DBGPlugInWinNt.cpp@ 62840

Last change on this file since 62840 was 62840, checked in by vboxsync, 8 years ago
Debugger: warnings
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 47.6 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 62840 2016-08-01 17:15:19Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF ///@todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/err.h>
26	#include <VBox/param.h>
27	#include <iprt/ldr.h>
28	#include <iprt/mem.h>
29	#include <iprt/stream.h>
30	#include <iprt/string.h>
31	#include <iprt/formats/pecoff.h>
32	#include <iprt/formats/mz.h>
33
34
35	/*********************************************************************************************************************************
36	* Structures and Typedefs *
37	*********************************************************************************************************************************/
38
39	/** @name Internal WinNT structures
40	* @{ */
41	/**
42	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
43	* Tested with XP.
44	*/
45	typedef struct NTMTE32
46	{
47	struct
48	{
49	uint32_t Flink;
50	uint32_t Blink;
51	} InLoadOrderLinks,
52	InMemoryOrderModuleList,
53	InInitializationOrderModuleList;
54	uint32_t DllBase;
55	uint32_t EntryPoint;
56	uint32_t SizeOfImage;
57	struct
58	{
59	uint16_t Length;
60	uint16_t MaximumLength;
61	uint32_t Buffer;
62	} FullDllName,
63	BaseDllName;
64	uint32_t Flags;
65	uint16_t LoadCount;
66	uint16_t TlsIndex;
67	/* ... there is more ... */
68	} NTMTE32;
69	typedef NTMTE32 *PNTMTE32;
70
71	/**
72	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
73	*/
74	typedef struct NTMTE64
75	{
76	struct
77	{
78	uint64_t Flink;
79	uint64_t Blink;
80	} InLoadOrderLinks, /*< 0x00 /
81	InMemoryOrderModuleList, /*< 0x10 /
82	InInitializationOrderModuleList; /*< 0x20 /
83	uint64_t DllBase; /*< 0x30 /
84	uint64_t EntryPoint; /*< 0x38 /
85	uint32_t SizeOfImage; /*< 0x40 /
86	uint32_t Alignment; /*< 0x44 /
87	struct
88	{
89	uint16_t Length; /*< 0x48,0x58 /
90	uint16_t MaximumLength; /*< 0x4a,0x5a /
91	uint32_t Alignment; /*< 0x4c,0x5c /
92	uint64_t Buffer; /*< 0x50,0x60 /
93	} FullDllName, /*< 0x48 /
94	BaseDllName; /*< 0x58 /
95	uint32_t Flags; /*< 0x68 /
96	uint16_t LoadCount; /*< 0x6c /
97	uint16_t TlsIndex; /*< 0x6e /
98	/* ... there is more ... */
99	} NTMTE64;
100	typedef NTMTE64 *PNTMTE64;
101
102	/** MTE union. */
103	typedef union NTMTE
104	{
105	NTMTE32 vX_32;
106	NTMTE64 vX_64;
107	} NTMTE;
108	typedef NTMTE *PNTMTE;
109
110
111	/**
112	* The essential bits of the KUSER_SHARED_DATA structure.
113	*/
114	typedef struct NTKUSERSHAREDDATA
115	{
116	uint32_t TickCountLowDeprecated;
117	uint32_t TickCountMultiplier;
118	struct
119	{
120	uint32_t LowPart;
121	int32_t High1Time;
122	int32_t High2Time;
123
124	} InterruptTime,
125	SystemTime,
126	TimeZoneBias;
127	uint16_t ImageNumberLow;
128	uint16_t ImageNumberHigh;
129	RTUTF16 NtSystemRoot[260];
130	uint32_t MaxStackTraceDepth;
131	uint32_t CryptoExponent;
132	uint32_t TimeZoneId;
133	uint32_t LargePageMinimum;
134	uint32_t Reserved2[7];
135	uint32_t NtProductType;
136	uint8_t ProductTypeIsValid;
137	uint8_t abPadding[3];
138	uint32_t NtMajorVersion;
139	uint32_t NtMinorVersion;
140	/* uint8_t ProcessorFeatures[64];
141	...
142	*/
143	} NTKUSERSHAREDDATA;
144	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
145
146	/** KI_USER_SHARED_DATA for i386 */
147	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
148	/** KI_USER_SHARED_DATA for AMD64 */
149	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
150
151	/** NTKUSERSHAREDDATA::NtProductType */
152	typedef enum NTPRODUCTTYPE
153	{
154	kNtProductType_Invalid = 0,
155	kNtProductType_WinNt = 1,
156	kNtProductType_LanManNt,
157	kNtProductType_Server
158	} NTPRODUCTTYPE;
159
160
161	/** NT image header union. */
162	typedef union NTHDRSU
163	{
164	IMAGE_NT_HEADERS32 vX_32;
165	IMAGE_NT_HEADERS64 vX_64;
166	} NTHDRS;
167	/** Pointer to NT image header union. */
168	typedef NTHDRS *PNTHDRS;
169	/** Pointer to const NT image header union. */
170	typedef NTHDRS const *PCNTHDRS;
171
172	/** @} */
173
174
175
176	typedef enum DBGDIGGERWINNTVER
177	{
178	DBGDIGGERWINNTVER_UNKNOWN,
179	DBGDIGGERWINNTVER_3_1,
180	DBGDIGGERWINNTVER_3_5,
181	DBGDIGGERWINNTVER_4_0,
182	DBGDIGGERWINNTVER_5_0,
183	DBGDIGGERWINNTVER_5_1,
184	DBGDIGGERWINNTVER_6_0
185	} DBGDIGGERWINNTVER;
186
187	/**
188	* WinNT guest OS digger instance data.
189	*/
190	typedef struct DBGDIGGERWINNT
191	{
192	/** Whether the information is valid or not.
193	* (For fending off illegal interface method calls.) */
194	bool fValid;
195	/** 32-bit (true) or 64-bit (false) */
196	bool f32Bit;
197
198	/** The NT version. */
199	DBGDIGGERWINNTVER enmVer;
200	/** NTKUSERSHAREDDATA::NtProductType */
201	NTPRODUCTTYPE NtProductType;
202	/** NTKUSERSHAREDDATA::NtMajorVersion */
203	uint32_t NtMajorVersion;
204	/** NTKUSERSHAREDDATA::NtMinorVersion */
205	uint32_t NtMinorVersion;
206
207	/** The address of the ntoskrnl.exe image. */
208	DBGFADDRESS KernelAddr;
209	/** The address of the ntoskrnl.exe module table entry. */
210	DBGFADDRESS KernelMteAddr;
211	/** The address of PsLoadedModuleList. */
212	DBGFADDRESS PsLoadedModuleListAddr;
213	} DBGDIGGERWINNT;
214	/** Pointer to the linux guest OS digger instance data. */
215	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
216
217
218	/**
219	* The WinNT digger's loader reader instance data.
220	*/
221	typedef struct DBGDIGGERWINNTRDR
222	{
223	/** The VM handle (referenced). */
224	PUVM pUVM;
225	/** The image base. */
226	DBGFADDRESS ImageAddr;
227	/** The image size. */
228	uint32_t cbImage;
229	/** The file offset of the SizeOfImage field in the optional header if it
230	* needs patching, otherwise set to UINT32_MAX. */
231	uint32_t offSizeOfImage;
232	/** The correct image size. */
233	uint32_t cbCorrectImageSize;
234	/** Number of entries in the aMappings table. */
235	uint32_t cMappings;
236	/** Mapping hint. */
237	uint32_t iHint;
238	/** Mapping file offset to memory offsets, ordered by file offset. */
239	struct
240	{
241	/** The file offset. */
242	uint32_t offFile;
243	/** The size of this mapping. */
244	uint32_t cbMem;
245	/** The offset to the memory from the start of the image. */
246	uint32_t offMem;
247	} aMappings[1];
248	} DBGDIGGERWINNTRDR;
249	/** Pointer a WinNT loader reader instance data. */
250	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
251
252
253	/*********************************************************************************************************************************
254	* Defined Constants And Macros *
255	*********************************************************************************************************************************/
256	/** Validates a 32-bit Windows NT kernel address */
257	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
258	/** Validates a 64-bit Windows NT kernel address */
259	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
260	/** Validates a kernel address. */
261	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
262	/** Versioned and bitness wrapper. */
263	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
264
265	/** The length (in chars) of the kernel file name (no path). */
266	#define WINNT_KERNEL_BASE_NAME_LEN 12
267
268	/** WindowsNT on little endian ASCII systems. */
269	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
270
271
272	/*********************************************************************************************************************************
273	* Internal Functions *
274	*********************************************************************************************************************************/
275	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
276
277
278	/*********************************************************************************************************************************
279	* Global Variables *
280	*********************************************************************************************************************************/
281	/** Kernel names. */
282	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
283	{
284	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
285	};
286
287
288
289	/** @callback_method_impl{PFNRTLDRRDRMEMREAD} */
290	static DECLCALLBACK(int) dbgDiggerWinNtRdr_Read(void pvBuf, size_t cb, size_t off, void pvUser)
291	{
292	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
293	uint32_t offFile = (uint32_t)off;
294	AssertReturn(offFile == off, VERR_INVALID_PARAMETER);
295
296	uint32_t i = pThis->iHint;
297	if (pThis->aMappings[i].offFile > offFile)
298	{
299	i = pThis->cMappings;
300	while (i-- > 0)
301	if (offFile >= pThis->aMappings[i].offFile)
302	break;
303	pThis->iHint = i;
304	}
305
306	while (cb > 0)
307	{
308	uint32_t offNextMap = i + 1 < pThis->cMappings ? pThis->aMappings[i + 1].offFile : pThis->cbImage;
309	uint32_t offMap = offFile - pThis->aMappings[i].offFile;
310
311	/* Read file bits backed by memory. */
312	if (offMap < pThis->aMappings[i].cbMem)
313	{
314	uint32_t cbToRead = pThis->aMappings[i].cbMem - offMap;
315	if (cbToRead > cb)
316	cbToRead = (uint32_t)cb;
317
318	DBGFADDRESS Addr = pThis->ImageAddr;
319	DBGFR3AddrAdd(&Addr, pThis->aMappings[i].offMem + offMap);
320
321	int rc = DBGFR3MemRead(pThis->pUVM, 0 /idCpu/, &Addr, pvBuf, cbToRead);
322	if (RT_FAILURE(rc))
323	return rc;
324
325	/* Apply SizeOfImage patch? */
326	if ( pThis->offSizeOfImage != UINT32_MAX
327	&& offFile < pThis->offSizeOfImage + 4
328	&& offFile + cbToRead > pThis->offSizeOfImage)
329	{
330	uint32_t SizeOfImage = pThis->cbCorrectImageSize;
331	uint32_t cbPatch = sizeof(SizeOfImage);
332	int32_t offPatch = pThis->offSizeOfImage - offFile;
333	uint8_t pbPatch = (uint8_t )pvBuf + offPatch;
334	if (offFile + cbToRead < pThis->offSizeOfImage + cbPatch)
335	cbPatch = offFile + cbToRead - pThis->offSizeOfImage;
336	while (cbPatch-- > 0)
337	{
338	if (offPatch >= 0)
339	*pbPatch = (uint8_t)SizeOfImage;
340	offPatch++;
341	pbPatch++;
342	SizeOfImage >>= 8;
343	}
344	}
345
346	/* Done? */
347	if (cbToRead == cb)
348	break;
349
350	offFile += cbToRead;
351	cb -= cbToRead;
352	pvBuf = (char *)pvBuf + cbToRead;
353	}
354
355	/* Mind the gap. */
356	if (offNextMap > offFile)
357	{
358	uint32_t cbZero = offNextMap - offFile;
359	if (cbZero > cb)
360	{
361	RT_BZERO(pvBuf, cb);
362	break;
363	}
364
365	RT_BZERO(pvBuf, cbZero);
366	offFile += cbZero;
367	cb -= cbZero;
368	pvBuf = (char *)pvBuf + cbZero;
369	}
370
371	pThis->iHint = ++i;
372	}
373
374	return VINF_SUCCESS;
375	}
376
377
378	/** @callback_method_impl{PFNRTLDRRDRMEMDTOR} */
379	static DECLCALLBACK(void) dbgDiggerWinNtRdr_Dtor(void *pvUser)
380	{
381	PDBGDIGGERWINNTRDR pThis = (PDBGDIGGERWINNTRDR)pvUser;
382
383	VMR3ReleaseUVM(pThis->pUVM);
384	pThis->pUVM = NULL;
385	RTMemFree(pvUser);
386	}
387
388
389	/**
390	* Checks if the section headers look okay.
391	*
392	* @returns true / false.
393	* @param paShs Pointer to the section headers.
394	* @param cShs Number of headers.
395	* @param cbImage The image size reported by NT.
396	* @param uRvaRsrc The RVA of the resource directory. UINT32_MAX if
397	* no resource directory.
398	* @param cbSectAlign The section alignment specified in the header.
399	* @param pcbImageCorrect The corrected image size. This is derived from
400	* cbImage and virtual range of the section tables.
401	*
402	* The problem is that NT may choose to drop the
403	* last pages in images it loads early, starting at
404	* the resource directory. These images will have
405	* a page aligned cbImage.
406	*/
407	static bool dbgDiggerWinNtCheckSectHdrsAndImgSize(PCIMAGE_SECTION_HEADER paShs, uint32_t cShs, uint32_t cbImage,
408	uint32_t uRvaRsrc, uint32_t cbSectAlign, uint32_t *pcbImageCorrect)
409	{
410	*pcbImageCorrect = cbImage;
411
412	for (uint32_t i = 0; i < cShs; i++)
413	{
414	if (!paShs[i].Name[0])
415	{
416	Log(("DigWinNt: Section header #%u has no name\n", i));
417	return false;
418	}
419
420	if (paShs[i].Characteristics & IMAGE_SCN_TYPE_NOLOAD)
421	continue;
422
423	/* Check that sizes are within the same range and that both sizes and
424	addresses are within reasonable limits. */
425	if ( RT_ALIGN(paShs[i].Misc.VirtualSize, _64K) < RT_ALIGN(paShs[i].SizeOfRawData, _64K)
426	\|\| paShs[i].Misc.VirtualSize >= _1G
427	\|\| paShs[i].SizeOfRawData >= _1G)
428	{
429	Log(("DigWinNt: Section header #%u has a VirtualSize=%#x and SizeOfRawData=%#x, that's too much data!\n",
430	i, paShs[i].Misc.VirtualSize, paShs[i].SizeOfRawData));
431	return false;
432	}
433	uint32_t uRvaEnd = paShs[i].VirtualAddress + paShs[i].Misc.VirtualSize;
434	if (uRvaEnd >= _1G \|\| uRvaEnd < paShs[i].VirtualAddress)
435	{
436	Log(("DigWinNt: Section header #%u has a VirtualSize=%#x and VirtualAddr=%#x, %#x in total, that's too much!\n",
437	i, paShs[i].Misc.VirtualSize, paShs[i].VirtualAddress, uRvaEnd));
438	return false;
439	}
440
441	/* Check for images chopped off around '.rsrc'. */
442	if ( cbImage < uRvaEnd
443	&& uRvaEnd >= uRvaRsrc)
444	cbImage = RT_ALIGN(uRvaEnd, cbSectAlign);
445
446	/* Check that the section is within the image. */
447	if (uRvaEnd > cbImage)
448	{
449	Log(("DigWinNt: Section header #%u has a virtual address range beyond the image: %#x TO %#x cbImage=%#x\n",
450	i, paShs[i].VirtualAddress, uRvaEnd, cbImage));
451	return false;
452	}
453	}
454
455	Assert(pcbImageCorrect == cbImage \|\| !(pcbImageCorrect & 0xfff));
456	*pcbImageCorrect = cbImage;
457	return true;
458	}
459
460
461	/**
462	* Create a loader module for the in-guest-memory PE module.
463	*/
464	static int dbgDiggerWinNtCreateLdrMod(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName, PCDBGFADDRESS pImageAddr,
465	uint32_t cbImage, uint8_t *pbBuf, size_t cbBuf,
466	uint32_t offHdrs, PCNTHDRS pHdrs, PRTLDRMOD phLdrMod)
467	{
468	/*
469	* Allocate and create a reader instance.
470	*/
471	uint32_t const cShs = WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections);
472	PDBGDIGGERWINNTRDR pRdr = (PDBGDIGGERWINNTRDR)RTMemAlloc(RT_OFFSETOF(DBGDIGGERWINNTRDR, aMappings[cShs + 2]));
473	if (!pRdr)
474	return VERR_NO_MEMORY;
475
476	VMR3RetainUVM(pUVM);
477	pRdr->pUVM = pUVM;
478	pRdr->ImageAddr = *pImageAddr;
479	pRdr->cbImage = cbImage;
480	pRdr->cbCorrectImageSize = cbImage;
481	pRdr->offSizeOfImage = UINT32_MAX;
482	pRdr->iHint = 0;
483
484	/*
485	* Use the section table to construct a more accurate view of the file/
486	* image if it's in the buffer (it should be).
487	*/
488	uint32_t uRvaRsrc = UINT32_MAX;
489	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).Size > 0)
490	uRvaRsrc = WINNT_UNION(pThis, pHdrs, OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress;
491	uint32_t offShs = offHdrs
492	+ ( pThis->f32Bit
493	? pHdrs->vX_32.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader)
494	: pHdrs->vX_64.FileHeader.SizeOfOptionalHeader + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader));
495	uint32_t cbShs = cShs * sizeof(IMAGE_SECTION_HEADER);
496	PCIMAGE_SECTION_HEADER paShs = (PCIMAGE_SECTION_HEADER)(pbBuf + offShs);
497	if ( offShs + cbShs <= RT_MIN(cbImage, cbBuf)
498	&& dbgDiggerWinNtCheckSectHdrsAndImgSize(paShs, cShs, cbImage, uRvaRsrc,
499	WINNT_UNION(pThis, pHdrs, OptionalHeader.SectionAlignment),
500	&pRdr->cbCorrectImageSize))
501	{
502	pRdr->cMappings = 0;
503
504	for (uint32_t i = 0; i < cShs; i++)
505	if ( paShs[i].SizeOfRawData > 0
506	&& paShs[i].PointerToRawData > 0)
507	{
508	uint32_t j = 1;
509	if (!pRdr->cMappings)
510	pRdr->cMappings++;
511	else
512	{
513	while (j < pRdr->cMappings && pRdr->aMappings[j].offFile < paShs[i].PointerToRawData)
514	j++;
515	if (j < pRdr->cMappings)
516	memmove(&pRdr->aMappings[j + 1], &pRdr->aMappings[j], (pRdr->cMappings - j) * sizeof(pRdr->aMappings));
517	}
518	pRdr->aMappings[j].offFile = paShs[i].PointerToRawData;
519	pRdr->aMappings[j].offMem = paShs[i].VirtualAddress;
520	pRdr->aMappings[j].cbMem = i + 1 < cShs
521	? paShs[i + 1].VirtualAddress - paShs[i].VirtualAddress
522	: paShs[i].Misc.VirtualSize;
523	if (j == pRdr->cMappings)
524	pRdr->cbImage = paShs[i].PointerToRawData + paShs[i].SizeOfRawData;
525	pRdr->cMappings++;
526	}
527
528	/* Insert the mapping of the headers that isn't covered by the section table. */
529	pRdr->aMappings[0].offFile = 0;
530	pRdr->aMappings[0].offMem = 0;
531	pRdr->aMappings[0].cbMem = pRdr->cMappings ? pRdr->aMappings[1].offFile : pRdr->cbImage;
532
533	int j = pRdr->cMappings - 1;
534	while (j-- > 0)
535	{
536	uint32_t cbFile = pRdr->aMappings[j + 1].offFile - pRdr->aMappings[j].offFile;
537	if (pRdr->aMappings[j].cbMem > cbFile)
538	pRdr->aMappings[j].cbMem = cbFile;
539	}
540	}
541	else
542	{
543	/*
544	* Fallback, fake identity mapped file data.
545	*/
546	pRdr->cMappings = 1;
547	pRdr->aMappings[0].offFile = 0;
548	pRdr->aMappings[0].offMem = 0;
549	pRdr->aMappings[0].cbMem = pRdr->cbImage;
550	}
551
552	/* Enable the SizeOfImage patching if necessary. */
553	if (pRdr->cbCorrectImageSize != cbImage)
554	{
555	Log(("DigWinNT: The image is really %#x bytes long, not %#x as mapped by NT!\n", pRdr->cbCorrectImageSize, cbImage));
556	pRdr->offSizeOfImage = pThis->f32Bit
557	? offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS32, OptionalHeader.SizeOfImage)
558	: offHdrs + RT_OFFSETOF(IMAGE_NT_HEADERS64, OptionalHeader.SizeOfImage);
559	}
560
561	/*
562	* Call the loader to open the PE image for debugging.
563	* Note! It always calls pfnDtor.
564	*/
565	RTLDRMOD hLdrMod;
566	int rc = RTLdrOpenInMemory(pszName, RTLDR_O_FOR_DEBUG, RTLDRARCH_WHATEVER, pRdr->cbImage,
567	dbgDiggerWinNtRdr_Read, dbgDiggerWinNtRdr_Dtor, pRdr,
568	&hLdrMod);
569	if (RT_SUCCESS(rc))
570	*phLdrMod = hLdrMod;
571	else
572	*phLdrMod = NIL_RTLDRMOD;
573	return rc;
574	}
575
576
577	/**
578	* Process a PE image found in guest memory.
579	*
580	* @param pThis The instance data.
581	* @param pUVM The user mode VM handle.
582	* @param pszName The image name.
583	* @param pImageAddr The image address.
584	* @param cbImage The size of the image.
585	* @param pbBuf Scratch buffer containing the first
586	* RT_MIN(cbBuf, cbImage) bytes of the image.
587	* @param cbBuf The scratch buffer size.
588	*/
589	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char *pszName,
590	PCDBGFADDRESS pImageAddr, uint32_t cbImage,
591	uint8_t *pbBuf, size_t cbBuf)
592	{
593	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
594
595	/*
596	* Do some basic validation first.
597	* This is the usual exteremely verbose and messy code...
598	*/
599	Assert(cbBuf >= sizeof(IMAGE_NT_HEADERS64));
600	if ( cbImage < sizeof(IMAGE_NT_HEADERS64)
601	\|\| cbImage >= _1M * 256)
602	{
603	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
604	return;
605	}
606
607	/* Dig out the NT/PE headers. */
608	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbBuf;
609	PCNTHDRS pHdrs;
610	uint32_t offHdrs;
611	if (pMzHdr->e_magic != IMAGE_DOS_SIGNATURE)
612	{
613	offHdrs = 0;
614	pHdrs = (PCNTHDRS)pbBuf;
615	}
616	else if ( pMzHdr->e_lfanew >= cbImage
617	\|\| pMzHdr->e_lfanew < sizeof(*pMzHdr)
618	\|\| pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) > cbImage)
619	{
620	Log(("DigWinNt: %s: PE header to far into image: %#x cbImage=%#x\n", pszName, pMzHdr->e_lfanew, cbImage));
621	return;
622	}
623	else if ( pMzHdr->e_lfanew < cbBuf
624	&& pMzHdr->e_lfanew + sizeof(IMAGE_NT_HEADERS64) <= cbBuf)
625	{
626	offHdrs = pMzHdr->e_lfanew;
627	pHdrs = (NTHDRS const *)(pbBuf + offHdrs);
628	}
629	else
630	{
631	Log(("DigWinNt: %s: PE header to far into image (lazy bird): %#x\n", pszName, pMzHdr->e_lfanew));
632	return;
633	}
634	if (pHdrs->vX_32.Signature != IMAGE_NT_SIGNATURE)
635	{
636	Log(("DigWinNt: %s: Bad PE signature: %#x\n", pszName, pHdrs->vX_32.Signature));
637	return;
638	}
639
640	/* The file header is the same on both archs */
641	if (pHdrs->vX_32.FileHeader.Machine != (pThis->f32Bit ? IMAGE_FILE_MACHINE_I386 : IMAGE_FILE_MACHINE_AMD64))
642	{
643	Log(("DigWinNt: %s: Invalid FH.Machine: %#x\n", pszName, pHdrs->vX_32.FileHeader.Machine));
644	return;
645	}
646	if (pHdrs->vX_32.FileHeader.SizeOfOptionalHeader != (pThis->f32Bit ? sizeof(IMAGE_OPTIONAL_HEADER32) : sizeof(IMAGE_OPTIONAL_HEADER64)))
647	{
648	Log(("DigWinNt: %s: Invalid FH.SizeOfOptionalHeader: %#x\n", pszName, pHdrs->vX_32.FileHeader.SizeOfOptionalHeader));
649	return;
650	}
651	if (WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections) > 64)
652	{
653	Log(("DigWinNt: %s: Too many sections: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, FileHeader.NumberOfSections)));
654	return;
655	}
656
657	const uint32_t TimeDateStamp = pHdrs->vX_32.FileHeader.TimeDateStamp;
658
659	/* The optional header is not... */
660	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic) != (pThis->f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC))
661	{
662	Log(("DigWinNt: %s: Invalid OH.Magic: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.Magic)));
663	return;
664	}
665	uint32_t cbImageFromHdr = WINNT_UNION(pThis, pHdrs, OptionalHeader.SizeOfImage);
666	if (RT_ALIGN(cbImageFromHdr, _4K) != RT_ALIGN(cbImage, _4K))
667	{
668	Log(("DigWinNt: %s: Invalid OH.SizeOfImage: %#x, expected %#x\n", pszName, cbImageFromHdr, cbImage));
669	return;
670	}
671	if (WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes) != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
672	{
673	Log(("DigWinNt: %s: Invalid OH.NumberOfRvaAndSizes: %#x\n", pszName, WINNT_UNION(pThis, pHdrs, OptionalHeader.NumberOfRvaAndSizes)));
674	return;
675	}
676
677	/*
678	* Create the module using the in memory image first, falling back
679	* on cached image.
680	*/
681	RTLDRMOD hLdrMod;
682	int rc = dbgDiggerWinNtCreateLdrMod(pThis, pUVM, pszName, pImageAddr, cbImage, pbBuf, cbBuf, offHdrs, pHdrs,
683	&hLdrMod);
684	if (RT_FAILURE(rc))
685	hLdrMod = NIL_RTLDRMOD;
686
687	RTDBGMOD hMod;
688	rc = RTDbgModCreateFromPeImage(&hMod, pszName, NULL, hLdrMod,
689	cbImageFromHdr, TimeDateStamp, DBGFR3AsGetConfig(pUVM));
690	if (RT_FAILURE(rc))
691	{
692	/*
693	* Final fallback is a container module.
694	*/
695	rc = RTDbgModCreate(&hMod, pszName, cbImage, 0);
696	if (RT_FAILURE(rc))
697	return;
698
699	rc = RTDbgModSymbolAdd(hMod, "Headers", 0 /iSeg/, 0, cbImage, 0 /fFlags/, NULL);
700	AssertRC(rc);
701	}
702
703	/* Tag the module. */
704	rc = RTDbgModSetTag(hMod, DIG_WINNT_MOD_TAG);
705	AssertRC(rc);
706
707	/*
708	* Link the module.
709	*/
710	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
711	if (hAs != NIL_RTDBGAS)
712	rc = RTDbgAsModuleLink(hAs, hMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
713	else
714	rc = VERR_INTERNAL_ERROR;
715	RTDbgModRelease(hMod);
716	RTDbgAsRelease(hAs);
717	}
718
719
720	/**
721	* @copydoc DBGFOSREG::pfnQueryInterface
722	*/
723	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
724	{
725	RT_NOREF3(pUVM, pvData, enmIf);
726	return NULL;
727	}
728
729
730	/**
731	* @copydoc DBGFOSREG::pfnQueryVersion
732	*/
733	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
734	{
735	RT_NOREF1(pUVM);
736	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
737	Assert(pThis->fValid);
738	const char *pszNtProductType;
739	switch (pThis->NtProductType)
740	{
741	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
742	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
743	case kNtProductType_Server: pszNtProductType = "-Server"; break;
744	default: pszNtProductType = ""; break;
745	}
746	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
747	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
748	return VINF_SUCCESS;
749	}
750
751
752	/**
753	* @copydoc DBGFOSREG::pfnTerm
754	*/
755	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
756	{
757	RT_NOREF1(pUVM);
758	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
759	Assert(pThis->fValid);
760
761	pThis->fValid = false;
762	}
763
764
765	/**
766	* @copydoc DBGFOSREG::pfnRefresh
767	*/
768	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
769	{
770	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
771	NOREF(pThis);
772	Assert(pThis->fValid);
773
774	/*
775	* For now we'll flush and reload everything.
776	*/
777	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
778	if (hDbgAs != NIL_RTDBGAS)
779	{
780	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
781	while (iMod-- > 0)
782	{
783	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
784	if (hMod != NIL_RTDBGMOD)
785	{
786	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
787	{
788	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
789	AssertRC(rc);
790	}
791	RTDbgModRelease(hMod);
792	}
793	}
794	RTDbgAsRelease(hDbgAs);
795	}
796
797	dbgDiggerWinNtTerm(pUVM, pvData);
798	return dbgDiggerWinNtInit(pUVM, pvData);
799	}
800
801
802	/**
803	* @copydoc DBGFOSREG::pfnInit
804	*/
805	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
806	{
807	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
808	Assert(!pThis->fValid);
809
810	union
811	{
812	uint8_t au8[0x2000];
813	RTUTF16 wsz[0x2000/2];
814	NTKUSERSHAREDDATA UserSharedData;
815	} u;
816	DBGFADDRESS Addr;
817	int rc;
818
819	/*
820	* Figure the NT version.
821	*/
822	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
823	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
824	if (RT_FAILURE(rc))
825	return rc;
826	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
827	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
828	: kNtProductType_Invalid;
829	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
830	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
831
832	/*
833	* Dig out the module chain.
834	*/
835	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
836	Addr = pThis->KernelMteAddr;
837	do
838	{
839	/* Read the validate the MTE. */
840	NTMTE Mte;
841	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
842	if (RT_FAILURE(rc))
843	break;
844	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
845	{
846	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
847	break;
848	}
849	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
850	{
851	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
852	break;
853	}
854	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
855	{
856	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
857	break;
858	}
859	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
860	{
861	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
862	break;
863	}
864	if ( !WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase))
865	\|\| WINNT_UNION(pThis, &Mte, SizeOfImage) > _1M*256
866	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > WINNT_UNION(pThis, &Mte, SizeOfImage) )
867	{
868	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
869	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), WINNT_UNION(pThis, &Mte, SizeOfImage), WINNT_UNION(pThis, &Mte, DllBase)));
870	break;
871	}
872
873	/* Read the full name. */
874	DBGFADDRESS AddrName;
875	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
876	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
877	if (cbName < sizeof(u))
878	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
879	else
880	rc = VERR_OUT_OF_RANGE;
881	if (RT_FAILURE(rc))
882	{
883	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
884	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
885	if (cbName < sizeof(u))
886	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
887	else
888	rc = VERR_OUT_OF_RANGE;
889	}
890	if (RT_SUCCESS(rc))
891	{
892	u.wsz[cbName/2] = '\0';
893	char *pszName;
894	rc = RTUtf16ToUtf8(u.wsz, &pszName);
895	if (RT_SUCCESS(rc))
896	{
897	/* Read the start of the PE image and pass it along to a worker. */
898	DBGFADDRESS ImageAddr;
899	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
900	uint32_t cbImageBuf = RT_MIN(sizeof(u), WINNT_UNION(pThis, &Mte, SizeOfImage));
901	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &ImageAddr, &u, cbImageBuf);
902	if (RT_SUCCESS(rc))
903	dbgDiggerWinNtProcessImage(pThis,
904	pUVM,
905	pszName,
906	&ImageAddr,
907	WINNT_UNION(pThis, &Mte, SizeOfImage),
908	&u.au8[0],
909	sizeof(u));
910	RTStrFree(pszName);
911	}
912	}
913
914	/* next */
915	AddrPrev = Addr;
916	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
917	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
918	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
919
920	pThis->fValid = true;
921	return VINF_SUCCESS;
922	}
923
924
925	/**
926	* @copydoc DBGFOSREG::pfnProbe
927	*/
928	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
929	{
930	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
931	DBGFADDRESS Addr;
932	union
933	{
934	uint8_t au8[8192];
935	uint16_t au16[8192/2];
936	uint32_t au32[8192/4];
937	IMAGE_DOS_HEADER MzHdr;
938	RTUTF16 wsz[8192/2];
939	} u;
940
941	union
942	{
943	NTMTE32 v32;
944	NTMTE64 v64;
945	} uMte, uMte2, uMte3;
946
947	/*
948	* Look for the PAGELK section name that seems to be a part of all kernels.
949	* Then try find the module table entry for it. Since it's the first entry
950	* in the PsLoadedModuleList we can easily validate the list head and report
951	* success.
952	*/
953	CPUMMODE enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
954	uint64_t const uStart = enmMode == CPUMMODE_LONG ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
955	uint64_t const uEnd = enmMode == CPUMMODE_LONG ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
956	DBGFADDRESS KernelAddr;
957	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uStart);
958	KernelAddr.FlatPtr < uEnd;
959	KernelAddr.FlatPtr += PAGE_SIZE)
960	{
961	int rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
962	1, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
963	if (RT_FAILURE(rc))
964	break;
965	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
966
967	/* MZ + PE header. */
968	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
969	if ( RT_SUCCESS(rc)
970	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
971	&& !(u.MzHdr.e_lfanew & 0x7)
972	&& u.MzHdr.e_lfanew >= 0x080
973	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
974	{
975	if (enmMode != CPUMMODE_LONG)
976	{
977	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
978	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
979	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
980	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
981	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
982	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
983	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
984	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
985	)
986	{
987	/* Find the MTE. */
988	RT_ZERO(uMte);
989	uMte.v32.DllBase = KernelAddr.FlatPtr;
990	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
991	uMte.v32.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
992	DBGFADDRESS HitAddr;
993	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
994	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
995	while (RT_SUCCESS(rc))
996	{
997	/* check the name. */
998	DBGFADDRESS MteAddr = HitAddr;
999	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
1000	&uMte2.v32, sizeof(uMte2.v32));
1001	if ( RT_SUCCESS(rc)
1002	&& uMte2.v32.DllBase == uMte.v32.DllBase
1003	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
1004	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
1005	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
1006	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
1007	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
1008	&& uMte2.v32.BaseDllName.Length <= 128
1009	&& uMte2.v32.FullDllName.Length <= 260
1010	)
1011	{
1012	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
1013	u.wsz, uMte2.v32.BaseDllName.Length);
1014	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
1015	if ( RT_SUCCESS(rc)
1016	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1017	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1018	)
1019	)
1020	{
1021	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1022	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
1023	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
1024	if ( RT_SUCCESS(rc)
1025	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1026	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
1027	{
1028	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1029	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
1030	pThis->KernelAddr = KernelAddr;
1031	pThis->KernelMteAddr = MteAddr;
1032	pThis->PsLoadedModuleListAddr = Addr;
1033	pThis->f32Bit = true;
1034	return true;
1035	}
1036	}
1037	else if (RT_SUCCESS(rc))
1038	{
1039	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1040	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
1041	break; /* Not NT kernel */
1042	}
1043	}
1044
1045	/* next */
1046	DBGFR3AddrAdd(&HitAddr, 4);
1047	if (HitAddr.FlatPtr < uEnd)
1048	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1049	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1050	else
1051	rc = VERR_DBGF_MEM_NOT_FOUND;
1052	}
1053	}
1054	}
1055	else
1056	{
1057	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
1058	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
1059	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
1060	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
1061	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
1062	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
1063	== IMAGE_FILE_EXECUTABLE_IMAGE
1064	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
1065	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
1066	)
1067	{
1068	/* Find the MTE. */
1069	RT_ZERO(uMte.v64);
1070	uMte.v64.DllBase = KernelAddr.FlatPtr;
1071	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
1072	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
1073	DBGFADDRESS ScanAddr;
1074	DBGFADDRESS HitAddr;
1075	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
1076	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
1077	while (RT_SUCCESS(rc))
1078	{
1079	/* Read the start of the MTE and check some basic members. */
1080	DBGFADDRESS MteAddr = HitAddr;
1081	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
1082	&uMte2.v64, sizeof(uMte2.v64));
1083	if ( RT_SUCCESS(rc)
1084	&& uMte2.v64.DllBase == uMte.v64.DllBase
1085	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
1086	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
1087	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
1088	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
1089	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
1090	&& uMte2.v64.BaseDllName.Length <= 128
1091	&& uMte2.v64.FullDllName.Length <= 260
1092	)
1093	{
1094	/* Try read the base name and compare with known NT kernel names. */
1095	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1096	u.wsz, uMte2.v64.BaseDllName.Length);
1097	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1098	if ( RT_SUCCESS(rc)
1099	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1100	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1101	)
1102	)
1103	{
1104	/* Read the link entry of the previous entry in the list and check that its
1105	forward pointer points at the MTE we've found. */
1106	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1107	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1108	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1109	if ( RT_SUCCESS(rc)
1110	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1111	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1112	{
1113	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1114	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1115	pThis->KernelAddr = KernelAddr;
1116	pThis->KernelMteAddr = MteAddr;
1117	pThis->PsLoadedModuleListAddr = Addr;
1118	pThis->f32Bit = false;
1119	return true;
1120	}
1121	}
1122	else if (RT_SUCCESS(rc))
1123	{
1124	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1125	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1126	break; /* Not NT kernel */
1127	}
1128	}
1129
1130	/* next */
1131	DBGFR3AddrAdd(&HitAddr, 8);
1132	if (HitAddr.FlatPtr < uEnd)
1133	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1134	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1135	else
1136	rc = VERR_DBGF_MEM_NOT_FOUND;
1137	}
1138	}
1139	}
1140	}
1141	}
1142	return false;
1143	}
1144
1145
1146	/**
1147	* @copydoc DBGFOSREG::pfnDestruct
1148	*/
1149	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1150	{
1151	RT_NOREF2(pUVM, pvData);
1152	}
1153
1154
1155	/**
1156	* @copydoc DBGFOSREG::pfnConstruct
1157	*/
1158	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1159	{
1160	RT_NOREF1(pUVM);
1161	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1162	pThis->fValid = false;
1163	pThis->f32Bit = false;
1164	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1165	return VINF_SUCCESS;
1166	}
1167
1168
1169	const DBGFOSREG g_DBGDiggerWinNt =
1170	{
1171	/* .u32Magic = */ DBGFOSREG_MAGIC,
1172	/* .fFlags = */ 0,
1173	/* .cbData = */ sizeof(DBGDIGGERWINNT),
1174	/* .szName = */ "WinNT",
1175	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1176	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1177	/* .pfnProbe = */ dbgDiggerWinNtProbe,
1178	/* .pfnInit = */ dbgDiggerWinNtInit,
1179	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1180	/* .pfnTerm = */ dbgDiggerWinNtTerm,
1181	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1182	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1183	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1184	};
1185

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 62840

Download in other formats: