contrib/elf2dmp/main.c

   1 /*
   2  * Copyright (c) 2018 Virtuozzo International GmbH
   3  *
   4  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   5  *
   6  */
   7
   8 #include "qemu/osdep.h"
   9
  10 #include "err.h"
  11 #include "addrspace.h"
  12 #include "pe.h"
  13 #include "pdb.h"
  14 #include "kdbg.h"
  15 #include "download.h"
  16 #include "qemu/win_dump_defs.h"
  17
  18 #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
  19 #define PDB_NAME    "ntkrnlmp.pdb"
  20 #define PE_NAME     "ntoskrnl.exe"
  21
  22 #define INITIAL_MXCSR   0x1f80
  23 #define MAX_NUMBER_OF_RUNS  42
  24
  25 typedef struct idt_desc {
  26     uint16_t offset1;   /* offset bits 0..15 */
  27     uint16_t selector;
  28     uint8_t ist;
  29     uint8_t type_attr;
  30     uint16_t offset2;   /* offset bits 16..31 */
  31     uint32_t offset3;   /* offset bits 32..63 */
  32     uint32_t rsrvd;
  33 } __attribute__ ((packed)) idt_desc_t;
  34
  35 static uint64_t idt_desc_addr(idt_desc_t desc)
  36 {
  37     return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) |
  38           ((uint64_t)desc.offset3 << 32);
  39 }
  40
  41 static const uint64_t SharedUserData = 0xfffff78000000000;
  42
  43 #define KUSD_OFFSET_SUITE_MASK 0x2d0
  44 #define KUSD_OFFSET_PRODUCT_TYPE 0x264
  45
  46 #define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
  47     s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
  48     eprintf("Failed to resolve "#s"\n"), s)
  49
  50 static uint64_t rol(uint64_t x, uint64_t y)
  51 {
  52     return (x << y) | (x >> (64 - y));
  53 }
  54
  55 /*
  56  * Decoding algorithm can be found in Volatility project
  57  */
  58 static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
  59         uint64_t kwn, uint64_t kwa, uint64_t kdbe)
  60 {
  61     size_t i;
  62     assert(size % sizeof(uint64_t) == 0);
  63     for (i = 0; i < size / sizeof(uint64_t); i++) {
  64         uint64_t block;
  65
  66         block = src[i];
  67         block = rol(block ^ kwn, (uint8_t)kwn);
  68         block = __builtin_bswap64(block ^ kdbe) ^ kwa;
  69         dst[i] = block;
  70     }
  71 }
  72
  73 static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
  74         struct va_space *vs, uint64_t KdDebuggerDataBlock)
  75 {
  76     const char OwnerTag[4] = "KDBG";
  77     KDDEBUGGER_DATA64 *kdbg = NULL;
  78     DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
  79     bool decode = false;
  80     uint64_t kwn, kwa, KdpDataBlockEncoded;
  81
  82     if (va_space_rw(vs,
  83                 KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
  84                 &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
  85         eprintf("Failed to extract KDBG header\n");
  86         return NULL;
  87     }
  88
  89     if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
  90         uint64_t KiWaitNever, KiWaitAlways;
  91
  92         decode = true;
  93
  94         if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) ||
  95                 !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) ||
  96                 !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
  97             return NULL;
  98         }
  99
 100         if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
 101                 va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
 102             return NULL;
 103         }
 104
 105         printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
 106         printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);
 107
 108         /*
 109          * If KDBG header can be decoded, KDBG size is available
 110          * and entire KDBG can be decoded.
 111          */
 112         printf("Decoding KDBG header...\n");
 113         kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr,
 114                 sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);
 115
 116         printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
 117         if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
 118             eprintf("Failed to decode KDBG header\n");
 119             return NULL;
 120         }
 121     }
 122
 123     kdbg = g_malloc(kdbg_hdr.Size);
 124
 125     if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
 126         eprintf("Failed to extract entire KDBG\n");
 127         g_free(kdbg);
 128         return NULL;
 129     }
 130
 131     if (!decode) {
 132         return kdbg;
 133     }
 134
 135     printf("Decoding KdDebuggerDataBlock...\n");
 136     kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size,
 137                 kwn, kwa, KdpDataBlockEncoded);
 138
 139     va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);
 140
 141     return kdbg;
 142 }
 143
 144 static void win_context_init_from_qemu_cpu_state(WinContext64 *ctx,
 145         QEMUCPUState *s)
 146 {
 147     WinContext64 win_ctx = (WinContext64){
 148         .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
 149         .MxCsr = INITIAL_MXCSR,
 150
 151         .SegCs = s->cs.selector,
 152         .SegSs = s->ss.selector,
 153         .SegDs = s->ds.selector,
 154         .SegEs = s->es.selector,
 155         .SegFs = s->fs.selector,
 156         .SegGs = s->gs.selector,
 157         .EFlags = (uint32_t)s->rflags,
 158
 159         .Rax = s->rax,
 160         .Rbx = s->rbx,
 161         .Rcx = s->rcx,
 162         .Rdx = s->rdx,
 163         .Rsp = s->rsp,
 164         .Rbp = s->rbp,
 165         .Rsi = s->rsi,
 166         .Rdi = s->rdi,
 167         .R8  = s->r8,
 168         .R9  = s->r9,
 169         .R10 = s->r10,
 170         .R11 = s->r11,
 171         .R12 = s->r12,
 172         .R13 = s->r13,
 173         .R14 = s->r14,
 174         .R15 = s->r15,
 175
 176         .Rip = s->rip,
 177         .FltSave = {
 178             .MxCsr = INITIAL_MXCSR,
 179         },
 180     };
 181
 182     *ctx = win_ctx;
 183 }
 184
 185 /*
 186  * Finds paging-structure hierarchy base,
 187  * if previously set doesn't give access to kernel structures
 188  */
 189 static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
 190 {
 191     /*
 192      * Firstly, test previously set DTB.
 193      */
 194     if (va_space_resolve(vs, SharedUserData)) {
 195         return 0;
 196     }
 197
 198     /*
 199      * Secondly, find CPU which run system task.
 200      */
 201     size_t i;
 202     for (i = 0; i < qe->state_nr; i++) {
 203         QEMUCPUState *s = qe->state[i];
 204
 205         if (is_system(s)) {
 206             va_space_set_dtb(vs, s->cr[3]);
 207             printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
 208                     " as system task CR3\n", vs->dtb, i);
 209             return !(va_space_resolve(vs, SharedUserData));
 210         }
 211     }
 212
 213     /*
 214      * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
 215      * CR3 as [Prcb+0x7000]
 216      */
 217     if (qe->has_kernel_gs_base) {
 218         QEMUCPUState *s = qe->state[0];
 219         uint64_t Prcb = s->kernel_gs_base;
 220         uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
 221
 222         if (!cr3) {
 223             return 1;
 224         }
 225
 226         va_space_set_dtb(vs, *cr3);
 227         printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
 228                 " as interrupt handling CR3\n", vs->dtb);
 229         return !(va_space_resolve(vs, SharedUserData));
 230     }
 231
 232     return 1;
 233 }
 234
 235 static void try_merge_runs(struct pa_space *ps,
 236         WinDumpPhyMemDesc64 *PhysicalMemoryBlock)
 237 {
 238     unsigned int merge_cnt = 0, run_idx = 0;
 239
 240     PhysicalMemoryBlock->NumberOfRuns = 0;
 241
 242     for (size_t idx = 0; idx < ps->block_nr; idx++) {
 243         struct pa_block *blk = ps->block + idx;
 244         struct pa_block *next = blk + 1;
 245
 246         PhysicalMemoryBlock->NumberOfPages += blk->size / ELF2DMP_PAGE_SIZE;
 247
 248         if (idx + 1 != ps->block_nr && blk->paddr + blk->size == next->paddr) {
 249             printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
 250                     " merged\n", idx, blk->paddr, blk->size, merge_cnt);
 251             merge_cnt++;
 252         } else {
 253             struct pa_block *first_merged = blk - merge_cnt;
 254
 255             printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
 256                     " merged to 0x%"PRIx64"+:0x%"PRIx64" (run #%u)\n",
 257                     idx, blk->paddr, blk->size, merge_cnt, first_merged->paddr,
 258                     blk->paddr + blk->size - first_merged->paddr, run_idx);
 259             PhysicalMemoryBlock->Run[run_idx] = (WinDumpPhyMemRun64) {
 260                 .BasePage = first_merged->paddr / ELF2DMP_PAGE_SIZE,
 261                 .PageCount = (blk->paddr + blk->size - first_merged->paddr) /
 262                         ELF2DMP_PAGE_SIZE,
 263             };
 264             PhysicalMemoryBlock->NumberOfRuns++;
 265             run_idx++;
 266             merge_cnt = 0;
 267         }
 268     }
 269 }
 270
 271 static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
 272         struct va_space *vs, uint64_t KdDebuggerDataBlock,
 273         KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
 274 {
 275     uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
 276             KUSD_OFFSET_SUITE_MASK);
 277     int32_t *product_type = va_space_resolve(vs, SharedUserData +
 278             KUSD_OFFSET_PRODUCT_TYPE);
 279     DBGKD_GET_VERSION64 kvb;
 280     WinDumpHeader64 h;
 281
 282     QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE);
 283     QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE);
 284
 285     if (!suite_mask || !product_type) {
 286         return 1;
 287     }
 288
 289     if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
 290         eprintf("Failed to extract KdVersionBlock\n");
 291         return 1;
 292     }
 293
 294     h = (WinDumpHeader64) {
 295         .Signature = "PAGE",
 296         .ValidDump = "DU64",
 297         .MajorVersion = kvb.MajorVersion,
 298         .MinorVersion = kvb.MinorVersion,
 299         .DirectoryTableBase = vs->dtb,
 300         .PfnDatabase = kdbg->MmPfnDatabase,
 301         .PsLoadedModuleList = kdbg->PsLoadedModuleList,
 302         .PsActiveProcessHead = kdbg->PsActiveProcessHead,
 303         .MachineImageType = kvb.MachineType,
 304         .NumberProcessors = nr_cpus,
 305         .BugcheckCode = LIVE_SYSTEM_DUMP,
 306         .KdDebuggerDataBlock = KdDebuggerDataBlock,
 307         .DumpType = 1,
 308         .Comment = "Hello from elf2dmp!",
 309         .SuiteMask = *suite_mask,
 310         .ProductType = *product_type,
 311         .SecondaryDataState = kvb.KdSecondaryVersion,
 312         .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
 313             .NumberOfRuns = ps->block_nr,
 314         },
 315         .RequiredDumpSpace = sizeof(h),
 316     };
 317
 318     if (h.PhysicalMemoryBlock.NumberOfRuns <= MAX_NUMBER_OF_RUNS) {
 319         for (size_t idx = 0; idx < ps->block_nr; idx++) {
 320             h.PhysicalMemoryBlock.NumberOfPages +=
 321                     ps->block[idx].size / ELF2DMP_PAGE_SIZE;
 322             h.PhysicalMemoryBlock.Run[idx] = (WinDumpPhyMemRun64) {
 323                 .BasePage = ps->block[idx].paddr / ELF2DMP_PAGE_SIZE,
 324                 .PageCount = ps->block[idx].size / ELF2DMP_PAGE_SIZE,
 325             };
 326         }
 327     } else {
 328         try_merge_runs(ps, &h.PhysicalMemoryBlock);
 329     }
 330
 331     h.RequiredDumpSpace +=
 332             h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
 333
 334     *hdr = h;
 335
 336     return 0;
 337 }
 338
 339 static int fill_context(KDDEBUGGER_DATA64 *kdbg,
 340         struct va_space *vs, QEMU_Elf *qe)
 341 {
 342     int i;
 343
 344     for (i = 0; i < qe->state_nr; i++) {
 345         uint64_t Prcb;
 346         uint64_t Context;
 347         WinContext64 ctx;
 348         QEMUCPUState *s = qe->state[i];
 349
 350         if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
 351                     &Prcb, sizeof(Prcb), 0)) {
 352             eprintf("Failed to read CPU #%d PRCB location\n", i);
 353             return 1;
 354         }
 355
 356         if (!Prcb) {
 357             eprintf("Context for CPU #%d is missing\n", i);
 358             continue;
 359         }
 360
 361         if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
 362                     &Context, sizeof(Context), 0)) {
 363             eprintf("Failed to read CPU #%d ContextFrame location\n", i);
 364             return 1;
 365         }
 366
 367         printf("Filling context for CPU #%d...\n", i);
 368         win_context_init_from_qemu_cpu_state(&ctx, s);
 369
 370         if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
 371             eprintf("Failed to fill CPU #%d context\n", i);
 372             return 1;
 373         }
 374     }
 375
 376     return 0;
 377 }
 378
 379 static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
 380         void *entry, size_t size, struct va_space *vs)
 381 {
 382     const char e_magic[2] = "MZ";
 383     const char Signature[4] = "PE\0\0";
 384     IMAGE_DOS_HEADER *dos_hdr = start_addr;
 385     IMAGE_NT_HEADERS64 nt_hdrs;
 386     IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
 387     IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
 388     IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
 389
 390     QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
 391
 392     if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
 393         return 1;
 394     }
 395
 396     if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 397                 &nt_hdrs, sizeof(nt_hdrs), 0)) {
 398         return 1;
 399     }
 400
 401     if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 402             file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 403         return 1;
 404     }
 405
 406     if (va_space_rw(vs,
 407                 base + data_dir[idx].VirtualAddress,
 408                 entry, size, 0)) {
 409         return 1;
 410     }
 411
 412     printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
 413             (uint32_t)data_dir[idx].VirtualAddress);
 414
 415     return 0;
 416 }
 417
 418 static int write_dump(struct pa_space *ps,
 419         WinDumpHeader64 *hdr, const char *name)
 420 {
 421     FILE *dmp_file = fopen(name, "wb");
 422     size_t i;
 423
 424     if (!dmp_file) {
 425         eprintf("Failed to open output file \'%s\'\n", name);
 426         return 1;
 427     }
 428
 429     printf("Writing header to file...\n");
 430
 431     if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
 432         eprintf("Failed to write dump header\n");
 433         fclose(dmp_file);
 434         return 1;
 435     }
 436
 437     for (i = 0; i < ps->block_nr; i++) {
 438         struct pa_block *b = &ps->block[i];
 439
 440         printf("Writing block #%zu/%zu of %"PRIu64" bytes to file...\n", i,
 441                 ps->block_nr, b->size);
 442         if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
 443             eprintf("Failed to write block\n");
 444             fclose(dmp_file);
 445             return 1;
 446         }
 447     }
 448
 449     return fclose(dmp_file);
 450 }
 451
 452 static bool pe_check_pdb_name(uint64_t base, void *start_addr,
 453         struct va_space *vs, OMFSignatureRSDS *rsds)
 454 {
 455     const char sign_rsds[4] = "RSDS";
 456     IMAGE_DEBUG_DIRECTORY debug_dir;
 457     char pdb_name[sizeof(PDB_NAME)];
 458
 459     if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
 460                 &debug_dir, sizeof(debug_dir), vs)) {
 461         eprintf("Failed to get Debug Directory\n");
 462         return false;
 463     }
 464
 465     if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
 466         eprintf("Debug Directory type is not CodeView\n");
 467         return false;
 468     }
 469
 470     if (va_space_rw(vs,
 471                 base + debug_dir.AddressOfRawData,
 472                 rsds, sizeof(*rsds), 0)) {
 473         eprintf("Failed to resolve OMFSignatureRSDS\n");
 474         return false;
 475     }
 476
 477     if (memcmp(&rsds->Signature, sign_rsds, sizeof(sign_rsds))) {
 478         eprintf("CodeView signature is \'%.4s\', \'%.4s\' expected\n",
 479                 rsds->Signature, sign_rsds);
 480         return false;
 481     }
 482
 483     if (debug_dir.SizeOfData - sizeof(*rsds) != sizeof(PDB_NAME)) {
 484         eprintf("PDB name size doesn't match\n");
 485         return false;
 486     }
 487
 488     if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
 489                 offsetof(OMFSignatureRSDS, name), pdb_name, sizeof(PDB_NAME),
 490                 0)) {
 491         eprintf("Failed to resolve PDB name\n");
 492         return false;
 493     }
 494
 495     printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
 496
 497     return !strcmp(pdb_name, PDB_NAME);
 498 }
 499
 500 static void pe_get_pdb_symstore_hash(OMFSignatureRSDS *rsds, char *hash)
 501 {
 502     sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds->guid.a, rsds->guid.b,
 503             rsds->guid.c, rsds->guid.d[0], rsds->guid.d[1]);
 504     hash += 20;
 505     for (unsigned int i = 0; i < 6; i++, hash += 2) {
 506         sprintf(hash, "%.02x", rsds->guid.e[i]);
 507     }
 508
 509     sprintf(hash, "%.01x", rsds->age);
 510 }
 511
 512 int main(int argc, char *argv[])
 513 {
 514     int err = 0;
 515     QEMU_Elf qemu_elf;
 516     struct pa_space ps;
 517     struct va_space vs;
 518     QEMUCPUState *state;
 519     idt_desc_t first_idt_desc;
 520     uint64_t KernBase;
 521     void *nt_start_addr = NULL;
 522     WinDumpHeader64 header;
 523     char pdb_hash[34];
 524     char pdb_url[] = SYM_URL_BASE PDB_NAME
 525         "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
 526     struct pdb_reader pdb;
 527     uint64_t KdDebuggerDataBlock;
 528     KDDEBUGGER_DATA64 *kdbg;
 529     uint64_t KdVersionBlock;
 530     bool kernel_found = false;
 531     OMFSignatureRSDS rsds;
 532
 533     if (argc != 3) {
 534         eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
 535         return 1;
 536     }
 537
 538     if (QEMU_Elf_init(&qemu_elf, argv[1])) {
 539         eprintf("Failed to initialize QEMU ELF dump\n");
 540         return 1;
 541     }
 542
 543     if (pa_space_create(&ps, &qemu_elf)) {
 544         eprintf("Failed to initialize physical address space\n");
 545         err = 1;
 546         goto out_elf;
 547     }
 548
 549     state = qemu_elf.state[0];
 550     printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);
 551
 552     va_space_create(&vs, &ps, state->cr[3]);
 553     if (fix_dtb(&vs, &qemu_elf)) {
 554         eprintf("Failed to find paging base\n");
 555         err = 1;
 556         goto out_elf;
 557     }
 558
 559     printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);
 560
 561     if (va_space_rw(&vs, state->idt.base,
 562                 &first_idt_desc, sizeof(first_idt_desc), 0)) {
 563         eprintf("Failed to get CPU #0 IDT[0]\n");
 564         err = 1;
 565         goto out_ps;
 566     }
 567     printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));
 568
 569     KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1);
 570     printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);
 571
 572     for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) {
 573         nt_start_addr = va_space_resolve(&vs, KernBase);
 574         if (!nt_start_addr) {
 575             continue;
 576         }
 577
 578         if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
 579             printf("Checking candidate KernBase = 0x%016"PRIx64"\n", KernBase);
 580             if (pe_check_pdb_name(KernBase, nt_start_addr, &vs, &rsds)) {
 581                 kernel_found = true;
 582                 break;
 583             }
 584         }
 585     }
 586
 587     if (!kernel_found) {
 588         eprintf("Failed to find NT kernel image\n");
 589         err = 1;
 590         goto out_ps;
 591     }
 592
 593     printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
 594             (char *)nt_start_addr);
 595
 596     pe_get_pdb_symstore_hash(&rsds, pdb_hash);
 597
 598     sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
 599     printf("PDB URL is %s\n", pdb_url);
 600
 601     if (download_url(PDB_NAME, pdb_url)) {
 602         eprintf("Failed to download PDB file\n");
 603         err = 1;
 604         goto out_ps;
 605     }
 606
 607     if (pdb_init_from_file(PDB_NAME, &pdb)) {
 608         eprintf("Failed to initialize PDB reader\n");
 609         err = 1;
 610         goto out_pdb_file;
 611     }
 612
 613     if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
 614             !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
 615         err = 1;
 616         goto out_pdb;
 617     }
 618
 619     kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
 620     if (!kdbg) {
 621         err = 1;
 622         goto out_pdb;
 623     }
 624
 625     if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
 626             KdVersionBlock, qemu_elf.state_nr)) {
 627         err = 1;
 628         goto out_kdbg;
 629     }
 630
 631     if (fill_context(kdbg, &vs, &qemu_elf)) {
 632         err = 1;
 633         goto out_kdbg;
 634     }
 635
 636     if (write_dump(&ps, &header, argv[2])) {
 637         eprintf("Failed to save dump\n");
 638         err = 1;
 639         goto out_kdbg;
 640     }
 641
 642 out_kdbg:
 643     g_free(kdbg);
 644 out_pdb:
 645     pdb_exit(&pdb);
 646 out_pdb_file:
 647     unlink(PDB_NAME);
 648 out_ps:
 649     pa_space_destroy(&ps);
 650 out_elf:
 651     QEMU_Elf_exit(&qemu_elf);
 652
 653     return err;
 654 }