[mirror_qemu.git] / contrib / elf2dmp / main.c

/*
 * Copyright (c) 2018 Virtuozzo International GmbH
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 *
 */

#include "qemu/osdep.h"

#include "err.h"
#include "addrspace.h"
#include "pe.h"
#include "pdb.h"
#include "kdbg.h"
#include "download.h"
#include "qemu/win_dump_defs.h"

#define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
#define PDB_NAME    "ntkrnlmp.pdb"
#define PE_NAME     "ntoskrnl.exe"

#define INITIAL_MXCSR   0x1f80
#define MAX_NUMBER_OF_RUNS  42

typedef struct idt_desc {
    uint16_t offset1;   /* offset bits 0..15 */
    uint16_t selector;
    uint8_t ist;
    uint8_t type_attr;
    uint16_t offset2;   /* offset bits 16..31 */
    uint32_t offset3;   /* offset bits 32..63 */
    uint32_t rsrvd;
} __attribute__ ((packed)) idt_desc_t;

static uint64_t idt_desc_addr(idt_desc_t desc)
{
    return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) |
          ((uint64_t)desc.offset3 << 32);
}

static const uint64_t SharedUserData = 0xfffff78000000000;

#define KUSD_OFFSET_SUITE_MASK 0x2d0
#define KUSD_OFFSET_PRODUCT_TYPE 0x264

#define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
    s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
    eprintf("Failed to resolve "#s"\n"), s)

static uint64_t rol(uint64_t x, uint64_t y)
{
    return (x << y) | (x >> (64 - y));
}

/*
 * Decoding algorithm can be found in Volatility project
 */
static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
        uint64_t kwn, uint64_t kwa, uint64_t kdbe)
{
    size_t i;
    assert(size % sizeof(uint64_t) == 0);
    for (i = 0; i < size / sizeof(uint64_t); i++) {
        uint64_t block;

        block = src[i];
        block = rol(block ^ kwn, (uint8_t)kwn);
        block = __builtin_bswap64(block ^ kdbe) ^ kwa;
        dst[i] = block;
    }
}

static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
        struct va_space *vs, uint64_t KdDebuggerDataBlock)
{
    const char OwnerTag[4] = "KDBG";
    KDDEBUGGER_DATA64 *kdbg = NULL;
    DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
    bool decode = false;
    uint64_t kwn, kwa, KdpDataBlockEncoded;

    if (va_space_rw(vs,
                KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
                &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
        eprintf("Failed to extract KDBG header\n");
        return NULL;
    }

    if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
        uint64_t KiWaitNever, KiWaitAlways;

        decode = true;

        if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) ||
                !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) ||
                !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
            return NULL;
        }

        if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
                va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
            return NULL;
        }

        printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
        printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);

        /*
         * If KDBG header can be decoded, KDBG size is available
         * and entire KDBG can be decoded.
         */
        printf("Decoding KDBG header...\n");
        kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr,
                sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);

        printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
        if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
            eprintf("Failed to decode KDBG header\n");
            return NULL;
        }
    }

    kdbg = g_malloc(kdbg_hdr.Size);

    if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
        eprintf("Failed to extract entire KDBG\n");
        g_free(kdbg);
        return NULL;
    }

    if (!decode) {
        return kdbg;
    }

    printf("Decoding KdDebuggerDataBlock...\n");
    kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size,
                kwn, kwa, KdpDataBlockEncoded);

    va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);

    return kdbg;
}

static void win_context_init_from_qemu_cpu_state(WinContext64 *ctx,
        QEMUCPUState *s)
{
    WinContext64 win_ctx = (WinContext64){
        .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
        .MxCsr = INITIAL_MXCSR,

        .SegCs = s->cs.selector,
        .SegSs = s->ss.selector,
        .SegDs = s->ds.selector,
        .SegEs = s->es.selector,
        .SegFs = s->fs.selector,
        .SegGs = s->gs.selector,
        .EFlags = (uint32_t)s->rflags,

        .Rax = s->rax,
        .Rbx = s->rbx,
        .Rcx = s->rcx,
        .Rdx = s->rdx,
        .Rsp = s->rsp,
        .Rbp = s->rbp,
        .Rsi = s->rsi,
        .Rdi = s->rdi,
        .R8  = s->r8,
        .R9  = s->r9,
        .R10 = s->r10,
        .R11 = s->r11,
        .R12 = s->r12,
        .R13 = s->r13,
        .R14 = s->r14,
        .R15 = s->r15,

        .Rip = s->rip,
        .FltSave = {
            .MxCsr = INITIAL_MXCSR,
        },
    };

    *ctx = win_ctx;
}

/*
 * Finds paging-structure hierarchy base,
 * if previously set doesn't give access to kernel structures
 */
static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
{
    /*
     * Firstly, test previously set DTB.
     */
    if (va_space_resolve(vs, SharedUserData)) {
        return 0;
    }

    /*
     * Secondly, find CPU which run system task.
     */
    size_t i;
    for (i = 0; i < qe->state_nr; i++) {
        QEMUCPUState *s = qe->state[i];

        if (is_system(s)) {
            va_space_set_dtb(vs, s->cr[3]);
            printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
                    " as system task CR3\n", vs->dtb, i);
            return !(va_space_resolve(vs, SharedUserData));
        }
    }

    /*
     * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
     * CR3 as [Prcb+0x7000]
     */
    if (qe->has_kernel_gs_base) {
        QEMUCPUState *s = qe->state[0];
        uint64_t Prcb = s->kernel_gs_base;
        uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);

        if (!cr3) {
            return 1;
        }

        va_space_set_dtb(vs, *cr3);
        printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
                " as interrupt handling CR3\n", vs->dtb);
        return !(va_space_resolve(vs, SharedUserData));
    }

    return 1;
}

static void try_merge_runs(struct pa_space *ps,
        WinDumpPhyMemDesc64 *PhysicalMemoryBlock)
{
    unsigned int merge_cnt = 0, run_idx = 0;

    PhysicalMemoryBlock->NumberOfRuns = 0;

    for (size_t idx = 0; idx < ps->block_nr; idx++) {
        struct pa_block *blk = ps->block + idx;
        struct pa_block *next = blk + 1;

        PhysicalMemoryBlock->NumberOfPages += blk->size / ELF2DMP_PAGE_SIZE;

        if (idx + 1 != ps->block_nr && blk->paddr + blk->size == next->paddr) {
            printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
                    " merged\n", idx, blk->paddr, blk->size, merge_cnt);
            merge_cnt++;
        } else {
            struct pa_block *first_merged = blk - merge_cnt;

            printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
                    " merged to 0x%"PRIx64"+:0x%"PRIx64" (run #%u)\n",
                    idx, blk->paddr, blk->size, merge_cnt, first_merged->paddr,
                    blk->paddr + blk->size - first_merged->paddr, run_idx);
            PhysicalMemoryBlock->Run[run_idx] = (WinDumpPhyMemRun64) {
                .BasePage = first_merged->paddr / ELF2DMP_PAGE_SIZE,
                .PageCount = (blk->paddr + blk->size - first_merged->paddr) /
                        ELF2DMP_PAGE_SIZE,
            };
            PhysicalMemoryBlock->NumberOfRuns++;
            run_idx++;
            merge_cnt = 0;
        }
    }
}

static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
        struct va_space *vs, uint64_t KdDebuggerDataBlock,
        KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
{
    uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
            KUSD_OFFSET_SUITE_MASK);
    int32_t *product_type = va_space_resolve(vs, SharedUserData +
            KUSD_OFFSET_PRODUCT_TYPE);
    DBGKD_GET_VERSION64 kvb;
    WinDumpHeader64 h;

    QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE);
    QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE);

    if (!suite_mask || !product_type) {
        return 1;
    }

    if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
        eprintf("Failed to extract KdVersionBlock\n");
        return 1;
    }

    h = (WinDumpHeader64) {
        .Signature = "PAGE",
        .ValidDump = "DU64",
        .MajorVersion = kvb.MajorVersion,
        .MinorVersion = kvb.MinorVersion,
        .DirectoryTableBase = vs->dtb,
        .PfnDatabase = kdbg->MmPfnDatabase,
        .PsLoadedModuleList = kdbg->PsLoadedModuleList,
        .PsActiveProcessHead = kdbg->PsActiveProcessHead,
        .MachineImageType = kvb.MachineType,
        .NumberProcessors = nr_cpus,
        .BugcheckCode = LIVE_SYSTEM_DUMP,
        .KdDebuggerDataBlock = KdDebuggerDataBlock,
        .DumpType = 1,
        .Comment = "Hello from elf2dmp!",
        .SuiteMask = *suite_mask,
        .ProductType = *product_type,
        .SecondaryDataState = kvb.KdSecondaryVersion,
        .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
            .NumberOfRuns = ps->block_nr,
        },
        .RequiredDumpSpace = sizeof(h),
    };

    if (h.PhysicalMemoryBlock.NumberOfRuns <= MAX_NUMBER_OF_RUNS) {
        for (size_t idx = 0; idx < ps->block_nr; idx++) {
            h.PhysicalMemoryBlock.NumberOfPages +=
                    ps->block[idx].size / ELF2DMP_PAGE_SIZE;
            h.PhysicalMemoryBlock.Run[idx] = (WinDumpPhyMemRun64) {
                .BasePage = ps->block[idx].paddr / ELF2DMP_PAGE_SIZE,
                .PageCount = ps->block[idx].size / ELF2DMP_PAGE_SIZE,
            };
        }
    } else {
        try_merge_runs(ps, &h.PhysicalMemoryBlock);
    }

    h.RequiredDumpSpace +=
            h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;

    *hdr = h;

    return 0;
}

/*
 * fill_context() continues even if it fails to fill contexts of some CPUs.
 * A dump may still contain valuable information even if it lacks contexts of
 * some CPUs due to dump corruption or a failure before starting CPUs.
 */
static void fill_context(KDDEBUGGER_DATA64 *kdbg,
                         struct va_space *vs, QEMU_Elf *qe)
{
    int i;

    for (i = 0; i < qe->state_nr; i++) {
        uint64_t Prcb;
        uint64_t Context;
        WinContext64 ctx;
        QEMUCPUState *s = qe->state[i];

        if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
                    &Prcb, sizeof(Prcb), 0)) {
            eprintf("Failed to read CPU #%d PRCB location\n", i);
            continue;
        }

        if (!Prcb) {
            eprintf("Context for CPU #%d is missing\n", i);
            continue;
        }

        if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
                    &Context, sizeof(Context), 0)) {
            eprintf("Failed to read CPU #%d ContextFrame location\n", i);
            continue;
        }

        printf("Filling context for CPU #%d...\n", i);
        win_context_init_from_qemu_cpu_state(&ctx, s);

        if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
            eprintf("Failed to fill CPU #%d context\n", i);
            continue;
        }
    }
}

static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
        void *entry, size_t size, struct va_space *vs)
{
    const char e_magic[2] = "MZ";
    const char Signature[4] = "PE\0\0";
    IMAGE_DOS_HEADER *dos_hdr = start_addr;
    IMAGE_NT_HEADERS64 nt_hdrs;
    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;

    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);

    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
        return 1;
    }

    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
                &nt_hdrs, sizeof(nt_hdrs), 0)) {
        return 1;
    }

    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
        return 1;
    }

    if (va_space_rw(vs,
                base + data_dir[idx].VirtualAddress,
                entry, size, 0)) {
        return 1;
    }

    printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
            (uint32_t)data_dir[idx].VirtualAddress);

    return 0;
}

static int write_dump(struct pa_space *ps,
        WinDumpHeader64 *hdr, const char *name)
{
    FILE *dmp_file = fopen(name, "wb");
    size_t i;

    if (!dmp_file) {
        eprintf("Failed to open output file \'%s\'\n", name);
        return 1;
    }

    printf("Writing header to file...\n");

    if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
        eprintf("Failed to write dump header\n");
        fclose(dmp_file);
        return 1;
    }

    for (i = 0; i < ps->block_nr; i++) {
        struct pa_block *b = &ps->block[i];

        printf("Writing block #%zu/%zu of %"PRIu64" bytes to file...\n", i,
                ps->block_nr, b->size);
        if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
            eprintf("Failed to write block\n");
            fclose(dmp_file);
            return 1;
        }
    }

    return fclose(dmp_file);
}

static bool pe_check_pdb_name(uint64_t base, void *start_addr,
        struct va_space *vs, OMFSignatureRSDS *rsds)
{
    const char sign_rsds[4] = "RSDS";
    IMAGE_DEBUG_DIRECTORY debug_dir;
    char pdb_name[sizeof(PDB_NAME)];

    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
                &debug_dir, sizeof(debug_dir), vs)) {
        eprintf("Failed to get Debug Directory\n");
        return false;
    }

    if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
        eprintf("Debug Directory type is not CodeView\n");
        return false;
    }

    if (va_space_rw(vs,
                base + debug_dir.AddressOfRawData,
                rsds, sizeof(*rsds), 0)) {
        eprintf("Failed to resolve OMFSignatureRSDS\n");
        return false;
    }

    if (memcmp(&rsds->Signature, sign_rsds, sizeof(sign_rsds))) {
        eprintf("CodeView signature is \'%.4s\', \'%.4s\' expected\n",
                rsds->Signature, sign_rsds);
        return false;
    }

    if (debug_dir.SizeOfData - sizeof(*rsds) != sizeof(PDB_NAME)) {
        eprintf("PDB name size doesn't match\n");
        return false;
    }

    if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
                offsetof(OMFSignatureRSDS, name), pdb_name, sizeof(PDB_NAME),
                0)) {
        eprintf("Failed to resolve PDB name\n");
        return false;
    }

    printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);

    return !strcmp(pdb_name, PDB_NAME);
}

static void pe_get_pdb_symstore_hash(OMFSignatureRSDS *rsds, char *hash)
{
    sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds->guid.a, rsds->guid.b,
            rsds->guid.c, rsds->guid.d[0], rsds->guid.d[1]);
    hash += 20;
    for (unsigned int i = 0; i < 6; i++, hash += 2) {
        sprintf(hash, "%.02x", rsds->guid.e[i]);
    }

    sprintf(hash, "%.01x", rsds->age);
}

int main(int argc, char *argv[])
{
    int err = 1;
    QEMU_Elf qemu_elf;
    struct pa_space ps;
    struct va_space vs;
    QEMUCPUState *state;
    idt_desc_t first_idt_desc;
    uint64_t KernBase;
    void *nt_start_addr = NULL;
    WinDumpHeader64 header;
    char pdb_hash[34];
    char pdb_url[] = SYM_URL_BASE PDB_NAME
        "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
    struct pdb_reader pdb;
    uint64_t KdDebuggerDataBlock;
    KDDEBUGGER_DATA64 *kdbg;
    uint64_t KdVersionBlock;
    bool kernel_found = false;
    OMFSignatureRSDS rsds;

    if (argc != 3) {
        eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
        return 1;
    }

    if (QEMU_Elf_init(&qemu_elf, argv[1])) {
        eprintf("Failed to initialize QEMU ELF dump\n");
        return 1;
    }

    if (pa_space_create(&ps, &qemu_elf)) {
        eprintf("Failed to initialize physical address space\n");
        goto out_elf;
    }

    state = qemu_elf.state[0];
    printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);

    va_space_create(&vs, &ps, state->cr[3]);
    if (fix_dtb(&vs, &qemu_elf)) {
        eprintf("Failed to find paging base\n");
        goto out_elf;
    }

    printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);

    if (va_space_rw(&vs, state->idt.base,
                &first_idt_desc, sizeof(first_idt_desc), 0)) {
        eprintf("Failed to get CPU #0 IDT[0]\n");
        goto out_ps;
    }
    printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));

    KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1);
    printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);

    for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) {
        nt_start_addr = va_space_resolve(&vs, KernBase);
        if (!nt_start_addr) {
            continue;
        }

        if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
            printf("Checking candidate KernBase = 0x%016"PRIx64"\n", KernBase);
            if (pe_check_pdb_name(KernBase, nt_start_addr, &vs, &rsds)) {
                kernel_found = true;
                break;
            }
        }
    }

    if (!kernel_found) {
        eprintf("Failed to find NT kernel image\n");
        goto out_ps;
    }

    printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
            (char *)nt_start_addr);

    pe_get_pdb_symstore_hash(&rsds, pdb_hash);

    sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
    printf("PDB URL is %s\n", pdb_url);

    if (download_url(PDB_NAME, pdb_url)) {
        eprintf("Failed to download PDB file\n");
        goto out_ps;
    }

    if (pdb_init_from_file(PDB_NAME, &pdb)) {
        eprintf("Failed to initialize PDB reader\n");
        goto out_pdb_file;
    }

    if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
            !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
        goto out_pdb;
    }

    kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
    if (!kdbg) {
        goto out_pdb;
    }

    if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
            KdVersionBlock, qemu_elf.state_nr)) {
        goto out_kdbg;
    }

    fill_context(kdbg, &vs, &qemu_elf);

    if (write_dump(&ps, &header, argv[2])) {
        eprintf("Failed to save dump\n");
        goto out_kdbg;
    }

    err = 0;

out_kdbg:
    g_free(kdbg);
out_pdb:
    pdb_exit(&pdb);
out_pdb_file:
    unlink(PDB_NAME);
out_ps:
    pa_space_destroy(&ps);
out_elf:
    QEMU_Elf_exit(&qemu_elf);

    return err;
}
Commit	Line	Data
3fa2d384 VP	1	/*
	2	* Copyright (c) 2018 Virtuozzo International GmbH
	3	*
	4	* This work is licensed under the terms of the GNU GPL, version 2 or later.
	5	*
	6	*/
	7
	8	#include "qemu/osdep.h"
bbfff196	9
3fa2d384 VP	10	#include "err.h"
	11	#include "addrspace.h"
	12	#include "pe.h"
	13	#include "pdb.h"
	14	#include "kdbg.h"
	15	#include "download.h"
	16	#include "qemu/win_dump_defs.h"
	17
	18	#define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/"
	19	#define PDB_NAME "ntkrnlmp.pdb"
d399d6b1	20	#define PE_NAME "ntoskrnl.exe"
3fa2d384 VP	21
3fa2d384 VP	22	#define INITIAL_MXCSR 0x1f80
9b7dcd8f	23	#define MAX_NUMBER_OF_RUNS 42
3fa2d384 VP	24
	25	typedef struct idt_desc {
	26	uint16_t offset1; /* offset bits 0..15 */
	27	uint16_t selector;
	28	uint8_t ist;
	29	uint8_t type_attr;
	30	uint16_t offset2; /* offset bits 16..31 */
	31	uint32_t offset3; /* offset bits 32..63 */
	32	uint32_t rsrvd;
	33	} __attribute__ ((packed)) idt_desc_t;
	34
	35	static uint64_t idt_desc_addr(idt_desc_t desc)
	36	{
	37	return (uint64_t)desc.offset1 \| ((uint64_t)desc.offset2 << 16) \|
	38	((uint64_t)desc.offset3 << 32);
	39	}
	40
	41	static const uint64_t SharedUserData = 0xfffff78000000000;
	42
	43	#define KUSD_OFFSET_SUITE_MASK 0x2d0
	44	#define KUSD_OFFSET_PRODUCT_TYPE 0x264
	45
	46	#define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
6ec6e988 VP	47	s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
6ec6e988 VP	48	eprintf("Failed to resolve "#s"\n"), s)
3fa2d384 VP	49
	50	static uint64_t rol(uint64_t x, uint64_t y)
	51	{
	52	return (x << y) \| (x >> (64 - y));
	53	}
	54
	55	/*
	56	* Decoding algorithm can be found in Volatility project
	57	*/
	58	static void kdbg_decode(uint64_t dst, uint64_t src, size_t size,
	59	uint64_t kwn, uint64_t kwa, uint64_t kdbe)
	60	{
	61	size_t i;
	62	assert(size % sizeof(uint64_t) == 0);
	63	for (i = 0; i < size / sizeof(uint64_t); i++) {
	64	uint64_t block;
	65
	66	block = src[i];
	67	block = rol(block ^ kwn, (uint8_t)kwn);
	68	block = __builtin_bswap64(block ^ kdbe) ^ kwa;
	69	dst[i] = block;
	70	}
	71	}
	72
	73	static KDDEBUGGER_DATA64 get_kdbg(uint64_t KernBase, struct pdb_reader pdb,
	74	struct va_space *vs, uint64_t KdDebuggerDataBlock)
	75	{
	76	const char OwnerTag[4] = "KDBG";
	77	KDDEBUGGER_DATA64 *kdbg = NULL;
	78	DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
	79	bool decode = false;
	80	uint64_t kwn, kwa, KdpDataBlockEncoded;
	81
	82	if (va_space_rw(vs,
	83	KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
	84	&kdbg_hdr, sizeof(kdbg_hdr), 0)) {
	85	eprintf("Failed to extract KDBG header\n");
	86	return NULL;
	87	}
	88
	89	if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
	90	uint64_t KiWaitNever, KiWaitAlways;
	91
	92	decode = true;
	93
	94	if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) \|\|
	95	!SYM_RESOLVE(KernBase, pdb, KiWaitAlways) \|\|
	96	!SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
	97	return NULL;
	98	}
	99
	100	if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) \|\|
	101	va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
	102	return NULL;
	103	}
	104
6ec6e988 VP	105	printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
6ec6e988 VP	106	printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);
3fa2d384 VP	107
	108	/*
	109	* If KDBG header can be decoded, KDBG size is available
	110	* and entire KDBG can be decoded.
	111	*/
	112	printf("Decoding KDBG header...\n");
	113	kdbg_decode((uint64_t )&kdbg_hdr, (uint64_t )&kdbg_hdr,
	114	sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);
	115
	116	printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
	117	if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
	118	eprintf("Failed to decode KDBG header\n");
	119	return NULL;
	120	}
	121	}
	122
2a052b4e	123	kdbg = g_malloc(kdbg_hdr.Size);
3fa2d384 VP	124
	125	if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
	126	eprintf("Failed to extract entire KDBG\n");
2a052b4e	127	g_free(kdbg);
3fa2d384 VP	128	return NULL;
	129	}
	130
	131	if (!decode) {
	132	return kdbg;
	133	}
	134
	135	printf("Decoding KdDebuggerDataBlock...\n");
	136	kdbg_decode((uint64_t )kdbg, (uint64_t )kdbg, kdbg_hdr.Size,
	137	kwn, kwa, KdpDataBlockEncoded);
	138
	139	va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);
	140
	141	return kdbg;
	142	}
	143
a64b4e17	144	static void win_context_init_from_qemu_cpu_state(WinContext64 *ctx,
3fa2d384 VP	145	QEMUCPUState *s)
3fa2d384 VP	146	{
a64b4e17	147	WinContext64 win_ctx = (WinContext64){
3fa2d384 VP	148	.ContextFlags = WIN_CTX_X64 \| WIN_CTX_INT \| WIN_CTX_SEG \| WIN_CTX_CTL,
	149	.MxCsr = INITIAL_MXCSR,
	150
	151	.SegCs = s->cs.selector,
	152	.SegSs = s->ss.selector,
	153	.SegDs = s->ds.selector,
	154	.SegEs = s->es.selector,
	155	.SegFs = s->fs.selector,
	156	.SegGs = s->gs.selector,
	157	.EFlags = (uint32_t)s->rflags,
	158
	159	.Rax = s->rax,
	160	.Rbx = s->rbx,
	161	.Rcx = s->rcx,
	162	.Rdx = s->rdx,
	163	.Rsp = s->rsp,
	164	.Rbp = s->rbp,
	165	.Rsi = s->rsi,
	166	.Rdi = s->rdi,
	167	.R8 = s->r8,
	168	.R9 = s->r9,
	169	.R10 = s->r10,
	170	.R11 = s->r11,
	171	.R12 = s->r12,
	172	.R13 = s->r13,
	173	.R14 = s->r14,
	174	.R15 = s->r15,
	175
	176	.Rip = s->rip,
	177	.FltSave = {
	178	.MxCsr = INITIAL_MXCSR,
	179	},
	180	};
	181
	182	*ctx = win_ctx;
	183	}
	184
	185	/*
	186	* Finds paging-structure hierarchy base,
	187	* if previously set doesn't give access to kernel structures
	188	*/
	189	static int fix_dtb(struct va_space vs, QEMU_Elf qe)
	190	{
	191	/*
	192	* Firstly, test previously set DTB.
	193	*/
	194	if (va_space_resolve(vs, SharedUserData)) {
	195	return 0;
	196	}
	197
	198	/*
	199	* Secondly, find CPU which run system task.
	200	*/
	201	size_t i;
	202	for (i = 0; i < qe->state_nr; i++) {
	203	QEMUCPUState *s = qe->state[i];
	204
	205	if (is_system(s)) {
	206	va_space_set_dtb(vs, s->cr[3]);
6ec6e988	207	printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
3fa2d384 VP	208	" as system task CR3\n", vs->dtb, i);
	209	return !(va_space_resolve(vs, SharedUserData));
	210	}
	211	}
	212
	213	/*
	214	* Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
	215	* CR3 as [Prcb+0x7000]
	216	*/
	217	if (qe->has_kernel_gs_base) {
	218	QEMUCPUState *s = qe->state[0];
	219	uint64_t Prcb = s->kernel_gs_base;
	220	uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
	221
	222	if (!cr3) {
	223	return 1;
	224	}
	225
	226	va_space_set_dtb(vs, *cr3);
6ec6e988	227	printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
3fa2d384 VP	228	" as interrupt handling CR3\n", vs->dtb);
	229	return !(va_space_resolve(vs, SharedUserData));
	230	}
	231
	232	return 1;
	233	}
	234
9b7dcd8f VP	235	static void try_merge_runs(struct pa_space *ps,
	236	WinDumpPhyMemDesc64 *PhysicalMemoryBlock)
	237	{
	238	unsigned int merge_cnt = 0, run_idx = 0;
	239
	240	PhysicalMemoryBlock->NumberOfRuns = 0;
	241
	242	for (size_t idx = 0; idx < ps->block_nr; idx++) {
	243	struct pa_block *blk = ps->block + idx;
	244	struct pa_block *next = blk + 1;
	245
	246	PhysicalMemoryBlock->NumberOfPages += blk->size / ELF2DMP_PAGE_SIZE;
	247
	248	if (idx + 1 != ps->block_nr && blk->paddr + blk->size == next->paddr) {
	249	printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
	250	" merged\n", idx, blk->paddr, blk->size, merge_cnt);
	251	merge_cnt++;
	252	} else {
	253	struct pa_block *first_merged = blk - merge_cnt;
	254
	255	printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
	256	" merged to 0x%"PRIx64"+:0x%"PRIx64" (run #%u)\n",
	257	idx, blk->paddr, blk->size, merge_cnt, first_merged->paddr,
	258	blk->paddr + blk->size - first_merged->paddr, run_idx);
	259	PhysicalMemoryBlock->Run[run_idx] = (WinDumpPhyMemRun64) {
	260	.BasePage = first_merged->paddr / ELF2DMP_PAGE_SIZE,
	261	.PageCount = (blk->paddr + blk->size - first_merged->paddr) /
	262	ELF2DMP_PAGE_SIZE,
	263	};
	264	PhysicalMemoryBlock->NumberOfRuns++;
	265	run_idx++;
	266	merge_cnt = 0;
	267	}
	268	}
	269	}
	270
3fa2d384 VP	271	static int fill_header(WinDumpHeader64 hdr, struct pa_space ps,
	272	struct va_space *vs, uint64_t KdDebuggerDataBlock,
	273	KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
	274	{
	275	uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
	276	KUSD_OFFSET_SUITE_MASK);
	277	int32_t *product_type = va_space_resolve(vs, SharedUserData +
	278	KUSD_OFFSET_PRODUCT_TYPE);
	279	DBGKD_GET_VERSION64 kvb;
	280	WinDumpHeader64 h;
3fa2d384	281
2d0fc797 JY	282	QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE);
2d0fc797 JY	283	QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE);
3fa2d384 VP	284
	285	if (!suite_mask \|\| !product_type) {
	286	return 1;
	287	}
	288
	289	if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
	290	eprintf("Failed to extract KdVersionBlock\n");
	291	return 1;
	292	}
	293
	294	h = (WinDumpHeader64) {
	295	.Signature = "PAGE",
	296	.ValidDump = "DU64",
	297	.MajorVersion = kvb.MajorVersion,
	298	.MinorVersion = kvb.MinorVersion,
	299	.DirectoryTableBase = vs->dtb,
	300	.PfnDatabase = kdbg->MmPfnDatabase,
	301	.PsLoadedModuleList = kdbg->PsLoadedModuleList,
	302	.PsActiveProcessHead = kdbg->PsActiveProcessHead,
	303	.MachineImageType = kvb.MachineType,
	304	.NumberProcessors = nr_cpus,
	305	.BugcheckCode = LIVE_SYSTEM_DUMP,
	306	.KdDebuggerDataBlock = KdDebuggerDataBlock,
	307	.DumpType = 1,
	308	.Comment = "Hello from elf2dmp!",
	309	.SuiteMask = *suite_mask,
	310	.ProductType = *product_type,
	311	.SecondaryDataState = kvb.KdSecondaryVersion,
	312	.PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
	313	.NumberOfRuns = ps->block_nr,
	314	},
	315	.RequiredDumpSpace = sizeof(h),
	316	};
	317
9b7dcd8f VP	318	if (h.PhysicalMemoryBlock.NumberOfRuns <= MAX_NUMBER_OF_RUNS) {
	319	for (size_t idx = 0; idx < ps->block_nr; idx++) {
	320	h.PhysicalMemoryBlock.NumberOfPages +=
	321	ps->block[idx].size / ELF2DMP_PAGE_SIZE;
	322	h.PhysicalMemoryBlock.Run[idx] = (WinDumpPhyMemRun64) {
	323	.BasePage = ps->block[idx].paddr / ELF2DMP_PAGE_SIZE,
	324	.PageCount = ps->block[idx].size / ELF2DMP_PAGE_SIZE,
	325	};
	326	}
	327	} else {
	328	try_merge_runs(ps, &h.PhysicalMemoryBlock);
3fa2d384 VP	329	}
3fa2d384 VP	330
05adc48e VP	331	h.RequiredDumpSpace +=
05adc48e VP	332	h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
3fa2d384 VP	333
	334	*hdr = h;
	335
	336	return 0;
	337	}
	338
87157ef3 AO	339	/*
	340	* fill_context() continues even if it fails to fill contexts of some CPUs.
	341	* A dump may still contain valuable information even if it lacks contexts of
	342	* some CPUs due to dump corruption or a failure before starting CPUs.
	343	*/
	344	static void fill_context(KDDEBUGGER_DATA64 *kdbg,
	345	struct va_space vs, QEMU_Elf qe)
3fa2d384	346	{
05adc48e VP	347	int i;
05adc48e VP	348
3fa2d384 VP	349	for (i = 0; i < qe->state_nr; i++) {
	350	uint64_t Prcb;
	351	uint64_t Context;
a64b4e17	352	WinContext64 ctx;
3fa2d384 VP	353	QEMUCPUState *s = qe->state[i];
	354
	355	if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
	356	&Prcb, sizeof(Prcb), 0)) {
	357	eprintf("Failed to read CPU #%d PRCB location\n", i);
87157ef3	358	continue;
3fa2d384 VP	359	}
3fa2d384 VP	360
548b8edc AO	361	if (!Prcb) {
	362	eprintf("Context for CPU #%d is missing\n", i);
	363	continue;
	364	}
	365
3fa2d384 VP	366	if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
	367	&Context, sizeof(Context), 0)) {
	368	eprintf("Failed to read CPU #%d ContextFrame location\n", i);
87157ef3	369	continue;
3fa2d384 VP	370	}
	371
	372	printf("Filling context for CPU #%d...\n", i);
	373	win_context_init_from_qemu_cpu_state(&ctx, s);
	374
	375	if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
	376	eprintf("Failed to fill CPU #%d context\n", i);
87157ef3	377	continue;
3fa2d384 VP	378	}
3fa2d384 VP	379	}
3fa2d384 VP	380	}
3fa2d384 VP	381
06ac60b7 VP	382	static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
	383	void entry, size_t size, struct va_space vs)
	384	{
	385	const char e_magic[2] = "MZ";
	386	const char Signature[4] = "PE\0\0";
	387	IMAGE_DOS_HEADER *dos_hdr = start_addr;
	388	IMAGE_NT_HEADERS64 nt_hdrs;
	389	IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
	390	IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
	391	IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
	392
	393	QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
	394
	395	if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
	396	return 1;
	397	}
	398
	399	if (va_space_rw(vs, base + dos_hdr->e_lfanew,
	400	&nt_hdrs, sizeof(nt_hdrs), 0)) {
	401	return 1;
	402	}
	403
	404	if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) \|\|
	405	file_hdr->Machine != 0x8664 \|\| opt_hdr->Magic != 0x020b) {
	406	return 1;
	407	}
	408
	409	if (va_space_rw(vs,
	410	base + data_dir[idx].VirtualAddress,
	411	entry, size, 0)) {
	412	return 1;
	413	}
	414
	415	printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
	416	(uint32_t)data_dir[idx].VirtualAddress);
	417
	418	return 0;
	419	}
	420
3fa2d384 VP	421	static int write_dump(struct pa_space *ps,
	422	WinDumpHeader64 hdr, const char name)
	423	{
	424	FILE *dmp_file = fopen(name, "wb");
	425	size_t i;
	426
	427	if (!dmp_file) {
	428	eprintf("Failed to open output file \'%s\'\n", name);
	429	return 1;
	430	}
	431
	432	printf("Writing header to file...\n");
	433
	434	if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
	435	eprintf("Failed to write dump header\n");
	436	fclose(dmp_file);
	437	return 1;
	438	}
	439
	440	for (i = 0; i < ps->block_nr; i++) {
	441	struct pa_block *b = &ps->block[i];
	442
d5c27a53 VP	443	printf("Writing block #%zu/%zu of %"PRIu64" bytes to file...\n", i,
d5c27a53 VP	444	ps->block_nr, b->size);
3fa2d384	445	if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
d5c27a53	446	eprintf("Failed to write block\n");
3fa2d384 VP	447	fclose(dmp_file);
	448	return 1;
	449	}
	450	}
	451
	452	return fclose(dmp_file);
	453	}
	454
3c407ec6 VP	455	static bool pe_check_pdb_name(uint64_t base, void *start_addr,
3c407ec6 VP	456	struct va_space vs, OMFSignatureRSDS rsds)
3fa2d384	457	{
3fa2d384	458	const char sign_rsds[4] = "RSDS";
3fa2d384	459	IMAGE_DEBUG_DIRECTORY debug_dir;
3c407ec6	460	char pdb_name[sizeof(PDB_NAME)];
3fa2d384	461
06ac60b7 VP	462	if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
	463	&debug_dir, sizeof(debug_dir), vs)) {
	464	eprintf("Failed to get Debug Directory\n");
3c407ec6	465	return false;
3fa2d384 VP	466	}
	467
	468	if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
3c407ec6 VP	469	eprintf("Debug Directory type is not CodeView\n");
3c407ec6 VP	470	return false;
3fa2d384 VP	471	}
	472
	473	if (va_space_rw(vs,
	474	base + debug_dir.AddressOfRawData,
3c407ec6 VP	475	rsds, sizeof(*rsds), 0)) {
	476	eprintf("Failed to resolve OMFSignatureRSDS\n");
	477	return false;
3fa2d384 VP	478	}
3fa2d384 VP	479
3c407ec6	480	if (memcmp(&rsds->Signature, sign_rsds, sizeof(sign_rsds))) {
8b01683e	481	eprintf("CodeView signature is \'%.4s\', \'%.4s\' expected\n",
3c407ec6 VP	482	rsds->Signature, sign_rsds);
3c407ec6 VP	483	return false;
3fa2d384 VP	484	}
3fa2d384 VP	485
3c407ec6 VP	486	if (debug_dir.SizeOfData - sizeof(*rsds) != sizeof(PDB_NAME)) {
	487	eprintf("PDB name size doesn't match\n");
	488	return false;
3fa2d384 VP	489	}
	490
	491	if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
3c407ec6 VP	492	offsetof(OMFSignatureRSDS, name), pdb_name, sizeof(PDB_NAME),
	493	0)) {
	494	eprintf("Failed to resolve PDB name\n");
	495	return false;
3fa2d384 VP	496	}
	497
	498	printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
	499
3c407ec6 VP	500	return !strcmp(pdb_name, PDB_NAME);
3c407ec6 VP	501	}
3fa2d384	502
3c407ec6 VP	503	static void pe_get_pdb_symstore_hash(OMFSignatureRSDS rsds, char hash)
	504	{
	505	sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds->guid.a, rsds->guid.b,
	506	rsds->guid.c, rsds->guid.d[0], rsds->guid.d[1]);
3fa2d384	507	hash += 20;
3c407ec6 VP	508	for (unsigned int i = 0; i < 6; i++, hash += 2) {
3c407ec6 VP	509	sprintf(hash, "%.02x", rsds->guid.e[i]);
3fa2d384 VP	510	}
3fa2d384 VP	511
3c407ec6	512	sprintf(hash, "%.01x", rsds->age);
3fa2d384 VP	513	}
	514
	515	int main(int argc, char *argv[])
	516	{
a4e58de1	517	int err = 1;
3fa2d384 VP	518	QEMU_Elf qemu_elf;
	519	struct pa_space ps;
	520	struct va_space vs;
	521	QEMUCPUState *state;
	522	idt_desc_t first_idt_desc;
	523	uint64_t KernBase;
	524	void *nt_start_addr = NULL;
	525	WinDumpHeader64 header;
	526	char pdb_hash[34];
	527	char pdb_url[] = SYM_URL_BASE PDB_NAME
	528	"/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
	529	struct pdb_reader pdb;
	530	uint64_t KdDebuggerDataBlock;
	531	KDDEBUGGER_DATA64 *kdbg;
	532	uint64_t KdVersionBlock;
d399d6b1	533	bool kernel_found = false;
3c407ec6	534	OMFSignatureRSDS rsds;
3fa2d384 VP	535
	536	if (argc != 3) {
	537	eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
	538	return 1;
	539	}
	540
	541	if (QEMU_Elf_init(&qemu_elf, argv[1])) {
	542	eprintf("Failed to initialize QEMU ELF dump\n");
	543	return 1;
	544	}
	545
	546	if (pa_space_create(&ps, &qemu_elf)) {
	547	eprintf("Failed to initialize physical address space\n");
3fa2d384 VP	548	goto out_elf;
	549	}
	550
	551	state = qemu_elf.state[0];
6ec6e988	552	printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);
3fa2d384 VP	553
	554	va_space_create(&vs, &ps, state->cr[3]);
	555	if (fix_dtb(&vs, &qemu_elf)) {
	556	eprintf("Failed to find paging base\n");
3fa2d384 VP	557	goto out_elf;
	558	}
	559
6ec6e988	560	printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);
3fa2d384 VP	561
	562	if (va_space_rw(&vs, state->idt.base,
	563	&first_idt_desc, sizeof(first_idt_desc), 0)) {
	564	eprintf("Failed to get CPU #0 IDT[0]\n");
3fa2d384 VP	565	goto out_ps;
3fa2d384 VP	566	}
6ec6e988	567	printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));
3fa2d384	568
2d0fc797	569	KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1);
6ec6e988	570	printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);
3fa2d384	571
2d0fc797	572	for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) {
3fa2d384 VP	573	nt_start_addr = va_space_resolve(&vs, KernBase);
	574	if (!nt_start_addr) {
	575	continue;
	576	}
	577
	578	if ((uint16_t )nt_start_addr == 0x5a4d) { /* MZ */
3c407ec6 VP	579	printf("Checking candidate KernBase = 0x%016"PRIx64"\n", KernBase);
3c407ec6 VP	580	if (pe_check_pdb_name(KernBase, nt_start_addr, &vs, &rsds)) {
d399d6b1 VP	581	kernel_found = true;
	582	break;
	583	}
3fa2d384 VP	584	}
	585	}
	586
d399d6b1	587	if (!kernel_found) {
06164cc4	588	eprintf("Failed to find NT kernel image\n");
06164cc4 VP	589	goto out_ps;
	590	}
	591
6ec6e988	592	printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
3fa2d384 VP	593	(char *)nt_start_addr);
3fa2d384 VP	594
3c407ec6	595	pe_get_pdb_symstore_hash(&rsds, pdb_hash);
3fa2d384 VP	596
	597	sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
	598	printf("PDB URL is %s\n", pdb_url);
	599
	600	if (download_url(PDB_NAME, pdb_url)) {
	601	eprintf("Failed to download PDB file\n");
3fa2d384 VP	602	goto out_ps;
	603	}
	604
	605	if (pdb_init_from_file(PDB_NAME, &pdb)) {
	606	eprintf("Failed to initialize PDB reader\n");
3fa2d384 VP	607	goto out_pdb_file;
	608	}
	609
	610	if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) \|\|
	611	!SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
3fa2d384 VP	612	goto out_pdb;
	613	}
	614
	615	kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
	616	if (!kdbg) {
3fa2d384 VP	617	goto out_pdb;
	618	}
	619
	620	if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
	621	KdVersionBlock, qemu_elf.state_nr)) {
885538fd	622	goto out_kdbg;
3fa2d384 VP	623	}
3fa2d384 VP	624
87157ef3	625	fill_context(kdbg, &vs, &qemu_elf);
3fa2d384 VP	626
	627	if (write_dump(&ps, &header, argv[2])) {
	628	eprintf("Failed to save dump\n");
3fa2d384 VP	629	goto out_kdbg;
	630	}
	631
a4e58de1 AO	632	err = 0;
a4e58de1 AO	633
3fa2d384	634	out_kdbg:
2a052b4e	635	g_free(kdbg);
3fa2d384 VP	636	out_pdb:
	637	pdb_exit(&pdb);
	638	out_pdb_file:
	639	unlink(PDB_NAME);
	640	out_ps:
	641	pa_space_destroy(&ps);
	642	out_elf:
	643	QEMU_Elf_exit(&qemu_elf);
	644
	645	return err;
	646	}