DBGPlugInWinNt.cpp@ 58944

Last change on this file since 58944 was 58742, checked in by vboxsync, 9 years ago
Various: Use our pecoff.h and mz.h instead of the internal IPRT headers.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 47.5 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 58742 2015-11-18 12:39:05Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF ///@todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/err.h>
26	#include <VBox/param.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/string.h>
31	#include <iprt/formats/pecoff.h>
32	#include <iprt/formats/mz.h>
33
34
35	/*********************************************************************************************************************************
36	* Structures and Typedefs *
37	*********************************************************************************************************************************/
38
39	/** @name Internal WinNT structures
40	* @{ */
41	/**
42	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
43	* Tested with XP.
44	*/
45	typedef struct NTMTE32
46	{
47	struct
48	{
49	uint32_t Flink;
50	uint32_t Blink;
51	} InLoadOrderLinks,
52	InMemoryOrderModuleList,
53	InInitializationOrderModuleList;
54	uint32_t DllBase;
55	uint32_t EntryPoint;
56	uint32_t SizeOfImage;
57	struct
58	{
59	uint16_t Length;
60	uint16_t MaximumLength;
61	uint32_t Buffer;
62	} FullDllName,
63	BaseDllName;
64	uint32_t Flags;
65	uint16_t LoadCount;
66	uint16_t TlsIndex;
67	/* ... there is more ... */
68	} NTMTE32;
69	typedef NTMTE32 *PNTMTE32;
70
71	/**
72	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
73	*/
74	typedef struct NTMTE64
75	{
76	struct
77	{
78	uint64_t Flink;
79	uint64_t Blink;
80	} InLoadOrderLinks, /*< 0x00 /
81	InMemoryOrderModuleList, /*< 0x10 /
82	InInitializationOrderModuleList; /*< 0x20 /
83	uint64_t DllBase; /*< 0x30 /
84	uint64_t EntryPoint; /*< 0x38 /
85	uint32_t SizeOfImage; /*< 0x40 /
86	uint32_t Alignment; /*< 0x44 /
87	struct
88	{
89	uint16_t Length; /*< 0x48,0x58 /
90	uint16_t MaximumLength; /*< 0x4a,0x5a /
91	uint32_t Alignment; /*< 0x4c,0x5c /
92	uint64_t Buffer; /*< 0x50,0x60 /
93	} FullDllName, /*< 0x48 /
94	BaseDllName; /*< 0x58 /
95	uint32_t Flags; /*< 0x68 /
96	uint16_t LoadCount; /*< 0x6c /
97	uint16_t TlsIndex; /*< 0x6e /
98	/* ... there is more ... */
99	} NTMTE64;
100	typedef NTMTE64 *PNTMTE64;
101
102	/** MTE union. */
103	typedef union NTMTE
104	{
105	NTMTE32 vX_32;
106	NTMTE64 vX_64;
107	} NTMTE;
108	typedef NTMTE *PNTMTE;
109
110
111	/**
112	* The essential bits of the KUSER_SHARED_DATA structure.
113	*/
114	typedef struct NTKUSERSHAREDDATA
115	{
116	uint32_t TickCountLowDeprecated;
117	uint32_t TickCountMultiplier;
118	struct
119	{
120	uint32_t LowPart;
121	int32_t High1Time;
122	int32_t High2Time;
123
124	} InterruptTime,
125	SystemTime,
126	TimeZoneBias;
127	uint16_t ImageNumberLow;
128	uint16_t ImageNumberHigh;
129	RTUTF16 NtSystemRoot[260];
130	uint32_t MaxStackTraceDepth;
131	uint32_t CryptoExponent;
132	uint32_t TimeZoneId;
133	uint32_t LargePageMinimum;
134	uint32_t Reserved2[7];
135	uint32_t NtProductType;
136	uint8_t ProductTypeIsValid;
137	uint8_t abPadding[3];
138	uint32_t NtMajorVersion;
139	uint32_t NtMinorVersion;
140	/* uint8_t ProcessorFeatures[64];
141	...
142	*/
143	} NTKUSERSHAREDDATA;
144	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
145
146	/** KI_USER_SHARED_DATA for i386 */
147	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
148	/** KI_USER_SHARED_DATA for AMD64 */
149	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
150
151	/** NTKUSERSHAREDDATA::NtProductType */
152	typedef enum NTPRODUCTTYPE
153	{
154	kNtProductType_Invalid = 0,
155	kNtProductType_WinNt = 1,
156	kNtProductType_LanManNt,
157	kNtProductType_Server
158	} NTPRODUCTTYPE;
159
160
161	/** NT image header union. */
162	typedef union NTHDRSU
163	{
164	IMAGE_NT_HEADERS32 vX_32;
165	IMAGE_NT_HEADERS64 vX_64;
166	} NTHDRS;
167	/** Pointer to NT image header union. */
168	typedef NTHDRS *PNTHDRS;
169	/** Pointer to const NT image header union. */
170	typedef NTHDRS const *PCNTHDRS;
171
172	/** @} */
173
174
175
176	typedef enum DBGDIGGERWINNTVER
177	{
178	DBGDIGGERWINNTVER_UNKNOWN,
179	DBGDIGGERWINNTVER_3_1,
180	DBGDIGGERWINNTVER_3_5,
181	DBGDIGGERWINNTVER_4_0,
182	DBGDIGGERWINNTVER_5_0,
183	DBGDIGGERWINNTVER_5_1,
184	DBGDIGGERWINNTVER_6_0
185	} DBGDIGGERWINNTVER;
186
187	/**
188	* WinNT guest OS digger instance data.
189	*/
190	typedef struct DBGDIGGERWINNT
191	{
192	/** Whether the information is valid or not.
193	* (For fending off illegal interface method calls.) */
194	bool fValid;
195	/** 32-bit (true) or 64-bit (false) */
196	bool f32Bit;
197
198	/** The NT version. */
199	DBGDIGGERWINNTVER enmVer;
200	/** NTKUSERSHAREDDATA::NtProductType */
201	NTPRODUCTTYPE NtProductType;
202	/** NTKUSERSHAREDDATA::NtMajorVersion */
203	uint32_t NtMajorVersion;
204	/** NTKUSERSHAREDDATA::NtMinorVersion */
205	uint32_t NtMinorVersion;
206
207	/** The address of the ntoskrnl.exe image. */
208	DBGFADDRESS KernelAddr;
209	/** The address of the ntoskrnl.exe module table entry. */
210	DBGFADDRESS KernelMteAddr;
211	/** The address of PsLoadedModuleList. */
212	DBGFADDRESS PsLoadedModuleListAddr;
213	} DBGDIGGERWINNT;
214	/** Pointer to the linux guest OS digger instance data. */
215	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
216
217
218	/**
219	* The WinNT digger's loader reader instance data.
220	*/
221	typedef struct DBGDIGGERWINNTRDR
222	{
223	/** The VM handle (referenced). */
224	PUVM pUVM;
225	/** The image base. */
226	DBGFADDRESS ImageAddr;
227	/** The image size. */
228	uint32_t cbImage;
229	/** The file offset of the SizeOfImage field in the optional header if it
230	* needs patching, otherwise set to UINT32_MAX. */
231	uint32_t offSizeOfImage;
232	/** The correct image size. */
233	uint32_t cbCorrectImageSize;
234	/** Number of entries in the aMappings table. */
235	uint32_t cMappings;
236	/** Mapping hint. */
237	uint32_t iHint;
238	/** Mapping file offset to memory offsets, ordered by file offset. */
239	struct
240	{
241	/** The file offset. */
242	uint32_t offFile;
243	/** The size of this mapping. */
244	uint32_t cbMem;
245	/** The offset to the memory from the start of the image. */
246	uint32_t offMem;
247	} aMappings[1];
248	} DBGDIGGERWINNTRDR;
249	/** Pointer a WinNT loader reader instance data. */
250	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
251
252
253	/*********************************************************************************************************************************
254	* Defined Constants And Macros *
255	*********************************************************************************************************************************/
256	/** Validates a 32-bit Windows NT kernel address */
257	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
258	/** Validates a 64-bit Windows NT kernel address */
259	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
260	/** Validates a kernel address. */
261	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
262	/** Versioned and bitness wrapper. */
263	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
264
265	/** The length (in chars) of the kernel file name (no path). */
266	#define WINNT_KERNEL_BASE_NAME_LEN 12
267
268	/** WindowsNT on little endian ASCII systems. */
269	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
270
271
272	/*********************************************************************************************************************************
273	* Internal Functions *
274	*********************************************************************************************************************************/
275	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
276
277
278	/*********************************************************************************************************************************
279	* Global Variables *
280	*********************************************************************************************************************************/
281	/** Kernel names. */
282	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
283	{
284	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
285	};
286
287
288
289	/** @callback_method_impl{PFNRTLDRRDRMEMREAD} */
290	static DECLCALLBACK(int) dbgDiggerWinNtRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
291	{
292	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
293	uint32_t offFile = (uint32_t)off;
294	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
295
296	uint32_t i = pThis->iHint;
297	if (pThis->aMappings[i].offFile > offFile)
298	{
299	i = pThis->cMappings;
300	while (i-- > 0)
301	if (offFile >= pThis->aMappings[i].offFile)
302	break;
303	pThis->iHint = i;
304	}
305
306	while (cb > 0)
307	{
308	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
309	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
310
311	/* Read file bits backed by memory. */
312	if (offMap < pThis->aMappings[i].cbMem)
313	{
314	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
315	if (cbToRead > cb)
316	cbToRead = (uint32_t)cb;
317
318	DBGFADDRESS Addr = pThis->ImageAddr;
319	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
320
321	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
322	if (RT_FAILURE(rc))
323	return rc;
324
325	/* Apply SizeOfImage patch? */
326	if ( pThis->offSizeOfImage != UINT32_MAX
327	&& offFile < pThis->offSizeOfImage + 4
328	&& offFile + cbToRead > pThis->offSizeOfImage)
329	{
330	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
331	uint32_t cbPatch = sizeof(SizeOfImage);
332	int32_t offPatch = pThis->offSizeOfImage - offFile;
333	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
334	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
335	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
336	while (cbPatch-- > 0)
337	{
338	if (offPatch >= 0)
339	*pbPatch = (uint8_t)SizeOfImage;
340	offPatch++;
341	pbPatch++;
342	SizeOfImage >>= 8;
343	}
344	}
345
346	/* Done? */
347	if (cbToRead == cb)
348	break;
349
350	offFile += cbToRead;
351	cb -= cbToRead;
352	pvBuf = (char *)pvBuf + cbToRead;
353	}
354
355	/* Mind the gap. */
356	if (offNextMap > offFile)
357	{
358	uint32_t cbZero = offNextMap - offFile;
359	if (cbZero > cb)
360	{
361	RT_BZERO(pvBuf, cb);
362	break;
363	}
364
365	RT_BZERO(pvBuf, cbZero);
366	offFile += cbZero;
367	cb -= cbZero;
368	pvBuf = (char *)pvBuf + cbZero;
369	}
370
371	pThis->iHint = ++i;
372	}
373
374	return VINF_SUCCESS;
375	}
376
377
378	/** @callback_method_impl{PFNRTLDRRDRMEMDTOR} */
379	static DECLCALLBACK(void) dbgDiggerWinNtRdr_Dtor(void *pvUser)
380	{
381	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
382
383	VMR3ReleaseUVM(pThis->pUVM);
384	pThis->pUVM = NULL;
385	RTMemFree(pvUser);
386	}
387
388
389	/**
390	* Checks if the section headers look okay.
391	*
392	* @returns true / false.
393	* @param paShs Pointer to the section headers.
394	* @param cShs Number of headers.
395	* @param cbImage The image size reported by NT.
396	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
397	* no resource directory.
398	* @param cbSectAlign The section alignment specified in the header.
399	* @param pcbImageCorrect The corrected image size. This is derived from
400	* cbImage and virtual range of the section tables.
401	*
402	* The problem is that NT may choose to drop the
403	* last pages in images it loads early, starting at
404	* the resource directory. These images will have
405	* a page aligned cbImage.
406	*/
407	static bool dbgDiggerWinNtCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShs, uint32_t cShs, uint32_t cbImage,
408	uint32_t uRvaRsrc, uint32_t cbSectAlign, uint32_t *pcbImageCorrect)
409	{
410	*pcbImageCorrect = cbImage;
411
412	for (uint32_t i = 0; i < cShs; i++)
413	{
414	if (!paShs[i].Name[0])
415	{
416	Log(("DigWinNt: Section header #%u has no name\n", i));
417	return false;
418	}
419
420	if (paShs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
421	continue;
422
423	/* Check that sizes are within the same range and that both sizes and
424	addresses are within reasonable limits. */
425	if ( RT_ALIGN(paShs[i].Misc.VirtualSize, _64K) < RT_ALIGN(paShs[i].SizeOfRawData, _64K)
426	\|\| paShs[i].Misc.VirtualSize >= _1G
427	\|\| paShs[i].SizeOfRawData >= _1G)
428	{
429	Log(("DigWinNt: Section header #%u has a VirtualSize=%#x and SizeOfRawData=%#x, that's too much data!\n",
430	i, paShs[i].Misc.VirtualSize, paShs[i].SizeOfRawData));
431	return false;
432	}
433	uint32_t uRvaEnd = paShs[i].VirtualAddress + paShs[i].Misc.VirtualSize;
434	if (uRvaEnd >= _1G \|\| uRvaEnd < paShs[i].VirtualAddress)
435	{
436	Log(("DigWinNt: Section header #%u has a VirtualSize=%#x and VirtualAddr=%#x, %#x in total, that's too much!\n",
437	i, paShs[i].Misc.VirtualSize, paShs[i].VirtualAddress, uRvaEnd));
438	return false;
439	}
440
441	/* Check for images chopped off around '.rsrc'. */
442	if ( cbImage < uRvaEnd
443	&& uRvaEnd >= uRvaRsrc)
444	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
445
446	/* Check that the section is within the image. */
447	if (uRvaEnd > cbImage)
448	{
449	Log(("DigWinNt: Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x\n",
450	i, paShs[i].VirtualAddress, uRvaEnd, cbImage));
451	return false;
452	}
453	}
454
455	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
456	*pcbImageCorrect = cbImage;
457	return true;
458	}
459
460
461	/**
462	* Create a loader module for the in-guest-memory PE module.
463	*/
464	static int dbgDiggerWinNtCreateLdrMod(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName, PCDBGFADDRESS pImageAddr,
465	uint32_t cbImage, uint8_t *pbBuf, size_t cbBuf,
466	uint32_t offHdrs, PCNTHDRS pHdrs, PRTLDRMOD phLdrMod)
467	{
468	/*
469	* Allocate and create a reader instance.
470	*/
471	uint32_t const cShs = WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections);
472	PDBGDIGGERWINNTRDR pRdr = (PDBGDIGGERWINNTRDR)RTMemAlloc(RT_OFFSETOF(DBGDIGGERWINNTRDR, aMappings[cShs + 2]));
473	if (!pRdr)
474	return VERR_NO_MEMORY;
475
476	VMR3RetainUVM(pUVM);
477	pRdr->pUVM = pUVM;
478	pRdr->ImageAddr = *pImageAddr;
479	pRdr->cbImage = cbImage;
480	pRdr->cbCorrectImageSize = cbImage;
481	pRdr->offSizeOfImage = UINT32_MAX;
482	pRdr->iHint = 0;
483
484	/*
485	* Use the section table to construct a more accurate view of the file/
486	* image if it's in the buffer (it should be).
487	*/
488	uint32_t uRvaRsrc = UINT32_MAX;
489	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).Size > 0)
490	uRvaRsrc = WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress;
491	uint32_t offShs = offHdrs
492	+ ( pThis->f32Bit
493	? pHdrs->vX_32.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
494	: pHdrs->vX_64.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader));
495	uint32_t cbShs = cShs * sizeof(IMAGE_SECTION_HEADER);
496	PCIMAGE_SECTION_HEADER paShs = (PCIMAGE_SECTION_HEADER)(pbBuf + offShs);
497	if ( offShs + cbShs <= RT_MIN(cbImage, cbBuf)
498	&& dbgDiggerWinNtCheckSectHdrsAndImgSize(paShs, cShs, cbImage, uRvaRsrc,
499	WINNT_UNION(pThis, pHdrs, OptionalHeader.SectionAlignment),
500	&pRdr->cbCorrectImageSize))
501	{
502	pRdr->cMappings = 0;
503
504	for (uint32_t i = 0; i < cShs; i++)
505	if ( paShs[i].SizeOfRawData > 0
506	&& paShs[i].PointerToRawData > 0)
507	{
508	uint32_t j = 1;
509	if (!pRdr->cMappings)
510	pRdr->cMappings++;
511	else
512	{
513	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShs[i].PointerToRawData)
514	j++;
515	if (j < pRdr->cMappings)
516	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
517	}
518	pRdr->aMappings[j].offFile = paShs[i].PointerToRawData;
519	pRdr->aMappings[j].offMem = paShs[i].VirtualAddress;
520	pRdr->aMappings[j].cbMem = i + 1 < cShs
521	? paShs[i + 1].VirtualAddress - paShs[i].VirtualAddress
522	: paShs[i].Misc.VirtualSize;
523	if (j == pRdr->cMappings)
524	pRdr->cbImage = paShs[i].PointerToRawData + paShs[i].SizeOfRawData;
525	pRdr->cMappings++;
526	}
527
528	/* Insert the mapping of the headers that isn't covered by the section table. */
529	pRdr->aMappings[0].offFile = 0;
530	pRdr->aMappings[0].offMem = 0;
531	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
532
533	int j = pRdr->cMappings - 1;
534	while (j-- > 0)
535	{
536	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
537	if (pRdr->aMappings[j].cbMem > cbFile)
538	pRdr->aMappings[j].cbMem = cbFile;
539	}
540	}
541	else
542	{
543	/*
544	* Fallback, fake identity mapped file data.
545	*/
546	pRdr->cMappings = 1;
547	pRdr->aMappings[0].offFile = 0;
548	pRdr->aMappings[0].offMem = 0;
549	pRdr->aMappings[0].cbMem = pRdr->cbImage;
550	}
551
552	/* Enable the SizeOfImage patching if necessary. */
553	if (pRdr->cbCorrectImageSize != cbImage)
554	{
555	Log(("DigWinNT: The image is really %#x bytes long, not %#x as mapped by NT!\n", pRdr->cbCorrectImageSize, cbImage));
556	pRdr->offSizeOfImage = pThis->f32Bit
557	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
558	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
559	}
560
561	/*
562	* Call the loader to open the PE image for debugging.
563	* Note! It always calls pfnDtor.
564	*/
565	RTLDRMOD hLdrMod;
566	int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
567	dbgDiggerWinNtRdr_Read, dbgDiggerWinNtRdr_Dtor, pRdr,
568	&hLdrMod);
569	if (RT_SUCCESS(rc))
570	*phLdrMod = hLdrMod;
571	else
572	*phLdrMod = NIL_RTLDRMOD;
573	return rc;
574	}
575
576
577	/**
578	* Process a PE image found in guest memory.
579	*
580	* @param pThis The instance data.
581	* @param pUVM The user mode VM handle.
582	* @param pszName The image name.
583	* @param pImageAddr The image address.
584	* @param cbImage The size of the image.
585	* @param pbBuf Scratch buffer containing the first
586	* RT_MIN(cbBuf, cbImage) bytes of the image.
587	* @param cbBuf The scratch buffer size.
588	*/
589	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
590	PCDBGFADDRESS pImageAddr, uint32_t cbImage,
591	uint8_t *pbBuf, size_t cbBuf)
592	{
593	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
594
595	/*
596	* Do some basic validation first.
597	* This is the usual exteremely verbose and messy code...
598	*/
599	Assert(cbBuf >= sizeof(IMAGE_NT_HEADERS64));
600	if ( cbImage < sizeof(IMAGE_NT_HEADERS64)
601	\|\| cbImage >= _1M * 256)
602	{
603	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
604	return;
605	}
606
607	/* Dig out the NT/PE headers. */
608	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbBuf;
609	PCNTHDRS pHdrs;
610	uint32_t offHdrs;
611	if (pMzHdr->e_magic != IMAGE_DOS_SIGNATURE)
612	{
613	offHdrs = 0;
614	pHdrs = (PCNTHDRS)pbBuf;
615	}
616	else if ( pMzHdr->e_lfanew >= cbImage
617	\|\| pMzHdr->e_lfanew < sizeof(*pMzHdr)
618	\|\| pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) > cbImage)
619	{
620	Log(("DigWinNt: %s: PE header to far into image: %#x cbImage=%#x\n", pszName, pMzHdr->e_lfanew, cbImage));
621	return;
622	}
623	else if ( pMzHdr->e_lfanew < cbBuf
624	&& pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) <= cbBuf)
625	{
626	offHdrs = pMzHdr->e_lfanew;
627	pHdrs = (NTHDRS const *)(pbBuf + offHdrs);
628	}
629	else
630	{
631	Log(("DigWinNt: %s: PE header to far into image (lazy bird): %#x\n", pszName, pMzHdr->e_lfanew));
632	return;
633	}
634	if (pHdrs->vX_32.Signature != IMAGE_NT_SIGNATURE)
635	{
636	Log(("DigWinNt: %s: Bad PE signature: %#x\n", pszName, pHdrs->vX_32.Signature));
637	return;
638	}
639
640	/* The file header is the same on both archs */
641	if (pHdrs->vX_32.FileHeader.Machine != (pThis->f32Bit ? IMAGE_FILE_MACHINE_I386 : IMAGE_FILE_MACHINE_AMD64))
642	{
643	Log(("DigWinNt: %s: Invalid FH.Machine: %#x\n", pszName, pHdrs->vX_32.FileHeader.Machine));
644	return;
645	}
646	if (pHdrs->vX_32.FileHeader.SizeOfOptionalHeader != (pThis->f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
647	{
648	Log(("DigWinNt: %s: Invalid FH.SizeOfOptionalHeader: %#x\n", pszName, pHdrs->vX_32.FileHeader.SizeOfOptionalHeader));
649	return;
650	}
651	if (WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections) > 64)
652	{
653	Log(("DigWinNt: %s: Too many sections: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections)));
654	return;
655	}
656
657	const uint32_t TimeDateStamp = pHdrs->vX_32.FileHeader.TimeDateStamp;
658
659	/* The optional header is not... */
660	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic) != (pThis->f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
661	{
662	Log(("DigWinNt: %s: Invalid OH.Magic: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic)));
663	return;
664	}
665	uint32_t cbImageFromHdr = WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage);
666	if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
667	{
668	Log(("DigWinNt: %s: Invalid OH.SizeOfImage: %#x, expected %#x\n", pszName, cbImageFromHdr, cbImage));
669	return;
670	}
671	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes) != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
672	{
673	Log(("DigWinNt: %s: Invalid OH.NumberOfRvaAndSizes: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes)));
674	return;
675	}
676
677	/*
678	* Create the module using the in memory image first, falling back
679	* on cached image.
680	*/
681	RTLDRMOD hLdrMod;
682	int rc = dbgDiggerWinNtCreateLdrMod(pThis, pUVM, pszName, pImageAddr, cbImage, pbBuf, cbBuf, offHdrs, pHdrs,
683	&hLdrMod);
684	if (RT_FAILURE(rc))
685	hLdrMod = NIL_RTLDRMOD;
686
687	RTDBGMOD hMod;
688	rc = RTDbgModCreateFromPeImage(&hMod, pszName, NULL, hLdrMod,
689	cbImageFromHdr, TimeDateStamp, DBGFR3AsGetConfig(pUVM));
690	if (RT_FAILURE(rc))
691	{
692	/*
693	* Final fallback is a container module.
694	*/
695	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
696	if (RT_FAILURE(rc))
697	return;
698
699	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
700	AssertRC(rc);
701	}
702
703	/* Tag the module. */
704	rc = RTDbgModSetTag(hMod, DIG_WINNT_MOD_TAG);
705	AssertRC(rc);
706
707	/*
708	* Link the module.
709	*/
710	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
711	if (hAs != NIL_RTDBGAS)
712	rc = RTDbgAsModuleLink(hAs, hMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
713	else
714	rc = VERR_INTERNAL_ERROR;
715	RTDbgModRelease(hMod);
716	RTDbgAsRelease(hAs);
717	}
718
719
720	/**
721	* @copydoc DBGFOSREG::pfnQueryInterface
722	*/
723	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
724	{
725	return NULL;
726	}
727
728
729	/**
730	* @copydoc DBGFOSREG::pfnQueryVersion
731	*/
732	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
733	{
734	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
735	Assert(pThis->fValid);
736	const char *pszNtProductType;
737	switch (pThis->NtProductType)
738	{
739	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
740	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
741	case kNtProductType_Server: pszNtProductType = "-Server"; break;
742	default: pszNtProductType = ""; break;
743	}
744	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
745	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
746	return VINF_SUCCESS;
747	}
748
749
750	/**
751	* @copydoc DBGFOSREG::pfnTerm
752	*/
753	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
754	{
755	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
756	Assert(pThis->fValid);
757
758	pThis->fValid = false;
759	}
760
761
762	/**
763	* @copydoc DBGFOSREG::pfnRefresh
764	*/
765	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
766	{
767	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
768	NOREF(pThis);
769	Assert(pThis->fValid);
770
771	/*
772	* For now we'll flush and reload everything.
773	*/
774	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
775	if (hDbgAs != NIL_RTDBGAS)
776	{
777	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
778	while (iMod-- > 0)
779	{
780	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
781	if (hMod != NIL_RTDBGMOD)
782	{
783	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
784	{
785	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
786	AssertRC(rc);
787	}
788	RTDbgModRelease(hMod);
789	}
790	}
791	RTDbgAsRelease(hDbgAs);
792	}
793
794	dbgDiggerWinNtTerm(pUVM, pvData);
795	return dbgDiggerWinNtInit(pUVM, pvData);
796	}
797
798
799	/**
800	* @copydoc DBGFOSREG::pfnInit
801	*/
802	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
803	{
804	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
805	Assert(!pThis->fValid);
806
807	union
808	{
809	uint8_t au8[0x2000];
810	RTUTF16 wsz[0x2000/2];
811	NTKUSERSHAREDDATA UserSharedData;
812	} u;
813	DBGFADDRESS Addr;
814	int rc;
815
816	/*
817	* Figure the NT version.
818	*/
819	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
820	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
821	if (RT_FAILURE(rc))
822	return rc;
823	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
824	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
825	: kNtProductType_Invalid;
826	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
827	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
828
829	/*
830	* Dig out the module chain.
831	*/
832	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
833	Addr = pThis->KernelMteAddr;
834	do
835	{
836	/* Read the validate the MTE. */
837	NTMTE Mte;
838	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
839	if (RT_FAILURE(rc))
840	break;
841	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
842	{
843	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
844	break;
845	}
846	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
847	{
848	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
849	break;
850	}
851	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
852	{
853	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
854	break;
855	}
856	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
857	{
858	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
859	break;
860	}
861	if ( !WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase))
862	\|\| WINNT_UNION(pThis, &Mte, SizeOfImage) > _1M*256
863	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > WINNT_UNION(pThis, &Mte, SizeOfImage) )
864	{
865	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
866	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), WINNT_UNION(pThis, &Mte, SizeOfImage), WINNT_UNION(pThis, &Mte, DllBase)));
867	break;
868	}
869
870	/* Read the full name. */
871	DBGFADDRESS AddrName;
872	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
873	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
874	if (cbName < sizeof(u))
875	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
876	else
877	rc = VERR_OUT_OF_RANGE;
878	if (RT_FAILURE(rc))
879	{
880	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
881	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
882	if (cbName < sizeof(u))
883	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
884	else
885	rc = VERR_OUT_OF_RANGE;
886	}
887	if (RT_SUCCESS(rc))
888	{
889	u.wsz[cbName/2] = '\0';
890	char *pszName;
891	rc = RTUtf16ToUtf8(u.wsz, &pszName);
892	if (RT_SUCCESS(rc))
893	{
894	/* Read the start of the PE image and pass it along to a worker. */
895	DBGFADDRESS ImageAddr;
896	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
897	uint32_t cbImageBuf = RT_MIN(sizeof(u), WINNT_UNION(pThis, &Mte, SizeOfImage));
898	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &ImageAddr, &u, cbImageBuf);
899	if (RT_SUCCESS(rc))
900	dbgDiggerWinNtProcessImage(pThis,
901	pUVM,
902	pszName,
903	&ImageAddr,
904	WINNT_UNION(pThis, &Mte, SizeOfImage),
905	&u.au8[0],
906	sizeof(u));
907	RTStrFree(pszName);
908	}
909	}
910
911	/* next */
912	AddrPrev = Addr;
913	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
914	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
915	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
916
917	pThis->fValid = true;
918	return VINF_SUCCESS;
919	}
920
921
922	/**
923	* @copydoc DBGFOSREG::pfnProbe
924	*/
925	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
926	{
927	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
928	DBGFADDRESS Addr;
929	union
930	{
931	uint8_t au8[8192];
932	uint16_t au16[8192/2];
933	uint32_t au32[8192/4];
934	IMAGE_DOS_HEADER MzHdr;
935	RTUTF16 wsz[8192/2];
936	} u;
937
938	union
939	{
940	NTMTE32 v32;
941	NTMTE64 v64;
942	} uMte, uMte2, uMte3;
943
944	/*
945	* Look for the PAGELK section name that seems to be a part of all kernels.
946	* Then try find the module table entry for it. Since it's the first entry
947	* in the PsLoadedModuleList we can easily validate the list head and report
948	* success.
949	*/
950	CPUMMODE enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
951	uint64_t const uStart = enmMode == CPUMMODE_LONG ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
952	uint64_t const uEnd = enmMode == CPUMMODE_LONG ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
953	DBGFADDRESS KernelAddr;
954	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uStart);
955	KernelAddr.FlatPtr < uEnd;
956	KernelAddr.FlatPtr += PAGE_SIZE)
957	{
958	int rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
959	1, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
960	if (RT_FAILURE(rc))
961	break;
962	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
963
964	/* MZ + PE header. */
965	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
966	if ( RT_SUCCESS(rc)
967	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
968	&& !(u.MzHdr.e_lfanew & 0x7)
969	&& u.MzHdr.e_lfanew >= 0x080
970	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
971	{
972	if (enmMode != CPUMMODE_LONG)
973	{
974	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
975	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
976	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
977	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
978	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
979	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
980	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
981	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
982	)
983	{
984	/* Find the MTE. */
985	RT_ZERO(uMte);
986	uMte.v32.DllBase = KernelAddr.FlatPtr;
987	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
988	uMte.v32.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
989	DBGFADDRESS HitAddr;
990	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
991	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
992	while (RT_SUCCESS(rc))
993	{
994	/* check the name. */
995	DBGFADDRESS MteAddr = HitAddr;
996	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
997	&uMte2.v32, sizeof(uMte2.v32));
998	if ( RT_SUCCESS(rc)
999	&& uMte2.v32.DllBase == uMte.v32.DllBase
1000	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1001	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1002	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1003	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1004	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1005	&& uMte2.v32.BaseDllName.Length <= 128
1006	&& uMte2.v32.FullDllName.Length <= 260
1007	)
1008	{
1009	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1010	u.wsz, uMte2.v32.BaseDllName.Length);
1011	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1012	if ( RT_SUCCESS(rc)
1013	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1014	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1015	)
1016	)
1017	{
1018	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1019	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
1020	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1021	if ( RT_SUCCESS(rc)
1022	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1023	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1024	{
1025	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1026	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1027	pThis->KernelAddr = KernelAddr;
1028	pThis->KernelMteAddr = MteAddr;
1029	pThis->PsLoadedModuleListAddr = Addr;
1030	pThis->f32Bit = true;
1031	return true;
1032	}
1033	}
1034	else if (RT_SUCCESS(rc))
1035	{
1036	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1037	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1038	break; /* Not NT kernel */
1039	}
1040	}
1041
1042	/* next */
1043	DBGFR3AddrAdd(&HitAddr, 4);
1044	if (HitAddr.FlatPtr < uEnd)
1045	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1046	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1047	else
1048	rc = VERR_DBGF_MEM_NOT_FOUND;
1049	}
1050	}
1051	}
1052	else
1053	{
1054	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
1055	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1056	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1057	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1058	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1059	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
1060	== IMAGE_FILE_EXECUTABLE_IMAGE
1061	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1062	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1063	)
1064	{
1065	/* Find the MTE. */
1066	RT_ZERO(uMte.v64);
1067	uMte.v64.DllBase = KernelAddr.FlatPtr;
1068	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1069	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1070	DBGFADDRESS ScanAddr;
1071	DBGFADDRESS HitAddr;
1072	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1073	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1074	while (RT_SUCCESS(rc))
1075	{
1076	/* Read the start of the MTE and check some basic members. */
1077	DBGFADDRESS MteAddr = HitAddr;
1078	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1079	&uMte2.v64, sizeof(uMte2.v64));
1080	if ( RT_SUCCESS(rc)
1081	&& uMte2.v64.DllBase == uMte.v64.DllBase
1082	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1083	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1084	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1085	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1086	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1087	&& uMte2.v64.BaseDllName.Length <= 128
1088	&& uMte2.v64.FullDllName.Length <= 260
1089	)
1090	{
1091	/* Try read the base name and compare with known NT kernel names. */
1092	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1093	u.wsz, uMte2.v64.BaseDllName.Length);
1094	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1095	if ( RT_SUCCESS(rc)
1096	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1097	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1098	)
1099	)
1100	{
1101	/* Read the link entry of the previous entry in the list and check that its
1102	forward pointer points at the MTE we've found. */
1103	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1104	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1105	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1106	if ( RT_SUCCESS(rc)
1107	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1108	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1109	{
1110	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1111	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1112	pThis->KernelAddr = KernelAddr;
1113	pThis->KernelMteAddr = MteAddr;
1114	pThis->PsLoadedModuleListAddr = Addr;
1115	pThis->f32Bit = false;
1116	return true;
1117	}
1118	}
1119	else if (RT_SUCCESS(rc))
1120	{
1121	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1122	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1123	break; /* Not NT kernel */
1124	}
1125	}
1126
1127	/* next */
1128	DBGFR3AddrAdd(&HitAddr, 8);
1129	if (HitAddr.FlatPtr < uEnd)
1130	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1131	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1132	else
1133	rc = VERR_DBGF_MEM_NOT_FOUND;
1134	}
1135	}
1136	}
1137	}
1138	}
1139	return false;
1140	}
1141
1142
1143	/**
1144	* @copydoc DBGFOSREG::pfnDestruct
1145	*/
1146	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1147	{
1148
1149	}
1150
1151
1152	/**
1153	* @copydoc DBGFOSREG::pfnConstruct
1154	*/
1155	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1156	{
1157	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1158	pThis->fValid = false;
1159	pThis->f32Bit = false;
1160	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1161	return VINF_SUCCESS;
1162	}
1163
1164
1165	const DBGFOSREG g_DBGDiggerWinNt =
1166	{
1167	/* .u32Magic = */ DBGFOSREG_MAGIC,
1168	/* .fFlags = */ 0,
1169	/* .cbData = */ sizeof(DBGDIGGERWINNT),
1170	/* .szName = */ "WinNT",
1171	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1172	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1173	/* .pfnProbe = */ dbgDiggerWinNtProbe,
1174	/* .pfnInit = */ dbgDiggerWinNtInit,
1175	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1176	/* .pfnTerm = */ dbgDiggerWinNtTerm,
1177	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1178	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1179	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1180	};
1181

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 58944

Download in other formats: