]>
Commit | Line | Data |
---|---|---|
3fa2d384 VP |
1 | /* |
2 | * Copyright (c) 2018 Virtuozzo International GmbH | |
3 | * | |
4 | * This work is licensed under the terms of the GNU GPL, version 2 or later. | |
5 | * | |
6 | */ | |
7 | ||
8 | #include "qemu/osdep.h" | |
bbfff196 | 9 | |
3fa2d384 VP |
10 | #include "err.h" |
11 | #include "addrspace.h" | |
12 | #include "pe.h" | |
13 | #include "pdb.h" | |
14 | #include "kdbg.h" | |
15 | #include "download.h" | |
16 | #include "qemu/win_dump_defs.h" | |
17 | ||
18 | #define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/" | |
19 | #define PDB_NAME "ntkrnlmp.pdb" | |
d399d6b1 | 20 | #define PE_NAME "ntoskrnl.exe" |
3fa2d384 VP |
21 | |
22 | #define INITIAL_MXCSR 0x1f80 | |
9b7dcd8f | 23 | #define MAX_NUMBER_OF_RUNS 42 |
3fa2d384 VP |
24 | |
25 | typedef struct idt_desc { | |
26 | uint16_t offset1; /* offset bits 0..15 */ | |
27 | uint16_t selector; | |
28 | uint8_t ist; | |
29 | uint8_t type_attr; | |
30 | uint16_t offset2; /* offset bits 16..31 */ | |
31 | uint32_t offset3; /* offset bits 32..63 */ | |
32 | uint32_t rsrvd; | |
33 | } __attribute__ ((packed)) idt_desc_t; | |
34 | ||
35 | static uint64_t idt_desc_addr(idt_desc_t desc) | |
36 | { | |
37 | return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) | | |
38 | ((uint64_t)desc.offset3 << 32); | |
39 | } | |
40 | ||
41 | static const uint64_t SharedUserData = 0xfffff78000000000; | |
42 | ||
43 | #define KUSD_OFFSET_SUITE_MASK 0x2d0 | |
44 | #define KUSD_OFFSET_PRODUCT_TYPE 0x264 | |
45 | ||
46 | #define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\ | |
6ec6e988 VP |
47 | s ? printf(#s" = 0x%016"PRIx64"\n", s) :\ |
48 | eprintf("Failed to resolve "#s"\n"), s) | |
3fa2d384 VP |
49 | |
50 | static uint64_t rol(uint64_t x, uint64_t y) | |
51 | { | |
52 | return (x << y) | (x >> (64 - y)); | |
53 | } | |
54 | ||
55 | /* | |
56 | * Decoding algorithm can be found in Volatility project | |
57 | */ | |
58 | static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size, | |
59 | uint64_t kwn, uint64_t kwa, uint64_t kdbe) | |
60 | { | |
61 | size_t i; | |
62 | assert(size % sizeof(uint64_t) == 0); | |
63 | for (i = 0; i < size / sizeof(uint64_t); i++) { | |
64 | uint64_t block; | |
65 | ||
66 | block = src[i]; | |
67 | block = rol(block ^ kwn, (uint8_t)kwn); | |
68 | block = __builtin_bswap64(block ^ kdbe) ^ kwa; | |
69 | dst[i] = block; | |
70 | } | |
71 | } | |
72 | ||
73 | static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb, | |
74 | struct va_space *vs, uint64_t KdDebuggerDataBlock) | |
75 | { | |
76 | const char OwnerTag[4] = "KDBG"; | |
77 | KDDEBUGGER_DATA64 *kdbg = NULL; | |
78 | DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr; | |
79 | bool decode = false; | |
80 | uint64_t kwn, kwa, KdpDataBlockEncoded; | |
81 | ||
a15f9749 AO |
82 | if (!va_space_rw(vs, |
83 | KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header), | |
84 | &kdbg_hdr, sizeof(kdbg_hdr), 0)) { | |
3fa2d384 VP |
85 | eprintf("Failed to extract KDBG header\n"); |
86 | return NULL; | |
87 | } | |
88 | ||
89 | if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) { | |
90 | uint64_t KiWaitNever, KiWaitAlways; | |
91 | ||
92 | decode = true; | |
93 | ||
94 | if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) || | |
95 | !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) || | |
96 | !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) { | |
97 | return NULL; | |
98 | } | |
99 | ||
a15f9749 AO |
100 | if (!va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) || |
101 | !va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) { | |
3fa2d384 VP |
102 | return NULL; |
103 | } | |
104 | ||
6ec6e988 VP |
105 | printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn); |
106 | printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa); | |
3fa2d384 VP |
107 | |
108 | /* | |
109 | * If KDBG header can be decoded, KDBG size is available | |
110 | * and entire KDBG can be decoded. | |
111 | */ | |
112 | printf("Decoding KDBG header...\n"); | |
113 | kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr, | |
114 | sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded); | |
115 | ||
116 | printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag); | |
117 | if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) { | |
118 | eprintf("Failed to decode KDBG header\n"); | |
119 | return NULL; | |
120 | } | |
121 | } | |
122 | ||
2a052b4e | 123 | kdbg = g_malloc(kdbg_hdr.Size); |
3fa2d384 | 124 | |
a15f9749 | 125 | if (!va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) { |
3fa2d384 | 126 | eprintf("Failed to extract entire KDBG\n"); |
2a052b4e | 127 | g_free(kdbg); |
3fa2d384 VP |
128 | return NULL; |
129 | } | |
130 | ||
131 | if (!decode) { | |
132 | return kdbg; | |
133 | } | |
134 | ||
135 | printf("Decoding KdDebuggerDataBlock...\n"); | |
136 | kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size, | |
137 | kwn, kwa, KdpDataBlockEncoded); | |
138 | ||
139 | va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1); | |
140 | ||
141 | return kdbg; | |
142 | } | |
143 | ||
a64b4e17 | 144 | static void win_context_init_from_qemu_cpu_state(WinContext64 *ctx, |
3fa2d384 VP |
145 | QEMUCPUState *s) |
146 | { | |
a64b4e17 | 147 | WinContext64 win_ctx = (WinContext64){ |
3fa2d384 VP |
148 | .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL, |
149 | .MxCsr = INITIAL_MXCSR, | |
150 | ||
151 | .SegCs = s->cs.selector, | |
152 | .SegSs = s->ss.selector, | |
153 | .SegDs = s->ds.selector, | |
154 | .SegEs = s->es.selector, | |
155 | .SegFs = s->fs.selector, | |
156 | .SegGs = s->gs.selector, | |
157 | .EFlags = (uint32_t)s->rflags, | |
158 | ||
159 | .Rax = s->rax, | |
160 | .Rbx = s->rbx, | |
161 | .Rcx = s->rcx, | |
162 | .Rdx = s->rdx, | |
163 | .Rsp = s->rsp, | |
164 | .Rbp = s->rbp, | |
165 | .Rsi = s->rsi, | |
166 | .Rdi = s->rdi, | |
167 | .R8 = s->r8, | |
168 | .R9 = s->r9, | |
169 | .R10 = s->r10, | |
170 | .R11 = s->r11, | |
171 | .R12 = s->r12, | |
172 | .R13 = s->r13, | |
173 | .R14 = s->r14, | |
174 | .R15 = s->r15, | |
175 | ||
176 | .Rip = s->rip, | |
177 | .FltSave = { | |
178 | .MxCsr = INITIAL_MXCSR, | |
179 | }, | |
180 | }; | |
181 | ||
182 | *ctx = win_ctx; | |
183 | } | |
184 | ||
185 | /* | |
186 | * Finds paging-structure hierarchy base, | |
187 | * if previously set doesn't give access to kernel structures | |
188 | */ | |
189 | static int fix_dtb(struct va_space *vs, QEMU_Elf *qe) | |
190 | { | |
191 | /* | |
192 | * Firstly, test previously set DTB. | |
193 | */ | |
194 | if (va_space_resolve(vs, SharedUserData)) { | |
195 | return 0; | |
196 | } | |
197 | ||
198 | /* | |
199 | * Secondly, find CPU which run system task. | |
200 | */ | |
201 | size_t i; | |
202 | for (i = 0; i < qe->state_nr; i++) { | |
203 | QEMUCPUState *s = qe->state[i]; | |
204 | ||
205 | if (is_system(s)) { | |
206 | va_space_set_dtb(vs, s->cr[3]); | |
6ec6e988 | 207 | printf("DTB 0x%016"PRIx64" has been found from CPU #%zu" |
3fa2d384 VP |
208 | " as system task CR3\n", vs->dtb, i); |
209 | return !(va_space_resolve(vs, SharedUserData)); | |
210 | } | |
211 | } | |
212 | ||
213 | /* | |
214 | * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and | |
215 | * CR3 as [Prcb+0x7000] | |
216 | */ | |
217 | if (qe->has_kernel_gs_base) { | |
218 | QEMUCPUState *s = qe->state[0]; | |
219 | uint64_t Prcb = s->kernel_gs_base; | |
220 | uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000); | |
221 | ||
222 | if (!cr3) { | |
223 | return 1; | |
224 | } | |
225 | ||
226 | va_space_set_dtb(vs, *cr3); | |
6ec6e988 | 227 | printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0" |
3fa2d384 VP |
228 | " as interrupt handling CR3\n", vs->dtb); |
229 | return !(va_space_resolve(vs, SharedUserData)); | |
230 | } | |
231 | ||
232 | return 1; | |
233 | } | |
234 | ||
9b7dcd8f VP |
235 | static void try_merge_runs(struct pa_space *ps, |
236 | WinDumpPhyMemDesc64 *PhysicalMemoryBlock) | |
237 | { | |
238 | unsigned int merge_cnt = 0, run_idx = 0; | |
239 | ||
240 | PhysicalMemoryBlock->NumberOfRuns = 0; | |
241 | ||
242 | for (size_t idx = 0; idx < ps->block_nr; idx++) { | |
243 | struct pa_block *blk = ps->block + idx; | |
244 | struct pa_block *next = blk + 1; | |
245 | ||
246 | PhysicalMemoryBlock->NumberOfPages += blk->size / ELF2DMP_PAGE_SIZE; | |
247 | ||
248 | if (idx + 1 != ps->block_nr && blk->paddr + blk->size == next->paddr) { | |
249 | printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be" | |
250 | " merged\n", idx, blk->paddr, blk->size, merge_cnt); | |
251 | merge_cnt++; | |
252 | } else { | |
253 | struct pa_block *first_merged = blk - merge_cnt; | |
254 | ||
255 | printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be" | |
256 | " merged to 0x%"PRIx64"+:0x%"PRIx64" (run #%u)\n", | |
257 | idx, blk->paddr, blk->size, merge_cnt, first_merged->paddr, | |
258 | blk->paddr + blk->size - first_merged->paddr, run_idx); | |
259 | PhysicalMemoryBlock->Run[run_idx] = (WinDumpPhyMemRun64) { | |
260 | .BasePage = first_merged->paddr / ELF2DMP_PAGE_SIZE, | |
261 | .PageCount = (blk->paddr + blk->size - first_merged->paddr) / | |
262 | ELF2DMP_PAGE_SIZE, | |
263 | }; | |
264 | PhysicalMemoryBlock->NumberOfRuns++; | |
265 | run_idx++; | |
266 | merge_cnt = 0; | |
267 | } | |
268 | } | |
269 | } | |
270 | ||
3fa2d384 VP |
271 | static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps, |
272 | struct va_space *vs, uint64_t KdDebuggerDataBlock, | |
273 | KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus) | |
274 | { | |
275 | uint32_t *suite_mask = va_space_resolve(vs, SharedUserData + | |
276 | KUSD_OFFSET_SUITE_MASK); | |
277 | int32_t *product_type = va_space_resolve(vs, SharedUserData + | |
278 | KUSD_OFFSET_PRODUCT_TYPE); | |
279 | DBGKD_GET_VERSION64 kvb; | |
280 | WinDumpHeader64 h; | |
3fa2d384 | 281 | |
2d0fc797 JY |
282 | QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE); |
283 | QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE); | |
3fa2d384 VP |
284 | |
285 | if (!suite_mask || !product_type) { | |
286 | return 1; | |
287 | } | |
288 | ||
a15f9749 | 289 | if (!va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) { |
3fa2d384 VP |
290 | eprintf("Failed to extract KdVersionBlock\n"); |
291 | return 1; | |
292 | } | |
293 | ||
294 | h = (WinDumpHeader64) { | |
295 | .Signature = "PAGE", | |
296 | .ValidDump = "DU64", | |
297 | .MajorVersion = kvb.MajorVersion, | |
298 | .MinorVersion = kvb.MinorVersion, | |
299 | .DirectoryTableBase = vs->dtb, | |
300 | .PfnDatabase = kdbg->MmPfnDatabase, | |
301 | .PsLoadedModuleList = kdbg->PsLoadedModuleList, | |
302 | .PsActiveProcessHead = kdbg->PsActiveProcessHead, | |
303 | .MachineImageType = kvb.MachineType, | |
304 | .NumberProcessors = nr_cpus, | |
305 | .BugcheckCode = LIVE_SYSTEM_DUMP, | |
306 | .KdDebuggerDataBlock = KdDebuggerDataBlock, | |
307 | .DumpType = 1, | |
308 | .Comment = "Hello from elf2dmp!", | |
309 | .SuiteMask = *suite_mask, | |
310 | .ProductType = *product_type, | |
311 | .SecondaryDataState = kvb.KdSecondaryVersion, | |
312 | .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) { | |
313 | .NumberOfRuns = ps->block_nr, | |
314 | }, | |
315 | .RequiredDumpSpace = sizeof(h), | |
316 | }; | |
317 | ||
9b7dcd8f VP |
318 | if (h.PhysicalMemoryBlock.NumberOfRuns <= MAX_NUMBER_OF_RUNS) { |
319 | for (size_t idx = 0; idx < ps->block_nr; idx++) { | |
320 | h.PhysicalMemoryBlock.NumberOfPages += | |
321 | ps->block[idx].size / ELF2DMP_PAGE_SIZE; | |
322 | h.PhysicalMemoryBlock.Run[idx] = (WinDumpPhyMemRun64) { | |
323 | .BasePage = ps->block[idx].paddr / ELF2DMP_PAGE_SIZE, | |
324 | .PageCount = ps->block[idx].size / ELF2DMP_PAGE_SIZE, | |
325 | }; | |
326 | } | |
327 | } else { | |
328 | try_merge_runs(ps, &h.PhysicalMemoryBlock); | |
3fa2d384 VP |
329 | } |
330 | ||
05adc48e VP |
331 | h.RequiredDumpSpace += |
332 | h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS; | |
3fa2d384 VP |
333 | |
334 | *hdr = h; | |
335 | ||
336 | return 0; | |
337 | } | |
338 | ||
87157ef3 AO |
339 | /* |
340 | * fill_context() continues even if it fails to fill contexts of some CPUs. | |
341 | * A dump may still contain valuable information even if it lacks contexts of | |
342 | * some CPUs due to dump corruption or a failure before starting CPUs. | |
343 | */ | |
344 | static void fill_context(KDDEBUGGER_DATA64 *kdbg, | |
345 | struct va_space *vs, QEMU_Elf *qe) | |
3fa2d384 | 346 | { |
05adc48e VP |
347 | int i; |
348 | ||
3fa2d384 VP |
349 | for (i = 0; i < qe->state_nr; i++) { |
350 | uint64_t Prcb; | |
351 | uint64_t Context; | |
a64b4e17 | 352 | WinContext64 ctx; |
3fa2d384 VP |
353 | QEMUCPUState *s = qe->state[i]; |
354 | ||
a15f9749 AO |
355 | if (!va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i, |
356 | &Prcb, sizeof(Prcb), 0)) { | |
3fa2d384 | 357 | eprintf("Failed to read CPU #%d PRCB location\n", i); |
87157ef3 | 358 | continue; |
3fa2d384 VP |
359 | } |
360 | ||
548b8edc AO |
361 | if (!Prcb) { |
362 | eprintf("Context for CPU #%d is missing\n", i); | |
363 | continue; | |
364 | } | |
365 | ||
a15f9749 AO |
366 | if (!va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext, |
367 | &Context, sizeof(Context), 0)) { | |
3fa2d384 | 368 | eprintf("Failed to read CPU #%d ContextFrame location\n", i); |
87157ef3 | 369 | continue; |
3fa2d384 VP |
370 | } |
371 | ||
372 | printf("Filling context for CPU #%d...\n", i); | |
373 | win_context_init_from_qemu_cpu_state(&ctx, s); | |
374 | ||
a15f9749 | 375 | if (!va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) { |
3fa2d384 | 376 | eprintf("Failed to fill CPU #%d context\n", i); |
87157ef3 | 377 | continue; |
3fa2d384 VP |
378 | } |
379 | } | |
3fa2d384 VP |
380 | } |
381 | ||
06ac60b7 VP |
382 | static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx, |
383 | void *entry, size_t size, struct va_space *vs) | |
384 | { | |
385 | const char e_magic[2] = "MZ"; | |
386 | const char Signature[4] = "PE\0\0"; | |
387 | IMAGE_DOS_HEADER *dos_hdr = start_addr; | |
388 | IMAGE_NT_HEADERS64 nt_hdrs; | |
389 | IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader; | |
390 | IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader; | |
391 | IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory; | |
392 | ||
393 | QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE); | |
394 | ||
395 | if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) { | |
396 | return 1; | |
397 | } | |
398 | ||
a15f9749 AO |
399 | if (!va_space_rw(vs, base + dos_hdr->e_lfanew, |
400 | &nt_hdrs, sizeof(nt_hdrs), 0)) { | |
06ac60b7 VP |
401 | return 1; |
402 | } | |
403 | ||
404 | if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) || | |
405 | file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) { | |
406 | return 1; | |
407 | } | |
408 | ||
a15f9749 | 409 | if (!va_space_rw(vs, base + data_dir[idx].VirtualAddress, entry, size, 0)) { |
06ac60b7 VP |
410 | return 1; |
411 | } | |
412 | ||
413 | printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx, | |
414 | (uint32_t)data_dir[idx].VirtualAddress); | |
415 | ||
416 | return 0; | |
417 | } | |
418 | ||
3fa2d384 VP |
419 | static int write_dump(struct pa_space *ps, |
420 | WinDumpHeader64 *hdr, const char *name) | |
421 | { | |
422 | FILE *dmp_file = fopen(name, "wb"); | |
423 | size_t i; | |
424 | ||
425 | if (!dmp_file) { | |
426 | eprintf("Failed to open output file \'%s\'\n", name); | |
427 | return 1; | |
428 | } | |
429 | ||
430 | printf("Writing header to file...\n"); | |
431 | ||
432 | if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) { | |
433 | eprintf("Failed to write dump header\n"); | |
434 | fclose(dmp_file); | |
435 | return 1; | |
436 | } | |
437 | ||
438 | for (i = 0; i < ps->block_nr; i++) { | |
439 | struct pa_block *b = &ps->block[i]; | |
440 | ||
d5c27a53 VP |
441 | printf("Writing block #%zu/%zu of %"PRIu64" bytes to file...\n", i, |
442 | ps->block_nr, b->size); | |
3fa2d384 | 443 | if (fwrite(b->addr, b->size, 1, dmp_file) != 1) { |
d5c27a53 | 444 | eprintf("Failed to write block\n"); |
3fa2d384 VP |
445 | fclose(dmp_file); |
446 | return 1; | |
447 | } | |
448 | } | |
449 | ||
450 | return fclose(dmp_file); | |
451 | } | |
452 | ||
3c407ec6 VP |
453 | static bool pe_check_pdb_name(uint64_t base, void *start_addr, |
454 | struct va_space *vs, OMFSignatureRSDS *rsds) | |
3fa2d384 | 455 | { |
3fa2d384 | 456 | const char sign_rsds[4] = "RSDS"; |
3fa2d384 | 457 | IMAGE_DEBUG_DIRECTORY debug_dir; |
3c407ec6 | 458 | char pdb_name[sizeof(PDB_NAME)]; |
3fa2d384 | 459 | |
06ac60b7 VP |
460 | if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY, |
461 | &debug_dir, sizeof(debug_dir), vs)) { | |
462 | eprintf("Failed to get Debug Directory\n"); | |
3c407ec6 | 463 | return false; |
3fa2d384 VP |
464 | } |
465 | ||
466 | if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) { | |
3c407ec6 VP |
467 | eprintf("Debug Directory type is not CodeView\n"); |
468 | return false; | |
3fa2d384 VP |
469 | } |
470 | ||
a15f9749 AO |
471 | if (!va_space_rw(vs, base + debug_dir.AddressOfRawData, |
472 | rsds, sizeof(*rsds), 0)) { | |
3c407ec6 VP |
473 | eprintf("Failed to resolve OMFSignatureRSDS\n"); |
474 | return false; | |
3fa2d384 VP |
475 | } |
476 | ||
3c407ec6 | 477 | if (memcmp(&rsds->Signature, sign_rsds, sizeof(sign_rsds))) { |
8b01683e | 478 | eprintf("CodeView signature is \'%.4s\', \'%.4s\' expected\n", |
3c407ec6 VP |
479 | rsds->Signature, sign_rsds); |
480 | return false; | |
3fa2d384 VP |
481 | } |
482 | ||
3c407ec6 VP |
483 | if (debug_dir.SizeOfData - sizeof(*rsds) != sizeof(PDB_NAME)) { |
484 | eprintf("PDB name size doesn't match\n"); | |
485 | return false; | |
3fa2d384 VP |
486 | } |
487 | ||
a15f9749 AO |
488 | if (!va_space_rw(vs, base + debug_dir.AddressOfRawData + |
489 | offsetof(OMFSignatureRSDS, name), | |
490 | pdb_name, sizeof(PDB_NAME), 0)) { | |
3c407ec6 VP |
491 | eprintf("Failed to resolve PDB name\n"); |
492 | return false; | |
3fa2d384 VP |
493 | } |
494 | ||
495 | printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME); | |
496 | ||
3c407ec6 VP |
497 | return !strcmp(pdb_name, PDB_NAME); |
498 | } | |
3fa2d384 | 499 | |
3c407ec6 VP |
500 | static void pe_get_pdb_symstore_hash(OMFSignatureRSDS *rsds, char *hash) |
501 | { | |
502 | sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds->guid.a, rsds->guid.b, | |
503 | rsds->guid.c, rsds->guid.d[0], rsds->guid.d[1]); | |
3fa2d384 | 504 | hash += 20; |
3c407ec6 VP |
505 | for (unsigned int i = 0; i < 6; i++, hash += 2) { |
506 | sprintf(hash, "%.02x", rsds->guid.e[i]); | |
3fa2d384 VP |
507 | } |
508 | ||
3c407ec6 | 509 | sprintf(hash, "%.01x", rsds->age); |
3fa2d384 VP |
510 | } |
511 | ||
512 | int main(int argc, char *argv[]) | |
513 | { | |
a4e58de1 | 514 | int err = 1; |
3fa2d384 VP |
515 | QEMU_Elf qemu_elf; |
516 | struct pa_space ps; | |
517 | struct va_space vs; | |
518 | QEMUCPUState *state; | |
519 | idt_desc_t first_idt_desc; | |
520 | uint64_t KernBase; | |
521 | void *nt_start_addr = NULL; | |
522 | WinDumpHeader64 header; | |
523 | char pdb_hash[34]; | |
524 | char pdb_url[] = SYM_URL_BASE PDB_NAME | |
525 | "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME; | |
526 | struct pdb_reader pdb; | |
527 | uint64_t KdDebuggerDataBlock; | |
528 | KDDEBUGGER_DATA64 *kdbg; | |
529 | uint64_t KdVersionBlock; | |
d399d6b1 | 530 | bool kernel_found = false; |
3c407ec6 | 531 | OMFSignatureRSDS rsds; |
3fa2d384 VP |
532 | |
533 | if (argc != 3) { | |
534 | eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]); | |
535 | return 1; | |
536 | } | |
537 | ||
538 | if (QEMU_Elf_init(&qemu_elf, argv[1])) { | |
539 | eprintf("Failed to initialize QEMU ELF dump\n"); | |
540 | return 1; | |
541 | } | |
542 | ||
262a0ff8 | 543 | pa_space_create(&ps, &qemu_elf); |
3fa2d384 VP |
544 | |
545 | state = qemu_elf.state[0]; | |
6ec6e988 | 546 | printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]); |
3fa2d384 VP |
547 | |
548 | va_space_create(&vs, &ps, state->cr[3]); | |
549 | if (fix_dtb(&vs, &qemu_elf)) { | |
550 | eprintf("Failed to find paging base\n"); | |
3fa2d384 VP |
551 | goto out_elf; |
552 | } | |
553 | ||
6ec6e988 | 554 | printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base); |
3fa2d384 | 555 | |
a15f9749 AO |
556 | if (!va_space_rw(&vs, state->idt.base, |
557 | &first_idt_desc, sizeof(first_idt_desc), 0)) { | |
3fa2d384 | 558 | eprintf("Failed to get CPU #0 IDT[0]\n"); |
3fa2d384 VP |
559 | goto out_ps; |
560 | } | |
6ec6e988 | 561 | printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc)); |
3fa2d384 | 562 | |
2d0fc797 | 563 | KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1); |
6ec6e988 | 564 | printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase); |
3fa2d384 | 565 | |
2d0fc797 | 566 | for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) { |
3fa2d384 VP |
567 | nt_start_addr = va_space_resolve(&vs, KernBase); |
568 | if (!nt_start_addr) { | |
569 | continue; | |
570 | } | |
571 | ||
572 | if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */ | |
3c407ec6 VP |
573 | printf("Checking candidate KernBase = 0x%016"PRIx64"\n", KernBase); |
574 | if (pe_check_pdb_name(KernBase, nt_start_addr, &vs, &rsds)) { | |
d399d6b1 VP |
575 | kernel_found = true; |
576 | break; | |
577 | } | |
3fa2d384 VP |
578 | } |
579 | } | |
580 | ||
d399d6b1 | 581 | if (!kernel_found) { |
06164cc4 | 582 | eprintf("Failed to find NT kernel image\n"); |
06164cc4 VP |
583 | goto out_ps; |
584 | } | |
585 | ||
6ec6e988 | 586 | printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase, |
3fa2d384 VP |
587 | (char *)nt_start_addr); |
588 | ||
3c407ec6 | 589 | pe_get_pdb_symstore_hash(&rsds, pdb_hash); |
3fa2d384 VP |
590 | |
591 | sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME); | |
592 | printf("PDB URL is %s\n", pdb_url); | |
593 | ||
594 | if (download_url(PDB_NAME, pdb_url)) { | |
595 | eprintf("Failed to download PDB file\n"); | |
3fa2d384 VP |
596 | goto out_ps; |
597 | } | |
598 | ||
599 | if (pdb_init_from_file(PDB_NAME, &pdb)) { | |
600 | eprintf("Failed to initialize PDB reader\n"); | |
3fa2d384 VP |
601 | goto out_pdb_file; |
602 | } | |
603 | ||
604 | if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) || | |
605 | !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) { | |
3fa2d384 VP |
606 | goto out_pdb; |
607 | } | |
608 | ||
609 | kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock); | |
610 | if (!kdbg) { | |
3fa2d384 VP |
611 | goto out_pdb; |
612 | } | |
613 | ||
614 | if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg, | |
615 | KdVersionBlock, qemu_elf.state_nr)) { | |
885538fd | 616 | goto out_kdbg; |
3fa2d384 VP |
617 | } |
618 | ||
87157ef3 | 619 | fill_context(kdbg, &vs, &qemu_elf); |
3fa2d384 VP |
620 | |
621 | if (write_dump(&ps, &header, argv[2])) { | |
622 | eprintf("Failed to save dump\n"); | |
3fa2d384 VP |
623 | goto out_kdbg; |
624 | } | |
625 | ||
a4e58de1 AO |
626 | err = 0; |
627 | ||
3fa2d384 | 628 | out_kdbg: |
2a052b4e | 629 | g_free(kdbg); |
3fa2d384 VP |
630 | out_pdb: |
631 | pdb_exit(&pdb); | |
632 | out_pdb_file: | |
633 | unlink(PDB_NAME); | |
634 | out_ps: | |
635 | pa_space_destroy(&ps); | |
636 | out_elf: | |
637 | QEMU_Elf_exit(&qemu_elf); | |
638 | ||
639 | return err; | |
640 | } |