DBGPlugInDarwin.cpp@ 103285

Last change on this file since 103285 was 103285, checked in by vboxsync, 9 months ago
Re-applied r161549 again (Got rid of a lot of deprecated strcpy / strcat calls; now using the IPRT pendants (found by Parfait)), left out some stuff which wasn't wanted, less bloated version of DrvAudio.cpp. bugref:3409
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 41.7 KB

Line
1	/* $Id: DBGPlugInDarwin.cpp 103285 2024-02-08 15:27:12Z vboxsync $ */
2	/** @file
3	* DBGPlugInDarwin - Debugger and Guest OS Digger Plugin For Darwin / OS X.
4	*/
5
6	/*
7	* Copyright (C) 2008-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
33	#include "DBGPlugIns.h"
34	#include <VBox/vmm/vmmr3vtable.h>
35	#include <iprt/err.h>
36	#include <iprt/mem.h>
37	#include <iprt/stream.h>
38	#include <iprt/string.h>
39	#include <iprt/uuid.h>
40	#include <iprt/ctype.h>
41	#include <iprt/formats/mach-o.h>
42
43	#undef LogRel2
44	#define LogRel2 LogRel
45
46
47	/*********************************************************************************************************************************
48	* Structures and Typedefs *
49	*********************************************************************************************************************************/
50
51	/** @name Internal Darwin structures
52	* @{ */
53
54	/**
55	* 32-bit darwin kernel module info structure (kmod_info_t).
56	*/
57	typedef struct OSX32_kmod_info
58	{
59	uint32_t next;
60	int32_t info_version;
61	uint32_t id;
62	char name[64];
63	char version[64];
64	int32_t reference_count;
65	uint32_t reference_list; /*< Points to kmod_reference_t. /
66	uint32_t address; /*< Where in memory the kext is loaded. /
67	uint32_t size;
68	uint32_t hdr_size;
69	uint32_t start; /*< Address of kmod_start_func_t. /
70	uint32_t stop; /*< Address of kmod_stop_func_t. /
71	} OSX32_kmod_info_t;
72
73	/**
74	* 32-bit darwin kernel module info structure (kmod_info_t).
75	*/
76	#pragma pack(1)
77	typedef struct OSX64_kmod_info
78	{
79	uint64_t next;
80	int32_t info_version;
81	uint32_t id;
82	char name[64];
83	char version[64];
84	int32_t reference_count;
85	uint64_t reference_list; /*< Points to kmod_reference_t. Misaligned, duh. /
86	uint64_t address; /*< Where in memory the kext is loaded. /
87	uint64_t size;
88	uint64_t hdr_size;
89	uint64_t start; /*< Address of kmod_start_func_t. /
90	uint64_t stop; /*< Address of kmod_stop_func_t. /
91	} OSX64_kmod_info_t;
92	#pragma pack()
93
94	/** The value of the info_version field. */
95	#define OSX_KMOD_INFO_VERSION INT32_C(1)
96
97	/** @} */
98
99
100	/**
101	* Linux guest OS digger instance data.
102	*/
103	typedef struct DBGDIGGERDARWIN
104	{
105	/** Whether the information is valid or not.
106	* (For fending off illegal interface method calls.) */
107	bool fValid;
108
109	/** Set if 64-bit kernel, clear if 32-bit.
110	* Set during probing. */
111	bool f64Bit;
112	/** The address of an kernel version string (there are several).
113	* This is set during probing. */
114	DBGFADDRESS AddrKernelVersion;
115	/** Kernel base address.
116	* This is set during probing. */
117	DBGFADDRESS AddrKernel;
118
119	/** The kernel message log interface. */
120	DBGFOSIDMESG IDmesg;
121	} DBGDIGGERDARWIN;
122	/** Pointer to the linux guest OS digger instance data. */
123	typedef DBGDIGGERDARWIN *PDBGDIGGERDARWIN;
124
125
126	/*********************************************************************************************************************************
127	* Defined Constants And Macros *
128	*********************************************************************************************************************************/
129	/** Validates a 32-bit darwin kernel address */
130	#define OSX32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x00001000) && (Addr) < UINT32_C(0xfffff000))
131	/** Validates a 64-bit darwin kernel address */
132	#define OSX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
133	/** Validates a 32-bit or 64-bit darwin kernel address. */
134	#define OSX_VALID_ADDRESS(a_f64Bits, a_Addr) \
135	((a_f64Bits) ? OSX64_VALID_ADDRESS(a_Addr) : OSX32_VALID_ADDRESS(a_Addr))
136
137	/** AppleOsX on little endian ASCII systems. */
138	#define DIG_DARWIN_MOD_TAG UINT64_C(0x58734f656c707041)
139
140
141	/*********************************************************************************************************************************
142	* Internal Functions *
143	*********************************************************************************************************************************/
144	static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData);
145
146
147
148	/**
149	* @interface_method_impl{DBGFOSIDMESG,pfnQueryKernelLog}
150	*/
151	static DECLCALLBACK(int) dbgDiggerDarwinIDmsg_QueryKernelLog(PDBGFOSIDMESG pThis, PUVM pUVM, PCVMMR3VTABLE pVMM, uint32_t fFlags,
152	uint32_t cMessages, char pszBuf, size_t cbBuf, size_t pcbActual)
153	{
154	RT_NOREF1(fFlags);
155	PDBGDIGGERDARWIN pData = RT_FROM_MEMBER(pThis, DBGDIGGERDARWIN, IDmesg);
156
157	if (cMessages < 1)
158	return VERR_INVALID_PARAMETER;
159
160	/*
161	* The 'msgbufp' variable points to a struct msgbuf (bsd/kern/subr_log.c).
162	*/
163	RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
164	RTDBGMOD hMod;
165	int rc = RTDbgAsModuleByName(hAs, "mach_kernel", 0, &hMod);
166	if (RT_FAILURE(rc))
167	return VERR_NOT_FOUND;
168	RTDbgAsRelease(hAs);
169
170	DBGFADDRESS Addr;
171	RTGCPTR GCPtrMsgBufP = 0;
172	RTDBGSYMBOL SymInfo;
173	rc = RTDbgModSymbolByName(hMod, "_msgbufp", &SymInfo);
174	if (RT_SUCCESS(rc))
175	{
176	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
177	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, SymInfo.Value + pData->AddrKernel.FlatPtr),
178	&GCPtrMsgBufP, pData->f64Bit ? sizeof(uint64_t) : sizeof(uint32_t));
179	if (RT_FAILURE(rc))
180	{
181	LogRel(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read _msgbufp at %RGv: %Rrc\n", Addr.FlatPtr, rc));
182	return VERR_NOT_FOUND;
183	}
184	if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
185	{
186	LogRel(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbufp: %RGv\n", GCPtrMsgBufP));
187	return VERR_NOT_FOUND;
188	}
189	}
190	else
191	{
192	rc = RTDbgModSymbolByName(hMod, "_msgbuf", &SymInfo);
193	if (RT_FAILURE(rc))
194	{
195	LogRel(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to find _msgbufp and _msgbuf: %Rrc\n", rc));
196	return VERR_NOT_FOUND;
197	}
198	GCPtrMsgBufP = SymInfo.Value + pData->AddrKernel.FlatPtr;
199	if (!OSX_VALID_ADDRESS(pData->f64Bit, GCPtrMsgBufP))
200	{
201	LogRel(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid address for _msgbuf: %RGv\n", GCPtrMsgBufP));
202	return VERR_NOT_FOUND;
203	}
204	}
205
206	/*
207	* Read the msgbuf structure.
208	*/
209	struct
210	{
211	uint32_t msg_magic;
212	uint32_t msg_size;
213	uint32_t msg_bufx;
214	uint32_t msg_bufr;
215	uint64_t msg_bufc; /*< Size depends on windows size. /
216	} MsgBuf;
217	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, GCPtrMsgBufP),
218	&MsgBuf, sizeof(MsgBuf) - (pData->f64Bit ? 0 : sizeof(uint32_t)) );
219	if (RT_FAILURE(rc))
220	{
221	LogRel(("dbgDiggerDarwinIDmsg_QueryKernelLog: failed to read msgbuf struct at %RGv: %Rrc\n", Addr.FlatPtr, rc));
222	return VERR_NOT_FOUND;
223	}
224	if (!pData->f64Bit)
225	MsgBuf.msg_bufc &= UINT32_MAX;
226
227	/*
228	* Validate the structure.
229	*/
230	if ( MsgBuf.msg_magic != UINT32_C(0x63061)
231	\|\| MsgBuf.msg_size < UINT32_C(4096)
232	\|\| MsgBuf.msg_size > 16*_1M
233	\|\| MsgBuf.msg_bufx > MsgBuf.msg_size
234	\|\| MsgBuf.msg_bufr > MsgBuf.msg_size
235	\|\| !OSX_VALID_ADDRESS(pData->f64Bit, MsgBuf.msg_bufc) )
236	{
237	LogRel(("dbgDiggerDarwinIDmsg_QueryKernelLog: Invalid MsgBuf data: magic=%#x size=%#x bufx=%#x bufr=%#x bufc=%RGv\n",
238	MsgBuf.msg_magic, MsgBuf.msg_size, MsgBuf.msg_bufx, MsgBuf.msg_bufr, MsgBuf.msg_bufc));
239	return VERR_INVALID_STATE;
240	}
241
242	/*
243	* Read the buffer.
244	*/
245	char pchMsgBuf = (char )RTMemAlloc(MsgBuf.msg_size);
246	if (!pchMsgBuf)
247	{
248	LogRel(("dbgDiggerDarwinIDmsg_QueryKernelLog: Failed to allocate %#x bytes of memory for the log buffer\n",
249	MsgBuf.msg_size));
250	return VERR_INVALID_STATE;
251	}
252	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
253	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, MsgBuf.msg_bufc), pchMsgBuf, MsgBuf.msg_size);
254	if (RT_SUCCESS(rc))
255	{
256	/*
257	* Copy it out raw.
258	*/
259	uint32_t offDst = 0;
260	if (MsgBuf.msg_bufr < MsgBuf.msg_bufx)
261	{
262	/* Single chunk between the read and write offsets. */
263	uint32_t cbToCopy = MsgBuf.msg_bufx - MsgBuf.msg_bufr;
264	if (cbToCopy < cbBuf)
265	{
266	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbToCopy);
267	pszBuf[cbToCopy] = '\0';
268	rc = VINF_SUCCESS;
269	}
270	else
271	{
272	if (cbBuf)
273	{
274	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
275	pszBuf[cbBuf - 1] = '\0';
276	}
277	rc = VERR_BUFFER_OVERFLOW;
278	}
279	offDst = cbToCopy + 1;
280	}
281	else
282	{
283	/* Two chunks, read offset to end, start to write offset. */
284	uint32_t cbFirst = MsgBuf.msg_size - MsgBuf.msg_bufr;
285	uint32_t cbSecond = MsgBuf.msg_bufx;
286	if (cbFirst + cbSecond < cbBuf)
287	{
288	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
289	memcpy(&pszBuf[cbFirst], pchMsgBuf, cbSecond);
290	offDst = cbFirst + cbSecond;
291	pszBuf[offDst++] = '\0';
292	rc = VINF_SUCCESS;
293	}
294	else
295	{
296	offDst = cbFirst + cbSecond + 1;
297	if (cbFirst < cbBuf)
298	{
299	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbFirst);
300	memcpy(&pszBuf[cbFirst], pchMsgBuf, cbBuf - cbFirst);
301	pszBuf[cbBuf - 1] = '\0';
302	}
303	else if (cbBuf)
304	{
305	memcpy(pszBuf, &pchMsgBuf[MsgBuf.msg_bufr], cbBuf - 1);
306	pszBuf[cbBuf - 1] = '\0';
307	}
308	rc = VERR_BUFFER_OVERFLOW;
309	}
310	}
311
312	if (pcbActual)
313	*pcbActual = offDst;
314	}
315	else
316	LogRel(("dbgDiggerDarwinIDmsg_QueryKernelLog: Error reading %#x bytes at %RGv: %Rrc\n",
317	MsgBuf.msg_size, MsgBuf.msg_bufc, rc));
318	RTMemFree(pchMsgBuf);
319	return rc;
320	}
321
322
323	/**
324	* @copydoc DBGFOSREG::pfnStackUnwindAssist
325	*/
326	static DECLCALLBACK(int) dbgDiggerDarwinStackUnwindAssist(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData, VMCPUID idCpu,
327	PDBGFSTACKFRAME pFrame, PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx,
328	RTDBGAS hAs, uint64_t *puScratch)
329	{
330	RT_NOREF(pUVM, pVMM, pvData, idCpu, pFrame, pState, pInitialCtx, hAs, puScratch);
331	return VINF_SUCCESS;
332	}
333
334
335	/**
336	* @copydoc DBGFOSREG::pfnQueryInterface
337	*/
338	static DECLCALLBACK(void ) dbgDiggerDarwinQueryInterface(PUVM pUVM, PCVMMR3VTABLE pVMM, void pvData, DBGFOSINTERFACE enmIf)
339	{
340	RT_NOREF(pUVM, pVMM);
341	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
342	switch (enmIf)
343	{
344	case DBGFOSINTERFACE_DMESG:
345	return &pThis->IDmesg;
346
347	default:
348	return NULL;
349	}
350	}
351
352
353	/**
354	* @copydoc DBGFOSREG::pfnQueryVersion
355	*/
356	static DECLCALLBACK(int) dbgDiggerDarwinQueryVersion(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData,
357	char *pszVersion, size_t cchVersion)
358	{
359	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
360	Assert(pThis->fValid);
361
362	/*
363	* It's all in the linux banner.
364	*/
365	int rc = pVMM->pfnDBGFR3MemReadString(pUVM, 0, &pThis->AddrKernelVersion, pszVersion, cchVersion);
366	if (RT_SUCCESS(rc))
367	{
368	char *pszEnd = RTStrEnd(pszVersion, cchVersion);
369	AssertReturn(pszEnd, VERR_BUFFER_OVERFLOW);
370	while ( pszEnd > pszVersion
371	&& RT_C_IS_SPACE(pszEnd[-1]))
372	pszEnd--;
373	*pszEnd = '\0';
374	}
375	else
376	RTStrPrintf(pszVersion, cchVersion, "DBGFR3MemRead -> %Rrc", rc);
377
378	return rc;
379	}
380
381
382	/**
383	* @copydoc DBGFOSREG::pfnTerm
384	*/
385	static DECLCALLBACK(void) dbgDiggerDarwinTerm(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
386	{
387	RT_NOREF(pUVM, pVMM);
388	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
389
390	pThis->fValid = false;
391	}
392
393
394	/**
395	* @copydoc DBGFOSREG::pfnRefresh
396	*/
397	static DECLCALLBACK(int) dbgDiggerDarwinRefresh(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
398	{
399	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
400	NOREF(pThis);
401	Assert(pThis->fValid);
402
403	/*
404	* For now we'll flush and reload everything.
405	*/
406	dbgDiggerDarwinTerm(pUVM, pVMM, pvData);
407	return dbgDiggerDarwinInit(pUVM, pVMM, pvData);
408	}
409
410
411	/**
412	* Helper function that tries to accertain whether a segment (__LINKEDIT) is
413	* present or not.
414	*
415	* @returns true if present, false if not.
416	* @param pUVM The user mode VM structure.
417	* @param pVMM The VMM function table.
418	* @param uSegAddr The segment addresss.
419	* @param cbSeg The segment size.
420	* @param uMinAddr Lowest allowed address.
421	* @param uMaxAddr Highest allowed address.
422	*/
423	static bool dbgDiggerDarwinIsSegmentPresent(PUVM pUVM, PCVMMR3VTABLE pVMM, uint64_t uSegAddr, uint64_t cbSeg,
424	uint64_t uMinAddr, uint64_t uMaxAddr)
425	{
426	/*
427	* Validate the size and address.
428	*/
429	if (cbSeg < 32)
430	{
431	LogRel(("OSXDig: __LINKEDIT too small %#RX64\n", cbSeg));
432	return false;
433	}
434	if (cbSeg > uMaxAddr - uMinAddr)
435	{
436	LogRel(("OSXDig: __LINKEDIT too big %#RX64, max %#RX64\n", cbSeg, uMaxAddr - uMinAddr));
437	return false;
438	}
439
440	if (uSegAddr < uMinAddr)
441	{
442	LogRel(("OSXDig: __LINKEDIT too low %#RX64, min %#RX64\n", uSegAddr, uMinAddr));
443	return false;
444	}
445	if (uSegAddr > uMaxAddr)
446	{
447	LogRel(("OSXDig: __LINKEDIT too high %#RX64, max %#RX64\n", uSegAddr, uMaxAddr));
448	return false;
449	}
450	if (uSegAddr + cbSeg > uMaxAddr)
451	{
452	LogRel(("OSXDig: __LINKEDIT ends too high %#RX64 (%#RX64+%#RX64), max %#RX64\n",
453	uSegAddr + cbSeg, uSegAddr, cbSeg, uMaxAddr));
454	return false;
455	}
456
457	/*
458	* Check that all the pages are present.
459	*/
460	cbSeg += uSegAddr & GUEST_PAGE_OFFSET_MASK;
461	uSegAddr &= ~(uint64_t)GUEST_PAGE_OFFSET_MASK;
462	for (;;)
463	{
464	uint8_t abBuf[8];
465	DBGFADDRESS Addr;
466	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &Addr, uSegAddr),
467	abBuf, sizeof(abBuf));
468	if (RT_FAILURE(rc))
469	{
470	LogRel(("OSXDig: __LINKEDIT read error at %#RX64: %Rrc\n", uSegAddr, rc));
471	return false;
472	}
473
474	/* Advance */
475	if (cbSeg <= GUEST_PAGE_SIZE)
476	return true;
477	cbSeg -= GUEST_PAGE_SIZE;
478	uSegAddr += GUEST_PAGE_SIZE;
479	}
480	}
481
482
483	/**
484	* Helper function that validates a segment (or section) name.
485	*
486	* @returns true if valid, false if not.
487	* @param pszName The name string.
488	* @param cbName The size of the string, including terminator.
489	*/
490	static bool dbgDiggerDarwinIsValidSegOrSectName(const char *pszName, size_t cbName)
491	{
492	/* ascii chars */
493	char ch;
494	size_t off = 0;
495	while (off < cbName && (ch = pszName[off]))
496	{
497	if (RT_C_IS_CNTRL(ch) \|\| ch >= 127)
498	return false;
499	off++;
500	}
501
502	/* Not empty nor 100% full. */
503	if (off == 0 \|\| off == cbName)
504	return false;
505
506	/* remainder should be zeros. */
507	while (off < cbName)
508	{
509	if (pszName[off])
510	return false;
511	off++;
512	}
513
514	return true;
515	}
516
517
518	static int dbgDiggerDarwinAddModule(PDBGDIGGERDARWIN pThis, PUVM pUVM, PCVMMR3VTABLE pVMM,
519	uint64_t uModAddr, const char pszName, bool pf64Bit)
520	{
521	RT_NOREF1(pThis);
522	union
523	{
524	uint8_t ab[2 * GUEST_PAGE_SIZE];
525	mach_header_64_t Hdr64;
526	mach_header_32_t Hdr32;
527	} uBuf;
528
529	/* Read the first page of the image. */
530	DBGFADDRESS ModAddr;
531	int rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/,
532	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr), uBuf.ab, GUEST_PAGE_SIZE);
533	if (RT_FAILURE(rc))
534	return rc;
535
536	/* Validate the header. */
537	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
538	if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
539	&& uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
540	return VERR_INVALID_EXE_SIGNATURE;
541	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
542	bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
543	if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
544	return VERR_LDR_ARCH_MISMATCH;
545	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
546	if ( uBuf.Hdr32.filetype != MH_EXECUTE
547	&& uBuf.Hdr32.filetype != (f64Bit ? MH_KEXT_BUNDLE : MH_OBJECT))
548	return VERR_BAD_EXE_FORMAT;
549	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
550	if (uBuf.Hdr32.ncmds > 256)
551	return VERR_BAD_EXE_FORMAT;
552	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
553	if (uBuf.Hdr32.sizeofcmds > GUEST_PAGE_SIZE * 2 - sizeof(mach_header_64_t))
554	return VERR_BAD_EXE_FORMAT;
555
556	/* Do we need to read a 2nd page to get all the load commands? If so, do it. */
557	if (uBuf.Hdr32.sizeofcmds + (f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)) > GUEST_PAGE_SIZE)
558	{
559	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr + GUEST_PAGE_SIZE),
560	&uBuf.ab[GUEST_PAGE_SIZE], GUEST_PAGE_SIZE);
561	if (RT_FAILURE(rc))
562	return rc;
563	}
564
565	/*
566	* Process the load commands.
567	*/
568	RTUUID Uuid = RTUUID_INITIALIZE_NULL;
569	RTDBGSEGMENT aSegs[24];
570	uint32_t cSegs = 0;
571	bool fHasLinkEdit = false;
572	uint32_t cLeft = uBuf.Hdr32.ncmds;
573	uint32_t cbLeft = uBuf.Hdr32.sizeofcmds;
574	union
575	{
576	uint8_t const *pb;
577	load_command_t const *pGenric;
578	segment_command_32_t const *pSeg32;
579	segment_command_64_t const *pSeg64;
580	uuid_command_t const *pUuid;
581	} uLCmd;
582	uLCmd.pb = &uBuf.ab[f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)];
583
584	while (cLeft-- > 0)
585	{
586	uint32_t const cbCmd = uLCmd.pGenric->cmdsize;
587	if (cbCmd > cbLeft \|\| cbCmd < sizeof(load_command_t))
588	return VERR_BAD_EXE_FORMAT;
589
590	switch (uLCmd.pGenric->cmd)
591	{
592	case LC_SEGMENT_32:
593	if (cbCmd != sizeof(segment_command_32_t) + uLCmd.pSeg32->nsects * sizeof(section_32_t))
594	return VERR_BAD_EXE_FORMAT;
595	if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg32->segname, sizeof(uLCmd.pSeg32->segname)))
596	return VERR_INVALID_NAME;
597	if ( !strcmp(uLCmd.pSeg32->segname, "__LINKEDIT")
598	&& !(fHasLinkEdit = dbgDiggerDarwinIsSegmentPresent(pUVM, pVMM, uLCmd.pSeg32->vmaddr, uLCmd.pSeg32->vmsize,
599	uModAddr, uModAddr + _64M)))
600	break; /* This usually is discarded or not loaded at all. */
601	if (cSegs >= RT_ELEMENTS(aSegs))
602	return VERR_BUFFER_OVERFLOW;
603	aSegs[cSegs].Address = uLCmd.pSeg32->vmaddr;
604	aSegs[cSegs].uRva = uLCmd.pSeg32->vmaddr - uModAddr;
605	aSegs[cSegs].cb = uLCmd.pSeg32->vmsize;
606	aSegs[cSegs].fFlags = uLCmd.pSeg32->flags; /* Abusing the flags field here... */
607	aSegs[cSegs].iSeg = cSegs;
608	AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg32->segname));
609	strcpy(aSegs[cSegs].szName, uLCmd.pSeg32->segname);
610	cSegs++;
611	break;
612
613	case LC_SEGMENT_64:
614	if (cbCmd != sizeof(segment_command_64_t) + uLCmd.pSeg64->nsects * sizeof(section_64_t))
615	return VERR_BAD_EXE_FORMAT;
616	if (!dbgDiggerDarwinIsValidSegOrSectName(uLCmd.pSeg64->segname, sizeof(uLCmd.pSeg64->segname)))
617	return VERR_INVALID_NAME;
618	if ( !strcmp(uLCmd.pSeg64->segname, "__LINKEDIT")
619	&& !(fHasLinkEdit = dbgDiggerDarwinIsSegmentPresent(pUVM, pVMM, uLCmd.pSeg64->vmaddr, uLCmd.pSeg64->vmsize,
620	uModAddr, uModAddr + _128M)))
621	break; /* This usually is discarded or not loaded at all. */
622	if (cSegs >= RT_ELEMENTS(aSegs))
623	return VERR_BUFFER_OVERFLOW;
624	aSegs[cSegs].Address = uLCmd.pSeg64->vmaddr;
625	aSegs[cSegs].uRva = uLCmd.pSeg64->vmaddr - uModAddr;
626	aSegs[cSegs].cb = uLCmd.pSeg64->vmsize;
627	aSegs[cSegs].fFlags = uLCmd.pSeg64->flags; /* Abusing the flags field here... */
628	aSegs[cSegs].iSeg = cSegs;
629	AssertCompile(RTDBG_SEGMENT_NAME_LENGTH > sizeof(uLCmd.pSeg64->segname));
630	strcpy(aSegs[cSegs].szName, uLCmd.pSeg64->segname);
631	cSegs++;
632	break;
633
634	case LC_UUID:
635	if (cbCmd != sizeof(uuid_command_t))
636	return VERR_BAD_EXE_FORMAT;
637	if (RTUuidIsNull((PCRTUUID)&uLCmd.pUuid->uuid[0]))
638	return VERR_BAD_EXE_FORMAT;
639	memcpy(&Uuid, &uLCmd.pUuid->uuid[0], sizeof(uLCmd.pUuid->uuid));
640	break;
641
642	default:
643	/* Current known max plus a lot of slack. */
644	if (uLCmd.pGenric->cmd > LC_DYLIB_CODE_SIGN_DRS + 32)
645	return VERR_BAD_EXE_FORMAT;
646	break;
647	}
648
649	/* next */
650	cbLeft -= cbCmd;
651	uLCmd.pb += cbCmd;
652	}
653
654	if (cbLeft != 0)
655	{
656	LogRel(("OSXDig: uModAddr=%#RX64 - %u bytes of command left over!\n", uModAddr, cbLeft));
657	return VERR_BAD_EXE_FORMAT;
658	}
659
660	/*
661	* Some post processing checks.
662	*/
663	uint32_t iSeg;
664	for (iSeg = 0; iSeg < cSegs; iSeg++)
665	if (aSegs[iSeg].Address == uModAddr)
666	break;
667	if (iSeg >= cSegs)
668	{
669	LogRel2(("OSXDig: uModAddr=%#RX64 was not found among the segments segments\n", uModAddr));
670	return VERR_ADDRESS_CONFLICT;
671	}
672
673	/*
674	* Create a debug module.
675	*/
676	RTDBGMOD hMod;
677	rc = RTDbgModCreateFromMachOImage(&hMod, pszName, NULL, f64Bit ? RTLDRARCH_AMD64 : RTLDRARCH_X86_32, NULL /phLdrModIn/,
678	0 /cbImage/, cSegs, aSegs, &Uuid, pVMM->pfnDBGFR3AsGetConfig(pUVM),
679	RTDBGMOD_F_NOT_DEFERRED \| (fHasLinkEdit ? RTDBGMOD_F_MACHO_LOAD_LINKEDIT : 0));
680
681
682	/*
683	* If module creation failed and we've got a linkedit segment, try open the
684	* image in-memory, because that will at a minimum give us symbol table symbols.
685	*/
686	if (RT_FAILURE(rc) && fHasLinkEdit)
687	{
688	DBGFADDRESS DbgfAddr;
689	RTERRINFOSTATIC ErrInfo;
690	rc = pVMM->pfnDBGFR3ModInMem(pUVM, pVMM->pfnDBGFR3AddrFromFlat(pUVM, &DbgfAddr, uModAddr),
691	DBGFMODINMEM_F_NO_CONTAINER_FALLBACK,
692	pszName, NULL /pszFilename/, f64Bit ? RTLDRARCH_AMD64 : RTLDRARCH_X86_32, 0 /cbImage /,
693	&hMod, RTErrInfoInitStatic(&ErrInfo));
694	if (RT_FAILURE(rc))
695	LogRel(("OSXDig: Failed to do an in-memory-opening of '%s' at %#RX64: %Rrc%s%s\n", pszName, uModAddr, rc,
696	RTErrInfoIsSet(&ErrInfo.Core) ? " - " : "", RTErrInfoIsSet(&ErrInfo.Core) ? ErrInfo.Core.pszMsg : ""));
697	}
698
699	/*
700	* Final fallback is a container module.
701	*/
702	if (RT_FAILURE(rc))
703	{
704	rc = RTDbgModCreate(&hMod, pszName, 0, 0);
705	if (RT_FAILURE(rc))
706	return rc;
707
708	uint64_t uRvaNext = 0;
709	for (iSeg = 0; iSeg < cSegs && RT_SUCCESS(rc); iSeg++)
710	{
711	if ( aSegs[iSeg].uRva > uRvaNext
712	&& aSegs[iSeg].uRva - uRvaNext < _1M)
713	uRvaNext = aSegs[iSeg].uRva;
714	rc = RTDbgModSegmentAdd(hMod, aSegs[iSeg].uRva, aSegs[iSeg].cb, aSegs[iSeg].szName, 0, NULL);
715	if (aSegs[iSeg].cb > 0 && RT_SUCCESS(rc))
716	{
717	char szTmp[RTDBG_SEGMENT_NAME_LENGTH + sizeof("_start")];
718	rc = RTStrCat(RTStrCopy2(szTmp, sizeof(szTmp), aSegs[iSeg].szName), sizeof(szTmp), "_start");
719	if (RT_SUCCESS(rc))
720	rc = RTDbgModSymbolAdd(hMod, szTmp, iSeg, 0 /uRva/, 0 /cb/, 0 /fFlags/, NULL);
721	}
722	uRvaNext += aSegs[iSeg].cb;
723	}
724
725	if (RT_FAILURE(rc))
726	{
727	RTDbgModRelease(hMod);
728	return rc;
729	}
730	}
731
732	/* Tag the module. */
733	rc = RTDbgModSetTag(hMod, DIG_DARWIN_MOD_TAG);
734	AssertRC(rc);
735
736	/*
737	* Link the module.
738	*/
739	RTDBGAS hAs = pVMM->pfnDBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
740	if (hAs != NIL_RTDBGAS)
741	{
742	//uint64_t uRvaNext = 0; - what was this?
743	uint32_t cLinked = 0;
744	iSeg = cSegs;
745	while (iSeg-- > 0) /* HACK: Map in reverse order to avoid replacing __TEXT. */
746	if (aSegs[iSeg].cb)
747	{
748	/* Find matching segment in the debug module. */
749	uint32_t iDbgSeg = 0;
750	while (iDbgSeg < cSegs)
751	{
752	RTDBGSEGMENT SegInfo;
753	int rc3 = RTDbgModSegmentByIndex(hMod, iDbgSeg, &SegInfo);
754	if (RT_SUCCESS(rc3) && !strcmp(SegInfo.szName, aSegs[iSeg].szName))
755	break;
756	iDbgSeg++;
757	}
758	AssertMsgStmt(iDbgSeg < cSegs, ("%s\n", aSegs[iSeg].szName), continue);
759
760	/* Map it. */
761	int rc2 = RTDbgAsModuleLinkSeg(hAs, hMod, iDbgSeg, aSegs[iSeg].Address, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
762	if (RT_SUCCESS(rc2))
763	cLinked++;
764	else if (RT_SUCCESS(rc))
765	rc = rc2;
766	}
767	if (RT_FAILURE(rc) && cLinked != 0)
768	rc = -rc;
769	}
770	else
771	rc = VERR_INTERNAL_ERROR;
772
773	RTDbgModRelease(hMod);
774	RTDbgAsRelease(hAs);
775
776	if (pf64Bit)
777	*pf64Bit = f64Bit;
778	return rc;
779	}
780
781
782	static bool dbgDiggerDarwinIsValidName(const char *pszName)
783	{
784	char ch;
785	while ((ch = *pszName++) != '\0')
786	{
787	if (ch < 0x20 \|\| ch >= 127)
788	return false;
789	}
790	return true;
791	}
792
793
794	static bool dbgDiggerDarwinIsValidVersion(const char *pszVersion)
795	{
796	char ch;
797	while ((ch = *pszVersion++) != '\0')
798	{
799	if (ch < 0x20 \|\| ch >= 127)
800	return false;
801	}
802	return true;
803	}
804
805
806	/**
807	* @copydoc DBGFOSREG::pfnInit
808	*/
809	static DECLCALLBACK(int) dbgDiggerDarwinInit(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
810	{
811	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
812	Assert(!pThis->fValid);
813
814	/*
815	* Add the kernel module.
816	*/
817	bool f64Bit;
818	int rc = dbgDiggerDarwinAddModule(pThis, pUVM, pVMM, pThis->AddrKernel.FlatPtr, "mach_kernel", &f64Bit);
819	if (RT_SUCCESS(rc))
820	{
821	/*
822	* The list of modules can be found at the 'kmod' symbol, that means
823	* that we currently require some kind of symbol file for the kernel
824	* to be loaded at this point.
825	*
826	* Note! Could also use the 'gLoadedKextSummaries', but I don't think
827	* it's any easier to find without any kernel map than 'kmod'.
828	*/
829	RTDBGSYMBOL SymInfo;
830	rc = pVMM->pfnDBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!kmod", &SymInfo, NULL);
831	if (RT_FAILURE(rc))
832	rc = pVMM->pfnDBGFR3AsSymbolByName(pUVM, DBGF_AS_KERNEL, "mach_kernel!_kmod", &SymInfo, NULL);
833	if (RT_SUCCESS(rc))
834	{
835	DBGFADDRESS AddrModInfo;
836	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrModInfo, SymInfo.Value);
837
838	/* Read the variable. */
839	RTUINT64U uKmodValue = { 0 };
840	if (f64Bit)
841	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &AddrModInfo, &uKmodValue.u, sizeof(uKmodValue.u));
842	else
843	rc = pVMM->pfnDBGFR3MemRead (pUVM, 0 /idCpu/, &AddrModInfo, &uKmodValue.s.Lo, sizeof(uKmodValue.s.Lo));
844	if (RT_SUCCESS(rc))
845	{
846	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrModInfo, uKmodValue.u);
847
848	/* Walk the list of modules. */
849	uint32_t cIterations = 0;
850	while (AddrModInfo.FlatPtr != 0)
851	{
852	/* Some extra loop conditions... */
853	if (!OSX_VALID_ADDRESS(f64Bit, AddrModInfo.FlatPtr))
854	{
855	LogRel(("OSXDig: Invalid kmod_info pointer: %RGv\n", AddrModInfo.FlatPtr));
856	break;
857	}
858	if (AddrModInfo.FlatPtr == uKmodValue.u && cIterations != 0)
859	{
860	LogRel(("OSXDig: kmod_info list looped back to the start.\n"));
861	break;
862	}
863	if (cIterations++ >= 2048)
864	{
865	LogRel(("OSXDig: Too many mod_info loops (%u)\n", cIterations));
866	break;
867	}
868
869	/*
870	* Read the kmod_info_t structure.
871	*/
872	union
873	{
874	OSX64_kmod_info_t Info64;
875	OSX32_kmod_info_t Info32;
876	} uMod;
877	RT_ZERO(uMod);
878	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &AddrModInfo, &uMod,
879	f64Bit ? sizeof(uMod.Info64) : sizeof(uMod.Info32));
880	if (RT_FAILURE(rc))
881	{
882	LogRel(("OSXDig: Error reading kmod_info structure at %RGv: %Rrc\n", AddrModInfo.FlatPtr, rc));
883	break;
884	}
885
886	/*
887	* Validate the kmod_info_t structure.
888	*/
889	int32_t iInfoVer = f64Bit ? uMod.Info64.info_version : uMod.Info32.info_version;
890	if (iInfoVer != OSX_KMOD_INFO_VERSION)
891	{
892	LogRel(("OSXDig: kmod_info @%RGv: Bad info_version %d\n", AddrModInfo.FlatPtr, iInfoVer));
893	break;
894	}
895
896	const char *pszName = f64Bit ? uMod.Info64.name : uMod.Info32.name;
897	if ( !*pszName
898	\|\| !RTStrEnd(pszName, sizeof(uMod.Info64.name))
899	\|\| !dbgDiggerDarwinIsValidName(pszName) )
900	{
901	LogRel(("OSXDig: kmod_info @%RGv: Bad name '%.*s'\n", AddrModInfo.FlatPtr,
902	sizeof(uMod.Info64.name), pszName));
903	break;
904	}
905
906	const char *pszVersion = f64Bit ? uMod.Info64.version : uMod.Info32.version;
907	if ( !RTStrEnd(pszVersion, sizeof(uMod.Info64.version))
908	\|\| !dbgDiggerDarwinIsValidVersion(pszVersion) )
909	{
910	LogRel(("OSXDig: kmod_info @%RGv: Bad version '%.*s'\n", AddrModInfo.FlatPtr,
911	sizeof(uMod.Info64.version), pszVersion));
912	break;
913	}
914
915	int32_t cRefs = f64Bit ? uMod.Info64.reference_count : uMod.Info32.reference_count;
916	if (cRefs < -1 \|\| cRefs > 16384)
917	{
918	LogRel(("OSXDig: kmod_info @%RGv: Bad reference_count %d\n", AddrModInfo.FlatPtr, cRefs));
919	break;
920	}
921
922	uint64_t uImageAddr = f64Bit ? uMod.Info64.address : uMod.Info32.address;
923	if (!OSX_VALID_ADDRESS(f64Bit, uImageAddr))
924	{
925	LogRel(("OSXDig: kmod_info @%RGv: Bad address %#llx\n", AddrModInfo.FlatPtr, uImageAddr));
926	break;
927	}
928
929	uint64_t cbImage = f64Bit ? uMod.Info64.size : uMod.Info32.size;
930	if (cbImage > 64U*_1M)
931	{
932	LogRel(("OSXDig: kmod_info @%RGv: Bad size %#llx\n", AddrModInfo.FlatPtr, cbImage));
933	break;
934	}
935
936	uint64_t cbHdr = f64Bit ? uMod.Info64.hdr_size : uMod.Info32.hdr_size;
937	if (cbHdr > 16U*_1M)
938	{
939	LogRel(("OSXDig: kmod_info @%RGv: Bad hdr_size %#llx\n", AddrModInfo.FlatPtr, cbHdr));
940	break;
941	}
942
943	uint64_t uStartAddr = f64Bit ? uMod.Info64.start : uMod.Info32.start;
944	if (!uStartAddr && !OSX_VALID_ADDRESS(f64Bit, uStartAddr))
945	{
946	LogRel(("OSXDig: kmod_info @%RGv: Bad start function %#llx\n", AddrModInfo.FlatPtr, uStartAddr));
947	break;
948	}
949
950	uint64_t uStopAddr = f64Bit ? uMod.Info64.stop : uMod.Info32.stop;
951	if (!uStopAddr && !OSX_VALID_ADDRESS(f64Bit, uStopAddr))
952	{
953	LogRel(("OSXDig: kmod_info @%RGv: Bad stop function %#llx\n", AddrModInfo.FlatPtr, uStopAddr));
954	break;
955	}
956
957	/*
958	* Try add the module.
959	*/
960	LogRel(("OSXDig: kmod_info @%RGv: '%s' ver '%s', image @%#llx LB %#llx cbHdr=%#llx\n", AddrModInfo.FlatPtr,
961	pszName, pszVersion, uImageAddr, cbImage, cbHdr));
962	rc = dbgDiggerDarwinAddModule(pThis, pUVM, pVMM, uImageAddr, pszName, NULL);
963
964
965	/*
966	* Advance to the next kmod_info entry.
967	*/
968	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &AddrModInfo, f64Bit ? uMod.Info64.next : uMod.Info32.next);
969	}
970	}
971	else
972	LogRel(("OSXDig: Error reading the 'kmod' variable: %Rrc\n", rc));
973	}
974	else
975	LogRel(("OSXDig: Failed to locate the 'kmod' variable in mach_kernel.\n"));
976
977	pThis->fValid = true;
978	return VINF_SUCCESS;
979	}
980
981	return rc;
982	}
983
984
985	/**
986	* @copydoc DBGFOSREG::pfnProbe
987	*/
988	static DECLCALLBACK(bool) dbgDiggerDarwinProbe(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
989	{
990	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
991
992	/*
993	* Look for a section + segment combo that normally only occures in
994	* mach_kernel. Follow it up with probing of the rest of the executable
995	* header. We must search a largish area because the more recent versions
996	* of darwin have random load address for security raisins.
997	*/
998	static struct { uint64_t uStart, uEnd; } const s_aRanges[] =
999	{
1000	/* 64-bit: */
1001	{ UINT64_C(0xffffff8000000000), UINT64_C(0xffffff81ffffffff), },
1002
1003	/* 32-bit - always search for this because of the hybrid 32-bit kernel
1004	with cpu in long mode that darwin used for a number of versions. */
1005	{ UINT64_C(0x00001000), UINT64_C(0x0ffff000), }
1006	};
1007	for (unsigned iRange = pVMM->pfnDBGFR3CpuGetMode(pUVM, 0 /idCpu/) != CPUMMODE_LONG;
1008	iRange < RT_ELEMENTS(s_aRanges);
1009	iRange++)
1010	{
1011	DBGFADDRESS KernelAddr;
1012	for (pVMM->pfnDBGFR3AddrFromFlat(pUVM, &KernelAddr, s_aRanges[iRange].uStart);
1013	KernelAddr.FlatPtr < s_aRanges[iRange].uEnd;
1014	KernelAddr.FlatPtr += GUEST_PAGE_SIZE)
1015	{
1016	static const uint8_t s_abNeedle[16 + 16] =
1017	{
1018	'_','_','t','e','x','t', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::sectname */
1019	'_','_','K','L','D', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::segname. */
1020	};
1021
1022	int rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, s_aRanges[iRange].uEnd - KernelAddr.FlatPtr,
1023	1, s_abNeedle, sizeof(s_abNeedle), &KernelAddr);
1024	if (RT_FAILURE(rc))
1025	break;
1026	pVMM->pfnDBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & GUEST_PAGE_OFFSET_MASK);
1027
1028	/*
1029	* Read the first page of the image and check the headers.
1030	*/
1031	union
1032	{
1033	uint8_t ab[GUEST_PAGE_SIZE];
1034	mach_header_64_t Hdr64;
1035	mach_header_32_t Hdr32;
1036	} uBuf;
1037	rc = pVMM->pfnDBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, uBuf.ab, GUEST_PAGE_SIZE);
1038	if (RT_FAILURE(rc))
1039	continue;
1040	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, magic, mach_header_32_t, magic);
1041	if ( uBuf.Hdr64.magic != IMAGE_MACHO64_SIGNATURE
1042	&& uBuf.Hdr32.magic != IMAGE_MACHO32_SIGNATURE)
1043	continue;
1044	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, cputype, mach_header_32_t, cputype);
1045	bool f64Bit = uBuf.Hdr64.magic == IMAGE_MACHO64_SIGNATURE;
1046	if (uBuf.Hdr32.cputype != (f64Bit ? CPU_TYPE_X86_64 : CPU_TYPE_I386))
1047	continue;
1048	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, filetype, mach_header_32_t, filetype);
1049	if (uBuf.Hdr32.filetype != MH_EXECUTE)
1050	continue;
1051	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, ncmds, mach_header_32_t, ncmds);
1052	if (uBuf.Hdr32.ncmds > 256)
1053	continue;
1054	AssertCompileMembersSameSizeAndOffset(mach_header_64_t, sizeofcmds, mach_header_32_t, sizeofcmds);
1055	if (uBuf.Hdr32.sizeofcmds > GUEST_PAGE_SIZE * 2 - sizeof(mach_header_64_t))
1056	continue;
1057
1058	/* Seems good enough for now.
1059
1060	If the above causes false positives, check the segments and make
1061	sure there is a kernel version string in the right one. */
1062	pThis->AddrKernel = KernelAddr;
1063	pThis->f64Bit = f64Bit;
1064
1065	/*
1066	* Finally, find the kernel version string.
1067	*/
1068	rc = pVMM->pfnDBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, 32*_1M, 1, RT_STR_TUPLE("Darwin Kernel Version"),
1069	&pThis->AddrKernelVersion);
1070	if (RT_FAILURE(rc))
1071	pVMM->pfnDBGFR3AddrFromFlat(pUVM, &pThis->AddrKernelVersion, 0);
1072	return true;
1073	}
1074	}
1075	return false;
1076	}
1077
1078
1079	/**
1080	* @copydoc DBGFOSREG::pfnDestruct
1081	*/
1082	static DECLCALLBACK(void) dbgDiggerDarwinDestruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1083	{
1084	RT_NOREF(pUVM, pVMM, pvData);
1085	}
1086
1087
1088	/**
1089	* @copydoc DBGFOSREG::pfnConstruct
1090	*/
1091	static DECLCALLBACK(int) dbgDiggerDarwinConstruct(PUVM pUVM, PCVMMR3VTABLE pVMM, void *pvData)
1092	{
1093	RT_NOREF(pUVM, pVMM);
1094	PDBGDIGGERDARWIN pThis = (PDBGDIGGERDARWIN)pvData;
1095
1096	pThis->IDmesg.u32Magic = DBGFOSIDMESG_MAGIC;
1097	pThis->IDmesg.pfnQueryKernelLog = dbgDiggerDarwinIDmsg_QueryKernelLog;
1098	pThis->IDmesg.u32EndMagic = DBGFOSIDMESG_MAGIC;
1099
1100	return VINF_SUCCESS;
1101	}
1102
1103
1104	const DBGFOSREG g_DBGDiggerDarwin =
1105	{
1106	/* .u32Magic = */ DBGFOSREG_MAGIC,
1107	/* .fFlags = */ 0,
1108	/* .cbData = */ sizeof(DBGDIGGERDARWIN),
1109	/* .szName = */ "Darwin",
1110	/* .pfnConstruct = */ dbgDiggerDarwinConstruct,
1111	/* .pfnDestruct = */ dbgDiggerDarwinDestruct,
1112	/* .pfnProbe = */ dbgDiggerDarwinProbe,
1113	/* .pfnInit = */ dbgDiggerDarwinInit,
1114	/* .pfnRefresh = */ dbgDiggerDarwinRefresh,
1115	/* .pfnTerm = */ dbgDiggerDarwinTerm,
1116	/* .pfnQueryVersion = */ dbgDiggerDarwinQueryVersion,
1117	/* .pfnQueryInterface = */ dbgDiggerDarwinQueryInterface,
1118	/* .pfnStackUnwindAssist = */ dbgDiggerDarwinStackUnwindAssist,
1119	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1120	};
1121

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInDarwin.cpp@ 103285

Download in other formats: