Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging
[qemu/ar7.git] / contrib / elf2dmp / main.c
blob9a2dbc290214bc56fa02b077f3afdaed8216fc54
1 /*
2 * Copyright (c) 2018 Virtuozzo International GmbH
4 * This work is licensed under the terms of the GNU GPL, version 2 or later.
6 */
8 #include "qemu/osdep.h"
10 #include "err.h"
11 #include "addrspace.h"
12 #include "pe.h"
13 #include "pdb.h"
14 #include "kdbg.h"
15 #include "download.h"
16 #include "qemu/win_dump_defs.h"
18 #define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/"
19 #define PDB_NAME "ntkrnlmp.pdb"
21 #define INITIAL_MXCSR 0x1f80
23 typedef struct idt_desc {
24 uint16_t offset1; /* offset bits 0..15 */
25 uint16_t selector;
26 uint8_t ist;
27 uint8_t type_attr;
28 uint16_t offset2; /* offset bits 16..31 */
29 uint32_t offset3; /* offset bits 32..63 */
30 uint32_t rsrvd;
31 } __attribute__ ((packed)) idt_desc_t;
33 static uint64_t idt_desc_addr(idt_desc_t desc)
35 return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) |
36 ((uint64_t)desc.offset3 << 32);
39 static const uint64_t SharedUserData = 0xfffff78000000000;
41 #define KUSD_OFFSET_SUITE_MASK 0x2d0
42 #define KUSD_OFFSET_PRODUCT_TYPE 0x264
44 #define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
45 s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
46 eprintf("Failed to resolve "#s"\n"), s)
48 static uint64_t rol(uint64_t x, uint64_t y)
50 return (x << y) | (x >> (64 - y));
54 * Decoding algorithm can be found in Volatility project
56 static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
57 uint64_t kwn, uint64_t kwa, uint64_t kdbe)
59 size_t i;
60 assert(size % sizeof(uint64_t) == 0);
61 for (i = 0; i < size / sizeof(uint64_t); i++) {
62 uint64_t block;
64 block = src[i];
65 block = rol(block ^ kwn, (uint8_t)kwn);
66 block = __builtin_bswap64(block ^ kdbe) ^ kwa;
67 dst[i] = block;
71 static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
72 struct va_space *vs, uint64_t KdDebuggerDataBlock)
74 const char OwnerTag[4] = "KDBG";
75 KDDEBUGGER_DATA64 *kdbg = NULL;
76 DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
77 bool decode = false;
78 uint64_t kwn, kwa, KdpDataBlockEncoded;
80 if (va_space_rw(vs,
81 KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
82 &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
83 eprintf("Failed to extract KDBG header\n");
84 return NULL;
87 if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
88 uint64_t KiWaitNever, KiWaitAlways;
90 decode = true;
92 if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) ||
93 !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) ||
94 !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
95 return NULL;
98 if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
99 va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
100 return NULL;
103 printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
104 printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);
107 * If KDBG header can be decoded, KDBG size is available
108 * and entire KDBG can be decoded.
110 printf("Decoding KDBG header...\n");
111 kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr,
112 sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);
114 printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
115 if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
116 eprintf("Failed to decode KDBG header\n");
117 return NULL;
121 kdbg = malloc(kdbg_hdr.Size);
122 if (!kdbg) {
123 return NULL;
126 if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
127 eprintf("Failed to extract entire KDBG\n");
128 return NULL;
131 if (!decode) {
132 return kdbg;
135 printf("Decoding KdDebuggerDataBlock...\n");
136 kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size,
137 kwn, kwa, KdpDataBlockEncoded);
139 va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);
141 return kdbg;
144 static void win_context_init_from_qemu_cpu_state(WinContext *ctx,
145 QEMUCPUState *s)
147 WinContext win_ctx = (WinContext){
148 .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
149 .MxCsr = INITIAL_MXCSR,
151 .SegCs = s->cs.selector,
152 .SegSs = s->ss.selector,
153 .SegDs = s->ds.selector,
154 .SegEs = s->es.selector,
155 .SegFs = s->fs.selector,
156 .SegGs = s->gs.selector,
157 .EFlags = (uint32_t)s->rflags,
159 .Rax = s->rax,
160 .Rbx = s->rbx,
161 .Rcx = s->rcx,
162 .Rdx = s->rdx,
163 .Rsp = s->rsp,
164 .Rbp = s->rbp,
165 .Rsi = s->rsi,
166 .Rdi = s->rdi,
167 .R8 = s->r8,
168 .R9 = s->r9,
169 .R10 = s->r10,
170 .R11 = s->r11,
171 .R12 = s->r12,
172 .R13 = s->r13,
173 .R14 = s->r14,
174 .R15 = s->r15,
176 .Rip = s->rip,
177 .FltSave = {
178 .MxCsr = INITIAL_MXCSR,
182 *ctx = win_ctx;
186 * Finds paging-structure hierarchy base,
187 * if previously set doesn't give access to kernel structures
189 static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
192 * Firstly, test previously set DTB.
194 if (va_space_resolve(vs, SharedUserData)) {
195 return 0;
199 * Secondly, find CPU which run system task.
201 size_t i;
202 for (i = 0; i < qe->state_nr; i++) {
203 QEMUCPUState *s = qe->state[i];
205 if (is_system(s)) {
206 va_space_set_dtb(vs, s->cr[3]);
207 printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
208 " as system task CR3\n", vs->dtb, i);
209 return !(va_space_resolve(vs, SharedUserData));
214 * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
215 * CR3 as [Prcb+0x7000]
217 if (qe->has_kernel_gs_base) {
218 QEMUCPUState *s = qe->state[0];
219 uint64_t Prcb = s->kernel_gs_base;
220 uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
222 if (!cr3) {
223 return 1;
226 va_space_set_dtb(vs, *cr3);
227 printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
228 " as interrupt handling CR3\n", vs->dtb);
229 return !(va_space_resolve(vs, SharedUserData));
232 return 1;
235 static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
236 struct va_space *vs, uint64_t KdDebuggerDataBlock,
237 KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
239 uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
240 KUSD_OFFSET_SUITE_MASK);
241 int32_t *product_type = va_space_resolve(vs, SharedUserData +
242 KUSD_OFFSET_PRODUCT_TYPE);
243 DBGKD_GET_VERSION64 kvb;
244 WinDumpHeader64 h;
245 size_t i;
247 QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= PAGE_SIZE);
248 QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= PAGE_SIZE);
250 if (!suite_mask || !product_type) {
251 return 1;
254 if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
255 eprintf("Failed to extract KdVersionBlock\n");
256 return 1;
259 h = (WinDumpHeader64) {
260 .Signature = "PAGE",
261 .ValidDump = "DU64",
262 .MajorVersion = kvb.MajorVersion,
263 .MinorVersion = kvb.MinorVersion,
264 .DirectoryTableBase = vs->dtb,
265 .PfnDatabase = kdbg->MmPfnDatabase,
266 .PsLoadedModuleList = kdbg->PsLoadedModuleList,
267 .PsActiveProcessHead = kdbg->PsActiveProcessHead,
268 .MachineImageType = kvb.MachineType,
269 .NumberProcessors = nr_cpus,
270 .BugcheckCode = LIVE_SYSTEM_DUMP,
271 .KdDebuggerDataBlock = KdDebuggerDataBlock,
272 .DumpType = 1,
273 .Comment = "Hello from elf2dmp!",
274 .SuiteMask = *suite_mask,
275 .ProductType = *product_type,
276 .SecondaryDataState = kvb.KdSecondaryVersion,
277 .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
278 .NumberOfRuns = ps->block_nr,
280 .RequiredDumpSpace = sizeof(h),
283 for (i = 0; i < ps->block_nr; i++) {
284 h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / PAGE_SIZE;
285 h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
286 .BasePage = ps->block[i].paddr / PAGE_SIZE,
287 .PageCount = ps->block[i].size / PAGE_SIZE,
291 h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << PAGE_BITS;
293 *hdr = h;
295 return 0;
298 static int fill_context(KDDEBUGGER_DATA64 *kdbg,
299 struct va_space *vs, QEMU_Elf *qe)
301 int i;
302 for (i = 0; i < qe->state_nr; i++) {
303 uint64_t Prcb;
304 uint64_t Context;
305 WinContext ctx;
306 QEMUCPUState *s = qe->state[i];
308 if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
309 &Prcb, sizeof(Prcb), 0)) {
310 eprintf("Failed to read CPU #%d PRCB location\n", i);
311 return 1;
314 if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
315 &Context, sizeof(Context), 0)) {
316 eprintf("Failed to read CPU #%d ContextFrame location\n", i);
317 return 1;
320 printf("Filling context for CPU #%d...\n", i);
321 win_context_init_from_qemu_cpu_state(&ctx, s);
323 if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
324 eprintf("Failed to fill CPU #%d context\n", i);
325 return 1;
329 return 0;
332 static int write_dump(struct pa_space *ps,
333 WinDumpHeader64 *hdr, const char *name)
335 FILE *dmp_file = fopen(name, "wb");
336 size_t i;
338 if (!dmp_file) {
339 eprintf("Failed to open output file \'%s\'\n", name);
340 return 1;
343 printf("Writing header to file...\n");
345 if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
346 eprintf("Failed to write dump header\n");
347 fclose(dmp_file);
348 return 1;
351 for (i = 0; i < ps->block_nr; i++) {
352 struct pa_block *b = &ps->block[i];
354 printf("Writing block #%zu/%zu to file...\n", i, ps->block_nr);
355 if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
356 eprintf("Failed to write dump header\n");
357 fclose(dmp_file);
358 return 1;
362 return fclose(dmp_file);
365 static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
366 char *hash, struct va_space *vs)
368 const char e_magic[2] = "MZ";
369 const char Signature[4] = "PE\0\0";
370 const char sign_rsds[4] = "RSDS";
371 IMAGE_DOS_HEADER *dos_hdr = start_addr;
372 IMAGE_NT_HEADERS64 nt_hdrs;
373 IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
374 IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
375 IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
376 IMAGE_DEBUG_DIRECTORY debug_dir;
377 OMFSignatureRSDS rsds;
378 char *pdb_name;
379 size_t pdb_name_sz;
380 size_t i;
382 QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= PAGE_SIZE);
384 if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
385 return 1;
388 if (va_space_rw(vs, base + dos_hdr->e_lfanew,
389 &nt_hdrs, sizeof(nt_hdrs), 0)) {
390 return 1;
393 if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
394 file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
395 return 1;
398 printf("Debug Directory RVA = 0x%08"PRIx32"\n",
399 (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
401 if (va_space_rw(vs,
402 base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
403 &debug_dir, sizeof(debug_dir), 0)) {
404 return 1;
407 if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
408 return 1;
411 if (va_space_rw(vs,
412 base + debug_dir.AddressOfRawData,
413 &rsds, sizeof(rsds), 0)) {
414 return 1;
417 printf("CodeView signature is \'%.4s\'\n", rsds.Signature);
419 if (memcmp(&rsds.Signature, sign_rsds, sizeof(sign_rsds))) {
420 return 1;
423 pdb_name_sz = debug_dir.SizeOfData - sizeof(rsds);
424 pdb_name = malloc(pdb_name_sz);
425 if (!pdb_name) {
426 return 1;
429 if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
430 offsetof(OMFSignatureRSDS, name), pdb_name, pdb_name_sz, 0)) {
431 free(pdb_name);
432 return 1;
435 printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
437 if (strcmp(pdb_name, PDB_NAME)) {
438 eprintf("Unexpected PDB name, it seems the kernel isn't found\n");
439 free(pdb_name);
440 return 1;
443 free(pdb_name);
445 sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds.guid.a, rsds.guid.b,
446 rsds.guid.c, rsds.guid.d[0], rsds.guid.d[1]);
447 hash += 20;
448 for (i = 0; i < 6; i++, hash += 2) {
449 sprintf(hash, "%.02x", rsds.guid.e[i]);
452 sprintf(hash, "%.01x", rsds.age);
454 return 0;
457 int main(int argc, char *argv[])
459 int err = 0;
460 QEMU_Elf qemu_elf;
461 struct pa_space ps;
462 struct va_space vs;
463 QEMUCPUState *state;
464 idt_desc_t first_idt_desc;
465 uint64_t KernBase;
466 void *nt_start_addr = NULL;
467 WinDumpHeader64 header;
468 char pdb_hash[34];
469 char pdb_url[] = SYM_URL_BASE PDB_NAME
470 "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
471 struct pdb_reader pdb;
472 uint64_t KdDebuggerDataBlock;
473 KDDEBUGGER_DATA64 *kdbg;
474 uint64_t KdVersionBlock;
476 if (argc != 3) {
477 eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
478 return 1;
481 if (QEMU_Elf_init(&qemu_elf, argv[1])) {
482 eprintf("Failed to initialize QEMU ELF dump\n");
483 return 1;
486 if (pa_space_create(&ps, &qemu_elf)) {
487 eprintf("Failed to initialize physical address space\n");
488 err = 1;
489 goto out_elf;
492 state = qemu_elf.state[0];
493 printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);
495 va_space_create(&vs, &ps, state->cr[3]);
496 if (fix_dtb(&vs, &qemu_elf)) {
497 eprintf("Failed to find paging base\n");
498 err = 1;
499 goto out_elf;
502 printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);
504 if (va_space_rw(&vs, state->idt.base,
505 &first_idt_desc, sizeof(first_idt_desc), 0)) {
506 eprintf("Failed to get CPU #0 IDT[0]\n");
507 err = 1;
508 goto out_ps;
510 printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));
512 KernBase = idt_desc_addr(first_idt_desc) & ~(PAGE_SIZE - 1);
513 printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);
515 for (; KernBase >= 0xfffff78000000000; KernBase -= PAGE_SIZE) {
516 nt_start_addr = va_space_resolve(&vs, KernBase);
517 if (!nt_start_addr) {
518 continue;
521 if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
522 break;
526 if (!nt_start_addr) {
527 eprintf("Failed to find NT kernel image\n");
528 err = 1;
529 goto out_ps;
532 printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
533 (char *)nt_start_addr);
535 if (pe_get_pdb_symstore_hash(KernBase, nt_start_addr, pdb_hash, &vs)) {
536 eprintf("Failed to get PDB symbol store hash\n");
537 err = 1;
538 goto out_ps;
541 sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
542 printf("PDB URL is %s\n", pdb_url);
544 if (download_url(PDB_NAME, pdb_url)) {
545 eprintf("Failed to download PDB file\n");
546 err = 1;
547 goto out_ps;
550 if (pdb_init_from_file(PDB_NAME, &pdb)) {
551 eprintf("Failed to initialize PDB reader\n");
552 err = 1;
553 goto out_pdb_file;
556 if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
557 !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
558 err = 1;
559 goto out_pdb;
562 kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
563 if (!kdbg) {
564 err = 1;
565 goto out_pdb;
568 if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
569 KdVersionBlock, qemu_elf.state_nr)) {
570 err = 1;
571 goto out_pdb;
574 if (fill_context(kdbg, &vs, &qemu_elf)) {
575 err = 1;
576 goto out_pdb;
579 if (write_dump(&ps, &header, argv[2])) {
580 eprintf("Failed to save dump\n");
581 err = 1;
582 goto out_kdbg;
585 out_kdbg:
586 free(kdbg);
587 out_pdb:
588 pdb_exit(&pdb);
589 out_pdb_file:
590 unlink(PDB_NAME);
591 out_ps:
592 pa_space_destroy(&ps);
593 out_elf:
594 QEMU_Elf_exit(&qemu_elf);
596 return err;