DBGFR3ModInMem.cpp@ 74113

Last change on this file since 74113 was 73491, checked in by vboxsync, 6 years ago
DBGF,DBGPluInWinNt: Produce more useful module names (e.g. stuff that works in DBGC).
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 28.9 KB

Line
1	/* $Id: DBGFR3ModInMem.cpp 73491 2018-08-03 14:51:55Z vboxsync $ */
2	/** @file
3	* DBGFR3ModInMemPe - In memory PE module 'loader'.
4	*/
5
6	/*
7	* Copyright (C) 2009-2018 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF
23	#include <VBox/vmm/dbgf.h>
24
25	#include <VBox/err.h>
26	#include <iprt/ctype.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/path.h>
30	#include <iprt/string.h>
31	#include <iprt/formats/pecoff.h>
32	#include <iprt/formats/mz.h>
33	#include <iprt/formats/elf.h>
34
35
36	/*********************************************************************************************************************************
37	* Structures and Typedefs *
38	*********************************************************************************************************************************/
39	/**
40	* The WinNT digger's loader reader instance data.
41	*/
42	typedef struct DBGFMODPERDR
43	{
44	/** The VM handle (referenced). */
45	PUVM pUVM;
46	/** The image base. */
47	DBGFADDRESS ImageAddr;
48	/** The image size. */
49	uint32_t cbImage;
50	/** The file offset of the SizeOfImage field in the optional header if it
51	* needs patching, otherwise set to UINT32_MAX. */
52	uint32_t offSizeOfImage;
53	/** The correct image size. */
54	uint32_t cbCorrectImageSize;
55	/** Number of entries in the aMappings table. */
56	uint32_t cMappings;
57	/** Mapping hint. */
58	uint32_t iHint;
59	/** Mapping file offset to memory offsets, ordered by file offset. */
60	struct
61	{
62	/** The file offset. */
63	uint32_t offFile;
64	/** The size of this mapping. */
65	uint32_t cbMem;
66	/** The offset to the memory from the start of the image. */
67	uint32_t offMem;
68	} aMappings[1];
69	} DBGFMODPERDR;
70	/** Pointer a WinNT loader reader instance data. */
71	typedef DBGFMODPERDR *PDBGFMODPERDR;
72
73	/**
74	* Stack buffer.
75	*/
76	typedef union DBGFMODINMEMBUF
77	{
78	uint8_t ab[0x2000];
79	IMAGE_DOS_HEADER DosHdr;
80	IMAGE_NT_HEADERS32 Nt32;
81	IMAGE_NT_HEADERS64 Nt64;
82	} DBGFMODINMEMBUF;
83	/** Pointer to stack buffer. */
84	typedef DBGFMODINMEMBUF *PDBGFMODINMEMBUF;
85
86
87
88	/**
89	* Normalizes a debug module name.
90	*
91	* @returns Normalized debug module name.
92	* @param pszName The name.
93	* @param pszBuf Buffer to use if work is needed.
94	* @param cbBuf Size of buffer.
95	*/
96	const char dbgfR3ModNormalizeName(const char pszName, char *pszBuf, size_t cbBuf)
97	{
98	/*
99	* Skip to the filename in case someone gave us a full filename path.
100	*/
101	pszName = RTPathFilenameEx(pszName, RTPATH_STR_F_STYLE_DOS);
102
103	/*
104	* Is it okay?
105	*/
106	size_t cchName = strlen(pszName);
107	size_t off = 0;
108	for (;; off++)
109	{
110	char ch = pszName[off];
111	if (ch == '\0')
112	return pszName;
113	if (!RT_C_IS_ALNUM(ch) && ch != '_')
114	break;
115	}
116
117	/*
118	* It's no okay, so morph it.
119	*/
120	if (cchName >= cbBuf)
121	cchName = cbBuf - 1;
122	for (off = 0; off < cchName; off++)
123	{
124	char ch = pszName[off];
125	if (!RT_C_IS_ALNUM(ch))
126	ch = '_';
127	pszBuf[off] = ch;
128	}
129	pszBuf[off] = '\0';
130
131	return pszBuf;
132	}
133
134
135	/**
136	* Handles in-memory ELF images.
137	*
138	* @returns VBox status code.
139	* @param pUVM The user mode VM handle.
140	* @param pImageAddr The image address.
141	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
142	* @param pszName The module name, optional.
143	* @param pszFilename The image filename, optional.
144	* @param enmArch The image arch if we force it, pass
145	* RTLDRARCH_WHATEVER if you don't care.
146	* @param cbImage Image size. Pass 0 if not known.
147	* @param puBuf The header buffer.
148	* @param phDbgMod Where to return the resulting debug module on success.
149	* @param pErrInfo Where to return extended error info on failure.
150	*/
151	static int dbgfR3ModInMemElf(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
152	RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
153	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
154	{
155	RT_NOREF(pUVM, fFlags, pszName, pszFilename, enmArch, cbImage, puBuf, phDbgMod);
156	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Found ELF magic at %RGv", pImageAddr->FlatPtr);
157	}
158
159
160	/**
161	* @callback_method_impl{PFNRTLDRRDRMEMREAD}
162	*/
163	static DECLCALLBACK(int) dbgfModInMemPeRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
164	{
165	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
166	uint32_t offFile = (uint32_t)off;
167	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
168
169	uint32_t i = pThis->iHint;
170	if (pThis->aMappings[i].offFile > offFile)
171	{
172	i = pThis->cMappings;
173	while (i-- > 0)
174	if (offFile >= pThis->aMappings[i].offFile)
175	break;
176	pThis->iHint = i;
177	}
178
179	while (cb > 0)
180	{
181	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
182	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
183
184	/* Read file bits backed by memory. */
185	if (offMap < pThis->aMappings[i].cbMem)
186	{
187	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
188	if (cbToRead > cb)
189	cbToRead = (uint32_t)cb;
190
191	DBGFADDRESS Addr = pThis->ImageAddr;
192	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
193
194	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
195	if (RT_FAILURE(rc))
196	return rc;
197
198	/* Apply SizeOfImage patch? */
199	if ( pThis->offSizeOfImage != UINT32_MAX
200	&& offFile < pThis->offSizeOfImage + 4
201	&& offFile + cbToRead > pThis->offSizeOfImage)
202	{
203	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
204	uint32_t cbPatch = sizeof(SizeOfImage);
205	int32_t offPatch = pThis->offSizeOfImage - offFile;
206	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
207	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
208	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
209	while (cbPatch-- > 0)
210	{
211	if (offPatch >= 0)
212	*pbPatch = (uint8_t)SizeOfImage;
213	offPatch++;
214	pbPatch++;
215	SizeOfImage >>= 8;
216	}
217	}
218
219	/* Done? */
220	if (cbToRead == cb)
221	break;
222
223	offFile += cbToRead;
224	cb -= cbToRead;
225	pvBuf = (char *)pvBuf + cbToRead;
226	}
227
228	/* Mind the gap. */
229	if (offNextMap > offFile)
230	{
231	uint32_t cbZero = offNextMap - offFile;
232	if (cbZero > cb)
233	{
234	RT_BZERO(pvBuf, cb);
235	break;
236	}
237
238	RT_BZERO(pvBuf, cbZero);
239	offFile += cbZero;
240	cb -= cbZero;
241	pvBuf = (char *)pvBuf + cbZero;
242	}
243
244	pThis->iHint = ++i;
245	}
246
247	return VINF_SUCCESS;
248	}
249
250
251	/**
252	* @callback_method_impl{PFNRTLDRRDRMEMDTOR}
253	*/
254	static DECLCALLBACK(void) dbgfModInMemPeRdr_Dtor(void *pvUser)
255	{
256	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
257
258	VMR3ReleaseUVM(pThis->pUVM);
259	pThis->pUVM = NULL;
260	RTMemFree(pvUser);
261	}
262
263
264	/**
265	* Checks if the section headers look okay.
266	*
267	* @returns VBox status code.
268	* @param paShdrs Pointer to the section headers.
269	* @param cShdrs Number of headers.
270	* @param cbImage The image size reported by NT.
271	* @param cbImageFromHdr The image size by the linker in the header.
272	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
273	* no resource directory.
274	* @param cbSectAlign The section alignment specified in the header.
275	* @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
276	* @param pcbImageCorrect The corrected image size. This is derived from
277	* cbImage and virtual range of the section tables.
278	*
279	* The problem is that NT may choose to drop the
280	* last pages in images it loads early, starting at
281	* the resource directory. These images will have
282	* a page aligned cbImage.
283	*
284	* @param pErrInfo Where to return more error details.
285	*/
286	static int dbgfR3ModPeCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShdrs, uint32_t cShdrs, uint32_t cbImage,
287	uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
288	bool fNt31, uint32_t *pcbImageCorrect, PRTERRINFO pErrInfo)
289	{
290	*pcbImageCorrect = cbImage;
291
292	for (uint32_t i = 0; i < cShdrs; i++)
293	{
294	if (!paShdrs[i].Name[0])
295	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Section header #%u has no name", i);
296
297	if (paShdrs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
298	continue;
299
300	/* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
301	/** @todo this isn't really perfect. cbImage is kind of wrong... */
302	uint32_t cbVirtual = paShdrs[i].Misc.VirtualSize;
303	if (cbVirtual == 0)
304	{
305	for (uint32_t j = i + 1; j < cShdrs; j++)
306	if ( !(paShdrs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
307	&& paShdrs[j].VirtualAddress > paShdrs[i].VirtualAddress)
308	{
309	cbVirtual = paShdrs[j].VirtualAddress - paShdrs[i].VirtualAddress;
310	break;
311	}
312	if (!cbVirtual)
313	{
314	if (paShdrs[i].VirtualAddress < cbImageFromHdr)
315	cbVirtual = cbImageFromHdr - paShdrs[i].VirtualAddress;
316	else if (paShdrs[i].SizeOfRawData > 0)
317	cbVirtual = RT_ALIGN(paShdrs[i].SizeOfRawData, _4K);
318	}
319	}
320
321	/* Check that sizes are within the same range and that both sizes and
322	addresses are within reasonable limits. */
323	if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShdrs[i].SizeOfRawData, _64K)
324	\|\| cbVirtual >= _1G
325	\|\| paShdrs[i].SizeOfRawData >= _1G)
326	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
327	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!",
328	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].SizeOfRawData);
329	uint32_t uRvaEnd = paShdrs[i].VirtualAddress + cbVirtual;
330	if (uRvaEnd >= _1G \|\| uRvaEnd < paShdrs[i].VirtualAddress)
331	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
332	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!",
333	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].VirtualAddress, uRvaEnd);
334
335	/* Check for images chopped off around '.rsrc'. */
336	if ( cbImage < uRvaEnd
337	&& uRvaEnd >= uRvaRsrc)
338	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
339
340	/* Check that the section is within the image. */
341	if (uRvaEnd > cbImage && fNt31)
342	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
343	"Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x",
344	i, paShdrs[i].VirtualAddress, uRvaEnd, cbImage);
345	}
346
347	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
348	*pcbImageCorrect = cbImage;
349	return VINF_SUCCESS;
350	}
351
352
353	/**
354	* Create a loader module for the in-guest-memory PE module.
355	*/
356	static int dbgfR3ModInMemPeCreateLdrMod(PUVM pUVM, uint32_t fFlags, const char *pszName, PCDBGFADDRESS pImageAddr,
357	uint32_t cbImage, uint32_t cbImageFromHdr, bool f32Bit,
358	uint32_t cShdrs, PCIMAGE_SECTION_HEADER paShdrs, uint32_t cbSectAlign,
359	uint32_t cDataDir, PCIMAGE_DATA_DIRECTORY paDataDir, uint32_t offHdrs,
360	PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
361	{
362	/*
363	* Allocate and create a reader instance.
364	*/
365	PDBGFMODPERDR pRdr = (PDBGFMODPERDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGFMODPERDR, aMappings[cShdrs + 2]));
366	if (!pRdr)
367	return VERR_NO_MEMORY;
368
369	VMR3RetainUVM(pUVM);
370	pRdr->pUVM = pUVM;
371	pRdr->ImageAddr = *pImageAddr;
372	pRdr->cbImage = cbImage;
373	pRdr->cbCorrectImageSize = cbImage;
374	pRdr->offSizeOfImage = UINT32_MAX;
375	pRdr->iHint = 0;
376
377	/*
378	* Use the section table to construct a more accurate view of the file/image.
379	*/
380	uint32_t uRvaRsrc = UINT32_MAX;
381	if ( cDataDir > IMAGE_DIRECTORY_ENTRY_RESOURCE
382	&& paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size > 0)
383	uRvaRsrc = paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
384
385	int rc = dbgfR3ModPeCheckSectHdrsAndImgSize(paShdrs, cShdrs, cbImage, cbImageFromHdr, uRvaRsrc, cbSectAlign,
386	RT_BOOL(fFlags & DBGFMODINMEM_F_PE_NT31), &pRdr->cbCorrectImageSize, pErrInfo);
387	if (RT_SUCCESS(rc))
388	{
389	pRdr->cMappings = 0;
390
391	for (uint32_t i = 0; i < cShdrs; i++)
392	if ( paShdrs[i].SizeOfRawData > 0
393	&& paShdrs[i].PointerToRawData > 0)
394	{
395	uint32_t j = 1;
396	if (!pRdr->cMappings)
397	pRdr->cMappings++;
398	else
399	{
400	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShdrs[i].PointerToRawData)
401	j++;
402	if (j < pRdr->cMappings)
403	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
404	}
405	pRdr->aMappings[j].offFile = paShdrs[i].PointerToRawData;
406	pRdr->aMappings[j].offMem = paShdrs[i].VirtualAddress;
407	pRdr->aMappings[j].cbMem = i + 1 < cShdrs
408	? paShdrs[i + 1].VirtualAddress - paShdrs[i].VirtualAddress
409	: paShdrs[i].Misc.VirtualSize;
410	if (j == pRdr->cMappings)
411	pRdr->cbImage = paShdrs[i].PointerToRawData + paShdrs[i].SizeOfRawData;
412	pRdr->cMappings++;
413	}
414
415	/* Insert the mapping of the headers that isn't covered by the section table. */
416	pRdr->aMappings[0].offFile = 0;
417	pRdr->aMappings[0].offMem = 0;
418	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
419
420	int j = pRdr->cMappings - 1;
421	while (j-- > 0)
422	{
423	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
424	if (pRdr->aMappings[j].cbMem > cbFile)
425	pRdr->aMappings[j].cbMem = cbFile;
426	}
427	}
428	else if (fFlags & DBGFMODINMEM_F_NO_READER_FALLBACK)
429	return rc;
430	else
431	{
432	/*
433	* Fallback, fake identity mapped file data.
434	*/
435	pRdr->cMappings = 1;
436	pRdr->aMappings[0].offFile = 0;
437	pRdr->aMappings[0].offMem = 0;
438	pRdr->aMappings[0].cbMem = pRdr->cbImage;
439	}
440
441	/* Enable the SizeOfImage patching if necessary. */
442	if (pRdr->cbCorrectImageSize != cbImage)
443	{
444	Log(("dbgfR3ModInMemPeCreateLdrMod: The image is really %#x bytes long, not %#x as mapped by NT!\n",
445	pRdr->cbCorrectImageSize, cbImage));
446	pRdr->offSizeOfImage = f32Bit
447	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
448	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
449	}
450
451	/*
452	* Call the loader to open the PE image for debugging.
453	* Note! It always calls pfnDtor.
454	*/
455	RTLDRMOD hLdrMod;
456	rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
457	dbgfModInMemPeRdr_Read, dbgfModInMemPeRdr_Dtor, pRdr,
458	&hLdrMod, pErrInfo);
459	if (RT_SUCCESS(rc))
460	*phLdrMod = hLdrMod;
461	else
462	*phLdrMod = NIL_RTLDRMOD;
463	return rc;
464	}
465
466
467	/**
468	* Handles in-memory PE images.
469	*
470	* @returns VBox status code.
471	* @param pUVM The user mode VM handle.
472	* @param pImageAddr The image address.
473	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
474	* @param pszName The module name, optional.
475	* @param pszFilename The image filename, optional.
476	* @param enmArch The image arch if we force it, pass
477	* RTLDRARCH_WHATEVER if you don't care.
478	* @param cbImage Image size. Pass 0 if not known.
479	* @param offPeHdrs Offset of the PE header.
480	* @param cbPeHdrsPart1 How read into uBuf at @a offPeHdrs.
481	* @param puBuf The header buffer.
482	* @param phDbgMod Where to return the resulting debug module on success.
483	* @param pErrInfo Where to return extended error info on failure.
484	*/
485	static int dbgfR3ModInMemPe(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
486	RTLDRARCH enmArch, uint32_t cbImage, uint32_t offPeHdrs, uint32_t cbPeHdrsPart1,
487	PDBGFMODINMEMBUF puBuf, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
488	{
489	/*
490	* Read the optional header and the section table after validating the
491	* info we need from the file header.
492	*/
493	/* Check the opt hdr size and number of sections as these are used to determine how much to read next. */
494	if ( puBuf->Nt32.FileHeader.SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER32)
495	\|\| puBuf->Nt32.FileHeader.SizeOfOptionalHeader > sizeof(IMAGE_OPTIONAL_HEADER64) + 128)
496	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Invalid SizeOfOptionalHeader value: %#RX32",
497	puBuf->Nt32.FileHeader.SizeOfOptionalHeader);
498
499	if ( puBuf->Nt32.FileHeader.NumberOfSections < 1
500	\|\| puBuf->Nt32.FileHeader.NumberOfSections > 190 /* what fits in our 8K buffer */)
501	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "NumberOfSections is out of range: %#RX32 (1..190)",
502	puBuf->Nt32.FileHeader.NumberOfSections);
503
504	/* Read the optional header and section table. */
505	uint32_t const cbHdrs = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
506	+ puBuf->Nt32.FileHeader.SizeOfOptionalHeader
507	+ puBuf->Nt32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
508	AssertReturn(cbHdrs <= sizeof(*puBuf), RTERRINFO_LOG_SET_F(pErrInfo, VERR_INTERNAL_ERROR_2, "cbHdrs=%#x", cbHdrs));
509
510	DBGFADDRESS PeHdrPart2Addr = *pImageAddr;
511	DBGFR3AddrAdd(&PeHdrPart2Addr, offPeHdrs + cbPeHdrsPart1);
512	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrPart2Addr, &puBuf->ab[cbPeHdrsPart1], cbHdrs - cbPeHdrsPart1);
513	if (RT_FAILURE(rc))
514	return RTERRINFO_LOG_SET_F(pErrInfo, rc,
515	"Failed to read the second part of the PE headers at %RGv (off=%#RX32 + %#RX32): %Rrc",
516	PeHdrPart2Addr.FlatPtr, offPeHdrs, cbPeHdrsPart1, rc);
517
518	/*
519	* Check the image architecture and determine the bitness.
520	*/
521	RTLDRARCH enmArchActual;
522	bool f32Bit;
523	switch (puBuf->Nt32.FileHeader.Machine)
524	{
525	case IMAGE_FILE_MACHINE_I386:
526	enmArchActual = RTLDRARCH_X86_32;
527	f32Bit = true;
528	break;
529	case IMAGE_FILE_MACHINE_AMD64:
530	enmArchActual = RTLDRARCH_AMD64;
531	f32Bit = false;
532	break;
533	case IMAGE_FILE_MACHINE_ARM:
534	case IMAGE_FILE_MACHINE_THUMB:
535	case IMAGE_FILE_MACHINE_ARMNT:
536	enmArchActual = RTLDRARCH_ARM32;
537	f32Bit = true;
538	break;
539	case IMAGE_FILE_MACHINE_ARM64:
540	enmArchActual = RTLDRARCH_ARM64;
541	f32Bit = false;
542	break;
543	default:
544	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unknown machine: %#x", puBuf->Nt32.FileHeader.Machine);
545	}
546	if ( enmArch != RTLDRARCH_WHATEVER
547	&& enmArch != enmArchActual)
548	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Found %s expected %s",
549	RTLdrArchName(enmArchActual), RTLdrArchName(enmArch));
550
551	/*
552	* Check optional header magic and size.
553	*/
554	uint16_t const uOptMagic = f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC;
555	if (puBuf->Nt32.OptionalHeader.Magic != uOptMagic)
556	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header magic: %#x (expected %#x)",
557	puBuf->Nt32.OptionalHeader.Magic, uOptMagic);
558
559	uint32_t const cDataDir = f32Bit ? puBuf->Nt32.OptionalHeader.NumberOfRvaAndSizes : puBuf->Nt64.OptionalHeader.NumberOfRvaAndSizes;
560	if ( cDataDir <= IMAGE_DIRECTORY_ENTRY_BASERELOC /* a bit random */
561	\|\| cDataDir > 32 /* also random */)
562	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected data directory size: %#x", cDataDir);
563
564	uint32_t cbOptHdr = f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64);
565	cbOptHdr -= sizeof(IMAGE_DATA_DIRECTORY) * IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
566	cbOptHdr += sizeof(IMAGE_DATA_DIRECTORY) * cDataDir;
567	if (puBuf->Nt32.FileHeader.SizeOfOptionalHeader != cbOptHdr)
568	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header size: %#x (expected %#x)",
569	puBuf->Nt32.FileHeader.SizeOfOptionalHeader, cbOptHdr);
570
571	uint32_t const cbSectAlign = f32Bit ? puBuf->Nt32.OptionalHeader.SectionAlignment : puBuf->Nt64.OptionalHeader.SectionAlignment;
572	PCIMAGE_SECTION_HEADER pSHdrs = (PCIMAGE_SECTION_HEADER)((uintptr_t)&puBuf->Nt32.OptionalHeader + cbOptHdr);
573	PCIMAGE_DATA_DIRECTORY paDataDir = (PCIMAGE_DATA_DIRECTORY)((uintptr_t)pSHdrs - cDataDir * sizeof(IMAGE_DATA_DIRECTORY));
574
575	/*
576	* Establish the image size.
577	*/
578	uint32_t cbImageFromHdr = f32Bit ? puBuf->Nt32.OptionalHeader.SizeOfImage : puBuf->Nt64.OptionalHeader.SizeOfImage;
579	if ( !cbImage
580	\|\| (fFlags & DBGFMODINMEM_F_PE_NT31))
581	cbImage = RT_ALIGN(cbImageFromHdr, _4K);
582	else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
583	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_MISMATCH, "Image size mismatch: input=%#x header=%#x", cbImage, cbImageFromHdr);
584
585	/*
586	* Guess the module name if not specified and make sure it conforms to DBGC expectations.
587	*/
588	if (!pszName)
589	{
590	if (pszFilename)
591	pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
592	/** @todo */
593	}
594
595	char szNormalized[128];
596	pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
597
598	/*
599	* Create the module using the in memory image first, falling back on cached image.
600	*/
601	RTLDRMOD hLdrMod;
602	rc = dbgfR3ModInMemPeCreateLdrMod(pUVM, fFlags, pszName, pImageAddr, cbImage, cbImageFromHdr, f32Bit,
603	puBuf->Nt32.FileHeader.NumberOfSections, pSHdrs, cbSectAlign, cDataDir, paDataDir,
604	offPeHdrs, &hLdrMod, pErrInfo);
605	if (RT_FAILURE(rc))
606	hLdrMod = NIL_RTLDRMOD;
607
608	RTDBGMOD hMod;
609	rc = RTDbgModCreateFromPeImage(&hMod, pszFilename, pszName, &hLdrMod, cbImageFromHdr,
610	puBuf->Nt32.FileHeader.TimeDateStamp, DBGFR3AsGetConfig(pUVM));
611	if (RT_SUCCESS(rc))
612	*phDbgMod = hMod;
613	else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
614	{
615	/*
616	* Fallback is a container module.
617	*/
618	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
619	if (RT_SUCCESS(rc))
620	{
621	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
622	AssertRC(rc);
623	}
624	}
625	return rc;
626	}
627
628
629
630	/**
631	* Process a PE image found in guest memory.
632	*
633	* @param pUVM The user mode VM handle.
634	* @param pImageAddr The image address.
635	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
636	* @param pszName The module name, optional.
637	* @param pszFilename The image filename, optional.
638	* @param enmArch The image arch if we force it, pass
639	* RTLDRARCH_WHATEVER if you don't care.
640	* @param cbImage Image size. Pass 0 if not known.
641	* @param phDbgMod Where to return the resulting debug module on success.
642	* @param pErrInfo Where to return extended error info on failure.
643	*/
644	VMMR3DECL(int) DBGFR3ModInMem(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
645	RTLDRARCH enmArch, uint32_t cbImage, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
646	{
647	/*
648	* Validate and adjust.
649	*/
650	AssertPtrReturn(phDbgMod, VERR_INVALID_POINTER);
651	*phDbgMod = NIL_RTDBGMOD;
652	AssertPtrReturn(pImageAddr, VERR_INVALID_POINTER);
653	AssertMsgReturn(cbImage == 0 \|\| cbImage >= sizeof(IMAGE_NT_HEADERS32) + sizeof(IMAGE_DOS_HEADER),
654	("cbImage=%#x\n", cbImage), VERR_INVALID_PARAMETER);
655	AssertMsgReturn(!(fFlags & ~DBGFMODINMEM_F_VALID_MASK), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
656	if (enmArch == RTLDRARCH_HOST)
657	enmArch = RTLdrGetHostArch();
658
659	/*
660	* Look for an image header we can work with.
661	*/
662	DBGFMODINMEMBUF uBuf;
663	RT_ZERO(uBuf);
664
665	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, pImageAddr, &uBuf, sizeof(uBuf.DosHdr));
666	if (RT_FAILURE(rc))
667	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read DOS header at %RGv: %Rrc", pImageAddr->FlatPtr, rc);
668
669	if (uBuf.ab[0] == ELFMAG0 && uBuf.ab[1] == ELFMAG1 && uBuf.ab[2] == ELFMAG2 && uBuf.ab[3] == ELFMAG3)
670	return dbgfR3ModInMemElf(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
671
672	uint32_t offNewHdrs;
673	if (uBuf.DosHdr.e_magic == IMAGE_DOS_SIGNATURE)
674	{
675	offNewHdrs = uBuf.DosHdr.e_lfanew;
676	if ( offNewHdrs < 16
677	\|\| offNewHdrs > (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)))
678	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "e_lfanew value is out of range: %RX32 (16..%u)",
679	offNewHdrs, (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)));
680	}
681	else if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
682	offNewHdrs = 0;
683	else
684	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Unknown image magic at %RGv: %.8Rhxs",
685	pImageAddr->FlatPtr, uBuf.ab);
686
687	/*
688	* Read the next bit of header, assuming PE so stop at the end of
689	* the COFF file header.
690	*/
691	DBGFADDRESS PeHdrAddr = *pImageAddr;
692	DBGFR3AddrAdd(&PeHdrAddr, offNewHdrs);
693	uint32_t const cbPeHdrsPart1 = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader);
694	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrAddr, &uBuf, cbPeHdrsPart1);
695	if (RT_FAILURE(rc))
696	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read PE/LX/NE headers at %RGv (off=%#RX32): %Rrc",
697	PeHdrAddr.FlatPtr, offNewHdrs, rc);
698
699	if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
700	return dbgfR3ModInMemPe(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, offNewHdrs, cbPeHdrsPart1,
701	&uBuf, phDbgMod, pErrInfo);
702
703	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "No PE/LX/NE header at %RGv (off=%#RX32): %.8Rhxs",
704	PeHdrAddr.FlatPtr, offNewHdrs, uBuf.ab);
705	}
706

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3ModInMem.cpp@ 74113

Download in other formats: