dbgkrnlinfo-r0drv-nt.cpp@ 78071

Last change on this file since 78071 was 77816, checked in by vboxsync, 6 years ago
SupHardNt: Made RTNtPathExpand8dot3Path() work correctly in kernel context (needs IPRT_NT_MAP_TO_ZW) and expand 8.3 names when comparing the executable image we found in the memory map with what NT returns for the process.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 34.7 KB

Line
1	/* $Id: dbgkrnlinfo-r0drv-nt.cpp 77816 2019-03-21 00:01:49Z vboxsync $ */
2	/** @file
3	* IPRT - Kernel Debug Information, R0 Driver, NT.
4	*/
5
6	/*
7	* Copyright (C) 2006-2019 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#define IMAGE_NT_HEADERS NT_IMAGE_NT_HEADERS
32	#define IMAGE_NT_HEADERS32 NT_IMAGE_NT_HEADERS32
33	#define IMAGE_NT_HEADERS64 NT_IMAGE_NT_HEADERS64
34	#define PIMAGE_NT_HEADERS NT_PIMAGE_NT_HEADERS
35	#define PIMAGE_NT_HEADERS32 NT_PIMAGE_NT_HEADERS32
36	#define PIMAGE_NT_HEADERS64 NT_PIMAGE_NT_HEADERS64
37	#ifndef IPRT_NT_MAP_TO_ZW
38	# define IPRT_NT_MAP_TO_ZW
39	#endif
40	#include "the-nt-kernel.h"
41	#include <iprt/dbg.h>
42
43	#include <iprt/err.h>
44	#include <iprt/log.h>
45	#include <iprt/mem.h>
46	#include <iprt/string.h>
47	#include <iprt/utf16.h>
48	#include "internal-r0drv-nt.h"
49	#include "internal/magics.h"
50
51	#undef IMAGE_NT_HEADERS
52	#undef IMAGE_NT_HEADERS32
53	#undef IMAGE_NT_HEADERS64
54	#undef PIMAGE_NT_HEADERS
55	#undef PIMAGE_NT_HEADERS32
56	#undef PIMAGE_NT_HEADERS64
57	#include <iprt/formats/pecoff.h>
58	#include <iprt/formats/mz.h>
59
60
61	/*********************************************************************************************************************************
62	* Defined Constants And Macros *
63	*********************************************************************************************************************************/
64	/** Private logging macro, will use DbgPrint! */
65	#ifdef IN_GUEST
66	# define RTR0DBG_NT_ERROR_LOG(a) do { RTLogBackdoorPrintf a; DbgPrint a; } while (0)
67	# define RTR0DBG_NT_DEBUG_LOG(a) do { RTLogBackdoorPrintf a; DbgPrint a; } while (0)
68	#else
69	# define RTR0DBG_NT_ERROR_LOG(a) do { DbgPrint a; } while (0)
70	# define RTR0DBG_NT_DEBUG_LOG(a) do { DbgPrint a; } while (0)
71	#endif
72	#ifndef LOG_ENABLED
73	# undef RTR0DBG_NT_DEBUG_LOG
74	# define RTR0DBG_NT_DEBUG_LOG(a) do { } while (0)
75	#endif
76
77
78	/*********************************************************************************************************************************
79	* Structures and Typedefs *
80	*********************************************************************************************************************************/
81	#define PIMAGE_NT_HEADERS RT_CONCAT(PIMAGE_NT_HEADERS, ARCH_BITS)
82
83	/**
84	* Information we cache for a kernel module.
85	*/
86	typedef struct RTDBGNTKRNLMODINFO
87	{
88	/** The module name. */
89	char szName[32];
90
91	/** The image base. */
92	uint8_t const *pbImageBase;
93	/** The NT headers. */
94	PIMAGE_NT_HEADERS pNtHdrs;
95	/** Set if this module parsed okay and all fields are valid. */
96	bool fOkay;
97	/** The NT header offset/RVA. */
98	uint32_t offNtHdrs;
99	/** The end of the section headers. */
100	uint32_t offEndSectHdrs;
101	/** The end of the image. */
102	uint32_t cbImage;
103	/** Offset of the export directory. */
104	uint32_t offExportDir;
105	/** Size of the export directory. */
106	uint32_t cbExportDir;
107
108	/** Exported functions and data by ordinal (RVAs). */
109	uint32_t const *paoffExports;
110	/** The number of exports. */
111	uint32_t cExports;
112	/** The number of exported names. */
113	uint32_t cNamedExports;
114	/** Pointer to the array of exported names (RVAs to strings). */
115	uint32_t const *paoffNamedExports;
116	/** Array parallel to paoffNamedExports with the corresponding ordinals
117	* (indexes into paoffExports). */
118	uint16_t const *pau16NameOrdinals;
119	} RTDBGNTKRNLMODINFO;
120	/** Pointer to kernel module info. */
121	typedef RTDBGNTKRNLMODINFO *PRTDBGNTKRNLMODINFO;
122	/** Pointer to const kernel module info. */
123	typedef RTDBGNTKRNLMODINFO const *PCRTDBGNTKRNLMODINFO;
124
125
126	/**
127	* NT kernel info instance.
128	*/
129	typedef struct RTDBGKRNLINFOINT
130	{
131	/** Magic value (RTDBGKRNLINFO_MAGIC). */
132	uint32_t u32Magic;
133	/** Reference counter. */
134	uint32_t volatile cRefs;
135	/** Number of additional modules in the cache. */
136	uint32_t cModules;
137	/** Additional modules. */
138	RTDBGNTKRNLMODINFO aModules[3];
139	} RTDBGKRNLINFOINT;
140
141
142
143	/*********************************************************************************************************************************
144	* Global Variables *
145	*********************************************************************************************************************************/
146	/** Pointer to MmGetSystemRoutineAddress.
147	* @note Added in NT v5.0. */
148	static decltype(MmGetSystemRoutineAddress) *g_pfnMmGetSystemRoutineAddress = NULL;
149	/** Info about the ntoskrnl.exe mapping. */
150	static RTDBGNTKRNLMODINFO g_NtOsKrnlInfo = { "ntoskrnl.exe", NULL, NULL, false, 0, 0, 0, 0, 0, NULL, 0, 0, NULL, NULL };
151	/** Info about the hal.dll mapping. */
152	static RTDBGNTKRNLMODINFO g_HalInfo = { "hal.dll", NULL, NULL, false, 0, 0, 0, 0, 0, NULL, 0, 0, NULL, NULL };
153
154
155
156	/**
157	* Looks up an symbol int the export table.
158	*
159	* @returns VINF_SUCCESS or VERR_SYMBOL_NOT_FOUND.
160	* @param pModInfo The module info.
161	* @param pszSymbol The symbol to find.
162	* @param cForwarders Forwarder nesting depth.
163	* @param ppvSymbol Where to put the symbol address.
164	*
165	* @note Support library has similar code for in the importless area.
166	*/
167	static int rtR0DbgKrnlInfoLookupSymbol(PCRTDBGNTKRNLMODINFO pModInfo, const char *pszSymbol, unsigned cForwarders,
168	void **ppvSymbol)
169	{
170	if (pModInfo->fOkay)
171	{
172	/*
173	* Binary search.
174	*/
175	__try
176	{
177	uint32_t iStart = 0;
178	uint32_t iEnd = pModInfo->cNamedExports;
179	while (iStart < iEnd)
180	{
181	uint32_t iCur = iStart + (iEnd - iStart) / 2;
182	uint32_t offExpName = pModInfo->paoffNamedExports[iCur];
183	if (offExpName >= pModInfo->offEndSectHdrs && offExpName < pModInfo->cbImage)
184	{ /* likely */ }
185	else
186	{
187	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: %s: Bad export name entry: %#x (iCur=%#x)\n",
188	pModInfo->szName, offExpName, iCur));
189	break;
190	}
191
192	const char pszExpName = (const char )&pModInfo->pbImageBase[offExpName];
193	int iDiff = strcmp(pszExpName, pszSymbol);
194	if (iDiff > 0) /* pszExpName > pszSymbol: search chunck before i */
195	iEnd = iCur;
196	else if (iDiff < 0) /* pszExpName < pszSymbol: search chunk after i */
197	iStart = iCur + 1;
198	else /* pszExpName == pszSymbol */
199	{
200	uint16_t iExpOrdinal = pModInfo->pau16NameOrdinals[iCur];
201	if (iExpOrdinal < pModInfo->cExports)
202	{
203	uint32_t offExport = pModInfo->paoffExports[iExpOrdinal];
204	if (offExport - pModInfo->offExportDir >= pModInfo->cbExportDir)
205	{
206	ppvSymbol = (void )&pModInfo->pbImageBase[offExport];
207	return VINF_SUCCESS;
208	}
209
210	/*
211	* Deal with forwarders to NT and HAL. No ordinals.
212	*/
213	const char pszForwarder = (const char )&pModInfo->pbImageBase[offExport];
214	uint32_t cbMax = pModInfo->cbImage - offExpName;
215	size_t cchForwarder = RTStrNLen(pszForwarder, cbMax);
216	if (cchForwarder < cbMax)
217	{
218	if ( cchForwarder > 9
219	&& pModInfo != &g_NtOsKrnlInfo
220	&& g_NtOsKrnlInfo.pbImageBase != NULL
221	&& cForwarders < 2
222	&& (pszForwarder[0] == 'n' \|\| pszForwarder[0] == 'N')
223	&& (pszForwarder[1] == 't' \|\| pszForwarder[1] == 'T')
224	&& (pszForwarder[2] == 'o' \|\| pszForwarder[2] == 'O')
225	&& (pszForwarder[3] == 's' \|\| pszForwarder[3] == 'S')
226	&& (pszForwarder[4] == 'k' \|\| pszForwarder[4] == 'K')
227	&& (pszForwarder[5] == 'r' \|\| pszForwarder[5] == 'R')
228	&& (pszForwarder[6] == 'n' \|\| pszForwarder[6] == 'N')
229	&& (pszForwarder[7] == 'l' \|\| pszForwarder[7] == 'L')
230	&& pszForwarder[8] == '.')
231	return rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, pszForwarder + 9, cForwarders + 1, ppvSymbol);
232
233	if ( cchForwarder > 4
234	&& pModInfo != &g_HalInfo
235	&& g_HalInfo.pbImageBase != NULL
236	&& cForwarders < 2
237	&& (pszForwarder[0] == 'h' \|\| pszForwarder[0] == 'H')
238	&& (pszForwarder[1] == 'a' \|\| pszForwarder[1] == 'A')
239	&& (pszForwarder[2] == 'l' \|\| pszForwarder[2] == 'L')
240	&& pszForwarder[3] == '.')
241	return rtR0DbgKrnlInfoLookupSymbol(&g_HalInfo, pszForwarder + 4, cForwarders + 1, ppvSymbol);
242	}
243
244	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: %s: Forwarded symbol '%s': offExport=%#x (dir %#x LB %#x)\n",
245	pModInfo->szName, pszSymbol, offExport, pModInfo->offExportDir, pModInfo->cbExportDir));
246	}
247	else
248	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: %s: Name ordinal for '%s' is out of bounds: %#x (max %#x)\n",
249	pModInfo->szName, iExpOrdinal, pModInfo->cExports));
250	break;
251	}
252	}
253	}
254	__except(EXCEPTION_EXECUTE_HANDLER)
255	{
256	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlInfoLookupSymbol: Exception searching '%s' for '%s'...\n",
257	pModInfo->szName, pszSymbol));
258	}
259	}
260
261	*ppvSymbol = NULL;
262	return VERR_SYMBOL_NOT_FOUND;
263	}
264
265
266	/**
267	* Parses (PE) module headers and fills in the coresponding module info struct.
268	*
269	* @returns true on if success, false if not.
270	* @param pModInfo The module info structure to fill in with parsed
271	* data. The szName and fOkay are set by the
272	* caller, this function does the rest.
273	* @param pbMapping The image mapping address
274	* @param cbMapping The image mapping size.
275	*
276	* @note Support library has similar code for in the importless area.
277	*/
278	static bool rtR0DbgKrnlNtParseModule(PRTDBGNTKRNLMODINFO pModInfo, uint8_t const *pbMapping, size_t cbMapping)
279	{
280	#define MODERR_RETURN(a_LogMsg, ...) \
281	do { RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtParseModule: " a_LogMsg, __VA_ARGS__)); return false; } while (0)
282
283	pModInfo->pbImageBase = pbMapping;
284
285	/*
286	* Locate the PE header, do some basic validations.
287	*/
288	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbMapping;
289	uint32_t offNtHdrs = 0;
290	PIMAGE_NT_HEADERS pNtHdrs;
291	if (pMzHdr->e_magic == IMAGE_DOS_SIGNATURE)
292	{
293	offNtHdrs = pMzHdr->e_lfanew;
294	if (offNtHdrs > _2K)
295	MODERR_RETURN("%s: e_lfanew=%#x, expected a lower value\n", pModInfo->szName, offNtHdrs);
296	}
297	pModInfo->pNtHdrs = pNtHdrs = (PIMAGE_NT_HEADERS)&pbMapping[offNtHdrs];
298
299	if (pNtHdrs->Signature != IMAGE_NT_SIGNATURE)
300	MODERR_RETURN("%s: Invalid PE signature: %#x", pModInfo->szName, pNtHdrs->Signature);
301	if (pNtHdrs->FileHeader.SizeOfOptionalHeader != sizeof(pNtHdrs->OptionalHeader))
302	MODERR_RETURN("%s: Unexpected optional header size: %#x\n", pModInfo->szName, pNtHdrs->FileHeader.SizeOfOptionalHeader);
303	if (pNtHdrs->OptionalHeader.Magic != RT_CONCAT3(IMAGE_NT_OPTIONAL_HDR,ARCH_BITS,_MAGIC))
304	MODERR_RETURN("%s: Unexpected optional header magic: %#x\n", pModInfo->szName, pNtHdrs->OptionalHeader.Magic);
305	if (pNtHdrs->OptionalHeader.NumberOfRvaAndSizes != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
306	MODERR_RETURN("%s: Unexpected number of RVA and sizes: %#x\n", pModInfo->szName, pNtHdrs->OptionalHeader.NumberOfRvaAndSizes);
307
308	pModInfo->offNtHdrs = offNtHdrs;
309	pModInfo->offEndSectHdrs = offNtHdrs
310	+ sizeof(*pNtHdrs)
311	+ pNtHdrs->FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);
312	pModInfo->cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
313	if (pModInfo->cbImage > cbMapping)
314	MODERR_RETURN("%s: The image size %#x is larger than the mapping: %#x\n",
315	pModInfo->szName, pModInfo->cbImage, cbMapping);
316
317	/*
318	* Find the export directory.
319	*/
320	IMAGE_DATA_DIRECTORY ExpDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
321	if ( ExpDir.Size < sizeof(IMAGE_EXPORT_DIRECTORY)
322	\|\| ExpDir.VirtualAddress < pModInfo->offEndSectHdrs
323	\|\| ExpDir.VirtualAddress >= pModInfo->cbImage
324	\|\| ExpDir.VirtualAddress + ExpDir.Size > pModInfo->cbImage)
325	MODERR_RETURN("%s: Missing or invalid export directory: %#lx LB %#x\n", pModInfo->szName, ExpDir.VirtualAddress, ExpDir.Size);
326	pModInfo->offExportDir = ExpDir.VirtualAddress;
327	pModInfo->cbExportDir = ExpDir.Size;
328
329	IMAGE_EXPORT_DIRECTORY const pExpDir = (IMAGE_EXPORT_DIRECTORY const )&pbMapping[ExpDir.VirtualAddress];
330
331	if ( pExpDir->NumberOfFunctions >= _1M
332	\|\| pExpDir->NumberOfFunctions < 1
333	\|\| pExpDir->NumberOfNames >= _1M
334	\|\| pExpDir->NumberOfNames < 1)
335	MODERR_RETURN("%s: NumberOfNames or/and NumberOfFunctions are outside the expected range: nof=%#x non=%#x\n",
336	pModInfo->szName, pExpDir->NumberOfFunctions, pExpDir->NumberOfNames);
337	pModInfo->cNamedExports = pExpDir->NumberOfNames;
338	pModInfo->cExports = RT_MAX(pExpDir->NumberOfNames, pExpDir->NumberOfFunctions);
339
340	if ( pExpDir->AddressOfFunctions < pModInfo->offEndSectHdrs
341	\|\| pExpDir->AddressOfFunctions >= pModInfo->cbImage
342	\|\| pExpDir->AddressOfFunctions + pModInfo->cExports * sizeof(uint32_t) > pModInfo->cbImage)
343	MODERR_RETURN("%s: Bad AddressOfFunctions: %#x\n", pModInfo->szName, pExpDir->AddressOfFunctions);
344	pModInfo->paoffExports = (uint32_t const *)&pbMapping[pExpDir->AddressOfFunctions];
345
346	if ( pExpDir->AddressOfNames < pModInfo->offEndSectHdrs
347	\|\| pExpDir->AddressOfNames >= pModInfo->cbImage
348	\|\| pExpDir->AddressOfNames + pExpDir->NumberOfNames * sizeof(uint32_t) > pModInfo->cbImage)
349	MODERR_RETURN("%s: Bad AddressOfNames: %#x\n", pModInfo->szName, pExpDir->AddressOfNames);
350	pModInfo->paoffNamedExports = (uint32_t const *)&pbMapping[pExpDir->AddressOfNames];
351
352	if ( pExpDir->AddressOfNameOrdinals < pModInfo->offEndSectHdrs
353	\|\| pExpDir->AddressOfNameOrdinals >= pModInfo->cbImage
354	\|\| pExpDir->AddressOfNameOrdinals + pExpDir->NumberOfNames * sizeof(uint32_t) > pModInfo->cbImage)
355	MODERR_RETURN("%s: Bad AddressOfNameOrdinals: %#x\n", pModInfo->szName, pExpDir->AddressOfNameOrdinals);
356	pModInfo->pau16NameOrdinals = (uint16_t const *)&pbMapping[pExpDir->AddressOfNameOrdinals];
357
358	/*
359	* Success.
360	*/
361	return true;
362	#undef MODERR_RETURN
363	}
364
365
366	/**
367	* Searches the module information from the kernel for the NT kernel module, the
368	* HAL module, and optionally one more module.
369	*
370	* If the NT kernel or HAL modules have already been found, they'll be skipped.
371	*
372	* @returns IPRT status code.
373	* @retval VERR_LDR_GENERAL_FAILURE if we failed to parse the NT kernel or HAL.
374	* @retval VERR_BAD_EXE_FORMAT if we failed to parse @a pModInfo.
375	* @retval VERR_MODULE_NOT_FOUND if @a pModInfo wasn't found.
376	* @retval VERR_BUFFER_UNDERFLOW if less that two modules was returned by the
377	* system.
378	*
379	* @param pModInfo Custom module to search for. Optional.
380	*/
381	static int rtR0DbgKrnlNtInit(PRTDBGNTKRNLMODINFO pModInfo)
382	{
383	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: pModInfo=%p\n", pModInfo));
384
385	#ifndef IPRT_TARGET_NT4
386	/*
387	* Must manually initialize g_pfnMmGetSystemRoutineAddress, otherwise compiler
388	* generates its own dynamic init code that might not necessarily be called.
389	*/
390	g_pfnMmGetSystemRoutineAddress = MmGetSystemRoutineAddress;
391	#endif
392
393	/*
394	* Allocate a reasonably large buffer and get the information we need. We don't
395	* need everything since the result starts off with the kernel bits in load order.
396	*
397	* Note! ZwQuerySystemInformation requires NT4. For 3.51 we could possibly emit
398	* the syscall ourselves, if we cared.
399	*/
400	uint32_t cModules = pModInfo ? 110 /32KB/ : 27 /8KB/;
401	ULONG cbInfo = RT_UOFFSETOF_DYN(RTL_PROCESS_MODULES, Modules[cModules]);
402	PRTL_PROCESS_MODULES pInfo = (PRTL_PROCESS_MODULES)RTMemAllocZ(cbInfo);
403	if (!pInfo)
404	{
405	cModules = cModules / 4;
406	cbInfo = RT_UOFFSETOF_DYN(RTL_PROCESS_MODULES, Modules[cModules]);
407	pInfo = (PRTL_PROCESS_MODULES)RTMemAllocZ(cbInfo);
408	if (!pInfo)
409	{
410	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Out of memory!\n"));
411	return VERR_NO_MEMORY;
412	}
413	}
414
415	int rc;
416	ULONG cbActual = 0;
417	NTSTATUS rcNt = ZwQuerySystemInformation(SystemModuleInformation, pInfo, cbInfo, &cbActual);
418	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: ZwQuerySystemInformation returned %#x and NumberOfModules=%#x\n",
419	rcNt, pInfo->NumberOfModules));
420	if ( NT_SUCCESS(rcNt)
421	\|\| rcNt == STATUS_INFO_LENGTH_MISMATCH)
422	rc = VINF_SUCCESS;
423	else
424	{
425	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: ZwQuerySystemInformation failed: %#x\n", rcNt));
426	rc = RTErrConvertFromNtStatus(rcNt);
427	}
428	if (RT_SUCCESS(rc))
429	{
430	/*
431	* Search the info. The information is ordered with the kernel bits first,
432	* we expect aleast two modules to be returned to us (kernel + hal)!
433	*/
434	#if ARCH_BITS == 32
435	uintptr_t const uMinKernelAddr = _2G; /** @todo resolve MmSystemRangeStart */
436	#else
437	uintptr_t const uMinKernelAddr = (uintptr_t)MM_SYSTEM_RANGE_START;
438	#endif
439	if (pInfo->NumberOfModules < cModules)
440	cModules = pInfo->NumberOfModules;
441	if (cModules < 2)
442	{
443	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Error! Only %u module(s) returned!\n", cModules));
444	rc = VERR_BUFFER_UNDERFLOW;
445	}
446	for (uint32_t iModule = 0; iModule < cModules; iModule++)
447	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: [%u]= %p LB %#x %s\n", iModule, pInfo->Modules[iModule].ImageBase,
448	pInfo->Modules[iModule].ImageSize, pInfo->Modules[iModule].FullPathName));
449
450	/*
451	* First time around we serch for the NT kernel and HAL. We'll look for NT
452	* kerneland HAL in the first 16 entries, and if not found, use the first
453	* and second entry respectively.
454	*/
455	if ( RT_SUCCESS(rc)
456	&& !g_NtOsKrnlInfo.pbImageBase
457	&& !g_HalInfo.pbImageBase)
458	{
459	/* Find them. */
460	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Looking for kernel and hal...\n"));
461	uint32_t const cMaxModules = RT_MIN(cModules, 16);
462	uint32_t idxNtOsKrnl = UINT32_MAX;
463	uint32_t idxHal = UINT32_MAX;
464	for (uint32_t iModule = 0; iModule < cMaxModules; iModule++)
465	{
466	RTL_PROCESS_MODULE_INFORMATION const * const pModule = &pInfo->Modules[iModule];
467	if ( (uintptr_t)pModule->ImageBase >= uMinKernelAddr
468	&& (uintptr_t)pModule->ImageSize >= _4K)
469	{
470	const char pszName = (const char )&pModule->FullPathName[pModule->OffsetToFileName];
471	if ( idxNtOsKrnl == UINT32_MAX
472	&& RTStrICmpAscii(pszName, g_NtOsKrnlInfo.szName) == 0)
473	{
474	idxNtOsKrnl = iModule;
475	if (idxHal != UINT32_MAX)
476	break;
477	}
478	else if ( idxHal == UINT32_MAX
479	&& RTStrICmpAscii(pszName, g_HalInfo.szName) == 0)
480	{
481	idxHal = iModule;
482	if (idxHal != UINT32_MAX)
483	break;
484	}
485	}
486	}
487	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: idxNtOsKrnl=%#x idxHal=%#x\n", idxNtOsKrnl, idxHal));
488	if (idxNtOsKrnl == UINT32_MAX)
489	{
490	idxNtOsKrnl = 0;
491	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: 'ntoskrnl.exe' not found, picking '%s' instead\n",
492	pInfo->Modules[idxNtOsKrnl].FullPathName));
493	}
494	if (idxHal == UINT32_MAX)
495	{
496	idxHal = 1;
497	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: 'hal.dll' not found, picking '%s' instead\n",
498	pInfo->Modules[idxHal].FullPathName));
499	}
500
501	/* Parse them. */
502	//RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Parsing NT kernel...\n"));
503	__try
504	{
505	g_NtOsKrnlInfo.fOkay = rtR0DbgKrnlNtParseModule(&g_NtOsKrnlInfo,
506	(uint8_t const *)pInfo->Modules[idxNtOsKrnl].ImageBase,
507	pInfo->Modules[idxNtOsKrnl].ImageSize);
508	}
509	__except(EXCEPTION_EXECUTE_HANDLER)
510	{
511	g_NtOsKrnlInfo.fOkay = false;
512	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Exception in rtR0DbgKrnlNtParseModule parsing ntoskrnl.exe...\n"));
513	}
514
515	//RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Parsing HAL...\n"));
516	__try
517	{
518	g_HalInfo.fOkay = rtR0DbgKrnlNtParseModule(&g_HalInfo, (uint8_t const *)pInfo->Modules[idxHal].ImageBase,
519	pInfo->Modules[idxHal].ImageSize);
520	}
521	__except(EXCEPTION_EXECUTE_HANDLER)
522	{
523	g_HalInfo.fOkay = false;
524	RTR0DBG_NT_ERROR_LOG(("rtR0DbgKrnlNtInit: Exception in rtR0DbgKrnlNtParseModule parsing hal.dll...\n"));
525	}
526	if (!g_NtOsKrnlInfo.fOkay \|\| !g_HalInfo.fOkay)
527	rc = VERR_LDR_GENERAL_FAILURE;
528
529	/*
530	* Resolve symbols we may need in the NT kernel (provided it parsed successfully)
531	*/
532	if (g_NtOsKrnlInfo.fOkay)
533	{
534	if (!g_pfnMmGetSystemRoutineAddress)
535	{
536	//RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Looking up 'MmGetSystemRoutineAddress'...\n"));
537	rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, "MmGetSystemRoutineAddress", 0,
538	(void **)&g_pfnMmGetSystemRoutineAddress);
539	}
540	}
541	}
542
543	/*
544	* If we're still good, search for the given module (optional).
545	*/
546	if (RT_SUCCESS(rc) && pModInfo)
547	{
548	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: Locating module '%s'...\n", pModInfo->szName));
549	rc = VERR_MODULE_NOT_FOUND;
550	for (uint32_t iModule = 0; iModule < cModules; iModule++)
551	{
552	RTL_PROCESS_MODULE_INFORMATION const * const pModule = &pInfo->Modules[iModule];
553	if ( (uintptr_t)pModule->ImageBase >= uMinKernelAddr
554	&& (uintptr_t)pModule->ImageSize >= _4K)
555	{
556	const char pszName = (const char )&pModule->FullPathName[pModule->OffsetToFileName];
557	if ( pModInfo->pbImageBase == NULL
558	&& RTStrICmpAscii(pszName, pModInfo->szName) == 0)
559	{
560	/*
561	* Found the module, try parse it.
562	*/
563	__try
564	{
565	pModInfo->fOkay = rtR0DbgKrnlNtParseModule(pModInfo, (uint8_t const *)pModule->ImageBase,
566	pModule->ImageSize);
567	rc = VINF_SUCCESS;
568	}
569	__except(EXCEPTION_EXECUTE_HANDLER)
570	{
571	pModInfo->fOkay = false;
572	rc = VERR_BAD_EXE_FORMAT;
573	}
574	break;
575	}
576	}
577	}
578	}
579	}
580
581	RTR0DBG_NT_DEBUG_LOG(("rtR0DbgKrnlNtInit: returns %d\n", rc));
582	RTMemFree(pInfo);
583	return rc;
584	}
585
586
587
588	RTR0DECL(int) RTR0DbgKrnlInfoOpen(PRTDBGKRNLINFO phKrnlInfo, uint32_t fFlags)
589	{
590	AssertReturn(!fFlags, VERR_INVALID_FLAGS);
591
592	RTDBGKRNLINFOINT pThis = (RTDBGKRNLINFOINT )RTMemAllocZ(sizeof(*pThis));
593	if (pThis)
594	{
595	pThis->u32Magic = RTDBGKRNLINFO_MAGIC;
596	pThis->cRefs = 1;
597	*phKrnlInfo = pThis;
598	return VINF_SUCCESS;
599	}
600	return VERR_NO_MEMORY;
601	}
602
603
604	RTR0DECL(uint32_t) RTR0DbgKrnlInfoRetain(RTDBGKRNLINFO hKrnlInfo)
605	{
606	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
607	AssertPtrReturn(pThis, UINT32_MAX);
608	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), UINT32_MAX);
609
610	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
611	Assert(cRefs && cRefs < 100000);
612	return cRefs;
613	}
614
615
616	static void rtR0DbgKrnlNtDtor(RTDBGKRNLINFOINT *pThis)
617	{
618	pThis->u32Magic = ~RTDBGKRNLINFO_MAGIC;
619	RTMemFree(pThis);
620	}
621
622
623	RTR0DECL(uint32_t) RTR0DbgKrnlInfoRelease(RTDBGKRNLINFO hKrnlInfo)
624	{
625	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
626	if (pThis == NIL_RTDBGKRNLINFO)
627	return 0;
628	AssertPtrReturn(pThis, UINT32_MAX);
629	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), UINT32_MAX);
630
631	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
632	if (cRefs == 0)
633	rtR0DbgKrnlNtDtor(pThis);
634	return cRefs;
635	}
636
637
638	RTR0DECL(int) RTR0DbgKrnlInfoQueryMember(RTDBGKRNLINFO hKrnlInfo, const char pszModule, const char pszStructure,
639	const char pszMember, size_t poffMember)
640	{
641	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
642	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
643	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
644	AssertPtrReturn(pszMember, VERR_INVALID_POINTER);
645	AssertPtrNullReturn(pszModule, VERR_INVALID_POINTER);
646	AssertPtrReturn(pszStructure, VERR_INVALID_POINTER);
647	AssertPtrReturn(poffMember, VERR_INVALID_POINTER);
648	return VERR_NOT_FOUND;
649	}
650
651
652	RTR0DECL(int) RTR0DbgKrnlInfoQuerySymbol(RTDBGKRNLINFO hKrnlInfo, const char pszModule, const char pszSymbol, void **ppvSymbol)
653	{
654	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
655	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
656	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
657	AssertPtrReturn(pszSymbol, VERR_INVALID_PARAMETER);
658	AssertPtrNullReturn(ppvSymbol, VERR_INVALID_PARAMETER);
659
660	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: pszModule=%s pszSymbol=%s\n", pszModule ? pszModule : "<null>", pszSymbol));
661
662	void *pvTmpSymbol = NULL;
663	if (!ppvSymbol)
664	ppvSymbol = &pvTmpSymbol;
665
666	int rc;
667	if (!pszModule)
668	{
669	/*
670	* Search both ntoskrnl and hal, may use MmGetSystemRoutineAddress as fallback.
671	* Note! MmGetSystemRoutineAddress was buggy before XP SP2 according to Geoff Chappell.
672	*/
673	if (g_NtOsKrnlInfo.pbImageBase)
674	rc = VINF_SUCCESS;
675	else
676	rc = rtR0DbgKrnlNtInit(NULL);
677	if (RT_SUCCESS(rc))
678	{
679	Assert(g_NtOsKrnlInfo.fOkay);
680	Assert(g_HalInfo.fOkay);
681	//RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: Calling RTR0DbgKrnlInfoQuerySymbol on NT kernel...\n"));
682	rc = rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, pszSymbol, 0, ppvSymbol);
683	if (RT_FAILURE(rc))
684	{
685	//RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: Calling RTR0DbgKrnlInfoQuerySymbol on HAL kernel...\n"));
686	rc = rtR0DbgKrnlInfoLookupSymbol(&g_HalInfo, pszSymbol, 0, ppvSymbol);
687	}
688	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: #1 returns %d ppvSymbol=%p\n", rc, ppvSymbol));
689	}
690	else
691	{
692	/* Init failed. Try resolve symbol, but preserve the status code up to a point. */
693	int rc2 = VERR_SYMBOL_NOT_FOUND;
694	if (g_NtOsKrnlInfo.fOkay)
695	rc2 = rtR0DbgKrnlInfoLookupSymbol(&g_NtOsKrnlInfo, pszSymbol, 0, ppvSymbol);
696	if (g_HalInfo.fOkay && rc2 == VERR_SYMBOL_NOT_FOUND)
697	rc2 = rtR0DbgKrnlInfoLookupSymbol(&g_HalInfo, pszSymbol, 0, ppvSymbol);
698	if ( rc2 == VERR_SYMBOL_NOT_FOUND
699	&& g_pfnMmGetSystemRoutineAddress)
700	{
701	/* We'll overwrite init failure status code here since
702	MmGetSystemRoutineAddress will do the job for us. */
703	size_t cwcSymbol;
704	PRTUTF16 pwszSymbol = NULL;
705	rc = RTStrToUtf16Ex(pszSymbol, RTSTR_MAX, &pwszSymbol, 0, &cwcSymbol);
706	if (RT_SUCCESS(rc))
707	{
708	UNICODE_STRING UniStr;
709	UniStr.Buffer = pwszSymbol;
710	UniStr.Length = (uint16_t)(cwcSymbol * sizeof(RTUTF16));
711	UniStr.MaximumLength = UniStr.Length + sizeof(RTUTF16);
712	*ppvSymbol = g_pfnMmGetSystemRoutineAddress(&UniStr);
713	if (*ppvSymbol)
714	rc = VINF_SUCCESS;
715	else
716	rc = VERR_SYMBOL_NOT_FOUND;
717	RTUtf16Free(pwszSymbol);
718	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: #2 returns %d ppvSymbol=%p\n", rc, ppvSymbol));
719	}
720	}
721	}
722	}
723	else
724	{
725	/*
726	* Search specified module.
727	*/
728	rc = VERR_MODULE_NOT_FOUND;
729	PRTDBGNTKRNLMODINFO pModInfo;
730	if (RTStrICmpAscii(pszModule, g_NtOsKrnlInfo.szName) == 0)
731	pModInfo = &g_NtOsKrnlInfo;
732	else if (RTStrICmpAscii(pszModule, g_HalInfo.szName) == 0)
733	pModInfo = &g_NtOsKrnlInfo;
734	else
735	{
736	pModInfo = NULL;
737	for (unsigned i = 0; i < pThis->cModules; i++)
738	if (RTStrICmpAscii(pszModule, pThis->aModules[i].szName) == 0)
739	{
740	pModInfo = &pThis->aModules[i];
741	break;
742	}
743	if (!pModInfo)
744	{
745	/*
746	* Not found, try load it. If module table is full, drop the first
747	* entry and shuffle the other up to make space.
748	*/
749	size_t const cchModule = strlen(pszModule);
750	RTDBGNTKRNLMODINFO NewModInfo;
751	if (cchModule < sizeof(NewModInfo.szName))
752	{
753	RT_ZERO(NewModInfo);
754	memcpy(NewModInfo.szName, pszModule, cchModule);
755	NewModInfo.szName[cchModule] = '\0';
756
757	rc = rtR0DbgKrnlNtInit(&NewModInfo);
758	if (RT_SUCCESS(rc))
759	{
760	Assert(NewModInfo.fOkay);
761	uint32_t iModule = pThis->cModules;
762	if (iModule >= RT_ELEMENTS(pThis->aModules))
763	{
764	iModule = RT_ELEMENTS(pThis->aModules) - 1;
765	memmove(&pThis->aModules[0], &pThis->aModules[1], iModule * sizeof(pThis->aModules[0]));
766	}
767	pThis->aModules[iModule] = NewModInfo;
768	pThis->cModules = iModule + 1;
769	pModInfo = &pThis->aModules[iModule];
770	rc = VINF_SUCCESS;
771	}
772	}
773	else
774	{
775	AssertMsgFailed(("cchModule=%zu pszModule=%s\n", cchModule, pszModule));
776	rc = VERR_FILENAME_TOO_LONG;
777	}
778	}
779	}
780	if (pModInfo)
781	{
782	rc = rtR0DbgKrnlInfoLookupSymbol(pModInfo, pszSymbol, 0, ppvSymbol);
783	RTR0DBG_NT_DEBUG_LOG(("RTR0DbgKrnlInfoQuerySymbol: #3 returns %d ppvSymbol=%p\n", rc, ppvSymbol));
784	}
785	}
786	return rc;
787	}
788
789
790	RTR0DECL(int) RTR0DbgKrnlInfoQuerySize(RTDBGKRNLINFO hKrnlInfo, const char pszModule, const char pszType, size_t *pcbType)
791	{
792	RTDBGKRNLINFOINT *pThis = hKrnlInfo;
793	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
794	AssertMsgReturn(pThis->u32Magic == RTDBGKRNLINFO_MAGIC, ("%p: u32Magic=%RX32\n", pThis, pThis->u32Magic), VERR_INVALID_HANDLE);
795	AssertPtrNullReturn(pszModule, VERR_INVALID_POINTER);
796	AssertPtrReturn(pszType, VERR_INVALID_POINTER);
797	AssertPtrReturn(pcbType, VERR_INVALID_POINTER);
798	return VERR_NOT_FOUND;
799	}
800

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/r0drv/nt/dbgkrnlinfo-r0drv-nt.cpp@ 78071

Download in other formats: