dbgkrnlinfo-r0drv-nt.cpp@ 70204

Last change on this file since 70204 was 70204, checked in by vboxsync, 7 years ago
comment fix
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 32.0 KB

Line
1	/* $Id: dbgkrnlinfo-r0drv-nt.cpp 70204 2017-12-18 14:59:50Z vboxsync $ */
2	/** @file
3	* IPRT - Kernel Debug Information, R0 Driver, NT.
4	*/
5
6	/*
7	* Copyright (C) 2006-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#define IMAGE_NT_HEADERS NT_IMAGE_NT_HEADERS
32	#define IMAGE_NT_HEADERS32 NT_IMAGE_NT_HEADERS32
33	#define IMAGE_NT_HEADERS64 NT_IMAGE_NT_HEADERS64
34	#define PIMAGE_NT_HEADERS NT_PIMAGE_NT_HEADERS
35	#define PIMAGE_NT_HEADERS32 NT_PIMAGE_NT_HEADERS32
36	#define PIMAGE_NT_HEADERS64 NT_PIMAGE_NT_HEADERS64
37	#define IPRT_NT_MAP_TO_ZW
38	#include "the-nt-kernel.h"
39	#include <iprt/dbg.h>
40
41	#include <iprt/err.h>
42	#include <iprt/log.h>
43	#include <iprt/mem.h>
44	#include <iprt/string.h>
45	#include <iprt/utf16.h>
46	#include "internal-r0drv-nt.h"
47	#include "internal/magics.h"
48
49	#undef IMAGE_NT_HEADERS
50	#undef IMAGE_NT_HEADERS32
51	#undef IMAGE_NT_HEADERS64
52	#undef PIMAGE_NT_HEADERS
53	#undef PIMAGE_NT_HEADERS32
54	#undef PIMAGE_NT_HEADERS64
55	#include <iprt/formats/pecoff.h>
56	#include <iprt/formats/mz.h>
57
58
59	/*********************************************************************************************************************************
60	* Defined Constants And Macros *
61	*********************************************************************************************************************************/
62	/** Private logging macro, will use DbgPrint! */
63	#ifdef IN_GUEST
64	# define RTR0DBG_NT_ERROR_LOG(a) do { RTLogBackdoorPrintf a; DbgPrint a; } while (0)
65	# define RTR0DBG_NT_DEBUG_LOG(a) do { RTLogBackdoorPrintf a; DbgPrint a; } while (0)
66	#else
67	# define RTR0DBG_NT_ERROR_LOG(a) do { DbgPrint a; } while (0)
68	# define RTR0DBG_NT_DEBUG_LOG(a) do { DbgPrint a; } while (0)
69	#endif
70	#ifndef LOG_ENABLED
71	# undef RTR0DBG_NT_DEBUG_LOG
72	# define RTR0DBG_NT_DEBUG_LOG(a) do { } while (0)
73	#endif
74
75
76	/*********************************************************************************************************************************
77	* Structures and Typedefs *
78	*********************************************************************************************************************************/
79	#define PIMAGE_NT_HEADERS RT_CONCAT(PIMAGE_NT_HEADERS, ARCH_BITS)
80
81	/**
82	* Information we cache for a kernel module.
83	*/
84	typedef struct RTDBGNTKRNLMODINFO
85	{
86	/** The module name. */
87	char szName[32];
88
89	/** The image base. */
90	uint8_t const *pbImageBase;
91	/** The NT headers. */
92	PIMAGE_NT_HEADERS pNtHdrs;
93	/** Set if this module parsed okay and all fields are valid. */
94	bool fOkay;
95	/** The NT header offset/RVA. */
96	uint32_t offNtHdrs;
97	/** The end of the section headers. */
98	uint32_t offEndSectHdrs;
99	/** The end of the image. */
100	uint32_t cbImage;
101	/** Offset of the export directory. */
102	uint32_t offExportDir;
103	/** Size of the export directory. */
104	uint32_t cbExportDir;
105
106	/** Exported functions and data by ordinal (RVAs). */
107	uint32_t const *paoffExports;
108	/** The number of exports. */
109	uint32_t cExports;
110	/** The number of exported names. */
111	uint32_t cNamedExports;
112	/** Pointer to the array of exported names (RVAs to strings). */
113	uint32_t const *paoffNamedExports;
114	/** Array parallel to paoffNamedExports with the corresponding ordinals
115	* (indexes into paoffExports). */
116	uint16_t const *pau16NameOrdinals;
117	} RTDBGNTKRNLMODINFO;
118	/** Pointer to kernel module info. */
119	typedef RTDBGNTKRNLMODINFO *PRTDBGNTKRNLMODINFO;
120	/** Pointer to const kernel module info. */
121	typedef RTDBGNTKRNLMODINFO const *PCRTDBGNTKRNLMODINFO;
122
123
124	/**
125	* NT kernel info instance.
126	*/
127	typedef struct RTDBGKRNLINFOINT
128	{
129	/** Magic value (RTDBGKRNLINFO_MAGIC). */
130	uint32_t u32Magic;
131	/** Reference counter. */
132	uint32_t volatile cRefs;
133	/** Number of additional modules in the cache. */
134	uint32_t cModules;
135	/** Additional modules. */
136	RTDBGNTKRNLMODINFO aModules[3];
137	} RTDBGKRNLINFOINT;
138
139
140
141	/*********************************************************************************************************************************
142	* Global Variables *
143	*********************************************************************************************************************************/
144	/** Pointer to MmGetSystemRoutineAddress.
145	* @note Added in NT v5.0. */
146	#ifdef IPRT_TARGET_NT4
147	static decltype(MmGetSystemRoutineAddress) *g_pfnMmGetSystemRoutineAddress = NULL;
148	#else
149	static decltype(MmGetSystemRoutineAddress) *g_pfnMmGetSystemRoutineAddress = MmGetSystemRoutineAddress;
150	#endif
151	/** Info about the ntoskrnl.exe mapping. */
152	static RTDBGNTKRNLMODINFO g_NtOsKrnlInfo = { "ntoskrnl.exe", NULL, NULL, false, 0, 0, 0, 0, 0, NULL, 0, 0, NULL, NULL };
153	/** Info about the hal.dll mapping. */
154	static RTDBGNTKRNLMODINFO g_HalInfo = { "hal.dll", NULL, NULL, false, 0, 0, 0, 0, 0, NULL, 0, 0, NULL, NULL };
155
156
157
158	/**
159	* Looks up an symbol int the export table.
160	*
161	* @returns VINF_SUCCESS or VERR_SYMBOL_NOT_FOUND.
162	* @param pModInfo The module info.
163	* @param pszSymbol The symbol to find.
164	* @param ppvSymbol Where to put the symbol address.
165	*
166	* @note Support library has similar code for in the importless area.
167	*/
168	static int rtR0DbgKrnlInfoLookupSymbol(PCRTDBGNTKRNLMODINFO pModInfo, const char pszSymbol, void *ppvSymbol)
169	{
170	if (pModInfo->fOkay)
171	{
172	/*
173	* Binary search.
174	*/
175	__try
176	{
177	uint32_t iStart = 0;
178	uint32_t iEnd = pModInfo->cNamedExports;
179	while (iStart < iEnd)
180	{
181	uint32_t iCur = iStart + (iEnd - iStart) / 2;
182	uint32_t offExpName = pModInfo->paoffNamedExports[iCur];
183	if (offExpName >= pModInfo->offEndSectHdrs && offExpName < pModInfo->cbImage)
184	{ /* likely */ }
185	else
186	{
187	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: %s: Bad export name entry: %#x (iCur=%#x)\n",
188	pModInfo->szName, offExpName, iCur));
189	break;
190	}
191
192	const char pszExpName = (const char )&pModInfo->pbImageBase[offExpName];
193	int iDiff = strcmp(pszExpName, pszSymbol);
194	if (iDiff > 0) /* pszExpName > pszSymbol: search chunck before i */
195	iEnd = iCur;
196	else if (iDiff < 0) /* pszExpName < pszSymbol: search chunk after i */
197	iStart = iCur + 1;
198	else /* pszExpName == pszSymbol */
199	{
200	uint16_t iExpOrdinal = pModInfo->pau16NameOrdinals[iCur];
201	if (iExpOrdinal < pModInfo->cExports)
202	{
203	uint32_t offExport = pModInfo->paoffExports[iExpOrdinal];
204	if (offExport - pModInfo->offExportDir >= pModInfo->cbExportDir)
205	{
206	ppvSymbol = (void )&pModInfo->pbImageBase[offExport];
207	return VINF_SUCCESS;
208	}
209
210	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: %s: Forwarded symbol '%s': offExport=%#x (dir %#x LB %#x)\n",
211	pModInfo->szName, pszSymbol, offExport, pModInfo->offExportDir, pModInfo->cbExportDir));
212	}
213	else
214	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: %s: Name ordinal for '%s' is out of bounds: %#x (max %#x)\n",
215	pModInfo->szName, iExpOrdinal, pModInfo->cExports));
216	break;
217	}
218	}
219	}
220	__except(EXCEPTION_EXECUTE_HANDLER)
221	{
222	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: Exception searching '%s' for '%s'...\n",
223	pModInfo->szName, pszSymbol));
224	}
225	}
226
227	*ppvSymbol = NULL;
228	return VERR_SYMBOL_NOT_FOUND;
229	}
230
231
232	/**
233	* Parses (PE) module headers and fills in the coresponding module info struct.
