nt3fakes-r0drv-nt.cpp@ 74125

Last change on this file since 74125 was 73097, checked in by vboxsync, 7 years ago
*: Made RT_UOFFSETOF, RT_OFFSETOF, RT_UOFFSETOF_ADD and RT_OFFSETOF_ADD work like builtin_offsetof() and require compile time resolvable requests, adding RT_UOFFSETOF_DYN for the dynamic questions that can only be answered at runtime.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 32.0 KB

Line
1	/* $Id: nt3fakes-r0drv-nt.cpp 73097 2018-07-12 21:06:33Z vboxsync $ */
2	/** @file
3	* IPRT - NT 3.x fakes for NT 4.0 KPIs.
4	*/
5
6	/*
7	* Copyright (C) 2006-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#define _IMAGE_NT_HEADERS RT_CONCAT(_IMAGE_NT_HEADERS,ARCH_BITS)
32	#include "the-nt-kernel.h"
33	#include <iprt/mem.h>
34
35	#include <iprt/assert.h>
36	#include <iprt/asm.h>
37	#include <iprt/ctype.h>
38	#include <iprt/dbg.h>
39	#include <iprt/err.h>
40	#include <iprt/log.h>
41	#include <iprt/string.h>
42	#include <iprt/x86.h>
43	#include <iprt/formats/mz.h>
44	#include <iprt/formats/pecoff.h>
45	#include "internal-r0drv-nt.h"
46
47	typedef uint32_t DWORD;
48	#include <VerRsrc.h>
49
50
51	/*********************************************************************************************************************************
52	* Internal Functions *
53	*********************************************************************************************************************************/
54	DECLASM(void) rtNt3InitSymbolsAssembly(void); /* in nt3fakesA-r0drv-nt.asm */
55
56
57	/*********************************************************************************************************************************
58	* Global Variables *
59	*********************************************************************************************************************************/
60	static uint32_t g_uNt3MajorVer = 3;
61	static uint32_t g_uNt3MinorVer = 51;
62	static uint32_t g_uNt3BuildNo = 1057;
63	static bool g_fNt3Checked = false;
64	static bool g_fNt3Smp = false; /*< Not reliable. /
65	static bool volatile g_fNt3VersionInitialized = false;
66
67	static uint8_t g_pbNt3OsKrnl = (uint8_t )UINT32_C(0x80100000);
68	static uint32_t g_cbNt3OsKrnl = 0x300000;
69	static uint8_t g_pbNt3Hal = (uint8_t )UINT32_C(0x80400000);
70	static uint32_t g_cbNt3Hal = _512K;
71	static bool volatile g_fNt3ModuleInfoInitialized = false;
72
73
74	RT_C_DECLS_BEGIN
75	/** @name KPIs we provide fallback implementations for.
76	*
77	* The assembly init routine will point the __imp_xxx variable to the NT
78	* implementation if available, using the fallback if not.
79	* @{ */
80	decltype(PsGetVersion) *g_pfnrtPsGetVersion;
81	decltype(ZwQuerySystemInformation) *g_pfnrtZwQuerySystemInformation;
82	decltype(KeSetTimerEx) *g_pfnrtKeSetTimerEx;
83	decltype(IoAttachDeviceToDeviceStack) *g_pfnrtIoAttachDeviceToDeviceStack;
84	decltype(PsGetCurrentProcessId) *g_pfnrtPsGetCurrentProcessId;
85	decltype(ZwYieldExecution) *g_pfnrtZwYieldExecution;
86	decltype(ExAcquireFastMutex) *g_pfnrtExAcquireFastMutex;
87	decltype(ExReleaseFastMutex) *g_pfnrtExReleaseFastMutex;
88	/** @} */
89
90	/** @name Fastcall optimizations not present in NT 3.1.
91	*
92	* We try resolve both the stdcall and fastcall variants and patch it up in
93	* assembly. The last four routines are in the hal.
94	*
95	* @{ */
96	decltype(IofCompleteRequest) *g_pfnrtIofCompleteRequest;
97	decltype(ObfDereferenceObject) *g_pfnrtObfDereferenceObject;
98	decltype(IofCallDriver) *g_pfnrtIofCallDriver;
99	decltype(KfAcquireSpinLock) *g_pfnrtKfAcquireSpinLock;
100	decltype(KfReleaseSpinLock) *g_pfnrtKfReleaseSpinLock;
101	decltype(KefAcquireSpinLockAtDpcLevel) *g_pfnrtKefAcquireSpinLockAtDpcLevel;
102	decltype(KefReleaseSpinLockFromDpcLevel) *g_pfnrtKefReleaseSpinLockFromDpcLevel;
103	decltype(KfLowerIrql) *g_pfnrtKfLowerIrql;
104	decltype(KfRaiseIrql) *g_pfnrtKfRaiseIrql;
105
106	VOID (__stdcall *g_pfnrtIoCompleteRequest)(PIRP, CCHAR);
107	LONG_PTR (__stdcall *g_pfnrtObDereferenceObject)(PVOID);
108	NTSTATUS (__stdcall *g_pfnrtIoCallDriver)(PDEVICE_OBJECT, PIRP);
109	KIRQL (__stdcall *g_pfnrtKeAcquireSpinLock)(PKSPIN_LOCK);
110	VOID (__stdcall *g_pfnrtKeReleaseSpinLock)(PKSPIN_LOCK, KIRQL);
111	KIRQL (__stdcall *g_pfnrtKeAcquireSpinLockAtDpcLevel)(PKSPIN_LOCK);
112	VOID (__stdcall *g_pfnrtKeReleaseSpinLockFromDpcLevel)(PKSPIN_LOCK);
113	VOID (__stdcall *g_pfnrtKeLowerIrql)(KIRQL);
114	KIRQL (__stdcall *g_pfnrtKeRaiseIrql)(KIRQL);
115	/** @} */
116
117	/** @name DATA exports and associated stuff
118	* @{ */
119	/** Import address table entry for KeTickCount (defined in asm). */
120	extern KSYSTEM_TIME *_imp__KeTickCount;
121	/** @} */
122
123	RT_C_DECLS_END
124
125
126	/*********************************************************************************************************************************
127	* Internal Functions *
128	*********************************************************************************************************************************/
129	static void rtR0Nt3InitModuleInfo(void);
130
131
132	/**
133	* Converts a string to a number, stopping at the first non-digit.
134	*
135	* @returns The value
136	* @param ppwcValue Pointer to the string pointer variable. Updated.
137	* @param pcwcValue Pointer to the string length variable. Updated.
138	*/
139	static uint32_t rtR0Nt3StringToNum(PCRTUTF16 ppwcValue, size_t pcwcValue)
140	{
141	uint32_t uValue = 0;
142	PCRTUTF16 pwcValue = *ppwcValue;
143	size_t cwcValue = *pcwcValue;
144
145	while (cwcValue > 0)
146	{
147	RTUTF16 uc = *pwcValue;
148	unsigned uDigit = (unsigned)uc - (unsigned)'0';
149	if (uDigit < (unsigned)10)
150	{
151	uValue *= 10;
152	uValue += uDigit;
153	}
154	else
155	break;
156	pwcValue++;
157	cwcValue--;
158	}
159
160	*ppwcValue = pwcValue;
161	*pcwcValue = cwcValue;
162	return uValue;
163	}
164
165
166	/**
167	* Implements RTL_QUERY_REGISTRY_ROUTINE for processing
168	* 'HKLM/Software/Microsoft/Window NT/CurrentVersion/CurrentVersion'
169	*/
170	static NTSTATUS NTAPI rtR0Nt3VerEnumCallback_CurrentVersion(PWSTR pwszValueName, ULONG uValueType,
171	PVOID pvValue, ULONG cbValue, PVOID pvUser, PVOID pvEntryCtx)
172	{
173	RT_NOREF(pwszValueName, pvEntryCtx);
174	if ( uValueType == REG_SZ
175	\|\| uValueType == REG_EXPAND_SZ)
176	{
177	PCRTUTF16 pwcValue = (PCRTUTF16)pvValue;
178	size_t cwcValue = cbValue / sizeof(*pwcValue);
179	uint32_t uMajor = rtR0Nt3StringToNum(&pwcValue, &cwcValue);
180	uint32_t uMinor = 0;
181	if (cwcValue > 1)
182	{
183	pwcValue++;
184	cwcValue--;
185	uMinor = rtR0Nt3StringToNum(&pwcValue, &cwcValue);
186	}
187
188	if (uMajor >= 3)
189	{
190	g_uNt3MajorVer = uMajor;
191	g_uNt3MinorVer = uMinor;
192	RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentVersion found: uMajor=%u uMinor=%u\n", uMajor, uMinor);
193	(uint32_t )pvUser \|= RT_BIT_32(0);
194	return STATUS_SUCCESS;
195	}
196
197	RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentVersion: '%.*ls'\n", cbValue / sizeof(RTUTF16), pvValue);
198	}
199	else
200	RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentVersion: uValueType=%u %.*Rhxs\n", uValueType, cbValue, pvValue);
201	return STATUS_SUCCESS;
202	}
203
204
205	/**
206	* Implements RTL_QUERY_REGISTRY_ROUTINE for processing
207	* 'HKLM/Software/Microsoft/Window NT/CurrentVersion/CurrentBuildNumber'
208	*/
209	static NTSTATUS NTAPI rtR0Nt3VerEnumCallback_CurrentBuildNumber(PWSTR pwszValueName, ULONG uValueType,
210	PVOID pvValue, ULONG cbValue, PVOID pvUser, PVOID pvEntryCtx)
211	{
212	RT_NOREF(pwszValueName, pvEntryCtx);
213	if ( uValueType == REG_SZ
214	\|\| uValueType == REG_EXPAND_SZ)
215	{
216	PCRTUTF16 pwcValue = (PCRTUTF16)pvValue;
217	size_t cwcValue = cbValue / sizeof(*pwcValue);
218	uint32_t uBuildNo = rtR0Nt3StringToNum(&pwcValue, &cwcValue);
219
220	if (uBuildNo >= 100 && uBuildNo < _1M)
221	{
222	g_uNt3BuildNo = uBuildNo;
223	RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentBuildNumber found: uBuildNo=%u\n", uBuildNo);
224	(uint32_t )pvUser \|= RT_BIT_32(1);
225	return STATUS_SUCCESS;
226	}
227
228	RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentBuildNumber: '%.*ls'\n", cbValue / sizeof(RTUTF16), pvValue);
229	}
230	else
231	RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentBuildNumber: uValueType=%u %.*Rhxs\n", uValueType, cbValue, pvValue);
232	return STATUS_SUCCESS;
233	}
234
235
236	/**
237	* Implements RTL_QUERY_REGISTRY_ROUTINE for processing
238	* 'HKLM/Software/Microsoft/Window NT/CurrentVersion/CurrentType'
239	*/
240	static NTSTATUS NTAPI rtR0Nt3VerEnumCallback_CurrentType(PWSTR pwszValueName, ULONG uValueType,
241	PVOID pvValue, ULONG cbValue, PVOID pvUser, PVOID pvEntryCtx)
242	{
243	RT_NOREF(pwszValueName, pvEntryCtx);
244	if ( uValueType == REG_SZ
245	\|\| uValueType == REG_EXPAND_SZ)
246	{
247	PCRTUTF16 pwcValue = (PCRTUTF16)pvValue;
248	size_t cwcValue = cbValue / sizeof(*pwcValue);
249
250	int fSmp = -1;
251	if (cwcValue >= 12 && RTUtf16NICmpAscii(pwcValue, "Uniprocessor", 12) == 0)
252	{
253	cwcValue -= 12;
254	pwcValue += 12;
255	fSmp = 0;
256	}
257	else if (cwcValue >= 14 && RTUtf16NICmpAscii(pwcValue, "Multiprocessor", 14) == 0)
258	{
259	cwcValue -= 14;
260	pwcValue += 14;
261	fSmp = 1;
262	}
263	if (fSmp != -1)
264	{
265	while (cwcValue > 0 && RT_C_IS_SPACE(*pwcValue))
266	cwcValue--, pwcValue++;
267
268	int fChecked = -1;
269	if (cwcValue >= 4 && RTUtf16NICmpAscii(pwcValue, "Free", 4) == 0)
270	fChecked = 0;
271	else if (cwcValue >= 7 && RTUtf16NICmpAscii(pwcValue, "Checked", 7) == 0)
272	fChecked = 1;
273	if (fChecked != -1)
274	{
275	g_fNt3Smp = fSmp != 0;
276	g_fNt3Checked = fChecked != 0;
277	RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentType found: fSmp=%d fChecked=%d\n", fSmp, fChecked);
278	(uint32_t )pvUser \|= RT_BIT_32(2);
279	return STATUS_SUCCESS;
280	}
281	}
282
283	RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentType: '%.*ls'\n", cbValue / sizeof(RTUTF16), pvValue);
284	}
285	else
286	RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentType: uValueType=%u %.*Rhxs\n", uValueType, cbValue, pvValue);
287	return STATUS_SUCCESS;
288	}
289
290
291	/**
292	* Figure out the NT 3 version from the registry.
293	*
294	* @note this will be called before the rtR0Nt3InitSymbols is called.
295	*/
296	static void rtR0Nt3InitVersion(void)
297	{
298	/*
299	* No PsGetVersion, so try the registry. Unfortunately not necessarily
300	* initialized when we're loaded.
301	*/
302	RTL_QUERY_REGISTRY_TABLE aQuery[4];
303	RT_ZERO(aQuery);
304	aQuery[0].QueryRoutine = rtR0Nt3VerEnumCallback_CurrentVersion;
305	aQuery[0].Flags = 0;
306	aQuery[0].Name = L"CurrentVersion";
307	aQuery[0].EntryContext = NULL;
308	aQuery[0].DefaultType = REG_NONE;
309
310	aQuery[1].QueryRoutine = rtR0Nt3VerEnumCallback_CurrentBuildNumber;
311	aQuery[1].Flags = 0;
312	aQuery[1].Name = L"CurrentBuildNumber";
313	aQuery[1].EntryContext = NULL;
314	aQuery[1].DefaultType = REG_NONE;
315
316	aQuery[2].QueryRoutine = rtR0Nt3VerEnumCallback_CurrentType;
317	aQuery[2].Flags = 0;
318	aQuery[2].Name = L"CurrentType";
319	aQuery[2].EntryContext = NULL;
320	aQuery[2].DefaultType = REG_NONE;
321
322	uint32_t fFound = 0;
323	//NTSTATUS rcNt = RtlQueryRegistryValues(RTL_REGISTRY_WINDOWS_NT, NULL, &aQuery[0], &fFound, NULL /Environment/);
324	NTSTATUS rcNt = RtlQueryRegistryValues(RTL_REGISTRY_ABSOLUTE,
325	L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion",
326	&aQuery[0], &fFound, NULL /Environment/);
327	if (!NT_SUCCESS(rcNt))
328	RTLogBackdoorPrintf("rtR0Nt3InitVersion: RtlQueryRegistryValues failed: %#x\n", rcNt);
329	else
330	RTLogBackdoorPrintf("rtR0Nt3InitVersion: Didn't get all values: fFound=%#x\n", fFound);
331
332	/*
333	* We really need the version number. Build, type and SMP is off less importance.
334	* Derive it from the NT kernel PE header.
335	*/
336	if (!(fFound & RT_BIT_32(0)))
337	{
338	if (!g_fNt3ModuleInfoInitialized)
339	rtR0Nt3InitModuleInfo();
340
341	PIMAGE_DOS_HEADER pMzHdr = (PIMAGE_DOS_HEADER)g_pbNt3OsKrnl;
342	PIMAGE_NT_HEADERS32 pNtHdrs = (PIMAGE_NT_HEADERS32)&g_pbNt3OsKrnl[pMzHdr->e_lfanew];
343	if (pNtHdrs->OptionalHeader.MajorOperatingSystemVersion == 1)
344	{
345	/* NT 3.1 and NT 3.50 both set OS version to 1.0 in the optional header. */
346	g_uNt3MajorVer = 3;
347	if ( pNtHdrs->OptionalHeader.MajorLinkerVersion == 2
348	&& pNtHdrs->OptionalHeader.MinorLinkerVersion < 50)
349	g_uNt3MinorVer = 10;
350	else
351	g_uNt3MinorVer = 50;
352	}
353	else
354	{
355	g_uNt3MajorVer = pNtHdrs->OptionalHeader.MajorOperatingSystemVersion;
356	g_uNt3MinorVer = pNtHdrs->OptionalHeader.MinorOperatingSystemVersion;
357	}
358	RTLogBackdoorPrintf("rtR0Nt3InitVersion: guessed %u.%u from PE header\n", g_uNt3MajorVer, g_uNt3MinorVer);
359
360	/* Check out the resource section, looking for VS_FIXEDFILEINFO. */
361	__try /* (pointless) */
362	{
363	PIMAGE_SECTION_HEADER paShdrs = (PIMAGE_SECTION_HEADER)(pNtHdrs + 1);
364	uint32_t const cShdrs = pNtHdrs->FileHeader.NumberOfSections;
365	uint32_t iShdr = 0;
366	while (iShdr < cShdrs && memcmp(paShdrs[iShdr].Name, ".rsrc", 6) != 0)
367	iShdr++;
368	if (iShdr < cShdrs)
369	{
370	if ( paShdrs[iShdr].VirtualAddress > 0
371	&& paShdrs[iShdr].VirtualAddress < pNtHdrs->OptionalHeader.SizeOfImage)
372	{
373	uint32_t const cbRsrc = RT_MIN(paShdrs[iShdr].Misc.VirtualSize
374	? paShdrs[iShdr].Misc.VirtualSize : paShdrs[iShdr].SizeOfRawData,
375	pNtHdrs->OptionalHeader.SizeOfImage - paShdrs[iShdr].VirtualAddress);
376	uint8_t const *pbRsrc = &g_pbNt3OsKrnl[paShdrs[iShdr].VirtualAddress];
377	uint32_t const puDwords = (uint32_t const )pbRsrc;
378	uint32_t cDWords = (cbRsrc - sizeof(VS_FIXEDFILEINFO) + sizeof(uint32_t)) / sizeof(uint32_t);
379	while (cDWords-- > 0)
380	{
381	if ( puDwords[0] == VS_FFI_SIGNATURE
382	&& puDwords[1] == VS_FFI_STRUCVERSION)
383	{
384	VS_FIXEDFILEINFO const pVerInfo = (VS_FIXEDFILEINFO const )puDwords;
385	g_uNt3MajorVer = pVerInfo->dwProductVersionMS >> 16;
386	g_uNt3MinorVer = pVerInfo->dwProductVersionMS >> 16;
387	g_uNt3BuildNo = pVerInfo->dwProductVersionLS >> 16;
388	RTLogBackdoorPrintf("rtR0Nt3InitVersion: Found version info %u.%u build %u\n",
389	g_uNt3MajorVer, g_uNt3MinorVer, g_uNt3BuildNo);
390	break;
391	}
392	puDwords++;
393	}
394	}
395	}
396	}
397	__except(EXCEPTION_EXECUTE_HANDLER)
398	{
399	RTLogBackdoorPrintf("rtR0Nt3InitVersion: Exception scanning .rsrc section for version info!\n");
400	}
401	}
402
403	/*
404	* If we've got PsGetVersion, use it to override the above finding!
405	* (We may end up here for reasons other than the PsGetVersion fallback.)
406	*/
407	if (g_pfnrtPsGetVersion)
408	{
409	WCHAR wszCsd[64];
410	UNICODE_STRING UniStr;
411	UniStr.Buffer = wszCsd;
412	UniStr.MaximumLength = sizeof(wszCsd) - sizeof(WCHAR);
413	UniStr.Length = 0;
414	RT_ZERO(wszCsd);
415	ULONG uMajor = 3;
416	ULONG uMinor = 51;
417	ULONG uBuildNo = 1057;
418	BOOLEAN fChecked = g_pfnrtPsGetVersion(&uMajor, &uMinor, &uBuildNo, &UniStr);
419
420	g_uNt3MajorVer = uMajor;
421	g_uNt3MinorVer = uMinor;
422	g_uNt3BuildNo = uBuildNo;
423	g_fNt3Checked = fChecked != FALSE;
424	}
425
426	g_fNt3VersionInitialized = true;
427	}
428
429
430	extern "C" DECLEXPORT(BOOLEAN) __stdcall
431	Nt3Fb_PsGetVersion(ULONG puMajor, ULONG puMinor, ULONG puBuildNo, UNICODE_STRING pCsdStr)
432	{
433	if (!g_fNt3VersionInitialized)
434	rtR0Nt3InitVersion();
435	if (puMajor)
436	*puMajor = g_uNt3MajorVer;
437	if (puMinor)
438	*puMinor = g_uNt3MinorVer;
439	if (puBuildNo)
440	*puBuildNo = g_uNt3BuildNo;
441	if (pCsdStr)
442	{
443	pCsdStr->Buffer[0] = '\0';
444	pCsdStr->Length = 0;
445	}
446	return g_fNt3Checked;
447	}
448
449
450	/**
451	* Worker for rtR0Nt3InitModuleInfo.
452	*/
453	static bool rtR0Nt3InitModuleInfoOne(const char pszImage, uint8_t const pbCode, uint8_t *ppbModule, uint32_t pcbModule)
454	{
455	uintptr_t const uImageAlign = _4K; /* XP may put the kernel at */
456
457	/* Align pbCode. */
458	pbCode = (uint8_t const *)((uintptr_t)pbCode & ~(uintptr_t)(uImageAlign - 1));
459
460	/* Scan backwards till we find a PE signature. */
461	for (uint32_t cbChecked = 0; cbChecked < _64M; cbChecked += uImageAlign, pbCode -= uImageAlign)
462	{
463	if (!MmIsAddressValid((void *)pbCode))
464	continue;
465
466	uint32_t uZero = 0;
467	uint32_t offNewHdr = 0;
468	__try /* pointless */
469	{
470	uZero = (uint32_t const )pbCode;
471	offNewHdr = (uint32_t const )&pbCode[RT_UOFFSETOF(IMAGE_DOS_HEADER, e_lfanew)];
472	}
473	__except(EXCEPTION_EXECUTE_HANDLER)
474	{
475	RTLogBackdoorPrintf("rtR0Nt3InitModuleInfo: Exception at %p scanning for DOS header...\n", pbCode);
476	continue;
477	}
478	if ( (uint16_t)uZero == IMAGE_DOS_SIGNATURE
479	&& offNewHdr < _2K
480	&& offNewHdr >= sizeof(IMAGE_DOS_HEADER))
481	{
482	RT_CONCAT(IMAGE_NT_HEADERS,ARCH_BITS) NtHdrs;
483	__try /* pointless */
484	{
485	NtHdrs = (decltype(NtHdrs) const )&pbCode[offNewHdr];
486	}
487	__except(EXCEPTION_EXECUTE_HANDLER)
488	{
489	RTLogBackdoorPrintf("rtR0Nt3InitModuleInfo: Exception at %p reading NT headers...\n", pbCode);
490	continue;
491	}
492	if ( NtHdrs.Signature == IMAGE_NT_SIGNATURE
493	&& NtHdrs.FileHeader.SizeOfOptionalHeader == sizeof(NtHdrs.OptionalHeader)
494	&& NtHdrs.FileHeader.NumberOfSections > 2
495	&& NtHdrs.FileHeader.NumberOfSections < _4K
496	&& NtHdrs.OptionalHeader.Magic == RT_CONCAT3(IMAGE_NT_OPTIONAL_HDR,ARCH_BITS,_MAGIC))
497	{
498	ppbModule = (uint8_t )pbCode;
499	*pcbModule = NtHdrs.OptionalHeader.SizeOfImage;
500	RTLogBackdoorPrintf("rtR0Nt3InitModuleInfo: Found %s at %#p LB %#x\n",
501	pszImage, pbCode, NtHdrs.OptionalHeader.SizeOfImage);
502	return true;
503	}
504	}
505	}
506	RTLogBackdoorPrintf("rtR0Nt3InitModuleInfo: Warning! Unable to locate %s...\n");
507	return false;
508	}
509
510
511	/**
512	* Initializes the module information (NTOSKRNL + HAL) using exported symbols.
513	* This only works as long as noone is intercepting the symbols.
514	*/
515	static void rtR0Nt3InitModuleInfo(void)
516	{
517	rtR0Nt3InitModuleInfoOne("ntoskrnl.exe", (uint8_t const *)(uintptr_t)IoGetCurrentProcess, &g_pbNt3OsKrnl, &g_cbNt3OsKrnl);
518	rtR0Nt3InitModuleInfoOne("hal.dll", (uint8_t const *)(uintptr_t)HalGetBusData, &g_pbNt3Hal, &g_cbNt3Hal);
519	g_fNt3ModuleInfoInitialized = true;
520	}
521
522
523	extern "C" DECLEXPORT(NTSTATUS) __stdcall
524	Nt3Fb_ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS enmClass, PVOID pvBuf, ULONG cbBuf, PULONG pcbActual)
525	{
526	switch (enmClass)
527	{
528	case SystemModuleInformation:
529	{
530	PRTL_PROCESS_MODULES pInfo = (PRTL_PROCESS_MODULES)pvBuf;
531	ULONG cbNeeded = RT_UOFFSETOF(RTL_PROCESS_MODULES, Modules[2]);
532	if (pcbActual)
533	*pcbActual = cbNeeded;
534	if (cbBuf < cbNeeded)
535	return STATUS_INFO_LENGTH_MISMATCH;
536
537	if (!g_fNt3ModuleInfoInitialized)
538	rtR0Nt3InitModuleInfo();
539
540	pInfo->NumberOfModules = 2;
541
542	/* ntoskrnl.exe */
543	pInfo->Modules[0].Section = NULL;
544	pInfo->Modules[0].MappedBase = g_pbNt3OsKrnl;
545	pInfo->Modules[0].ImageBase = g_pbNt3OsKrnl;
546	pInfo->Modules[0].ImageSize = g_cbNt3OsKrnl;
547	pInfo->Modules[0].Flags = 0;
548	pInfo->Modules[0].LoadOrderIndex = 0;
549	pInfo->Modules[0].InitOrderIndex = 0;
550	pInfo->Modules[0].LoadCount = 1024;
551	pInfo->Modules[0].OffsetToFileName = sizeof("\\SystemRoot\\System32\\") - 1;
552	memcpy(pInfo->Modules[0].FullPathName, RT_STR_TUPLE("\\SystemRoot\\System32\\ntoskrnl.exe"));
553
554	/* hal.dll */
555	pInfo->Modules[1].Section = NULL;
556	pInfo->Modules[1].MappedBase = g_pbNt3Hal;
557	pInfo->Modules[1].ImageBase = g_pbNt3Hal;
558	pInfo->Modules[1].ImageSize = g_cbNt3Hal;
559	pInfo->Modules[1].Flags = 0;
560	pInfo->Modules[1].LoadOrderIndex = 1;
561	pInfo->Modules[1].InitOrderIndex = 0;
562	pInfo->Modules[1].LoadCount = 1024;
563	pInfo->Modules[1].OffsetToFileName = sizeof("\\SystemRoot\\System32\\") - 1;
564	memcpy(pInfo->Modules[1].FullPathName, RT_STR_TUPLE("\\SystemRoot\\System32\\hal.dll"));
565
566	return STATUS_SUCCESS;
567	}
568
569	default:
570	return STATUS_INVALID_INFO_CLASS;
571	}
572	}
573
574	/**
575	* Calculates the length indicated by an ModR/M sequence.
576	*
577	* @returns Length, including RM byte.
578	* @param bRm The RM byte.
579	*/
580	static uint32_t rtR0Nt3CalcModRmLength(uint8_t bRm)
581	{
582	uint32_t cbRm = 1;
583
584	if ( (bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT)
585	\|\| (bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5)
586	cbRm += 4; /* disp32 */
587	else if ((bRm & X86_MODRM_MOD_MASK) == (1 << X86_MODRM_MOD_SHIFT))
588	cbRm += 1; /* disp8 */
589	else if ((bRm & X86_MODRM_MOD_MASK) == (2 << X86_MODRM_MOD_SHIFT))
590	cbRm += 2; /* disp16 */
591
592	if ((bRm & X86_MODRM_RM_MASK) == 4 && (bRm & X86_MODRM_MOD_MASK) != (3 << X86_MODRM_MOD_SHIFT))
593	cbRm += 1; /* SIB */
594
595	return cbRm;
596	}
597
598
599	/**
600	* Init symbols.
601	*
602	* This is called after both ZwQuerySystemInformation and PsGetVersion are used
603	* for the first time.
604	*
605	* @returns IPRT status code
606	* @param hKrnlInfo Kernel symbol digger handle.
607	*/
608	DECLHIDDEN(int) rtR0Nt3InitSymbols(RTDBGKRNLINFO hKrnlInfo)
609	{
610	/*
611	* Resolve symbols. (We set C variables (g_pfnrtXxx) here, not the __imp__Xxx ones.)
612	*/
613	#define GET_SYSTEM_ROUTINE(a_fnName) do { \
614	RT_CONCAT(g_pfnrt, a_fnName) = (decltype(RT_CONCAT(g_pfnrt, a_fnName)))RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, #a_fnName); \
615	} while (0)
616
617	GET_SYSTEM_ROUTINE(PsGetVersion);
618	GET_SYSTEM_ROUTINE(ZwQuerySystemInformation);
619	GET_SYSTEM_ROUTINE(KeSetTimerEx);
620	GET_SYSTEM_ROUTINE(IoAttachDeviceToDeviceStack);
621	GET_SYSTEM_ROUTINE(PsGetCurrentProcessId);
622	GET_SYSTEM_ROUTINE(ZwYieldExecution);
623	GET_SYSTEM_ROUTINE(ExAcquireFastMutex);
624	GET_SYSTEM_ROUTINE(ExReleaseFastMutex);
625
626	#define GET_FAST_CALL_SYSTEM_ROUTINE(a_fnFastcall, a_fnStdcall) do { \
627	GET_SYSTEM_ROUTINE(a_fnFastcall); \
628	GET_SYSTEM_ROUTINE(a_fnStdcall); \
629	AssertLogRelReturn(RT_CONCAT(g_pfnrt,a_fnFastcall) \|\| RT_CONCAT(g_pfnrt,a_fnStdcall), VERR_INTERNAL_ERROR_3); \
630	} while (0)
631	GET_FAST_CALL_SYSTEM_ROUTINE(IofCompleteRequest, IoCompleteRequest);
632	GET_FAST_CALL_SYSTEM_ROUTINE(ObfDereferenceObject, ObDereferenceObject);
633	GET_FAST_CALL_SYSTEM_ROUTINE(IofCallDriver, IoCallDriver);
634	GET_FAST_CALL_SYSTEM_ROUTINE(KfAcquireSpinLock, KeAcquireSpinLock);
635	GET_FAST_CALL_SYSTEM_ROUTINE(KfReleaseSpinLock, KeReleaseSpinLock);
636	GET_FAST_CALL_SYSTEM_ROUTINE(KfLowerIrql, KeLowerIrql);
637	GET_FAST_CALL_SYSTEM_ROUTINE(KfRaiseIrql, KeRaiseIrql);
638	GET_FAST_CALL_SYSTEM_ROUTINE(KefAcquireSpinLockAtDpcLevel, KeAcquireSpinLockAtDpcLevel);
639	GET_FAST_CALL_SYSTEM_ROUTINE(KefReleaseSpinLockFromDpcLevel, KeReleaseSpinLockFromDpcLevel);
640
641	/*
642	* We need to call assembly to update the __imp__Xxx entries, since C
643	* doesn't allow '@' in symbols.
644	*/
645	rtNt3InitSymbolsAssembly();
646
647	/*
648	* Tick count data. We disassemble KeQueryTickCount until we find the
649	* first absolute address referenced in it.
650	* %80105b70 8b 44 24 04 mov eax, dword [esp+004h]
651	* %80105b74 c7 40 04 00 00 00 00 mov dword [eax+004h], 000000000h
652	* %80105b7b 8b 0d 88 70 19 80 mov ecx, dword [080197088h]
653	* %80105b81 89 08 mov dword [eax], ecx
654	* %80105b83 c2 04 00 retn 00004h
655	*/
656	_imp__KeTickCount = (decltype(_imp__KeTickCount))RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "KeTickCount");
657	if (!_imp__KeTickCount)
658	{
659	if (!g_fNt3VersionInitialized)
660	rtR0Nt3InitVersion();
661	Assert(g_uNt3MajorVer == 3 && g_uNt3MinorVer < 50);
662
663	uint8_t const pbCode = (uint8_t const )RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "KeQueryTickCount");
664	AssertLogRelReturn(pbCode, VERR_INTERNAL_ERROR_2);
665
666	for (uint32_t off = 0; off < 128 && _imp__KeTickCount == NULL;)
667	{
668	uint8_t const b1 = pbCode[off++];
669	switch (b1)
670	{
671	case 0x8b: /* mov reg, r/m ; We're looking for absolute address in r/m. */
672	if ((pbCode[off] & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5 /disp32/)
673	_imp__KeTickCount = (KSYSTEM_TIME *)&pbCode[off + 1];
674	RT_FALL_THRU();
675	case 0x89: /* mov r/m, reg */
676	off += rtR0Nt3CalcModRmLength(pbCode[off]);
677	break;
678
679	case 0xc7:
680	if ((pbCode[off] & X86_MODRM_REG_MASK) == 0) /* mov r/m, imm32 */
681	off += rtR0Nt3CalcModRmLength(pbCode[off]) + 4;
682	else
683	{
684	RTLogBackdoorPrintf("rtR0Nt3InitSymbols: Failed to find KeTickCount! Encountered unknown opcode at %#x! %.*Rhxs\n",
685	off - 1, RT_MAX(off + 16, RT_MIN(PAGE_SIZE - ((uintptr_t)pbCode & PAGE_OFFSET_MASK), 128)), pbCode);
686	return VERR_INTERNAL_ERROR_3;
687	}
688	break;
689
690	case 0xc2: /* ret iw */
691	RTLogBackdoorPrintf("rtR0Nt3InitSymbols: Failed to find KeTickCount! Encountered RET! %.*Rhxs\n",
692	off + 2, pbCode);
693	return VERR_INTERNAL_ERROR_3;
694
695	default:
696	RTLogBackdoorPrintf("rtR0Nt3InitSymbols: Failed to find KeTickCount! Encountered unknown opcode at %#x! %.*Rhxs\n",
697	off - 1, RT_MAX(off + 16, RT_MIN(PAGE_SIZE - ((uintptr_t)pbCode & PAGE_OFFSET_MASK), 128)), pbCode);
698	return VERR_INTERNAL_ERROR_3;
699
700	/* Just in case: */
701
702	case 0xa1: /* mov eax, [m32] */
703	_imp__KeTickCount = (KSYSTEM_TIME *)&pbCode[off];
704	off += 4;
705	break;
706
707	case 50: case 51: case 52: case 53: case 54: case 55: case 56: case 57: /* push reg */
708	break;
709	}
710	}
711	if (!_imp__KeTickCount)
712	{
713	RTLogBackdoorPrintf("rtR0Nt3InitSymbols: Failed to find KeTickCount after 128 bytes! %.*Rhxs\n", 128, pbCode);
714	return VERR_INTERNAL_ERROR_3;
715	}
716	}
717
718	return VINF_SUCCESS;
719	}
720
721
722	extern "C" DECLEXPORT(VOID)
723	Nt3Fb_KeInitializeTimerEx(PKTIMER pTimer, TIMER_TYPE enmType)
724	{
725	KeInitializeTimer(pTimer);
726	NOREF(enmType);
727	/** @todo Default is NotificationTimer, for SyncrhonizationTimer we need to
728	* do more work. timer-r0drv-nt.cpp is using the latter. :/ */
729	}
730
731
732	extern "C" DECLEXPORT(BOOLEAN) __stdcall
733	Nt3Fb_KeSetTimerEx(PKTIMER pTimer, LARGE_INTEGER DueTime, LONG cMsPeriod, PKDPC pDpc)
734	{
735	AssertReturn(cMsPeriod == 0, FALSE);
736	return KeSetTimer(pTimer, DueTime, pDpc);
737	}
738
739
740	extern "C" DECLEXPORT(PDEVICE_OBJECT)
741	Nt3Fb_IoAttachDeviceToDeviceStack(PDEVICE_OBJECT pSourceDevice, PDEVICE_OBJECT pTargetDevice)
742	{
743	NOREF(pSourceDevice); NOREF(pTargetDevice);
744	return NULL;
745	}
746
747
748	extern "C" DECLEXPORT(HANDLE)
749	Nt3Fb_PsGetCurrentProcessId(void)
750	{
751	if (!g_fNt3VersionInitialized)
752	rtR0Nt3InitVersion();
753
754	uint8_t const pbProcess = (uint8_t const )IoGetCurrentProcess();
755	if ( g_uNt3MajorVer > 3
756	\|\| g_uNt3MinorVer >= 50)
757	return (HANDLE const )&pbProcess[0x94];
758	return (HANDLE const )&pbProcess[0xb0];
759	}
760
761
762	extern "C" DECLEXPORT(NTSTATUS)
763	Nt3Fb_ZwYieldExecution(VOID)
764	{
765	LARGE_INTEGER Interval;
766	Interval.QuadPart = 0;
767	KeDelayExecutionThread(KernelMode, FALSE, &Interval);
768	return STATUS_SUCCESS;
769	}
770
771
772	/**
773	* This is a simple implementation of the fast mutex api introduced in 3.50.
774	*/
775	extern "C" DECLEXPORT(VOID) FASTCALL
776	Nt3Fb_ExAcquireFastMutex(PFAST_MUTEX pFastMtx)
777	{
778	PETHREAD pSelf = PsGetCurrentThread();
779	KIRQL OldIrql;
780	KeRaiseIrql(APC_LEVEL, &OldIrql);
781
782	/* The Count member is initialized to 1. So if we decrement it to zero, we're
783	the first locker and owns the mutex. Otherwise we must wait for our turn. */
784	int32_t cLockers = ASMAtomicDecS32((int32_t volatile *)&pFastMtx->Count);
785	if (cLockers != 0)
786	{
787	ASMAtomicIncU32((uint32_t volatile *)&pFastMtx->Contention);
788	KeWaitForSingleObject(&pFastMtx->Event, Executive, KernelMode, FALSE /fAlertable/, NULL /pTimeout/);
789	}
790
791	pFastMtx->Owner = (PKTHREAD)pSelf;
792	pFastMtx->OldIrql = OldIrql;
793	}
794
795
796	/**
797	* This is a simple implementation of the fast mutex api introduced in 3.50.
798	*/
799	extern "C" DECLEXPORT(VOID) FASTCALL
800	Nt3Fb_ExReleaseFastMutex(PFAST_MUTEX pFastMtx)
801	{
802	AssertMsg(pFastMtx->Owner == (PKTHREAD)PsGetCurrentThread(), ("Owner=%p, expected %p\n", pFastMtx->Owner, PsGetCurrentThread()));
803
804	KIRQL OldIrql = pFastMtx->OldIrql;
805	pFastMtx->Owner = NULL;
806	int32_t cLockers = ASMAtomicIncS32((int32_t volatile *)&pFastMtx->Count);
807	if (cLockers < 0)
808	KeSetEvent(&pFastMtx->Event, EVENT_INCREMENT, FALSE /fWait/);
809	if (OldIrql != APC_LEVEL)
810	KeLowerIrql(OldIrql);
811	}
812

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/r0drv/nt/nt3fakes-r0drv-nt.cpp@ 74125

Download in other formats: