DBGFR3ModInMem.cpp@ 92780

Last change on this file since 92780 was 85969, checked in by vboxsync, 4 years ago
VMM/DBGFR3ModInMem.cpp: Don't call RTDbgModCreateFromMachOImage unless we've got a loader handle, it'll just assert and return VERR_INVALID_PARAMETER.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 44.3 KB

Line
1	/* $Id: DBGFR3ModInMem.cpp 85969 2020-08-31 23:50:11Z vboxsync $ */
2	/** @file
3	* DBGFR3ModInMemPe - In memory PE module 'loader'.
4	*/
5
6	/*
7	* Copyright (C) 2009-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF
23	#include <VBox/vmm/dbgf.h>
24
25	#include <VBox/err.h>
26	#include <iprt/ctype.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/path.h>
30	#include <iprt/string.h>
31	#include <iprt/sort.h>
32	#include <iprt/formats/pecoff.h>
33	#include <iprt/formats/mz.h>
34	#include <iprt/formats/elf.h>
35	#include <iprt/formats/mach-o.h>
36
37
38	/*********************************************************************************************************************************
39	* Structures and Typedefs *
40	*********************************************************************************************************************************/
41	/** Entry for mapping file offset to memory location. */
42	typedef struct DBGFMODINMEMMAPPING
43	{
44	/** The file offset. */
45	uint32_t offFile;
46	/** The file size of this mapping. */
47	uint32_t cbFile;
48	/** The size of this mapping. */
49	uint32_t cbMem;
50	/** The offset to the memory from the start of the image.
51	* @note This can be negative (for mach_kernel). */
52	int32_t offMem;
53	} DBGFMODINMEMMAPPING;
54	typedef DBGFMODINMEMMAPPING *PDBGFMODINMEMMAPPING;
55	typedef DBGFMODINMEMMAPPING const *PCDBGFMODINMEMMAPPING;
56
57	/**
58	* Common in-memory reader instance data.
59	*/
60	typedef struct DBGFMODINMEMRDR
61	{
62	/** The VM handle (referenced). */
63	PUVM pUVM;
64	/** The image base. */
65	DBGFADDRESS ImageAddr;
66	/** The file size, based on the offFile and cbFile of the last mapping. */
67	uint32_t cbFile;
68	/** Number of entries in the aMappings table. */
69	uint32_t cMappings;
70	/** Mapping hint. */
71	uint32_t iHint;
72	/** Mapping file offset to memory offsets, ordered by file offset. */
73	DBGFMODINMEMMAPPING aMappings[RT_FLEXIBLE_ARRAY_NESTED];
74	} DBGFMODINMEMRDR;
75	/** Pointer to the common instance data for an in-memory file reader. */
76	typedef DBGFMODINMEMRDR *PDBGFMODINMEMRDR;
77
78	/**
79	* The WinNT digger's loader reader instance data.
80	*/
81	typedef struct DBGFMODPERDR
82	{
83	/** The VM handle (referenced). */
84	PUVM pUVM;
85	/** The image base. */
86	DBGFADDRESS ImageAddr;
87	/** The image size. */
88	uint32_t cbImage;
89	/** The file offset of the SizeOfImage field in the optional header if it
90	* needs patching, otherwise set to UINT32_MAX. */
91	uint32_t offSizeOfImage;
92	/** The correct image size. */
93	uint32_t cbCorrectImageSize;
94	/** Number of entries in the aMappings table. */
95	uint32_t cMappings;
96	/** Mapping hint. */
97	uint32_t iHint;
98	/** Mapping file offset to memory offsets, ordered by file offset. */
99	struct
100	{
101	/** The file offset. */
102	uint32_t offFile;
103	/** The size of this mapping. */
104	uint32_t cbMem;
105	/** The offset to the memory from the start of the image. */
106	uint32_t offMem;
107	} aMappings[1];
108	} DBGFMODPERDR;
109	/** Pointer a WinNT loader reader instance data. */
110	typedef DBGFMODPERDR *PDBGFMODPERDR;
111
112	/**
113	* Stack buffer.
114	*/
115	typedef union DBGFMODINMEMBUF
116	{
117	uint8_t ab[0x2000];
118	IMAGE_DOS_HEADER DosHdr;
119	IMAGE_NT_HEADERS32 Nt32;
120	IMAGE_NT_HEADERS64 Nt64;
121	mach_header_64 MachoHdr;
122	DBGFMODINMEMMAPPING aMappings[0x2000 / sizeof(DBGFMODINMEMMAPPING)];
123	} DBGFMODINMEMBUF;
124	/** Pointer to stack buffer. */
125	typedef DBGFMODINMEMBUF *PDBGFMODINMEMBUF;
126
127
128
129	/**
130	* Normalizes a debug module name.
131	*
132	* @returns Normalized debug module name.
133	* @param pszName The name.
134	* @param pszBuf Buffer to use if work is needed.
135	* @param cbBuf Size of buffer.
136	*/
137	const char dbgfR3ModNormalizeName(const char pszName, char *pszBuf, size_t cbBuf)
138	{
139	/*
140	* Skip to the filename in case someone gave us a full filename path.
141	*/
142	pszName = RTPathFilenameEx(pszName, RTPATH_STR_F_STYLE_DOS);
143
144	/*
145	* Is it okay?
146	*/
147	size_t cchName = strlen(pszName);
148	size_t off = 0;
149	for (;; off++)
150	{
151	char ch = pszName[off];
152	if (ch == '\0')
153	return pszName;
154	if (!RT_C_IS_ALNUM(ch) && ch != '_')
155	break;
156	}
157
158	/*
159	* It's no okay, so morph it.
160	*/
161	if (cchName >= cbBuf)
162	cchName = cbBuf - 1;
163	for (off = 0; off < cchName; off++)
164	{
165	char ch = pszName[off];
166	if (!RT_C_IS_ALNUM(ch))
167	ch = '_';
168	pszBuf[off] = ch;
169	}
170	pszBuf[off] = '\0';
171
172	return pszBuf;
173	}
174
175
176	/**
177	* @callback_method_impl{PFNRTLDRRDRMEMREAD}
178	*/
179	static DECLCALLBACK(int) dbgfModInMemCommon_Read(void pvBuf, size_t cb, size_t off, void pvUser)
180	{
181	PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
182	uint32_t offFile = (uint32_t)off;
183	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
184
185	/*
186	* Set i to a mapping that starts at or before the specified offset.
187	* ASSUMING aMappings are sorted by offFile.
188	*/
189	uint32_t i = pThis->iHint;
190	if (pThis->aMappings[i].offFile > offFile)
191	{
192	i = pThis->cMappings; /** @todo doesn't need to start from the end here... */
193	while (i-- > 0)
194	if (offFile >= pThis->aMappings[i].offFile)
195	break;
196	pThis->iHint = i;
197	}
198
199	while (cb > 0)
200	{
201	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile
202	: pThis->aMappings[i].offFile + RT_MAX(pThis->aMappings[i].cbFile, pThis->aMappings[i].cbMem);
203	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
204
205	/* Read file bits backed by memory. */
206	if (offMap < pThis->aMappings[i].cbMem)
207	{
208	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
209	if (cbToRead > cb)
210	cbToRead = (uint32_t)cb;
211
212	DBGFADDRESS Addr = pThis->ImageAddr;
213	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
214
215	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
216	if (RT_FAILURE(rc))
217	return rc;
218
219	/* Done? */
220	if (cbToRead == cb)
221	break;
222
223	offFile += cbToRead;
224	cb -= cbToRead;
225	pvBuf = (char *)pvBuf + cbToRead;
226	}
227
228	/* Mind the gap. */
229	if (offNextMap > offFile)
230	{
231	uint32_t cbZero = offNextMap - offFile;
232	if (cbZero > cb)
233	{
234	RT_BZERO(pvBuf, cb);
235	break;
236	}
237
238	RT_BZERO(pvBuf, cbZero);
239	offFile += cbZero;
240	cb -= cbZero;
241	pvBuf = (char *)pvBuf + cbZero;
242	}
243
244	pThis->iHint = ++i;
245	}
246
247	return VINF_SUCCESS;
248	}
249
250
251	/**
252	* @callback_method_impl{PFNRTLDRRDRMEMDTOR}
253	*/
254	static DECLCALLBACK(void) dbgfModInMemCommon_Dtor(void *pvUser, size_t cbImage)
255	{
256	PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)pvUser;
257	RT_NOREF(cbImage);
258
259	VMR3ReleaseUVM(pThis->pUVM);
260	pThis->pUVM = NULL;
261
262	RTMemFree(pThis);
263	}
264
265
266	/**
267	* @callback_method_impl{FNRTSORTCMP}
268	*/
269	static DECLCALLBACK(int) dbgfModInMemCompMappings(void const pvElement1, void const pvElement2, void *pvUser)
270	{
271	RT_NOREF(pvUser);
272	PCDBGFMODINMEMMAPPING pElement1 = (PCDBGFMODINMEMMAPPING)pvElement1;
273	PCDBGFMODINMEMMAPPING pElement2 = (PCDBGFMODINMEMMAPPING)pvElement2;
274	if (pElement1->offFile < pElement2->offFile)
275	return -1;
276	if (pElement1->offFile > pElement2->offFile)
277	return 1;
278	if (pElement1->cbFile < pElement2->cbFile)
279	return -1;
280	if (pElement1->cbFile > pElement2->cbFile)
281	return 1;
282	if (pElement1->offMem < pElement2->offMem)
283	return -1;
284	if (pElement1->offMem > pElement2->offMem)
285	return 1;
286	if (pElement1->cbMem < pElement2->cbMem)
287	return -1;
288	if (pElement1->cbMem > pElement2->cbMem)
289	return 1;
290	return 0;
291	}
292
293
294	static int dbgfModInMemCommon_Init(PDBGFMODINMEMRDR pThis, PUVM pUVM, PCDBGFADDRESS pImageAddr,PCDBGFMODINMEMMAPPING paMappings,
295	uint32_t cMappings, const char *pszName, RTLDRARCH enmArch,
296	PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
297	{
298	/*
299	* Initialize the reader instance.
300	*/
301	VMR3RetainUVM(pUVM);
302	pThis->pUVM = pUVM;
303	pThis->ImageAddr = *pImageAddr;
304	pThis->cMappings = cMappings;
305	pThis->iHint = 0;
306	memcpy(pThis->aMappings, paMappings, cMappings * sizeof(pThis->aMappings[0]));
307	RTSortShell(pThis->aMappings, cMappings, sizeof(pThis->aMappings[0]), dbgfModInMemCompMappings, NULL);
308	pThis->cbFile = pThis->aMappings[cMappings - 1].offFile + pThis->aMappings[cMappings - 1].cbFile;
309
310	/*
311	* Call the loader to open it.
312	* Note! destructore is always called.
313	*/
314
315	RTLDRMOD hLdrMod;
316	int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, enmArch, pThis->cbFile,
317	dbgfModInMemCommon_Read, dbgfModInMemCommon_Dtor, pThis,
318	&hLdrMod, pErrInfo);
319	if (RT_SUCCESS(rc))
320	*phLdrMod = hLdrMod;
321	else
322	*phLdrMod = NIL_RTLDRMOD;
323	return rc;
324	}
325
326
327	/**
328	* Handles in-memory ELF images.
329	*
330	* @returns VBox status code.
331	* @param pUVM The user mode VM handle.
332	* @param pImageAddr The image address.
333	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
334	* @param pszName The module name, optional.
335	* @param pszFilename The image filename, optional.
336	* @param enmArch The image arch if we force it, pass
337	* RTLDRARCH_WHATEVER if you don't care.
338	* @param cbImage Image size. Pass 0 if not known.
339	* @param puBuf The header buffer.
340	* @param phDbgMod Where to return the resulting debug module on success.
341	* @param pErrInfo Where to return extended error info on failure.
342	*/
343	static int dbgfR3ModInMemElf(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
344	RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
345	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
346	{
347	RT_NOREF(pUVM, fFlags, pszName, pszFilename, enmArch, cbImage, puBuf, phDbgMod);
348	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Found ELF magic at %RGv", pImageAddr->FlatPtr);
349	}
350
351
352	/**
353	* Handles in-memory Mach-O images.
354	*
355	* @returns VBox status code.
356	* @param pUVM The user mode VM handle.
357	* @param pImageAddr The image address.
358	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
359	* @param pszName The module name, optional.
360	* @param pszFilename The image filename, optional.
361	* @param enmArch The image arch if we force it, pass
362	* RTLDRARCH_WHATEVER if you don't care.
363	* @param cbImage Image size. Pass 0 if not known.
364	* @param puBuf The header buffer.
365	* @param phDbgMod Where to return the resulting debug module on success.
366	* @param pErrInfo Where to return extended error info on failure.
367	*/
368	static int dbgfR3ModInMemMachO(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
369	RTLDRARCH enmArch, uint32_t cbImage, PDBGFMODINMEMBUF puBuf,
370	PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
371	{
372	RT_NOREF(cbImage, fFlags);
373
374	/*
375	* Match up enmArch.
376	*/
377	if (enmArch == RTLDRARCH_AMD64)
378	{
379	if (puBuf->MachoHdr.magic != IMAGE_MACHO64_SIGNATURE)
380	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but header is not 64-bit");
381	if (puBuf->MachoHdr.cputype != CPU_TYPE_X86_64)
382	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted AMD64 but cpu type is %#x instead of %#x",
383	puBuf->MachoHdr.cputype, CPU_TYPE_X86_64);
384	}
385	else if (enmArch == RTLDRARCH_X86_32)
386	{
387	if (puBuf->MachoHdr.magic != IMAGE_MACHO32_SIGNATURE)
388	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but header is not 32-bit");
389	if (puBuf->MachoHdr.cputype != CPU_TYPE_X86)
390	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Wanted X86_32 but cpu type is %#x instead of %#x",
391	puBuf->MachoHdr.cputype, CPU_TYPE_X86);
392	}
393	else if (enmArch != RTLDRARCH_WHATEVER)
394	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unsupported enmArch value %s (%d)",
395	RTLdrArchName(enmArch), enmArch);
396
397	/*
398	* Guess the module name if not specified and make sure it conforms to DBGC expectations.
399	*/
400	char szNormalized[128];
401	if (!pszName)
402	{
403	if (pszFilename)
404	pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS /whatever/);
405	if (!pszName)
406	{
407	RTStrPrintf(szNormalized, sizeof(szNormalized), "image_%#llx", (uint64_t)pImageAddr->FlatPtr);
408	pszName = szNormalized;
409	}
410	}
411	if (pszName != szNormalized)
412	pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
413
414	/*
415	* Read the load commands into memory, they follow the header. Refuse
416	* if there appear to be too many or too much of these.
417	*/
418	uint32_t const cLoadCmds = puBuf->MachoHdr.ncmds;
419	uint32_t const cbLoadCmds = puBuf->MachoHdr.sizeofcmds;
420	if (cLoadCmds > _8K \|\| cLoadCmds < 2)
421	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
422	"ncmds=%u is out of sensible range (2..8192)", cLoadCmds);
423	if (cbLoadCmds > _2M \|\| cbLoadCmds < sizeof(load_command_t) * 2)
424	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_HEADER,
425	"cbLoadCmds=%#x is out of sensible range (8..2MiB)", cbLoadCmds);
426
427	uint8_t pbLoadCmds = (uint8_t )RTMemTmpAllocZ(cbLoadCmds);
428	AssertReturn(pbLoadCmds, VERR_NO_TMP_MEMORY);
429
430	uint32_t const cbHdr = puBuf->MachoHdr.magic == IMAGE_MACHO64_SIGNATURE ? sizeof(mach_header_64) : sizeof(mach_header_32);
431	DBGFADDRESS Addr = *pImageAddr;
432	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrAdd(&Addr, cbHdr), pbLoadCmds, cbLoadCmds);
433	if (RT_SUCCESS(rc))
434	{
435	/*
436	* Scan it for segments so we can tranlate file offsets to virtual
437	* memory locations.
438	*/
439	RTUUID Uuid = RTUUID_INITIALIZE_NULL;
440	uint32_t cMappings = 0;
441	uint32_t offCmd = 0;
442	for (uint32_t iCmd = 0; iCmd < cLoadCmds; iCmd++)
443	{
444	load_command_t const pCurCmd = (load_command_t const )&pbLoadCmds[offCmd];
445	uint32_t const cbCurCmd = offCmd + sizeof(pCurCmd) <= cbLoadCmds ? pCurCmd->cmdsize : sizeof(pCurCmd);
446	if (offCmd + cbCurCmd > cbLoadCmds)
447	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
448	"Load command #%u @ %#x is out of bounds: size %#x, left %#x", iCmd, offCmd, cbCurCmd,
449	cbLoadCmds - offCmd);
450	else if (pCurCmd->cmd == LC_SEGMENT_64)
451	{
452	segment_command_64 const pSeg = (segment_command_64 const )pCurCmd;
453	if (cbCurCmd >= sizeof(*pSeg))
454	{
455	if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
456	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
457	else
458	{
459	puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
460	puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
461	puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
462	puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
463	cMappings++;
464	}
465	}
466	else
467	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
468	"Load command #%u @ %#x is too small for a 64-bit segment: %#x", iCmd, offCmd, cbCurCmd);
469	}
470	else if (pCurCmd->cmd == LC_SEGMENT_32)
471	{
472	segment_command_32 const pSeg = (segment_command_32 const )pCurCmd;
473	if (cbCurCmd >= sizeof(*pSeg))
474	{
475	if (cMappings >= RT_ELEMENTS(puBuf->aMappings))
476	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_OUT_OF_RANGE, "Too many segments!");
477	else
478	{
479	puBuf->aMappings[cMappings].offFile = pSeg->fileoff;
480	puBuf->aMappings[cMappings].cbFile = pSeg->filesize;
481	puBuf->aMappings[cMappings].offMem = pSeg->vmaddr - pImageAddr->FlatPtr;
482	puBuf->aMappings[cMappings].cbMem = pSeg->vmsize;
483	cMappings++;
484	}
485	}
486	else
487	rc = RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDRMACHO_BAD_LOAD_COMMAND,
488	"Load command #%u @ %#x is too small for a 32-bit segment: %#x", iCmd, offCmd, cbCurCmd);
489	}
490	else if (pCurCmd->cmd == LC_UUID && cbCurCmd == sizeof(uuid_command_t))
491	memcpy(&Uuid, ((uuid_command_t const *)pCurCmd)->uuid, sizeof(Uuid));
492
493	if (RT_SUCCESS(rc))
494	offCmd += cbCurCmd;
495	else
496	break;
497	} /* for each command */
498
499	if (RT_SUCCESS(rc))
500	{
501	/*
502	* Create generic loader module instance (pThis is tied to it
503	* come rain come shine).
504	*/
505	PDBGFMODINMEMRDR pThis = (PDBGFMODINMEMRDR)RTMemAllocZVar(RT_UOFFSETOF_DYN(DBGFMODINMEMRDR, aMappings[cMappings]));
506	if (pThis)
507	{
508	RTLDRMOD hLdrMod;
509	rc = dbgfModInMemCommon_Init(pThis, pUVM, pImageAddr, puBuf->aMappings, cMappings,
510	pszName, enmArch, &hLdrMod, pErrInfo);
511	if (RT_SUCCESS(rc)) /* Don't bother if we don't have a handle. */
512	{
513	RTDBGMOD hMod;
514	rc = RTDbgModCreateFromMachOImage(&hMod, pszFilename ? pszFilename : pszName, pszName, enmArch,
515	&hLdrMod, 0 /cbImage/, 0, NULL, &Uuid, DBGFR3AsGetConfig(pUVM), fFlags);
516	if (RT_SUCCESS(rc))
517	*phDbgMod = hMod;
518	}
519	else
520	hLdrMod = NIL_RTLDRMOD;
521
522	#if 0 /** @todo later */
523	if (RT_FAILURE(rc) && !(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
524	{
525	/*
526	* Fallback is a container module.
527	*/
528	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
529	if (RT_SUCCESS(rc))
530	{
531	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
532	AssertRC(rc);
533	}
534	}
535	#endif
536	if (hLdrMod != NIL_RTLDRMOD)
537	RTLdrClose(hLdrMod);
538	}
539	else
540	rc = VERR_NO_MEMORY;
541	}
542	}
543	else
544	RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read %#x bytes of load commands", cbLoadCmds);
545	RTMemTmpFree(pbLoadCmds);
546	return rc;
547	}
548
549
550	/**
551	* @callback_method_impl{PFNRTLDRRDRMEMREAD}
552	*/
553	static DECLCALLBACK(int) dbgfModInMemPeRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
554	{
555	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
556	uint32_t offFile = (uint32_t)off;
557	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
558
559	uint32_t i = pThis->iHint;
560	if (pThis->aMappings[i].offFile > offFile)
561	{
562	i = pThis->cMappings;
563	while (i-- > 0)
564	if (offFile >= pThis->aMappings[i].offFile)
565	break;
566	pThis->iHint = i;
567	}
568
569	while (cb > 0)
570	{
571	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
572	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
573
574	/* Read file bits backed by memory. */
575	if (offMap < pThis->aMappings[i].cbMem)
576	{
577	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
578	if (cbToRead > cb)
579	cbToRead = (uint32_t)cb;
580
581	DBGFADDRESS Addr = pThis->ImageAddr;
582	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
583
584	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
585	if (RT_FAILURE(rc))
586	return rc;
587
588	/* Apply SizeOfImage patch? */
589	if ( pThis->offSizeOfImage != UINT32_MAX
590	&& offFile < pThis->offSizeOfImage + 4
591	&& offFile + cbToRead > pThis->offSizeOfImage)
592	{
593	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
594	uint32_t cbPatch = sizeof(SizeOfImage);
595	int32_t offPatch = pThis->offSizeOfImage - offFile;
596	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
597	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
598	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
599	while (cbPatch-- > 0)
600	{
601	if (offPatch >= 0)
602	*pbPatch = (uint8_t)SizeOfImage;
603	offPatch++;
604	pbPatch++;
605	SizeOfImage >>= 8;
606	}
607	}
608
609	/* Done? */
610	if (cbToRead == cb)
611	break;
612
613	offFile += cbToRead;
614	cb -= cbToRead;
615	pvBuf = (char *)pvBuf + cbToRead;
616	}
617
618	/* Mind the gap. */
619	if (offNextMap > offFile)
620	{
621	uint32_t cbZero = offNextMap - offFile;
622	if (cbZero > cb)
623	{
624	RT_BZERO(pvBuf, cb);
625	break;
626	}
627
628	RT_BZERO(pvBuf, cbZero);
629	offFile += cbZero;
630	cb -= cbZero;
631	pvBuf = (char *)pvBuf + cbZero;
632	}
633
634	pThis->iHint = ++i;
635	}
636
637	return VINF_SUCCESS;
638	}
639
640
641	/**
642	* @callback_method_impl{PFNRTLDRRDRMEMDTOR}
643	*/
644	static DECLCALLBACK(void) dbgfModInMemPeRdr_Dtor(void *pvUser, size_t cbImage)
645	{
646	PDBGFMODPERDR pThis = (PDBGFMODPERDR)pvUser;
647	RT_NOREF(cbImage);
648
649	VMR3ReleaseUVM(pThis->pUVM);
650	pThis->pUVM = NULL;
651	RTMemFree(pvUser);
652	}
653
654
655	/**
656	* Checks if the section headers look okay.
657	*
658	* @returns VBox status code.
659	* @param paShdrs Pointer to the section headers.
660	* @param cShdrs Number of headers.
661	* @param cbImage The image size reported by NT.
662	* @param cbImageFromHdr The image size by the linker in the header.
663	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
664	* no resource directory.
665	* @param cbSectAlign The section alignment specified in the header.
666	* @param fNt31 Set if NT 3.1. Needed for chopped off HAL.
667	* @param pcbImageCorrect The corrected image size. This is derived from
668	* cbImage and virtual range of the section tables.
669	*
670	* The problem is that NT may choose to drop the
671	* last pages in images it loads early, starting at
672	* the resource directory. These images will have
673	* a page aligned cbImage.
674	*
675	* @param pErrInfo Where to return more error details.
676	*/
677	static int dbgfR3ModPeCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShdrs, uint32_t cShdrs, uint32_t cbImage,
678	uint32_t cbImageFromHdr, uint32_t uRvaRsrc, uint32_t cbSectAlign,
679	bool fNt31, uint32_t *pcbImageCorrect, PRTERRINFO pErrInfo)
680	{
681	*pcbImageCorrect = cbImage;
682
683	for (uint32_t i = 0; i < cShdrs; i++)
684	{
685	if (!paShdrs[i].Name[0])
686	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Section header #%u has no name", i);
687
688	if (paShdrs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
689	continue;
690
691	/* Tweak to determine the virtual size if the linker didn't set it (NT 3.1). */
692	/** @todo this isn't really perfect. cbImage is kind of wrong... */
693	uint32_t cbVirtual = paShdrs[i].Misc.VirtualSize;
694	if (cbVirtual == 0)
695	{
696	for (uint32_t j = i + 1; j < cShdrs; j++)
697	if ( !(paShdrs[j].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
698	&& paShdrs[j].VirtualAddress > paShdrs[i].VirtualAddress)
699	{
700	cbVirtual = paShdrs[j].VirtualAddress - paShdrs[i].VirtualAddress;
701	break;
702	}
703	if (!cbVirtual)
704	{
705	if (paShdrs[i].VirtualAddress < cbImageFromHdr)
706	cbVirtual = cbImageFromHdr - paShdrs[i].VirtualAddress;
707	else if (paShdrs[i].SizeOfRawData > 0)
708	cbVirtual = RT_ALIGN(paShdrs[i].SizeOfRawData, _4K);
709	}
710	}
711
712	/* Check that sizes are within the same range and that both sizes and
713	addresses are within reasonable limits. */
714	if ( RT_ALIGN(cbVirtual, _64K) < RT_ALIGN(paShdrs[i].SizeOfRawData, _64K)
715	\|\| cbVirtual >= _1G
716	\|\| paShdrs[i].SizeOfRawData >= _1G)
717	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
718	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and SizeOfRawData=%#x, that's too much data!",
719	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].SizeOfRawData);
720	uint32_t uRvaEnd = paShdrs[i].VirtualAddress + cbVirtual;
721	if (uRvaEnd >= _1G \|\| uRvaEnd < paShdrs[i].VirtualAddress)
722	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
723	"Section header #%u (%.8s) has a VirtualSize=%#x (%#x) and VirtualAddr=%#x, %#x in total, that's too much!",
724	i, paShdrs[i].Name, cbVirtual, paShdrs[i].Misc.VirtualSize, paShdrs[i].VirtualAddress, uRvaEnd);
725
726	/* Check for images chopped off around '.rsrc'. */
727	if ( cbImage < uRvaEnd
728	&& uRvaEnd >= uRvaRsrc)
729	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
730
731	/* Check that the section is within the image. */
732	if (uRvaEnd > cbImage && fNt31)
733	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT,
734	"Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x",
735	i, paShdrs[i].VirtualAddress, uRvaEnd, cbImage);
736	}
737
738	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
739	*pcbImageCorrect = cbImage;
740	return VINF_SUCCESS;
741	}
742
743
744	/**
745	* Create a loader module for the in-guest-memory PE module.
746	*/
747	static int dbgfR3ModInMemPeCreateLdrMod(PUVM pUVM, uint32_t fFlags, const char *pszName, PCDBGFADDRESS pImageAddr,
748	uint32_t cbImage, uint32_t cbImageFromHdr, bool f32Bit,
749	uint32_t cShdrs, PCIMAGE_SECTION_HEADER paShdrs, uint32_t cbSectAlign,
750	uint32_t cDataDir, PCIMAGE_DATA_DIRECTORY paDataDir, uint32_t offHdrs,
751	PRTLDRMOD phLdrMod, PRTERRINFO pErrInfo)
752	{
753	/*
754	* Allocate and create a reader instance.
755	*/
756	PDBGFMODPERDR pRdr = (PDBGFMODPERDR)RTMemAlloc(RT_UOFFSETOF_DYN(DBGFMODPERDR, aMappings[cShdrs + 2]));
757	if (!pRdr)
758	return VERR_NO_MEMORY;
759
760	VMR3RetainUVM(pUVM);
761	pRdr->pUVM = pUVM;
762	pRdr->ImageAddr = *pImageAddr;
763	pRdr->cbImage = cbImage;
764	pRdr->cbCorrectImageSize = cbImage;
765	pRdr->offSizeOfImage = UINT32_MAX;
766	pRdr->iHint = 0;
767
768	/*
769	* Use the section table to construct a more accurate view of the file/image.
770	*/
771	uint32_t uRvaRsrc = UINT32_MAX;
772	if ( cDataDir > IMAGE_DIRECTORY_ENTRY_RESOURCE
773	&& paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size > 0)
774	uRvaRsrc = paDataDir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
775
776	int rc = dbgfR3ModPeCheckSectHdrsAndImgSize(paShdrs, cShdrs, cbImage, cbImageFromHdr, uRvaRsrc, cbSectAlign,
777	RT_BOOL(fFlags & DBGFMODINMEM_F_PE_NT31), &pRdr->cbCorrectImageSize, pErrInfo);
778	if (RT_SUCCESS(rc))
779	{
780	pRdr->cMappings = 0;
781
782	for (uint32_t i = 0; i < cShdrs; i++)
783	if ( paShdrs[i].SizeOfRawData > 0
784	&& paShdrs[i].PointerToRawData > 0)
785	{
786	uint32_t j = 1;
787	if (!pRdr->cMappings)
788	pRdr->cMappings++;
789	else
790	{
791	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShdrs[i].PointerToRawData)
792	j++;
793	if (j < pRdr->cMappings)
794	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
795	}
796	pRdr->aMappings[j].offFile = paShdrs[i].PointerToRawData;
797	pRdr->aMappings[j].offMem = paShdrs[i].VirtualAddress;
798	pRdr->aMappings[j].cbMem = i + 1 < cShdrs
799	? paShdrs[i + 1].VirtualAddress - paShdrs[i].VirtualAddress
800	: paShdrs[i].Misc.VirtualSize;
801	if (j == pRdr->cMappings)
802	pRdr->cbImage = paShdrs[i].PointerToRawData + paShdrs[i].SizeOfRawData;
803	pRdr->cMappings++;
804	}
805
806	/* Insert the mapping of the headers that isn't covered by the section table. */
807	pRdr->aMappings[0].offFile = 0;
808	pRdr->aMappings[0].offMem = 0;
809	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
810
811	int j = pRdr->cMappings - 1;
812	while (j-- > 0)
813	{
814	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
815	if (pRdr->aMappings[j].cbMem > cbFile)
816	pRdr->aMappings[j].cbMem = cbFile;
817	}
818	}
819	else if (fFlags & DBGFMODINMEM_F_NO_READER_FALLBACK)
820	return rc;
821	else
822	{
823	/*
824	* Fallback, fake identity mapped file data.
825	*/
826	pRdr->cMappings = 1;
827	pRdr->aMappings[0].offFile = 0;
828	pRdr->aMappings[0].offMem = 0;
829	pRdr->aMappings[0].cbMem = pRdr->cbImage;
830	}
831
832	/* Enable the SizeOfImage patching if necessary. */
833	if (pRdr->cbCorrectImageSize != cbImage)
834	{
835	Log(("dbgfR3ModInMemPeCreateLdrMod: The image is really %#x bytes long, not %#x as mapped by NT!\n",
836	pRdr->cbCorrectImageSize, cbImage));
837	pRdr->offSizeOfImage = f32Bit
838	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
839	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
840	}
841
842	/*
843	* Call the loader to open the PE image for debugging.
844	* Note! It always calls pfnDtor.
845	*/
846	RTLDRMOD hLdrMod;
847	rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
848	dbgfModInMemPeRdr_Read, dbgfModInMemPeRdr_Dtor, pRdr,
849	&hLdrMod, pErrInfo);
850	if (RT_SUCCESS(rc))
851	*phLdrMod = hLdrMod;
852	else
853	*phLdrMod = NIL_RTLDRMOD;
854	return rc;
855	}
856
857
858	/**
859	* Handles in-memory PE images.
860	*
861	* @returns VBox status code.
862	* @param pUVM The user mode VM handle.
863	* @param pImageAddr The image address.
864	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
865	* @param pszName The module name, optional.
866	* @param pszFilename The image filename, optional.
867	* @param enmArch The image arch if we force it, pass
868	* RTLDRARCH_WHATEVER if you don't care.
869	* @param cbImage Image size. Pass 0 if not known.
870	* @param offPeHdrs Offset of the PE header.
871	* @param cbPeHdrsPart1 How read into uBuf at @a offPeHdrs.
872	* @param puBuf The header buffer.
873	* @param phDbgMod Where to return the resulting debug module on success.
874	* @param pErrInfo Where to return extended error info on failure.
875	*/
876	static int dbgfR3ModInMemPe(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
877	RTLDRARCH enmArch, uint32_t cbImage, uint32_t offPeHdrs, uint32_t cbPeHdrsPart1,
878	PDBGFMODINMEMBUF puBuf, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
879	{
880	/*
881	* Read the optional header and the section table after validating the
882	* info we need from the file header.
883	*/
884	/* Check the opt hdr size and number of sections as these are used to determine how much to read next. */
885	if ( puBuf->Nt32.FileHeader.SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER32)
886	\|\| puBuf->Nt32.FileHeader.SizeOfOptionalHeader > sizeof(IMAGE_OPTIONAL_HEADER64) + 128)
887	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Invalid SizeOfOptionalHeader value: %#RX32",
888	puBuf->Nt32.FileHeader.SizeOfOptionalHeader);
889
890	if ( puBuf->Nt32.FileHeader.NumberOfSections < 1
891	\|\| puBuf->Nt32.FileHeader.NumberOfSections > 190 /* what fits in our 8K buffer */)
892	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "NumberOfSections is out of range: %#RX32 (1..190)",
893	puBuf->Nt32.FileHeader.NumberOfSections);
894
895	/* Read the optional header and section table. */
896	uint32_t const cbHdrs = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
897	+ puBuf->Nt32.FileHeader.SizeOfOptionalHeader
898	+ puBuf->Nt32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
899	AssertReturn(cbHdrs <= sizeof(*puBuf), RTERRINFO_LOG_SET_F(pErrInfo, VERR_INTERNAL_ERROR_2, "cbHdrs=%#x", cbHdrs));
900
901	DBGFADDRESS PeHdrPart2Addr = *pImageAddr;
902	DBGFR3AddrAdd(&PeHdrPart2Addr, offPeHdrs + cbPeHdrsPart1);
903	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrPart2Addr, &puBuf->ab[cbPeHdrsPart1], cbHdrs - cbPeHdrsPart1);
904	if (RT_FAILURE(rc))
905	return RTERRINFO_LOG_SET_F(pErrInfo, rc,
906	"Failed to read the second part of the PE headers at %RGv (off=%#RX32 + %#RX32): %Rrc",
907	PeHdrPart2Addr.FlatPtr, offPeHdrs, cbPeHdrsPart1, rc);
908
909	/*
910	* Check the image architecture and determine the bitness.
911	*/
912	RTLDRARCH enmArchActual;
913	bool f32Bit;
914	switch (puBuf->Nt32.FileHeader.Machine)
915	{
916	case IMAGE_FILE_MACHINE_I386:
917	enmArchActual = RTLDRARCH_X86_32;
918	f32Bit = true;
919	break;
920	case IMAGE_FILE_MACHINE_AMD64:
921	enmArchActual = RTLDRARCH_AMD64;
922	f32Bit = false;
923	break;
924	case IMAGE_FILE_MACHINE_ARM:
925	case IMAGE_FILE_MACHINE_THUMB:
926	case IMAGE_FILE_MACHINE_ARMNT:
927	enmArchActual = RTLDRARCH_ARM32;
928	f32Bit = true;
929	break;
930	case IMAGE_FILE_MACHINE_ARM64:
931	enmArchActual = RTLDRARCH_ARM64;
932	f32Bit = false;
933	break;
934	default:
935	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Unknown machine: %#x", puBuf->Nt32.FileHeader.Machine);
936	}
937	if ( enmArch != RTLDRARCH_WHATEVER
938	&& enmArch != enmArchActual)
939	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_LDR_ARCH_MISMATCH, "Found %s expected %s",
940	RTLdrArchName(enmArchActual), RTLdrArchName(enmArch));
941
942	/*
943	* Check optional header magic and size.
944	*/
945	uint16_t const uOptMagic = f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC;
946	if (puBuf->Nt32.OptionalHeader.Magic != uOptMagic)
947	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header magic: %#x (expected %#x)",
948	puBuf->Nt32.OptionalHeader.Magic, uOptMagic);
949
950	uint32_t const cDataDir = f32Bit ? puBuf->Nt32.OptionalHeader.NumberOfRvaAndSizes : puBuf->Nt64.OptionalHeader.NumberOfRvaAndSizes;
951	if ( cDataDir <= IMAGE_DIRECTORY_ENTRY_BASERELOC /* a bit random */
952	\|\| cDataDir > 32 /* also random */)
953	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected data directory size: %#x", cDataDir);
954
955	uint32_t cbOptHdr = f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64);
956	cbOptHdr -= sizeof(IMAGE_DATA_DIRECTORY) * IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
957	cbOptHdr += sizeof(IMAGE_DATA_DIRECTORY) * cDataDir;
958	if (puBuf->Nt32.FileHeader.SizeOfOptionalHeader != cbOptHdr)
959	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_BAD_EXE_FORMAT, "Unexpected optional header size: %#x (expected %#x)",
960	puBuf->Nt32.FileHeader.SizeOfOptionalHeader, cbOptHdr);
961
962	uint32_t const cbSectAlign = f32Bit ? puBuf->Nt32.OptionalHeader.SectionAlignment : puBuf->Nt64.OptionalHeader.SectionAlignment;
963	PCIMAGE_SECTION_HEADER pSHdrs = (PCIMAGE_SECTION_HEADER)((uintptr_t)&puBuf->Nt32.OptionalHeader + cbOptHdr);
964	PCIMAGE_DATA_DIRECTORY paDataDir = (PCIMAGE_DATA_DIRECTORY)((uintptr_t)pSHdrs - cDataDir * sizeof(IMAGE_DATA_DIRECTORY));
965
966	/*
967	* Establish the image size.
968	*/
969	uint32_t cbImageFromHdr = f32Bit ? puBuf->Nt32.OptionalHeader.SizeOfImage : puBuf->Nt64.OptionalHeader.SizeOfImage;
970	if ( !cbImage
971	\|\| (fFlags & DBGFMODINMEM_F_PE_NT31))
972	cbImage = RT_ALIGN(cbImageFromHdr, _4K);
973	else if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
974	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_MISMATCH, "Image size mismatch: input=%#x header=%#x", cbImage, cbImageFromHdr);
975
976	/*
977	* Guess the module name if not specified and make sure it conforms to DBGC expectations.
978	*/
979	if (!pszName)
980	{
981	if (pszFilename)
982	pszName = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
983	/** @todo */
984	}
985
986	char szNormalized[128];
987	pszName = dbgfR3ModNormalizeName(pszName, szNormalized, sizeof(szNormalized));
988
989	/*
990	* Create the module using the in memory image first, falling back on cached image.
991	*/
992	RTLDRMOD hLdrMod;
993	rc = dbgfR3ModInMemPeCreateLdrMod(pUVM, fFlags, pszName, pImageAddr, cbImage, cbImageFromHdr, f32Bit,
994	puBuf->Nt32.FileHeader.NumberOfSections, pSHdrs, cbSectAlign, cDataDir, paDataDir,
995	offPeHdrs, &hLdrMod, pErrInfo);
996	if (RT_FAILURE(rc))
997	hLdrMod = NIL_RTLDRMOD;
998
999	RTDBGMOD hMod;
1000	rc = RTDbgModCreateFromPeImage(&hMod, pszFilename, pszName, &hLdrMod, cbImageFromHdr,
1001	puBuf->Nt32.FileHeader.TimeDateStamp, DBGFR3AsGetConfig(pUVM));
1002	if (RT_SUCCESS(rc))
1003	*phDbgMod = hMod;
1004	else if (!(fFlags & DBGFMODINMEM_F_NO_CONTAINER_FALLBACK))
1005	{
1006	/*
1007	* Fallback is a container module.
1008	*/
1009	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
1010	if (RT_SUCCESS(rc))
1011	{
1012	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
1013	AssertRC(rc);
1014	}
1015	}
1016	return rc;
1017	}
1018
1019
1020
1021	/**
1022	* Process a PE image found in guest memory.
1023	*
1024	* @param pUVM The user mode VM handle.
1025	* @param pImageAddr The image address.
1026	* @param fFlags Flags, DBGFMODINMEM_F_XXX.
1027	* @param pszName The module name, optional.
1028	* @param pszFilename The image filename, optional.
1029	* @param enmArch The image arch if we force it, pass
1030	* RTLDRARCH_WHATEVER if you don't care.
1031	* @param cbImage Image size. Pass 0 if not known.
1032	* @param phDbgMod Where to return the resulting debug module on success.
1033	* @param pErrInfo Where to return extended error info on failure.
1034	*/
1035	VMMR3DECL(int) DBGFR3ModInMem(PUVM pUVM, PCDBGFADDRESS pImageAddr, uint32_t fFlags, const char pszName, const char pszFilename,
1036	RTLDRARCH enmArch, uint32_t cbImage, PRTDBGMOD phDbgMod, PRTERRINFO pErrInfo)
1037	{
1038	/*
1039	* Validate and adjust.
1040	*/
1041	AssertPtrReturn(phDbgMod, VERR_INVALID_POINTER);
1042	*phDbgMod = NIL_RTDBGMOD;
1043	AssertPtrReturn(pImageAddr, VERR_INVALID_POINTER);
1044	AssertMsgReturn(cbImage == 0 \|\| cbImage >= sizeof(IMAGE_NT_HEADERS32) + sizeof(IMAGE_DOS_HEADER),
1045	("cbImage=%#x\n", cbImage), VERR_INVALID_PARAMETER);
1046	AssertMsgReturn(!(fFlags & ~DBGFMODINMEM_F_VALID_MASK), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
1047	if (enmArch == RTLDRARCH_HOST)
1048	enmArch = RTLdrGetHostArch();
1049
1050	/*
1051	* Look for an image header we can work with.
1052	*/
1053	DBGFMODINMEMBUF uBuf;
1054	RT_ZERO(uBuf);
1055
1056	int rc = DBGFR3MemRead(pUVM, 0 /idCpu/, pImageAddr, &uBuf, sizeof(uBuf.DosHdr));
1057	if (RT_FAILURE(rc))
1058	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read DOS header at %RGv: %Rrc", pImageAddr->FlatPtr, rc);
1059
1060	if (uBuf.ab[0] == ELFMAG0 && uBuf.ab[1] == ELFMAG1 && uBuf.ab[2] == ELFMAG2 && uBuf.ab[3] == ELFMAG3)
1061	return dbgfR3ModInMemElf(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
1062
1063	if ( uBuf.MachoHdr.magic == IMAGE_MACHO64_SIGNATURE
1064	\|\| uBuf.MachoHdr.magic == IMAGE_MACHO32_SIGNATURE)
1065	return dbgfR3ModInMemMachO(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, &uBuf, phDbgMod, pErrInfo);
1066
1067	uint32_t offNewHdrs;
1068	if (uBuf.DosHdr.e_magic == IMAGE_DOS_SIGNATURE)
1069	{
1070	offNewHdrs = uBuf.DosHdr.e_lfanew;
1071	if ( offNewHdrs < 16
1072	\|\| offNewHdrs > (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)))
1073	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "e_lfanew value is out of range: %RX32 (16..%u)",
1074	offNewHdrs, (cbImage ? _2M : cbImage - sizeof(IMAGE_NT_HEADERS32)));
1075	}
1076	else if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
1077	offNewHdrs = 0;
1078	else
1079	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "Unknown image magic at %RGv: %.8Rhxs",
1080	pImageAddr->FlatPtr, uBuf.ab);
1081
1082	/*
1083	* Read the next bit of header, assuming PE so stop at the end of
1084	* the COFF file header.
1085	*/
1086	DBGFADDRESS PeHdrAddr = *pImageAddr;
1087	DBGFR3AddrAdd(&PeHdrAddr, offNewHdrs);
1088	uint32_t const cbPeHdrsPart1 = RT_UOFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader);
1089	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &PeHdrAddr, &uBuf, cbPeHdrsPart1);
1090	if (RT_FAILURE(rc))
1091	return RTERRINFO_LOG_SET_F(pErrInfo, rc, "Failed to read PE/LX/NE headers at %RGv (off=%#RX32): %Rrc",
1092	PeHdrAddr.FlatPtr, offNewHdrs, rc);
1093
1094	if (uBuf.Nt32.Signature == IMAGE_NT_SIGNATURE)
1095	return dbgfR3ModInMemPe(pUVM, pImageAddr, fFlags, pszName, pszFilename, enmArch, cbImage, offNewHdrs, cbPeHdrsPart1,
1096	&uBuf, phDbgMod, pErrInfo);
1097
1098	return RTERRINFO_LOG_SET_F(pErrInfo, VERR_INVALID_EXE_SIGNATURE, "No PE/LX/NE header at %RGv (off=%#RX32): %.8Rhxs",
1099	PeHdrAddr.FlatPtr, offNewHdrs, uBuf.ab);
1100	}
1101

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3ModInMem.cpp@ 92780

Download in other formats: