DBGPlugInWinNt.cpp@ 72492

Last change on this file since 72492 was 70338, checked in by vboxsync, 7 years ago
DBGPlugInWinNt.cpp: Detect NT 3.1. NTMTE32.SizeOfImage is used differently, VirtualSize absent, no KUSER_SHARED_DATA. Not perfect yet.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 50.7 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 70338 2017-12-25 17:38:40Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/err.h>
26	#include <VBox/param.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/string.h>
31	#include <iprt/formats/pecoff.h>
32	#include <iprt/formats/mz.h>
33
34
35	/*********************************************************************************************************************************
36	* Structures and Typedefs *
37	*********************************************************************************************************************************/
38
39	/** @name Internal WinNT structures
40	* @{ */
41	/**
42	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
43	* Tested with XP.
44	*/
45	typedef struct NTMTE32
46	{
47	struct
48	{
49	uint32_t Flink;
50	uint32_t Blink;
51	} InLoadOrderLinks,
52	InMemoryOrderModuleList,
53	InInitializationOrderModuleList;
54	uint32_t DllBase;
55	uint32_t EntryPoint;
56	/** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
57	* boot loader, for other images it looks like some kind of pointer. */
58	uint32_t SizeOfImage;
59	struct
60	{
61	uint16_t Length;
62	uint16_t MaximumLength;
63	uint32_t Buffer;
64	} FullDllName,
65	BaseDllName;
66	uint32_t Flags;
67	uint16_t LoadCount;
68	uint16_t TlsIndex;
69	/* ... there is more ... */
70	} NTMTE32;
71	typedef NTMTE32 *PNTMTE32;
72
73	/**
74	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
75	*/
76	typedef struct NTMTE64
77	{
78	struct
79	{
80	uint64_t Flink;
81	uint64_t Blink;
82	} InLoadOrderLinks, /*< 0x00 /
83	InMemoryOrderModuleList, /*< 0x10 /
84	InInitializationOrderModuleList; /*< 0x20 /
85	uint64_t DllBase; /*< 0x30 /
86	uint64_t EntryPoint; /*< 0x38 /
87	uint32_t SizeOfImage; /*< 0x40 /
88	uint32_t Alignment; /*< 0x44 /
89	struct
90	{
91	uint16_t Length; /*< 0x48,0x58 /
92	uint16_t MaximumLength; /*< 0x4a,0x5a /
93	uint32_t Alignment; /*< 0x4c,0x5c /
94	uint64_t Buffer; /*< 0x50,0x60 /
95	} FullDllName, /*< 0x48 /
96	BaseDllName; /*< 0x58 /
97	uint32_t Flags; /*< 0x68 /
98	uint16_t LoadCount; /*< 0x6c /
99	uint16_t TlsIndex; /*< 0x6e /
100	/* ... there is more ... */
101	} NTMTE64;
102	typedef NTMTE64 *PNTMTE64;
103
104	/** MTE union. */
105	typedef union NTMTE
106	{
107	NTMTE32 vX_32;
108	NTMTE64 vX_64;
109	} NTMTE;
110	typedef NTMTE *PNTMTE;
111
112
113	/**
114	* The essential bits of the KUSER_SHARED_DATA structure.
115	*/
116	typedef struct NTKUSERSHAREDDATA
117	{
118	uint32_t TickCountLowDeprecated;
119	uint32_t TickCountMultiplier;
120	struct
121	{
122	uint32_t LowPart;
123	int32_t High1Time;
124	int32_t High2Time;
125
126	} InterruptTime,
127	SystemTime,
128	TimeZoneBias;
129	uint16_t ImageNumberLow;
130	uint16_t ImageNumberHigh;
131	RTUTF16 NtSystemRoot[260];
132	uint32_t MaxStackTraceDepth;
133	uint32_t CryptoExponent;
134	uint32_t TimeZoneId;
135	uint32_t LargePageMinimum;
136	uint32_t Reserved2[7];
137	uint32_t NtProductType;
138	uint8_t ProductTypeIsValid;
139	uint8_t abPadding[3];
140	uint32_t NtMajorVersion;
141	uint32_t NtMinorVersion;
142	/* uint8_t ProcessorFeatures[64];
143	...
144	*/
145	} NTKUSERSHAREDDATA;
146	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
147
148	/** KI_USER_SHARED_DATA for i386 */
149	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
150	/** KI_USER_SHARED_DATA for AMD64 */
151	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
152
153	/** NTKUSERSHAREDDATA::NtProductType */
154	typedef enum NTPRODUCTTYPE
155	{
156	kNtProductType_Invalid = 0,
157	kNtProductType_WinNt = 1,
158	kNtProductType_LanManNt,
159	kNtProductType_Server
160	} NTPRODUCTTYPE;
161
162
163	/** NT image header union. */
164	typedef union NTHDRSU
165	{
166	IMAGE_NT_HEADERS32 vX_32;
167	IMAGE_NT_HEADERS64 vX_64;
168	} NTHDRS;
169	/** Pointer to NT image header union. */
170	typedef NTHDRS *PNTHDRS;
171	/** Pointer to const NT image header union. */
172	typedef NTHDRS const *PCNTHDRS;
173
174	/** @} */
175
176
177
178	typedef enum DBGDIGGERWINNTVER
179	{
180	DBGDIGGERWINNTVER_UNKNOWN,
181	DBGDIGGERWINNTVER_3_1,
182	DBGDIGGERWINNTVER_3_5,
183	DBGDIGGERWINNTVER_4_0,
184	DBGDIGGERWINNTVER_5_0,
185	DBGDIGGERWINNTVER_5_1,
186	DBGDIGGERWINNTVER_6_0
187	} DBGDIGGERWINNTVER;
188
189	/**
190	* WinNT guest OS digger instance data.
191	*/
192	typedef struct DBGDIGGERWINNT
193	{
194	/** Whether the information is valid or not.
195	* (For fending off illegal interface method calls.) */
196	bool fValid;
197	/** 32-bit (true) or 64-bit (false) */
198	bool f32Bit;
199	/** Set if NT 3.1 was detected.
200	* This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
201	bool fNt31;
202
203	/** The NT version. */
204	DBGDIGGERWINNTVER enmVer;
205	/** NTKUSERSHAREDDATA::NtProductType */
206	NTPRODUCTTYPE NtProductType;
207	/** NTKUSERSHAREDDATA::NtMajorVersion */
208	uint32_t NtMajorVersion;
209	/** NTKUSERSHAREDDATA::NtMinorVersion */
210	uint32_t NtMinorVersion;
211
212	/** The address of the ntoskrnl.exe image. */
213	DBGFADDRESS KernelAddr;
214	/** The address of the ntoskrnl.exe module table entry. */
215	DBGFADDRESS KernelMteAddr;
216	/** The address of PsLoadedModuleList. */
217	DBGFADDRESS PsLoadedModuleListAddr;
218	} DBGDIGGERWINNT;
219	/** Pointer to the linux guest OS digger instance data. */
220	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
221
222
223	/**
224	* The WinNT digger's loader reader instance data.
225	*/
226	typedef struct DBGDIGGERWINNTRDR
227	{
228	/** The VM handle (referenced). */
229	PUVM pUVM;
230	/** The image base. */
231	DBGFADDRESS ImageAddr;
232	/** The image size. */
233	uint32_t cbImage;
234	/** The file offset of the SizeOfImage field in the optional header if it
235	* needs patching, otherwise set to UINT32_MAX. */
236	uint32_t offSizeOfImage;
237	/** The correct image size. */
238	uint32_t cbCorrectImageSize;
239	/** Number of entries in the aMappings table. */
240	uint32_t cMappings;
241	/** Mapping hint. */
242	uint32_t iHint;
243	/** Mapping file offset to memory offsets, ordered by file offset. */
244	struct
245	{
246	/** The file offset. */
247	uint32_t offFile;
248	/** The size of this mapping. */
249	uint32_t cbMem;
250	/** The offset to the memory from the start of the image. */
251	uint32_t offMem;
252	} aMappings[1];
253	} DBGDIGGERWINNTRDR;
254	/** Pointer a WinNT loader reader instance data. */
255	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
256
257
258	/*********************************************************************************************************************************
259	* Defined Constants And Macros *
260	*********************************************************************************************************************************/
261	/** Validates a 32-bit Windows NT kernel address */
262	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
263	/** Validates a 64-bit Windows NT kernel address */
264	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
265	/** Validates a kernel address. */
266	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
267	/** Versioned and bitness wrapper. */
268	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
269
270	/** The length (in chars) of the kernel file name (no path). */
271	#define WINNT_KERNEL_BASE_NAME_LEN 12
272
273	/** WindowsNT on little endian ASCII systems. */
274	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
275
276
277	/*********************************************************************************************************************************
278	* Internal Functions *
279	*********************************************************************************************************************************/
280	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
281
282
283	/*********************************************************************************************************************************
284	* Global Variables *
285	*********************************************************************************************************************************/
286	/** Kernel names. */
287	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
288	{
289	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
290	};
291
292
293
294	/** @callback_method_impl{PFNRTLDRRDRMEMREAD} */
295	static DECLCALLBACK(int) dbgDiggerWinNtRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
296	{
297	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
298	uint32_t offFile = (uint32_t)off;
299	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
300
301	uint32_t i = pThis->iHint;
302	if (pThis->aMappings[i].offFile > offFile)
303	{
304	i = pThis->cMappings;
305	while (i-- > 0)
306	if (offFile >= pThis->aMappings[i].offFile)
307	break;
308	pThis->iHint = i;
309	}
310
311	while (cb > 0)
312	{
313	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
314	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
315
316	/* Read file bits backed by memory. */
317	if (offMap < pThis->aMappings[i].cbMem)
318	{
319	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
320	if (cbToRead > cb)
321	cbToRead = (uint32_t)cb;
322
323	DBGFADDRESS Addr = pThis->ImageAddr;
324	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
325
326	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
327	if (RT_FAILURE(rc))
328	return rc;
329
330	/* Apply SizeOfImage patch? */
331	if ( pThis->offSizeOfImage != UINT32_MAX
332	&& offFile < pThis->offSizeOfImage + 4
333	&& offFile + cbToRead > pThis->offSizeOfImage)
334	{
335	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
336	uint32_t cbPatch = sizeof(SizeOfImage);
337	int32_t offPatch = pThis->offSizeOfImage - offFile;
338	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
339	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
340	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
341	while (cbPatch-- > 0)
342	{
343	if (offPatch >= 0)
344	*pbPatch = (uint8_t)SizeOfImage;
345	offPatch++;
346	pbPatch++;
347	SizeOfImage >>= 8;
348	}
349	}
350
351	/* Done? */
352	if (cbToRead == cb)
353	break;
354
355	offFile += cbToRead;
356	cb -= cbToRead;
357	pvBuf = (char *)pvBuf + cbToRead;
358	}
359
360	/* Mind the gap. */
361	if (offNextMap > offFile)
362	{
363	uint32_t cbZero = offNextMap - offFile;
364	if (cbZero > cb)
365	{
366	RT_BZERO(pvBuf, cb);
367	break;
368	}
369
370	RT_BZERO(pvBuf, cbZero);
371	offFile += cbZero;
372	cb -= cbZero;
373	pvBuf = (char *)pvBuf + cbZero;
374	}
375
376	pThis->iHint = ++i;
377	}
378
379	return VINF_SUCCESS;
380	}
381
382
383	/** @callback_method_impl{PFNRTLDRRDRMEMDTOR} */
384	static DECLCALLBACK(void) dbgDiggerWinNtRdr_Dtor(void *pvUser)
385	{
386	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
387
388	VMR3ReleaseUVM(pThis->pUVM);
389	pThis->pUVM = NULL;
390	RTMemFree(pvUser);
391	}
392
393
394	/**
395	* Checks if the section headers look okay.
396	*
397	* @returns true / false.
398	* @param paShs Pointer to the section headers.
399	* @param cShs Number of headers.
400	* @param cbImage The image size reported by NT.
401	* @param cbImageFromHdr The image size by the linker in the header.
402	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
403	* no resource directory.
404	* @param cbSectAlign The section alignment specified in the header.
405	* @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
406	* @param pcbImageCorrect The corrected image size. This is derived from
407	* cbImage and virtual range of the section tables.
408	*
409	* The problem is that NT may choose to drop the
410	* last pages in images it loads early, starting at
411	* the resource directory. These images will have
412	* a page aligned cbImage.
413	*/
414	static bool dbgDiggerWinNtCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShs, uint32_t cShs, uint32_t cbImage,
415	uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
416	bool fNt31, uint32_t *pcbImageCorrect)
417	{
418	*pcbImageCorrect = cbImage;
419
420	for (uint32_t i = 0; i < cShs; i++)
421	{
422	if (!paShs[i].Name[0])
423	{
424	Log(("DigWinNt: Section header #%u has no name\n", i));
425	return false;
426	}
427
428	if (paShs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
429	continue;
430
431	/* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
432	/** @todo this isn't really perfect. cbImage is kind of wrong... */
433	uint32_t cbVirtual = paShs[i].Misc.VirtualSize;
434	if (cbVirtual == 0)
435	{
436	for (uint32_t j = i + 1; j < cShs; j++)
437	if (!(paShs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
438	&& paShs[j].VirtualAddress > paShs[i].VirtualAddress)
439	{
440	cbVirtual = paShs[j].VirtualAddress - paShs[i].VirtualAddress;
441	break;
442	}
443	if (!cbVirtual)
444	{
445	if (paShs[i].VirtualAddress < cbImageFromHdr)
446	cbVirtual = cbImageFromHdr - paShs[i].VirtualAddress;
447	else if (paShs[i].SizeOfRawData > 0)
448	cbVirtual = RT_ALIGN(paShs[i].SizeOfRawData, _4K);
449	}
450	}
451
452	/* Check that sizes are within the same range and that both sizes and
453	addresses are within reasonable limits. */
454	if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShs[i].SizeOfRawData, _64K)
455	\|\| cbVirtual >= _1G
456	\|\| paShs[i].SizeOfRawData >= _1G)
457	{
458	Log(("DigWinNt: Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!\n",
459	i, paShs[i].Name, cbVirtual, paShs[i].Misc.VirtualSize, paShs[i].SizeOfRawData));
460	return false;
461	}
462	uint32_t uRvaEnd = paShs[i].VirtualAddress + cbVirtual;
463	if (uRvaEnd >= _1G \|\| uRvaEnd < paShs[i].VirtualAddress)
464	{
465	Log(("DigWinNt: Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!\n",
466	i, paShs[i].Name, cbVirtual, paShs[i].Misc.VirtualSize, paShs[i].VirtualAddress, uRvaEnd));
467	return false;
468	}
469
470	/* Check for images chopped off around '.rsrc'. */
471	if ( cbImage < uRvaEnd
472	&& uRvaEnd >= uRvaRsrc)
473	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
474
475	/* Check that the section is within the image. */
476	if (uRvaEnd > cbImage && fNt31)
477	{
478	Log(("DigWinNt: Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x\n",
479	i, paShs[i].VirtualAddress, uRvaEnd, cbImage));
480	return false;
481	}
482	}
483
484	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
485	*pcbImageCorrect = cbImage;
486	return true;
487	}
488
489
490	/**
491	* Create a loader module for the in-guest-memory PE module.
492	*/
493	static int dbgDiggerWinNtCreateLdrMod(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName, PCDBGFADDRESS pImageAddr,
494	uint32_t cbImage, uint8_t *pbBuf, size_t cbBuf,
495	uint32_t offHdrs, PCNTHDRS pHdrs, PRTLDRMOD phLdrMod)
496	{
497	/*
498	* Allocate and create a reader instance.
499	*/
500	uint32_t const cShs = WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections);
501	PDBGDIGGERWINNTRDR pRdr = (PDBGDIGGERWINNTRDR)RTMemAlloc(RT_OFFSETOF(DBGDIGGERWINNTRDR, aMappings[cShs + 2]));
502	if (!pRdr)
503	return VERR_NO_MEMORY;
504
505	VMR3RetainUVM(pUVM);
506	pRdr->pUVM = pUVM;
507	pRdr->ImageAddr = *pImageAddr;
508	pRdr->cbImage = cbImage;
509	pRdr->cbCorrectImageSize = cbImage;
510	pRdr->offSizeOfImage = UINT32_MAX;
511	pRdr->iHint = 0;
512
513	/*
514	* Use the section table to construct a more accurate view of the file/
515	* image if it's in the buffer (it should be).
516	*/
517	uint32_t uRvaRsrc = UINT32_MAX;
518	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).Size > 0)
519	uRvaRsrc = WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress;
520	uint32_t offShs = offHdrs
521	+ ( pThis->f32Bit
522	? pHdrs->vX_32.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
523	: pHdrs->vX_64.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader));
524	uint32_t cbShs = cShs * sizeof(IMAGE_SECTION_HEADER);
525	PCIMAGE_SECTION_HEADER paShs = (PCIMAGE_SECTION_HEADER)(pbBuf + offShs);
526	if ( offShs + cbShs <= RT_MIN(cbImage, cbBuf)
527	&& dbgDiggerWinNtCheckSectHdrsAndImgSize(paShs, cShs, cbImage, WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage),
528	uRvaRsrc, WINNT_UNION(pThis, pHdrs, OptionalHeader.SectionAlignment),
529	pThis->fNt31, &pRdr->cbCorrectImageSize))
530	{
531	pRdr->cMappings = 0;
532
533	for (uint32_t i = 0; i < cShs; i++)
534	if ( paShs[i].SizeOfRawData > 0
535	&& paShs[i].PointerToRawData > 0)
536	{
537	uint32_t j = 1;
538	if (!pRdr->cMappings)
539	pRdr->cMappings++;
540	else
541	{
542	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShs[i].PointerToRawData)
543	j++;
544	if (j < pRdr->cMappings)
545	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
546	}
547	pRdr->aMappings[j].offFile = paShs[i].PointerToRawData;
548	pRdr->aMappings[j].offMem = paShs[i].VirtualAddress;
549	pRdr->aMappings[j].cbMem = i + 1 < cShs
550	? paShs[i + 1].VirtualAddress - paShs[i].VirtualAddress
551	: paShs[i].Misc.VirtualSize;
552	if (j == pRdr->cMappings)
553	pRdr->cbImage = paShs[i].PointerToRawData + paShs[i].SizeOfRawData;
554	pRdr->cMappings++;
555	}
556
557	/* Insert the mapping of the headers that isn't covered by the section table. */
558	pRdr->aMappings[0].offFile = 0;
559	pRdr->aMappings[0].offMem = 0;
560	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
561
562	int j = pRdr->cMappings - 1;
563	while (j-- > 0)
564	{
565	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
566	if (pRdr->aMappings[j].cbMem > cbFile)
567	pRdr->aMappings[j].cbMem = cbFile;
568	}
569	}
570	else
571	{
572	/*
573	* Fallback, fake identity mapped file data.
