2 * Copyright (c) 2018 Virtuozzo International GmbH
4 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 #include "qemu/osdep.h"
12 #include "addrspace.h"
17 #include "qemu/win_dump_defs.h"
19 #define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/"
20 #define PDB_NAME "ntkrnlmp.pdb"
22 #define INITIAL_MXCSR 0x1f80
24 typedef struct idt_desc
{
25 uint16_t offset1
; /* offset bits 0..15 */
29 uint16_t offset2
; /* offset bits 16..31 */
30 uint32_t offset3
; /* offset bits 32..63 */
32 } __attribute__ ((packed
)) idt_desc_t
;
34 static uint64_t idt_desc_addr(idt_desc_t desc
)
36 return (uint64_t)desc
.offset1
| ((uint64_t)desc
.offset2
<< 16) |
37 ((uint64_t)desc
.offset3
<< 32);
40 static const uint64_t SharedUserData
= 0xfffff78000000000;
42 #define KUSD_OFFSET_SUITE_MASK 0x2d0
43 #define KUSD_OFFSET_PRODUCT_TYPE 0x264
45 #define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
46 s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
47 eprintf("Failed to resolve "#s"\n"), s)
49 static uint64_t rol(uint64_t x
, uint64_t y
)
51 return (x
<< y
) | (x
>> (64 - y
));
55 * Decoding algorithm can be found in Volatility project
57 static void kdbg_decode(uint64_t *dst
, uint64_t *src
, size_t size
,
58 uint64_t kwn
, uint64_t kwa
, uint64_t kdbe
)
61 assert(size
% sizeof(uint64_t) == 0);
62 for (i
= 0; i
< size
/ sizeof(uint64_t); i
++) {
66 block
= rol(block
^ kwn
, (uint8_t)kwn
);
67 block
= __builtin_bswap64(block
^ kdbe
) ^ kwa
;
72 static KDDEBUGGER_DATA64
*get_kdbg(uint64_t KernBase
, struct pdb_reader
*pdb
,
73 struct va_space
*vs
, uint64_t KdDebuggerDataBlock
)
75 const char OwnerTag
[4] = "KDBG";
76 KDDEBUGGER_DATA64
*kdbg
= NULL
;
77 DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr
;
79 uint64_t kwn
, kwa
, KdpDataBlockEncoded
;
82 KdDebuggerDataBlock
+ offsetof(KDDEBUGGER_DATA64
, Header
),
83 &kdbg_hdr
, sizeof(kdbg_hdr
), 0)) {
84 eprintf("Failed to extract KDBG header\n");
88 if (memcmp(&kdbg_hdr
.OwnerTag
, OwnerTag
, sizeof(OwnerTag
))) {
89 uint64_t KiWaitNever
, KiWaitAlways
;
93 if (!SYM_RESOLVE(KernBase
, pdb
, KiWaitNever
) ||
94 !SYM_RESOLVE(KernBase
, pdb
, KiWaitAlways
) ||
95 !SYM_RESOLVE(KernBase
, pdb
, KdpDataBlockEncoded
)) {
99 if (va_space_rw(vs
, KiWaitNever
, &kwn
, sizeof(kwn
), 0) ||
100 va_space_rw(vs
, KiWaitAlways
, &kwa
, sizeof(kwa
), 0)) {
104 printf("[KiWaitNever] = 0x%016"PRIx64
"\n", kwn
);
105 printf("[KiWaitAlways] = 0x%016"PRIx64
"\n", kwa
);
108 * If KDBG header can be decoded, KDBG size is available
109 * and entire KDBG can be decoded.
111 printf("Decoding KDBG header...\n");
112 kdbg_decode((uint64_t *)&kdbg_hdr
, (uint64_t *)&kdbg_hdr
,
113 sizeof(kdbg_hdr
), kwn
, kwa
, KdpDataBlockEncoded
);
115 printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr
.OwnerTag
);
116 if (memcmp(&kdbg_hdr
.OwnerTag
, OwnerTag
, sizeof(OwnerTag
))) {
117 eprintf("Failed to decode KDBG header\n");
122 kdbg
= malloc(kdbg_hdr
.Size
);
127 if (va_space_rw(vs
, KdDebuggerDataBlock
, kdbg
, kdbg_hdr
.Size
, 0)) {
128 eprintf("Failed to extract entire KDBG\n");
136 printf("Decoding KdDebuggerDataBlock...\n");
137 kdbg_decode((uint64_t *)kdbg
, (uint64_t *)kdbg
, kdbg_hdr
.Size
,
138 kwn
, kwa
, KdpDataBlockEncoded
);
140 va_space_rw(vs
, KdDebuggerDataBlock
, kdbg
, kdbg_hdr
.Size
, 1);
145 static void win_context_init_from_qemu_cpu_state(WinContext
*ctx
,
148 WinContext win_ctx
= (WinContext
){
149 .ContextFlags
= WIN_CTX_X64
| WIN_CTX_INT
| WIN_CTX_SEG
| WIN_CTX_CTL
,
150 .MxCsr
= INITIAL_MXCSR
,
152 .SegCs
= s
->cs
.selector
,
153 .SegSs
= s
->ss
.selector
,
154 .SegDs
= s
->ds
.selector
,
155 .SegEs
= s
->es
.selector
,
156 .SegFs
= s
->fs
.selector
,
157 .SegGs
= s
->gs
.selector
,
158 .EFlags
= (uint32_t)s
->rflags
,
179 .MxCsr
= INITIAL_MXCSR
,
187 * Finds paging-structure hierarchy base,
188 * if previously set doesn't give access to kernel structures
190 static int fix_dtb(struct va_space
*vs
, QEMU_Elf
*qe
)
193 * Firstly, test previously set DTB.
195 if (va_space_resolve(vs
, SharedUserData
)) {
200 * Secondly, find CPU which run system task.
203 for (i
= 0; i
< qe
->state_nr
; i
++) {
204 QEMUCPUState
*s
= qe
->state
[i
];
207 va_space_set_dtb(vs
, s
->cr
[3]);
208 printf("DTB 0x%016"PRIx64
" has been found from CPU #%zu"
209 " as system task CR3\n", vs
->dtb
, i
);
210 return !(va_space_resolve(vs
, SharedUserData
));
215 * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
216 * CR3 as [Prcb+0x7000]
218 if (qe
->has_kernel_gs_base
) {
219 QEMUCPUState
*s
= qe
->state
[0];
220 uint64_t Prcb
= s
->kernel_gs_base
;
221 uint64_t *cr3
= va_space_resolve(vs
, Prcb
+ 0x7000);
227 va_space_set_dtb(vs
, *cr3
);
228 printf("DirectoryTableBase = 0x%016"PRIx64
" has been found from CPU #0"
229 " as interrupt handling CR3\n", vs
->dtb
);
230 return !(va_space_resolve(vs
, SharedUserData
));
236 static int fill_header(WinDumpHeader64
*hdr
, struct pa_space
*ps
,
237 struct va_space
*vs
, uint64_t KdDebuggerDataBlock
,
238 KDDEBUGGER_DATA64
*kdbg
, uint64_t KdVersionBlock
, int nr_cpus
)
240 uint32_t *suite_mask
= va_space_resolve(vs
, SharedUserData
+
241 KUSD_OFFSET_SUITE_MASK
);
242 int32_t *product_type
= va_space_resolve(vs
, SharedUserData
+
243 KUSD_OFFSET_PRODUCT_TYPE
);
244 DBGKD_GET_VERSION64 kvb
;
248 QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK
>= PAGE_SIZE
);
249 QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE
>= PAGE_SIZE
);
251 if (!suite_mask
|| !product_type
) {
255 if (va_space_rw(vs
, KdVersionBlock
, &kvb
, sizeof(kvb
), 0)) {
256 eprintf("Failed to extract KdVersionBlock\n");
260 h
= (WinDumpHeader64
) {
263 .MajorVersion
= kvb
.MajorVersion
,
264 .MinorVersion
= kvb
.MinorVersion
,
265 .DirectoryTableBase
= vs
->dtb
,
266 .PfnDatabase
= kdbg
->MmPfnDatabase
,
267 .PsLoadedModuleList
= kdbg
->PsLoadedModuleList
,
268 .PsActiveProcessHead
= kdbg
->PsActiveProcessHead
,
269 .MachineImageType
= kvb
.MachineType
,
270 .NumberProcessors
= nr_cpus
,
271 .BugcheckCode
= LIVE_SYSTEM_DUMP
,
272 .KdDebuggerDataBlock
= KdDebuggerDataBlock
,
274 .Comment
= "Hello from elf2dmp!",
275 .SuiteMask
= *suite_mask
,
276 .ProductType
= *product_type
,
277 .SecondaryDataState
= kvb
.KdSecondaryVersion
,
278 .PhysicalMemoryBlock
= (WinDumpPhyMemDesc64
) {
279 .NumberOfRuns
= ps
->block_nr
,
281 .RequiredDumpSpace
= sizeof(h
),
284 for (i
= 0; i
< ps
->block_nr
; i
++) {
285 h
.PhysicalMemoryBlock
.NumberOfPages
+= ps
->block
[i
].size
/ PAGE_SIZE
;
286 h
.PhysicalMemoryBlock
.Run
[i
] = (WinDumpPhyMemRun64
) {
287 .BasePage
= ps
->block
[i
].paddr
/ PAGE_SIZE
,
288 .PageCount
= ps
->block
[i
].size
/ PAGE_SIZE
,
292 h
.RequiredDumpSpace
+= h
.PhysicalMemoryBlock
.NumberOfPages
<< PAGE_BITS
;
299 static int fill_context(KDDEBUGGER_DATA64
*kdbg
,
300 struct va_space
*vs
, QEMU_Elf
*qe
)
303 for (i
= 0; i
< qe
->state_nr
; i
++) {
307 QEMUCPUState
*s
= qe
->state
[i
];
309 if (va_space_rw(vs
, kdbg
->KiProcessorBlock
+ sizeof(Prcb
) * i
,
310 &Prcb
, sizeof(Prcb
), 0)) {
311 eprintf("Failed to read CPU #%d PRCB location\n", i
);
315 if (va_space_rw(vs
, Prcb
+ kdbg
->OffsetPrcbContext
,
316 &Context
, sizeof(Context
), 0)) {
317 eprintf("Failed to read CPU #%d ContextFrame location\n", i
);
321 printf("Filling context for CPU #%d...\n", i
);
322 win_context_init_from_qemu_cpu_state(&ctx
, s
);
324 if (va_space_rw(vs
, Context
, &ctx
, sizeof(ctx
), 1)) {
325 eprintf("Failed to fill CPU #%d context\n", i
);
333 static int write_dump(struct pa_space
*ps
,
334 WinDumpHeader64
*hdr
, const char *name
)
336 FILE *dmp_file
= fopen(name
, "wb");
340 eprintf("Failed to open output file \'%s\'\n", name
);
344 printf("Writing header to file...\n");
346 if (fwrite(hdr
, sizeof(*hdr
), 1, dmp_file
) != 1) {
347 eprintf("Failed to write dump header\n");
352 for (i
= 0; i
< ps
->block_nr
; i
++) {
353 struct pa_block
*b
= &ps
->block
[i
];
355 printf("Writing block #%zu/%zu to file...\n", i
, ps
->block_nr
);
356 if (fwrite(b
->addr
, b
->size
, 1, dmp_file
) != 1) {
357 eprintf("Failed to write dump header\n");
363 return fclose(dmp_file
);
366 static int pe_get_pdb_symstore_hash(uint64_t base
, void *start_addr
,
367 char *hash
, struct va_space
*vs
)
369 const char e_magic
[2] = "MZ";
370 const char Signature
[4] = "PE\0\0";
371 const char sign_rsds
[4] = "RSDS";
372 IMAGE_DOS_HEADER
*dos_hdr
= start_addr
;
373 IMAGE_NT_HEADERS64 nt_hdrs
;
374 IMAGE_FILE_HEADER
*file_hdr
= &nt_hdrs
.FileHeader
;
375 IMAGE_OPTIONAL_HEADER64
*opt_hdr
= &nt_hdrs
.OptionalHeader
;
376 IMAGE_DATA_DIRECTORY
*data_dir
= nt_hdrs
.OptionalHeader
.DataDirectory
;
377 IMAGE_DEBUG_DIRECTORY debug_dir
;
378 OMFSignatureRSDS rsds
;
383 QEMU_BUILD_BUG_ON(sizeof(*dos_hdr
) >= PAGE_SIZE
);
385 if (memcmp(&dos_hdr
->e_magic
, e_magic
, sizeof(e_magic
))) {
389 if (va_space_rw(vs
, base
+ dos_hdr
->e_lfanew
,
390 &nt_hdrs
, sizeof(nt_hdrs
), 0)) {
394 if (memcmp(&nt_hdrs
.Signature
, Signature
, sizeof(Signature
)) ||
395 file_hdr
->Machine
!= 0x8664 || opt_hdr
->Magic
!= 0x020b) {
399 printf("Debug Directory RVA = 0x%08"PRIx32
"\n",
400 (uint32_t)data_dir
[IMAGE_FILE_DEBUG_DIRECTORY
].VirtualAddress
);
403 base
+ data_dir
[IMAGE_FILE_DEBUG_DIRECTORY
].VirtualAddress
,
404 &debug_dir
, sizeof(debug_dir
), 0)) {
408 if (debug_dir
.Type
!= IMAGE_DEBUG_TYPE_CODEVIEW
) {
413 base
+ debug_dir
.AddressOfRawData
,
414 &rsds
, sizeof(rsds
), 0)) {
418 printf("CodeView signature is \'%.4s\'\n", rsds
.Signature
);
420 if (memcmp(&rsds
.Signature
, sign_rsds
, sizeof(sign_rsds
))) {
424 pdb_name_sz
= debug_dir
.SizeOfData
- sizeof(rsds
);
425 pdb_name
= malloc(pdb_name_sz
);
430 if (va_space_rw(vs
, base
+ debug_dir
.AddressOfRawData
+
431 offsetof(OMFSignatureRSDS
, name
), pdb_name
, pdb_name_sz
, 0)) {
436 printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name
, PDB_NAME
);
438 if (strcmp(pdb_name
, PDB_NAME
)) {
439 eprintf("Unexpected PDB name, it seems the kernel isn't found\n");
446 sprintf(hash
, "%.08x%.04x%.04x%.02x%.02x", rsds
.guid
.a
, rsds
.guid
.b
,
447 rsds
.guid
.c
, rsds
.guid
.d
[0], rsds
.guid
.d
[1]);
449 for (i
= 0; i
< 6; i
++, hash
+= 2) {
450 sprintf(hash
, "%.02x", rsds
.guid
.e
[i
]);
453 sprintf(hash
, "%.01x", rsds
.age
);
458 int main(int argc
, char *argv
[])
465 idt_desc_t first_idt_desc
;
467 void *nt_start_addr
= NULL
;
468 WinDumpHeader64 header
;
470 char pdb_url
[] = SYM_URL_BASE PDB_NAME
471 "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME
;
472 struct pdb_reader pdb
;
473 uint64_t KdDebuggerDataBlock
;
474 KDDEBUGGER_DATA64
*kdbg
;
475 uint64_t KdVersionBlock
;
478 eprintf("usage:\n\t%s elf_file dmp_file\n", argv
[0]);
482 if (QEMU_Elf_init(&qemu_elf
, argv
[1])) {
483 eprintf("Failed to initialize QEMU ELF dump\n");
487 if (pa_space_create(&ps
, &qemu_elf
)) {
488 eprintf("Failed to initialize physical address space\n");
493 state
= qemu_elf
.state
[0];
494 printf("CPU #0 CR3 is 0x%016"PRIx64
"\n", state
->cr
[3]);
496 va_space_create(&vs
, &ps
, state
->cr
[3]);
497 if (fix_dtb(&vs
, &qemu_elf
)) {
498 eprintf("Failed to find paging base\n");
503 printf("CPU #0 IDT is at 0x%016"PRIx64
"\n", state
->idt
.base
);
505 if (va_space_rw(&vs
, state
->idt
.base
,
506 &first_idt_desc
, sizeof(first_idt_desc
), 0)) {
507 eprintf("Failed to get CPU #0 IDT[0]\n");
511 printf("CPU #0 IDT[0] -> 0x%016"PRIx64
"\n", idt_desc_addr(first_idt_desc
));
513 KernBase
= idt_desc_addr(first_idt_desc
) & ~(PAGE_SIZE
- 1);
514 printf("Searching kernel downwards from 0x%016"PRIx64
"...\n", KernBase
);
516 for (; KernBase
>= 0xfffff78000000000; KernBase
-= PAGE_SIZE
) {
517 nt_start_addr
= va_space_resolve(&vs
, KernBase
);
518 if (!nt_start_addr
) {
522 if (*(uint16_t *)nt_start_addr
== 0x5a4d) { /* MZ */
527 if (!nt_start_addr
) {
528 eprintf("Failed to find NT kernel image\n");
533 printf("KernBase = 0x%016"PRIx64
", signature is \'%.2s\'\n", KernBase
,
534 (char *)nt_start_addr
);
536 if (pe_get_pdb_symstore_hash(KernBase
, nt_start_addr
, pdb_hash
, &vs
)) {
537 eprintf("Failed to get PDB symbol store hash\n");
542 sprintf(pdb_url
, "%s%s/%s/%s", SYM_URL_BASE
, PDB_NAME
, pdb_hash
, PDB_NAME
);
543 printf("PDB URL is %s\n", pdb_url
);
545 if (download_url(PDB_NAME
, pdb_url
)) {
546 eprintf("Failed to download PDB file\n");
551 if (pdb_init_from_file(PDB_NAME
, &pdb
)) {
552 eprintf("Failed to initialize PDB reader\n");
557 if (!SYM_RESOLVE(KernBase
, &pdb
, KdDebuggerDataBlock
) ||
558 !SYM_RESOLVE(KernBase
, &pdb
, KdVersionBlock
)) {
563 kdbg
= get_kdbg(KernBase
, &pdb
, &vs
, KdDebuggerDataBlock
);
569 if (fill_header(&header
, &ps
, &vs
, KdDebuggerDataBlock
, kdbg
,
570 KdVersionBlock
, qemu_elf
.state_nr
)) {
575 if (fill_context(kdbg
, &vs
, &qemu_elf
)) {
580 if (write_dump(&ps
, &header
, argv
[2])) {
581 eprintf("Failed to save dump\n");
593 pa_space_destroy(&ps
);
595 QEMU_Elf_exit(&qemu_elf
);