contrib/elf2dmp/main.c

   1 /*
   2  * Copyright (c) 2018 Virtuozzo International GmbH
   3  *
   4  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   5  *
   6  */
   7
   8 #include "qemu/osdep.h"
   9 #include "err.h"
  10 #include "addrspace.h"
  11 #include "pe.h"
  12 #include "pdb.h"
  13 #include "kdbg.h"
  14 #include "download.h"
  15 #include "qemu/win_dump_defs.h"
  16
  17 #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
  18 #define PDB_NAME    "ntkrnlmp.pdb"
  19
  20 #define INITIAL_MXCSR   0x1f80
  21
  22 typedef struct idt_desc {
  23     uint16_t offset1;   /* offset bits 0..15 */
  24     uint16_t selector;
  25     uint8_t ist;
  26     uint8_t type_attr;
  27     uint16_t offset2;   /* offset bits 16..31 */
  28     uint32_t offset3;   /* offset bits 32..63 */
  29     uint32_t rsrvd;
  30 } __attribute__ ((packed)) idt_desc_t;
  31
  32 static uint64_t idt_desc_addr(idt_desc_t desc)
  33 {
  34     return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) |
  35           ((uint64_t)desc.offset3 << 32);
  36 }
  37
  38 static const uint64_t SharedUserData = 0xfffff78000000000;
  39
  40 #define KUSD_OFFSET_SUITE_MASK 0x2d0
  41 #define KUSD_OFFSET_PRODUCT_TYPE 0x264
  42
  43 #define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
  44     s ? printf(#s" = 0x%016lx\n", s) : eprintf("Failed to resolve "#s"\n"), s)
  45
  46 static uint64_t rol(uint64_t x, uint64_t y)
  47 {
  48     return (x << y) | (x >> (64 - y));
  49 }
  50
  51 /*
  52  * Decoding algorithm can be found in Volatility project
  53  */
  54 static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
  55         uint64_t kwn, uint64_t kwa, uint64_t kdbe)
  56 {
  57     size_t i;
  58     assert(size % sizeof(uint64_t) == 0);
  59     for (i = 0; i < size / sizeof(uint64_t); i++) {
  60         uint64_t block;
  61
  62         block = src[i];
  63         block = rol(block ^ kwn, (uint8_t)kwn);
  64         block = __builtin_bswap64(block ^ kdbe) ^ kwa;
  65         dst[i] = block;
  66     }
  67 }
  68
  69 static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
  70         struct va_space *vs, uint64_t KdDebuggerDataBlock)
  71 {
  72     const char OwnerTag[4] = "KDBG";
  73     KDDEBUGGER_DATA64 *kdbg = NULL;
  74     DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
  75     bool decode = false;
  76     uint64_t kwn, kwa, KdpDataBlockEncoded;
  77
  78     if (va_space_rw(vs,
  79                 KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
  80                 &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
  81         eprintf("Failed to extract KDBG header\n");
  82         return NULL;
  83     }
  84
  85     if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
  86         uint64_t KiWaitNever, KiWaitAlways;
  87
  88         decode = true;
  89
  90         if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) ||
  91                 !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) ||
  92                 !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
  93             return NULL;
  94         }
  95
  96         if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
  97                 va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
  98             return NULL;
  99         }
 100
 101         printf("[KiWaitNever] = 0x%016lx\n", kwn);
 102         printf("[KiWaitAlways] = 0x%016lx\n", kwa);
 103
 104         /*
 105          * If KDBG header can be decoded, KDBG size is available
 106          * and entire KDBG can be decoded.
 107          */
 108         printf("Decoding KDBG header...\n");
 109         kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr,
 110                 sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);
 111
 112         printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
 113         if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
 114             eprintf("Failed to decode KDBG header\n");
 115             return NULL;
 116         }
 117     }
 118
 119     kdbg = malloc(kdbg_hdr.Size);
 120     if (!kdbg) {
 121         return NULL;
 122     }
 123
 124     if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
 125         eprintf("Failed to extract entire KDBG\n");
 126         return NULL;
 127     }
 128
 129     if (!decode) {
 130         return kdbg;
 131     }
 132
 133     printf("Decoding KdDebuggerDataBlock...\n");
 134     kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size,
 135                 kwn, kwa, KdpDataBlockEncoded);
 136
 137     va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);
 138
 139     return kdbg;
 140 }
 141
 142 static void win_context_init_from_qemu_cpu_state(WinContext *ctx,
 143         QEMUCPUState *s)
 144 {
 145     WinContext win_ctx = (WinContext){
 146         .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
 147         .MxCsr = INITIAL_MXCSR,
 148
 149         .SegCs = s->cs.selector,
 150         .SegSs = s->ss.selector,
 151         .SegDs = s->ds.selector,
 152         .SegEs = s->es.selector,
 153         .SegFs = s->fs.selector,
 154         .SegGs = s->gs.selector,
 155         .EFlags = (uint32_t)s->rflags,
 156
 157         .Rax = s->rax,
 158         .Rbx = s->rbx,
 159         .Rcx = s->rcx,
 160         .Rdx = s->rdx,
 161         .Rsp = s->rsp,
 162         .Rbp = s->rbp,
 163         .Rsi = s->rsi,
 164         .Rdi = s->rdi,
 165         .R8  = s->r8,
 166         .R9  = s->r9,
 167         .R10 = s->r10,
 168         .R11 = s->r11,
 169         .R12 = s->r12,
 170         .R13 = s->r13,
 171         .R14 = s->r14,
 172         .R15 = s->r15,
 173
 174         .Rip = s->rip,
 175         .FltSave = {
 176             .MxCsr = INITIAL_MXCSR,
 177         },
 178     };
 179
 180     *ctx = win_ctx;
 181 }
 182
 183 /*
 184  * Finds paging-structure hierarchy base,
 185  * if previously set doesn't give access to kernel structures
 186  */
 187 static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
 188 {
 189     /*
 190      * Firstly, test previously set DTB.
 191      */
 192     if (va_space_resolve(vs, SharedUserData)) {
 193         return 0;
 194     }
 195
 196     /*
 197      * Secondly, find CPU which run system task.
 198      */
 199     size_t i;
 200     for (i = 0; i < qe->state_nr; i++) {
 201         QEMUCPUState *s = qe->state[i];
 202
 203         if (is_system(s)) {
 204             va_space_set_dtb(vs, s->cr[3]);
 205             printf("DTB 0x%016lx has been found from CPU #%zu"
 206                     " as system task CR3\n", vs->dtb, i);
 207             return !(va_space_resolve(vs, SharedUserData));
 208         }
 209     }
 210
 211     /*
 212      * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
 213      * CR3 as [Prcb+0x7000]
 214      */
 215     if (qe->has_kernel_gs_base) {
 216         QEMUCPUState *s = qe->state[0];
 217         uint64_t Prcb = s->kernel_gs_base;
 218         uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
 219
 220         if (!cr3) {
 221             return 1;
 222         }
 223
 224         va_space_set_dtb(vs, *cr3);
 225         printf("DirectoryTableBase = 0x%016lx has been found from CPU #0"
 226                 " as interrupt handling CR3\n", vs->dtb);
 227         return !(va_space_resolve(vs, SharedUserData));
 228     }
 229
 230     return 1;
 231 }
 232
 233 static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
 234         struct va_space *vs, uint64_t KdDebuggerDataBlock,
 235         KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
 236 {
 237     uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
 238             KUSD_OFFSET_SUITE_MASK);
 239     int32_t *product_type = va_space_resolve(vs, SharedUserData +
 240             KUSD_OFFSET_PRODUCT_TYPE);
 241     DBGKD_GET_VERSION64 kvb;
 242     WinDumpHeader64 h;
 243     size_t i;
 244
 245     QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= PAGE_SIZE);
 246     QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= PAGE_SIZE);
 247
 248     if (!suite_mask || !product_type) {
 249         return 1;
 250     }
 251
 252     if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
 253         eprintf("Failed to extract KdVersionBlock\n");
 254         return 1;
 255     }
 256
 257     h = (WinDumpHeader64) {
 258         .Signature = "PAGE",
 259         .ValidDump = "DU64",
 260         .MajorVersion = kvb.MajorVersion,
 261         .MinorVersion = kvb.MinorVersion,
 262         .DirectoryTableBase = vs->dtb,
 263         .PfnDatabase = kdbg->MmPfnDatabase,
 264         .PsLoadedModuleList = kdbg->PsLoadedModuleList,
 265         .PsActiveProcessHead = kdbg->PsActiveProcessHead,
 266         .MachineImageType = kvb.MachineType,
 267         .NumberProcessors = nr_cpus,
 268         .BugcheckCode = LIVE_SYSTEM_DUMP,
 269         .KdDebuggerDataBlock = KdDebuggerDataBlock,
 270         .DumpType = 1,
 271         .Comment = "Hello from elf2dmp!",
 272         .SuiteMask = *suite_mask,
 273         .ProductType = *product_type,
 274         .SecondaryDataState = kvb.KdSecondaryVersion,
 275         .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
 276             .NumberOfRuns = ps->block_nr,
 277         },
 278         .RequiredDumpSpace = sizeof(h),
 279     };
 280
 281     for (i = 0; i < ps->block_nr; i++) {
 282         h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / PAGE_SIZE;
 283         h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
 284             .BasePage = ps->block[i].paddr / PAGE_SIZE,
 285             .PageCount = ps->block[i].size / PAGE_SIZE,
 286         };
 287     }
 288
 289     h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << PAGE_BITS;
 290
 291     *hdr = h;
 292
 293     return 0;
 294 }
 295
 296 static int fill_context(KDDEBUGGER_DATA64 *kdbg,
 297         struct va_space *vs, QEMU_Elf *qe)
 298 {
 299         int i;
 300     for (i = 0; i < qe->state_nr; i++) {
 301         uint64_t Prcb;
 302         uint64_t Context;
 303         WinContext ctx;
 304         QEMUCPUState *s = qe->state[i];
 305
 306         if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
 307                     &Prcb, sizeof(Prcb), 0)) {
 308             eprintf("Failed to read CPU #%d PRCB location\n", i);
 309             return 1;
 310         }
 311
 312         if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
 313                     &Context, sizeof(Context), 0)) {
 314             eprintf("Failed to read CPU #%d ContextFrame location\n", i);
 315             return 1;
 316         }
 317
 318         printf("Filling context for CPU #%d...\n", i);
 319         win_context_init_from_qemu_cpu_state(&ctx, s);
 320
 321         if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
 322             eprintf("Failed to fill CPU #%d context\n", i);
 323             return 1;
 324         }
 325     }
 326
 327     return 0;
 328 }
 329
 330 static int write_dump(struct pa_space *ps,
 331         WinDumpHeader64 *hdr, const char *name)
 332 {
 333     FILE *dmp_file = fopen(name, "wb");
 334     size_t i;
 335
 336     if (!dmp_file) {
 337         eprintf("Failed to open output file \'%s\'\n", name);
 338         return 1;
 339     }
 340
 341     printf("Writing header to file...\n");
 342
 343     if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
 344         eprintf("Failed to write dump header\n");
 345         fclose(dmp_file);
 346         return 1;
 347     }
 348
 349     for (i = 0; i < ps->block_nr; i++) {
 350         struct pa_block *b = &ps->block[i];
 351
 352         printf("Writing block #%zu/%zu to file...\n", i, ps->block_nr);
 353         if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
 354             eprintf("Failed to write dump header\n");
 355             fclose(dmp_file);
 356             return 1;
 357         }
 358     }
 359
 360     return fclose(dmp_file);
 361 }
 362
 363 static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
 364         char *hash, struct va_space *vs)
 365 {
 366     const char e_magic[2] = "MZ";
 367     const char Signature[4] = "PE\0\0";
 368     const char sign_rsds[4] = "RSDS";
 369     IMAGE_DOS_HEADER *dos_hdr = start_addr;
 370     IMAGE_NT_HEADERS64 nt_hdrs;
 371     IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
 372     IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
 373     IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
 374     IMAGE_DEBUG_DIRECTORY debug_dir;
 375     OMFSignatureRSDS rsds;
 376     char *pdb_name;
 377     size_t pdb_name_sz;
 378     size_t i;
 379
 380     QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= PAGE_SIZE);
 381
 382     if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
 383         return 1;
 384     }
 385
 386     if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 387                 &nt_hdrs, sizeof(nt_hdrs), 0)) {
 388         return 1;
 389     }
 390
 391     if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 392             file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 393         return 1;
 394     }
 395
 396     printf("Debug Directory RVA = 0x%016x\n",
 397             data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
 398
 399     if (va_space_rw(vs,
 400                 base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
 401                 &debug_dir, sizeof(debug_dir), 0)) {
 402         return 1;
 403     }
 404
 405     if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
 406         return 1;
 407     }
 408
 409     if (va_space_rw(vs,
 410                 base + debug_dir.AddressOfRawData,
 411                 &rsds, sizeof(rsds), 0)) {
 412         return 1;
 413     }
 414
 415     printf("CodeView signature is \'%.4s\'\n", rsds.Signature);
 416
 417     if (memcmp(&rsds.Signature, sign_rsds, sizeof(sign_rsds))) {
 418         return 1;
 419     }
 420
 421     pdb_name_sz = debug_dir.SizeOfData - sizeof(rsds);
 422     pdb_name = malloc(pdb_name_sz);
 423     if (!pdb_name) {
 424         return 1;
 425     }
 426
 427     if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
 428                 offsetof(OMFSignatureRSDS, name), pdb_name, pdb_name_sz, 0)) {
 429         free(pdb_name);
 430         return 1;
 431     }
 432
 433     printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
 434
 435     if (strcmp(pdb_name, PDB_NAME)) {
 436         eprintf("Unexpected PDB name, it seems the kernel isn't found\n");
 437         free(pdb_name);
 438         return 1;
 439     }
 440
 441     free(pdb_name);
 442
 443     sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds.guid.a, rsds.guid.b,
 444             rsds.guid.c, rsds.guid.d[0], rsds.guid.d[1]);
 445     hash += 20;
 446     for (i = 0; i < 6; i++, hash += 2) {
 447         sprintf(hash, "%.02x", rsds.guid.e[i]);
 448     }
 449
 450     sprintf(hash, "%.01x", rsds.age);
 451
 452     return 0;
 453 }
 454
 455 int main(int argc, char *argv[])
 456 {
 457     int err = 0;
 458     QEMU_Elf qemu_elf;
 459     struct pa_space ps;
 460     struct va_space vs;
 461     QEMUCPUState *state;
 462     idt_desc_t first_idt_desc;
 463     uint64_t KernBase;
 464     void *nt_start_addr = NULL;
 465     WinDumpHeader64 header;
 466     char pdb_hash[34];
 467     char pdb_url[] = SYM_URL_BASE PDB_NAME
 468         "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
 469     struct pdb_reader pdb;
 470     uint64_t KdDebuggerDataBlock;
 471     KDDEBUGGER_DATA64 *kdbg;
 472     uint64_t KdVersionBlock;
 473
 474     if (argc != 3) {
 475         eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
 476         return 1;
 477     }
 478
 479     if (QEMU_Elf_init(&qemu_elf, argv[1])) {
 480         eprintf("Failed to initialize QEMU ELF dump\n");
 481         return 1;
 482     }
 483
 484     if (pa_space_create(&ps, &qemu_elf)) {
 485         eprintf("Failed to initialize physical address space\n");
 486         err = 1;
 487         goto out_elf;
 488     }
 489
 490     state = qemu_elf.state[0];
 491     printf("CPU #0 CR3 is 0x%016lx\n", state->cr[3]);
 492
 493     va_space_create(&vs, &ps, state->cr[3]);
 494     if (fix_dtb(&vs, &qemu_elf)) {
 495         eprintf("Failed to find paging base\n");
 496         err = 1;
 497         goto out_elf;
 498     }
 499
 500     printf("CPU #0 IDT is at 0x%016lx\n", state->idt.base);
 501
 502     if (va_space_rw(&vs, state->idt.base,
 503                 &first_idt_desc, sizeof(first_idt_desc), 0)) {
 504         eprintf("Failed to get CPU #0 IDT[0]\n");
 505         err = 1;
 506         goto out_ps;
 507     }
 508     printf("CPU #0 IDT[0] -> 0x%016lx\n", idt_desc_addr(first_idt_desc));
 509
 510     KernBase = idt_desc_addr(first_idt_desc) & ~(PAGE_SIZE - 1);
 511     printf("Searching kernel downwards from 0x%16lx...\n", KernBase);
 512
 513     for (; KernBase >= 0xfffff78000000000; KernBase -= PAGE_SIZE) {
 514         nt_start_addr = va_space_resolve(&vs, KernBase);
 515         if (!nt_start_addr) {
 516             continue;
 517         }
 518
 519         if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
 520             break;
 521         }
 522     }
 523
 524     printf("KernBase = 0x%16lx, signature is \'%.2s\'\n", KernBase,
 525             (char *)nt_start_addr);
 526
 527     if (pe_get_pdb_symstore_hash(KernBase, nt_start_addr, pdb_hash, &vs)) {
 528         eprintf("Failed to get PDB symbol store hash\n");
 529         err = 1;
 530         goto out_ps;
 531     }
 532
 533     sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
 534     printf("PDB URL is %s\n", pdb_url);
 535
 536     if (download_url(PDB_NAME, pdb_url)) {
 537         eprintf("Failed to download PDB file\n");
 538         err = 1;
 539         goto out_ps;
 540     }
 541
 542     if (pdb_init_from_file(PDB_NAME, &pdb)) {
 543         eprintf("Failed to initialize PDB reader\n");
 544         err = 1;
 545         goto out_pdb_file;
 546     }
 547
 548     if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
 549             !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
 550         err = 1;
 551         goto out_pdb;
 552     }
 553
 554     kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
 555     if (!kdbg) {
 556         err = 1;
 557         goto out_pdb;
 558     }
 559
 560     if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
 561             KdVersionBlock, qemu_elf.state_nr)) {
 562         err = 1;
 563         goto out_pdb;
 564     }
 565
 566     if (fill_context(kdbg, &vs, &qemu_elf)) {
 567         err = 1;
 568         goto out_pdb;
 569     }
 570
 571     if (write_dump(&ps, &header, argv[2])) {
 572         eprintf("Failed to save dump\n");
 573         err = 1;
 574         goto out_kdbg;
 575     }
 576
 577 out_kdbg:
 578     free(kdbg);
 579 out_pdb:
 580     pdb_exit(&pdb);
 581 out_pdb_file:
 582     unlink(PDB_NAME);
 583 out_ps:
 584     pa_space_destroy(&ps);
 585 out_elf:
 586     QEMU_Elf_exit(&qemu_elf);
 587
 588     return err;
 589 }