DBGPlugInWinNt.cpp@ 93516

Last change on this file since 93516 was 93470, checked in by vboxsync, 3 years ago
DbgPlugInDiggers,VMM,Main: Refactored the diggers and related interfaces to work via the VMM function table. Removed non-working tstVBoxDbg (needs proper COM now). bugref:10072
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 60.7 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 93470 2022-01-27 23:51:28Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2022 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/vmm/cpumctx.h>
26	#include <VBox/vmm/mm.h>
27	#include <VBox/vmm/vmmr3vtable.h>
28	#include <VBox/err.h>
29	#include <VBox/param.h>
30	#include <iprt/ctype.h>
31	#include <iprt/ldr.h>
32	#include <iprt/mem.h>
33	#include <iprt/path.h>
34	#include <iprt/stream.h>
35	#include <iprt/string.h>
36	#include <iprt/utf16.h>
37	#include <iprt/formats/pecoff.h>
38	#include <iprt/formats/mz.h>
39	#include <iprt/nt/nt-structures.h>
40
41
42	/*********************************************************************************************************************************
43	* Structures and Typedefs *
44	*********************************************************************************************************************************/
45
46	/** @name Internal WinNT structures
47	* @{ */
48	/**
49	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
50	* Tested with XP.
51	*/
52	typedef struct NTMTE32
53	{
54	struct
55	{
56	uint32_t Flink;
57	uint32_t Blink;
58	} InLoadOrderLinks,
59	InMemoryOrderModuleList,
60	InInitializationOrderModuleList;
61	uint32_t DllBase;
62	uint32_t EntryPoint;
63	/** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
64	* boot loader, for other images it looks like some kind of pointer. */
65	uint32_t SizeOfImage;
66	struct
67	{
68	uint16_t Length;
69	uint16_t MaximumLength;
70	uint32_t Buffer;
71	} FullDllName,
72	BaseDllName;
73	uint32_t Flags;
74	uint16_t LoadCount;
75	uint16_t TlsIndex;
76	/* ... there is more ... */
77	} NTMTE32;
78	typedef NTMTE32 *PNTMTE32;
79
80	/**
81	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
82	*/
83	typedef struct NTMTE64
84	{
85	struct
86	{
87	uint64_t Flink;
88	uint64_t Blink;
89	} InLoadOrderLinks, /*< 0x00 /
90	InMemoryOrderModuleList, /*< 0x10 /
91	InInitializationOrderModuleList; /*< 0x20 /
92	uint64_t DllBase; /*< 0x30 /
93	uint64_t EntryPoint; /*< 0x38 /
94	uint32_t SizeOfImage; /*< 0x40 /
95	uint32_t Alignment; /*< 0x44 /
96	struct
97	{
98	uint16_t Length; /*< 0x48,0x58 /
99	uint16_t MaximumLength; /*< 0x4a,0x5a /
100	uint32_t Alignment; /*< 0x4c,0x5c /
101	uint64_t Buffer; /*< 0x50,0x60 /
102	} FullDllName, /*< 0x48 /
103	BaseDllName; /*< 0x58 /
104	uint32_t Flags; /*< 0x68 /
105	uint16_t LoadCount; /*< 0x6c /
106	uint16_t TlsIndex; /*< 0x6e /
107	/* ... there is more ... */
108	} NTMTE64;
109	typedef NTMTE64 *PNTMTE64;
110
111	/** MTE union. */
112	typedef union NTMTE
113	{
114	NTMTE32 vX_32;
115	NTMTE64 vX_64;
116	} NTMTE;
117	typedef NTMTE *PNTMTE;
118
119
120	/**
121	* The essential bits of the KUSER_SHARED_DATA structure.
122	*/
123	typedef struct NTKUSERSHAREDDATA
124	{
125	uint32_t TickCountLowDeprecated;
126	uint32_t TickCountMultiplier;
127	struct
128	{
129	uint32_t LowPart;
130	int32_t High1Time;
131	int32_t High2Time;
132
133	} InterruptTime,
134	SystemTime,
135	TimeZoneBias;
136	uint16_t ImageNumberLow;
137	uint16_t ImageNumberHigh;
138	RTUTF16 NtSystemRoot[260];
139	uint32_t MaxStackTraceDepth;
140	uint32_t CryptoExponent;
141	uint32_t TimeZoneId;
142	uint32_t LargePageMinimum;
143	uint32_t Reserved2[6];
144	uint32_t NtBuildNumber;
145	uint32_t NtProductType;
146	uint8_t ProductTypeIsValid;
147	uint8_t abPadding[3];
148	uint32_t NtMajorVersion;
149	uint32_t NtMinorVersion;
150	/* uint8_t ProcessorFeatures[64];
151	...
152	*/
153	} NTKUSERSHAREDDATA;
154	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
155
156	/** KI_USER_SHARED_DATA for i386 */
157	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
158	/** KI_USER_SHARED_DATA for AMD64 */
159	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
160
161	/** NTKUSERSHAREDDATA::NtProductType */
162	typedef enum NTPRODUCTTYPE
163	{
164	kNtProductType_Invalid = 0,
165	kNtProductType_WinNt = 1,
166	kNtProductType_LanManNt,
167	kNtProductType_Server
168	} NTPRODUCTTYPE;
169
170
171	/** NT image header union. */
172	typedef union NTHDRSU
173	{
174	IMAGE_NT_HEADERS32 vX_32;
175	IMAGE_NT_HEADERS64 vX_64;
176	} NTHDRS;
177	/** Pointer to NT image header union. */
178	typedef NTHDRS *PNTHDRS;
179	/** Pointer to const NT image header union. */
180	typedef NTHDRS const *PCNTHDRS;
181
182
183	/**
184	* NT KD version block.
185	*/
186	typedef struct NTKDVERSIONBLOCK
187	{
188	uint16_t MajorVersion;
189	uint16_t MinorVersion;
190	uint8_t ProtocolVersion;
191	uint8_t KdSecondaryVersion;
192	uint16_t Flags;
193	uint16_t MachineType;
194	uint8_t MaxPacketType;
195	uint8_t MaxStateChange;
196	uint8_t MaxManipulate;
197	uint8_t Simulation;
198	uint16_t Unused;
199	uint64_t KernBase;
200	uint64_t PsLoadedModuleList;
201	uint64_t DebuggerDataList;
202	} NTKDVERSIONBLOCK;
203	/** Pointer to an NT KD version block. */
204	typedef NTKDVERSIONBLOCK *PNTKDVERSIONBLOCK;
205	/** Pointer to a const NT KD version block. */
206	typedef const NTKDVERSIONBLOCK *PCNTKDVERSIONBLOCK;
207
208	/** @} */
209
210
211
212	typedef enum DBGDIGGERWINNTVER
213	{
214	DBGDIGGERWINNTVER_UNKNOWN,
215	DBGDIGGERWINNTVER_3_1,
216	DBGDIGGERWINNTVER_3_5,
217	DBGDIGGERWINNTVER_4_0,
218	DBGDIGGERWINNTVER_5_0,
219	DBGDIGGERWINNTVER_5_1,
220	DBGDIGGERWINNTVER_6_0
221	} DBGDIGGERWINNTVER;
222
223	/**
224	* WinNT guest OS digger instance data.
225	*/
226	typedef struct DBGDIGGERWINNT
227	{
228	/** Whether the information is valid or not.
229	* (For fending off illegal interface method calls.) */
230	bool fValid;
231	/** 32-bit (true) or 64-bit (false) */
232	bool f32Bit;
233	/** Set if NT 3.1 was detected.
234	* This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
235	bool fNt31;
236
237	/** The NT version. */
238	DBGDIGGERWINNTVER enmVer;
239	/** NTKUSERSHAREDDATA::NtProductType */
240	NTPRODUCTTYPE NtProductType;
241	/** NTKUSERSHAREDDATA::NtMajorVersion */
242	uint32_t NtMajorVersion;
243	/** NTKUSERSHAREDDATA::NtMinorVersion */
244	uint32_t NtMinorVersion;
245	/** NTKUSERSHAREDDATA::NtBuildNumber */
246	uint32_t NtBuildNumber;
247
248	/** The address of the ntoskrnl.exe image. */
249	DBGFADDRESS KernelAddr;
250	/** The address of the ntoskrnl.exe module table entry. */
251	DBGFADDRESS KernelMteAddr;
252	/** The address of PsLoadedModuleList. */
253	DBGFADDRESS PsLoadedModuleListAddr;
254
255	/** Array of detected KPCR addresses for each vCPU. */
256	PDBGFADDRESS paKpcrAddr;
257	/** Array of detected KPCRB addresses for each vCPU. */
258	PDBGFADDRESS paKpcrbAddr;
259
260	/** The Windows NT specifics interface. */
261	DBGFOSIWINNT IWinNt;
262	} DBGDIGGERWINNT;
263	/** Pointer to the linux guest OS digger instance data. */
264	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
265
266
267	/**
268	* The WinNT digger's loader reader instance data.
269	*/
270	typedef struct DBGDIGGERWINNTRDR
271	{
272	/** The VM handle (referenced). */
273	PUVM pUVM;
274	/** The image base. */
275	DBGFADDRESS ImageAddr;
276	/** The image size. */
277	uint32_t cbImage;
278	/** The file offset of the SizeOfImage field in the optional header if it
279	* needs patching, otherwise set to UINT32_MAX. */
280	uint32_t offSizeOfImage;
281	/** The correct image size. */
282	uint32_t cbCorrectImageSize;
283	/** Number of entries in the aMappings table. */
284	uint32_t cMappings;
285	/** Mapping hint. */
286	uint32_t iHint;
287	/** Mapping file offset to memory offsets, ordered by file offset. */
288	struct
289	{
290	/** The file offset. */
291	uint32_t offFile;
292	/** The size of this mapping. */
293	uint32_t cbMem;
294	/** The offset to the memory from the start of the image. */
295	uint32_t offMem;
296	} aMappings[1];
297	} DBGDIGGERWINNTRDR;
298	/** Pointer a WinNT loader reader instance data. */
299	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
300
301
302	/*********************************************************************************************************************************
303	* Defined Constants And Macros *
304	*********************************************************************************************************************************/
305	/** Validates a 32-bit Windows NT kernel address */
306	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
307	/** Validates a 64-bit Windows NT kernel address */
308	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
309	/** Validates a kernel address. */
310	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
311	/** Versioned and bitness wrapper. */
312	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
313
314	/** The length (in chars) of the kernel file name (no path). */
315	#define WINNT_KERNEL_BASE_NAME_LEN 12
316
317	/** WindowsNT on little endian ASCII systems. */
318	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
319
320
321	/*********************************************************************************************************************************
322	* Internal Functions *
323	*********************************************************************************************************************************/
324	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData);
325
326
327	/*********************************************************************************************************************************
328	* Global Variables *
329	*********************************************************************************************************************************/
330	/** Kernel names. */
331	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
332	{
333	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
334	};
335
336
337
338	/**
339	* Tries to resolve the KPCR and KPCRB addresses for each vCPU.
340	*
341	* @returns nothing.
342	* @param pThis The instance data.
343	* @param pUVM The user mode VM handle.
344	* @param pVMM The VMM function table.
345	*/
346	static void dbgDiggerWinNtResolveKpcr(PDBGDIGGERWINNT pThis, PUVM pUVM, PCVMMR3VTABLE pVMM)
347	{
348	/*
349	* Getting at the KPCR and KPCRB is explained here:
350	* https://www.geoffchappell.com/studies/windows/km/ntoskrnl/structs/kpcr.htm
351	* Together with the available offsets from:
352	* https://github.com/tpn/winsdk-10/blob/master/Include/10.0.16299.0/shared/ksamd64.inc#L883
353	* we can verify that the found addresses are valid by cross checking that the GDTR and self reference
354	* match what we expect.
355	*/
356	VMCPUID cCpus = pVMM->pfnDBGFR3CpuGetCount(pUVM);
357	pThis->paKpcrAddr = (PDBGFADDRESS)RTMemAllocZ(cCpus * 2 * sizeof(DBGFADDRESS));
358	if (RT_LIKELY(pThis->paKpcrAddr))
359	{
360	pThis->paKpcrbAddr = &pThis->paKpcrAddr[cCpus];
361
362	/* Work each CPU, unexpected values in each CPU make the whole thing fail to play safe. */
363	int rc = VINF_SUCCESS;
364	for (VMCPUID idCpu = 0; (idCpu < cCpus) && RT_SUCCESS(rc); idCpu++)
365	{
366	PDBGFADDRESS pKpcrAddr = &pThis->paKpcrAddr[idCpu];
367	PDBGFADDRESS pKpcrbAddr = &pThis->paKpcrbAddr[idCpu];
368
369	if (pThis->f32Bit)
370	{
371	/* Read FS base */
372	uint32_t GCPtrKpcrBase = 0;
373
374	rc = pVMM->pfnDBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_FS_BASE, &GCPtrKpcrBase);
375	if ( RT_SUCCESS(rc)
376	&& WINNT32_VALID_ADDRESS(GCPtrKpcrBase))
377	{
378	/*
379	* Read the start of the KPCR (@todo Probably move this to a global header)
380	* and verify its content.
381	*/
382	struct
383	{
384	uint8_t abOoi[28]; /* Out of interest */
385	uint32_t GCPtrSelf;
386	uint32_t GCPtrCurrentPrcb;
387	uint32_t u32Irql;
388	uint32_t u32Iir;
389	uint32_t u32IirActive;
390	uint32_t u32Idr;
391	uint32_t GCPtrKdVersionBlock;
392	uint32_t GCPtrIdt;
393	uint32_t GCPtrGdt;
394	uint32_t GCPtrTss;
395	} Kpcr;
396
397	LogFlow(("DigWinNt/KPCR[%u]: GS Base %RGv\n", idCpu, GCPtrKpcrBase));
398	pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrAddr, GCPtrKpcrBase);
399
400	rc = pVMM->pfnDBGFR3MemRead(pUVM, idCpu, pKpcrAddr, &Kpcr, sizeof(Kpcr));
401	if (RT_SUCCESS(rc))
402	{
403	uint32_t GCPtrGdt = 0;
404	uint32_t GCPtrIdt = 0;
405
406	rc = pVMM->pfnDBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_GDTR_BASE, &GCPtrGdt);
407	if (RT_SUCCESS(rc))
408	rc = pVMM->pfnDBGFR3RegCpuQueryU32(pUVM, idCpu, DBGFREG_IDTR_BASE, &GCPtrIdt);
409	if (RT_SUCCESS(rc))
410	{
411	if ( Kpcr.GCPtrGdt == GCPtrGdt
412	&& Kpcr.GCPtrIdt == GCPtrIdt
413	&& Kpcr.GCPtrSelf == pKpcrAddr->FlatPtr)
414	{
415	pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrbAddr, Kpcr.GCPtrCurrentPrcb);
416	LogRel(("DigWinNt/KPCR[%u]: KPCR=%RGv KPCRB=%RGv\n", idCpu, pKpcrAddr->FlatPtr, pKpcrbAddr->FlatPtr));
417
418	/*
419	* Try to extract the NT build number from the KD version block if it exists,
420	* the shared user data might have set it to 0.
421	*
422	* @todo We can use this method to get at the kern base and loaded module list if the other detection
423	* method fails (seen with Windows 10 x86).
424	* @todo On 32bit Windows the debugger data list is also always accessible this way contrary to
425	* the amd64 version where it is only available with "/debug on" set.
426	*/
427	if (!pThis->NtBuildNumber)
428	{
429	NTKDVERSIONBLOCK KdVersBlock;
430	DBGFADDRESS AddrKdVersBlock;
431
432	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrKdVersBlock, Kpcr.GCPtrKdVersionBlock);
433	rc = pVMM->pfnDBGFR3MemRead(pUVM, idCpu, &AddrKdVersBlock, &KdVersBlock, sizeof(KdVersBlock));
434	if (RT_SUCCESS(rc))
435	pThis->NtBuildNumber = KdVersBlock.MinorVersion;
436	}
437	}
438	else
439	LogRel(("DigWinNt/KPCR[%u]: KPCR validation error GDT=(%RGv vs %RGv) KPCR=(%RGv vs %RGv)\n", idCpu,
440	Kpcr.GCPtrGdt, GCPtrGdt, Kpcr.GCPtrSelf, pKpcrAddr->FlatPtr));
441	}
442	else
443	LogRel(("DigWinNt/KPCR[%u]: Getting GDT or IDT base register failed with %Rrc\n", idCpu, rc));
444	}
445	}
446	else
447	LogRel(("DigWinNt/KPCR[%u]: Getting FS base register failed with %Rrc (%RGv)\n", idCpu, rc, GCPtrKpcrBase));
448	}
449	else
450	{
451	/* Read GS base which points to the base of the KPCR for each CPU. */
452	RTGCUINTPTR GCPtrTmp = 0;
453	rc = pVMM->pfnDBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_GS_BASE, &GCPtrTmp);
454	if ( RT_SUCCESS(rc)
455	&& !WINNT64_VALID_ADDRESS(GCPtrTmp))
456	{
457	/*
458	* Could be a user address when we stopped the VM right in usermode,
459	* read the GS kernel base MSR instead.
460	*/
461	rc = pVMM->pfnDBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_MSR_K8_KERNEL_GS_BASE, &GCPtrTmp);
462	}
463
464	if ( RT_SUCCESS(rc)
465	&& WINNT64_VALID_ADDRESS(GCPtrTmp))
466	{
467	LogFlow(("DigWinNt/KPCR[%u]: GS Base %RGv\n", idCpu, GCPtrTmp));
468	pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrAddr, GCPtrTmp);
469
470	rc = pVMM->pfnDBGFR3RegCpuQueryU64(pUVM, idCpu, DBGFREG_GDTR_BASE, &GCPtrTmp);
471	if (RT_SUCCESS(rc))
472	{
473	/*
474	* Read the start of the KPCR (@todo Probably move this to a global header)
475	* and verify its content.
476	*/
477	struct
478	{
479	RTGCUINTPTR GCPtrGdt;
480	RTGCUINTPTR GCPtrTss;
481	RTGCUINTPTR GCPtrUserRsp;
482	RTGCUINTPTR GCPtrSelf;
483	RTGCUINTPTR GCPtrCurrentPrcb;
484	} Kpcr;
485
486	rc = pVMM->pfnDBGFR3MemRead(pUVM, idCpu, pKpcrAddr, &Kpcr, sizeof(Kpcr));
487	if (RT_SUCCESS(rc))
488	{
489	if ( Kpcr.GCPtrGdt == GCPtrTmp
490	&& Kpcr.GCPtrSelf == pKpcrAddr->FlatPtr
491	/** @todo && TSS */ )
492	{
493	pVMM->pfnDBGFR3AddrFromFlat(pUVM, pKpcrbAddr, Kpcr.GCPtrCurrentPrcb);
494	LogRel(("DigWinNt/KPCR[%u]: KPCR=%RGv KPCRB=%RGv\n", idCpu, pKpcrAddr->FlatPtr, pKpcrbAddr->FlatPtr));
495	}
496	else
497	LogRel(("DigWinNt/KPCR[%u]: KPCR validation error GDT=(%RGv vs %RGv) KPCR=(%RGv vs %RGv)\n", idCpu,
498	Kpcr.GCPtrGdt, GCPtrTmp, Kpcr.GCPtrSelf, pKpcrAddr->FlatPtr));
499	}
500	else
501	LogRel(("DigWinNt/KPCR[%u]: Reading KPCR start at %RGv failed with %Rrc\n", idCpu, pKpcrAddr->FlatPtr, rc));
502	}
503	else
504	LogRel(("DigWinNt/KPCR[%u]: Getting GDT base register failed with %Rrc\n", idCpu, rc));
505	}
506	else
507	LogRel(("DigWinNt/KPCR[%u]: Getting GS base register failed with %Rrc\n", idCpu, rc));
508	}
509	}
510
511	if (RT_FAILURE(rc))
512	{
513	LogRel(("DigWinNt/KPCR: Failed to detmine KPCR and KPCRB rc=%Rrc\n", rc));
514	RTMemFree(pThis->paKpcrAddr);
515	pThis->paKpcrAddr = NULL;
516	pThis->paKpcrbAddr = NULL;
517	}
518	}
519	else
520	LogRel(("DigWinNt/KPCR: Failed to allocate %u entries for the KPCR/KPCRB addresses\n", cCpus * 2));
521	}
522
523
524	/**
525	* Process a PE image found in guest memory.
526	*
527	* @param pThis The instance data.
528	* @param pUVM The user mode VM handle.
529	* @param pVMM The VMM function table.
530	* @param pszName The module name.
531	* @param pszFilename The image filename.
532	* @param pImageAddr The image address.
533	* @param cbImage The size of the image.
534	*/
535	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, const char *pszName,
536	const char *pszFilename, PCDBGFADDRESS pImageAddr, uint32_t cbImage)
537	{
538	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
539
540	/*
541	* Do some basic validation first.
542	*/
543	if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
544	\|\| cbImage >= _1M * 256)
545	{
546	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
547	return;
548	}
549
550	/*
551	* Use the common in-memory module reader to create a debug module.
552	*/
553	RTERRINFOSTATIC ErrInfo;
554	RTDBGMOD hDbgMod = NIL_RTDBGMOD;
555	int rc = pVMM->pfnDBGFR3ModInMem(pUVM, pImageAddr, pThis->fNt31 ? DBGFMODINMEM_F_PE_NT31 : 0, pszName, pszFilename,
556	pThis->f32Bit ? RTLDRARCH_X86_32 : RTLDRARCH_AMD64, cbImage,
557	&hDbgMod, RTErrInfoInitStatic(&ErrInfo));
558	if (RT_SUCCESS(rc))
559	{
560	/*
561	* Tag the module.
562	*/
563	rc = RTDbgModSetTag(hDbgMod, DIG_WINNT_MOD_TAG);
564	AssertRC(rc);
565
566	/*
567	* Link the module.
568	*/
569	RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
570	if (hAs != NIL_RTDBGAS)
571	rc = RTDbgAsModuleLink(hAs, hDbgMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
572	else
573	rc = VERR_INTERNAL_ERROR;
574	RTDbgModRelease(hDbgMod);
575	RTDbgAsRelease(hAs);
576	}
577	else if (RTErrInfoIsSet(&ErrInfo.Core))
578	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc - %s\n", pszName, rc, ErrInfo.Core.pszMsg));
579	else
580	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc\n", pszName, rc));
581	}
582
583
584	/**
585	* Generate a debugger compatible module name from a filename.
586	*
587	* @returns Pointer to module name (doesn't need to be pszName).
588	* @param pszFilename The source filename.
589	* @param pszName Buffer to put the module name in.
590	* @param cbName Buffer size.
591	*/
592	static const char dbgDiggerWintNtFilenameToModuleName(const char pszFilename, char *pszName, size_t cbName)
593	{
594	/* Skip to the filename part of the filename. :-) */
595	pszFilename = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
596
597	/* We try use 'nt' for the kernel. */
598	if ( RTStrICmpAscii(pszFilename, "ntoskrnl.exe") == 0
599	\|\| RTStrICmpAscii(pszFilename, "ntkrnlmp.exe") == 0)
600	return "nt";
601
602
603	/* Drop the extension if .dll or .sys. */
604	size_t cchFilename = strlen(pszFilename);
605	if ( cchFilename > 4
606	&& pszFilename[cchFilename - 4] == '.')
607	{
608	if ( RTStrICmpAscii(&pszFilename[cchFilename - 4], ".sys") == 0
609	\|\| RTStrICmpAscii(&pszFilename[cchFilename - 4], ".dll") == 0)
610	cchFilename -= 4;
611	}
612
613	/* Copy and do replacements. */
614	if (cchFilename >= cbName)
615	cchFilename = cbName - 1;
616	size_t off;
617	for (off = 0; off < cchFilename; off++)
618	{
619	char ch = pszFilename[off];
620	if (!RT_C_IS_ALNUM(ch))
621	ch = '_';
622	pszName[off] = ch;
623	}
624	pszName[off] = '\0';
625	return pszName;
626	}
627
628
629	/**
630	* @interface_method_impl{DBGFOSIWINNT,pfnQueryVersion}
631	*/
632	static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryVersion(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
633	uint32_t puVersMajor, uint32_t puVersMinor,
634	uint32_t puBuildNumber, bool pf32Bit)
635	{
636	PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
637	RT_NOREF(pUVM, pVMM);
638
639	if (puVersMajor)
640	*puVersMajor = pData->NtMajorVersion;
641	if (puVersMinor)
642	*puVersMinor = pData->NtMinorVersion;
643	if (puBuildNumber)
644	*puBuildNumber = pData->NtBuildNumber;
645	if (pf32Bit)
646	*pf32Bit = pData->f32Bit;
647	return VINF_SUCCESS;
648	}
649
650
651	/**
652	* @interface_method_impl{DBGFOSIWINNT,pfnQueryKernelPtrs}
653	*/
654	static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryKernelPtrs(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
655	PRTGCUINTPTR pGCPtrKernBase, PRTGCUINTPTR pGCPtrPsLoadedModuleList)
656	{
657	PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
658	RT_NOREF(pUVM, pVMM);
659
660	*pGCPtrKernBase = pData->KernelAddr.FlatPtr;
661	*pGCPtrPsLoadedModuleList = pData->PsLoadedModuleListAddr.FlatPtr;
662	return VINF_SUCCESS;
663	}
664
665
666	/**
667	* @interface_method_impl{DBGFOSIWINNT,pfnQueryKpcrForVCpu}
668	*/
669	static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryKpcrForVCpu(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
670	VMCPUID idCpu, PRTGCUINTPTR pKpcr, PRTGCUINTPTR pKpcrb)
671	{
672	PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
673
674	if (!pData->paKpcrAddr)
675	return VERR_NOT_SUPPORTED;
676
677	AssertReturn(idCpu < pVMM->pfnDBGFR3CpuGetCount(pUVM), VERR_INVALID_CPU_ID);
678
679	if (pKpcr)
680	*pKpcr = pData->paKpcrAddr[idCpu].FlatPtr;
681	if (pKpcrb)
682	*pKpcrb = pData->paKpcrbAddr[idCpu].FlatPtr;
683	return VINF_SUCCESS;
684	}
685
686
687	/**
688	* @interface_method_impl{DBGFOSIWINNT,pfnQueryCurThrdForVCpu}
689	*/
690	static DECLCALLBACK(int) dbgDiggerWinNtIWinNt_QueryCurThrdForVCpu(struct DBGFOSIWINNT *pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
691	VMCPUID idCpu, PRTGCUINTPTR pCurThrd)
692	{
693	PDBGDIGGERWINNT pData = RT_FROM_MEMBER(pThis, DBGDIGGERWINNT, IWinNt);
694
695	if (!pData->paKpcrAddr)
696	return VERR_NOT_SUPPORTED;
697
698	AssertReturn(idCpu < pVMM->pfnDBGFR3CpuGetCount(pUVM), VERR_INVALID_CPU_ID);
699
700	DBGFADDRESS AddrCurThrdPtr = pData->paKpcrbAddr[idCpu];
701	pVMM->pfnDBGFR3AddrAdd(&AddrCurThrdPtr, 0x08); /** @todo Make this prettier. */
702	return pVMM->pfnDBGFR3MemRead(pUVM, idCpu, &AddrCurThrdPtr, pCurThrd, sizeof(*pCurThrd));
703	}
704
705
706	/**
707	* @copydoc DBGFOSREG::pfnStackUnwindAssist
708	*/
709	static DECLCALLBACK(int) dbgDiggerWinNtStackUnwindAssist(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, VMCPUID idCpu,
710	PDBGFSTACKFRAME pFrame, PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx,
711	RTDBGAS hAs, uint64_t *puScratch)
712	{
713	Assert(pInitialCtx);
714
715	/*
716	* We want to locate trap frames here. The trap frame structure contains
717	* the 64-bit IRET frame, so given unwind information it's easy to identify
718	* using the return type and frame address.
719	*/
720	if (pFrame->fFlags & DBGFSTACKFRAME_FLAGS_64BIT)
721	{
722	/*
723	* Is this a trap frame? If so, try read the trap frame.
724	*/
725	if ( pFrame->enmReturnType == RTDBGRETURNTYPE_IRET64
726	&& !(pFrame->AddrFrame.FlatPtr & 0x7)
727	&& WINNT64_VALID_ADDRESS(pFrame->AddrFrame.FlatPtr) )
728	{
729	KTRAP_FRAME_AMD64 TrapFrame;
730	RT_ZERO(TrapFrame);
731	uint64_t const uTrapFrameAddr = pFrame->AddrFrame.FlatPtr
732	- RT_UOFFSETOF(KTRAP_FRAME_AMD64, ErrCdOrXcptFrameOrS);
733	int rc = pState->pfnReadStack(pState, uTrapFrameAddr, sizeof(TrapFrame), &TrapFrame);
734	if (RT_SUCCESS(rc))
735	{
736	/* Valid? Not too much else we can check here (EFlags isn't
737	reliable in manually construct frames). */
738	if (TrapFrame.ExceptionActive <= 2)
739	{
740	pFrame->fFlags \|= DBGFSTACKFRAME_FLAGS_TRAP_FRAME;
741
742	/*
743	* Add sure 'register' information from the frame to the frame.
744	*
745	* To avoid code duplication, we do this in two steps in a loop.
746	* The first iteration only figures out how many registers we're
747	* going to save and allocates room for them. The second iteration
748	* does the actual adding.
749	*/
750	uint32_t cRegs = pFrame->cSureRegs;
751	PDBGFREGVALEX paSureRegs = NULL;
752	#define ADD_REG_NAMED(a_Type, a_ValMemb, a_Value, a_pszName) do { \
753	if (paSureRegs) \
754	{ \
755	paSureRegs[iReg].pszName = a_pszName;\
756	paSureRegs[iReg].enmReg = DBGFREG_END; \
757	paSureRegs[iReg].enmType = a_Type; \
758	paSureRegs[iReg].Value.a_ValMemb = (a_Value); \
759	} \
760	iReg++; \
761	} while (0)
762	#define MAYBE_ADD_GREG(a_Value, a_enmReg, a_idxReg) do { \
763	if (!(pState->u.x86.Loaded.s.fRegs & RT_BIT(a_idxReg))) \
764	{ \
765	if (paSureRegs) \
766	{ \
767	pState->u.x86.Loaded.s.fRegs \|= RT_BIT(a_idxReg); \
768	pState->u.x86.auRegs[a_idxReg] = (a_Value); \
769	paSureRegs[iReg].Value.u64 = (a_Value); \
770	paSureRegs[iReg].enmReg = a_enmReg; \
771	paSureRegs[iReg].enmType = DBGFREGVALTYPE_U64; \
772	paSureRegs[iReg].pszName = NULL; \
773	} \
774	iReg++; \
775	} \
776	} while (0)
777	for (unsigned iLoop = 0; iLoop < 2; iLoop++)
778	{
779	uint32_t iReg = pFrame->cSureRegs;
780	ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, uTrapFrameAddr, "TrapFrame");
781	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.ExceptionActive, "ExceptionActive");
782	if (TrapFrame.ExceptionActive == 0)
783	{
784	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.PreviousIrql, "PrevIrql");
785	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, (uint8_t)TrapFrame.ErrCdOrXcptFrameOrS, "IntNo");
786	}
787	else if ( TrapFrame.ExceptionActive == 1
788	&& TrapFrame.FaultIndicator == ((TrapFrame.ErrCdOrXcptFrameOrS >> 1) & 0x9))
789	ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, TrapFrame.FaultAddrOrCtxRecOrTS, "cr2-probably");
790	if (TrapFrame.SegCs & X86_SEL_RPL)
791	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "UserMode");
792	else
793	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "KernelMode");
794	if (TrapFrame.ExceptionActive <= 1)
795	{
796	MAYBE_ADD_GREG(TrapFrame.Rax, DBGFREG_RAX, X86_GREG_xAX);
797	MAYBE_ADD_GREG(TrapFrame.Rcx, DBGFREG_RCX, X86_GREG_xCX);
798	MAYBE_ADD_GREG(TrapFrame.Rdx, DBGFREG_RDX, X86_GREG_xDX);
799	MAYBE_ADD_GREG(TrapFrame.R8, DBGFREG_R8, X86_GREG_x8);
800	MAYBE_ADD_GREG(TrapFrame.R9, DBGFREG_R9, X86_GREG_x9);
801	MAYBE_ADD_GREG(TrapFrame.R10, DBGFREG_R10, X86_GREG_x10);
802	MAYBE_ADD_GREG(TrapFrame.R11, DBGFREG_R11, X86_GREG_x11);
803	}
804	else if (TrapFrame.ExceptionActive == 2)
805	{
806	MAYBE_ADD_GREG(TrapFrame.Rbx, DBGFREG_RBX, X86_GREG_xBX);
807	MAYBE_ADD_GREG(TrapFrame.Rsi, DBGFREG_RSI, X86_GREG_xSI);
808	MAYBE_ADD_GREG(TrapFrame.Rdi, DBGFREG_RDI, X86_GREG_xDI);
809	}
810	// MAYBE_ADD_GREG(TrapFrame.Rbp, DBGFREG_RBP, X86_GREG_xBP); - KiInterrupt[Sub]Dispatch* may leave this invalid.
811
812	/* Done? */
813	if (iLoop > 0)
814	{
815	Assert(cRegs == iReg);
816	break;
817	}
818
819	/* Resize the array, zeroing the extension. */
820	if (pFrame->cSureRegs)
821	paSureRegs = (PDBGFREGVALEX)pVMM->pfnMMR3HeapRealloc(pFrame->paSureRegs, iReg * sizeof(paSureRegs[0]));
822	else
823	paSureRegs = (PDBGFREGVALEX)pVMM->pfnMMR3HeapAllocU(pUVM, MM_TAG_DBGF_STACK, iReg * sizeof(paSureRegs[0]));
824	AssertReturn(paSureRegs, VERR_NO_MEMORY);
825
826	pFrame->paSureRegs = paSureRegs;
827	RT_BZERO(&paSureRegs[pFrame->cSureRegs], (iReg - pFrame->cSureRegs) * sizeof(paSureRegs[0]));
828	cRegs = iReg;
829	}
830	#undef ADD_REG_NAMED
831	#undef MAYBE_ADD_GREG
832
833	/* Commit the register update. */
834	pFrame->cSureRegs = cRegs;
835	}
836	}
837	}
838	}
839
840	RT_NOREF(pUVM, pVMM, pvData, idCpu, hAs, pInitialCtx, puScratch);
841	return VINF_SUCCESS;
842	}
843
844
845	/**
846	* @copydoc DBGFOSREG::pfnQueryInterface
847	*/
848	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, PCVMMR3VTABLE pVMM, void pvData, DBGFOSINTERFACE enmIf)
849	{
850	RT_NOREF(pUVM, pVMM);
851	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
852
853	switch (enmIf)
854	{
855	case DBGFOSINTERFACE_WINNT:
856	return &pThis->IWinNt;
857	default:
858	return NULL;
859	}
860	}
861
862
863	/**
864	* @copydoc DBGFOSREG::pfnQueryVersion
865	*/
866	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData,
867	char *pszVersion, size_t cchVersion)
868	{
869	RT_NOREF(pUVM, pVMM);
870	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
871	Assert(pThis->fValid);
872
873	const char *pszNtProductType;
874	switch (pThis->NtProductType)
875	{
876	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
877	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
878	case kNtProductType_Server: pszNtProductType = "-Server"; break;
879	default: pszNtProductType = ""; break;
880	}
881
882	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s (BuildNumber %u)", pThis->NtMajorVersion, pThis->NtMinorVersion,
883	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType, pThis->NtBuildNumber);
884	return VINF_SUCCESS;
885	}
886
887
888	/**
889	* @copydoc DBGFOSREG::pfnTerm
890	*/
891	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
892	{
893	RT_NOREF1(pUVM);
894	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
895	Assert(pThis->fValid);
896
897	/*
898	* As long as we're using our private LDR reader implementation,
899	* we must unlink and ditch the modules we created.
900	*/
901	RTDBGAS hDbgAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
902	if (hDbgAs != NIL_RTDBGAS)
903	{
904	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
905	while (iMod-- > 0)
906	{
907	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
908	if (hMod != NIL_RTDBGMOD)
909	{
910	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
911	{
912	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
913	AssertRC(rc);
914	}
915	RTDbgModRelease(hMod);
916	}
917	}
918	RTDbgAsRelease(hDbgAs);
919	}
920
921	if (pThis->paKpcrAddr)
922	RTMemFree(pThis->paKpcrAddr);
923	/* pThis->paKpcrbAddr comes from the same allocation as pThis->paKpcrAddr. */
924
925	pThis->paKpcrAddr = NULL;
926	pThis->paKpcrbAddr = NULL;
927
928	pThis->fValid = false;
929	}
930
931
932	/**
933	* @copydoc DBGFOSREG::pfnRefresh
934	*/
935	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
936	{
937	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
938	NOREF(pThis);
939	Assert(pThis->fValid);
940
941	/*
942	* For now we'll flush and reload everything.
943	*/
944	dbgDiggerWinNtTerm(pUVM, pVMM, pvData);
945
946	return dbgDiggerWinNtInit(pUVM, pVMM, pvData);
947	}
948
949
950	/**
951	* @copydoc DBGFOSREG::pfnInit
952	*/
953	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
954	{
955	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
956	Assert(!pThis->fValid);
957
958	union
959	{
960	uint8_t au8[0x2000];
961	RTUTF16 wsz[0x2000/2];
962	NTKUSERSHAREDDATA UserSharedData;
963	} u;
964	DBGFADDRESS Addr;
965	int rc;
966
967	/*
968	* Figure the NT version.
969	*/
970	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
971	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
972	if (RT_SUCCESS(rc))
973	{
974	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
975	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
976	: kNtProductType_Invalid;
977	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
978	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
979	pThis->NtBuildNumber = u.UserSharedData.NtBuildNumber;
980	}
981	else if (pThis->fNt31)
982	{
983	pThis->NtProductType = kNtProductType_WinNt;
984	pThis->NtMajorVersion = 3;
985	pThis->NtMinorVersion = 1;
986	pThis->NtBuildNumber = 0;
987	}
988	else
989	{
990	Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
991	return rc;
992	}
993
994	/*
995	* Dig out the module chain.
996	*/
997	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
998	Addr = pThis->KernelMteAddr;
999	do
1000	{
1001	/* Read the validate the MTE. */
1002	NTMTE Mte;
1003	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
1004	if (RT_FAILURE(rc))
1005	break;
1006	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
1007	{
1008	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
1009	break;
1010	}
1011	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
1012	{
1013	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
1014	break;
1015	}
1016	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
1017	{
1018	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
1019	break;
1020	}
1021	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
1022	{
1023	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
1024	break;
1025	}
1026	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
1027	{
1028	Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
1029	break;
1030	}
1031
1032	uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
1033	if ( !pThis->fNt31
1034	&& ( cbImageMte > _256M
1035	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
1036	{
1037	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
1038	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
1039	break;
1040	}
1041
1042	/* Read the full name. */
1043	DBGFADDRESS AddrName;
1044	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
1045	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
1046	if (cbName < sizeof(u))
1047	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
1048	else
1049	rc = VERR_OUT_OF_RANGE;
1050	if (RT_FAILURE(rc))
1051	{
1052	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
1053	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
1054	if (cbName < sizeof(u))
1055	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
1056	else
1057	rc = VERR_OUT_OF_RANGE;
1058	}
1059	if (RT_SUCCESS(rc))
1060	{
1061	u.wsz[cbName / 2] = '\0';
1062
1063	char *pszFilename;
1064	rc = RTUtf16ToUtf8(u.wsz, &pszFilename);
1065	if (RT_SUCCESS(rc))
1066	{
1067	char szModName[128];
1068	const char *pszModName = dbgDiggerWintNtFilenameToModuleName(pszFilename, szModName, sizeof(szModName));
1069
1070	/* Read the start of the PE image and pass it along to a worker. */
1071	DBGFADDRESS ImageAddr;
1072	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
1073	dbgDiggerWinNtProcessImage(pThis, pUVM, pVMM, pszModName, pszFilename, &ImageAddr, cbImageMte);
1074	RTStrFree(pszFilename);
1075	}
1076	}
1077
1078	/* next */
1079	AddrPrev = Addr;
1080	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
1081	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
1082	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
1083
1084	/* Try resolving the KPCR and KPCRB addresses for each vCPU. */
1085	dbgDiggerWinNtResolveKpcr(pThis, pUVM, pVMM);
1086
1087	pThis->fValid = true;
1088	return VINF_SUCCESS;
1089	}
1090
1091
1092	/**
1093	* @copydoc DBGFOSREG::pfnProbe
1094	*/
1095	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1096	{
1097	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1098	DBGFADDRESS Addr;
1099	union
1100	{
1101	uint8_t au8[8192];
1102	uint16_t au16[8192/2];
1103	uint32_t au32[8192/4];
1104	IMAGE_DOS_HEADER MzHdr;
1105	RTUTF16 wsz[8192/2];
1106	X86DESCGATE a32Gates[X86_XCPT_PF + 1];
1107	X86DESC64GATE a64Gates[X86_XCPT_PF + 1];
1108	} u;
1109
1110	union
1111	{
1112	NTMTE32 v32;
1113	NTMTE64 v64;
1114	} uMte, uMte2, uMte3;
1115
1116	/*
1117	* NT only runs in protected or long mode.
1118	*/
1119	CPUMMODE const enmMode = pVMM->pfnDBGFR3CpuGetMode(pUVM, 0 /idCpu/);
1120	if (enmMode != CPUMMODE_PROTECTED && enmMode != CPUMMODE_LONG)
1121	return false;
1122	bool const f64Bit = enmMode == CPUMMODE_LONG;
1123	uint64_t const uStart = f64Bit ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
1124	uint64_t const uEnd = f64Bit ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
1125
1126	/*
1127	* To approximately locate the kernel we examine the IDTR handlers.
1128	*
1129	* The exception/trap/fault handlers are all in NT kernel image, we pick
1130	* KiPageFault here.
1131	*/
1132	uint64_t uIdtrBase = 0;
1133	uint16_t uIdtrLimit = 0;
1134	int rc = pVMM->pfnDBGFR3RegCpuQueryXdtr(pUVM, 0, DBGFREG_IDTR, &uIdtrBase, &uIdtrLimit);
1135	AssertRCReturn(rc, false);
1136
1137	const uint16_t cbMinIdtr = (X86_XCPT_PF + 1) * (f64Bit ? sizeof(X86DESC64GATE) : sizeof(X86DESCGATE));
1138	if (uIdtrLimit < cbMinIdtr)
1139	return false;
1140
1141	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uIdtrBase), &u, cbMinIdtr);
1142	if (RT_FAILURE(rc))
1143	return false;
1144
1145	uint64_t uKrnlStart = uStart;
1146	uint64_t uKrnlEnd = uEnd;
1147	if (f64Bit)
1148	{
1149	uint64_t uHandler = u.a64Gates[X86_XCPT_PF].u16OffsetLow
1150	\| ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16)
1151	\| ((uint64_t)u.a64Gates[X86_XCPT_PF].u32OffsetTop << 32);
1152	if (uHandler < uStart \|\| uHandler > uEnd)
1153	return false;
1154	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _512M;
1155	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
1156	}
1157	else
1158	{
1159	uint32_t uHandler = RT_MAKE_U32(u.a32Gates[X86_XCPT_PF].u16OffsetLow, u.a32Gates[X86_XCPT_PF].u16OffsetHigh);
1160	if (uHandler < uStart \|\| uHandler > uEnd)
1161	return false;
1162	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _64M;
1163	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
1164	}
1165
1166	/*
1167	* Look for the PAGELK section name that seems to be a part of all kernels.
1168	* Then try find the module table entry for it. Since it's the first entry
1169	* in the PsLoadedModuleList we can easily validate the list head and report
1170	* success.
1171	*
1172	* Note! We ASSUME the section name is 8 byte aligned.
1173	*/
1174	DBGFADDRESS KernelAddr;
1175	for (pVMM->pfnDBGFR3AddrFromFlat(pUVM, &KernelAddr, uKrnlStart);
1176	KernelAddr.FlatPtr < uKrnlEnd;
1177	KernelAddr.FlatPtr += PAGE_SIZE)
1178	{
1179	bool fNt31 = false;
1180	DBGFADDRESS const RetryAddress = KernelAddr;
1181	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1182	8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
1183	if ( rc == VERR_DBGF_MEM_NOT_FOUND
1184	&& enmMode != CPUMMODE_LONG)
1185	{
1186	/* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
1187	following VirtualSize is zero, so check for that too. */
1188	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
1189	8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
1190	fNt31 = true;
1191	}
1192	if (RT_FAILURE(rc))
1193	break;
1194	pVMM->pfnDBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
1195
1196	/* MZ + PE header. */
1197	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
1198	if ( RT_SUCCESS(rc)
1199	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
1200	&& !(u.MzHdr.e_lfanew & 0x7)
1201	&& u.MzHdr.e_lfanew >= 0x080
1202	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
1203	{
1204	if (enmMode != CPUMMODE_LONG)
1205	{
1206	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
1207	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1208	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
1209	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1210	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1211	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
1212	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
1213	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1214	)
1215	{
1216	/* Find the MTE. */
1217	RT_ZERO(uMte);
1218	uMte.v32.DllBase = KernelAddr.FlatPtr;
1219	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1220	uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
1221	DBGFADDRESS HitAddr;
1222	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
1223	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1224	while (RT_SUCCESS(rc))
1225	{
1226	/* check the name. */
1227	DBGFADDRESS MteAddr = HitAddr;
1228	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1229	pVMM->pfnDBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
1230	&uMte2.v32, sizeof(uMte2.v32));
1231	if ( RT_SUCCESS(rc)
1232	&& uMte2.v32.DllBase == uMte.v32.DllBase
1233	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1234	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1235	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1236	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1237	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1238	&& uMte2.v32.BaseDllName.Length <= 128
1239	&& uMte2.v32.FullDllName.Length <= 260
1240	)
1241	{
1242	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1243	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1244	u.wsz, uMte2.v32.BaseDllName.Length);
1245	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1246	if ( RT_SUCCESS(rc)
1247	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1248	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1249	)
1250	)
1251	{
1252	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1253	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1254	uMte2.v32.InLoadOrderLinks.Blink),
1255	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1256	if ( RT_SUCCESS(rc)
1257	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1258	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1259	{
1260	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1261	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1262	pThis->KernelAddr = KernelAddr;
1263	pThis->KernelMteAddr = MteAddr;
1264	pThis->PsLoadedModuleListAddr = Addr;
1265	pThis->f32Bit = true;
1266	pThis->fNt31 = fNt31;
1267	return true;
1268	}
1269	}
1270	else if (RT_SUCCESS(rc))
1271	{
1272	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1273	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1274	break; /* Not NT kernel */
1275	}
1276	}
1277
1278	/* next */
1279	pVMM->pfnDBGFR3AddrAdd(&HitAddr, 4);
1280	if (HitAddr.FlatPtr < uEnd)
1281	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1282	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1283	else
1284	rc = VERR_DBGF_MEM_NOT_FOUND;
1285	}
1286	}
1287	}
1288	else
1289	{
1290	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
1291	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1292	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1293	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1294	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1295	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
1296	== IMAGE_FILE_EXECUTABLE_IMAGE
1297	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1298	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1299	)
1300	{
1301	/* Find the MTE. */
1302	RT_ZERO(uMte.v64);
1303	uMte.v64.DllBase = KernelAddr.FlatPtr;
1304	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1305	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1306	DBGFADDRESS ScanAddr;
1307	DBGFADDRESS HitAddr;
1308	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1309	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1310	while (RT_SUCCESS(rc))
1311	{
1312	/* Read the start of the MTE and check some basic members. */
1313	DBGFADDRESS MteAddr = HitAddr;
1314	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1315	pVMM->pfnDBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1316	&uMte2.v64, sizeof(uMte2.v64));
1317	if ( RT_SUCCESS(rc)
1318	&& uMte2.v64.DllBase == uMte.v64.DllBase
1319	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1320	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1321	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1322	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1323	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1324	&& uMte2.v64.BaseDllName.Length <= 128
1325	&& uMte2.v64.FullDllName.Length <= 260
1326	)
1327	{
1328	/* Try read the base name and compare with known NT kernel names. */
1329	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1330	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1331	u.wsz, uMte2.v64.BaseDllName.Length);
1332	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1333	if ( RT_SUCCESS(rc)
1334	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1335	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1336	)
1337	)
1338	{
1339	/* Read the link entry of the previous entry in the list and check that its
1340	forward pointer points at the MTE we've found. */
1341	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
1342	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr,
1343	uMte2.v64.InLoadOrderLinks.Blink),
1344	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1345	if ( RT_SUCCESS(rc)
1346	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1347	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1348	{
1349	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1350	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1351	pThis->KernelAddr = KernelAddr;
1352	pThis->KernelMteAddr = MteAddr;
1353	pThis->PsLoadedModuleListAddr = Addr;
1354	pThis->f32Bit = false;
1355	pThis->fNt31 = false;
1356	return true;
1357	}
1358	}
1359	else if (RT_SUCCESS(rc))
1360	{
1361	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1362	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1363	break; /* Not NT kernel */
1364	}
1365	}
1366
1367	/* next */
1368	pVMM->pfnDBGFR3AddrAdd(&HitAddr, 8);
1369	if (HitAddr.FlatPtr < uEnd)
1370	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1371	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1372	else
1373	rc = VERR_DBGF_MEM_NOT_FOUND;
1374	}
1375	}
1376	}
1377	}
1378	}
1379	return false;
1380	}
1381
1382
1383	/**
1384	* @copydoc DBGFOSREG::pfnDestruct
1385	*/
1386	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1387	{
1388	RT_NOREF(pUVM, pVMM, pvData);
1389	}
1390
1391
1392	/**
1393	* @copydoc DBGFOSREG::pfnConstruct
1394	*/
1395	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1396	{
1397	RT_NOREF(pUVM, pVMM);
1398	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1399	pThis->fValid = false;
1400	pThis->f32Bit = false;
1401	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1402
1403	pThis->IWinNt.u32Magic = DBGFOSIWINNT_MAGIC;
1404	pThis->IWinNt.pfnQueryVersion = dbgDiggerWinNtIWinNt_QueryVersion;
1405	pThis->IWinNt.pfnQueryKernelPtrs = dbgDiggerWinNtIWinNt_QueryKernelPtrs;
1406	pThis->IWinNt.pfnQueryKpcrForVCpu = dbgDiggerWinNtIWinNt_QueryKpcrForVCpu;
1407	pThis->IWinNt.pfnQueryCurThrdForVCpu = dbgDiggerWinNtIWinNt_QueryCurThrdForVCpu;
1408	pThis->IWinNt.u32EndMagic = DBGFOSIWINNT_MAGIC;
1409
1410	return VINF_SUCCESS;
1411	}
1412
1413
1414	const DBGFOSREG g_DBGDiggerWinNt =
1415	{
1416	/* .u32Magic = */ DBGFOSREG_MAGIC,
1417	/* .fFlags = */ 0,
1418	/* .cbData = */ sizeof(DBGDIGGERWINNT),
1419	/* .szName = */ "WinNT",
1420	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1421	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1422	/* .pfnProbe = */ dbgDiggerWinNtProbe,
1423	/* .pfnInit = */ dbgDiggerWinNtInit,
1424	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1425	/* .pfnTerm = */ dbgDiggerWinNtTerm,
1426	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1427	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1428	/* .pfnStackUnwindAssist = */ dbgDiggerWinNtStackUnwindAssist,
1429	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1430	};
1431

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 93516

Download in other formats: