contrib/elf2dmp/main.c

   1 /*
   2  * Copyright (c) 2018 Virtuozzo International GmbH
   3  *
   4  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   5  *
   6  */
   7
   8 #include "qemu/osdep.h"
   9
  10 #include "err.h"
  11 #include "addrspace.h"
  12 #include "pe.h"
  13 #include "pdb.h"
  14 #include "kdbg.h"
  15 #include "download.h"
  16 #include "qemu/win_dump_defs.h"
  17
  18 #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
  19 #define PDB_NAME    "ntkrnlmp.pdb"
  20
  21 #define INITIAL_MXCSR   0x1f80
  22
  23 typedef struct idt_desc {
  24     uint16_t offset1;   /* offset bits 0..15 */
  25     uint16_t selector;
  26     uint8_t ist;
  27     uint8_t type_attr;
  28     uint16_t offset2;   /* offset bits 16..31 */
  29     uint32_t offset3;   /* offset bits 32..63 */
  30     uint32_t rsrvd;
  31 } __attribute__ ((packed)) idt_desc_t;
  32
  33 static uint64_t idt_desc_addr(idt_desc_t desc)
  34 {
  35     return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) |
  36           ((uint64_t)desc.offset3 << 32);
  37 }
  38
  39 static const uint64_t SharedUserData = 0xfffff78000000000;
  40
  41 #define KUSD_OFFSET_SUITE_MASK 0x2d0
  42 #define KUSD_OFFSET_PRODUCT_TYPE 0x264
  43
  44 #define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
  45     s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
  46     eprintf("Failed to resolve "#s"\n"), s)
  47
  48 static uint64_t rol(uint64_t x, uint64_t y)
  49 {
  50     return (x << y) | (x >> (64 - y));
  51 }
  52
  53 /*
  54  * Decoding algorithm can be found in Volatility project
  55  */
  56 static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
  57         uint64_t kwn, uint64_t kwa, uint64_t kdbe)
  58 {
  59     size_t i;
  60     assert(size % sizeof(uint64_t) == 0);
  61     for (i = 0; i < size / sizeof(uint64_t); i++) {
  62         uint64_t block;
  63
  64         block = src[i];
  65         block = rol(block ^ kwn, (uint8_t)kwn);
  66         block = __builtin_bswap64(block ^ kdbe) ^ kwa;
  67         dst[i] = block;
  68     }
  69 }
  70
  71 static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
  72         struct va_space *vs, uint64_t KdDebuggerDataBlock)
  73 {
  74     const char OwnerTag[4] = "KDBG";
  75     KDDEBUGGER_DATA64 *kdbg = NULL;
  76     DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
  77     bool decode = false;
  78     uint64_t kwn, kwa, KdpDataBlockEncoded;
  79
  80     if (va_space_rw(vs,
  81                 KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
  82                 &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
  83         eprintf("Failed to extract KDBG header\n");
  84         return NULL;
  85     }
  86
  87     if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
  88         uint64_t KiWaitNever, KiWaitAlways;
  89
  90         decode = true;
  91
  92         if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) ||
  93                 !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) ||
  94                 !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
  95             return NULL;
  96         }
  97
  98         if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
  99                 va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
 100             return NULL;
 101         }
 102
 103         printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
 104         printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);
 105
 106         /*
 107          * If KDBG header can be decoded, KDBG size is available
 108          * and entire KDBG can be decoded.
 109          */
 110         printf("Decoding KDBG header...\n");
 111         kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr,
 112                 sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);
 113
 114         printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
 115         if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
 116             eprintf("Failed to decode KDBG header\n");
 117             return NULL;
 118         }
 119     }
 120
 121     kdbg = malloc(kdbg_hdr.Size);
 122     if (!kdbg) {
 123         return NULL;
 124     }
 125
 126     if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
 127         eprintf("Failed to extract entire KDBG\n");
 128         free(kdbg);
 129         return NULL;
 130     }
 131
 132     if (!decode) {
 133         return kdbg;
 134     }
 135
 136     printf("Decoding KdDebuggerDataBlock...\n");
 137     kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size,
 138                 kwn, kwa, KdpDataBlockEncoded);
 139
 140     va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);
 141
 142     return kdbg;
 143 }
 144
 145 static void win_context_init_from_qemu_cpu_state(WinContext64 *ctx,
 146         QEMUCPUState *s)
 147 {
 148     WinContext64 win_ctx = (WinContext64){
 149         .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
 150         .MxCsr = INITIAL_MXCSR,
 151
 152         .SegCs = s->cs.selector,
 153         .SegSs = s->ss.selector,
 154         .SegDs = s->ds.selector,
 155         .SegEs = s->es.selector,
 156         .SegFs = s->fs.selector,
 157         .SegGs = s->gs.selector,
 158         .EFlags = (uint32_t)s->rflags,
 159
 160         .Rax = s->rax,
 161         .Rbx = s->rbx,
 162         .Rcx = s->rcx,
 163         .Rdx = s->rdx,
 164         .Rsp = s->rsp,
 165         .Rbp = s->rbp,
 166         .Rsi = s->rsi,
 167         .Rdi = s->rdi,
 168         .R8  = s->r8,
 169         .R9  = s->r9,
 170         .R10 = s->r10,
 171         .R11 = s->r11,
 172         .R12 = s->r12,
 173         .R13 = s->r13,
 174         .R14 = s->r14,
 175         .R15 = s->r15,
 176
 177         .Rip = s->rip,
 178         .FltSave = {
 179             .MxCsr = INITIAL_MXCSR,
 180         },
 181     };
 182
 183     *ctx = win_ctx;
 184 }
 185
 186 /*
 187  * Finds paging-structure hierarchy base,
 188  * if previously set doesn't give access to kernel structures
 189  */
 190 static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
 191 {
 192     /*
 193      * Firstly, test previously set DTB.
 194      */
 195     if (va_space_resolve(vs, SharedUserData)) {
 196         return 0;
 197     }
 198
 199     /*
 200      * Secondly, find CPU which run system task.
 201      */
 202     size_t i;
 203     for (i = 0; i < qe->state_nr; i++) {
 204         QEMUCPUState *s = qe->state[i];
 205
 206         if (is_system(s)) {
 207             va_space_set_dtb(vs, s->cr[3]);
 208             printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
 209                     " as system task CR3\n", vs->dtb, i);
 210             return !(va_space_resolve(vs, SharedUserData));
 211         }
 212     }
 213
 214     /*
 215      * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
 216      * CR3 as [Prcb+0x7000]
 217      */
 218     if (qe->has_kernel_gs_base) {
 219         QEMUCPUState *s = qe->state[0];
 220         uint64_t Prcb = s->kernel_gs_base;
 221         uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
 222
 223         if (!cr3) {
 224             return 1;
 225         }
 226
 227         va_space_set_dtb(vs, *cr3);
 228         printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
 229                 " as interrupt handling CR3\n", vs->dtb);
 230         return !(va_space_resolve(vs, SharedUserData));
 231     }
 232
 233     return 1;
 234 }
 235
 236 static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
 237         struct va_space *vs, uint64_t KdDebuggerDataBlock,
 238         KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
 239 {
 240     uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
 241             KUSD_OFFSET_SUITE_MASK);
 242     int32_t *product_type = va_space_resolve(vs, SharedUserData +
 243             KUSD_OFFSET_PRODUCT_TYPE);
 244     DBGKD_GET_VERSION64 kvb;
 245     WinDumpHeader64 h;
 246     size_t i;
 247
 248     QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE);
 249     QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE);
 250
 251     if (!suite_mask || !product_type) {
 252         return 1;
 253     }
 254
 255     if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
 256         eprintf("Failed to extract KdVersionBlock\n");
 257         return 1;
 258     }
 259
 260     h = (WinDumpHeader64) {
 261         .Signature = "PAGE",
 262         .ValidDump = "DU64",
 263         .MajorVersion = kvb.MajorVersion,
 264         .MinorVersion = kvb.MinorVersion,
 265         .DirectoryTableBase = vs->dtb,
 266         .PfnDatabase = kdbg->MmPfnDatabase,
 267         .PsLoadedModuleList = kdbg->PsLoadedModuleList,
 268         .PsActiveProcessHead = kdbg->PsActiveProcessHead,
 269         .MachineImageType = kvb.MachineType,
 270         .NumberProcessors = nr_cpus,
 271         .BugcheckCode = LIVE_SYSTEM_DUMP,
 272         .KdDebuggerDataBlock = KdDebuggerDataBlock,
 273         .DumpType = 1,
 274         .Comment = "Hello from elf2dmp!",
 275         .SuiteMask = *suite_mask,
 276         .ProductType = *product_type,
 277         .SecondaryDataState = kvb.KdSecondaryVersion,
 278         .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
 279             .NumberOfRuns = ps->block_nr,
 280         },
 281         .RequiredDumpSpace = sizeof(h),
 282     };
 283
 284     for (i = 0; i < ps->block_nr; i++) {
 285         h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE;
 286         h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
 287             .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE,
 288             .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE,
 289         };
 290     }
 291
 292     h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
 293
 294     *hdr = h;
 295
 296     return 0;
 297 }
 298
 299 static int fill_context(KDDEBUGGER_DATA64 *kdbg,
 300         struct va_space *vs, QEMU_Elf *qe)
 301 {
 302         int i;
 303     for (i = 0; i < qe->state_nr; i++) {
 304         uint64_t Prcb;
 305         uint64_t Context;
 306         WinContext64 ctx;
 307         QEMUCPUState *s = qe->state[i];
 308
 309         if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
 310                     &Prcb, sizeof(Prcb), 0)) {
 311             eprintf("Failed to read CPU #%d PRCB location\n", i);
 312             return 1;
 313         }
 314
 315         if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
 316                     &Context, sizeof(Context), 0)) {
 317             eprintf("Failed to read CPU #%d ContextFrame location\n", i);
 318             return 1;
 319         }
 320
 321         printf("Filling context for CPU #%d...\n", i);
 322         win_context_init_from_qemu_cpu_state(&ctx, s);
 323
 324         if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
 325             eprintf("Failed to fill CPU #%d context\n", i);
 326             return 1;
 327         }
 328     }
 329
 330     return 0;
 331 }
 332
 333 static int write_dump(struct pa_space *ps,
 334         WinDumpHeader64 *hdr, const char *name)
 335 {
 336     FILE *dmp_file = fopen(name, "wb");
 337     size_t i;
 338
 339     if (!dmp_file) {
 340         eprintf("Failed to open output file \'%s\'\n", name);
 341         return 1;
 342     }
 343
 344     printf("Writing header to file...\n");
 345
 346     if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
 347         eprintf("Failed to write dump header\n");
 348         fclose(dmp_file);
 349         return 1;
 350     }
 351
 352     for (i = 0; i < ps->block_nr; i++) {
 353         struct pa_block *b = &ps->block[i];
 354
 355         printf("Writing block #%zu/%zu to file...\n", i, ps->block_nr);
 356         if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
 357             eprintf("Failed to write dump header\n");
 358             fclose(dmp_file);
 359             return 1;
 360         }
 361     }
 362
 363     return fclose(dmp_file);
 364 }
 365
 366 static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
 367         char *hash, struct va_space *vs)
 368 {
 369     const char e_magic[2] = "MZ";
 370     const char Signature[4] = "PE\0\0";
 371     const char sign_rsds[4] = "RSDS";
 372     IMAGE_DOS_HEADER *dos_hdr = start_addr;
 373     IMAGE_NT_HEADERS64 nt_hdrs;
 374     IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
 375     IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
 376     IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
 377     IMAGE_DEBUG_DIRECTORY debug_dir;
 378     OMFSignatureRSDS rsds;
 379     char *pdb_name;
 380     size_t pdb_name_sz;
 381     size_t i;
 382
 383     QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
 384
 385     if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
 386         return 1;
 387     }
 388
 389     if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 390                 &nt_hdrs, sizeof(nt_hdrs), 0)) {
 391         return 1;
 392     }
 393
 394     if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 395             file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 396         return 1;
 397     }
 398
 399     printf("Debug Directory RVA = 0x%08"PRIx32"\n",
 400             (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
 401
 402     if (va_space_rw(vs,
 403                 base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
 404                 &debug_dir, sizeof(debug_dir), 0)) {
 405         return 1;
 406     }
 407
 408     if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
 409         return 1;
 410     }
 411
 412     if (va_space_rw(vs,
 413                 base + debug_dir.AddressOfRawData,
 414                 &rsds, sizeof(rsds), 0)) {
 415         return 1;
 416     }
 417
 418     printf("CodeView signature is \'%.4s\'\n", rsds.Signature);
 419
 420     if (memcmp(&rsds.Signature, sign_rsds, sizeof(sign_rsds))) {
 421         return 1;
 422     }
 423
 424     pdb_name_sz = debug_dir.SizeOfData - sizeof(rsds);
 425     pdb_name = malloc(pdb_name_sz);
 426     if (!pdb_name) {
 427         return 1;
 428     }
 429
 430     if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
 431                 offsetof(OMFSignatureRSDS, name), pdb_name, pdb_name_sz, 0)) {
 432         free(pdb_name);
 433         return 1;
 434     }
 435
 436     printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
 437
 438     if (strcmp(pdb_name, PDB_NAME)) {
 439         eprintf("Unexpected PDB name, it seems the kernel isn't found\n");
 440         free(pdb_name);
 441         return 1;
 442     }
 443
 444     free(pdb_name);
 445
 446     sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds.guid.a, rsds.guid.b,
 447             rsds.guid.c, rsds.guid.d[0], rsds.guid.d[1]);
 448     hash += 20;
 449     for (i = 0; i < 6; i++, hash += 2) {
 450         sprintf(hash, "%.02x", rsds.guid.e[i]);
 451     }
 452
 453     sprintf(hash, "%.01x", rsds.age);
 454
 455     return 0;
 456 }
 457
 458 int main(int argc, char *argv[])
 459 {
 460     int err = 0;
 461     QEMU_Elf qemu_elf;
 462     struct pa_space ps;
 463     struct va_space vs;
 464     QEMUCPUState *state;
 465     idt_desc_t first_idt_desc;
 466     uint64_t KernBase;
 467     void *nt_start_addr = NULL;
 468     WinDumpHeader64 header;
 469     char pdb_hash[34];
 470     char pdb_url[] = SYM_URL_BASE PDB_NAME
 471         "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
 472     struct pdb_reader pdb;
 473     uint64_t KdDebuggerDataBlock;
 474     KDDEBUGGER_DATA64 *kdbg;
 475     uint64_t KdVersionBlock;
 476
 477     if (argc != 3) {
 478         eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
 479         return 1;
 480     }
 481
 482     if (QEMU_Elf_init(&qemu_elf, argv[1])) {
 483         eprintf("Failed to initialize QEMU ELF dump\n");
 484         return 1;
 485     }
 486
 487     if (pa_space_create(&ps, &qemu_elf)) {
 488         eprintf("Failed to initialize physical address space\n");
 489         err = 1;
 490         goto out_elf;
 491     }
 492
 493     state = qemu_elf.state[0];
 494     printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);
 495
 496     va_space_create(&vs, &ps, state->cr[3]);
 497     if (fix_dtb(&vs, &qemu_elf)) {
 498         eprintf("Failed to find paging base\n");
 499         err = 1;
 500         goto out_elf;
 501     }
 502
 503     printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);
 504
 505     if (va_space_rw(&vs, state->idt.base,
 506                 &first_idt_desc, sizeof(first_idt_desc), 0)) {
 507         eprintf("Failed to get CPU #0 IDT[0]\n");
 508         err = 1;
 509         goto out_ps;
 510     }
 511     printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));
 512
 513     KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1);
 514     printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);
 515
 516     for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) {
 517         nt_start_addr = va_space_resolve(&vs, KernBase);
 518         if (!nt_start_addr) {
 519             continue;
 520         }
 521
 522         if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
 523             break;
 524         }
 525     }
 526
 527     if (!nt_start_addr) {
 528         eprintf("Failed to find NT kernel image\n");
 529         err = 1;
 530         goto out_ps;
 531     }
 532
 533     printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
 534             (char *)nt_start_addr);
 535
 536     if (pe_get_pdb_symstore_hash(KernBase, nt_start_addr, pdb_hash, &vs)) {
 537         eprintf("Failed to get PDB symbol store hash\n");
 538         err = 1;
 539         goto out_ps;
 540     }
 541
 542     sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
 543     printf("PDB URL is %s\n", pdb_url);
 544
 545     if (download_url(PDB_NAME, pdb_url)) {
 546         eprintf("Failed to download PDB file\n");
 547         err = 1;
 548         goto out_ps;
 549     }
 550
 551     if (pdb_init_from_file(PDB_NAME, &pdb)) {
 552         eprintf("Failed to initialize PDB reader\n");
 553         err = 1;
 554         goto out_pdb_file;
 555     }
 556
 557     if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
 558             !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
 559         err = 1;
 560         goto out_pdb;
 561     }
 562
 563     kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
 564     if (!kdbg) {
 565         err = 1;
 566         goto out_pdb;
 567     }
 568
 569     if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
 570             KdVersionBlock, qemu_elf.state_nr)) {
 571         err = 1;
 572         goto out_kdbg;
 573     }
 574
 575     if (fill_context(kdbg, &vs, &qemu_elf)) {
 576         err = 1;
 577         goto out_kdbg;
 578     }
 579
 580     if (write_dump(&ps, &header, argv[2])) {
 581         eprintf("Failed to save dump\n");
 582         err = 1;
 583         goto out_kdbg;
 584     }
 585
 586 out_kdbg:
 587     free(kdbg);
 588 out_pdb:
 589     pdb_exit(&pdb);
 590 out_pdb_file:
 591     unlink(PDB_NAME);
 592 out_ps:
 593     pa_space_destroy(&ps);
 594 out_elf:
 595     QEMU_Elf_exit(&qemu_elf);
 596
 597     return err;
 598 }