574	*/
575	pRdr->cMappings = 1;
576	pRdr->aMappings[0].offFile = 0;
577	pRdr->aMappings[0].offMem = 0;
578	pRdr->aMappings[0].cbMem = pRdr->cbImage;
579	}
580
581	/* Enable the SizeOfImage patching if necessary. */
582	if (pRdr->cbCorrectImageSize != cbImage)
583	{
584	Log(("DigWinNT: The image is really %#x bytes long, not %#x as mapped by NT!\n", pRdr->cbCorrectImageSize, cbImage));
585	pRdr->offSizeOfImage = pThis->f32Bit
586	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
587	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
588	}
589
590	/*
591	* Call the loader to open the PE image for debugging.
592	* Note! It always calls pfnDtor.
593	*/
594	RTLDRMOD hLdrMod;
595	int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
596	dbgDiggerWinNtRdr_Read, dbgDiggerWinNtRdr_Dtor, pRdr,
597	&hLdrMod);
598	if (RT_SUCCESS(rc))
599	*phLdrMod = hLdrMod;
600	else
601	*phLdrMod = NIL_RTLDRMOD;
602	return rc;
603	}
604
605
606	/**
607	* Process a PE image found in guest memory.
608	*
609	* @param pThis The instance data.
610	* @param pUVM The user mode VM handle.
611	* @param pszName The image name.
612	* @param pImageAddr The image address.
613	* @param cbImage The size of the image.
614	* @param pbBuf Scratch buffer containing the first
615	* RT_MIN(cbBuf, cbImage) bytes of the image.
616	* @param cbBuf The scratch buffer size.
617	*/
618	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
619	PCDBGFADDRESS pImageAddr, uint32_t cbImage,
620	uint8_t *pbBuf, size_t cbBuf)
621	{
622	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
623
624	/*
625	* NT 3.1 doesn't set the image size in the MTEs, so a little
626	* bit of tweaking is necessary here.
627	*/
628	uint32_t const cbImageValidate = !pThis->fNt31 ? cbImage : _64M;
629
630	/*
631	* Do some basic validation first.
632	* This is the usual exteremely verbose and messy code...
633	*/
634	Assert(cbBuf >= sizeof(IMAGE_NT_HEADERS64));
635	if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
636	\|\| cbImage >= _1M * 256)
637	{
638	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
639	return;
640	}
641
642	/* Dig out the NT/PE headers. */
643	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbBuf;
644	PCNTHDRS pHdrs;
645	uint32_t offHdrs;
646	if (pMzHdr->e_magic != IMAGE_DOS_SIGNATURE)
647	{
648	offHdrs = 0;
649	pHdrs = (PCNTHDRS)pbBuf;
650	}
651	else if ( pMzHdr->e_lfanew >= cbImageValidate
652	\|\| pMzHdr->e_lfanew < sizeof(*pMzHdr)
653	\|\| pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) > cbImageValidate)
654	{
655	Log(("DigWinNt: %s: PE header to far into image: %#x cbImage=%#x\n", pszName, pMzHdr->e_lfanew, cbImage));
656	return;
657	}
658	else if ( pMzHdr->e_lfanew < cbBuf
659	&& pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) <= cbBuf)
660	{
661	offHdrs = pMzHdr->e_lfanew;
662	pHdrs = (NTHDRS const *)(pbBuf + offHdrs);
663	}
664	else
665	{
666	Log(("DigWinNt: %s: PE header to far into image (lazy bird): %#x\n", pszName, pMzHdr->e_lfanew));
667	return;
668	}
669	if (pHdrs->vX_32.Signature != IMAGE_NT_SIGNATURE)
670	{
671	Log(("DigWinNt: %s: Bad PE signature: %#x\n", pszName, pHdrs->vX_32.Signature));
672	return;
673	}
674
675	/* The file header is the same on both archs */
676	if (pHdrs->vX_32.FileHeader.Machine != (pThis->f32Bit ? IMAGE_FILE_MACHINE_I386 : IMAGE_FILE_MACHINE_AMD64))
677	{
678	Log(("DigWinNt: %s: Invalid FH.Machine: %#x\n", pszName, pHdrs->vX_32.FileHeader.Machine));
679	return;
680	}
681	if (pHdrs->vX_32.FileHeader.SizeOfOptionalHeader != (pThis->f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
682	{
683	Log(("DigWinNt: %s: Invalid FH.SizeOfOptionalHeader: %#x\n", pszName, pHdrs->vX_32.FileHeader.SizeOfOptionalHeader));
684	return;
685	}
686	if (WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections) > 64)
687	{
688	Log(("DigWinNt: %s: Too many sections: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections)));
689	return;
690	}
691
692	const uint32_t TimeDateStamp = pHdrs->vX_32.FileHeader.TimeDateStamp;
693
694	/* The optional header is not... */
695	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic) != (pThis->f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
696	{
697	Log(("DigWinNt: %s: Invalid OH.Magic: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic)));
698	return;
699	}
700	uint32_t cbImageFromHdr = WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage);
701	if (pThis->fNt31)
702	cbImage = RT_ALIGN(cbImageFromHdr, _4K);
703	else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
704	{
705	Log(("DigWinNt: %s: Invalid OH.SizeOfImage: %#x, expected %#x\n", pszName, cbImageFromHdr, cbImage));
706	return;
707	}
708	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes) != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
709	{
710	Log(("DigWinNt: %s: Invalid OH.NumberOfRvaAndSizes: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes)));
711	return;
712	}
713
714	/*
715	* Create the module using the in memory image first, falling back
716	* on cached image.
717	*/
718	RTLDRMOD hLdrMod;
719	int rc = dbgDiggerWinNtCreateLdrMod(pThis, pUVM, pszName, pImageAddr, cbImage, pbBuf, cbBuf, offHdrs, pHdrs,
720	&hLdrMod);
721	if (RT_FAILURE(rc))
722	hLdrMod = NIL_RTLDRMOD;
723
724	RTDBGMOD hMod;
725	rc = RTDbgModCreateFromPeImage(&hMod, pszName, NULL, hLdrMod,
726	cbImageFromHdr, TimeDateStamp, DBGFR3AsGetConfig(pUVM));
727	if (RT_FAILURE(rc))
728	{
729	/*
730	* Final fallback is a container module.
731	*/
732	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
733	if (RT_FAILURE(rc))
734	return;
735
736	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
737	AssertRC(rc);
738	}
739
740	/* Tag the module. */
741	rc = RTDbgModSetTag(hMod, DIG_WINNT_MOD_TAG);
742	AssertRC(rc);
743
744	/*
745	* Link the module.
746	*/
747	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
748	if (hAs != NIL_RTDBGAS)
749	rc = RTDbgAsModuleLink(hAs, hMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
750	else
751	rc = VERR_INTERNAL_ERROR;
752	RTDbgModRelease(hMod);
753	RTDbgAsRelease(hAs);
754	}
755
756
757	/**
758	* @copydoc DBGFOSREG::pfnQueryInterface
759	*/
760	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
761	{
762	RT_NOREF3(pUVM, pvData, enmIf);
763	return NULL;
764	}
765
766
767	/**
768	* @copydoc DBGFOSREG::pfnQueryVersion
769	*/
770	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
771	{
772	RT_NOREF1(pUVM);
773	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
774	Assert(pThis->fValid);
775	const char *pszNtProductType;
776	switch (pThis->NtProductType)
777	{
778	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
779	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
780	case kNtProductType_Server: pszNtProductType = "-Server"; break;
781	default: pszNtProductType = ""; break;
782	}
783	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
784	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
785	return VINF_SUCCESS;
786	}
787
788
789	/**
790	* @copydoc DBGFOSREG::pfnTerm
791	*/
792	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
793	{
794	RT_NOREF1(pUVM);
795	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
796	Assert(pThis->fValid);
797
798	pThis->fValid = false;
799	}
800
801
802	/**
803	* @copydoc DBGFOSREG::pfnRefresh
804	*/
805	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
806	{
807	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
808	NOREF(pThis);
809	Assert(pThis->fValid);
810
811	/*
812	* For now we'll flush and reload everything.
813	*/
814	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
815	if (hDbgAs != NIL_RTDBGAS)
816	{
817	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
818	while (iMod-- > 0)
819	{
820	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
821	if (hMod != NIL_RTDBGMOD)
822	{
823	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
824	{
825	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
826	AssertRC(rc);
827	}
828	RTDbgModRelease(hMod);
829	}
830	}
831	RTDbgAsRelease(hDbgAs);
832	}
833
834	dbgDiggerWinNtTerm(pUVM, pvData);
835	return dbgDiggerWinNtInit(pUVM, pvData);
836	}
837
838
839	/**
840	* @copydoc DBGFOSREG::pfnInit
841	*/
842	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
843	{
844	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
845	Assert(!pThis->fValid);
846
847	union
848	{
849	uint8_t au8[0x2000];
850	RTUTF16 wsz[0x2000/2];
851	NTKUSERSHAREDDATA UserSharedData;
852	} u;
853	DBGFADDRESS Addr;
854	int rc;
855
856	/*
857	* Figure the NT version.
858	*/
859	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
860	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
861	if (RT_SUCCESS(rc))
862	{
863	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
864	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
865	: kNtProductType_Invalid;
866	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
867	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
868	}
869	else if (pThis->fNt31)
870	{
871	pThis->NtProductType = kNtProductType_WinNt;
872	pThis->NtMajorVersion = 3;
873	pThis->NtMinorVersion = 1;
874	}
875	else
876	{
877	Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
878	return rc;
879	}
880
881	/*
882	* Dig out the module chain.
883	*/
884	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
885	Addr = pThis->KernelMteAddr;
886	do
887	{
888	/* Read the validate the MTE. */
889	NTMTE Mte;
890	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
891	if (RT_FAILURE(rc))
892	break;
893	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
894	{
895	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
896	break;
897	}
898	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
899	{
900	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
901	break;
902	}
903	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
904	{
905	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
906	break;
907	}
908	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
909	{
910	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
911	break;
912	}
913	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
914	{
915	Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
916	break;
917	}
918
919	uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
920	if ( !pThis->fNt31
921	&& ( cbImageMte > _256M
922	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
923	{
924	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
925	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
926	break;
927	}
928
929	/* Read the full name. */
930	DBGFADDRESS AddrName;
931	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
932	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
933	if (cbName < sizeof(u))
934	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
935	else
936	rc = VERR_OUT_OF_RANGE;
937	if (RT_FAILURE(rc))
938	{
939	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
940	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
941	if (cbName < sizeof(u))
942	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
943	else
944	rc = VERR_OUT_OF_RANGE;
945	}
946	if (RT_SUCCESS(rc))
947	{
948	u.wsz[cbName/2] = '\0';
949	char *pszName;
950	rc = RTUtf16ToUtf8(u.wsz, &pszName);
951	if (RT_SUCCESS(rc))
952	{
953	/* Read the start of the PE image and pass it along to a worker. */
954	DBGFADDRESS ImageAddr;
955	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
956	uint32_t cbImageBuf = RT_MIN(sizeof(u), RT_MAX(cbImageMte, _4K));
957	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &ImageAddr, &u, cbImageBuf);
958	if (RT_SUCCESS(rc))
959	dbgDiggerWinNtProcessImage(pThis,
960	pUVM,
961	pszName,
962	&ImageAddr,
963	cbImageMte,
964	&u.au8[0],
965	sizeof(u));
966	RTStrFree(pszName);
967	}
968	}
969
970	/* next */
971	AddrPrev = Addr;
972	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
973	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
974	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
975
976	pThis->fValid = true;
977	return VINF_SUCCESS;
978	}
979
980
981	/**
982	* @copydoc DBGFOSREG::pfnProbe
983	*/
984	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
985	{
986	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
987	DBGFADDRESS Addr;
988	union
989	{
990	uint8_t au8[8192];
991	uint16_t au16[8192/2];
992	uint32_t au32[8192/4];
993	IMAGE_DOS_HEADER MzHdr;
994	RTUTF16 wsz[8192/2];
995	} u;
996
997	union
998	{
999	NTMTE32 v32;
1000	NTMTE64 v64;
1001	} uMte, uMte2, uMte3;
1002
1003	/*
1004	* Look for the PAGELK section name that seems to be a part of all kernels.
1005	* Then try find the module table entry for it. Since it's the first entry
1006	* in the PsLoadedModuleList we can easily validate the list head and report
1007	* success.
1008	*
1009	* Note! We ASSUME the section name is 8 byte aligned.
1010	*/
1011	CPUMMODE enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
1012	uint64_t const uStart = enmMode == CPUMMODE_LONG ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
1013	uint64_t const uEnd = enmMode == CPUMMODE_LONG ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
1014	DBGFADDRESS KernelAddr;
1015	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uStart);
1016	KernelAddr.FlatPtr < uEnd;
1017	KernelAddr.FlatPtr += PAGE_SIZE)
1018	{
1019	bool fNt31 = false;
1020	DBGFADDRESS const RetryAddress = KernelAddr;
1021	int rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1022	8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
1023	if ( rc == VERR_DBGF_MEM_NOT_FOUND
1024	&& enmMode != CPUMMODE_LONG)
1025	{
1026	/* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
1027	following VirtualSize is zero, so check for that too. */
1028	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
1029	8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
1030	fNt31 = true;
1031	}
1032	if (RT_FAILURE(rc))
1033	break;
1034	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
1035
1036	/* MZ + PE header. */
1037	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
1038	if ( RT_SUCCESS(rc)
1039	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
1040	&& !(u.MzHdr.e_lfanew & 0x7)
1041	&& u.MzHdr.e_lfanew >= 0x080
1042	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
1043	{
1044	if (enmMode != CPUMMODE_LONG)
1045	{
1046	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
1047	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1048	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
1049	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1050	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1051	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
1052	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
1053	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1054	)
1055	{
1056	/* Find the MTE. */
1057	RT_ZERO(uMte);
1058	uMte.v32.DllBase = KernelAddr.FlatPtr;
1059	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1060	uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
1061	DBGFADDRESS HitAddr;
1062	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1063	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1064	while (RT_SUCCESS(rc))
1065	{
1066	/* check the name. */
1067	DBGFADDRESS MteAddr = HitAddr;
1068	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
1069	&uMte2.v32, sizeof(uMte2.v32));
1070	if ( RT_SUCCESS(rc)
1071	&& uMte2.v32.DllBase == uMte.v32.DllBase
1072	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1073	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1074	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1075	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1076	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1077	&& uMte2.v32.BaseDllName.Length <= 128
1078	&& uMte2.v32.FullDllName.Length <= 260
1079	)
1080	{
1081	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1082	u.wsz, uMte2.v32.BaseDllName.Length);
1083	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1084	if ( RT_SUCCESS(rc)
1085	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1086	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1087	)
1088	)
1089	{
1090	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1091	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
1092	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1093	if ( RT_SUCCESS(rc)
1094	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1095	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1096	{
1097	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1098	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1099	pThis->KernelAddr = KernelAddr;
1100	pThis->KernelMteAddr = MteAddr;
1101	pThis->PsLoadedModuleListAddr = Addr;
1102	pThis->f32Bit = true;
1103	pThis->fNt31 = fNt31;
1104	return true;
1105	}
1106	}
1107	else if (RT_SUCCESS(rc))
1108	{
1109	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1110	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1111	break; /* Not NT kernel */
1112	}
1113	}
1114
1115	/* next */
1116	DBGFR3AddrAdd(&HitAddr, 4);
1117	if (HitAddr.FlatPtr < uEnd)
1118	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1119	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1120	else
1121	rc = VERR_DBGF_MEM_NOT_FOUND;
1122	}
1123	}
1124	}
1125	else
1126	{
1127	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
1128	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1129	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1130	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1131	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1132	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
1133	== IMAGE_FILE_EXECUTABLE_IMAGE
1134	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1135	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1136	)
1137	{
1138	/* Find the MTE. */
1139	RT_ZERO(uMte.v64);
1140	uMte.v64.DllBase = KernelAddr.FlatPtr;
1141	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1142	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1143	DBGFADDRESS ScanAddr;
1144	DBGFADDRESS HitAddr;
1145	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1146	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1147	while (RT_SUCCESS(rc))
1148	{
1149	/* Read the start of the MTE and check some basic members. */
1150	DBGFADDRESS MteAddr = HitAddr;
1151	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1152	&uMte2.v64, sizeof(uMte2.v64));
1153	if ( RT_SUCCESS(rc)
1154	&& uMte2.v64.DllBase == uMte.v64.DllBase
1155	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1156	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1157	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1158	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1159	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1160	&& uMte2.v64.BaseDllName.Length <= 128
1161	&& uMte2.v64.FullDllName.Length <= 260
1162	)
1163	{
1164	/* Try read the base name and compare with known NT kernel names. */
1165	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1166	u.wsz, uMte2.v64.BaseDllName.Length);
1167	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1168	if ( RT_SUCCESS(rc)
1169	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1170	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1171	)
1172	)
1173	{
1174	/* Read the link entry of the previous entry in the list and check that its
1175	forward pointer points at the MTE we've found. */
1176	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1177	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1178	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1179	if ( RT_SUCCESS(rc)
1180	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1181	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1182	{
1183	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1184	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1185	pThis->KernelAddr = KernelAddr;
1186	pThis->KernelMteAddr = MteAddr;
1187	pThis->PsLoadedModuleListAddr = Addr;
1188	pThis->f32Bit = false;
1189	pThis->fNt31 = false;
1190	return true;
1191	}
1192	}
1193	else if (RT_SUCCESS(rc))
1194	{
1195	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1196	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1197	break; /* Not NT kernel */
1198	}
1199	}
1200
1201	/* next */
1202	DBGFR3AddrAdd(&HitAddr, 8);
1203	if (HitAddr.FlatPtr < uEnd)
1204	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1205	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1206	else
1207	rc = VERR_DBGF_MEM_NOT_FOUND;
1208	}
1209	}
1210	}
1211	}
1212	}
1213	return false;
1214	}
1215
1216
1217	/**
1218	* @copydoc DBGFOSREG::pfnDestruct
1219	*/
1220	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1221	{
1222	RT_NOREF2(pUVM, pvData);
1223	}
1224
1225
1226	/**
1227	* @copydoc DBGFOSREG::pfnConstruct
1228	*/
1229	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1230	{
1231	RT_NOREF1(pUVM);
1232	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1233	pThis->fValid = false;
1234	pThis->f32Bit = false;
1235	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1236	return VINF_SUCCESS;
1237	}
1238
1239
1240	const DBGFOSREG g_DBGDiggerWinNt =
1241	{
1242	/* .u32Magic = */ DBGFOSREG_MAGIC,
1243	/* .fFlags = */ 0,
1244	/* .cbData = */ sizeof(DBGDIGGERWINNT),
1245	/* .szName = */ "WinNT",
1246	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1247	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1248	/* .pfnProbe = */ dbgDiggerWinNtProbe,
1249	/* .pfnInit = */ dbgDiggerWinNtInit,
1250	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1251	/* .pfnTerm = */ dbgDiggerWinNtTerm,
1252	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1253	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1254	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1255	};
1256

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 72492

Download in other formats: