dbgkrnlinfo-r0drv-nt.cpp@ 76452

Last change on this file since 76452 was 75275, checked in by vboxsync, 6 years ago
IPRT/dbgkrnlinfo-r0drv-nt.cpp: Must manually initialize g_pfnMmGetSystemRoutineAddress according to the linker.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 32.3 KB

Line
1	/* $Id: dbgkrnlinfo-r0drv-nt.cpp 75275 2018-11-06 11:17:30Z vboxsync $ */
2	/** @file
3	* IPRT - Kernel Debug Information, R0 Driver, NT.
4	*/
5
6	/*
7	* Copyright (C) 2006-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#define IMAGE_NT_HEADERS NT_IMAGE_NT_HEADERS
32	#define IMAGE_NT_HEADERS32 NT_IMAGE_NT_HEADERS32
33	#define IMAGE_NT_HEADERS64 NT_IMAGE_NT_HEADERS64
34	#define PIMAGE_NT_HEADERS NT_PIMAGE_NT_HEADERS
35	#define PIMAGE_NT_HEADERS32 NT_PIMAGE_NT_HEADERS32
36	#define PIMAGE_NT_HEADERS64 NT_PIMAGE_NT_HEADERS64
37	#define IPRT_NT_MAP_TO_ZW
38	#include "the-nt-kernel.h"
39	#include <iprt/dbg.h>
40
41	#include <iprt/err.h>
42	#include <iprt/log.h>
43	#include <iprt/mem.h>
44	#include <iprt/string.h>
45	#include <iprt/utf16.h>
46	#include "internal-r0drv-nt.h"
47	#include "internal/magics.h"
48
49	#undef IMAGE_NT_HEADERS
50	#undef IMAGE_NT_HEADERS32
51	#undef IMAGE_NT_HEADERS64
52	#undef PIMAGE_NT_HEADERS
53	#undef PIMAGE_NT_HEADERS32
54	#undef PIMAGE_NT_HEADERS64
55	#include <iprt/formats/pecoff.h>
56	#include <iprt/formats/mz.h>
57
58
59	/*********************************************************************************************************************************
60	* Defined Constants And Macros *
61	*********************************************************************************************************************************/
62	/** Private logging macro, will use DbgPrint! */
63	#ifdef IN_GUEST
64	# define RTR0DBG_NT_ERROR_LOG(a) do { RTLogBackdoorPrintf a; DbgPrint a; } while (0)
65	# define RTR0DBG_NT_DEBUG_LOG(a) do { RTLogBackdoorPrintf a; DbgPrint a; } while (0)
66	#else
67	# define RTR0DBG_NT_ERROR_LOG(a) do { DbgPrint a; } while (0)
68	# define RTR0DBG_NT_DEBUG_LOG(a) do { DbgPrint a; } while (0)
69	#endif
70	#ifndef LOG_ENABLED
71	# undef RTR0DBG_NT_DEBUG_LOG
72	# define RTR0DBG_NT_DEBUG_LOG(a) do { } while (0)
73	#endif
74
75
76	/*********************************************************************************************************************************
77	* Structures and Typedefs *
78	*********************************************************************************************************************************/
79	#define PIMAGE_NT_HEADERS RT_CONCAT(PIMAGE_NT_HEADERS, ARCH_BITS)
80
81	/**
82	* Information we cache for a kernel module.
83	*/
84	typedef struct RTDBGNTKRNLMODINFO
85	{
86	/** The module name. */
87	char szName[32];
88
89	/** The image base. */
90	uint8_t const *pbImageBase;
91	/** The NT headers. */
92	PIMAGE_NT_HEADERS pNtHdrs;
93	/** Set if this module parsed okay and all fields are valid. */
94	bool fOkay;
95	/** The NT header offset/RVA. */
96	uint32_t offNtHdrs;
97	/** The end of the section headers. */
98	uint32_t offEndSectHdrs;
99	/** The end of the image. */
100	uint32_t cbImage;
101	/** Offset of the export directory. */
102	uint32_t offExportDir;
103	/** Size of the export directory. */
104	uint32_t cbExportDir;
105
106	/** Exported functions and data by ordinal (RVAs). */
107	uint32_t const *paoffExports;
108	/** The number of exports. */
109	uint32_t cExports;
110	/** The number of exported names. */
111	uint32_t cNamedExports;
112	/** Pointer to the array of exported names (RVAs to strings). */
113	uint32_t const *paoffNamedExports;
114	/** Array parallel to paoffNamedExports with the corresponding ordinals
115	* (indexes into paoffExports). */
116	uint16_t const *pau16NameOrdinals;
117	} RTDBGNTKRNLMODINFO;
118	/** Pointer to kernel module info. */
119	typedef RTDBGNTKRNLMODINFO *PRTDBGNTKRNLMODINFO;
120	/** Pointer to const kernel module info. */
121	typedef RTDBGNTKRNLMODINFO const *PCRTDBGNTKRNLMODINFO;
122
123
124	/**
125	* NT kernel info instance.
126	*/
127	typedef struct RTDBGKRNLINFOINT
128	{
129	/** Magic value (RTDBGKRNLINFO_MAGIC). */
130	uint32_t u32Magic;
131	/** Reference counter. */
132	uint32_t volatile cRefs;
133	/** Number of additional modules in the cache. */
134	uint32_t cModules;
135	/** Additional modules. */
136	RTDBGNTKRNLMODINFO aModules[3];
137	} RTDBGKRNLINFOINT;
138
139
140
141	/*********************************************************************************************************************************
142	* Global Variables *
143	*********************************************************************************************************************************/
144	/** Pointer to MmGetSystemRoutineAddress.
145	* @note Added in NT v5.0. */
146	static decltype(MmGetSystemRoutineAddress) *g_pfnMmGetSystemRoutineAddress = NULL;
147	/** Info about the ntoskrnl.exe mapping. */
148	static RTDBGNTKRNLMODINFO g_NtOsKrnlInfo = { "ntoskrnl.exe", NULL, NULL, false, 0, 0, 0, 0, 0, NULL, 0, 0, NULL, NULL };
149	/** Info about the hal.dll mapping. */
150	static RTDBGNTKRNLMODINFO g_HalInfo = { "hal.dll", NULL, NULL, false, 0, 0, 0, 0, 0, NULL, 0, 0, NULL, NULL };
151
152
153
154	/**
155	* Looks up an symbol int the export table.
156	*
157	* @returns VINF_SUCCESS or VERR_SYMBOL_NOT_FOUND.
158	* @param pModInfo The module info.
159	* @param pszSymbol The symbol to find.
160	* @param ppvSymbol Where to put the symbol address.
161	*
162	* @note Support library has similar code for in the importless area.
163	*/
164	static int rtR0DbgKrnlInfoLookupSymbol(PCRTDBGNTKRNLMODINFO pModInfo, const char pszSymbol, void *ppvSymbol)
165	{
166	if (pModInfo->fOkay)
167	{
168	/*
169	* Binary search.
170	*/
171	__try
172	{
173	uint32_t iStart = 0;
174	uint32_t iEnd = pModInfo->cNamedExports;
175	while (iStart < iEnd)
176	{
177	uint32_t iCur = iStart + (iEnd - iStart) / 2;
178	uint32_t offExpName = pModInfo->paoffNamedExports[iCur];
179	if (offExpName >= pModInfo->offEndSectHdrs && offExpName < pModInfo->cbImage)
180	{ /* likely */ }
181	else
182	{
183	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: %s: Bad export name entry: %#x (iCur=%#x)\n",
184	pModInfo->szName, offExpName, iCur));
185	break;
186	}
187
188	const char pszExpName = (const char )&pModInfo->pbImageBase[offExpName];
189	int iDiff = strcmp(pszExpName, pszSymbol);
190	if (iDiff > 0) /* pszExpName > pszSymbol: search chunck before i */
191	iEnd = iCur;
192	else if (iDiff < 0) /* pszExpName < pszSymbol: search chunk after i */
193	iStart = iCur + 1;
194	else /* pszExpName == pszSymbol */
195	{
196	uint16_t iExpOrdinal = pModInfo->pau16NameOrdinals[iCur];
197	if (iExpOrdinal < pModInfo->cExports)
198	{
199	uint32_t offExport = pModInfo->paoffExports[iExpOrdinal];
200	if (offExport - pModInfo->offExportDir >= pModInfo->cbExportDir)
201	{
202	ppvSymbol = (void )&pModInfo->pbImageBase[offExport];
203	return VINF_SUCCESS;
204	}
205
206	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: %s: Forwarded symbol '%s': offExport=%#x (dir %#x LB %#x)\n",
207	pModInfo->szName, pszSymbol, offExport, pModInfo->offExportDir, pModInfo->cbExportDir));
208	}
209	else
210	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: %s: Name ordinal for '%s' is out of bounds: %#x (max %#x)\n",
211	pModInfo->szName, iExpOrdinal, pModInfo->cExports));
212	break;
213	}
214	}
215	}
216	__except(EXCEPTION_EXECUTE_HANDLER)
217	{
218	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: Exception searching '%s' for '%s'...\n",
219	pModInfo->szName, pszSymbol));
220	}
221	}
222
223	*ppvSymbol = NULL;
224	return VERR_SYMBOL_NOT_FOUND;
225	}
226
227
228	/**
229	* Parses (PE) module headers and fills in the coresponding module info struct.
230	*
231	* @returns true on if success, false if not.
232	* @param pModInfo The module info structure to fill in with parsed
233	* data. The szName and fOkay are set by the
234	* caller, this function does the rest.
235	* @param pbMapping The image mapping address
236	* @param cbMapping The image mapping size.
237	*
238	* @note Support library has similar code for in the importless area.
239	*/
240	static bool rtR0DbgKrnlNtParseModule(PRTDBGNTKRNLMODINFO pModInfo, uint8_t const *pbMapping, size_t cbMapping)
241	{
242	#define MODERR_RETURN(a_LogMsg, ...) \
243	do { RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtParseModule: " a_LogMsg, __VA_ARGS__)); return false; } while (0)
244
245	pModInfo->pbImageBase = pbMapping;
246
247	/*
248	* Locate the PE header, do some basic validations.
249	*/
250	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbMapping;
251	uint32_t offNtHdrs = 0;
252	PIMAGE_NT_HEADERS pNtHdrs;
253	if (pMzHdr->e_magic == IMAGE_DOS_SIGNATURE)
254	{
255	offNtHdrs = pMzHdr->e_lfanew;
256	if (offNtHdrs > _2K)
257	MODERR_RETURN("%s: e_lfanew=%#x, expected a lower value\n", pModInfo->szName, offNtHdrs);
258	}
259	pModInfo->pNtHdrs = pNtHdrs = (PIMAGE_NT_HEADERS)&pbMapping[offNtHdrs];
260
261	if (pNtHdrs->Signature != IMAGE_NT_SIGNATURE)
262	MODERR_RETURN("%s: Invalid PE signature: %#x", pModInfo->szName, pNtHdrs->Signature);
263	if (pNtHdrs->FileHeader.SizeOfOptionalHeader != sizeof(pNtHdrs->OptionalHeader))
264	MODERR_RETURN("%s: Unexpected optional header size: %#x\n", pModInfo->szName, pNtHdrs->FileHeader.SizeOfOptionalHeader);
265	if (pNtHdrs->OptionalHeader.Magic != RT_CONCAT3(IMAGE_NT_OPTIONAL_HDR,ARCH_BITS,_MAGIC))
266	MODERR_RETURN("%s: Unexpected optional header magic: %#x\n", pModInfo->szName, pNtHdrs->OptionalHeader.Magic);
267	if (pNtHdrs->OptionalHeader.NumberOfRvaAndSizes != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
268	MODERR_RETURN("%s: Unexpected number of RVA and sizes: %#x\n", pModInfo->szName, pNtHdrs->OptionalHeader.NumberOfRvaAndSizes);
269
270	pModInfo->offNtHdrs = offNtHdrs;
271	pModInfo->offEndSectHdrs = offNtHdrs
272	+ sizeof(*pNtHdrs)
273	+ pNtHdrs->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
274	pModInfo->cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
275	if (pModInfo->cbImage > cbMapping)
276	MODERR_RETURN("%s: The image size %#x is larger than the mapping: %#x\n",
277	pModInfo->szName, pModInfo->cbImage, cbMapping);
278
279	/*
280	* Find the export directory.
281	*/
282	IMAGE_DATA_DIRECTORY ExpDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
283	if ( ExpDir.Size < sizeof(IMAGE_EXPORT_DIRECTORY)
284	\|\| ExpDir.VirtualAddress < pModInfo->offEndSectHdrs
285	\|\| ExpDir.VirtualAddress >= pModInfo->cbImage
286	\|\| ExpDir.VirtualAddress + ExpDir.Size > pModInfo->cbImage)
287	MODERR_RETURN("%s: Missing or invalid export directory: %#lx LB %#x\n", pModInfo->szName, ExpDir.VirtualAddress, ExpDir.Size);
288	pModInfo->offExportDir = ExpDir.VirtualAddress;
289	pModInfo->cbExportDir = ExpDir.Size;
290
291	IMAGE_EXPORT_DIRECTORY const pExpDir = (IMAGE_EXPORT_DIRECTORY const )&pbMapping[ExpDir.VirtualAddress];
292
293	if ( pExpDir->NumberOfFunctions >= _1M
294	\|\| pExpDir->NumberOfFunctions < 1
295	\|\| pExpDir->NumberOfNames >= _1M
296	\|\| pExpDir->NumberOfNames < 1)
297	MODERR_RETURN("%s: NumberOfNames or/and NumberOfFunctions are outside the expected range: nof=%#x non=%#x\n",
298	pModInfo->szName, pExpDir->NumberOfFunctions, pExpDir->NumberOfNames);
299	pModInfo->cNamedExports = pExpDir->NumberOfNames;
300	pModInfo->cExports = RT_MAX(pExpDir->NumberOfNames, pExpDir->NumberOfFunctions);
301
302	if ( pExpDir->AddressOfFunctions < pModInfo->offEndSectHdrs
303	\|\| pExpDir->AddressOfFunctions >= pModInfo->cbImage
304	\|\| pExpDir->AddressOfFunctions + pModInfo->cExports * sizeof(uint32_t) > pModInfo->cbImage)
305	MODERR_RETURN("%s: Bad AddressOfFunctions: %#x\n", pModInfo->szName, pExpDir->AddressOfFunctions);
306	pModInfo->paoffExports = (uint32_t const *)&pbMapping[pExpDir->AddressOfFunctions];
307
308	if ( pExpDir->AddressOfNames < pModInfo->offEndSectHdrs
309	\|\| pExpDir->AddressOfNames >= pModInfo->cbImage
310	\|\| pExpDir->AddressOfNames + pExpDir->NumberOfNames * sizeof(uint32_t) > pModInfo->cbImage)
311	MODERR_RETURN("%s: Bad AddressOfNames: %#x\n", pModInfo->szName, pExpDir->AddressOfNames);
312	pModInfo->paoffNamedExports = (uint32_t const *)&pbMapping[pExpDir->AddressOfNames];
313
314	if ( pExpDir->AddressOfNameOrdinals < pModInfo->offEndSectHdrs
315	\|\| pExpDir->AddressOfNameOrdinals >= pModInfo->cbImage
316	\|\| pExpDir->AddressOfNameOrdinals + pExpDir->NumberOfNames * sizeof(uint32_t) > pModInfo->cbImage)
317	MODERR_RETURN("%s: Bad AddressOfNameOrdinals: %#x\n", pModInfo->szName, pExpDir->AddressOfNameOrdinals);
318	pModInfo->pau16NameOrdinals = (uint16_t const *)&pbMapping[pExpDir->AddressOfNameOrdinals];
319
320	/*
321	* Success.
322	*/
323	return true;
324	#undef MODERR_RETURN
325	}
326
327
328	/**
329	* Searches the module information from the kernel for the NT kernel module, the
330	* HAL module, and optionally one more module.
331	*
332	* If the NT kernel or HAL modules have already been found, they'll be skipped.
333	*
334	* @returns IPRT status code.
335	* @retval VERR_LDR_GENERAL_FAILURE if we failed to parse the NT kernel or HAL.
336	* @retval VERR_BAD_EXE_FORMAT if we failed to parse @a pModInfo.
337	* @retval VERR_MODULE_NOT_FOUND if @a pModInfo wasn't found.
338	* @retval VERR_BUFFER_UNDERFLOW if less that two modules was returned by the
339	* system.
340	*
341	* @param pModInfo Custom module to search for. Optional.
342	*/
343	static int rtR0DbgKrnlNtInit(PRTDBGNTKRNLMODINFO pModInfo)
344	{
345	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: pModInfo=%p\n", pModInfo));
346
347	#ifndef IPRT_TARGET_NT4
348	/*
349	* Must manually initialize g_pfnMmGetSystemRoutineAddress, otherwise compiler
350	* generates its own dynamic init code that might not necessarily be called.
351	*/
352	g_pfnMmGetSystemRoutineAddress = MmGetSystemRoutineAddress;
353	#endif
354
355	/*
356	* Allocate a reasonably large buffer and get the information we need. We don't
357	* need everything since the result starts off with the kernel bits in load order.
358	*
359	* Note! ZwQuerySystemInformation requires NT4. For 3.51 we could possibly emit
360	* the syscall ourselves, if we cared.
361	*/
362	uint32_t cModules = pModInfo ? 110 /32KB/ : 27 /8KB/;
363	ULONG cbInfo = RT_UOFFSETOF_DYN(RTL_PROCESS_MODULES, Modules[cModules]);
364	PRTL_PROCESS_MODULES pInfo = (PRTL_PROCESS_MODULES)RTMemAllocZ(cbInfo);
365	if (!pInfo)
366	{
367	cModules = cModules / 4;
368	cbInfo = RT_UOFFSETOF_DYN(RTL_PROCESS_MODULES, Modules[cModules]);
369	pInfo = (PRTL_PROCESS_MODULES)RTMemAllocZ(cbInfo);
370	if (!pInfo)
371	{
372	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Out of memory!\n"));
373	return VERR_NO_MEMORY;
374	}
375	}
376
377	int rc;
378	ULONG cbActual = 0;
379	NTSTATUS rcNt = ZwQuerySystemInformation(SystemModuleInformation, pInfo, cbInfo, &cbActual);
380	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: ZwQuerySystemInformation returned %#x and NumberOfModules=%#x\n",
381	rcNt, pInfo->NumberOfModules));
382	if ( NT_SUCCESS(rcNt)
383	\|\| rcNt == STATUS_INFO_LENGTH_MISMATCH)
384	rc = VINF_SUCCESS;
385	else
386	{
387	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: ZwQuerySystemInformation failed: %#x\n", rcNt));
388	rc = RTErrConvertFromNtStatus(rcNt);
389	}
390	if (RT_SUCCESS(rc))
391	{
392	/*
393	* Search the info. The information is ordered with the kernel bits first,
394	* we expect aleast two modules to be returned to us (kernel + hal)!
395	*/
396	#if ARCH_BITS == 32
397	uintptr_t const uMinKernelAddr = _2G; /** @todo resolve MmSystemRangeStart */
398	#else
399	uintptr_t const uMinKernelAddr = (uintptr_t)MM_SYSTEM_RANGE_START;
400	#endif
401	if (pInfo->NumberOfModules < cModules)
402	cModules = pInfo->NumberOfModules;
403	if (cModules < 2)
404	{
405	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Error! Only %u module(s) returned!\n", cModules));
406	rc = VERR_BUFFER_UNDERFLOW;
407	}
408	for (uint32_t iModule = 0; iModule < cModules; iModule++)
409	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: [%u]= %p LB %#x %s\n", iModule, pInfo->Modules[iModule].ImageBase,
410	pInfo->Modules[iModule].ImageSize, pInfo->Modules[iModule].FullPathName));
411
412	/*
413	* First time around we serch for the NT kernel and HAL. We'll look for NT
414	* kerneland HAL in the first 16 entries, and if not found, use the first
415	* and second entry respectively.
416	*/
417	if ( RT_SUCCESS(rc)
418	&& !g_NtOsKrnlInfo.pbImageBase
419	&& !g_HalInfo.pbImageBase)
420	{
421	/* Find them. */
422	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Looking for kernel and hal...\n"));
423	uint32_t const cMaxModules = RT_MIN(cModules, 16);
424	uint32_t idxNtOsKrnl = UINT32_MAX;
425	uint32_t idxHal = UINT32_MAX;
426	for (uint32_t iModule = 0; iModule < cMaxModules; iModule++)
427	{
428	RTL_PROCESS_MODULE_INFORMATION const * const pModule = &pInfo->Modules[iModule];
429	if ( (uintptr_t)pModule->ImageBase >= uMinKernelAddr
430	&& (uintptr_t)pModule->ImageSize >= _4K)
431	{
432	const char pszName = (const char )&pModule->FullPathName[pModule->OffsetToFileName];
433	if ( idxNtOsKrnl == UINT32_MAX
434	&& RTStrICmpAscii(pszName, g_NtOsKrnlInfo.szName) == 0)
435	{
436	idxNtOsKrnl = iModule;
437	if (idxHal != UINT32_MAX)
438	break;
439	}
440	else if ( idxHal == UINT32_MAX
441	&& RTStrICmpAscii(pszName, g_HalInfo.szName) == 0)
442	{
443	idxHal = iModule;
444	if (idxHal != UINT32_MAX)
445	break;
446	}
447	}
448	}
449	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: idxNtOsKrnl=%#x idxHal=%#x\n", idxNtOsKrnl, idxHal));
450	if (idxNtOsKrnl == UINT32_MAX)
451	{
452	idxNtOsKrnl = 0;
453	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: 'ntoskrnl.exe' not found, picking '%s' instead\n",
454	pInfo->Modules[idxNtOsKrnl].FullPathName));
455	}
456	if (idxHal == UINT32_MAX)
457	{
458	idxHal = 1;
459	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: 'hal.dll' not found, picking '%s' instead\n",
460	pInfo->Modules[idxHal].FullPathName));
461	}
462
463	/* Parse them. */
464	//RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Parsing NT kernel...\n"));
465	__try
466	{
467	g_NtOsKrnlInfo.fOkay = rtR0DbgKrnlNtParseModule(&g_NtOsKrnlInfo,
468	(uint8_t const *)pInfo->Modules[idxNtOsKrnl].ImageBase,
469	pInfo->Modules[idxNtOsKrnl].ImageSize);
470	}
471	__except(EXCEPTION_EXECUTE_HANDLER)
472	{
473	g_NtOsKrnlInfo.fOkay = false;
474	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Exception in rtR0DbgKrnlNtParseModule parsing ntoskrnl.exe...\n"));
475	}
476
477	//RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Parsing HAL...\n"));
478	__try
479	{
480	g_HalInfo.fOkay = rtR0DbgKrnlNtParseModule(&g_HalInfo, (uint8_t const *)pInfo->Modules[idxHal].ImageBase,
481	pInfo->Modules[idxHal].ImageSize);
482	}
483	__except(EXCEPTION_EXECUTE_HANDLER)
484	{
485	g_HalInfo.fOkay = false;
486	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Exception in rtR0DbgKrnlNtParseModule parsing hal.dll...\n"));
487	}
488	if (!g_NtOsKrnlInfo.fOkay \|\| !g_HalInfo.fOkay)
489	rc = VERR_LDR_GENERAL_FAILURE;
490
491	/*
492	* Resolve symbols we may need in the NT kernel (provided it parsed successfully)
493	*/
494	if (g_NtOsKrnlInfo.fOkay)
495	{
496	if (!g_pfnMmGetSystemRoutineAddress)
497	{
498	//RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Looking up 'MmGetSystemRoutineAddress'...\n"));
499	rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, "MmGetSystemRoutineAddress", (void **)&g_pfnMmGetSystemRoutineAddress);
500	}
501	}
502	}
503
504	/*
505	* If we're still good, search for the given module (optional).
506	*/
507	if (RT_SUCCESS(rc) && pModInfo)
508	{
509	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Locating module '%s'...\n", pModInfo->szName));
510	rc = VERR_MODULE_NOT_FOUND;
511	for (uint32_t iModule = 0; iModule < cModules; iModule++)
512	{
513	RTL_PROCESS_MODULE_INFORMATION const * const pModule = &pInfo->Modules[iModule];
514	if ( (uintptr_t)pModule->ImageBase >= uMinKernelAddr
515	&& (uintptr_t)pModule->ImageSize >= _4K)
516	{
517	const char pszName = (const char )&pModule->FullPathName[pModule->OffsetToFileName];
518	if ( pModInfo->pbImageBase == NULL
519	&& RTStrICmpAscii(pszName, pModInfo->szName) == 0)
520	{
521	/*
522	* Found the module, try parse it.
523	*/
524	__try
525	{
526	pModInfo->fOkay = rtR0DbgKrnlNtParseModule(pModInfo, (uint8_t const *)pModule->ImageBase,
527	pModule->ImageSize);
528	rc = VINF_SUCCESS;
529	}
530	__except(EXCEPTION_EXECUTE_HANDLER)
531	{
532	pModInfo->fOkay = false;
533	rc = VERR_BAD_EXE_FORMAT;
534	}
535	break;
536	}
537	}
538	}
539	}
540	}
541
542	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: returns %d\n", rc));
543	RTMemFree(pInfo);
544	return rc;
545	}
546
547
548
549	RTR0DECL(int) RTR0DbgKrnlInfoOpen(PRTDBGKRNLINFO phKrnlInfo, uint32_t fFlags)
550	{
551	AssertReturn(!fFlags, VERR_INVALID_FLAGS);
552
553	RTDBGKRNLINFOINT pThis = (RTDBGKRNLINFOINT )RTMemAllocZ(sizeof(*pThis));
554	if (pThis)
555	{
556	pThis->u32Magic = RTDBGKRNLINFO_MAGIC;
557	pThis->cRefs = 1;
558	*phKrnlInfo = pThis;
559	return VINF_SUCCESS;
560	}
561	return VERR_NO_MEMORY;
562	}
563
564
565	RTR0DECL(uint32_t) RTR0DbgKrnlInfoRetain(RTDBGKRNLINFO hKrnlInfo)
566	{
567	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
568	AssertPtrReturn(pThis, UINT32_MAX);
569	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), UINT32_MAX);
570
571	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
572	Assert(cRefs && cRefs < 100000);
573	return cRefs;
574	}
575
576
577	static void rtR0DbgKrnlNtDtor(RTDBGKRNLINFOINT *pThis)
578	{
579	pThis->u32Magic = ~RTDBGKRNLINFO_MAGIC;
580	RTMemFree(pThis);
581	}
582
583
584	RTR0DECL(uint32_t) RTR0DbgKrnlInfoRelease(RTDBGKRNLINFO hKrnlInfo)
585	{
586	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
587	if (pThis == NIL_RTDBGKRNLINFO)
588	return 0;
589	AssertPtrReturn(pThis, UINT32_MAX);
590	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), UINT32_MAX);
591
592	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
593	if (cRefs == 0)
594	rtR0DbgKrnlNtDtor(pThis);
595	return cRefs;
596	}
597
598
599	RTR0DECL(int) RTR0DbgKrnlInfoQueryMember(RTDBGKRNLINFO hKrnlInfo, const char pszModule, const char pszStructure,
600	const char pszMember, size_t poffMember)
601	{
602	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
603	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
604	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
605	AssertPtrReturn(pszMember, VERR_INVALID_POINTER);
606	AssertPtrNullReturn(pszModule, VERR_INVALID_POINTER);
607	AssertPtrReturn(pszStructure, VERR_INVALID_POINTER);
608	AssertPtrReturn(poffMember, VERR_INVALID_POINTER);
609	return VERR_NOT_FOUND;
610	}
611
612
613	RTR0DECL(int) RTR0DbgKrnlInfoQuerySymbol(RTDBGKRNLINFO hKrnlInfo, const char pszModule, const char pszSymbol, void **ppvSymbol)
614	{
615	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
616	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
617	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
618	AssertPtrReturn(pszSymbol, VERR_INVALID_PARAMETER);
619	AssertPtrNullReturn(ppvSymbol, VERR_INVALID_PARAMETER);
620
621	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: pszModule=%s pszSymbol=%s\n", pszModule ? pszModule : "<null>", pszSymbol));
622
623	void *pvTmpSymbol = NULL;
624	if (!ppvSymbol)
625	ppvSymbol = &pvTmpSymbol;
626
627	int rc;
628	if (!pszModule)
629	{
630	/*
631	* Search both ntoskrnl and hal, may use MmGetSystemRoutineAddress as fallback.
632	* Note! MmGetSystemRoutineAddress was buggy before XP SP2 according to Geoff Chappell.
633	*/
634	if (g_NtOsKrnlInfo.pbImageBase)
635	rc = VINF_SUCCESS;
636	else
637	rc = rtR0DbgKrnlNtInit(NULL);
638	if (RT_SUCCESS(rc))
639	{
640	Assert(g_NtOsKrnlInfo.fOkay);
641	Assert(g_HalInfo.fOkay);
642	//RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: Calling RTR0DbgKrnlInfoQuerySymbol on NT kernel...\n"));
643	rc = rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, pszSymbol, ppvSymbol);
644	if (RT_FAILURE(rc))
645	{
646	//RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: Calling RTR0DbgKrnlInfoQuerySymbol on HAL kernel...\n"));
647	rc = rtR0DbgKrnlInfoLookupSymbol(&g_HalInfo, pszSymbol, ppvSymbol);
648	}
649	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: #1 returns %d ppvSymbol=%p\n", rc, ppvSymbol));
650	}
651	else
652	{
653	/* Init failed. Try resolve symbol, but preserve the status code up to a point. */
654	int rc2 = VERR_SYMBOL_NOT_FOUND;
655	if (g_NtOsKrnlInfo.fOkay)
656	rc2 = rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, pszSymbol, ppvSymbol);
657	if (g_HalInfo.fOkay && rc2 == VERR_SYMBOL_NOT_FOUND)
658	rc2 = rtR0DbgKrnlInfoLookupSymbol(&g_HalInfo, pszSymbol, ppvSymbol);
659	if ( rc2 == VERR_SYMBOL_NOT_FOUND
660	&& g_pfnMmGetSystemRoutineAddress)
661	{
662	/* We'll overwrite init failure status code here since
663	MmGetSystemRoutineAddress will do the job for us. */
664	size_t cwcSymbol;
665	PRTUTF16 pwszSymbol = NULL;
666	rc = RTStrToUtf16Ex(pszSymbol, RTSTR_MAX, &pwszSymbol, 0, &cwcSymbol);
667	if (RT_SUCCESS(rc))
668	{
669	UNICODE_STRING UniStr;
670	UniStr.Buffer = pwszSymbol;
671	UniStr.Length = (uint16_t)(cwcSymbol * sizeof(RTUTF16));
672	UniStr.MaximumLength = UniStr.Length + sizeof(RTUTF16);
673	*ppvSymbol = g_pfnMmGetSystemRoutineAddress(&UniStr);
674	if (*ppvSymbol)
675	rc = VINF_SUCCESS;
676	else
677	rc = VERR_SYMBOL_NOT_FOUND;
678	RTUtf16Free(pwszSymbol);
679	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: #2 returns %d ppvSymbol=%p\n", rc, ppvSymbol));
680	}
681	}
682	}
683	}
684	else
685	{
686	/*
687	* Search specified module.
688	*/
689	rc = VERR_MODULE_NOT_FOUND;
690	PRTDBGNTKRNLMODINFO pModInfo;
691	if (RTStrICmpAscii(pszModule, g_NtOsKrnlInfo.szName) == 0)
692	pModInfo = &g_NtOsKrnlInfo;
693	else if (RTStrICmpAscii(pszModule, g_HalInfo.szName) == 0)
694	pModInfo = &g_NtOsKrnlInfo;
695	else
696	{
697	pModInfo = NULL;
698	for (unsigned i = 0; i < pThis->cModules; i++)
699	if (RTStrICmpAscii(pszModule, pThis->aModules[i].szName) == 0)
700	{
701	pModInfo = &pThis->aModules[i];
702	break;
703	}
704	if (!pModInfo)
705	{
706	/*
707	* Not found, try load it. If module table is full, drop the first
708	* entry and shuffle the other up to make space.
709	*/
710	size_t const cchModule = strlen(pszModule);
711	RTDBGNTKRNLMODINFO NewModInfo;
712	if (cchModule < sizeof(NewModInfo.szName))
713	{
714	RT_ZERO(NewModInfo);
715	memcpy(NewModInfo.szName, pszModule, cchModule);
716	NewModInfo.szName[cchModule] = '\0';
717
718	rc = rtR0DbgKrnlNtInit(&NewModInfo);
719	if (RT_SUCCESS(rc))
720	{
721	Assert(NewModInfo.fOkay);
722	uint32_t iModule = pThis->cModules;
723	if (iModule >= RT_ELEMENTS(pThis->aModules))
724	{
725	iModule = RT_ELEMENTS(pThis->aModules) - 1;
726	memmove(&pThis->aModules[0], &pThis->aModules[1], iModule * sizeof(pThis->aModules[0]));
727	}
728	pThis->aModules[iModule] = NewModInfo;
729	pThis->cModules = iModule + 1;
730	pModInfo = &pThis->aModules[iModule];
731	rc = VINF_SUCCESS;
732	}
733	}
734	else
735	{
736	AssertMsgFailed(("cchModule=%zu pszModule=%s\n", cchModule, pszModule));
737	rc = VERR_FILENAME_TOO_LONG;
738	}
739	}
740	}
741	if (pModInfo)
742	{
743	rc = rtR0DbgKrnlInfoLookupSymbol(pModInfo, pszSymbol, ppvSymbol);
744	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: #3 returns %d ppvSymbol=%p\n", rc, ppvSymbol));
745	}
746	}
747	return rc;
748	}
749
750
751	RTR0DECL(int) RTR0DbgKrnlInfoQuerySize(RTDBGKRNLINFO hKrnlInfo, const char pszModule, const char pszType, size_t *pcbType)
752	{
753	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
754	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
755	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
756	AssertPtrNullReturn(pszModule, VERR_INVALID_POINTER);
757	AssertPtrReturn(pszType, VERR_INVALID_POINTER);
758	AssertPtrReturn(pcbType, VERR_INVALID_POINTER);
759	return VERR_NOT_FOUND;
760	}
761

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/r0drv/nt/dbgkrnlinfo-r0drv-nt.cpp@ 76452

Download in other formats: