contrib/elf2dmp/main.c

   1 /*
   2  * Copyright (c) 2018 Virtuozzo International GmbH
   3  *
   4  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   5  *
   6  */
   7
   8 #include "qemu/osdep.h"
   9
  10 #include "err.h"
  11 #include "addrspace.h"
  12 #include "pe.h"
  13 #include "pdb.h"
  14 #include "kdbg.h"
  15 #include "download.h"
  16 #include "qemu/win_dump_defs.h"
  17
  18 #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
  19 #define PDB_NAME    "ntkrnlmp.pdb"
  20 #define PE_NAME     "ntoskrnl.exe"
  21
  22 #define INITIAL_MXCSR   0x1f80
  23 #define MAX_NUMBER_OF_RUNS  42
  24
  25 typedef struct idt_desc {
  26     uint16_t offset1;   /* offset bits 0..15 */
  27     uint16_t selector;
  28     uint8_t ist;
  29     uint8_t type_attr;
  30     uint16_t offset2;   /* offset bits 16..31 */
  31     uint32_t offset3;   /* offset bits 32..63 */
  32     uint32_t rsrvd;
  33 } __attribute__ ((packed)) idt_desc_t;
  34
  35 static uint64_t idt_desc_addr(idt_desc_t desc)
  36 {
  37     return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) |
  38           ((uint64_t)desc.offset3 << 32);
  39 }
  40
  41 static const uint64_t SharedUserData = 0xfffff78000000000;
  42
  43 #define KUSD_OFFSET_SUITE_MASK 0x2d0
  44 #define KUSD_OFFSET_PRODUCT_TYPE 0x264
  45
  46 #define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
  47     s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
  48     eprintf("Failed to resolve "#s"\n"), s)
  49
  50 static uint64_t rol(uint64_t x, uint64_t y)
  51 {
  52     return (x << y) | (x >> (64 - y));
  53 }
  54
  55 /*
  56  * Decoding algorithm can be found in Volatility project
  57  */
  58 static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
  59         uint64_t kwn, uint64_t kwa, uint64_t kdbe)
  60 {
  61     size_t i;
  62     assert(size % sizeof(uint64_t) == 0);
  63     for (i = 0; i < size / sizeof(uint64_t); i++) {
  64         uint64_t block;
  65
  66         block = src[i];
  67         block = rol(block ^ kwn, (uint8_t)kwn);
  68         block = __builtin_bswap64(block ^ kdbe) ^ kwa;
  69         dst[i] = block;
  70     }
  71 }
  72
  73 static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
  74         struct va_space *vs, uint64_t KdDebuggerDataBlock)
  75 {
  76     const char OwnerTag[4] = "KDBG";
  77     KDDEBUGGER_DATA64 *kdbg = NULL;
  78     DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
  79     bool decode = false;
  80     uint64_t kwn, kwa, KdpDataBlockEncoded;
  81
  82     if (va_space_rw(vs,
  83                 KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
  84                 &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
  85         eprintf("Failed to extract KDBG header\n");
  86         return NULL;
  87     }
  88
  89     if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
  90         uint64_t KiWaitNever, KiWaitAlways;
  91
  92         decode = true;
  93
  94         if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) ||
  95                 !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) ||
  96                 !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
  97             return NULL;
  98         }
  99
 100         if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
 101                 va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
 102             return NULL;
 103         }
 104
 105         printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
 106         printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);
 107
 108         /*
 109          * If KDBG header can be decoded, KDBG size is available
 110          * and entire KDBG can be decoded.
 111          */
 112         printf("Decoding KDBG header...\n");
 113         kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr,
 114                 sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);
 115
 116         printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
 117         if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
 118             eprintf("Failed to decode KDBG header\n");
 119             return NULL;
 120         }
 121     }
 122
 123     kdbg = malloc(kdbg_hdr.Size);
 124     if (!kdbg) {
 125         return NULL;
 126     }
 127
 128     if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
 129         eprintf("Failed to extract entire KDBG\n");
 130         free(kdbg);
 131         return NULL;
 132     }
 133
 134     if (!decode) {
 135         return kdbg;
 136     }
 137
 138     printf("Decoding KdDebuggerDataBlock...\n");
 139     kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size,
 140                 kwn, kwa, KdpDataBlockEncoded);
 141
 142     va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);
 143
 144     return kdbg;
 145 }
 146
 147 static void win_context_init_from_qemu_cpu_state(WinContext64 *ctx,
 148         QEMUCPUState *s)
 149 {
 150     WinContext64 win_ctx = (WinContext64){
 151         .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
 152         .MxCsr = INITIAL_MXCSR,
 153
 154         .SegCs = s->cs.selector,
 155         .SegSs = s->ss.selector,
 156         .SegDs = s->ds.selector,
 157         .SegEs = s->es.selector,
 158         .SegFs = s->fs.selector,
 159         .SegGs = s->gs.selector,
 160         .EFlags = (uint32_t)s->rflags,
 161
 162         .Rax = s->rax,
 163         .Rbx = s->rbx,
 164         .Rcx = s->rcx,
 165         .Rdx = s->rdx,
 166         .Rsp = s->rsp,
 167         .Rbp = s->rbp,
 168         .Rsi = s->rsi,
 169         .Rdi = s->rdi,
 170         .R8  = s->r8,
 171         .R9  = s->r9,
 172         .R10 = s->r10,
 173         .R11 = s->r11,
 174         .R12 = s->r12,
 175         .R13 = s->r13,
 176         .R14 = s->r14,
 177         .R15 = s->r15,
 178
 179         .Rip = s->rip,
 180         .FltSave = {
 181             .MxCsr = INITIAL_MXCSR,
 182         },
 183     };
 184
 185     *ctx = win_ctx;
 186 }
 187
 188 /*
 189  * Finds paging-structure hierarchy base,
 190  * if previously set doesn't give access to kernel structures
 191  */
 192 static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
 193 {
 194     /*
 195      * Firstly, test previously set DTB.
 196      */
 197     if (va_space_resolve(vs, SharedUserData)) {
 198         return 0;
 199     }
 200
 201     /*
 202      * Secondly, find CPU which run system task.
 203      */
 204     size_t i;
 205     for (i = 0; i < qe->state_nr; i++) {
 206         QEMUCPUState *s = qe->state[i];
 207
 208         if (is_system(s)) {
 209             va_space_set_dtb(vs, s->cr[3]);
 210             printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
 211                     " as system task CR3\n", vs->dtb, i);
 212             return !(va_space_resolve(vs, SharedUserData));
 213         }
 214     }
 215
 216     /*
 217      * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
 218      * CR3 as [Prcb+0x7000]
 219      */
 220     if (qe->has_kernel_gs_base) {
 221         QEMUCPUState *s = qe->state[0];
 222         uint64_t Prcb = s->kernel_gs_base;
 223         uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
 224
 225         if (!cr3) {
 226             return 1;
 227         }
 228
 229         va_space_set_dtb(vs, *cr3);
 230         printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
 231                 " as interrupt handling CR3\n", vs->dtb);
 232         return !(va_space_resolve(vs, SharedUserData));
 233     }
 234
 235     return 1;
 236 }
 237
 238 static void try_merge_runs(struct pa_space *ps,
 239         WinDumpPhyMemDesc64 *PhysicalMemoryBlock)
 240 {
 241     unsigned int merge_cnt = 0, run_idx = 0;
 242
 243     PhysicalMemoryBlock->NumberOfRuns = 0;
 244
 245     for (size_t idx = 0; idx < ps->block_nr; idx++) {
 246         struct pa_block *blk = ps->block + idx;
 247         struct pa_block *next = blk + 1;
 248
 249         PhysicalMemoryBlock->NumberOfPages += blk->size / ELF2DMP_PAGE_SIZE;
 250
 251         if (idx + 1 != ps->block_nr && blk->paddr + blk->size == next->paddr) {
 252             printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
 253                     " merged\n", idx, blk->paddr, blk->size, merge_cnt);
 254             merge_cnt++;
 255         } else {
 256             struct pa_block *first_merged = blk - merge_cnt;
 257
 258             printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
 259                     " merged to 0x%"PRIx64"+:0x%"PRIx64" (run #%u)\n",
 260                     idx, blk->paddr, blk->size, merge_cnt, first_merged->paddr,
 261                     blk->paddr + blk->size - first_merged->paddr, run_idx);
 262             PhysicalMemoryBlock->Run[run_idx] = (WinDumpPhyMemRun64) {
 263                 .BasePage = first_merged->paddr / ELF2DMP_PAGE_SIZE,
 264                 .PageCount = (blk->paddr + blk->size - first_merged->paddr) /
 265                         ELF2DMP_PAGE_SIZE,
 266             };
 267             PhysicalMemoryBlock->NumberOfRuns++;
 268             run_idx++;
 269             merge_cnt = 0;
 270         }
 271     }
 272 }
 273
 274 static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
 275         struct va_space *vs, uint64_t KdDebuggerDataBlock,
 276         KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
 277 {
 278     uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
 279             KUSD_OFFSET_SUITE_MASK);
 280     int32_t *product_type = va_space_resolve(vs, SharedUserData +
 281             KUSD_OFFSET_PRODUCT_TYPE);
 282     DBGKD_GET_VERSION64 kvb;
 283     WinDumpHeader64 h;
 284
 285     QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE);
 286     QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE);
 287
 288     if (!suite_mask || !product_type) {
 289         return 1;
 290     }
 291
 292     if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
 293         eprintf("Failed to extract KdVersionBlock\n");
 294         return 1;
 295     }
 296
 297     h = (WinDumpHeader64) {
 298         .Signature = "PAGE",
 299         .ValidDump = "DU64",
 300         .MajorVersion = kvb.MajorVersion,
 301         .MinorVersion = kvb.MinorVersion,
 302         .DirectoryTableBase = vs->dtb,
 303         .PfnDatabase = kdbg->MmPfnDatabase,
 304         .PsLoadedModuleList = kdbg->PsLoadedModuleList,
 305         .PsActiveProcessHead = kdbg->PsActiveProcessHead,
 306         .MachineImageType = kvb.MachineType,
 307         .NumberProcessors = nr_cpus,
 308         .BugcheckCode = LIVE_SYSTEM_DUMP,
 309         .KdDebuggerDataBlock = KdDebuggerDataBlock,
 310         .DumpType = 1,
 311         .Comment = "Hello from elf2dmp!",
 312         .SuiteMask = *suite_mask,
 313         .ProductType = *product_type,
 314         .SecondaryDataState = kvb.KdSecondaryVersion,
 315         .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
 316             .NumberOfRuns = ps->block_nr,
 317         },
 318         .RequiredDumpSpace = sizeof(h),
 319     };
 320
 321     if (h.PhysicalMemoryBlock.NumberOfRuns <= MAX_NUMBER_OF_RUNS) {
 322         for (size_t idx = 0; idx < ps->block_nr; idx++) {
 323             h.PhysicalMemoryBlock.NumberOfPages +=
 324                     ps->block[idx].size / ELF2DMP_PAGE_SIZE;
 325             h.PhysicalMemoryBlock.Run[idx] = (WinDumpPhyMemRun64) {
 326                 .BasePage = ps->block[idx].paddr / ELF2DMP_PAGE_SIZE,
 327                 .PageCount = ps->block[idx].size / ELF2DMP_PAGE_SIZE,
 328             };
 329         }
 330     } else {
 331         try_merge_runs(ps, &h.PhysicalMemoryBlock);
 332     }
 333
 334     h.RequiredDumpSpace +=
 335             h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
 336
 337     *hdr = h;
 338
 339     return 0;
 340 }
 341
 342 static int fill_context(KDDEBUGGER_DATA64 *kdbg,
 343         struct va_space *vs, QEMU_Elf *qe)
 344 {
 345     int i;
 346
 347     for (i = 0; i < qe->state_nr; i++) {
 348         uint64_t Prcb;
 349         uint64_t Context;
 350         WinContext64 ctx;
 351         QEMUCPUState *s = qe->state[i];
 352
 353         if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
 354                     &Prcb, sizeof(Prcb), 0)) {
 355             eprintf("Failed to read CPU #%d PRCB location\n", i);
 356             return 1;
 357         }
 358
 359         if (!Prcb) {
 360             eprintf("Context for CPU #%d is missing\n", i);
 361             continue;
 362         }
 363
 364         if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
 365                     &Context, sizeof(Context), 0)) {
 366             eprintf("Failed to read CPU #%d ContextFrame location\n", i);
 367             return 1;
 368         }
 369
 370         printf("Filling context for CPU #%d...\n", i);
 371         win_context_init_from_qemu_cpu_state(&ctx, s);
 372
 373         if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
 374             eprintf("Failed to fill CPU #%d context\n", i);
 375             return 1;
 376         }
 377     }
 378
 379     return 0;
 380 }
 381
 382 static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
 383         void *entry, size_t size, struct va_space *vs)
 384 {
 385     const char e_magic[2] = "MZ";
 386     const char Signature[4] = "PE\0\0";
 387     IMAGE_DOS_HEADER *dos_hdr = start_addr;
 388     IMAGE_NT_HEADERS64 nt_hdrs;
 389     IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
 390     IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
 391     IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
 392
 393     QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
 394
 395     if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
 396         return 1;
 397     }
 398
 399     if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 400                 &nt_hdrs, sizeof(nt_hdrs), 0)) {
 401         return 1;
 402     }
 403
 404     if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 405             file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 406         return 1;
 407     }
 408
 409     if (va_space_rw(vs,
 410                 base + data_dir[idx].VirtualAddress,
 411                 entry, size, 0)) {
 412         return 1;
 413     }
 414
 415     printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
 416             (uint32_t)data_dir[idx].VirtualAddress);
 417
 418     return 0;
 419 }
 420
 421 static int write_dump(struct pa_space *ps,
 422         WinDumpHeader64 *hdr, const char *name)
 423 {
 424     FILE *dmp_file = fopen(name, "wb");
 425     size_t i;
 426
 427     if (!dmp_file) {
 428         eprintf("Failed to open output file \'%s\'\n", name);
 429         return 1;
 430     }
 431
 432     printf("Writing header to file...\n");
 433
 434     if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
 435         eprintf("Failed to write dump header\n");
 436         fclose(dmp_file);
 437         return 1;
 438     }
 439
 440     for (i = 0; i < ps->block_nr; i++) {
 441         struct pa_block *b = &ps->block[i];
 442
 443         printf("Writing block #%zu/%zu of %"PRIu64" bytes to file...\n", i,
 444                 ps->block_nr, b->size);
 445         if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
 446             eprintf("Failed to write block\n");
 447             fclose(dmp_file);
 448             return 1;
 449         }
 450     }
 451
 452     return fclose(dmp_file);
 453 }
 454
 455 static bool pe_check_pdb_name(uint64_t base, void *start_addr,
 456         struct va_space *vs, OMFSignatureRSDS *rsds)
 457 {
 458     const char sign_rsds[4] = "RSDS";
 459     IMAGE_DEBUG_DIRECTORY debug_dir;
 460     char pdb_name[sizeof(PDB_NAME)];
 461
 462     if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
 463                 &debug_dir, sizeof(debug_dir), vs)) {
 464         eprintf("Failed to get Debug Directory\n");
 465         return false;
 466     }
 467
 468     if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
 469         eprintf("Debug Directory type is not CodeView\n");
 470         return false;
 471     }
 472
 473     if (va_space_rw(vs,
 474                 base + debug_dir.AddressOfRawData,
 475                 rsds, sizeof(*rsds), 0)) {
 476         eprintf("Failed to resolve OMFSignatureRSDS\n");
 477         return false;
 478     }
 479
 480     if (memcmp(&rsds->Signature, sign_rsds, sizeof(sign_rsds))) {
 481         eprintf("CodeView signature is \'%.4s\', \'%.4s\' expected\n",
 482                 rsds->Signature, sign_rsds);
 483         return false;
 484     }
 485
 486     if (debug_dir.SizeOfData - sizeof(*rsds) != sizeof(PDB_NAME)) {
 487         eprintf("PDB name size doesn't match\n");
 488         return false;
 489     }
 490
 491     if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
 492                 offsetof(OMFSignatureRSDS, name), pdb_name, sizeof(PDB_NAME),
 493                 0)) {
 494         eprintf("Failed to resolve PDB name\n");
 495         return false;
 496     }
 497
 498     printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
 499
 500     return !strcmp(pdb_name, PDB_NAME);
 501 }
 502
 503 static void pe_get_pdb_symstore_hash(OMFSignatureRSDS *rsds, char *hash)
 504 {
 505     sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds->guid.a, rsds->guid.b,
 506             rsds->guid.c, rsds->guid.d[0], rsds->guid.d[1]);
 507     hash += 20;
 508     for (unsigned int i = 0; i < 6; i++, hash += 2) {
 509         sprintf(hash, "%.02x", rsds->guid.e[i]);
 510     }
 511
 512     sprintf(hash, "%.01x", rsds->age);
 513 }
 514
 515 int main(int argc, char *argv[])
 516 {
 517     int err = 0;
 518     QEMU_Elf qemu_elf;
 519     struct pa_space ps;
 520     struct va_space vs;
 521     QEMUCPUState *state;
 522     idt_desc_t first_idt_desc;
 523     uint64_t KernBase;
 524     void *nt_start_addr = NULL;
 525     WinDumpHeader64 header;
 526     char pdb_hash[34];
 527     char pdb_url[] = SYM_URL_BASE PDB_NAME
 528         "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
 529     struct pdb_reader pdb;
 530     uint64_t KdDebuggerDataBlock;
 531     KDDEBUGGER_DATA64 *kdbg;
 532     uint64_t KdVersionBlock;
 533     bool kernel_found = false;
 534     OMFSignatureRSDS rsds;
 535
 536     if (argc != 3) {
 537         eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
 538         return 1;
 539     }
 540
 541     if (QEMU_Elf_init(&qemu_elf, argv[1])) {
 542         eprintf("Failed to initialize QEMU ELF dump\n");
 543         return 1;
 544     }
 545
 546     if (pa_space_create(&ps, &qemu_elf)) {
 547         eprintf("Failed to initialize physical address space\n");
 548         err = 1;
 549         goto out_elf;
 550     }
 551
 552     state = qemu_elf.state[0];
 553     printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);
 554
 555     va_space_create(&vs, &ps, state->cr[3]);
 556     if (fix_dtb(&vs, &qemu_elf)) {
 557         eprintf("Failed to find paging base\n");
 558         err = 1;
 559         goto out_elf;
 560     }
 561
 562     printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);
 563
 564     if (va_space_rw(&vs, state->idt.base,
 565                 &first_idt_desc, sizeof(first_idt_desc), 0)) {
 566         eprintf("Failed to get CPU #0 IDT[0]\n");
 567         err = 1;
 568         goto out_ps;
 569     }
 570     printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));
 571
 572     KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1);
 573     printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);
 574
 575     for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) {
 576         nt_start_addr = va_space_resolve(&vs, KernBase);
 577         if (!nt_start_addr) {
 578             continue;
 579         }
 580
 581         if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
 582             printf("Checking candidate KernBase = 0x%016"PRIx64"\n", KernBase);
 583             if (pe_check_pdb_name(KernBase, nt_start_addr, &vs, &rsds)) {
 584                 kernel_found = true;
 585                 break;
 586             }
 587         }
 588     }
 589
 590     if (!kernel_found) {
 591         eprintf("Failed to find NT kernel image\n");
 592         err = 1;
 593         goto out_ps;
 594     }
 595
 596     printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
 597             (char *)nt_start_addr);
 598
 599     pe_get_pdb_symstore_hash(&rsds, pdb_hash);
 600
 601     sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
 602     printf("PDB URL is %s\n", pdb_url);
 603
 604     if (download_url(PDB_NAME, pdb_url)) {
 605         eprintf("Failed to download PDB file\n");
 606         err = 1;
 607         goto out_ps;
 608     }
 609
 610     if (pdb_init_from_file(PDB_NAME, &pdb)) {
 611         eprintf("Failed to initialize PDB reader\n");
 612         err = 1;
 613         goto out_pdb_file;
 614     }
 615
 616     if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
 617             !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
 618         err = 1;
 619         goto out_pdb;
 620     }
 621
 622     kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
 623     if (!kdbg) {
 624         err = 1;
 625         goto out_pdb;
 626     }
 627
 628     if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
 629             KdVersionBlock, qemu_elf.state_nr)) {
 630         err = 1;
 631         goto out_kdbg;
 632     }
 633
 634     if (fill_context(kdbg, &vs, &qemu_elf)) {
 635         err = 1;
 636         goto out_kdbg;
 637     }
 638
 639     if (write_dump(&ps, &header, argv[2])) {
 640         eprintf("Failed to save dump\n");
 641         err = 1;
 642         goto out_kdbg;
 643     }
 644
 645 out_kdbg:
 646     free(kdbg);
 647 out_pdb:
 648     pdb_exit(&pdb);
 649 out_pdb_file:
 650     unlink(PDB_NAME);
 651 out_ps:
 652     pa_space_destroy(&ps);
 653 out_elf:
 654     QEMU_Elf_exit(&qemu_elf);
 655
 656     return err;
 657 }