234	*
235	* @returns true on if success, false if not.
236	* @param pModInfo The module info structure to fill in with parsed
237	* data. The szName and fOkay are set by the
238	* caller, this function does the rest.
239	* @param pbMapping The image mapping address
240	* @param cbMapping The image mapping size.
241	*
242	* @note Support library has similar code for in the importless area.
243	*/
244	static bool rtR0DbgKrnlNtParseModule(PRTDBGNTKRNLMODINFO pModInfo, uint8_t const *pbMapping, size_t cbMapping)
245	{
246	#define MODERR_RETURN(a_LogMsg, ...) \
247	do { RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtParseModule: " a_LogMsg, __VA_ARGS__)); return false; } while (0)
248
249	pModInfo->pbImageBase = pbMapping;
250
251	/*
252	* Locate the PE header, do some basic validations.
253	*/
254	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbMapping;
255	uint32_t offNtHdrs = 0;
256	PIMAGE_NT_HEADERS pNtHdrs;
257	if (pMzHdr->e_magic == IMAGE_DOS_SIGNATURE)
258	{
259	offNtHdrs = pMzHdr->e_lfanew;
260	if (offNtHdrs > _2K)
261	MODERR_RETURN("%s: e_lfanew=%#x, expected a lower value\n", pModInfo->szName, offNtHdrs);
262	}
263	pModInfo->pNtHdrs = pNtHdrs = (PIMAGE_NT_HEADERS)&pbMapping[offNtHdrs];
264
265	if (pNtHdrs->Signature != IMAGE_NT_SIGNATURE)
266	MODERR_RETURN("%s: Invalid PE signature: %#x", pModInfo->szName, pNtHdrs->Signature);
267	if (pNtHdrs->FileHeader.SizeOfOptionalHeader != sizeof(pNtHdrs->OptionalHeader))
268	MODERR_RETURN("%s: Unexpected optional header size: %#x\n", pModInfo->szName, pNtHdrs->FileHeader.SizeOfOptionalHeader);
269	if (pNtHdrs->OptionalHeader.Magic != RT_CONCAT3(IMAGE_NT_OPTIONAL_HDR,ARCH_BITS,_MAGIC))
270	MODERR_RETURN("%s: Unexpected optional header magic: %#x\n", pModInfo->szName, pNtHdrs->OptionalHeader.Magic);
271	if (pNtHdrs->OptionalHeader.NumberOfRvaAndSizes != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
272	MODERR_RETURN("%s: Unexpected number of RVA and sizes: %#x\n", pModInfo->szName, pNtHdrs->OptionalHeader.NumberOfRvaAndSizes);
273
274	pModInfo->offNtHdrs = offNtHdrs;
275	pModInfo->offEndSectHdrs = offNtHdrs
276	+ sizeof(*pNtHdrs)
277	+ pNtHdrs->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
278	pModInfo->cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
279	if (pModInfo->cbImage > cbMapping)
280	MODERR_RETURN("%s: The image size %#x is larger than the mapping: %#x\n",
281	pModInfo->szName, pModInfo->cbImage, cbMapping);
282
283	/*
284	* Find the export directory.
285	*/
286	IMAGE_DATA_DIRECTORY ExpDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
287	if ( ExpDir.Size < sizeof(IMAGE_EXPORT_DIRECTORY)
288	\|\| ExpDir.VirtualAddress < pModInfo->offEndSectHdrs
289	\|\| ExpDir.VirtualAddress >= pModInfo->cbImage
290	\|\| ExpDir.VirtualAddress + ExpDir.Size > pModInfo->cbImage)
291	MODERR_RETURN("%s: Missing or invalid export directory: %#lx LB %#x\n", pModInfo->szName, ExpDir.VirtualAddress, ExpDir.Size);
292	pModInfo->offExportDir = ExpDir.VirtualAddress;
293	pModInfo->cbExportDir = ExpDir.Size;
294
295	IMAGE_EXPORT_DIRECTORY const pExpDir = (IMAGE_EXPORT_DIRECTORY const )&pbMapping[ExpDir.VirtualAddress];
296
297	if ( pExpDir->NumberOfFunctions >= _1M
298	\|\| pExpDir->NumberOfFunctions < 1
299	\|\| pExpDir->NumberOfNames >= _1M
300	\|\| pExpDir->NumberOfNames < 1)
301	MODERR_RETURN("%s: NumberOfNames or/and NumberOfFunctions are outside the expected range: nof=%#x non=%#x\n",
302	pModInfo->szName, pExpDir->NumberOfFunctions, pExpDir->NumberOfNames);
303	pModInfo->cNamedExports = pExpDir->NumberOfNames;
304	pModInfo->cExports = RT_MAX(pExpDir->NumberOfNames, pExpDir->NumberOfFunctions);
305
306	if ( pExpDir->AddressOfFunctions < pModInfo->offEndSectHdrs
307	\|\| pExpDir->AddressOfFunctions >= pModInfo->cbImage
308	\|\| pExpDir->AddressOfFunctions + pModInfo->cExports * sizeof(uint32_t) > pModInfo->cbImage)
309	MODERR_RETURN("%s: Bad AddressOfFunctions: %#x\n", pModInfo->szName, pExpDir->AddressOfFunctions);
310	pModInfo->paoffExports = (uint32_t const *)&pbMapping[pExpDir->AddressOfFunctions];
311
312	if ( pExpDir->AddressOfNames < pModInfo->offEndSectHdrs
313	\|\| pExpDir->AddressOfNames >= pModInfo->cbImage
314	\|\| pExpDir->AddressOfNames + pExpDir->NumberOfNames * sizeof(uint32_t) > pModInfo->cbImage)
315	MODERR_RETURN("%s: Bad AddressOfNames: %#x\n", pModInfo->szName, pExpDir->AddressOfNames);
316	pModInfo->paoffNamedExports = (uint32_t const *)&pbMapping[pExpDir->AddressOfNames];
317
318	if ( pExpDir->AddressOfNameOrdinals < pModInfo->offEndSectHdrs
319	\|\| pExpDir->AddressOfNameOrdinals >= pModInfo->cbImage
320	\|\| pExpDir->AddressOfNameOrdinals + pExpDir->NumberOfNames * sizeof(uint32_t) > pModInfo->cbImage)
321	MODERR_RETURN("%s: Bad AddressOfNameOrdinals: %#x\n", pModInfo->szName, pExpDir->AddressOfNameOrdinals);
322	pModInfo->pau16NameOrdinals = (uint16_t const *)&pbMapping[pExpDir->AddressOfNameOrdinals];
323
324	/*
325	* Success.
326	*/
327	return true;
328	#undef MODERR_RETURN
329	}
330
331
332	/**
333	* Searches the module information from the kernel for the NT kernel module, the
334	* HAL module, and optionally one more module.
335	*
336	* If the NT kernel or HAL modules have already been found, they'll be skipped.
337	*
338	* @returns IPRT status code.
339	* @retval VERR_LDR_GENERAL_FAILURE if we failed to parse the NT kernel or HAL.
340	* @retval VERR_BAD_EXE_FORMAT if we failed to parse @a pModInfo.
341	* @retval VERR_MODULE_NOT_FOUND if @a pModInfo wasn't found.
342	* @retval VERR_BUFFER_UNDERFLOW if less that two modules was returned by the
343	* system.
344	*
345	* @param pModInfo Custom module to search for. Optional.
346	*/
347	static int rtR0DbgKrnlNtInit(PRTDBGNTKRNLMODINFO pModInfo)
348	{
349	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: pModInfo=%p\n", pModInfo));
350
351	/*
352	* Allocate a reasonably large buffer and get the information we need. We don't
353	* need everything since the result starts off with the kernel bits in load order.
354	*
355	* Note! ZwQuerySystemInformation requires NT4. For 3.51 we could possibly emit
356	* the syscall ourselves, if we cared.
357	*/
358	uint32_t cModules = pModInfo ? 110 /32KB/ : 27 /8KB/;
359	ULONG cbInfo = RT_OFFSETOF(RTL_PROCESS_MODULES, Modules[cModules]);
360	PRTL_PROCESS_MODULES pInfo = (PRTL_PROCESS_MODULES)RTMemAllocZ(cbInfo);
361	if (!pInfo)
362	{
363	cModules = cModules / 4;
364	cbInfo = RT_OFFSETOF(RTL_PROCESS_MODULES, Modules[cModules]);
365	pInfo = (PRTL_PROCESS_MODULES)RTMemAllocZ(cbInfo);
366	if (!pInfo)
367	{
368	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Out of memory!\n"));
369	return VERR_NO_MEMORY;
370	}
371	}
372
373	int rc;
374	ULONG cbActual = 0;
375	NTSTATUS rcNt = ZwQuerySystemInformation(SystemModuleInformation, pInfo, cbInfo, &cbActual);
376	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: ZwQuerySystemInformation returned %#x and NumberOfModules=%#x\n",
377	rcNt, pInfo->NumberOfModules));
378	if ( NT_SUCCESS(rcNt)
379	\|\| rcNt == STATUS_INFO_LENGTH_MISMATCH)
380	rc = VINF_SUCCESS;
381	else
382	{
383	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: ZwQuerySystemInformation failed: %#x\n", rcNt));
384	rc = RTErrConvertFromNtStatus(rcNt);
385	}
386	if (RT_SUCCESS(rc))
387	{
388	/*
389	* Search the info. The information is ordered with the kernel bits first,
390	* we expect aleast two modules to be returned to us (kernel + hal)!
391	*/
392	#if ARCH_BITS == 32
393	uintptr_t const uMinKernelAddr = _2G; /** @todo resolve MmSystemRangeStart */
394	#else
395	uintptr_t const uMinKernelAddr = (uintptr_t)MM_SYSTEM_RANGE_START;
396	#endif
397	if (pInfo->NumberOfModules < cModules)
398	cModules = pInfo->NumberOfModules;
399	if (cModules < 2)
400	{
401	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Error! Only %u module(s) returned!\n", cModules));
402	rc = VERR_BUFFER_UNDERFLOW;
403	}
404	for (uint32_t iModule = 0; iModule < cModules; iModule++)
405	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: [%u]= %p LB %#x %s\n", iModule, pInfo->Modules[iModule].ImageBase,
406	pInfo->Modules[iModule].ImageSize, pInfo->Modules[iModule].FullPathName));
407
408	/*
409	* First time around we serch for the NT kernel and HAL. We'll look for NT
410	* kerneland HAL in the first 16 entries, and if not found, use the first
411	* and second entry respectively.
412	*/
413	if ( RT_SUCCESS(rc)
414	&& !g_NtOsKrnlInfo.pbImageBase
415	&& !g_HalInfo.pbImageBase)
416	{
417	/* Find them. */
418	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Looking for kernel and hal...\n"));
419	uint32_t const cMaxModules = RT_MIN(cModules, 16);
420	uint32_t idxNtOsKrnl = UINT32_MAX;
421	uint32_t idxHal = UINT32_MAX;
422	for (uint32_t iModule = 0; iModule < cMaxModules; iModule++)
423	{
424	RTL_PROCESS_MODULE_INFORMATION const * const pModule = &pInfo->Modules[iModule];
425	if ( (uintptr_t)pModule->ImageBase >= uMinKernelAddr
426	&& (uintptr_t)pModule->ImageSize >= _4K)
427	{
428	const char pszName = (const char )&pModule->FullPathName[pModule->OffsetToFileName];
429	if ( idxNtOsKrnl == UINT32_MAX
430	&& RTStrICmpAscii(pszName, g_NtOsKrnlInfo.szName) == 0)
431	{
432	idxNtOsKrnl = iModule;
433	if (idxHal != UINT32_MAX)
434	break;
435	}
436	else if ( idxHal == UINT32_MAX
437	&& RTStrICmpAscii(pszName, g_HalInfo.szName) == 0)
438	{
439	idxHal = iModule;
440	if (idxHal != UINT32_MAX)
441	break;
442	}
443	}
444	}
445	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: idxNtOsKrnl=%#x idxHal=%#x\n", idxNtOsKrnl, idxHal));
446	if (idxNtOsKrnl == UINT32_MAX)
447	{
448	idxNtOsKrnl = 0;
449	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: 'ntoskrnl.exe' not found, picking '%s' instead\n",
450	pInfo->Modules[idxNtOsKrnl].FullPathName));
451	}
452	if (idxHal == UINT32_MAX)
453	{
454	idxHal = 1;
455	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: 'hal.dll' not found, picking '%s' instead\n",
456	pInfo->Modules[idxHal].FullPathName));
457	}
458
459	/* Parse them. */
460	//RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Parsing NT kernel...\n"));
461	__try
462	{
463	g_NtOsKrnlInfo.fOkay = rtR0DbgKrnlNtParseModule(&g_NtOsKrnlInfo,
464	(uint8_t const *)pInfo->Modules[idxNtOsKrnl].ImageBase,
465	pInfo->Modules[idxNtOsKrnl].ImageSize);
466	}
467	__except(EXCEPTION_EXECUTE_HANDLER)
468	{
469	g_NtOsKrnlInfo.fOkay = false;
470	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Exception in rtR0DbgKrnlNtParseModule parsing ntoskrnl.exe...\n"));
471	}
472
473	//RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Parsing HAL...\n"));
474	__try
475	{
476	g_HalInfo.fOkay = rtR0DbgKrnlNtParseModule(&g_HalInfo, (uint8_t const *)pInfo->Modules[idxHal].ImageBase,
477	pInfo->Modules[idxHal].ImageSize);
478	}
479	__except(EXCEPTION_EXECUTE_HANDLER)
480	{
481	g_HalInfo.fOkay = false;
482	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Exception in rtR0DbgKrnlNtParseModule parsing hal.dll...\n"));
483	}
484	if (!g_NtOsKrnlInfo.fOkay \|\| !g_HalInfo.fOkay)
485	rc = VERR_LDR_GENERAL_FAILURE;
486
487	/*
488	* Resolve symbols we may need in the NT kernel (provided it parsed successfully)
489	*/
490	if (g_NtOsKrnlInfo.fOkay)
491	{
492	if (!g_pfnMmGetSystemRoutineAddress)
493	{
494	//RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Looking up 'MmGetSystemRoutineAddress'...\n"));
495	rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, "MmGetSystemRoutineAddress", (void **)&g_pfnMmGetSystemRoutineAddress);
496	}
497	}
498	}
499
500	/*
501	* If we're still good, search for the given module (optional).
502	*/
503	if (RT_SUCCESS(rc) && pModInfo)
504	{
505	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Locating module '%s'...\n", pModInfo->szName));
506	rc = VERR_MODULE_NOT_FOUND;
507	for (uint32_t iModule = 0; iModule < cModules; iModule++)
508	{
509	RTL_PROCESS_MODULE_INFORMATION const * const pModule = &pInfo->Modules[iModule];
510	if ( (uintptr_t)pModule->ImageBase >= uMinKernelAddr
511	&& (uintptr_t)pModule->ImageSize >= _4K)
512	{
513	const char pszName = (const char )&pModule->FullPathName[pModule->OffsetToFileName];
514	if ( pModInfo->pbImageBase == NULL
515	&& RTStrICmpAscii(pszName, pModInfo->szName) == 0)
516	{
517	/*
518	* Found the module, try parse it.
519	*/
520	__try
521	{
522	pModInfo->fOkay = rtR0DbgKrnlNtParseModule(pModInfo, (uint8_t const *)pModule->ImageBase,
523	pModule->ImageSize);
524	rc = VINF_SUCCESS;
525	}
526	__except(EXCEPTION_EXECUTE_HANDLER)
527	{
528	pModInfo->fOkay = false;
529	rc = VERR_BAD_EXE_FORMAT;
530	}
531	break;
532	}
533	}
534	}
535	}
536	}
537
538	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: returns %d\n", rc));
539	RTMemFree(pInfo);
540	return rc;
541	}
542
543
544
545	RTR0DECL(int) RTR0DbgKrnlInfoOpen(PRTDBGKRNLINFO phKrnlInfo, uint32_t fFlags)
546	{
547	AssertReturn(!fFlags, VERR_INVALID_FLAGS);
548
549	RTDBGKRNLINFOINT pThis = (RTDBGKRNLINFOINT )RTMemAllocZ(sizeof(*pThis));
550	if (pThis)
551	{
552	pThis->u32Magic = RTDBGKRNLINFO_MAGIC;
553	pThis->cRefs = 1;
554	*phKrnlInfo = pThis;
555	return VINF_SUCCESS;
556	}
557	return VERR_NO_MEMORY;
558	}
559
560
561	RTR0DECL(uint32_t) RTR0DbgKrnlInfoRetain(RTDBGKRNLINFO hKrnlInfo)
562	{
563	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
564	AssertPtrReturn(pThis, UINT32_MAX);
565	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), UINT32_MAX);
566
567	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
568	Assert(cRefs && cRefs < 100000);
569	return cRefs;
570	}
571
572
573	static void rtR0DbgKrnlNtDtor(RTDBGKRNLINFOINT *pThis)
574	{
575	pThis->u32Magic = ~RTDBGKRNLINFO_MAGIC;
576	RTMemFree(pThis);
577	}
578
579
580	RTR0DECL(uint32_t) RTR0DbgKrnlInfoRelease(RTDBGKRNLINFO hKrnlInfo)
581	{
582	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
583	if (pThis == NIL_RTDBGKRNLINFO)
584	return 0;
585	AssertPtrReturn(pThis, UINT32_MAX);
586	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), UINT32_MAX);
587
588	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
589	if (cRefs == 0)
590	rtR0DbgKrnlNtDtor(pThis);
591	return cRefs;
592	}
593
594
595	RTR0DECL(int) RTR0DbgKrnlInfoQueryMember(RTDBGKRNLINFO hKrnlInfo, const char pszModule, const char pszStructure,
596	const char pszMember, size_t poffMember)
597	{
598	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
599	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
600	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
601	AssertPtrReturn(pszMember, VERR_INVALID_POINTER);
602	AssertPtrNullReturn(pszModule, VERR_INVALID_POINTER);
603	AssertPtrReturn(pszStructure, VERR_INVALID_POINTER);
604	AssertPtrReturn(poffMember, VERR_INVALID_POINTER);
605	return VERR_NOT_FOUND;
606	}
607
608
609	RTR0DECL(int) RTR0DbgKrnlInfoQuerySymbol(RTDBGKRNLINFO hKrnlInfo, const char pszModule, const char pszSymbol, void **ppvSymbol)
610	{
611	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
612	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
613	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
614	AssertPtrReturn(pszSymbol, VERR_INVALID_PARAMETER);
615	AssertPtrNullReturn(ppvSymbol, VERR_INVALID_PARAMETER);
616
617	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: pszModule=%s pszSymbol=%s\n", pszModule ? pszModule : "<null>", pszSymbol));
618
619	void *pvTmpSymbol = NULL;
620	if (!ppvSymbol)
621	ppvSymbol = &pvTmpSymbol;
622
623	int rc;
624	if (!pszModule)
625	{
626	/*
627	* Search both ntoskrnl and hal, may use MmGetSystemRoutineAddress as fallback.
628	* Note! MmGetSystemRoutineAddress was buggy before XP SP2 according to Geoff Chappell.
629	*/
630	if (g_NtOsKrnlInfo.pbImageBase)
631	rc = VINF_SUCCESS;
632	else
633	rc = rtR0DbgKrnlNtInit(NULL);
634	if (RT_SUCCESS(rc))
635	{
636	Assert(g_NtOsKrnlInfo.fOkay);
637	Assert(g_HalInfo.fOkay);
638	//RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: Calling RTR0DbgKrnlInfoQuerySymbol on NT kernel...\n"));
639	rc = rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, pszSymbol, ppvSymbol);
640	if (RT_FAILURE(rc))
641	{
642	//RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: Calling RTR0DbgKrnlInfoQuerySymbol on HAL kernel...\n"));
643	rc = rtR0DbgKrnlInfoLookupSymbol(&g_HalInfo, pszSymbol, ppvSymbol);
644	}
645	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: #1 returns %d ppvSymbol=%p\n", rc, ppvSymbol));
646	}
647	else
648	{
649	/* Init failed. Try resolve symbol, but preserve the status code up to a point. */
650	int rc2 = VERR_SYMBOL_NOT_FOUND;
651	if (g_NtOsKrnlInfo.fOkay)
652	rc2 = rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, pszSymbol, ppvSymbol);
653	if (g_HalInfo.fOkay && rc2 == VERR_SYMBOL_NOT_FOUND)
654	rc2 = rtR0DbgKrnlInfoLookupSymbol(&g_HalInfo, pszSymbol, ppvSymbol);
655	if ( rc2 == VERR_SYMBOL_NOT_FOUND
656	&& g_pfnMmGetSystemRoutineAddress)
657	{
658	/* We'll overwrite init failure status code here since
659	MmGetSystemRoutineAddress will do the job for us. */
660	PRTUTF16 pwszSymbol;
661	rc = RTStrToUtf16(pszSymbol, &pwszSymbol);
662	if (RT_SUCCESS(rc))
663	{
664	UNICODE_STRING UniStr;
665	UniStr.Buffer = pwszSymbol;
666	UniStr.Length = (uint16_t)RTUtf16Len(pwszSymbol);
667	UniStr.MaximumLength = UniStr.Length + 1;
668	*ppvSymbol = g_pfnMmGetSystemRoutineAddress(&UniStr);
669	if (*ppvSymbol)
670	rc = VINF_SUCCESS;
671	else
672	rc = VERR_SYMBOL_NOT_FOUND;
673	RTUtf16Free(pwszSymbol);
674	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: #2 returns %d ppvSymbol=%p\n", rc, ppvSymbol));
675	}
676	}
677	}
678	}
679	else
680	{
681	/*
682	* Search specified module.
683	*/
684	rc = VERR_MODULE_NOT_FOUND;
685	PRTDBGNTKRNLMODINFO pModInfo;
686	if (RTStrICmpAscii(pszModule, g_NtOsKrnlInfo.szName) == 0)
687	pModInfo = &g_NtOsKrnlInfo;
688	else if (RTStrICmpAscii(pszModule, g_HalInfo.szName) == 0)
689	pModInfo = &g_NtOsKrnlInfo;
690	else
691	{
692	pModInfo = NULL;
693	for (unsigned i = 0; i < pThis->cModules; i++)
694	if (RTStrICmpAscii(pszModule, pThis->aModules[i].szName) == 0)
695	{
696	pModInfo = &pThis->aModules[i];
697	break;
698	}
699	if (!pModInfo)
700	{
701	/*
702	* Not found, try load it. If module table is full, drop the first
703	* entry and shuffle the other up to make space.
704	*/
705	size_t const cchModule = strlen(pszModule);
706	RTDBGNTKRNLMODINFO NewModInfo;
707	if (cchModule < sizeof(NewModInfo.szName))
708	{
709	RT_ZERO(NewModInfo);
710	memcpy(NewModInfo.szName, pszModule, cchModule);
711	NewModInfo.szName[cchModule] = '\0';
712
713	rc = rtR0DbgKrnlNtInit(&NewModInfo);
714	if (RT_SUCCESS(rc))
715	{
716	Assert(NewModInfo.fOkay);
717	uint32_t iModule = pThis->cModules;
718	if (iModule >= RT_ELEMENTS(pThis->aModules))
719	{
720	iModule = RT_ELEMENTS(pThis->aModules) - 1;
721	memmove(&pThis->aModules[0], &pThis->aModules[1], iModule * sizeof(pThis->aModules[0]));
722	}
723	pThis->aModules[iModule] = NewModInfo;
724	pThis->cModules = iModule + 1;
725	pModInfo = &pThis->aModules[iModule];
726	rc = VINF_SUCCESS;
727	}
728	}
729	else
730	{
731	AssertMsgFailed(("cchModule=%zu pszModule=%s\n", cchModule, pszModule));
732	rc = VERR_FILENAME_TOO_LONG;
733	}
734	}
735	}
736	if (pModInfo)
737	{
738	rc = rtR0DbgKrnlInfoLookupSymbol(pModInfo, pszSymbol, ppvSymbol);
739	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: #3 returns %d ppvSymbol=%p\n", rc, ppvSymbol));
740	}
741	}
742	return rc;
743	}
744
745
746	RTR0DECL(int) RTR0DbgKrnlInfoQuerySize(RTDBGKRNLINFO hKrnlInfo, const char pszModule, const char pszType, size_t *pcbType)
747	{
748	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
749	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
750	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
751	AssertPtrNullReturn(pszModule, VERR_INVALID_POINTER);
752	AssertPtrReturn(pszType, VERR_INVALID_POINTER);
753	AssertPtrReturn(pcbType, VERR_INVALID_POINTER);
754	return VERR_NOT_FOUND;
755	}
756

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/r0drv/nt/dbgkrnlinfo-r0drv-nt.cpp@ 70204

Download in other formats: