DBGPlugInWinNt.cpp@ 76573

Last change on this file since 76573 was 76553, checked in by vboxsync, 6 years ago
scm --update-copyright-year
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 45.4 KB

Line
1	/* $Id: DBGPlugInWinNt.cpp 76553 2019-01-01 01:45:53Z vboxsync $ */
2	/** @file
3	* DBGPlugInWindows - Debugger and Guest OS Digger Plugin For Windows NT.
4	*/
5
6	/*
7	* Copyright (C) 2009-2019 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DBGF /// @todo add new log group.
23	#include "DBGPlugIns.h"
24	#include <VBox/vmm/dbgf.h>
25	#include <VBox/vmm/cpumctx.h>
26	#include <VBox/vmm/mm.h>
27	#include <VBox/err.h>
28	#include <VBox/param.h>
29	#include <iprt/ctype.h>
30	#include <iprt/ldr.h>
31	#include <iprt/mem.h>
32	#include <iprt/path.h>
33	#include <iprt/stream.h>
34	#include <iprt/string.h>
35	#include <iprt/utf16.h>
36	#include <iprt/formats/pecoff.h>
37	#include <iprt/formats/mz.h>
38	#include <iprt/nt/nt-structures.h>
39
40
41	/*********************************************************************************************************************************
42	* Structures and Typedefs *
43	*********************************************************************************************************************************/
44
45	/** @name Internal WinNT structures
46	* @{ */
47	/**
48	* PsLoadedModuleList entry for 32-bit NT aka LDR_DATA_TABLE_ENTRY.
49	* Tested with XP.
50	*/
51	typedef struct NTMTE32
52	{
53	struct
54	{
55	uint32_t Flink;
56	uint32_t Blink;
57	} InLoadOrderLinks,
58	InMemoryOrderModuleList,
59	InInitializationOrderModuleList;
60	uint32_t DllBase;
61	uint32_t EntryPoint;
62	/** @note This field is not a size in NT 3.1. It's NULL for images loaded by the
63	* boot loader, for other images it looks like some kind of pointer. */
64	uint32_t SizeOfImage;
65	struct
66	{
67	uint16_t Length;
68	uint16_t MaximumLength;
69	uint32_t Buffer;
70	} FullDllName,
71	BaseDllName;
72	uint32_t Flags;
73	uint16_t LoadCount;
74	uint16_t TlsIndex;
75	/* ... there is more ... */
76	} NTMTE32;
77	typedef NTMTE32 *PNTMTE32;
78
79	/**
80	* PsLoadedModuleList entry for 64-bit NT aka LDR_DATA_TABLE_ENTRY.
81	*/
82	typedef struct NTMTE64
83	{
84	struct
85	{
86	uint64_t Flink;
87	uint64_t Blink;
88	} InLoadOrderLinks, /*< 0x00 /
89	InMemoryOrderModuleList, /*< 0x10 /
90	InInitializationOrderModuleList; /*< 0x20 /
91	uint64_t DllBase; /*< 0x30 /
92	uint64_t EntryPoint; /*< 0x38 /
93	uint32_t SizeOfImage; /*< 0x40 /
94	uint32_t Alignment; /*< 0x44 /
95	struct
96	{
97	uint16_t Length; /*< 0x48,0x58 /
98	uint16_t MaximumLength; /*< 0x4a,0x5a /
99	uint32_t Alignment; /*< 0x4c,0x5c /
100	uint64_t Buffer; /*< 0x50,0x60 /
101	} FullDllName, /*< 0x48 /
102	BaseDllName; /*< 0x58 /
103	uint32_t Flags; /*< 0x68 /
104	uint16_t LoadCount; /*< 0x6c /
105	uint16_t TlsIndex; /*< 0x6e /
106	/* ... there is more ... */
107	} NTMTE64;
108	typedef NTMTE64 *PNTMTE64;
109
110	/** MTE union. */
111	typedef union NTMTE
112	{
113	NTMTE32 vX_32;
114	NTMTE64 vX_64;
115	} NTMTE;
116	typedef NTMTE *PNTMTE;
117
118
119	/**
120	* The essential bits of the KUSER_SHARED_DATA structure.
121	*/
122	typedef struct NTKUSERSHAREDDATA
123	{
124	uint32_t TickCountLowDeprecated;
125	uint32_t TickCountMultiplier;
126	struct
127	{
128	uint32_t LowPart;
129	int32_t High1Time;
130	int32_t High2Time;
131
132	} InterruptTime,
133	SystemTime,
134	TimeZoneBias;
135	uint16_t ImageNumberLow;
136	uint16_t ImageNumberHigh;
137	RTUTF16 NtSystemRoot[260];
138	uint32_t MaxStackTraceDepth;
139	uint32_t CryptoExponent;
140	uint32_t TimeZoneId;
141	uint32_t LargePageMinimum;
142	uint32_t Reserved2[7];
143	uint32_t NtProductType;
144	uint8_t ProductTypeIsValid;
145	uint8_t abPadding[3];
146	uint32_t NtMajorVersion;
147	uint32_t NtMinorVersion;
148	/* uint8_t ProcessorFeatures[64];
149	...
150	*/
151	} NTKUSERSHAREDDATA;
152	typedef NTKUSERSHAREDDATA *PNTKUSERSHAREDDATA;
153
154	/** KI_USER_SHARED_DATA for i386 */
155	#define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000)
156	/** KI_USER_SHARED_DATA for AMD64 */
157	#define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000)
158
159	/** NTKUSERSHAREDDATA::NtProductType */
160	typedef enum NTPRODUCTTYPE
161	{
162	kNtProductType_Invalid = 0,
163	kNtProductType_WinNt = 1,
164	kNtProductType_LanManNt,
165	kNtProductType_Server
166	} NTPRODUCTTYPE;
167
168
169	/** NT image header union. */
170	typedef union NTHDRSU
171	{
172	IMAGE_NT_HEADERS32 vX_32;
173	IMAGE_NT_HEADERS64 vX_64;
174	} NTHDRS;
175	/** Pointer to NT image header union. */
176	typedef NTHDRS *PNTHDRS;
177	/** Pointer to const NT image header union. */
178	typedef NTHDRS const *PCNTHDRS;
179
180	/** @} */
181
182
183
184	typedef enum DBGDIGGERWINNTVER
185	{
186	DBGDIGGERWINNTVER_UNKNOWN,
187	DBGDIGGERWINNTVER_3_1,
188	DBGDIGGERWINNTVER_3_5,
189	DBGDIGGERWINNTVER_4_0,
190	DBGDIGGERWINNTVER_5_0,
191	DBGDIGGERWINNTVER_5_1,
192	DBGDIGGERWINNTVER_6_0
193	} DBGDIGGERWINNTVER;
194
195	/**
196	* WinNT guest OS digger instance data.
197	*/
198	typedef struct DBGDIGGERWINNT
199	{
200	/** Whether the information is valid or not.
201	* (For fending off illegal interface method calls.) */
202	bool fValid;
203	/** 32-bit (true) or 64-bit (false) */
204	bool f32Bit;
205	/** Set if NT 3.1 was detected.
206	* This implies both Misc.VirtualSize and NTMTE32::SizeOfImage are zero. */
207	bool fNt31;
208
209	/** The NT version. */
210	DBGDIGGERWINNTVER enmVer;
211	/** NTKUSERSHAREDDATA::NtProductType */
212	NTPRODUCTTYPE NtProductType;
213	/** NTKUSERSHAREDDATA::NtMajorVersion */
214	uint32_t NtMajorVersion;
215	/** NTKUSERSHAREDDATA::NtMinorVersion */
216	uint32_t NtMinorVersion;
217
218	/** The address of the ntoskrnl.exe image. */
219	DBGFADDRESS KernelAddr;
220	/** The address of the ntoskrnl.exe module table entry. */
221	DBGFADDRESS KernelMteAddr;
222	/** The address of PsLoadedModuleList. */
223	DBGFADDRESS PsLoadedModuleListAddr;
224	} DBGDIGGERWINNT;
225	/** Pointer to the linux guest OS digger instance data. */
226	typedef DBGDIGGERWINNT *PDBGDIGGERWINNT;
227
228
229	/**
230	* The WinNT digger's loader reader instance data.
231	*/
232	typedef struct DBGDIGGERWINNTRDR
233	{
234	/** The VM handle (referenced). */
235	PUVM pUVM;
236	/** The image base. */
237	DBGFADDRESS ImageAddr;
238	/** The image size. */
239	uint32_t cbImage;
240	/** The file offset of the SizeOfImage field in the optional header if it
241	* needs patching, otherwise set to UINT32_MAX. */
242	uint32_t offSizeOfImage;
243	/** The correct image size. */
244	uint32_t cbCorrectImageSize;
245	/** Number of entries in the aMappings table. */
246	uint32_t cMappings;
247	/** Mapping hint. */
248	uint32_t iHint;
249	/** Mapping file offset to memory offsets, ordered by file offset. */
250	struct
251	{
252	/** The file offset. */
253	uint32_t offFile;
254	/** The size of this mapping. */
255	uint32_t cbMem;
256	/** The offset to the memory from the start of the image. */
257	uint32_t offMem;
258	} aMappings[1];
259	} DBGDIGGERWINNTRDR;
260	/** Pointer a WinNT loader reader instance data. */
261	typedef DBGDIGGERWINNTRDR *PDBGDIGGERWINNTRDR;
262
263
264	/*********************************************************************************************************************************
265	* Defined Constants And Macros *
266	*********************************************************************************************************************************/
267	/** Validates a 32-bit Windows NT kernel address */
268	#define WINNT32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
269	/** Validates a 64-bit Windows NT kernel address */
270	#define WINNT64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
271	/** Validates a kernel address. */
272	#define WINNT_VALID_ADDRESS(pThis, Addr) ((pThis)->f32Bit ? WINNT32_VALID_ADDRESS(Addr) : WINNT64_VALID_ADDRESS(Addr))
273	/** Versioned and bitness wrapper. */
274	#define WINNT_UNION(pThis, pUnion, Member) ((pThis)->f32Bit ? (pUnion)->vX_32. Member : (pUnion)->vX_64. Member )
275
276	/** The length (in chars) of the kernel file name (no path). */
277	#define WINNT_KERNEL_BASE_NAME_LEN 12
278
279	/** WindowsNT on little endian ASCII systems. */
280	#define DIG_WINNT_MOD_TAG UINT64_C(0x54696e646f774e54)
281
282
283	/*********************************************************************************************************************************
284	* Internal Functions *
285	*********************************************************************************************************************************/
286	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData);
287
288
289	/*********************************************************************************************************************************
290	* Global Variables *
291	*********************************************************************************************************************************/
292	/** Kernel names. */
293	static const RTUTF16 g_wszKernelNames[][WINNT_KERNEL_BASE_NAME_LEN + 1] =
294	{
295	{ 'n', 't', 'o', 's', 'k', 'r', 'n', 'l', '.', 'e', 'x', 'e' }
296	};
297
298
299
300	/**
301	* Process a PE image found in guest memory.
302	*
303	* @param pThis The instance data.
304	* @param pUVM The user mode VM handle.
305	* @param pszName The module name.
306	* @param pszFilename The image filename.
307	* @param pImageAddr The image address.
308	* @param cbImage The size of the image.
309	*/
310	static void dbgDiggerWinNtProcessImage(PDBGDIGGERWINNT pThis, PUVM pUVM, const char pszName, const char pszFilename,
311	PCDBGFADDRESS pImageAddr, uint32_t cbImage)
312	{
313	LogFlow(("DigWinNt: %RGp %#x %s\n", pImageAddr->FlatPtr, cbImage, pszName));
314
315	/*
316	* Do some basic validation first.
317	*/
318	if ( (cbImage < sizeof(IMAGE_NT_HEADERS64) && !pThis->fNt31)
319	\|\| cbImage >= _1M * 256)
320	{
321	Log(("DigWinNt: %s: Bad image size: %#x\n", pszName, cbImage));
322	return;
323	}
324
325	/*
326	* Use the common in-memory module reader to create a debug module.
327	*/
328	RTERRINFOSTATIC ErrInfo;
329	RTDBGMOD hDbgMod = NIL_RTDBGMOD;
330	int rc = DBGFR3ModInMem(pUVM, pImageAddr, pThis->fNt31 ? DBGFMODINMEM_F_PE_NT31 : 0, pszName, pszFilename,
331	pThis->f32Bit ? RTLDRARCH_X86_32 : RTLDRARCH_AMD64, cbImage,
332	&hDbgMod, RTErrInfoInitStatic(&ErrInfo));
333	if (RT_SUCCESS(rc))
334	{
335	/*
336	* Tag the module.
337	*/
338	rc = RTDbgModSetTag(hDbgMod, DIG_WINNT_MOD_TAG);
339	AssertRC(rc);
340
341	/*
342	* Link the module.
343	*/
344	RTDBGAS hAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
345	if (hAs != NIL_RTDBGAS)
346	rc = RTDbgAsModuleLink(hAs, hDbgMod, pImageAddr->FlatPtr, RTDBGASLINK_FLAGS_REPLACE /fFlags/);
347	else
348	rc = VERR_INTERNAL_ERROR;
349	RTDbgModRelease(hDbgMod);
350	RTDbgAsRelease(hAs);
351	}
352	else if (RTErrInfoIsSet(&ErrInfo.Core))
353	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc - %s\n", pszName, rc, ErrInfo.Core.pszMsg));
354	else
355	Log(("DigWinNt: %s: DBGFR3ModInMem failed: %Rrc\n", pszName, rc));
356	}
357
358
359	/**
360	* Generate a debugger compatible module name from a filename.
361	*
362	* @returns Pointer to module name (doesn't need to be pszName).
363	* @param pszFilename The source filename.
364	* @param pszName Buffer to put the module name in.
365	* @param cbName Buffer size.
366	*/
367	static const char dbgDiggerWintNtFilenameToModuleName(const char pszFilename, char *pszName, size_t cbName)
368	{
369	/* Skip to the filename part of the filename. :-) */
370	pszFilename = RTPathFilenameEx(pszFilename, RTPATH_STR_F_STYLE_DOS);
371
372	/* We try use 'nt' for the kernel. */
373	if ( RTStrICmpAscii(pszFilename, "ntoskrnl.exe") == 0
374	\|\| RTStrICmpAscii(pszFilename, "ntkrnlmp.exe") == 0)
375	return "nt";
376
377
378	/* Drop the extension if .dll or .sys. */
379	size_t cchFilename = strlen(pszFilename);
380	if ( cchFilename > 4
381	&& pszFilename[cchFilename - 4] == '.')
382	{
383	if ( RTStrICmpAscii(&pszFilename[cchFilename - 4], ".sys") == 0
384	\|\| RTStrICmpAscii(&pszFilename[cchFilename - 4], ".dll") == 0)
385	cchFilename -= 4;
386	}
387
388	/* Copy and do replacements. */
389	if (cchFilename >= cbName)
390	cchFilename = cbName - 1;
391	size_t off;
392	for (off = 0; off < cchFilename; off++)
393	{
394	char ch = pszFilename[off];
395	if (!RT_C_IS_ALNUM(ch))
396	ch = '_';
397	pszName[off] = ch;
398	}
399	pszName[off] = '\0';
400	return pszName;
401	}
402
403
404	/**
405	* @copydoc DBGFOSREG::pfnStackUnwindAssist
406	*/
407	static DECLCALLBACK(int) dbgDiggerWinNtStackUnwindAssist(PUVM pUVM, void *pvData, VMCPUID idCpu, PDBGFSTACKFRAME pFrame,
408	PRTDBGUNWINDSTATE pState, PCCPUMCTX pInitialCtx, RTDBGAS hAs,
409	uint64_t *puScratch)
410	{
411	Assert(pInitialCtx);
412
413	/*
414	* We want to locate trap frames here. The trap frame structure contains
415	* the 64-bit IRET frame, so given unwind information it's easy to identify
416	* using the return type and frame address.
417	*/
418	if (pFrame->fFlags & DBGFSTACKFRAME_FLAGS_64BIT)
419	{
420	/*
421	* Is this a trap frame? If so, try read the trap frame.
422	*/
423	if ( pFrame->enmReturnType == RTDBGRETURNTYPE_IRET64
424	&& !(pFrame->AddrFrame.FlatPtr & 0x7)
425	&& WINNT64_VALID_ADDRESS(pFrame->AddrFrame.FlatPtr) )
426	{
427	KTRAP_FRAME_AMD64 TrapFrame;
428	RT_ZERO(TrapFrame);
429	uint64_t const uTrapFrameAddr = pFrame->AddrFrame.FlatPtr
430	- RT_UOFFSETOF(KTRAP_FRAME_AMD64, ErrCdOrXcptFrameOrS);
431	int rc = pState->pfnReadStack(pState, uTrapFrameAddr, sizeof(TrapFrame), &TrapFrame);
432	if (RT_SUCCESS(rc))
433	{
434	/* Valid? Not too much else we can check here (EFlags isn't
435	reliable in manually construct frames). */
436	if (TrapFrame.ExceptionActive <= 2)
437	{
438	pFrame->fFlags \|= DBGFSTACKFRAME_FLAGS_TRAP_FRAME;
439
440	/*
441	* Add sure 'register' information from the frame to the frame.
442	*
443	* To avoid code duplication, we do this in two steps in a loop.
444	* The first iteration only figures out how many registers we're
445	* going to save and allocates room for them. The second iteration
446	* does the actual adding.
447	*/
448	uint32_t cRegs = pFrame->cSureRegs;
449	PDBGFREGVALEX paSureRegs = NULL;
450	#define ADD_REG_NAMED(a_Type, a_ValMemb, a_Value, a_pszName) do { \
451	if (paSureRegs) \
452	{ \
453	paSureRegs[iReg].pszName = a_pszName;\
454	paSureRegs[iReg].enmReg = DBGFREG_END; \
455	paSureRegs[iReg].enmType = a_Type; \
456	paSureRegs[iReg].Value.a_ValMemb = (a_Value); \
457	} \
458	iReg++; \
459	} while (0)
460	#define MAYBE_ADD_GREG(a_Value, a_enmReg, a_idxReg) do { \
461	if (!(pState->u.x86.Loaded.s.fRegs & RT_BIT(a_idxReg))) \
462	{ \
463	if (paSureRegs) \
464	{ \
465	pState->u.x86.Loaded.s.fRegs \|= RT_BIT(a_idxReg); \
466	pState->u.x86.auRegs[a_idxReg] = (a_Value); \
467	paSureRegs[iReg].Value.u64 = (a_Value); \
468	paSureRegs[iReg].enmReg = a_enmReg; \
469	paSureRegs[iReg].enmType = DBGFREGVALTYPE_U64; \
470	paSureRegs[iReg].pszName = NULL; \
471	} \
472	iReg++; \
473	} \
474	} while (0)
475	for (unsigned iLoop = 0; iLoop < 2; iLoop++)
476	{
477	uint32_t iReg = pFrame->cSureRegs;
478	ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, uTrapFrameAddr, "TrapFrame");
479	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.ExceptionActive, "ExceptionActive");
480	if (TrapFrame.ExceptionActive == 0)
481	{
482	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, TrapFrame.PreviousIrql, "PrevIrql");
483	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, (uint8_t)TrapFrame.ErrCdOrXcptFrameOrS, "IntNo");
484	}
485	else if ( TrapFrame.ExceptionActive == 1
486	&& TrapFrame.FaultIndicator == ((TrapFrame.ErrCdOrXcptFrameOrS >> 1) & 0x9))
487	ADD_REG_NAMED(DBGFREGVALTYPE_U64, u64, TrapFrame.FaultAddrOrCtxRecOrTS, "cr2-probably");
488	if (TrapFrame.SegCs & X86_SEL_RPL)
489	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "UserMode");
490	else
491	ADD_REG_NAMED(DBGFREGVALTYPE_U8, u8, 1, "KernelMode");
492	if (TrapFrame.ExceptionActive <= 1)
493	{
494	MAYBE_ADD_GREG(TrapFrame.Rax, DBGFREG_RAX, X86_GREG_xAX);
495	MAYBE_ADD_GREG(TrapFrame.Rcx, DBGFREG_RCX, X86_GREG_xCX);
496	MAYBE_ADD_GREG(TrapFrame.Rdx, DBGFREG_RDX, X86_GREG_xDX);
497	MAYBE_ADD_GREG(TrapFrame.R8, DBGFREG_R8, X86_GREG_x8);
498	MAYBE_ADD_GREG(TrapFrame.R9, DBGFREG_R9, X86_GREG_x9);
499	MAYBE_ADD_GREG(TrapFrame.R10, DBGFREG_R10, X86_GREG_x10);
500	MAYBE_ADD_GREG(TrapFrame.R11, DBGFREG_R11, X86_GREG_x11);
501	}
502	else if (TrapFrame.ExceptionActive == 2)
503	{
504	MAYBE_ADD_GREG(TrapFrame.Rbx, DBGFREG_RBX, X86_GREG_xBX);
505	MAYBE_ADD_GREG(TrapFrame.Rsi, DBGFREG_RSI, X86_GREG_xSI);
506	MAYBE_ADD_GREG(TrapFrame.Rdi, DBGFREG_RDI, X86_GREG_xDI);
507	}
508	// MAYBE_ADD_GREG(TrapFrame.Rbp, DBGFREG_RBP, X86_GREG_xBP); - KiInterrupt[Sub]Dispatch* may leave this invalid.
509
510	/* Done? */
511	if (iLoop > 0)
512	{
513	Assert(cRegs == iReg);
514	break;
515	}
516
517	/* Resize the array, zeroing the extension. */
518	if (pFrame->cSureRegs)
519	paSureRegs = (PDBGFREGVALEX)MMR3HeapRealloc(pFrame->paSureRegs, iReg * sizeof(paSureRegs[0]));
520	else
521	paSureRegs = (PDBGFREGVALEX)MMR3HeapAllocU(pUVM, MM_TAG_DBGF_STACK, iReg * sizeof(paSureRegs[0]));
522	AssertReturn(paSureRegs, VERR_NO_MEMORY);
523
524	pFrame->paSureRegs = paSureRegs;
525	RT_BZERO(&paSureRegs[pFrame->cSureRegs], (iReg - pFrame->cSureRegs) * sizeof(paSureRegs[0]));
526	cRegs = iReg;
527	}
528	#undef ADD_REG_NAMED
529	#undef MAYBE_ADD_GREG
530
531	/* Commit the register update. */
532	pFrame->cSureRegs = cRegs;
533	}
534	}
535	}
536	}
537
538	RT_NOREF(pUVM, pvData, idCpu, hAs, pInitialCtx, puScratch);
539	return VINF_SUCCESS;
540	}
541
542
543	/**
544	* @copydoc DBGFOSREG::pfnQueryInterface
545	*/
546	static DECLCALLBACK(void ) dbgDiggerWinNtQueryInterface(PUVM pUVM, void pvData, DBGFOSINTERFACE enmIf)
547	{
548	RT_NOREF3(pUVM, pvData, enmIf);
549	return NULL;
550	}
551
552
553	/**
554	* @copydoc DBGFOSREG::pfnQueryVersion
555	*/
556	static DECLCALLBACK(int) dbgDiggerWinNtQueryVersion(PUVM pUVM, void pvData, char pszVersion, size_t cchVersion)
557	{
558	RT_NOREF1(pUVM);
559	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
560	Assert(pThis->fValid);
561	const char *pszNtProductType;
562	switch (pThis->NtProductType)
563	{
564	case kNtProductType_WinNt: pszNtProductType = "-WinNT"; break;
565	case kNtProductType_LanManNt: pszNtProductType = "-LanManNT"; break;
566	case kNtProductType_Server: pszNtProductType = "-Server"; break;
567	default: pszNtProductType = ""; break;
568	}
569	RTStrPrintf(pszVersion, cchVersion, "%u.%u-%s%s", pThis->NtMajorVersion, pThis->NtMinorVersion,
570	pThis->f32Bit ? "x86" : "AMD64", pszNtProductType);
571	return VINF_SUCCESS;
572	}
573
574
575	/**
576	* @copydoc DBGFOSREG::pfnTerm
577	*/
578	static DECLCALLBACK(void) dbgDiggerWinNtTerm(PUVM pUVM, void *pvData)
579	{
580	RT_NOREF1(pUVM);
581	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
582	Assert(pThis->fValid);
583
584	/*
585	* As long as we're using our private LDR reader implementation,
586	* we must unlink and ditch the modules we created.
587	*/
588	RTDBGAS hDbgAs = DBGFR3AsResolveAndRetain(pUVM, DBGF_AS_KERNEL);
589	if (hDbgAs != NIL_RTDBGAS)
590	{
591	uint32_t iMod = RTDbgAsModuleCount(hDbgAs);
592	while (iMod-- > 0)
593	{
594	RTDBGMOD hMod = RTDbgAsModuleByIndex(hDbgAs, iMod);
595	if (hMod != NIL_RTDBGMOD)
596	{
597	if (RTDbgModGetTag(hMod) == DIG_WINNT_MOD_TAG)
598	{
599	int rc = RTDbgAsModuleUnlink(hDbgAs, hMod);
600	AssertRC(rc);
601	}
602	RTDbgModRelease(hMod);
603	}
604	}
605	RTDbgAsRelease(hDbgAs);
606	}
607
608	pThis->fValid = false;
609	}
610
611
612	/**
613	* @copydoc DBGFOSREG::pfnRefresh
614	*/
615	static DECLCALLBACK(int) dbgDiggerWinNtRefresh(PUVM pUVM, void *pvData)
616	{
617	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
618	NOREF(pThis);
619	Assert(pThis->fValid);
620
621	/*
622	* For now we'll flush and reload everything.
623	*/
624	dbgDiggerWinNtTerm(pUVM, pvData);
625
626	return dbgDiggerWinNtInit(pUVM, pvData);
627	}
628
629
630	/**
631	* @copydoc DBGFOSREG::pfnInit
632	*/
633	static DECLCALLBACK(int) dbgDiggerWinNtInit(PUVM pUVM, void *pvData)
634	{
635	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
636	Assert(!pThis->fValid);
637
638	union
639	{
640	uint8_t au8[0x2000];
641	RTUTF16 wsz[0x2000/2];
642	NTKUSERSHAREDDATA UserSharedData;
643	} u;
644	DBGFADDRESS Addr;
645	int rc;
646
647	/*
648	* Figure the NT version.
649	*/
650	DBGFR3AddrFromFlat(pUVM, &Addr, pThis->f32Bit ? NTKUSERSHAREDDATA_WINNT32 : NTKUSERSHAREDDATA_WINNT64);
651	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &u, PAGE_SIZE);
652	if (RT_SUCCESS(rc))
653	{
654	pThis->NtProductType = u.UserSharedData.ProductTypeIsValid && u.UserSharedData.NtProductType <= kNtProductType_Server
655	? (NTPRODUCTTYPE)u.UserSharedData.NtProductType
656	: kNtProductType_Invalid;
657	pThis->NtMajorVersion = u.UserSharedData.NtMajorVersion;
658	pThis->NtMinorVersion = u.UserSharedData.NtMinorVersion;
659	}
660	else if (pThis->fNt31)
661	{
662	pThis->NtProductType = kNtProductType_WinNt;
663	pThis->NtMajorVersion = 3;
664	pThis->NtMinorVersion = 1;
665	}
666	else
667	{
668	Log(("DigWinNt: Error reading KUSER_SHARED_DATA: %Rrc\n", rc));
669	return rc;
670	}
671
672	/*
673	* Dig out the module chain.
674	*/
675	DBGFADDRESS AddrPrev = pThis->PsLoadedModuleListAddr;
676	Addr = pThis->KernelMteAddr;
677	do
678	{
679	/* Read the validate the MTE. */
680	NTMTE Mte;
681	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &Addr, &Mte, pThis->f32Bit ? sizeof(Mte.vX_32) : sizeof(Mte.vX_64));
682	if (RT_FAILURE(rc))
683	break;
684	if (WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Blink) != AddrPrev.FlatPtr)
685	{
686	Log(("DigWinNt: Bad Mte At %RGv - backpointer\n", Addr.FlatPtr));
687	break;
688	}
689	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink)) )
690	{
691	Log(("DigWinNt: Bad Mte at %RGv - forward pointer\n", Addr.FlatPtr));
692	break;
693	}
694	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)))
695	{
696	Log(("DigWinNt: Bad Mte at %RGv - BaseDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer)));
697	break;
698	}
699	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)))
700	{
701	Log(("DigWinNt: Bad Mte at %RGv - FullDllName=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, FullDllName.Buffer)));
702	break;
703	}
704	if (!WINNT_VALID_ADDRESS(pThis, WINNT_UNION(pThis, &Mte, DllBase)))
705	{
706	Log(("DigWinNt: Bad Mte at %RGv - DllBase=%llx\n", Addr.FlatPtr, WINNT_UNION(pThis, &Mte, DllBase) ));
707	break;
708	}
709
710	uint32_t const cbImageMte = !pThis->fNt31 ? WINNT_UNION(pThis, &Mte, SizeOfImage) : 0;
711	if ( !pThis->fNt31
712	&& ( cbImageMte > _256M
713	\|\| WINNT_UNION(pThis, &Mte, EntryPoint) - WINNT_UNION(pThis, &Mte, DllBase) > cbImageMte) )
714	{
715	Log(("DigWinNt: Bad Mte at %RGv - EntryPoint=%llx SizeOfImage=%x DllBase=%llx\n",
716	Addr.FlatPtr, WINNT_UNION(pThis, &Mte, EntryPoint), cbImageMte, WINNT_UNION(pThis, &Mte, DllBase)));
717	break;
718	}
719
720	/* Read the full name. */
721	DBGFADDRESS AddrName;
722	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, FullDllName.Buffer));
723	uint16_t cbName = WINNT_UNION(pThis, &Mte, FullDllName.Length);
724	if (cbName < sizeof(u))
725	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
726	else
727	rc = VERR_OUT_OF_RANGE;
728	if (RT_FAILURE(rc))
729	{
730	DBGFR3AddrFromFlat(pUVM, &AddrName, WINNT_UNION(pThis, &Mte, BaseDllName.Buffer));
731	cbName = WINNT_UNION(pThis, &Mte, BaseDllName.Length);
732	if (cbName < sizeof(u))
733	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &AddrName, &u, cbName);
734	else
735	rc = VERR_OUT_OF_RANGE;
736	}
737	if (RT_SUCCESS(rc))
738	{
739	u.wsz[cbName / 2] = '\0';
740
741	char *pszFilename;
742	rc = RTUtf16ToUtf8(u.wsz, &pszFilename);
743	if (RT_SUCCESS(rc))
744	{
745	char szModName[128];
746	const char *pszModName = dbgDiggerWintNtFilenameToModuleName(pszFilename, szModName, sizeof(szModName));
747
748	/* Read the start of the PE image and pass it along to a worker. */
749	DBGFADDRESS ImageAddr;
750	DBGFR3AddrFromFlat(pUVM, &ImageAddr, WINNT_UNION(pThis, &Mte, DllBase));
751	dbgDiggerWinNtProcessImage(pThis, pUVM, pszModName, pszFilename, &ImageAddr, cbImageMte);
752	RTStrFree(pszFilename);
753	}
754	}
755
756	/* next */
757	AddrPrev = Addr;
758	DBGFR3AddrFromFlat(pUVM, &Addr, WINNT_UNION(pThis, &Mte, InLoadOrderLinks.Flink));
759	} while ( Addr.FlatPtr != pThis->KernelMteAddr.FlatPtr
760	&& Addr.FlatPtr != pThis->PsLoadedModuleListAddr.FlatPtr);
761
762	pThis->fValid = true;
763	return VINF_SUCCESS;
764	}
765
766
767	/**
768	* @copydoc DBGFOSREG::pfnProbe
769	*/
770	static DECLCALLBACK(bool) dbgDiggerWinNtProbe(PUVM pUVM, void *pvData)
771	{
772	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
773	DBGFADDRESS Addr;
774	union
775	{
776	uint8_t au8[8192];
777	uint16_t au16[8192/2];
778	uint32_t au32[8192/4];
779	IMAGE_DOS_HEADER MzHdr;
780	RTUTF16 wsz[8192/2];
781	X86DESC64GATE a32Gates[X86_XCPT_PF + 1];
782	X86DESC64GATE a64Gates[X86_XCPT_PF + 1];
783	} u;
784
785	union
786	{
787	NTMTE32 v32;
788	NTMTE64 v64;
789	} uMte, uMte2, uMte3;
790
791	/*
792	* NT only runs in protected or long mode.
793	*/
794	CPUMMODE const enmMode = DBGFR3CpuGetMode(pUVM, 0 /idCpu/);
795	if (enmMode != CPUMMODE_PROTECTED && enmMode != CPUMMODE_LONG)
796	return false;
797	bool const f64Bit = enmMode == CPUMMODE_LONG;
798	uint64_t const uStart = f64Bit ? UINT64_C(0xffff080000000000) : UINT32_C(0x80001000);
799	uint64_t const uEnd = f64Bit ? UINT64_C(0xffffffffffff0000) : UINT32_C(0xffff0000);
800
801	/*
802	* To approximately locate the kernel we examine the IDTR handlers.
803	*
804	* The exception/trap/fault handlers are all in NT kernel image, we pick
805	* KiPageFault here.
806	*/
807	uint64_t uIdtrBase = 0;
808	uint16_t uIdtrLimit = 0;
809	int rc = DBGFR3RegCpuQueryXdtr(pUVM, 0, DBGFREG_IDTR, &uIdtrBase, &uIdtrLimit);
810	AssertRCReturn(rc, false);
811
812	const uint16_t cbMinIdtr = (X86_XCPT_PF + 1) * (f64Bit ? sizeof(X86DESC64GATE) : sizeof(X86DESCGATE));
813	if (uIdtrLimit < cbMinIdtr)
814	return false;
815
816	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uIdtrBase), &u, cbMinIdtr);
817	if (RT_FAILURE(rc))
818	return false;
819
820	uint64_t uKrnlStart = uStart;
821	uint64_t uKrnlEnd = uEnd;
822	if (f64Bit)
823	{
824	uint64_t uHandler = u.a64Gates[X86_XCPT_PF].u16OffsetLow
825	\| ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16)
826	\| ((uint64_t)u.a64Gates[X86_XCPT_PF].u32OffsetTop << 32);
827	if (uHandler < uStart \|\| uHandler > uEnd)
828	return false;
829	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _512M;
830	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
831	}
832	else
833	{
834	uint32_t uHandler = u.a32Gates[X86_XCPT_PF].u16OffsetLow
835	\| ((uint32_t)u.a64Gates[X86_XCPT_PF].u16OffsetHigh << 16);
836	if (uHandler < uStart \|\| uHandler > uEnd)
837	return false;
838	uKrnlStart = (uHandler & ~(uint64_t)_4M) - _64M;
839	uKrnlEnd = (uHandler + (uint64_t)_4M) & ~(uint64_t)_4M;
840	}
841
842	/*
843	* Look for the PAGELK section name that seems to be a part of all kernels.
844	* Then try find the module table entry for it. Since it's the first entry
845	* in the PsLoadedModuleList we can easily validate the list head and report
846	* success.
847	*
848	* Note! We ASSUME the section name is 8 byte aligned.
849	*/
850	DBGFADDRESS KernelAddr;
851	for (DBGFR3AddrFromFlat(pUVM, &KernelAddr, uKrnlStart);
852	KernelAddr.FlatPtr < uKrnlEnd;
853	KernelAddr.FlatPtr += PAGE_SIZE)
854	{
855	bool fNt31 = false;
856	DBGFADDRESS const RetryAddress = KernelAddr;
857	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
858	8, "PAGELK\0", sizeof("PAGELK\0"), &KernelAddr);
859	if ( rc == VERR_DBGF_MEM_NOT_FOUND
860	&& enmMode != CPUMMODE_LONG)
861	{
862	/* NT3.1 didn't have a PAGELK section, so look for _TEXT instead. The
863	following VirtualSize is zero, so check for that too. */
864	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &RetryAddress, uEnd - RetryAddress.FlatPtr,
865	8, "_TEXT\0\0\0\0\0\0", sizeof("_TEXT\0\0\0\0\0\0"), &KernelAddr);
866	fNt31 = true;
867	}
868	if (RT_FAILURE(rc))
869	break;
870	DBGFR3AddrSub(&KernelAddr, KernelAddr.FlatPtr & PAGE_OFFSET_MASK);
871
872	/* MZ + PE header. */
873	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, &KernelAddr, &u, sizeof(u));
874	if ( RT_SUCCESS(rc)
875	&& u.MzHdr.e_magic == IMAGE_DOS_SIGNATURE
876	&& !(u.MzHdr.e_lfanew & 0x7)
877	&& u.MzHdr.e_lfanew >= 0x080
878	&& u.MzHdr.e_lfanew <= 0x400) /* W8 is at 0x288*/
879	{
880	if (enmMode != CPUMMODE_LONG)
881	{
882	IMAGE_NT_HEADERS32 const pHdrs = (IMAGE_NT_HEADERS32 const )&u.au8[u.MzHdr.e_lfanew];
883	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
884	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386
885	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
886	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
887	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL)) == IMAGE_FILE_EXECUTABLE_IMAGE
888	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC
889	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
890	)
891	{
892	/* Find the MTE. */
893	RT_ZERO(uMte);
894	uMte.v32.DllBase = KernelAddr.FlatPtr;
895	uMte.v32.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
896	uMte.v32.SizeOfImage = !fNt31 ? pHdrs->OptionalHeader.SizeOfImage : 0; /* NT 3.1 didn't set the size. */
897	DBGFADDRESS HitAddr;
898	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &KernelAddr, uEnd - KernelAddr.FlatPtr,
899	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
900	while (RT_SUCCESS(rc))
901	{
902	/* check the name. */
903	DBGFADDRESS MteAddr = HitAddr;
904	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE32, DllBase)),
905	&uMte2.v32, sizeof(uMte2.v32));
906	if ( RT_SUCCESS(rc)
907	&& uMte2.v32.DllBase == uMte.v32.DllBase
908	&& uMte2.v32.EntryPoint == uMte.v32.EntryPoint
909	&& uMte2.v32.SizeOfImage == uMte.v32.SizeOfImage
910	&& WINNT32_VALID_ADDRESS(uMte2.v32.InLoadOrderLinks.Flink)
911	&& WINNT32_VALID_ADDRESS(uMte2.v32.BaseDllName.Buffer)
912	&& WINNT32_VALID_ADDRESS(uMte2.v32.FullDllName.Buffer)
913	&& uMte2.v32.BaseDllName.Length <= 128
914	&& uMte2.v32.FullDllName.Length <= 260
915	)
916	{
917	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.BaseDllName.Buffer),
918	u.wsz, uMte2.v32.BaseDllName.Length);
919	u.wsz[uMte2.v32.BaseDllName.Length / 2] = '\0';
920	if ( RT_SUCCESS(rc)
921	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
922	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
923	)
924	)
925	{
926	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
927	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v32.InLoadOrderLinks.Blink),
928	&uMte3.v32, RT_SIZEOFMEMB(NTMTE32, InLoadOrderLinks));
929	if ( RT_SUCCESS(rc)
930	&& uMte3.v32.InLoadOrderLinks.Flink == MteAddr.FlatPtr
931	&& WINNT32_VALID_ADDRESS(uMte3.v32.InLoadOrderLinks.Blink) )
932	{
933	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
934	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, Addr.FlatPtr));
935	pThis->KernelAddr = KernelAddr;
936	pThis->KernelMteAddr = MteAddr;
937	pThis->PsLoadedModuleListAddr = Addr;
938	pThis->f32Bit = true;
939	pThis->fNt31 = fNt31;
940	return true;
941	}
942	}
943	else if (RT_SUCCESS(rc))
944	{
945	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
946	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v32.SizeOfImage, u.wsz));
947	break; /* Not NT kernel */
948	}
949	}
950
951	/* next */
952	DBGFR3AddrAdd(&HitAddr, 4);
953	if (HitAddr.FlatPtr < uEnd)
954	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
955	4 /align/, &uMte.v32.DllBase, 3 * sizeof(uint32_t), &HitAddr);
956	else
957	rc = VERR_DBGF_MEM_NOT_FOUND;
958	}
959	}
960	}
961	else
962	{
963	IMAGE_NT_HEADERS64 const pHdrs = (IMAGE_NT_HEADERS64 const )&u.au8[u.MzHdr.e_lfanew];
964	if ( pHdrs->Signature == IMAGE_NT_SIGNATURE
965	&& pHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64
966	&& pHdrs->FileHeader.SizeOfOptionalHeader == sizeof(pHdrs->OptionalHeader)
967	&& pHdrs->FileHeader.NumberOfSections >= 10 /* the kernel has lots */
968	&& (pHdrs->FileHeader.Characteristics & (IMAGE_FILE_EXECUTABLE_IMAGE \| IMAGE_FILE_DLL))
969	== IMAGE_FILE_EXECUTABLE_IMAGE
970	&& pHdrs->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC
971	&& pHdrs->OptionalHeader.NumberOfRvaAndSizes == IMAGE_NUMBEROF_DIRECTORY_ENTRIES
972	)
973	{
974	/* Find the MTE. */
975	RT_ZERO(uMte.v64);
976	uMte.v64.DllBase = KernelAddr.FlatPtr;
977	uMte.v64.EntryPoint = KernelAddr.FlatPtr + pHdrs->OptionalHeader.AddressOfEntryPoint;
978	uMte.v64.SizeOfImage = pHdrs->OptionalHeader.SizeOfImage;
979	DBGFADDRESS ScanAddr;
980	DBGFADDRESS HitAddr;
981	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &ScanAddr, uStart),
982	uEnd - uStart, 8 /align/, &uMte.v64.DllBase, 5 * sizeof(uint32_t), &HitAddr);
983	while (RT_SUCCESS(rc))
984	{
985	/* Read the start of the MTE and check some basic members. */
986	DBGFADDRESS MteAddr = HitAddr;
987	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrSub(&MteAddr, RT_OFFSETOF(NTMTE64, DllBase)),
988	&uMte2.v64, sizeof(uMte2.v64));
989	if ( RT_SUCCESS(rc)
990	&& uMte2.v64.DllBase == uMte.v64.DllBase
991	&& uMte2.v64.EntryPoint == uMte.v64.EntryPoint
992	&& uMte2.v64.SizeOfImage == uMte.v64.SizeOfImage
993	&& WINNT64_VALID_ADDRESS(uMte2.v64.InLoadOrderLinks.Flink)
994	&& WINNT64_VALID_ADDRESS(uMte2.v64.BaseDllName.Buffer)
995	&& WINNT64_VALID_ADDRESS(uMte2.v64.FullDllName.Buffer)
996	&& uMte2.v64.BaseDllName.Length <= 128
997	&& uMte2.v64.FullDllName.Length <= 260
998	)
999	{
1000	/* Try read the base name and compare with known NT kernel names. */
1001	rc = DBGFR3MemRead(pUVM, 0 /idCpu/, DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.BaseDllName.Buffer),
1002	u.wsz, uMte2.v64.BaseDllName.Length);
1003	u.wsz[uMte2.v64.BaseDllName.Length / 2] = '\0';
1004	if ( RT_SUCCESS(rc)
1005	&& ( !RTUtf16ICmp(u.wsz, g_wszKernelNames[0])
1006	/* \|\| !RTUtf16ICmp(u.wsz, g_wszKernelNames[1]) */
1007	)
1008	)
1009	{
1010	/* Read the link entry of the previous entry in the list and check that its
1011	forward pointer points at the MTE we've found. */
1012	rc = DBGFR3MemRead(pUVM, 0 /idCpu/,
1013	DBGFR3AddrFromFlat(pUVM, &Addr, uMte2.v64.InLoadOrderLinks.Blink),
1014	&uMte3.v64, RT_SIZEOFMEMB(NTMTE64, InLoadOrderLinks));
1015	if ( RT_SUCCESS(rc)
1016	&& uMte3.v64.InLoadOrderLinks.Flink == MteAddr.FlatPtr
1017	&& WINNT64_VALID_ADDRESS(uMte3.v64.InLoadOrderLinks.Blink) )
1018	{
1019	Log(("DigWinNt: MteAddr=%RGv KernelAddr=%RGv SizeOfImage=%x &PsLoadedModuleList=%RGv (32-bit)\n",
1020	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, Addr.FlatPtr));
1021	pThis->KernelAddr = KernelAddr;
1022	pThis->KernelMteAddr = MteAddr;
1023	pThis->PsLoadedModuleListAddr = Addr;
1024	pThis->f32Bit = false;
1025	pThis->fNt31 = false;
1026	return true;
1027	}
1028	}
1029	else if (RT_SUCCESS(rc))
1030	{
1031	Log2(("DigWinNt: Wrong module: MteAddr=%RGv ImageAddr=%RGv SizeOfImage=%#x '%ls'\n",
1032	MteAddr.FlatPtr, KernelAddr.FlatPtr, uMte2.v64.SizeOfImage, u.wsz));
1033	break; /* Not NT kernel */
1034	}
1035	}
1036
1037	/* next */
1038	DBGFR3AddrAdd(&HitAddr, 8);
1039	if (HitAddr.FlatPtr < uEnd)
1040	rc = DBGFR3MemScan(pUVM, 0 /idCpu/, &HitAddr, uEnd - HitAddr.FlatPtr,
1041	8 /align/, &uMte.v64.DllBase, 3 * sizeof(uint32_t), &HitAddr);
1042	else
1043	rc = VERR_DBGF_MEM_NOT_FOUND;
1044	}
1045	}
1046	}
1047	}
1048	}
1049	return false;
1050	}
1051
1052
1053	/**
1054	* @copydoc DBGFOSREG::pfnDestruct
1055	*/
1056	static DECLCALLBACK(void) dbgDiggerWinNtDestruct(PUVM pUVM, void *pvData)
1057	{
1058	RT_NOREF2(pUVM, pvData);
1059	}
1060
1061
1062	/**
1063	* @copydoc DBGFOSREG::pfnConstruct
1064	*/
1065	static DECLCALLBACK(int) dbgDiggerWinNtConstruct(PUVM pUVM, void *pvData)
1066	{
1067	RT_NOREF1(pUVM);
1068	PDBGDIGGERWINNT pThis = (PDBGDIGGERWINNT)pvData;
1069	pThis->fValid = false;
1070	pThis->f32Bit = false;
1071	pThis->enmVer = DBGDIGGERWINNTVER_UNKNOWN;
1072	return VINF_SUCCESS;
1073	}
1074
1075
1076	const DBGFOSREG g_DBGDiggerWinNt =
1077	{
1078	/* .u32Magic = */ DBGFOSREG_MAGIC,
1079	/* .fFlags = */ 0,
1080	/* .cbData = */ sizeof(DBGDIGGERWINNT),
1081	/* .szName = */ "WinNT",
1082	/* .pfnConstruct = */ dbgDiggerWinNtConstruct,
1083	/* .pfnDestruct = */ dbgDiggerWinNtDestruct,
1084	/* .pfnProbe = */ dbgDiggerWinNtProbe,
1085	/* .pfnInit = */ dbgDiggerWinNtInit,
1086	/* .pfnRefresh = */ dbgDiggerWinNtRefresh,
1087	/* .pfnTerm = */ dbgDiggerWinNtTerm,
1088	/* .pfnQueryVersion = */ dbgDiggerWinNtQueryVersion,
1089	/* .pfnQueryInterface = */ dbgDiggerWinNtQueryInterface,
1090	/* .pfnStackUnwindAssist = */ dbgDiggerWinNtStackUnwindAssist,
1091	/* .u32EndMagic = */ DBGFOSREG_MAGIC
1092	};
1093

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cpp@ 76573

Download in other formats: