KI_USER_SHARED_DATA for AMD64 */
156	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
157
158	/** NTKUSERSHAREDDATA::NtProductType */
159	typedef enum NTPRODUCTTYPE
160	{
161	kNtProductType_Invalid = 0,
162	kNtProductType_WinNt = 1,
163	kNtProductType_LanManNt,
164	kNtProductType_Server
165	} NTPRODUCTTYPE;
166
167
168	/** NT image header union. */
169	typedef union NTHDRSU
170	{
171	IMAGE_NT_HEADERS32 vX_32;
172	IMAGE_NT_HEADERS64 vX_64;
173	} NTHDRS;
174	/** Pointer to NT image header union. */
175	typedef NTHDRS *PNTHDRS;
176	/** Pointer to const NT image header union. */
177	typedef NTHDRS const *PCNTHDRS;
178
179	/** @} */
180
181
182
183	typedef enum DBGDIGGERWINNTVER
184	{
185	DBGDIGGERWINNTVER_UNKNOWN,
186	DBGDIGGERWINNTVER_3_1,
187	DBGDIGGERWINNTVER_3_5,
188	DBGDIGGERWINNTVER_4_0,
189	DBGDIGGERWINNTVER_5_0,
190	DBGDIGGERWINNTVER_5_1,
191	DBGDIGGERWINNTVER_6_0
192	} DBGDIGGERWINNTVER;
193
194	/**
195	* WinNT guest OS digger instance data.
196	*/
197	typedef struct DBGDIGGERWINNT
198	{
199	/** Whether the information is valid or not.
200	* (For fending off illegal interface method calls.) */
201	bool fValid;
202	/** 32-bit (true) or 64-bit (false) */
203	bool f32Bit;
204	/** Set if NT 3.1 was detected.
205	* This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
206	bool fNt31;
207
208	/** The NT version. */
209	DBGDIGGERWINNTVER enmVer;
210	/** NTKUSERSHAREDDATA::NtProductType */
211	NTPRODUCTTYPE NtProductType;
212	/** NTKUSERSHAREDDATA::NtMajorVersion */
213	uint32_t NtMajorVersion;
214	/** NTKUSERSHAREDDATA::NtMinorVersion */
215	uint32_t NtMinorVersion;
216
217	/** The address of the ntoskrnl.exe image. */
218	DBGFADDRESS KernelAddr;
219	/** The address of the ntoskrnl.exe module table entry. */
220	DBGFADDRESS KernelMteAddr;
221	/** The address of PsLoadedModuleList. */
222	DBGFADDRESS PsLoadedModuleListAddr;
223	} DBGDIGGERWINNT;
224	/** Pointer to the linux guest OS digger instance data. */
225	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
226
227
228	/**
229	* The WinNT digger's loader reader instance data.
230	*/
231	typedef struct DBGDIGGERWINNTRDR
232	{
233	/** The VM handle (referenced). */
234	PUVM pUVM;
235	/** The image base. */
236	DBGFADDRESS ImageAddr;
237	/** The image size. */
238	uint32_t cbImage;
239	/** The file offset of the SizeOfImage field in the optional header if it
240	* needs patching, otherwise set to UINT32_MAX. */
241	uint32_t offSizeOfImage;
242	/** The correct image size. */
243	uint32_t cbCorrectImageSize;
244	/** Number of entries in the aMappings table. */
245	uint32_t cMappings;
246	/** Mapping hint. */
247	uint32_t iHint;
248	/** Mapping file offset to memory offsets, ordered by file offset. */
249	struct
250	{
251	/** The file offset. */
252	uint32_t offFile;
253	/** The size of this mapping. */
254	uint32_t cbMem;
255	/** The offset to the memory from the start of the image. */
256	uint32_t offMem;
257	} aMappings[1];
258	} DBGDIGGERWINNTRDR;
259	/** Pointer a WinNT loader reader instance data. */
260	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
261
262
263	/*********************************************************************************************************************************
264	* Defined Constants And Macros *
265	*********************************************************************************************************************************/
266	/** Validates a 32-bit Windows NT kernel address */
267	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
268	/** Validates a 64-bit Windows NT kernel address */
269	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
270	/** Validates a kernel address. */
271	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
272	/** Versioned and bitness wrapper. */
273	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
274
275	/** The length (in chars) of the kernel file name (no path). */
276	#define WINNT_KERNEL_BASE_NAME_LEN 12
277
278	/** WindowsNT on little endian ASCII systems. */
279	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
280
281
282	/*********************************************************************************************************************************
283	* Internal Functions *
284	*********************************************************************************************************************************/
285	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
286
287
288	/*********************************************************************************************************************************
289	* Global Variables *
290	*********************************************************************************************************************************/
291	/** Kernel names. */
292	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
293	{
294	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
295	};
296
297
298
299	/**
300	* Process a PE image found in guest memory.
301	*
302	* @param pThis The instance data.
303	* @param pUVM The user mode VM handle.
304	* @param pszName The module name.
305	* @param pszFilename The image filename.
306	* @param pImageAddr The image address.
307	* @param cbImage The size of the image.
308	*/
309	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char pszName, const char pszFilename,
310	PCDBGFADDRESS pImageAddr, uint32_t cbImage)
311	{
312	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
313
314	/*
315	* Do some basic validation first.
316	*/
317	if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
318	\|\| cbImage >= _1M * 256)
319	{
320	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
321	return;
322	}
323
324	/*
325	* Use the common in-memory module reader to create a debug module.
326	*/
327	RTERRINFOSTATIC ErrInfo;
328	RTDBGMOD hDbgMod = NIL_RTDBGMOD;
329	int rc = DBGFR3ModInMem(pUVM, pImageAddr, pThis->fNt31 ? DBGFMODINMEM_F_PE_NT31 : 0, pszName, pszFilename,
330	pThis->f32Bit ? RTLDRARCH_X86_32 : RTLDRARCH_AMD64, cbImage,
331	&hDbgMod, RTErrInfoInitStatic(&ErrInfo));
332	if (RT_SUCCESS(rc))
333	{
334	/*
335	* Tag the module.
336	*/
337	rc = RTDbgModSetTag(hDbgMod, DIG_WINNT_MOD_TAG);
338	AssertRC(rc);
339
340	/*
341	* Link the module.
342	*/
343	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
344	if (hAs != NIL_RTDBGAS)
345	rc = RTDbgAsModuleLink(hAs, hDbgMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
346	else
347	rc = VERR_INTERNAL_ERROR;
348	RTDbgModRelease(hDbgMod);
349	RTDbgAsRelease(hAs);
350	}
351	else if (RTErrInfoIsSet(&ErrInfo.Core))
352	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc - %s\n", pszName, rc, ErrInfo.Core.pszMsg));
353	else
354	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc\n", pszName, rc));
355	}
356
357
358	/**
359	* Generate a debugger compatible module name from a filename.
360	*
361	* @returns Pointer to module name (doesn't need to be pszName).
362	* @param pszFilename The source filename.
363	* @param pszName Buffer to put the module name in.
364	* @param cbName Buffer size.
365	*/
366	static const char dbgDiggerWintNtFilenameToModuleName(const char pszFilename, char *pszName, size_t cbName)
367	{
368	/* Skip to the filename part of the filename. :-) */
369	pszFilename = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
370
371	/* We try use 'nt' for the kernel. */
372	if ( RTStrICmpAscii(pszFilename, "ntoskrnl.exe") == 0
373	\|\| RTStrICmpAscii(pszFilename, "ntkrnlmp.exe") == 0)
374	return "nt";
375
376
377	/* Drop the extension if .dll or .sys. */
378	size_t cchFilename = strlen(pszFilename);
379	if ( cchFilename > 4
380	&& pszFilename[cchFilename - 4] == '.')
381	{
382	if ( RTStrICmpAscii(&pszFilename[cchFilename - 4], ".sys") == 0
383	\|\| RTStrICmpAscii(&pszFilename[cchFilename - 4], ".dll") == 0)
384	cchFilename -= 4;
385	}
386
387	/* Copy and do replacements. */
388	if (cchFilename >= cbName)
389	cchFilename = cbName - 1;
390	size_t off;
391	for (off = 0; off < cchFilename; off++)
392	{
393	char ch = pszFilename[off];
394	if (!RT_C_IS_ALNUM(ch))
395	ch = '_';
396	pszName[off] = ch;
397	}
398	pszName[off] = '\0';
399	return pszName;
400	}
401
402
403	/**
404	* @copydoc DBGFOSREG::pfnStackUnwindAssist
405	*/
406	static DECLCALLBACK(int) dbgDiggerWinNtStackUnwindAssist(PUVM pUVM, void *pvData, VMCPUID idCpu, PDBGFSTACKFRAME pFrame,
407	PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx, RTDBGAS hAs,
408	uint64_t *puScratch)
409	{
410	Assert(pInitialCtx);
411
412	/*
413	* We want to locate trap frames here. The trap frame structure contains
414	* the 64-bit IRET frame, so given unwind information it's easy to identify
415	* using the return type and frame address.
416	*/
417	if (pFrame->fFlags & DBGFSTACKFRAME_FLAGS_64BIT)
418	{
419	/*
420	* Is this a trap frame? If so, try read the trap frame.
421	*/
422	if ( pFrame->enmReturnType == RTDBGRETURNTYPE_IRET64
423	&& !(pFrame->AddrFrame.FlatPtr & 0x7)
424	&& WINNT64_VALID_ADDRESS(pFrame->AddrFrame.FlatPtr) )
425	{
426	KTRAP_FRAME_AMD64 TrapFrame;
427	RT_ZERO(TrapFrame);
428	uint64_t const uTrapFrameAddr = pFrame->AddrFrame.FlatPtr
429	- RT_UOFFSETOF(KTRAP_FRAME_AMD64, ErrCdOrXcptFrameOrS);
430	int rc = pState->pfnReadStack(pState, uTrapFrameAddr, sizeof(TrapFrame), &TrapFrame);
431	if (RT_SUCCESS(rc))
432	{
433	/* Valid? Not too much else we can check here (EFlags isn't
434	reliable in manually construct frames). */
435	if (TrapFrame.ExceptionActive <= 2)
436	{
437	pFrame->fFlags \|= DBGFSTACKFRAME_FLAGS_TRAP_FRAME;
438
439	/*
440	* Add sure 'register' information from the frame to the frame.
441	*
442	* To avoid code duplication, we do this in two steps in a loop.
443	* The first iteration only figures out how many registers we're
444	* going to save and allocates room for them. The second iteration
445	* does the actual adding.
446	*/
447	uint32_t cRegs = pFrame->cSureRegs;
448	PDBGFREGVALEX paSureRegs = NULL;
449	#define ADD_REG_NAMED(a_Type, a_ValMemb, a_Value, a_pszName) do { \
450	if (paSureRegs) \
451	{ \
452	paSureRegs[iReg].pszName = a_pszName;\
453	paSureRegs[iReg].enmReg = DBGFREG_END; \
454	paSureRegs[iReg].enmType = a_Type; \
455	paSureRegs[iReg].Value.a_ValMemb = (a_Value); \
456	} \
457	iReg++; \
458	} while (0)
459	#define MAYBE_ADD_GREG(a_Value, a_enmReg, a_idxReg) do { \
460	if (!(pState->u.x86.Loaded.s.fRegs & RT_BIT(a_idxReg))) \
461	{ \
462	if (paSureRegs) \
463	{ \
464	pState->u.x86.Loaded.s.fRegs \|= RT_BIT(a_idxReg); \
465	pState->u.x86.auRegs[a_idxReg] = (a_Value); \
466	paSureRegs[iReg].Value.u64 = (a_Value); \
467	paSureRegs[iReg].enmReg = a_enmReg; \
468	paSureRegs[iReg].enmType = DBGFREGVALTYPE_U64; \
469	paSureRegs[iReg].pszName = NULL; \
470	} \
471	iReg++; \
472	} \
473	} while (0)
474	for (unsigned iLoop = 0; iLoop < 2; iLoop++)
475	{
476	uint32_t iReg = pFrame->cSureRegs;
477	ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, uTrapFrameAddr, "TrapFrame");
478	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.ExceptionActive, "ExceptionActive");
479	if (TrapFrame.ExceptionActive == 0)
480	{
481	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.PreviousIrql, "PrevIrql");
482	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, (uint8_t)TrapFrame.ErrCdOrXcptFrameOrS, "IntNo");
483	}
484	else if ( TrapFrame.ExceptionActive == 1
485	&& TrapFrame.FaultIndicator == ((TrapFrame.ErrCdOrXcptFrameOrS >> 1) & 0x9))
486	ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, TrapFrame.FaultAddrOrCtxRecOrTS, "cr2-probably");
487	if (TrapFrame.SegCs & X86_SEL_RPL)
488	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "UserMode");
489	else
490	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "KernelMode");
491	if (TrapFrame.ExceptionActive <= 1)
492	{
493	MAYBE_ADD_GREG(TrapFrame.Rax, DBGFREG_RAX, X86_GREG_xAX);
494	MAYBE_ADD_GREG(TrapFrame.Rcx, DBGFREG_RCX, X86_GREG_xCX);
495	MAYBE_ADD_GREG(TrapFrame.Rdx, DBGFREG_RDX, X86_GREG_xDX);
496	MAYBE_ADD_GREG(TrapFrame.R8, DBGFREG_R8, X86_GREG_x8);
497	MAYBE_ADD_GREG(TrapFrame.R9, DBGFREG_R9, X86_GREG_x9);
498	MAYBE_ADD_GREG(TrapFrame.R10, DBGFREG_R10, X86_GREG_x10);
499	MAYBE_ADD_GREG(TrapFrame.R11, DBGFREG_R11, X86_GREG_x11);
500	}
501	else if (TrapFrame.ExceptionActive == 2)
502	{
503	MAYBE_ADD_GREG(TrapFrame.Rbx, DBGFREG_RBX, X86_GREG_xBX);
504	MAYBE_ADD_GREG(TrapFrame.Rsi, DBGFREG_RSI, X86_GREG_xSI);
505	MAYBE_ADD_GREG(TrapFrame.Rdi, DBGFREG_RDI, X86_GREG_xDI);
506	}
507	// MAYBE_ADD_GREG(TrapFrame.Rbp, DBGFREG_RBP, X86_GREG_xBP); - KiInterrupt[Sub]Dispatch* may leave this invalid.
508
509	/* Done? */
510	if (iLoop > 0)
511	{
512	Assert(cRegs == iReg);
513	break;
514	}
515
516	/* Resize the array, zeroing the extension. */
517	if (pFrame->cSureRegs)
518	paSureRegs = (PDBGFREGVALEX)MMR3HeapRealloc(pFrame->paSureRegs, iReg * sizeof(paSureRegs[0]));
519	else
520	paSureRegs = (PDBGFREGVALEX)MMR3HeapAllocU(pUVM, MM_TAG_DBGF_STACK, iReg * sizeof(paSureRegs[0]));
521	AssertReturn(paSureRegs, VERR_NO_MEMORY);
522
523	pFrame->paSureRegs = paSureRegs;
524	RT_BZERO(&paSureRegs[pFrame->cSureRegs], (iReg - pFrame->cSureRegs) * sizeof(paSureRegs[0]));
525	cRegs = iReg;
526	}
527	#undef ADD_REG_NAMED
528	#undef MAYBE_ADD_GREG
529
530	/* Commit the register update. */
531	pFrame->cSureRegs = cRegs;
532	}
533	}
534	}
535	}
536
537	RT_NOREF(pUVM, pvData, idCpu, hAs, pInitialCtx, puScratch);
538	return VINF_SUCCESS;
539	}
540
541
542	/**
543	* @copydoc DBGFOSREG::pfnQueryInterface
544	*/
545	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
546	{
547	RT_NOREF3(pUVM, pvData, enmIf);
548	return NULL;
549	}
550
551
552	/**
553	* @copydoc DBGFOSREG::pfnQueryVersion
554	*/
555	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
556	{
557	RT_NOREF1(pUVM);
558	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
559	Assert(pThis->fValid);
560	const char *pszNtProductType;
561	switch (pThis->NtProductType)
562	{
563	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
564	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
565	case kNtProductType_Server: pszNtProductType = "-Server"; break;
566	default: pszNtProductType = ""; break;
567	}
568	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
569	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
570	return VINF_SUCCESS;
571	}
572
573
574	/**
575	* @copydoc DBGFOSREG::pfnTerm
576	*/
577	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
578	{
579	RT_NOREF1(pUVM);
580	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
581	Assert(pThis->fValid);
582
583	/*
584	* As long as we're using our private LDR reader implementation,
585	* we must unlink and ditch the modules we created.
586	*/
587	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
588	if (hDbgAs != NIL_RTDBGAS)
589	{
590	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
591	while (iMod-- > 0)
592	{
593	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
594	if (hMod != NIL_RTDBGMOD)
595	{
596	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
597	{
598	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
599	AssertRC(rc);
600	}
601	RTDbgModRelease(hMod);
602	}
603	}
604	RTDbgAsRelease(hDbgAs);
605	}
606
607	pThis->fValid = false;
608	}
609
610
611	/**
612	* @copydoc DBGFOSREG::pfnRefresh
613	*/
614	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
615	{
616	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
617	NOREF(pThis);
618	Assert(pThis->fValid);
619
620	/*
621	* For now we'll flush and reload everything.
622	*/
623	dbgDiggerWinNtTerm(pUVM, pvData);
624
625	return dbgDiggerWinNtInit(pUVM, pvData);
626	}
627
628
629	/**
630	* @copydoc DBGFOSREG::pfnInit
631	*/
632	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
633	{
634	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
635	Assert(!pThis->fValid);
636
637	union
638	{
639	uint8_t au8[0x2000];
640	RTUTF16 wsz[0x2000/2];
641	NTKUSERSHAREDDATA UserSharedData;
642	} u;
643	DBGFADDRESS Addr;
644	int rc;
645
646	/*
647	* Figure the NT version.
648	*/
649	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
650	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
651	if (RT_SUCCESS(rc))
652	{
653	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
654	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
655	: kNtProductType_Invalid;
656	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
657	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
658	}
659	else if (pThis->fNt31)
660	{
661	pThis->NtProductType = kNtProductType_WinNt;
662	pThis->NtMajorVersion = 3;
663	pThis->NtMinorVersion = 1;
664	}
665	else
666	{
667	Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
668	return rc;
669	}
670
671	/*
672	* Dig out the module chain.
673	*/
674	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
675	Addr = pThis->KernelMteAddr;
676	do
677	{
678	/* Read the validate the MTE. */
679	NTMTE Mte;
680	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
681	if (RT_FAILURE(rc))
682	break;
683	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
684	{
685	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
686	break;
687	}
688	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
689	{
690	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
691	break;
692	}
693	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
694	{
695	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
696	break;
697	}
698	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
699	{
700	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
701	break;
702	}
703	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
704	{
705	Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
706	break;
707	}
708
709	uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
710	if ( !pThis->fNt31
711	&& ( cbImageMte > _256M
712	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
713	{
714	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
715	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
716	break;
717	}
718
719	/* Read the full name. */
720	DBGFADDRESS AddrName;
721	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
722	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
723	if (cbName < sizeof(u))
724	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
725	else
726	rc = VERR_OUT_OF_RANGE;
727	if (RT_FAILURE(rc))
728	{
729	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
730	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
731	if (cbName < sizeof(u))
732	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
733	else
734	rc = VERR_OUT_OF_RANGE;
735	}
736	if (RT_SUCCESS(rc))
737	{
738	u.wsz[cbName / 2] = '\0';
739
740	char *pszFilename;
741	rc = RTUtf16ToUtf8(u.wsz, &pszFilename);
742	if (RT_SUCCESS(rc))
743	{
744	char szModName[128];
745	const char *pszModName = dbgDiggerWintNtFilenameToModuleName(pszFilename, szModName, sizeof(szModName));
746
747	/* Read the start of the PE image and pass it along to a worker. */
748	DBGFADDRESS ImageAddr;
749	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
750	dbgDiggerWinNtProcessImage(pThis, pUVM, pszModName, pszFilename, &ImageAddr, cbImageMte);
751	RTStrFree(pszFilename);
752	}
753	}
754
755	/* next */
756	AddrPrev = Addr;
757	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
758	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
759	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
760
761	pThis->fValid = true;
762	return VINF_SUCCESS;
763	}
764
765
766	/**
767	* @copydoc DBGFOSREG::pfnProbe
768	*/
769	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
770	{
771	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
772	DBGFADDRESS Addr;
773	union
774	{
775	uint8_t au8[8192];
776	uint16_t au16[8192/2];
777	uint32_t au32[8192/4];
778	IMAGE_DOS_HEADER MzHdr;
779	RTUTF16 wsz[8192/2];
780	X86DESC64GATE a32Gates[X86_XCPT_PF + 1];
781	X86DESC64GATE a64Gates[X86_XCPT_PF + 1];
782	} u;
783
784	union
785	{
786	NTMTE32 v32;
787	NTMTE64 v64;
788	} uMte, uMte2, uMte3;
789
790	/*
791	* NT only runs in protected or long mode.
792	*/
793	CPUMMODE const enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
794	if (enmMode != CPUMMODE_PROTECTED && enmMode != CPUMMODE_LONG)
795	return false;
796	bool const f64Bit = enmMode == CPUMMODE_LONG;
797	uint64_t const uStart = f64Bit ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
798	uint64_t const uEnd = f64Bit ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
799
800	/*
801	* To approximately locate the kernel we examine the IDTR handlers.
802	*
803	* The exception/trap/fault handlers are all in NT kernel image, we pick
804	* KiPageFault here.
805	*/
806	uint64_t uIdtrBase = 0;
807	uint16_t uIdtrLimit = 0;
808	int rc = DBGFR3RegCpuQueryXdtr(pUVM, 0, DBGFREG_IDTR, &uIdtrBase, &uIdtrLimit);
809	AssertRCReturn(rc, false);
810
811	const uint16_t cbMinIdtr = (X86_XCPT_PF + 1) * (f64Bit ? sizeof(X86DESC64GATE) : sizeof(X86DESCGATE));
812	if (uIdtrLimit < cbMinIdtr)
813	return false;
814
815	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uIdtrBase), &u, cbMinIdtr);
816	if (RT_FAILURE(rc))
817	return false;
818
819	uint64_t uKrnlStart = uStart;
820	uint64_t uKrnlEnd = uEnd;
821	if (f64Bit)
822	{
823	uint64_t uHandler = u.a64Gates[X86_XCPT_PF].u16OffsetLow
824	\| ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16)
825	\| ((uint64_t)u.a64Gates[X86_XCPT_PF].u32OffsetTop << 32);
826	if (uHandler < uStart \|\| uHandler > uEnd)
827	return false;
828	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _512M;
829	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
830	}
831	else
832	{
833	uint32_t uHandler = u.a32Gates[X86_XCPT_PF].u16OffsetLow
834	\| ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16);
835	if (uHandler < uStart \|\| uHandler > uEnd)
836	return false;
837	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _64M;
838	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
839	}
840
841	/*
842	* Look for the PAGELK section name that seems to be a part of all kernels.
843	* Then try find the module table entry for it. Since it's the first entry
844	* in the PsLoadedModuleList we can easily validate the list head and report
845	* success.
846	*
847	* Note! We ASSUME the section name is 8 byte aligned.
848	*/
849	DBGFADDRESS KernelAddr;
850	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uKrnlStart);
851	KernelAddr.FlatPtr < uKrnlEnd;
852	KernelAddr.FlatPtr += PAGE_SIZE)
853	{
854	bool fNt31 = false;
855	DBGFADDRESS const RetryAddress = KernelAddr;
856	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
857	8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
858	if ( rc == VERR_DBGF_MEM_NOT_FOUND
859	&& enmMode != CPUMMODE_LONG)
860	{
861	/* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
862	following VirtualSize is zero, so check for that too. */
863	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
864	8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
865	fNt31 = true;
866	}
867	if (RT_FAILURE(rc))
868	break;
869	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
870
871	/* MZ + PE header. */
872	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
873	if ( RT_SUCCESS(rc)
874	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
875	&& !(u.MzHdr.e_lfanew & 0x7)
876	&& u.MzHdr.e_lfanew >= 0x080
877	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
878	{
879	if (enmMode != CPUMMODE_LONG)
880	{
881	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
882	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
883	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
884	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
885	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
886	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
887	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
888	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
889	)
890	{
891	/* Find the MTE. */
892	RT_ZERO(uMte);
893	uMte.v32.DllBase = KernelAddr.FlatPtr;
894	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
895	uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
896	DBGFADDRESS HitAddr;
897	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
898	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
899	while (RT_SUCCESS(rc))
900	{
901	/* check the name. */
902	DBGFADDRESS MteAddr = HitAddr;
903	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
904	&uMte2.v32, sizeof(uMte2.v32));
905	if ( RT_SUCCESS(rc)
906	&& uMte2.v32.DllBase == uMte.v32.DllBase
907	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
908	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
909	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
910	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
911	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
912	&& uMte2.v32.BaseDllName.Length <= 128
913	&& uMte2.v32.FullDllName.Length <= 260
914	)
915	{
916	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
917	u.wsz, uMte2.v32.BaseDllName.Length);
918	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
919	if ( RT_SUCCESS(rc)
920	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
921	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
922	)
923	)
924	{
925	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
926	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
927	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
928	if ( RT_SUCCESS(rc)
929	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
930	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
931	{
932	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
933	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
934	pThis->KernelAddr = KernelAddr;
935	pThis->KernelMteAddr = MteAddr;
936	pThis->PsLoadedModuleListAddr = Addr;
937	pThis->f32Bit = true;
938	pThis->fNt31 = fNt31;
939	return true;
940	}
941	}
942	else if (RT_SUCCESS(rc))
943	{
944	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
945	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
946	break; /* Not NT kernel */
947	}
948	}
949
950	/* next */
951	DBGFR3AddrAdd(&HitAddr, 4);
952	if (HitAddr.FlatPtr < uEnd)
953	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
954	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
955	else
956	rc = VERR_DBGF_MEM_NOT_FOUND;
957	}
958	}
959	}
960	else
961	{
962	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
963	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
964	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
965	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
966	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
967	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
968	== IMAGE_FILE_EXECUTABLE_IMAGE
969	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
970	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
971	)
972	{
973	/* Find the MTE. */
974	RT_ZERO(uMte.v64);
975	uMte.v64.DllBase = KernelAddr.FlatPtr;
976	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
977	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
978	DBGFADDRESS ScanAddr;
979	DBGFADDRESS HitAddr;
980	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
981	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
982	while (RT_SUCCESS(rc))
983	{
984	/* Read the start of the MTE and check some basic members. */
985	DBGFADDRESS MteAddr = HitAddr;
986	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
987	&uMte2.v64, sizeof(uMte2.v64));
988	if ( RT_SUCCESS(rc)
989	&& uMte2.v64.DllBase == uMte.v64.DllBase
990	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
991	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
992	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
993	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
994	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
995	&& uMte2.v64.BaseDllName.Length <= 128
996	&& uMte2.v64.FullDllName.Length <= 260
997	)
998	{
999	/* Try read the base name and compare with known NT kernel names. */
1000	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1001	u.wsz, uMte2.v64.BaseDllName.Length);
1002	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1003	if ( RT_SUCCESS(rc)
1004	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1005	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1006	)
1007	)
1008	{
1009	/* Read the link entry of the previous entry in the list and check that its
1010	forward pointer points at the MTE we've found. */
1011	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1012	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1013	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1014	if ( RT_SUCCESS(rc)
1015	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1016	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1017	{
1018	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1019	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1020	pThis->KernelAddr = KernelAddr;
1021	pThis->KernelMteAddr = MteAddr;
1022	pThis->PsLoadedModuleListAddr = Addr;
1023	pThis->f32Bit = false;
1024	pThis->fNt31 = false;
1025	return true;
1026	}
1027	}
1028	else if (RT_SUCCESS(rc))
1029	{
1030	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1031	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1032	break; /* Not NT kernel */
1033	}
1034	}
1035
1036	/* next */
1037	DBGFR3AddrAdd(&HitAddr, 8);
1038	if (HitAddr.FlatPtr < uEnd)
1039	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1040	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1041	else
1042	rc = VERR_DBGF_MEM_NOT_FOUND;
1043	}
1044	}
1045	}
1046	}
1047	}
1048	return false;
1049	}
1050
1051
1052	/**
1053	* @copydoc DBGFOSREG::pfnDestruct
1054	*/
1055	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1056	{
1057	RT_NOREF2(pUVM, pvData);
1058	}
1059
1060
1061	/**
1062	* @copydoc DBGFOSREG::pfnConstruct
1063	*/
1064	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1065	{
1066	RT_NOREF1(pUVM);
1067	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1068	pThis->fValid = false;
1069	pThis->f32Bit = false;
1070	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1071	return VINF_SUCCESS;
1072	}
1073
1074
1075	const DBGFOSREG g_DBGDiggerWinNt =
1076	{
1077	/* .u32Magic = */ DBGFOSREG_MAGIC,
1078	/* .fFlags = */ 0,
1079	/* .cbData = */ sizeof(DBGDIGGERWINNT),
1080	/* .szName = */ "WinNT",
1081	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1082	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1083	/* .pfnProbe = */ dbgDiggerWinNtProbe,
1084	/* .pfnInit = */ dbgDiggerWinNtInit,
1085	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1086	/* .pfnTerm = */ dbgDiggerWinNtTerm,
1087	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1088	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1089	/* .pfnStackUnwindAssist = */ dbgDiggerWinNtStackUnwindAssist,
1090	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1091	};
1092

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 74882

Download in other formats: