DBGFR3ModInMem.cpp@ 73472

Last change on this file since 73472 was 73150, checked in by vboxsync, 6 years ago

VMM,DBGC,IPRT: In memory

VMM: Morphed part of the NT kernel digger into DBGFR3ModInMem.
DBGC: Added 'loadinmem' command for accessing the DBGFR3ModInMem functionality.
IPRT: Modified RTDbgModCreateFromPeImage to clearly indicate to caller whether the loader module was consumed or not (missing direct ref counting).
IPRT: Added RTLdrGetHostArch for resolving RTLDRARCH_HOST.
IPRT: Added RTLdrArchName for naming a RTLDRARCH value.

Property svn:eol-style set to native
Property svn:keywords set to Author Date Id Revision

File size: 27.3 KB

Line
1	/* $Id: DBGFR3ModInMem.cpp 73150 2018-07-16 10:03:41Z vboxsync $ */
2	/** @file
3	* DBGFR3ModInMemPe - In memory PE module 'loader'.
4	*/
5
6	/*
7	* Copyright (C) 2009-2018 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF
23	#include <VBox/vmm/dbgf.h>
24
25	#include <VBox/err.h>
26	#include <iprt/ldr.h>
27	#include <iprt/mem.h>
28	#include <iprt/string.h>
29	#include <iprt/formats/pecoff.h>
30	#include <iprt/formats/mz.h>
31	#include <iprt/formats/elf.h>
32
33
34	/*********************************************************************************************************************************
35	* Structures and Typedefs *
36	*********************************************************************************************************************************/
37	/**
38	* The WinNT digger's loader reader instance data.
39	*/
40	typedef struct DBGFMODPERDR
41	{
42	/** The VM handle (referenced). */
43	PUVM pUVM;
44	/** The image base. */
45	DBGFADDRESS ImageAddr;
46	/** The image size. */
47	uint32_t cbImage;
48	/** The file offset of the SizeOfImage field in the optional header if it
49	* needs patching, otherwise set to UINT32_MAX. */
50	uint32_t offSizeOfImage;
51	/** The correct image size. */
52	uint32_t cbCorrectImageSize;
53	/** Number of entries in the aMappings table. */
54	uint32_t cMappings;
55	/** Mapping hint. */
56	uint32_t iHint;
57	/** Mapping file offset to memory offsets, ordered by file offset. */
58	struct
59	{
60	/** The file offset. */
61	uint32_t offFile;
62	/** The size of this mapping. */
63	uint32_t cbMem;
64	/** The offset to the memory from the start of the image. */
65	uint32_t offMem;
66	} aMappings[1];
67	} DBGFMODPERDR;
68	/** Pointer a WinNT loader reader instance data. */
69	typedef DBGFMODPERDR *PDBGFMODPERDR;
70
71	/**
72	* Stack buffer.
73	*/
74	typedef union DBGFMODINMEMBUF
75	{
76	uint8_t ab[0x2000];
77	IMAGE_DOS_HEADER DosHdr;
78	IMAGE_NT_HEADERS32 Nt32;
79	IMAGE_NT_HEADERS64 Nt64;
80	} DBGFMODINMEMBUF;
81	/** Pointer to stack buffer. */
82	typedef DBGFMODINMEMBUF *PDBGFMODINMEMBUF;
83
84
85
86	/**
87	* Handles in-memory ELF images.
88	*
89	* @returns VBox status code.
90	* @param pUVM The user mode VM handle.
91	* @param pImageAddr The image address.
92	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
93	* @param pszName The image name, optional.
94	* @param enmArch The image arch if we force it, pass
95	* RTLDRARCH_WHATEVER if you don't care.
96	* @param cbImage Image size. Pass 0 if not known.
97	* @param puBuf The header buffer.
98	* @param phDbgMod Where to return the resulting debug module on success.
99	* @param pErrInfo Where to return extended error info on failure.
100	*/
101	static int dbgfR3ModInMemElf(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName,
102	RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
103	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
104	{
105	RT_NOREF(pUVM, fFlags, pszName, enmArch, cbImage, puBuf, phDbgMod);
106	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Found ELF magic at %RGv", pImageAddr->FlatPtr);
107	}
108
109
110	/**
111	* @callback_method_impl{PFNRTLDRRDRMEMREAD}
112	*/
113	static DECLCALLBACK(int) dbgfModInMemPeRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
114	{
115	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
116	uint32_t offFile = (uint32_t)off;
117	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
118
119	uint32_t i = pThis->iHint;
120	if (pThis->aMappings[i].offFile > offFile)
121	{
122	i = pThis->cMappings;
123	while (i-- > 0)
124	if (offFile >= pThis->aMappings[i].offFile)
125	break;
126	pThis->iHint = i;
127	}
128
129	while (cb > 0)
130	{
131	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
132	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
133
134	/* Read file bits backed by memory. */
135	if (offMap < pThis->aMappings[i].cbMem)
136	{
137	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
138	if (cbToRead > cb)
139	cbToRead = (uint32_t)cb;
140
141	DBGFADDRESS Addr = pThis->ImageAddr;
142	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
143
144	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
145	if (RT_FAILURE(rc))
146	return rc;
147
148	/* Apply SizeOfImage patch? */
149	if ( pThis->offSizeOfImage != UINT32_MAX
150	&& offFile < pThis->offSizeOfImage + 4
151	&& offFile + cbToRead > pThis->offSizeOfImage)
152	{
153	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
154	uint32_t cbPatch = sizeof(SizeOfImage);
155	int32_t offPatch = pThis->offSizeOfImage - offFile;
156	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
157	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
158	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
159	while (cbPatch-- > 0)
160	{
161	if (offPatch >= 0)
162	*pbPatch = (uint8_t)SizeOfImage;
163	offPatch++;
164	pbPatch++;
165	SizeOfImage >>= 8;
166	}
167	}
168
169	/* Done? */
170	if (cbToRead == cb)
171	break;
172
173	offFile += cbToRead;
174	cb -= cbToRead;
175	pvBuf = (char *)pvBuf + cbToRead;
176	}
177
178	/* Mind the gap. */
179	if (offNextMap > offFile)
180	{
181	uint32_t cbZero = offNextMap - offFile;
182	if (cbZero > cb)
183	{
184	RT_BZERO(pvBuf, cb);
185	break;
186	}
187
188	RT_BZERO(pvBuf, cbZero);
189	offFile += cbZero;
190	cb -= cbZero;
191	pvBuf = (char *)pvBuf + cbZero;
192	}
193
194	pThis->iHint = ++i;
195	}
196
197	return VINF_SUCCESS;
198	}
199
200
201	/**
202	* @callback_method_impl{PFNRTLDRRDRMEMDTOR}
203	*/
204	static DECLCALLBACK(void) dbgfModInMemPeRdr_Dtor(void *pvUser)
205	{
206	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
207
208	VMR3ReleaseUVM(pThis->pUVM);
209	pThis->pUVM = NULL;
210	RTMemFree(pvUser);
211	}
212
213
214	/**
215	* Checks if the section headers look okay.
216	*
217	* @returns VBox status code.
218	* @param paShdrs Pointer to the section headers.
219	* @param cShdrs Number of headers.
220	* @param cbImage The image size reported by NT.
221	* @param cbImageFromHdr The image size by the linker in the header.
222	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
223	* no resource directory.
224	* @param cbSectAlign The section alignment specified in the header.
225	* @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
226	* @param pcbImageCorrect The corrected image size. This is derived from
227	* cbImage and virtual range of the section tables.
228	*
229	* The problem is that NT may choose to drop the
230	* last pages in images it loads early, starting at
231	* the resource directory. These images will have
232	* a page aligned cbImage.
233	*
234	* @param pErrInfo Where to return more error details.
235	*/
236	static int dbgfR3ModPeCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShdrs, uint32_t cShdrs, uint32_t cbImage,
237	uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
238	bool fNt31, uint32_t *pcbImageCorrect, PRTERRINFO pErrInfo)
239	{
240	*pcbImageCorrect = cbImage;
241
242	for (uint32_t i = 0; i < cShdrs; i++)
243	{
244	if (!paShdrs[i].Name[0])
245	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Section header #%u has no name", i);
246
247	if (paShdrs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
248	continue;
249
250	/* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
251	/** @todo this isn't really perfect. cbImage is kind of wrong... */
252	uint32_t cbVirtual = paShdrs[i].Misc.VirtualSize;
253	if (cbVirtual == 0)
254	{
255	for (uint32_t j = i + 1; j < cShdrs; j++)
256	if ( !(paShdrs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
257	&& paShdrs[j].VirtualAddress > paShdrs[i].VirtualAddress)
258	{
259	cbVirtual = paShdrs[j].VirtualAddress - paShdrs[i].VirtualAddress;
260	break;
261	}
262	if (!cbVirtual)
263	{
264	if (paShdrs[i].VirtualAddress < cbImageFromHdr)
265	cbVirtual = cbImageFromHdr - paShdrs[i].VirtualAddress;
266	else if (paShdrs[i].SizeOfRawData > 0)
267	cbVirtual = RT_ALIGN(paShdrs[i].SizeOfRawData, _4K);
268	}
269	}
270
271	/* Check that sizes are within the same range and that both sizes and
272	addresses are within reasonable limits. */
273	if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShdrs[i].SizeOfRawData, _64K)
274	\|\| cbVirtual >= _1G
275	\|\| paShdrs[i].SizeOfRawData >= _1G)
276	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
277	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!",
278	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].SizeOfRawData);
279	uint32_t uRvaEnd = paShdrs[i].VirtualAddress + cbVirtual;
280	if (uRvaEnd >= _1G \|\| uRvaEnd < paShdrs[i].VirtualAddress)
281	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
282	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!",
283	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].VirtualAddress, uRvaEnd);
284
285	/* Check for images chopped off around '.rsrc'. */
286	if ( cbImage < uRvaEnd
287	&& uRvaEnd >= uRvaRsrc)
288	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
289
290	/* Check that the section is within the image. */
291	if (uRvaEnd > cbImage && fNt31)
292	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
293	"Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x",
294	i, paShdrs[i].VirtualAddress, uRvaEnd, cbImage);
295	}
296
297	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
298	*pcbImageCorrect = cbImage;
299	return VINF_SUCCESS;
300	}
301
302
303	/**
304	* Create a loader module for the in-guest-memory PE module.
305	*/
306	static int dbgfR3ModInMemPeCreateLdrMod(PUVM pUVM, uint32_t fFlags, const char *pszName, PCDBGFADDRESS pImageAddr,
307	uint32_t cbImage, uint32_t cbImageFromHdr, bool f32Bit,
308	uint32_t cShdrs, PCIMAGE_SECTION_HEADER paShdrs, uint32_t cbSectAlign,
309	uint32_t cDataDir, PCIMAGE_DATA_DIRECTORY paDataDir, uint32_t offHdrs,
310	PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
311	{
312	/*
313	* Allocate and create a reader instance.
314	*/
315	PDBGFMODPERDR pRdr = (PDBGFMODPERDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGFMODPERDR, aMappings[cShdrs + 2]));
316	if (!pRdr)
317	return VERR_NO_MEMORY;
318
319	VMR3RetainUVM(pUVM);
320	pRdr->pUVM = pUVM;
321	pRdr->ImageAddr = *pImageAddr;
322	pRdr->cbImage = cbImage;
323	pRdr->cbCorrectImageSize = cbImage;
324	pRdr->offSizeOfImage = UINT32_MAX;
325	pRdr->iHint = 0;
326
327	/*
328	* Use the section table to construct a more accurate view of the file/image.
329	*/
330	uint32_t uRvaRsrc = UINT32_MAX;
331	if ( cDataDir > IMAGE_DIRECTORY_ENTRY_RESOURCE
332	&& paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size > 0)
333	uRvaRsrc = paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
334
335	int rc = dbgfR3ModPeCheckSectHdrsAndImgSize(paShdrs, cShdrs, cbImage, cbImageFromHdr, uRvaRsrc, cbSectAlign,
336	RT_BOOL(fFlags & DBGFMODINMEM_F_PE_NT31), &pRdr->cbCorrectImageSize, pErrInfo);
337	if (RT_SUCCESS(rc))
338	{
339	pRdr->cMappings = 0;
340
341	for (uint32_t i = 0; i < cShdrs; i++)
342	if ( paShdrs[i].SizeOfRawData > 0
343	&& paShdrs[i].PointerToRawData > 0)
344	{
345	uint32_t j = 1;
346	if (!pRdr->cMappings)
347	pRdr->cMappings++;
348	else
349	{
350	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShdrs[i].PointerToRawData)
351	j++;
352	if (j < pRdr->cMappings)
353	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
354	}
355	pRdr->aMappings[j].offFile = paShdrs[i].PointerToRawData;
356	pRdr->aMappings[j].offMem = paShdrs[i].VirtualAddress;
357	pRdr->aMappings[j].cbMem = i + 1 < cShdrs
358	? paShdrs[i + 1].VirtualAddress - paShdrs[i].VirtualAddress
359	: paShdrs[i].Misc.VirtualSize;
360	if (j == pRdr->cMappings)
361	pRdr->cbImage = paShdrs[i].PointerToRawData + paShdrs[i].SizeOfRawData;
362	pRdr->cMappings++;
363	}
364
365	/* Insert the mapping of the headers that isn't covered by the section table. */
366	pRdr->aMappings[0].offFile = 0;
367	pRdr->aMappings[0].offMem = 0;
368	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
369
370	int j = pRdr->cMappings - 1;
371	while (j-- > 0)
372	{
373	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
374	if (pRdr->aMappings[j].cbMem > cbFile)
375	pRdr->aMappings[j].cbMem = cbFile;
376	}
377	}
378	else if (fFlags & DBGFMODINMEM_F_NO_READER_FALLBACK)
379	return rc;
380	else
381	{
382	/*
383	* Fallback, fake identity mapped file data.
384	*/
385	pRdr->cMappings = 1;
386	pRdr->aMappings[0].offFile = 0;
387	pRdr->aMappings[0].offMem = 0;
388	pRdr->aMappings[0].cbMem = pRdr->cbImage;
389	}
390
391	/* Enable the SizeOfImage patching if necessary. */
392	if (pRdr->cbCorrectImageSize != cbImage)
393	{
394	Log(("dbgfR3ModInMemPeCreateLdrMod: The image is really %#x bytes long, not %#x as mapped by NT!\n",
395	pRdr->cbCorrectImageSize, cbImage));
396	pRdr->offSizeOfImage = f32Bit
397	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
398	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
399	}
400
401	/*
402	* Call the loader to open the PE image for debugging.
403	* Note! It always calls pfnDtor.
404	*/
405	RTLDRMOD hLdrMod;
406	rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
407	dbgfModInMemPeRdr_Read, dbgfModInMemPeRdr_Dtor, pRdr,
408	&hLdrMod, pErrInfo);
409	if (RT_SUCCESS(rc))
410	*phLdrMod = hLdrMod;
411	else
412	*phLdrMod = NIL_RTLDRMOD;
413	return rc;
414	}
415
416
417	/**
418	* Handles in-memory PE images.
419	*
420	* @returns VBox status code.
421	* @param pUVM The user mode VM handle.
422	* @param pImageAddr The image address.
423	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
424	* @param pszName The image name, optional.
425	* @param enmArch The image arch if we force it, pass
426	* RTLDRARCH_WHATEVER if you don't care.
427	* @param cbImage Image size. Pass 0 if not known.
428	* @param offPeHdrs Offset of the PE header.
429	* @param cbPeHdrsPart1 How read into uBuf at @a offPeHdrs.
430	* @param puBuf The header buffer.
431	* @param phDbgMod Where to return the resulting debug module on success.
432	* @param pErrInfo Where to return extended error info on failure.
433	*/
434	static int dbgfR3ModInMemPe(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName, RTLDRARCH enmArch,
435	uint32_t cbImage, uint32_t offPeHdrs, uint32_t cbPeHdrsPart1, PDBGFMODINMEMBUF puBuf,
436	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
437	{
438	/*
439	* Read the optional header and the section table after validating the
440	* info we need from the file header.
441	*/
442	/* Check the opt hdr size and number of sections as these are used to determine how much to read next. */
443	if ( puBuf->Nt32.FileHeader.SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER32)
444	\|\| puBuf->Nt32.FileHeader.SizeOfOptionalHeader > sizeof(IMAGE_OPTIONAL_HEADER64) + 128)
445	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Invalid SizeOfOptionalHeader value: %#RX32",
446	puBuf->Nt32.FileHeader.SizeOfOptionalHeader);
447
448	if ( puBuf->Nt32.FileHeader.NumberOfSections < 1
449	\|\| puBuf->Nt32.FileHeader.NumberOfSections > 190 /* what fits in our 8K buffer */)
450	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "NumberOfSections is out of range: %#RX32 (1..190)",
451	puBuf->Nt32.FileHeader.NumberOfSections);
452
453	/* Read the optional header and section table. */
454	uint32_t const cbHdrs = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
455	+ puBuf->Nt32.FileHeader.SizeOfOptionalHeader
456	+ puBuf->Nt32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
457	AssertReturn(cbHdrs <= sizeof(*puBuf), RTERRINFO_LOG_SET_F(pErrInfo, VERR_INTERNAL_ERROR_2, "cbHdrs=%#x", cbHdrs));
458
459	DBGFADDRESS PeHdrPart2Addr = *pImageAddr;
460	DBGFR3AddrAdd(&PeHdrPart2Addr, offPeHdrs + cbPeHdrsPart1);
461	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrPart2Addr, &puBuf->ab[cbPeHdrsPart1], cbHdrs - cbPeHdrsPart1);
462	if (RT_FAILURE(rc))
463	return RTERRINFO_LOG_SET_F(pErrInfo, rc,
464	"Failed to read the second part of the PE headers at %RGv (off=%#RX32 + %#RX32): %Rrc",
465	PeHdrPart2Addr.FlatPtr, offPeHdrs, cbPeHdrsPart1, rc);
466
467	/*
468	* Check the image architecture and determine the bitness.
469	*/
470	RTLDRARCH enmArchActual;
471	bool f32Bit;
472	switch (puBuf->Nt32.FileHeader.Machine)
473	{
474	case IMAGE_FILE_MACHINE_I386:
475	enmArchActual = RTLDRARCH_X86_32;
476	f32Bit = true;
477	break;
478	case IMAGE_FILE_MACHINE_AMD64:
479	enmArchActual = RTLDRARCH_AMD64;
480	f32Bit = false;
481	break;
482	case IMAGE_FILE_MACHINE_ARM:
483	case IMAGE_FILE_MACHINE_THUMB:
484	case IMAGE_FILE_MACHINE_ARMNT:
485	enmArchActual = RTLDRARCH_ARM32;
486	f32Bit = true;
487	break;
488	case IMAGE_FILE_MACHINE_ARM64:
489	enmArchActual = RTLDRARCH_ARM64;
490	f32Bit = false;
491	break;
492	default:
493	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unknown machine: %#x", puBuf->Nt32.FileHeader.Machine);
494	}
495	if ( enmArch != RTLDRARCH_WHATEVER
496	&& enmArch != enmArchActual)
497	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Found %s expected %s",
498	RTLdrArchName(enmArchActual), RTLdrArchName(enmArch));
499
500	/*
501	* Check optional header magic and size.
502	*/
503	uint16_t const uOptMagic = f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC;
504	if (puBuf->Nt32.OptionalHeader.Magic != uOptMagic)
505	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header magic: %#x (expected %#x)",
506	puBuf->Nt32.OptionalHeader.Magic, uOptMagic);
507
508	uint32_t const cDataDir = f32Bit ? puBuf->Nt32.OptionalHeader.NumberOfRvaAndSizes : puBuf->Nt64.OptionalHeader.NumberOfRvaAndSizes;
509	if ( cDataDir <= IMAGE_DIRECTORY_ENTRY_BASERELOC /* a bit random */
510	\|\| cDataDir > 32 /* also random */)
511	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected data directory size: %#x", cDataDir);
512
513	uint32_t cbOptHdr = f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64);
514	cbOptHdr -= sizeof(IMAGE_DATA_DIRECTORY) * IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
515	cbOptHdr += sizeof(IMAGE_DATA_DIRECTORY) * cDataDir;
516	if (puBuf->Nt32.FileHeader.SizeOfOptionalHeader != cbOptHdr)
517	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header size: %#x (expected %#x)",
518	puBuf->Nt32.FileHeader.SizeOfOptionalHeader, cbOptHdr);
519
520	uint32_t const cbSectAlign = f32Bit ? puBuf->Nt32.OptionalHeader.SectionAlignment : puBuf->Nt64.OptionalHeader.SectionAlignment;
521	PCIMAGE_SECTION_HEADER pSHdrs = (PCIMAGE_SECTION_HEADER)((uintptr_t)&puBuf->Nt32.OptionalHeader + cbOptHdr);
522	PCIMAGE_DATA_DIRECTORY paDataDir = (PCIMAGE_DATA_DIRECTORY)((uintptr_t)pSHdrs - cDataDir * sizeof(IMAGE_DATA_DIRECTORY));
523
524	/*
525	* Establish the image size.
526	*/
527	uint32_t cbImageFromHdr = f32Bit ? puBuf->Nt32.OptionalHeader.SizeOfImage : puBuf->Nt64.OptionalHeader.SizeOfImage;
528	if ( !cbImage
529	\|\| (fFlags & DBGFMODINMEM_F_PE_NT31))
530	cbImage = RT_ALIGN(cbImageFromHdr, _4K);
531	else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
532	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_MISMATCH, "Image size mismatch: input=%#x header=%#x", cbImage, cbImageFromHdr);
533
534	/*
535	* Guess the image name if not specified.
536	*/
537	//char szImageName[64];
538	if (!pszName)
539	{
540	/** @todo */
541	}
542
543	/*
544	* Create the module using the in memory image first, falling back on cached image.
545	*/
546	RTLDRMOD hLdrMod;
547	rc = dbgfR3ModInMemPeCreateLdrMod(pUVM, fFlags, pszName, pImageAddr, cbImage, cbImageFromHdr, f32Bit,
548	puBuf->Nt32.FileHeader.NumberOfSections, pSHdrs, cbSectAlign, cDataDir, paDataDir,
549	offPeHdrs, &hLdrMod, pErrInfo);
550	if (RT_FAILURE(rc))
551	hLdrMod = NIL_RTLDRMOD;
552
553	RTDBGMOD hMod;
554	rc = RTDbgModCreateFromPeImage(&hMod, pszName, NULL, &hLdrMod, cbImageFromHdr,
555	puBuf->Nt32.FileHeader.TimeDateStamp, DBGFR3AsGetConfig(pUVM));
556	if (RT_SUCCESS(rc))
557	*phDbgMod = hMod;
558	else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
559	{
560	/*
561	* Fallback is a container module.
562	*/
563	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
564	if (RT_SUCCESS(rc))
565	{
566	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
567	AssertRC(rc);
568	}
569	}
570	return rc;
571	}
572
573
574
575	/**
576	* Process a PE image found in guest memory.
577	*
578	* @param pUVM The user mode VM handle.
579	* @param pImageAddr The image address.
580	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
581	* @param pszName The image name, optional.
582	* @param enmArch The image arch if we force it, pass
583	* RTLDRARCH_WHATEVER if you don't care.
584	* @param cbImage Image size. Pass 0 if not known.
585	* @param phDbgMod Where to return the resulting debug module on success.
586	* @param pErrInfo Where to return extended error info on failure.
587	*/
588	VMMR3DECL(int) DBGFR3ModInMem(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char *pszName,
589	RTLDRARCH enmArch, uint32_t cbImage, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
590	{
591	/*
592	* Validate and adjust.
593	*/
594	AssertPtrReturn(phDbgMod, VERR_INVALID_POINTER);
595	*phDbgMod = NIL_RTDBGMOD;
596	AssertPtrReturn(pImageAddr, VERR_INVALID_POINTER);
597	AssertMsgReturn(cbImage == 0 \|\| cbImage >= sizeof(IMAGE_NT_HEADERS32) + sizeof(IMAGE_DOS_HEADER),
598	("cbImage=%#x\n", cbImage), VERR_INVALID_PARAMETER);
599	AssertMsgReturn(!(fFlags & ~DBGFMODINMEM_F_VALID_MASK), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
600	if (enmArch == RTLDRARCH_HOST)
601	enmArch = RTLdrGetHostArch();
602
603	/*
604	* Look for an image header we can work with.
605	*/
606	DBGFMODINMEMBUF uBuf;
607	RT_ZERO(uBuf);
608
609	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, pImageAddr, &uBuf, sizeof(uBuf.DosHdr));
610	if (RT_FAILURE(rc))
611	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read DOS header at %RGv: %Rrc", pImageAddr->FlatPtr, rc);
612
613	if (uBuf.ab[0] == ELFMAG0 && uBuf.ab[1] == ELFMAG1 && uBuf.ab[2] == ELFMAG2 && uBuf.ab[3] == ELFMAG3)
614	return dbgfR3ModInMemElf(pUVM, pImageAddr, fFlags, pszName, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
615
616	uint32_t offNewHdrs;
617	if (uBuf.DosHdr.e_magic == IMAGE_DOS_SIGNATURE)
618	{
619	offNewHdrs = uBuf.DosHdr.e_lfanew;
620	if ( offNewHdrs < 16
621	\|\| offNewHdrs > (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)))
622	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "e_lfanew value is out of range: %RX32 (16..%u)",
623	offNewHdrs, (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)));
624	}
625	else if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
626	offNewHdrs = 0;
627	else
628	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Unknown image magic at %RGv: %.8Rhxs",
629	pImageAddr->FlatPtr, uBuf.ab);
630
631	/*
632	* Read the next bit of header, assuming PE so stop at the end of
633	* the COFF file header.
634	*/
635	DBGFADDRESS PeHdrAddr = *pImageAddr;
636	DBGFR3AddrAdd(&PeHdrAddr, offNewHdrs);
637	uint32_t const cbPeHdrsPart1 = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader);
638	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrAddr, &uBuf, cbPeHdrsPart1);
639	if (RT_FAILURE(rc))
640	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read PE/LX/NE headers at %RGv (off=%#RX32): %Rrc",
641	PeHdrAddr.FlatPtr, offNewHdrs, rc);
642
643	if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
644	return dbgfR3ModInMemPe(pUVM, pImageAddr, fFlags, pszName, enmArch, cbImage, offNewHdrs, cbPeHdrsPart1, &uBuf,
645	phDbgMod, pErrInfo);
646
647	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "No PE/LX/NE header at %RGv (off=%#RX32): %.8Rhxs",
648	PeHdrAddr.FlatPtr, offNewHdrs, uBuf.ab);
649	}
650

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3ModInMem.cpp@ 73472

Download in other formats: