DBGFR3ModInMem.cpp@ 75142

Last change on this file since 75142 was 75049, checked in by vboxsync, 6 years ago
IPRT,SUPDrv: Added cbImage parameter to FNRTLDRRDRMEMDTOR; sketched the basics for darwin module verification. bugref:9232
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 29.0 KB

Line
1	/* $Id: DBGFR3ModInMem.cpp 75049 2018-10-24 16:06:42Z vboxsync $ */
2	/** @file
3	* DBGFR3ModInMemPe - In memory PE module 'loader'.
4	*/
5
6	/*
7	* Copyright (C) 2009-2018 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF
23	#include <VBox/vmm/dbgf.h>
24
25	#include <VBox/err.h>
26	#include <iprt/ctype.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/path.h>
30	#include <iprt/string.h>
31	#include <iprt/formats/pecoff.h>
32	#include <iprt/formats/mz.h>
33	#include <iprt/formats/elf.h>
34
35
36	/*********************************************************************************************************************************
37	* Structures and Typedefs *
38	*********************************************************************************************************************************/
39	/**
40	* The WinNT digger's loader reader instance data.
41	*/
42	typedef struct DBGFMODPERDR
43	{
44	/** The VM handle (referenced). */
45	PUVM pUVM;
46	/** The image base. */
47	DBGFADDRESS ImageAddr;
48	/** The image size. */
49	uint32_t cbImage;
50	/** The file offset of the SizeOfImage field in the optional header if it
51	* needs patching, otherwise set to UINT32_MAX. */
52	uint32_t offSizeOfImage;
53	/** The correct image size. */
54	uint32_t cbCorrectImageSize;
55	/** Number of entries in the aMappings table. */
56	uint32_t cMappings;
57	/** Mapping hint. */
58	uint32_t iHint;
59	/** Mapping file offset to memory offsets, ordered by file offset. */
60	struct
61	{
62	/** The file offset. */
63	uint32_t offFile;
64	/** The size of this mapping. */
65	uint32_t cbMem;
66	/** The offset to the memory from the start of the image. */
67	uint32_t offMem;
68	} aMappings[1];
69	} DBGFMODPERDR;
70	/** Pointer a WinNT loader reader instance data. */
71	typedef DBGFMODPERDR *PDBGFMODPERDR;
72
73	/**
74	* Stack buffer.
75	*/
76	typedef union DBGFMODINMEMBUF
77	{
78	uint8_t ab[0x2000];
79	IMAGE_DOS_HEADER DosHdr;
80	IMAGE_NT_HEADERS32 Nt32;
81	IMAGE_NT_HEADERS64 Nt64;
82	} DBGFMODINMEMBUF;
83	/** Pointer to stack buffer. */
84	typedef DBGFMODINMEMBUF *PDBGFMODINMEMBUF;
85
86
87
88	/**
89	* Normalizes a debug module name.
90	*
91	* @returns Normalized debug module name.
92	* @param pszName The name.
93	* @param pszBuf Buffer to use if work is needed.
94	* @param cbBuf Size of buffer.
95	*/
96	const char dbgfR3ModNormalizeName(const char pszName, char *pszBuf, size_t cbBuf)
97	{
98	/*
99	* Skip to the filename in case someone gave us a full filename path.
100	*/
101	pszName = RTPathFilenameEx(pszName, RTPATH_STR_F_STYLE_DOS);
102
103	/*
104	* Is it okay?
105	*/
106	size_t cchName = strlen(pszName);
107	size_t off = 0;
108	for (;; off++)
109	{
110	char ch = pszName[off];
111	if (ch == '\0')
112	return pszName;
113	if (!RT_C_IS_ALNUM(ch) && ch != '_')
114	break;
115	}
116
117	/*
118	* It's no okay, so morph it.
119	*/
120	if (cchName >= cbBuf)
121	cchName = cbBuf - 1;
122	for (off = 0; off < cchName; off++)
123	{
124	char ch = pszName[off];
125	if (!RT_C_IS_ALNUM(ch))
126	ch = '_';
127	pszBuf[off] = ch;
128	}
129	pszBuf[off] = '\0';
130
131	return pszBuf;
132	}
133
134
135	/**
136	* Handles in-memory ELF images.
137	*
138	* @returns VBox status code.
139	* @param pUVM The user mode VM handle.
140	* @param pImageAddr The image address.
141	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
142	* @param pszName The module name, optional.
143	* @param pszFilename The image filename, optional.
144	* @param enmArch The image arch if we force it, pass
145	* RTLDRARCH_WHATEVER if you don't care.
146	* @param cbImage Image size. Pass 0 if not known.
147	* @param puBuf The header buffer.
148	* @param phDbgMod Where to return the resulting debug module on success.
149	* @param pErrInfo Where to return extended error info on failure.
150	*/
151	static int dbgfR3ModInMemElf(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
152	RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
153	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
154	{
155	RT_NOREF(pUVM, fFlags, pszName, pszFilename, enmArch, cbImage, puBuf, phDbgMod);
156	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Found ELF magic at %RGv", pImageAddr->FlatPtr);
157	}
158
159
160	/**
161	* @callback_method_impl{PFNRTLDRRDRMEMREAD}
162	*/
163	static DECLCALLBACK(int) dbgfModInMemPeRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
164	{
165	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
166	uint32_t offFile = (uint32_t)off;
167	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
168
169	uint32_t i = pThis->iHint;
170	if (pThis->aMappings[i].offFile > offFile)
171	{
172	i = pThis->cMappings;
173	while (i-- > 0)
174	if (offFile >= pThis->aMappings[i].offFile)
175	break;
176	pThis->iHint = i;
177	}
178
179	while (cb > 0)
180	{
181	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
182	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
183
184	/* Read file bits backed by memory. */
185	if (offMap < pThis->aMappings[i].cbMem)
186	{
187	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
188	if (cbToRead > cb)
189	cbToRead = (uint32_t)cb;
190
191	DBGFADDRESS Addr = pThis->ImageAddr;
192	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
193
194	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
195	if (RT_FAILURE(rc))
196	return rc;
197
198	/* Apply SizeOfImage patch? */
199	if ( pThis->offSizeOfImage != UINT32_MAX
200	&& offFile < pThis->offSizeOfImage + 4
201	&& offFile + cbToRead > pThis->offSizeOfImage)
202	{
203	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
204	uint32_t cbPatch = sizeof(SizeOfImage);
205	int32_t offPatch = pThis->offSizeOfImage - offFile;
206	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
207	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
208	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
209	while (cbPatch-- > 0)
210	{
211	if (offPatch >= 0)
212	*pbPatch = (uint8_t)SizeOfImage;
213	offPatch++;
214	pbPatch++;
215	SizeOfImage >>= 8;
216	}
217	}
218
219	/* Done? */
220	if (cbToRead == cb)
221	break;
222
223	offFile += cbToRead;
224	cb -= cbToRead;
225	pvBuf = (char *)pvBuf + cbToRead;
226	}
227
228	/* Mind the gap. */
229	if (offNextMap > offFile)
230	{
231	uint32_t cbZero = offNextMap - offFile;
232	if (cbZero > cb)
233	{
234	RT_BZERO(pvBuf, cb);
235	break;
236	}
237
238	RT_BZERO(pvBuf, cbZero);
239	offFile += cbZero;
240	cb -= cbZero;
241	pvBuf = (char *)pvBuf + cbZero;
242	}
243
244	pThis->iHint = ++i;
245	}
246
247	return VINF_SUCCESS;
248	}
249
250
251	/**
252	* @callback_method_impl{PFNRTLDRRDRMEMDTOR}
253	*/
254	static DECLCALLBACK(void) dbgfModInMemPeRdr_Dtor(void *pvUser, size_t cbImage)
255	{
256	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
257	RT_NOREF(cbImage);
258
259	VMR3ReleaseUVM(pThis->pUVM);
260	pThis->pUVM = NULL;
261	RTMemFree(pvUser);
262	}
263
264
265	/**
266	* Checks if the section headers look okay.
267	*
268	* @returns VBox status code.
269	* @param paShdrs Pointer to the section headers.
270	* @param cShdrs Number of headers.
271	* @param cbImage The image size reported by NT.
272	* @param cbImageFromHdr The image size by the linker in the header.
273	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
274	* no resource directory.
275	* @param cbSectAlign The section alignment specified in the header.
276	* @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
277	* @param pcbImageCorrect The corrected image size. This is derived from
278	* cbImage and virtual range of the section tables.
279	*
280	* The problem is that NT may choose to drop the
281	* last pages in images it loads early, starting at
282	* the resource directory. These images will have
283	* a page aligned cbImage.
284	*
285	* @param pErrInfo Where to return more error details.
286	*/
287	static int dbgfR3ModPeCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShdrs, uint32_t cShdrs, uint32_t cbImage,
288	uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
289	bool fNt31, uint32_t *pcbImageCorrect, PRTERRINFO pErrInfo)
290	{
291	*pcbImageCorrect = cbImage;
292
293	for (uint32_t i = 0; i < cShdrs; i++)
294	{
295	if (!paShdrs[i].Name[0])
296	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Section header #%u has no name", i);
297
298	if (paShdrs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
299	continue;
300
301	/* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
302	/** @todo this isn't really perfect. cbImage is kind of wrong... */
303	uint32_t cbVirtual = paShdrs[i].Misc.VirtualSize;
304	if (cbVirtual == 0)
305	{
306	for (uint32_t j = i + 1; j < cShdrs; j++)
307	if ( !(paShdrs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
308	&& paShdrs[j].VirtualAddress > paShdrs[i].VirtualAddress)
309	{
310	cbVirtual = paShdrs[j].VirtualAddress - paShdrs[i].VirtualAddress;
311	break;
312	}
313	if (!cbVirtual)
314	{
315	if (paShdrs[i].VirtualAddress < cbImageFromHdr)
316	cbVirtual = cbImageFromHdr - paShdrs[i].VirtualAddress;
317	else if (paShdrs[i].SizeOfRawData > 0)
318	cbVirtual = RT_ALIGN(paShdrs[i].SizeOfRawData, _4K);
319	}
320	}
321
322	/* Check that sizes are within the same range and that both sizes and
323	addresses are within reasonable limits. */
324	if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShdrs[i].SizeOfRawData, _64K)
325	\|\| cbVirtual >= _1G
326	\|\| paShdrs[i].SizeOfRawData >= _1G)
327	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
328	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!",
329	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].SizeOfRawData);
330	uint32_t uRvaEnd = paShdrs[i].VirtualAddress + cbVirtual;
331	if (uRvaEnd >= _1G \|\| uRvaEnd < paShdrs[i].VirtualAddress)
332	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
333	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!",
334	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].VirtualAddress, uRvaEnd);
335
336	/* Check for images chopped off around '.rsrc'. */
337	if ( cbImage < uRvaEnd
338	&& uRvaEnd >= uRvaRsrc)
339	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
340
341	/* Check that the section is within the image. */
342	if (uRvaEnd > cbImage && fNt31)
343	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
344	"Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x",
345	i, paShdrs[i].VirtualAddress, uRvaEnd, cbImage);
346	}
347
348	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
349	*pcbImageCorrect = cbImage;
350	return VINF_SUCCESS;
351	}
352
353
354	/**
355	* Create a loader module for the in-guest-memory PE module.
356	*/
357	static int dbgfR3ModInMemPeCreateLdrMod(PUVM pUVM, uint32_t fFlags, const char *pszName, PCDBGFADDRESS pImageAddr,
358	uint32_t cbImage, uint32_t cbImageFromHdr, bool f32Bit,
359	uint32_t cShdrs, PCIMAGE_SECTION_HEADER paShdrs, uint32_t cbSectAlign,
360	uint32_t cDataDir, PCIMAGE_DATA_DIRECTORY paDataDir, uint32_t offHdrs,
361	PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
362	{
363	/*
364	* Allocate and create a reader instance.
365	*/
366	PDBGFMODPERDR pRdr = (PDBGFMODPERDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGFMODPERDR, aMappings[cShdrs + 2]));
367	if (!pRdr)
368	return VERR_NO_MEMORY;
369
370	VMR3RetainUVM(pUVM);
371	pRdr->pUVM = pUVM;
372	pRdr->ImageAddr = *pImageAddr;
373	pRdr->cbImage = cbImage;
374	pRdr->cbCorrectImageSize = cbImage;
375	pRdr->offSizeOfImage = UINT32_MAX;
376	pRdr->iHint = 0;
377
378	/*
379	* Use the section table to construct a more accurate view of the file/image.
380	*/
381	uint32_t uRvaRsrc = UINT32_MAX;
382	if ( cDataDir > IMAGE_DIRECTORY_ENTRY_RESOURCE
383	&& paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size > 0)
384	uRvaRsrc = paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
385
386	int rc = dbgfR3ModPeCheckSectHdrsAndImgSize(paShdrs, cShdrs, cbImage, cbImageFromHdr, uRvaRsrc, cbSectAlign,
387	RT_BOOL(fFlags & DBGFMODINMEM_F_PE_NT31), &pRdr->cbCorrectImageSize, pErrInfo);
388	if (RT_SUCCESS(rc))
389	{
390	pRdr->cMappings = 0;
391
392	for (uint32_t i = 0; i < cShdrs; i++)
393	if ( paShdrs[i].SizeOfRawData > 0
394	&& paShdrs[i].PointerToRawData > 0)
395	{
396	uint32_t j = 1;
397	if (!pRdr->cMappings)
398	pRdr->cMappings++;
399	else
400	{
401	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShdrs[i].PointerToRawData)
402	j++;
403	if (j < pRdr->cMappings)
404	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
405	}
406	pRdr->aMappings[j].offFile = paShdrs[i].PointerToRawData;
407	pRdr->aMappings[j].offMem = paShdrs[i].VirtualAddress;
408	pRdr->aMappings[j].cbMem = i + 1 < cShdrs
409	? paShdrs[i + 1].VirtualAddress - paShdrs[i].VirtualAddress
410	: paShdrs[i].Misc.VirtualSize;
411	if (j == pRdr->cMappings)
412	pRdr->cbImage = paShdrs[i].PointerToRawData + paShdrs[i].SizeOfRawData;
413	pRdr->cMappings++;
414	}
415
416	/* Insert the mapping of the headers that isn't covered by the section table. */
417	pRdr->aMappings[0].offFile = 0;
418	pRdr->aMappings[0].offMem = 0;
419	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
420
421	int j = pRdr->cMappings - 1;
422	while (j-- > 0)
423	{
424	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
425	if (pRdr->aMappings[j].cbMem > cbFile)
426	pRdr->aMappings[j].cbMem = cbFile;
427	}
428	}
429	else if (fFlags & DBGFMODINMEM_F_NO_READER_FALLBACK)
430	return rc;
431	else
432	{
433	/*
434	* Fallback, fake identity mapped file data.
435	*/
436	pRdr->cMappings = 1;
437	pRdr->aMappings[0].offFile = 0;
438	pRdr->aMappings[0].offMem = 0;
439	pRdr->aMappings[0].cbMem = pRdr->cbImage;
440	}
441
442	/* Enable the SizeOfImage patching if necessary. */
443	if (pRdr->cbCorrectImageSize != cbImage)
444	{
445	Log(("dbgfR3ModInMemPeCreateLdrMod: The image is really %#x bytes long, not %#x as mapped by NT!\n",
446	pRdr->cbCorrectImageSize, cbImage));
447	pRdr->offSizeOfImage = f32Bit
448	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
449	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
450	}
451
452	/*
453	* Call the loader to open the PE image for debugging.
454	* Note! It always calls pfnDtor.
455	*/
456	RTLDRMOD hLdrMod;
457	rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
458	dbgfModInMemPeRdr_Read, dbgfModInMemPeRdr_Dtor, pRdr,
459	&hLdrMod, pErrInfo);
460	if (RT_SUCCESS(rc))
461	*phLdrMod = hLdrMod;
462	else
463	*phLdrMod = NIL_RTLDRMOD;
464	return rc;
465	}
466
467
468	/**
469	* Handles in-memory PE images.
470	*
471	* @returns VBox status code.
472	* @param pUVM The user mode VM handle.
473	* @param pImageAddr The image address.
474	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
475	* @param pszName The module name, optional.
476	* @param pszFilename The image filename, optional.
477	* @param enmArch The image arch if we force it, pass
478	* RTLDRARCH_WHATEVER if you don't care.
479	* @param cbImage Image size. Pass 0 if not known.
480	* @param offPeHdrs Offset of the PE header.
481	* @param cbPeHdrsPart1 How read into uBuf at @a offPeHdrs.
482	* @param puBuf The header buffer.
483	* @param phDbgMod Where to return the resulting debug module on success.
484	* @param pErrInfo Where to return extended error info on failure.
485	*/
486	static int dbgfR3ModInMemPe(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
487	RTLDRARCH enmArch, uint32_t cbImage, uint32_t offPeHdrs, uint32_t cbPeHdrsPart1,
488	PDBGFMODINMEMBUF puBuf, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
489	{
490	/*
491	* Read the optional header and the section table after validating the
492	* info we need from the file header.
493	*/
494	/* Check the opt hdr size and number of sections as these are used to determine how much to read next. */
495	if ( puBuf->Nt32.FileHeader.SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER32)
496	\|\| puBuf->Nt32.FileHeader.SizeOfOptionalHeader > sizeof(IMAGE_OPTIONAL_HEADER64) + 128)
497	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Invalid SizeOfOptionalHeader value: %#RX32",
498	puBuf->Nt32.FileHeader.SizeOfOptionalHeader);
499
500	if ( puBuf->Nt32.FileHeader.NumberOfSections < 1
501	\|\| puBuf->Nt32.FileHeader.NumberOfSections > 190 /* what fits in our 8K buffer */)
502	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "NumberOfSections is out of range: %#RX32 (1..190)",
503	puBuf->Nt32.FileHeader.NumberOfSections);
504
505	/* Read the optional header and section table. */
506	uint32_t const cbHdrs = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
507	+ puBuf->Nt32.FileHeader.SizeOfOptionalHeader
508	+ puBuf->Nt32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
509	AssertReturn(cbHdrs <= sizeof(*puBuf), RTERRINFO_LOG_SET_F(pErrInfo, VERR_INTERNAL_ERROR_2, "cbHdrs=%#x", cbHdrs));
510
511	DBGFADDRESS PeHdrPart2Addr = *pImageAddr;
512	DBGFR3AddrAdd(&PeHdrPart2Addr, offPeHdrs + cbPeHdrsPart1);
513	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrPart2Addr, &puBuf->ab[cbPeHdrsPart1], cbHdrs - cbPeHdrsPart1);
514	if (RT_FAILURE(rc))
515	return RTERRINFO_LOG_SET_F(pErrInfo, rc,
516	"Failed to read the second part of the PE headers at %RGv (off=%#RX32 + %#RX32): %Rrc",
517	PeHdrPart2Addr.FlatPtr, offPeHdrs, cbPeHdrsPart1, rc);
518
519	/*
520	* Check the image architecture and determine the bitness.
521	*/
522	RTLDRARCH enmArchActual;
523	bool f32Bit;
524	switch (puBuf->Nt32.FileHeader.Machine)
525	{
526	case IMAGE_FILE_MACHINE_I386:
527	enmArchActual = RTLDRARCH_X86_32;
528	f32Bit = true;
529	break;
530	case IMAGE_FILE_MACHINE_AMD64:
531	enmArchActual = RTLDRARCH_AMD64;
532	f32Bit = false;
533	break;
534	case IMAGE_FILE_MACHINE_ARM:
535	case IMAGE_FILE_MACHINE_THUMB:
536	case IMAGE_FILE_MACHINE_ARMNT:
537	enmArchActual = RTLDRARCH_ARM32;
538	f32Bit = true;
539	break;
540	case IMAGE_FILE_MACHINE_ARM64:
541	enmArchActual = RTLDRARCH_ARM64;
542	f32Bit = false;
543	break;
544	default:
545	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unknown machine: %#x", puBuf->Nt32.FileHeader.Machine);
546	}
547	if ( enmArch != RTLDRARCH_WHATEVER
548	&& enmArch != enmArchActual)
549	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Found %s expected %s",
550	RTLdrArchName(enmArchActual), RTLdrArchName(enmArch));
551
552	/*
553	* Check optional header magic and size.
554	*/
555	uint16_t const uOptMagic = f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC;
556	if (puBuf->Nt32.OptionalHeader.Magic != uOptMagic)
557	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header magic: %#x (expected %#x)",
558	puBuf->Nt32.OptionalHeader.Magic, uOptMagic);
559
560	uint32_t const cDataDir = f32Bit ? puBuf->Nt32.OptionalHeader.NumberOfRvaAndSizes : puBuf->Nt64.OptionalHeader.NumberOfRvaAndSizes;
561	if ( cDataDir <= IMAGE_DIRECTORY_ENTRY_BASERELOC /* a bit random */
562	\|\| cDataDir > 32 /* also random */)
563	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected data directory size: %#x", cDataDir);
564
565	uint32_t cbOptHdr = f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64);
566	cbOptHdr -= sizeof(IMAGE_DATA_DIRECTORY) * IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
567	cbOptHdr += sizeof(IMAGE_DATA_DIRECTORY) * cDataDir;
568	if (puBuf->Nt32.FileHeader.SizeOfOptionalHeader != cbOptHdr)
569	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header size: %#x (expected %#x)",
570	puBuf->Nt32.FileHeader.SizeOfOptionalHeader, cbOptHdr);
571
572	uint32_t const cbSectAlign = f32Bit ? puBuf->Nt32.OptionalHeader.SectionAlignment : puBuf->Nt64.OptionalHeader.SectionAlignment;
573	PCIMAGE_SECTION_HEADER pSHdrs = (PCIMAGE_SECTION_HEADER)((uintptr_t)&puBuf->Nt32.OptionalHeader + cbOptHdr);
574	PCIMAGE_DATA_DIRECTORY paDataDir = (PCIMAGE_DATA_DIRECTORY)((uintptr_t)pSHdrs - cDataDir * sizeof(IMAGE_DATA_DIRECTORY));
575
576	/*
577	* Establish the image size.
578	*/
579	uint32_t cbImageFromHdr = f32Bit ? puBuf->Nt32.OptionalHeader.SizeOfImage : puBuf->Nt64.OptionalHeader.SizeOfImage;
580	if ( !cbImage
581	\|\| (fFlags & DBGFMODINMEM_F_PE_NT31))
582	cbImage = RT_ALIGN(cbImageFromHdr, _4K);
583	else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
584	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_MISMATCH, "Image size mismatch: input=%#x header=%#x", cbImage, cbImageFromHdr);
585
586	/*
587	* Guess the module name if not specified and make sure it conforms to DBGC expectations.
588	*/
589	if (!pszName)
590	{
591	if (pszFilename)
592	pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
593	/** @todo */
594	}
595
596	char szNormalized[128];
597	pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
598
599	/*
600	* Create the module using the in memory image first, falling back on cached image.
601	*/
602	RTLDRMOD hLdrMod;
603	rc = dbgfR3ModInMemPeCreateLdrMod(pUVM, fFlags, pszName, pImageAddr, cbImage, cbImageFromHdr, f32Bit,
604	puBuf->Nt32.FileHeader.NumberOfSections, pSHdrs, cbSectAlign, cDataDir, paDataDir,
605	offPeHdrs, &hLdrMod, pErrInfo);
606	if (RT_FAILURE(rc))
607	hLdrMod = NIL_RTLDRMOD;
608
609	RTDBGMOD hMod;
610	rc = RTDbgModCreateFromPeImage(&hMod, pszFilename, pszName, &hLdrMod, cbImageFromHdr,
611	puBuf->Nt32.FileHeader.TimeDateStamp, DBGFR3AsGetConfig(pUVM));
612	if (RT_SUCCESS(rc))
613	*phDbgMod = hMod;
614	else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
615	{
616	/*
617	* Fallback is a container module.
618	*/
619	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
620	if (RT_SUCCESS(rc))
621	{
622	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
623	AssertRC(rc);
624	}
625	}
626	return rc;
627	}
628
629
630
631	/**
632	* Process a PE image found in guest memory.
633	*
634	* @param pUVM The user mode VM handle.
635	* @param pImageAddr The image address.
636	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
637	* @param pszName The module name, optional.
638	* @param pszFilename The image filename, optional.
639	* @param enmArch The image arch if we force it, pass
640	* RTLDRARCH_WHATEVER if you don't care.
641	* @param cbImage Image size. Pass 0 if not known.
642	* @param phDbgMod Where to return the resulting debug module on success.
643	* @param pErrInfo Where to return extended error info on failure.
644	*/
645	VMMR3DECL(int) DBGFR3ModInMem(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
646	RTLDRARCH enmArch, uint32_t cbImage, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
647	{
648	/*
649	* Validate and adjust.
650	*/
651	AssertPtrReturn(phDbgMod, VERR_INVALID_POINTER);
652	*phDbgMod = NIL_RTDBGMOD;
653	AssertPtrReturn(pImageAddr, VERR_INVALID_POINTER);
654	AssertMsgReturn(cbImage == 0 \|\| cbImage >= sizeof(IMAGE_NT_HEADERS32) + sizeof(IMAGE_DOS_HEADER),
655	("cbImage=%#x\n", cbImage), VERR_INVALID_PARAMETER);
656	AssertMsgReturn(!(fFlags & ~DBGFMODINMEM_F_VALID_MASK), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
657	if (enmArch == RTLDRARCH_HOST)
658	enmArch = RTLdrGetHostArch();
659
660	/*
661	* Look for an image header we can work with.
662	*/
663	DBGFMODINMEMBUF uBuf;
664	RT_ZERO(uBuf);
665
666	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, pImageAddr, &uBuf, sizeof(uBuf.DosHdr));
667	if (RT_FAILURE(rc))
668	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read DOS header at %RGv: %Rrc", pImageAddr->FlatPtr, rc);
669
670	if (uBuf.ab[0] == ELFMAG0 && uBuf.ab[1] == ELFMAG1 && uBuf.ab[2] == ELFMAG2 && uBuf.ab[3] == ELFMAG3)
671	return dbgfR3ModInMemElf(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
672
673	uint32_t offNewHdrs;
674	if (uBuf.DosHdr.e_magic == IMAGE_DOS_SIGNATURE)
675	{
676	offNewHdrs = uBuf.DosHdr.e_lfanew;
677	if ( offNewHdrs < 16
678	\|\| offNewHdrs > (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)))
679	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "e_lfanew value is out of range: %RX32 (16..%u)",
680	offNewHdrs, (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)));
681	}
682	else if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
683	offNewHdrs = 0;
684	else
685	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Unknown image magic at %RGv: %.8Rhxs",
686	pImageAddr->FlatPtr, uBuf.ab);
687
688	/*
689	* Read the next bit of header, assuming PE so stop at the end of
690	* the COFF file header.
691	*/
692	DBGFADDRESS PeHdrAddr = *pImageAddr;
693	DBGFR3AddrAdd(&PeHdrAddr, offNewHdrs);
694	uint32_t const cbPeHdrsPart1 = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader);
695	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrAddr, &uBuf, cbPeHdrsPart1);
696	if (RT_FAILURE(rc))
697	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read PE/LX/NE headers at %RGv (off=%#RX32): %Rrc",
698	PeHdrAddr.FlatPtr, offNewHdrs, rc);
699
700	if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
701	return dbgfR3ModInMemPe(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, offNewHdrs, cbPeHdrsPart1,
702	&uBuf, phDbgMod, pErrInfo);
703
704	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "No PE/LX/NE header at %RGv (off=%#RX32): %.8Rhxs",
705	PeHdrAddr.FlatPtr, offNewHdrs, uBuf.ab);
706	}
707

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3ModInMem.cpp@ 75142

Download in other formats: