DBGFR3ModInMem.cpp@ 85416

Last change on this file since 85416 was 83085, checked in by vboxsync, 5 years ago
IPRT,VMM,DBGPlugInDarwin: Implemented in-memory guest kernel and kext image loading for OS X / Mach-O. Requires LINKEDIT to not be jettisoned to work.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 44.2 KB

Line
1	/* $Id: DBGFR3ModInMem.cpp 83085 2020-02-15 21:19:54Z vboxsync $ */
2	/** @file
3	* DBGFR3ModInMemPe - In memory PE module 'loader'.
4	*/
5
6	/*
7	* Copyright (C) 2009-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF
23	#include <VBox/vmm/dbgf.h>
24
25	#include <VBox/err.h>
26	#include <iprt/ctype.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/path.h>
30	#include <iprt/string.h>
31	#include <iprt/sort.h>
32	#include <iprt/formats/pecoff.h>
33	#include <iprt/formats/mz.h>
34	#include <iprt/formats/elf.h>
35	#include <iprt/formats/mach-o.h>
36
37
38	/*********************************************************************************************************************************
39	* Structures and Typedefs *
40	*********************************************************************************************************************************/
41	/** Entry for mapping file offset to memory location. */
42	typedef struct DBGFMODINMEMMAPPING
43	{
44	/** The file offset. */
45	uint32_t offFile;
46	/** The file size of this mapping. */
47	uint32_t cbFile;
48	/** The size of this mapping. */
49	uint32_t cbMem;
50	/** The offset to the memory from the start of the image.
51	* @note This can be negative (for mach_kernel). */
52	int32_t offMem;
53	} DBGFMODINMEMMAPPING;
54	typedef DBGFMODINMEMMAPPING *PDBGFMODINMEMMAPPING;
55	typedef DBGFMODINMEMMAPPING const *PCDBGFMODINMEMMAPPING;
56
57	/**
58	* Common in-memory reader instance data.
59	*/
60	typedef struct DBGFMODINMEMRDR
61	{
62	/** The VM handle (referenced). */
63	PUVM pUVM;
64	/** The image base. */
65	DBGFADDRESS ImageAddr;
66	/** The file size, based on the offFile and cbFile of the last mapping. */
67	uint32_t cbFile;
68	/** Number of entries in the aMappings table. */
69	uint32_t cMappings;
70	/** Mapping hint. */
71	uint32_t iHint;
72	/** Mapping file offset to memory offsets, ordered by file offset. */
73	DBGFMODINMEMMAPPING aMappings[RT_FLEXIBLE_ARRAY_NESTED];
74	} DBGFMODINMEMRDR;
75	/** Pointer to the common instance data for an in-memory file reader. */
76	typedef DBGFMODINMEMRDR *PDBGFMODINMEMRDR;
77
78	/**
79	* The WinNT digger's loader reader instance data.
80	*/
81	typedef struct DBGFMODPERDR
82	{
83	/** The VM handle (referenced). */
84	PUVM pUVM;
85	/** The image base. */
86	DBGFADDRESS ImageAddr;
87	/** The image size. */
88	uint32_t cbImage;
89	/** The file offset of the SizeOfImage field in the optional header if it
90	* needs patching, otherwise set to UINT32_MAX. */
91	uint32_t offSizeOfImage;
92	/** The correct image size. */
93	uint32_t cbCorrectImageSize;
94	/** Number of entries in the aMappings table. */
95	uint32_t cMappings;
96	/** Mapping hint. */
97	uint32_t iHint;
98	/** Mapping file offset to memory offsets, ordered by file offset. */
99	struct
100	{
101	/** The file offset. */
102	uint32_t offFile;
103	/** The size of this mapping. */
104	uint32_t cbMem;
105	/** The offset to the memory from the start of the image. */
106	uint32_t offMem;
107	} aMappings[1];
108	} DBGFMODPERDR;
109	/** Pointer a WinNT loader reader instance data. */
110	typedef DBGFMODPERDR *PDBGFMODPERDR;
111
112	/**
113	* Stack buffer.
114	*/
115	typedef union DBGFMODINMEMBUF
116	{
117	uint8_t ab[0x2000];
118	IMAGE_DOS_HEADER DosHdr;
119	IMAGE_NT_HEADERS32 Nt32;
120	IMAGE_NT_HEADERS64 Nt64;
121	mach_header_64 MachoHdr;
122	DBGFMODINMEMMAPPING aMappings[0x2000 / sizeof(DBGFMODINMEMMAPPING)];
123	} DBGFMODINMEMBUF;
124	/** Pointer to stack buffer. */
125	typedef DBGFMODINMEMBUF *PDBGFMODINMEMBUF;
126
127
128
129	/**
130	* Normalizes a debug module name.
131	*
132	* @returns Normalized debug module name.
133	* @param pszName The name.
134	* @param pszBuf Buffer to use if work is needed.
135	* @param cbBuf Size of buffer.
136	*/
137	const char dbgfR3ModNormalizeName(const char pszName, char *pszBuf, size_t cbBuf)
138	{
139	/*
140	* Skip to the filename in case someone gave us a full filename path.
141	*/
142	pszName = RTPathFilenameEx(pszName, RTPATH_STR_F_STYLE_DOS);
143
144	/*
145	* Is it okay?
146	*/
147	size_t cchName = strlen(pszName);
148	size_t off = 0;
149	for (;; off++)
150	{
151	char ch = pszName[off];
152	if (ch == '\0')
153	return pszName;
154	if (!RT_C_IS_ALNUM(ch) && ch != '_')
155	break;
156	}
157
158	/*
159	* It's no okay, so morph it.
160	*/
161	if (cchName >= cbBuf)
162	cchName = cbBuf - 1;
163	for (off = 0; off < cchName; off++)
164	{
165	char ch = pszName[off];
166	if (!RT_C_IS_ALNUM(ch))
167	ch = '_';
168	pszBuf[off] = ch;
169	}
170	pszBuf[off] = '\0';
171
172	return pszBuf;
173	}
174
175
176	/**
177	* @callback_method_impl{PFNRTLDRRDRMEMREAD}
178	*/
179	static DECLCALLBACK(int) dbgfModInMemCommon_Read(void pvBuf, size_t cb, size_t off, void pvUser)
180	{
181	PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
182	uint32_t offFile = (uint32_t)off;
183	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
184
185	/*
186	* Set i to a mapping that starts at or before the specified offset.
187	* ASSUMING aMappings are sorted by offFile.
188	*/
189	uint32_t i = pThis->iHint;
190	if (pThis->aMappings[i].offFile > offFile)
191	{
192	i = pThis->cMappings; /** @todo doesn't need to start from the end here... */
193	while (i-- > 0)
194	if (offFile >= pThis->aMappings[i].offFile)
195	break;
196	pThis->iHint = i;
197	}
198
199	while (cb > 0)
200	{
201	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile
202	: pThis->aMappings[i].offFile + RT_MAX(pThis->aMappings[i].cbFile, pThis->aMappings[i].cbMem);
203	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
204
205	/* Read file bits backed by memory. */
206	if (offMap < pThis->aMappings[i].cbMem)
207	{
208	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
209	if (cbToRead > cb)
210	cbToRead = (uint32_t)cb;
211
212	DBGFADDRESS Addr = pThis->ImageAddr;
213	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
214
215	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
216	if (RT_FAILURE(rc))
217	return rc;
218
219	/* Done? */
220	if (cbToRead == cb)
221	break;
222
223	offFile += cbToRead;
224	cb -= cbToRead;
225	pvBuf = (char *)pvBuf + cbToRead;
226	}
227
228	/* Mind the gap. */
229	if (offNextMap > offFile)
230	{
231	uint32_t cbZero = offNextMap - offFile;
232	if (cbZero > cb)
233	{
234	RT_BZERO(pvBuf, cb);
235	break;
236	}
237
238	RT_BZERO(pvBuf, cbZero);
239	offFile += cbZero;
240	cb -= cbZero;
241	pvBuf = (char *)pvBuf + cbZero;
242	}
243
244	pThis->iHint = ++i;
245	}
246
247	return VINF_SUCCESS;
248	}
249
250
251	/**
252	* @callback_method_impl{PFNRTLDRRDRMEMDTOR}
253	*/
254	static DECLCALLBACK(void) dbgfModInMemCommon_Dtor(void *pvUser, size_t cbImage)
255	{
256	PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
257	RT_NOREF(cbImage);
258
259	VMR3ReleaseUVM(pThis->pUVM);
260	pThis->pUVM = NULL;
261
262	RTMemFree(pThis);
263	}
264
265
266	/**
267	* @callback_method_impl{FNRTSORTCMP}
268	*/
269	static DECLCALLBACK(int) dbgfModInMemCompMappings(void const pvElement1, void const pvElement2, void *pvUser)
270	{
271	RT_NOREF(pvUser);
272	PCDBGFMODINMEMMAPPING pElement1 = (PCDBGFMODINMEMMAPPING)pvElement1;
273	PCDBGFMODINMEMMAPPING pElement2 = (PCDBGFMODINMEMMAPPING)pvElement2;
274	if (pElement1->offFile < pElement2->offFile)
275	return -1;
276	if (pElement1->offFile > pElement2->offFile)
277	return 1;
278	if (pElement1->cbFile < pElement2->cbFile)
279	return -1;
280	if (pElement1->cbFile > pElement2->cbFile)
281	return 1;
282	if (pElement1->offMem < pElement2->offMem)
283	return -1;
284	if (pElement1->offMem > pElement2->offMem)
285	return 1;
286	if (pElement1->cbMem < pElement2->cbMem)
287	return -1;
288	if (pElement1->cbMem > pElement2->cbMem)
289	return 1;
290	return 0;
291	}
292
293
294	static int dbgfModInMemCommon_Init(PDBGFMODINMEMRDR pThis, PUVM pUVM, PCDBGFADDRESS pImageAddr,PCDBGFMODINMEMMAPPING paMappings,
295	uint32_t cMappings, const char *pszName, RTLDRARCH enmArch,
296	PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
297	{
298	/*
299	* Initialize the reader instance.
300	*/
301	VMR3RetainUVM(pUVM);
302	pThis->pUVM = pUVM;
303	pThis->ImageAddr = *pImageAddr;
304	pThis->cMappings = cMappings;
305	pThis->iHint = 0;
306	memcpy(pThis->aMappings, paMappings, cMappings * sizeof(pThis->aMappings[0]));
307	RTSortShell(pThis->aMappings, cMappings, sizeof(pThis->aMappings[0]), dbgfModInMemCompMappings, NULL);
308	pThis->cbFile = pThis->aMappings[cMappings - 1].offFile + pThis->aMappings[cMappings - 1].cbFile;
309
310	/*
311	* Call the loader to open it.
312	* Note! destructore is always called.
313	*/
314
315	RTLDRMOD hLdrMod;
316	int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, enmArch, pThis->cbFile,
317	dbgfModInMemCommon_Read, dbgfModInMemCommon_Dtor, pThis,
318	&hLdrMod, pErrInfo);
319	if (RT_SUCCESS(rc))
320	*phLdrMod = hLdrMod;
321	else
322	*phLdrMod = NIL_RTLDRMOD;
323	return rc;
324	}
325
326
327	/**
328	* Handles in-memory ELF images.
329	*
330	* @returns VBox status code.
331	* @param pUVM The user mode VM handle.
332	* @param pImageAddr The image address.
333	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
334	* @param pszName The module name, optional.
335	* @param pszFilename The image filename, optional.
336	* @param enmArch The image arch if we force it, pass
337	* RTLDRARCH_WHATEVER if you don't care.
338	* @param cbImage Image size. Pass 0 if not known.
339	* @param puBuf The header buffer.
340	* @param phDbgMod Where to return the resulting debug module on success.
341	* @param pErrInfo Where to return extended error info on failure.
342	*/
343	static int dbgfR3ModInMemElf(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
344	RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
345	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
346	{
347	RT_NOREF(pUVM, fFlags, pszName, pszFilename, enmArch, cbImage, puBuf, phDbgMod);
348	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Found ELF magic at %RGv", pImageAddr->FlatPtr);
349	}
350
351
352	/**
353	* Handles in-memory Mach-O images.
354	*
355	* @returns VBox status code.
356	* @param pUVM The user mode VM handle.
357	* @param pImageAddr The image address.
358	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
359	* @param pszName The module name, optional.
360	* @param pszFilename The image filename, optional.
361	* @param enmArch The image arch if we force it, pass
362	* RTLDRARCH_WHATEVER if you don't care.
363	* @param cbImage Image size. Pass 0 if not known.
364	* @param puBuf The header buffer.
365	* @param phDbgMod Where to return the resulting debug module on success.
366	* @param pErrInfo Where to return extended error info on failure.
367	*/
368	static int dbgfR3ModInMemMachO(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
369	RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
370	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
371	{
372	RT_NOREF(cbImage, fFlags);
373
374	/*
375	* Match up enmArch.
376	*/
377	if (enmArch == RTLDRARCH_AMD64)
378	{
379	if (puBuf->MachoHdr.magic != IMAGE_MACHO64_SIGNATURE)
380	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but header is not 64-bit");
381	if (puBuf->MachoHdr.cputype != CPU_TYPE_X86_64)
382	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but cpu type is %#x instead of %#x",
383	puBuf->MachoHdr.cputype, CPU_TYPE_X86_64);
384	}
385	else if (enmArch == RTLDRARCH_X86_32)
386	{
387	if (puBuf->MachoHdr.magic != IMAGE_MACHO32_SIGNATURE)
388	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but header is not 32-bit");
389	if (puBuf->MachoHdr.cputype != CPU_TYPE_X86)
390	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but cpu type is %#x instead of %#x",
391	puBuf->MachoHdr.cputype, CPU_TYPE_X86);
392	}
393	else if (enmArch != RTLDRARCH_WHATEVER)
394	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unsupported enmArch value %s (%d)",
395	RTLdrArchName(enmArch), enmArch);
396
397	/*
398	* Guess the module name if not specified and make sure it conforms to DBGC expectations.
399	*/
400	char szNormalized[128];
401	if (!pszName)
402	{
403	if (pszFilename)
404	pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS /whatever/);
405	if (!pszName)
406	{
407	RTStrPrintf(szNormalized, sizeof(szNormalized), "image_%#llx", (uint64_t)pImageAddr->FlatPtr);
408	pszName = szNormalized;
409	}
410	}
411	if (pszName != szNormalized)
412	pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
413
414	/*
415	* Read the load commands into memory, they follow the header. Refuse
416	* if there appear to be too many or too much of these.
417	*/
418	uint32_t const cLoadCmds = puBuf->MachoHdr.ncmds;
419	uint32_t const cbLoadCmds = puBuf->MachoHdr.sizeofcmds;
420	if (cLoadCmds > _8K \|\| cLoadCmds < 2)
421	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
422	"ncmds=%u is out of sensible range (2..8192)", cLoadCmds);
423	if (cbLoadCmds > _2M \|\| cbLoadCmds < sizeof(load_command_t) * 2)
424	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
425	"cbLoadCmds=%#x is out of sensible range (8..2MiB)", cbLoadCmds);
426
427	uint8_t pbLoadCmds = (uint8_t )RTMemTmpAllocZ(cbLoadCmds);
428	AssertReturn(pbLoadCmds, VERR_NO_TMP_MEMORY);
429
430	uint32_t const cbHdr = puBuf->MachoHdr.magic == IMAGE_MACHO64_SIGNATURE ? sizeof(mach_header_64) : sizeof(mach_header_32);
431	DBGFADDRESS Addr = *pImageAddr;
432	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrAdd(&Addr, cbHdr), pbLoadCmds, cbLoadCmds);
433	if (RT_SUCCESS(rc))
434	{
435	/*
436	* Scan it for segments so we can tranlate file offsets to virtual
437	* memory locations.
438	*/
439	RTUUID Uuid = RTUUID_INITIALIZE_NULL;
440	uint32_t cMappings = 0;
441	uint32_t offCmd = 0;
442	for (uint32_t iCmd = 0; iCmd < cLoadCmds; iCmd++)
443	{
444	load_command_t const pCurCmd = (load_command_t const )&pbLoadCmds[offCmd];
445	uint32_t const cbCurCmd = offCmd + sizeof(pCurCmd) <= cbLoadCmds ? pCurCmd->cmdsize : sizeof(pCurCmd);
446	if (offCmd + cbCurCmd > cbLoadCmds)
447	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
448	"Load command #%u @ %#x is out of bounds: size %#x, left %#x", iCmd, offCmd, cbCurCmd,
449	cbLoadCmds - offCmd);
450	else if (pCurCmd->cmd == LC_SEGMENT_64)
451	{
452	segment_command_64 const pSeg = (segment_command_64 const )pCurCmd;
453	if (cbCurCmd >= sizeof(*pSeg))
454	{
455	if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
456	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
457	else
458	{
459	puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
460	puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
461	puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
462	puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
463	cMappings++;
464	}
465	}
466	else
467	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
468	"Load command #%u @ %#x is too small for a 64-bit segment: %#x", iCmd, offCmd, cbCurCmd);
469	}
470	else if (pCurCmd->cmd == LC_SEGMENT_32)
471	{
472	segment_command_32 const pSeg = (segment_command_32 const )pCurCmd;
473	if (cbCurCmd >= sizeof(*pSeg))
474	{
475	if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
476	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
477	else
478	{
479	puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
480	puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
481	puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
482	puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
483	cMappings++;
484	}
485	}
486	else
487	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
488	"Load command #%u @ %#x is too small for a 32-bit segment: %#x", iCmd, offCmd, cbCurCmd);
489	}
490	else if (pCurCmd->cmd == LC_UUID && cbCurCmd == sizeof(uuid_command_t))
491	memcpy(&Uuid, ((uuid_command_t const *)pCurCmd)->uuid, sizeof(Uuid));
492
493	if (RT_SUCCESS(rc))
494	offCmd += cbCurCmd;
495	else
496	break;
497	} /* for each command */
498
499	if (RT_SUCCESS(rc))
500	{
501	/*
502	* Create generic loader module instance (pThis is tied to it
503	* come rain come shine).
504	*/
505	PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)RTMemAllocZVar(RT_UOFFSETOF_DYN(DBGFMODINMEMRDR, aMappings[cMappings]));
506	if (pThis)
507	{
508	RTLDRMOD hLdrMod;
509	rc = dbgfModInMemCommon_Init(pThis, pUVM, pImageAddr, puBuf->aMappings, cMappings,
510	pszName, enmArch, &hLdrMod, pErrInfo);
511	if (RT_FAILURE(rc))
512	hLdrMod = NIL_RTLDRMOD;
513
514	RTDBGMOD hMod;
515	rc = RTDbgModCreateFromMachOImage(&hMod, pszFilename ? pszFilename : pszName, pszName, enmArch,
516	&hLdrMod, 0 /cbImage/, 0, NULL, &Uuid, DBGFR3AsGetConfig(pUVM), fFlags);
517	if (RT_SUCCESS(rc))
518	*phDbgMod = hMod;
519	#if 0 /** @todo later */
520	else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
521	{
522	/*
523	* Fallback is a container module.
524	*/
525	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
526	if (RT_SUCCESS(rc))
527	{
528	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
529	AssertRC(rc);
530	}
531	}
532	#endif
533	if (hLdrMod != NIL_RTLDRMOD)
534	RTLdrClose(hLdrMod);
535	}
536	else
537	rc = VERR_NO_MEMORY;
538	}
539	}
540	else
541	RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read %#x bytes of load commands", cbLoadCmds);
542	RTMemTmpFree(pbLoadCmds);
543	return rc;
544	}
545
546
547	/**
548	* @callback_method_impl{PFNRTLDRRDRMEMREAD}
549	*/
550	static DECLCALLBACK(int) dbgfModInMemPeRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
551	{
552	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
553	uint32_t offFile = (uint32_t)off;
554	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
555
556	uint32_t i = pThis->iHint;
557	if (pThis->aMappings[i].offFile > offFile)
558	{
559	i = pThis->cMappings;
560	while (i-- > 0)
561	if (offFile >= pThis->aMappings[i].offFile)
562	break;
563	pThis->iHint = i;
564	}
565
566	while (cb > 0)
567	{
568	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
569	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
570
571	/* Read file bits backed by memory. */
572	if (offMap < pThis->aMappings[i].cbMem)
573	{
574	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
575	if (cbToRead > cb)
576	cbToRead = (uint32_t)cb;
577
578	DBGFADDRESS Addr = pThis->ImageAddr;
579	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
580
581	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
582	if (RT_FAILURE(rc))
583	return rc;
584
585	/* Apply SizeOfImage patch? */
586	if ( pThis->offSizeOfImage != UINT32_MAX
587	&& offFile < pThis->offSizeOfImage + 4
588	&& offFile + cbToRead > pThis->offSizeOfImage)
589	{
590	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
591	uint32_t cbPatch = sizeof(SizeOfImage);
592	int32_t offPatch = pThis->offSizeOfImage - offFile;
593	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
594	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
595	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
596	while (cbPatch-- > 0)
597	{
598	if (offPatch >= 0)
599	*pbPatch = (uint8_t)SizeOfImage;
600	offPatch++;
601	pbPatch++;
602	SizeOfImage >>= 8;
603	}
604	}
605
606	/* Done? */
607	if (cbToRead == cb)
608	break;
609
610	offFile += cbToRead;
611	cb -= cbToRead;
612	pvBuf = (char *)pvBuf + cbToRead;
613	}
614
615	/* Mind the gap. */
616	if (offNextMap > offFile)
617	{
618	uint32_t cbZero = offNextMap - offFile;
619	if (cbZero > cb)
620	{
621	RT_BZERO(pvBuf, cb);
622	break;
623	}
624
625	RT_BZERO(pvBuf, cbZero);
626	offFile += cbZero;
627	cb -= cbZero;
628	pvBuf = (char *)pvBuf + cbZero;
629	}
630
631	pThis->iHint = ++i;
632	}
633
634	return VINF_SUCCESS;
635	}
636
637
638	/**
639	* @callback_method_impl{PFNRTLDRRDRMEMDTOR}
640	*/
641	static DECLCALLBACK(void) dbgfModInMemPeRdr_Dtor(void *pvUser, size_t cbImage)
642	{
643	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
644	RT_NOREF(cbImage);
645
646	VMR3ReleaseUVM(pThis->pUVM);
647	pThis->pUVM = NULL;
648	RTMemFree(pvUser);
649	}
650
651
652	/**
653	* Checks if the section headers look okay.
654	*
655	* @returns VBox status code.
656	* @param paShdrs Pointer to the section headers.
657	* @param cShdrs Number of headers.
658	* @param cbImage The image size reported by NT.
659	* @param cbImageFromHdr The image size by the linker in the header.
660	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
661	* no resource directory.
662	* @param cbSectAlign The section alignment specified in the header.
663	* @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
664	* @param pcbImageCorrect The corrected image size. This is derived from
665	* cbImage and virtual range of the section tables.
666	*
667	* The problem is that NT may choose to drop the
668	* last pages in images it loads early, starting at
669	* the resource directory. These images will have
670	* a page aligned cbImage.
671	*
672	* @param pErrInfo Where to return more error details.
673	*/
674	static int dbgfR3ModPeCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShdrs, uint32_t cShdrs, uint32_t cbImage,
675	uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
676	bool fNt31, uint32_t *pcbImageCorrect, PRTERRINFO pErrInfo)
677	{
678	*pcbImageCorrect = cbImage;
679
680	for (uint32_t i = 0; i < cShdrs; i++)
681	{
682	if (!paShdrs[i].Name[0])
683	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Section header #%u has no name", i);
684
685	if (paShdrs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
686	continue;
687
688	/* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
689	/** @todo this isn't really perfect. cbImage is kind of wrong... */
690	uint32_t cbVirtual = paShdrs[i].Misc.VirtualSize;
691	if (cbVirtual == 0)
692	{
693	for (uint32_t j = i + 1; j < cShdrs; j++)
694	if ( !(paShdrs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
695	&& paShdrs[j].VirtualAddress > paShdrs[i].VirtualAddress)
696	{
697	cbVirtual = paShdrs[j].VirtualAddress - paShdrs[i].VirtualAddress;
698	break;
699	}
700	if (!cbVirtual)
701	{
702	if (paShdrs[i].VirtualAddress < cbImageFromHdr)
703	cbVirtual = cbImageFromHdr - paShdrs[i].VirtualAddress;
704	else if (paShdrs[i].SizeOfRawData > 0)
705	cbVirtual = RT_ALIGN(paShdrs[i].SizeOfRawData, _4K);
706	}
707	}
708
709	/* Check that sizes are within the same range and that both sizes and
710	addresses are within reasonable limits. */
711	if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShdrs[i].SizeOfRawData, _64K)
712	\|\| cbVirtual >= _1G
713	\|\| paShdrs[i].SizeOfRawData >= _1G)
714	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
715	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!",
716	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].SizeOfRawData);
717	uint32_t uRvaEnd = paShdrs[i].VirtualAddress + cbVirtual;
718	if (uRvaEnd >= _1G \|\| uRvaEnd < paShdrs[i].VirtualAddress)
719	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
720	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!",
721	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].VirtualAddress, uRvaEnd);
722
723	/* Check for images chopped off around '.rsrc'. */
724	if ( cbImage < uRvaEnd
725	&& uRvaEnd >= uRvaRsrc)
726	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
727
728	/* Check that the section is within the image. */
729	if (uRvaEnd > cbImage && fNt31)
730	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
731	"Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x",
732	i, paShdrs[i].VirtualAddress, uRvaEnd, cbImage);
733	}
734
735	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
736	*pcbImageCorrect = cbImage;
737	return VINF_SUCCESS;
738	}
739
740
741	/**
742	* Create a loader module for the in-guest-memory PE module.
743	*/
744	static int dbgfR3ModInMemPeCreateLdrMod(PUVM pUVM, uint32_t fFlags, const char *pszName, PCDBGFADDRESS pImageAddr,
745	uint32_t cbImage, uint32_t cbImageFromHdr, bool f32Bit,
746	uint32_t cShdrs, PCIMAGE_SECTION_HEADER paShdrs, uint32_t cbSectAlign,
747	uint32_t cDataDir, PCIMAGE_DATA_DIRECTORY paDataDir, uint32_t offHdrs,
748	PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
749	{
750	/*
751	* Allocate and create a reader instance.
752	*/
753	PDBGFMODPERDR pRdr = (PDBGFMODPERDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGFMODPERDR, aMappings[cShdrs + 2]));
754	if (!pRdr)
755	return VERR_NO_MEMORY;
756
757	VMR3RetainUVM(pUVM);
758	pRdr->pUVM = pUVM;
759	pRdr->ImageAddr = *pImageAddr;
760	pRdr->cbImage = cbImage;
761	pRdr->cbCorrectImageSize = cbImage;
762	pRdr->offSizeOfImage = UINT32_MAX;
763	pRdr->iHint = 0;
764
765	/*
766	* Use the section table to construct a more accurate view of the file/image.
767	*/
768	uint32_t uRvaRsrc = UINT32_MAX;
769	if ( cDataDir > IMAGE_DIRECTORY_ENTRY_RESOURCE
770	&& paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size > 0)
771	uRvaRsrc = paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
772
773	int rc = dbgfR3ModPeCheckSectHdrsAndImgSize(paShdrs, cShdrs, cbImage, cbImageFromHdr, uRvaRsrc, cbSectAlign,
774	RT_BOOL(fFlags & DBGFMODINMEM_F_PE_NT31), &pRdr->cbCorrectImageSize, pErrInfo);
775	if (RT_SUCCESS(rc))
776	{
777	pRdr->cMappings = 0;
778
779	for (uint32_t i = 0; i < cShdrs; i++)
780	if ( paShdrs[i].SizeOfRawData > 0
781	&& paShdrs[i].PointerToRawData > 0)
782	{
783	uint32_t j = 1;
784	if (!pRdr->cMappings)
785	pRdr->cMappings++;
786	else
787	{
788	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShdrs[i].PointerToRawData)
789	j++;
790	if (j < pRdr->cMappings)
791	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
792	}
793	pRdr->aMappings[j].offFile = paShdrs[i].PointerToRawData;
794	pRdr->aMappings[j].offMem = paShdrs[i].VirtualAddress;
795	pRdr->aMappings[j].cbMem = i + 1 < cShdrs
796	? paShdrs[i + 1].VirtualAddress - paShdrs[i].VirtualAddress
797	: paShdrs[i].Misc.VirtualSize;
798	if (j == pRdr->cMappings)
799	pRdr->cbImage = paShdrs[i].PointerToRawData + paShdrs[i].SizeOfRawData;
800	pRdr->cMappings++;
801	}
802
803	/* Insert the mapping of the headers that isn't covered by the section table. */
804	pRdr->aMappings[0].offFile = 0;
805	pRdr->aMappings[0].offMem = 0;
806	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
807
808	int j = pRdr->cMappings - 1;
809	while (j-- > 0)
810	{
811	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
812	if (pRdr->aMappings[j].cbMem > cbFile)
813	pRdr->aMappings[j].cbMem = cbFile;
814	}
815	}
816	else if (fFlags & DBGFMODINMEM_F_NO_READER_FALLBACK)
817	return rc;
818	else
819	{
820	/*
821	* Fallback, fake identity mapped file data.
822	*/
823	pRdr->cMappings = 1;
824	pRdr->aMappings[0].offFile = 0;
825	pRdr->aMappings[0].offMem = 0;
826	pRdr->aMappings[0].cbMem = pRdr->cbImage;
827	}
828
829	/* Enable the SizeOfImage patching if necessary. */
830	if (pRdr->cbCorrectImageSize != cbImage)
831	{
832	Log(("dbgfR3ModInMemPeCreateLdrMod: The image is really %#x bytes long, not %#x as mapped by NT!\n",
833	pRdr->cbCorrectImageSize, cbImage));
834	pRdr->offSizeOfImage = f32Bit
835	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
836	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
837	}
838
839	/*
840	* Call the loader to open the PE image for debugging.
841	* Note! It always calls pfnDtor.
842	*/
843	RTLDRMOD hLdrMod;
844	rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
845	dbgfModInMemPeRdr_Read, dbgfModInMemPeRdr_Dtor, pRdr,
846	&hLdrMod, pErrInfo);
847	if (RT_SUCCESS(rc))
848	*phLdrMod = hLdrMod;
849	else
850	*phLdrMod = NIL_RTLDRMOD;
851	return rc;
852	}
853
854
855	/**
856	* Handles in-memory PE images.
857	*
858	* @returns VBox status code.
859	* @param pUVM The user mode VM handle.
860	* @param pImageAddr The image address.
861	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
862	* @param pszName The module name, optional.
863	* @param pszFilename The image filename, optional.
864	* @param enmArch The image arch if we force it, pass
865	* RTLDRARCH_WHATEVER if you don't care.
866	* @param cbImage Image size. Pass 0 if not known.
867	* @param offPeHdrs Offset of the PE header.
868	* @param cbPeHdrsPart1 How read into uBuf at @a offPeHdrs.
869	* @param puBuf The header buffer.
870	* @param phDbgMod Where to return the resulting debug module on success.
871	* @param pErrInfo Where to return extended error info on failure.
872	*/
873	static int dbgfR3ModInMemPe(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
874	RTLDRARCH enmArch, uint32_t cbImage, uint32_t offPeHdrs, uint32_t cbPeHdrsPart1,
875	PDBGFMODINMEMBUF puBuf, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
876	{
877	/*
878	* Read the optional header and the section table after validating the
879	* info we need from the file header.
880	*/
881	/* Check the opt hdr size and number of sections as these are used to determine how much to read next. */
882	if ( puBuf->Nt32.FileHeader.SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER32)
883	\|\| puBuf->Nt32.FileHeader.SizeOfOptionalHeader > sizeof(IMAGE_OPTIONAL_HEADER64) + 128)
884	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Invalid SizeOfOptionalHeader value: %#RX32",
885	puBuf->Nt32.FileHeader.SizeOfOptionalHeader);
886
887	if ( puBuf->Nt32.FileHeader.NumberOfSections < 1
888	\|\| puBuf->Nt32.FileHeader.NumberOfSections > 190 /* what fits in our 8K buffer */)
889	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "NumberOfSections is out of range: %#RX32 (1..190)",
890	puBuf->Nt32.FileHeader.NumberOfSections);
891
892	/* Read the optional header and section table. */
893	uint32_t const cbHdrs = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
894	+ puBuf->Nt32.FileHeader.SizeOfOptionalHeader
895	+ puBuf->Nt32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
896	AssertReturn(cbHdrs <= sizeof(*puBuf), RTERRINFO_LOG_SET_F(pErrInfo, VERR_INTERNAL_ERROR_2, "cbHdrs=%#x", cbHdrs));
897
898	DBGFADDRESS PeHdrPart2Addr = *pImageAddr;
899	DBGFR3AddrAdd(&PeHdrPart2Addr, offPeHdrs + cbPeHdrsPart1);
900	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrPart2Addr, &puBuf->ab[cbPeHdrsPart1], cbHdrs - cbPeHdrsPart1);
901	if (RT_FAILURE(rc))
902	return RTERRINFO_LOG_SET_F(pErrInfo, rc,
903	"Failed to read the second part of the PE headers at %RGv (off=%#RX32 + %#RX32): %Rrc",
904	PeHdrPart2Addr.FlatPtr, offPeHdrs, cbPeHdrsPart1, rc);
905
906	/*
907	* Check the image architecture and determine the bitness.
908	*/
909	RTLDRARCH enmArchActual;
910	bool f32Bit;
911	switch (puBuf->Nt32.FileHeader.Machine)
912	{
913	case IMAGE_FILE_MACHINE_I386:
914	enmArchActual = RTLDRARCH_X86_32;
915	f32Bit = true;
916	break;
917	case IMAGE_FILE_MACHINE_AMD64:
918	enmArchActual = RTLDRARCH_AMD64;
919	f32Bit = false;
920	break;
921	case IMAGE_FILE_MACHINE_ARM:
922	case IMAGE_FILE_MACHINE_THUMB:
923	case IMAGE_FILE_MACHINE_ARMNT:
924	enmArchActual = RTLDRARCH_ARM32;
925	f32Bit = true;
926	break;
927	case IMAGE_FILE_MACHINE_ARM64:
928	enmArchActual = RTLDRARCH_ARM64;
929	f32Bit = false;
930	break;
931	default:
932	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unknown machine: %#x", puBuf->Nt32.FileHeader.Machine);
933	}
934	if ( enmArch != RTLDRARCH_WHATEVER
935	&& enmArch != enmArchActual)
936	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Found %s expected %s",
937	RTLdrArchName(enmArchActual), RTLdrArchName(enmArch));
938
939	/*
940	* Check optional header magic and size.
941	*/
942	uint16_t const uOptMagic = f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC;
943	if (puBuf->Nt32.OptionalHeader.Magic != uOptMagic)
944	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header magic: %#x (expected %#x)",
945	puBuf->Nt32.OptionalHeader.Magic, uOptMagic);
946
947	uint32_t const cDataDir = f32Bit ? puBuf->Nt32.OptionalHeader.NumberOfRvaAndSizes : puBuf->Nt64.OptionalHeader.NumberOfRvaAndSizes;
948	if ( cDataDir <= IMAGE_DIRECTORY_ENTRY_BASERELOC /* a bit random */
949	\|\| cDataDir > 32 /* also random */)
950	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected data directory size: %#x", cDataDir);
951
952	uint32_t cbOptHdr = f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64);
953	cbOptHdr -= sizeof(IMAGE_DATA_DIRECTORY) * IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
954	cbOptHdr += sizeof(IMAGE_DATA_DIRECTORY) * cDataDir;
955	if (puBuf->Nt32.FileHeader.SizeOfOptionalHeader != cbOptHdr)
956	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header size: %#x (expected %#x)",
957	puBuf->Nt32.FileHeader.SizeOfOptionalHeader, cbOptHdr);
958
959	uint32_t const cbSectAlign = f32Bit ? puBuf->Nt32.OptionalHeader.SectionAlignment : puBuf->Nt64.OptionalHeader.SectionAlignment;
960	PCIMAGE_SECTION_HEADER pSHdrs = (PCIMAGE_SECTION_HEADER)((uintptr_t)&puBuf->Nt32.OptionalHeader + cbOptHdr);
961	PCIMAGE_DATA_DIRECTORY paDataDir = (PCIMAGE_DATA_DIRECTORY)((uintptr_t)pSHdrs - cDataDir * sizeof(IMAGE_DATA_DIRECTORY));
962
963	/*
964	* Establish the image size.
965	*/
966	uint32_t cbImageFromHdr = f32Bit ? puBuf->Nt32.OptionalHeader.SizeOfImage : puBuf->Nt64.OptionalHeader.SizeOfImage;
967	if ( !cbImage
968	\|\| (fFlags & DBGFMODINMEM_F_PE_NT31))
969	cbImage = RT_ALIGN(cbImageFromHdr, _4K);
970	else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
971	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_MISMATCH, "Image size mismatch: input=%#x header=%#x", cbImage, cbImageFromHdr);
972
973	/*
974	* Guess the module name if not specified and make sure it conforms to DBGC expectations.
975	*/
976	if (!pszName)
977	{
978	if (pszFilename)
979	pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
980	/** @todo */
981	}
982
983	char szNormalized[128];
984	pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
985
986	/*
987	* Create the module using the in memory image first, falling back on cached image.
988	*/
989	RTLDRMOD hLdrMod;
990	rc = dbgfR3ModInMemPeCreateLdrMod(pUVM, fFlags, pszName, pImageAddr, cbImage, cbImageFromHdr, f32Bit,
991	puBuf->Nt32.FileHeader.NumberOfSections, pSHdrs, cbSectAlign, cDataDir, paDataDir,
992	offPeHdrs, &hLdrMod, pErrInfo);
993	if (RT_FAILURE(rc))
994	hLdrMod = NIL_RTLDRMOD;
995
996	RTDBGMOD hMod;
997	rc = RTDbgModCreateFromPeImage(&hMod, pszFilename, pszName, &hLdrMod, cbImageFromHdr,
998	puBuf->Nt32.FileHeader.TimeDateStamp, DBGFR3AsGetConfig(pUVM));
999	if (RT_SUCCESS(rc))
1000	*phDbgMod = hMod;
1001	else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
1002	{
1003	/*
1004	* Fallback is a container module.
1005	*/
1006	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
1007	if (RT_SUCCESS(rc))
1008	{
1009	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
1010	AssertRC(rc);
1011	}
1012	}
1013	return rc;
1014	}
1015
1016
1017
1018	/**
1019	* Process a PE image found in guest memory.
1020	*
1021	* @param pUVM The user mode VM handle.
1022	* @param pImageAddr The image address.
1023	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
1024	* @param pszName The module name, optional.
1025	* @param pszFilename The image filename, optional.
1026	* @param enmArch The image arch if we force it, pass
1027	* RTLDRARCH_WHATEVER if you don't care.
1028	* @param cbImage Image size. Pass 0 if not known.
1029	* @param phDbgMod Where to return the resulting debug module on success.
1030	* @param pErrInfo Where to return extended error info on failure.
1031	*/
1032	VMMR3DECL(int) DBGFR3ModInMem(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
1033	RTLDRARCH enmArch, uint32_t cbImage, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
1034	{
1035	/*
1036	* Validate and adjust.
1037	*/
1038	AssertPtrReturn(phDbgMod, VERR_INVALID_POINTER);
1039	*phDbgMod = NIL_RTDBGMOD;
1040	AssertPtrReturn(pImageAddr, VERR_INVALID_POINTER);
1041	AssertMsgReturn(cbImage == 0 \|\| cbImage >= sizeof(IMAGE_NT_HEADERS32) + sizeof(IMAGE_DOS_HEADER),
1042	("cbImage=%#x\n", cbImage), VERR_INVALID_PARAMETER);
1043	AssertMsgReturn(!(fFlags & ~DBGFMODINMEM_F_VALID_MASK), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
1044	if (enmArch == RTLDRARCH_HOST)
1045	enmArch = RTLdrGetHostArch();
1046
1047	/*
1048	* Look for an image header we can work with.
1049	*/
1050	DBGFMODINMEMBUF uBuf;
1051	RT_ZERO(uBuf);
1052
1053	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, pImageAddr, &uBuf, sizeof(uBuf.DosHdr));
1054	if (RT_FAILURE(rc))
1055	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read DOS header at %RGv: %Rrc", pImageAddr->FlatPtr, rc);
1056
1057	if (uBuf.ab[0] == ELFMAG0 && uBuf.ab[1] == ELFMAG1 && uBuf.ab[2] == ELFMAG2 && uBuf.ab[3] == ELFMAG3)
1058	return dbgfR3ModInMemElf(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
1059
1060	if ( uBuf.MachoHdr.magic == IMAGE_MACHO64_SIGNATURE
1061	\|\| uBuf.MachoHdr.magic == IMAGE_MACHO32_SIGNATURE)
1062	return dbgfR3ModInMemMachO(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
1063
1064	uint32_t offNewHdrs;
1065	if (uBuf.DosHdr.e_magic == IMAGE_DOS_SIGNATURE)
1066	{
1067	offNewHdrs = uBuf.DosHdr.e_lfanew;
1068	if ( offNewHdrs < 16
1069	\|\| offNewHdrs > (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)))
1070	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "e_lfanew value is out of range: %RX32 (16..%u)",
1071	offNewHdrs, (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)));
1072	}
1073	else if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
1074	offNewHdrs = 0;
1075	else
1076	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Unknown image magic at %RGv: %.8Rhxs",
1077	pImageAddr->FlatPtr, uBuf.ab);
1078
1079	/*
1080	* Read the next bit of header, assuming PE so stop at the end of
1081	* the COFF file header.
1082	*/
1083	DBGFADDRESS PeHdrAddr = *pImageAddr;
1084	DBGFR3AddrAdd(&PeHdrAddr, offNewHdrs);
1085	uint32_t const cbPeHdrsPart1 = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader);
1086	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrAddr, &uBuf, cbPeHdrsPart1);
1087	if (RT_FAILURE(rc))
1088	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read PE/LX/NE headers at %RGv (off=%#RX32): %Rrc",
1089	PeHdrAddr.FlatPtr, offNewHdrs, rc);
1090
1091	if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
1092	return dbgfR3ModInMemPe(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, offNewHdrs, cbPeHdrsPart1,
1093	&uBuf, phDbgMod, pErrInfo);
1094
1095	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "No PE/LX/NE header at %RGv (off=%#RX32): %.8Rhxs",
1096	PeHdrAddr.FlatPtr, offNewHdrs, uBuf.ab);
1097	}
1098

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3ModInMem.cpp@ 85416

Download in other formats: