2 * Wine debugger - minidump handling
4 * Copyright 2005 Eric Pouech
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 #define NONAMELESSUNION
22 #define NONAMELESSSTRUCT
33 #include "wine/debug.h"
34 #include "wine/exception.h"
36 WINE_DEFAULT_DEBUG_CHANNEL(winedbg
);
38 static struct be_process_io be_process_minidump_io
;
40 /* we need this function on 32bit hosts to ensure we zero out the higher DWORD
41 * stored in the minidump file (sometimes it's not cleared, or the conversion from
42 * 32bit to 64bit wide integers is done as signed, which is wrong)
43 * So we clamp on 32bit CPUs (as stored in minidump information) all addresses to
44 * keep only the lower 32 bits.
45 * FIXME: as of today, since we don't support a backend CPU which is different from
46 * CPU this process is running on, casting to (DWORD_PTR) will do just fine.
48 static inline DWORD64
get_addr64(DWORD64 addr
)
50 return (DWORD_PTR
)addr
;
53 void minidump_write(const char* file
, const EXCEPTION_RECORD
* rec
)
56 MINIDUMP_EXCEPTION_INFORMATION mei
;
57 EXCEPTION_POINTERS ep
;
60 if (dbg_curr_process
->be_cpu
->machine
!= IMAGE_FILE_MACHINE_AMD64
)
62 FIXME("Cannot write minidump for 32-bit process using 64-bit winedbg\n");
67 hFile
= CreateFileA(file
, GENERIC_READ
|GENERIC_WRITE
, 0, NULL
, CREATE_ALWAYS
,
68 FILE_ATTRIBUTE_NORMAL
, NULL
);
70 if (hFile
== INVALID_HANDLE_VALUE
) return;
74 mei
.ThreadId
= dbg_curr_thread
->tid
;
75 mei
.ExceptionPointers
= &ep
;
76 ep
.ExceptionRecord
= (EXCEPTION_RECORD
*)rec
;
77 ep
.ContextRecord
= &dbg_context
.ctx
;
78 mei
.ClientPointers
= FALSE
;
80 MiniDumpWriteDump(dbg_curr_process
->handle
, dbg_curr_process
->pid
,
81 hFile
, MiniDumpNormal
/*|MiniDumpWithDataSegs*/,
82 rec
? &mei
: NULL
, NULL
, NULL
);
86 #define Wine_ElfModuleListStream 0xFFF0
88 struct tgt_process_minidump_data
95 static inline struct tgt_process_minidump_data
* private_data(struct dbg_process
* pcs
)
100 static BOOL
tgt_process_minidump_read(HANDLE hProcess
, const void* addr
,
101 void* buffer
, SIZE_T len
, SIZE_T
* rlen
)
105 if (!private_data(dbg_curr_process
)->mapping
) return FALSE
;
106 if (MiniDumpReadDumpStream(private_data(dbg_curr_process
)->mapping
,
107 MemoryListStream
, NULL
, &stream
, NULL
))
109 MINIDUMP_MEMORY_LIST
* mml
= stream
;
110 MINIDUMP_MEMORY_DESCRIPTOR
* mmd
= mml
->MemoryRanges
;
112 SIZE_T ilen
, prev_len
= 0;
114 /* There's no reason that memory ranges inside a minidump do not overlap.
115 * So be smart when looking for a given memory range (either grab a
116 * range that covers the whole requested area, or if none, the range that
117 * has the largest overlap with requested area)
119 for (i
= 0; i
< mml
->NumberOfMemoryRanges
; i
++, mmd
++)
121 if (get_addr64(mmd
->StartOfMemoryRange
) <= (DWORD_PTR
)addr
&&
122 (DWORD_PTR
)addr
< get_addr64(mmd
->StartOfMemoryRange
) + mmd
->Memory
.DataSize
)
125 get_addr64(mmd
->StartOfMemoryRange
) + mmd
->Memory
.DataSize
- (DWORD_PTR
)addr
);
126 if (ilen
== len
) /* whole range is matched */
132 if (found
== -1 || ilen
> prev_len
) /* partial match, keep largest one */
141 mmd
= &mml
->MemoryRanges
[found
];
143 (char*)private_data(dbg_curr_process
)->mapping
+ mmd
->Memory
.Rva
+ (DWORD_PTR
)addr
- get_addr64(mmd
->StartOfMemoryRange
),
145 if (rlen
) *rlen
= prev_len
;
149 /* FIXME: this is a dirty hack to let the last frame in a bt to work
150 * However, we need to check who's to blame, this code or the current
151 * dbghelp!StackWalk implementation
153 if ((DWORD_PTR
)addr
< 32)
155 memset(buffer
, 0, len
);
156 if (rlen
) *rlen
= len
;
162 static BOOL
tgt_process_minidump_write(HANDLE hProcess
, void* addr
,
163 const void* buffer
, SIZE_T len
, SIZE_T
* wlen
)
168 static BOOL CALLBACK
validate_file(PCWSTR name
, void* user
)
170 return FALSE
; /* get the first file we find !! */
173 static BOOL
is_pe_module_embedded(struct tgt_process_minidump_data
* data
,
174 MINIDUMP_MODULE
* pe_mm
)
176 MINIDUMP_MODULE_LIST
* mml
;
178 if (MiniDumpReadDumpStream(data
->mapping
, Wine_ElfModuleListStream
, NULL
,
184 for (i
= 0, mm
= mml
->Modules
; i
< mml
->NumberOfModules
; i
++, mm
++)
186 if (get_addr64(mm
->BaseOfImage
) <= get_addr64(pe_mm
->BaseOfImage
) &&
187 get_addr64(mm
->BaseOfImage
) + mm
->SizeOfImage
>= get_addr64(pe_mm
->BaseOfImage
) + pe_mm
->SizeOfImage
)
194 static enum dbg_start
minidump_do_reload(struct tgt_process_minidump_data
* data
)
197 DWORD pid
= 1; /* by default */
198 HANDLE hProc
= (HANDLE
)0x900DBAAD;
200 MINIDUMP_MODULE_LIST
* mml
;
202 MINIDUMP_STRING
* mds
;
203 MINIDUMP_DIRECTORY
* dir
;
204 WCHAR exec_name
[1024];
209 if (MiniDumpReadDumpStream(data
->mapping
, MiscInfoStream
, NULL
, &stream
, NULL
))
211 MINIDUMP_MISC_INFO
* mmi
= stream
;
212 if (mmi
->Flags1
& MINIDUMP_MISC1_PROCESS_ID
)
213 pid
= mmi
->ProcessId
;
216 /* fetch executable name (it's normally the first one in module list) */
217 lstrcpyW(exec_name
, L
"<minidump-exec>");
219 if (MiniDumpReadDumpStream(data
->mapping
, ModuleListStream
, NULL
, &stream
, NULL
))
222 if (mml
->NumberOfModules
)
227 mds
= (MINIDUMP_STRING
*)((char*)data
->mapping
+ mm
->ModuleNameRva
);
228 len
= mds
->Length
/ 2;
229 memcpy(exec_name
, mds
->Buffer
, mds
->Length
);
231 for (ptr
= exec_name
+ len
- 1; ptr
>= exec_name
; ptr
--)
233 if (*ptr
== '/' || *ptr
== '\\')
235 memmove(exec_name
, ptr
+ 1, (lstrlenW(ptr
+ 1) + 1) * sizeof(WCHAR
));
242 if (MiniDumpReadDumpStream(data
->mapping
, SystemInfoStream
, &dir
, &stream
, NULL
))
244 MINIDUMP_SYSTEM_INFO
* msi
= stream
;
248 dbg_printf("WineDbg starting on minidump on pid %04lx\n", pid
);
249 switch (msi
->ProcessorArchitecture
)
251 case PROCESSOR_ARCHITECTURE_UNKNOWN
:
254 case PROCESSOR_ARCHITECTURE_INTEL
:
255 strcpy(tmp
, "Intel ");
256 switch (msi
->ProcessorLevel
)
258 case 3: str
= "80386"; break;
259 case 4: str
= "80486"; break;
260 case 5: str
= "Pentium"; break;
261 case 6: str
= "Pentium Pro/II or AMD Athlon"; break;
262 case 15: str
= "Pentium 4 or AMD Athlon64"; break;
263 default: str
= "???"; break;
266 if (msi
->ProcessorLevel
== 3 || msi
->ProcessorLevel
== 4)
268 if (HIBYTE(msi
->ProcessorRevision
) == 0xFF)
269 sprintf(tmp
+ strlen(tmp
), " (%c%d)",
270 'A' + ((msi
->ProcessorRevision
>>4)&0xf)-0x0a,
271 ((msi
->ProcessorRevision
&0xf)));
273 sprintf(tmp
+ strlen(tmp
), " (%c%d)",
274 'A' + HIBYTE(msi
->ProcessorRevision
),
275 LOBYTE(msi
->ProcessorRevision
));
277 else sprintf(tmp
+ strlen(tmp
), " (%d.%d)",
278 HIBYTE(msi
->ProcessorRevision
),
279 LOBYTE(msi
->ProcessorRevision
));
282 case PROCESSOR_ARCHITECTURE_MIPS
:
285 case PROCESSOR_ARCHITECTURE_ALPHA
:
288 case PROCESSOR_ARCHITECTURE_PPC
:
291 case PROCESSOR_ARCHITECTURE_AMD64
:
294 case PROCESSOR_ARCHITECTURE_ARM
:
297 case PROCESSOR_ARCHITECTURE_ARM64
:
300 case PROCESSOR_ARCHITECTURE_MSIL
:
303 case PROCESSOR_ARCHITECTURE_NEUTRAL
:
310 dbg_printf(" %ls was running on #%d %s CPU%s",
311 exec_name
, msi
->u
.s
.NumberOfProcessors
, str
,
312 msi
->u
.s
.NumberOfProcessors
< 2 ? "" : "s");
313 switch (msi
->MajorVersion
)
316 switch (msi
->MinorVersion
)
318 case 51: str
= "NT 3.51"; break;
319 default: str
= "3-????"; break;
323 switch (msi
->MinorVersion
)
325 case 0: str
= (msi
->PlatformId
== VER_PLATFORM_WIN32_NT
) ? "NT 4.0" : "95"; break;
326 case 10: str
= "98"; break;
327 case 90: str
= "ME"; break;
328 default: str
= "4-????"; break;
332 switch (msi
->MinorVersion
)
334 case 0: str
= "2000"; break;
335 case 1: str
= "XP"; break;
337 if (msi
->u
.s
.ProductType
== 1) str
= "XP";
338 else if (msi
->u
.s
.ProductType
== 3) str
= "Server 2003";
341 default: str
= "5-????"; break;
345 switch (msi
->MinorVersion
)
348 if (msi
->u
.s
.ProductType
== 1) str
= "Vista";
349 else if (msi
->u
.s
.ProductType
== 3) str
= "Server 2008";
353 if (msi
->u
.s
.ProductType
== 1) str
= "Win7";
354 else if (msi
->u
.s
.ProductType
== 3) str
= "Server 2008";
358 if (msi
->u
.s
.ProductType
== 1) str
= "Win8";
359 else if (msi
->u
.s
.ProductType
== 3) str
= "Server 2012";
363 if (msi
->u
.s
.ProductType
== 1) str
= "Win8.1";
364 else if (msi
->u
.s
.ProductType
== 3) str
= "Server 2012 R2";
367 default: str
= "6-????"; break;
371 switch (msi
->MinorVersion
)
374 if (msi
->u
.s
.ProductType
== 1) str
= "Win10";
375 else str
= "10-????";
377 default: str
= "10-????"; break;
380 default: str
= "???"; break;
382 dbg_printf(" on Windows %s (%u)\n", str
, msi
->BuildNumber
);
383 /* FIXME CSD: msi->CSDVersionRva */
385 if (sizeof(MINIDUMP_SYSTEM_INFO
) + 4 > dir
->Location
.DataSize
&&
386 msi
->CSDVersionRva
>= dir
->Location
.Rva
+ sizeof(MINIDUMP_SYSTEM_INFO
) + 4)
388 const char* code
= (const char*)stream
+ sizeof(MINIDUMP_SYSTEM_INFO
);
391 if (code
[0] == 'W' && code
[1] == 'I' && code
[2] == 'N' && code
[3] == 'E' &&
392 *(wes
= (const DWORD
*)(code
+= 4)) >= 3)
394 /* assume we have wine extensions */
395 dbg_printf(" [on %s, on top of %s (%s)]\n",
396 code
+ wes
[1], code
+ wes
[2], code
+ wes
[3]);
401 dbg_curr_process
= dbg_add_process(&be_process_minidump_io
, pid
, hProc
);
403 dbg_curr_process
->pio_data
= data
;
404 dbg_set_process_name(dbg_curr_process
, exec_name
);
406 dbg_init(hProc
, NULL
, FALSE
);
408 if (MiniDumpReadDumpStream(data
->mapping
, ThreadListStream
, NULL
, &stream
, NULL
))
410 MINIDUMP_THREAD_LIST
* mtl
= stream
;
413 for (i
= 0; i
< mtl
->NumberOfThreads
; i
++)
415 dbg_add_thread(dbg_curr_process
, mtl
->Threads
[i
].ThreadId
, NULL
,
416 (void*)(DWORD_PTR
)get_addr64(mtl
->Threads
[i
].Teb
));
419 /* first load ELF modules, then do the PE ones */
420 if (MiniDumpReadDumpStream(data
->mapping
, Wine_ElfModuleListStream
, NULL
,
423 WCHAR buffer
[MAX_PATH
];
426 for (i
= 0, mm
= mml
->Modules
; i
< mml
->NumberOfModules
; i
++, mm
++)
428 mds
= (MINIDUMP_STRING
*)((char*)data
->mapping
+ mm
->ModuleNameRva
);
429 memcpy(nameW
, mds
->Buffer
, mds
->Length
);
430 nameW
[mds
->Length
/ sizeof(WCHAR
)] = 0;
431 if (SymFindFileInPathW(hProc
, NULL
, nameW
, (void*)(DWORD_PTR
)mm
->CheckSum
,
432 0, 0, SSRVOPT_DWORD
, buffer
, validate_file
, NULL
))
433 dbg_load_module(hProc
, NULL
, buffer
, get_addr64(mm
->BaseOfImage
),
436 SymLoadModuleExW(hProc
, NULL
, nameW
, NULL
, get_addr64(mm
->BaseOfImage
),
437 mm
->SizeOfImage
, NULL
, SLMFLAG_VIRTUAL
);
440 if (MiniDumpReadDumpStream(data
->mapping
, ModuleListStream
, NULL
, &stream
, NULL
))
442 WCHAR buffer
[MAX_PATH
];
445 for (i
= 0, mm
= mml
->Modules
; i
< mml
->NumberOfModules
; i
++, mm
++)
447 mds
= (MINIDUMP_STRING
*)((char*)data
->mapping
+ mm
->ModuleNameRva
);
448 memcpy(nameW
, mds
->Buffer
, mds
->Length
);
449 nameW
[mds
->Length
/ sizeof(WCHAR
)] = 0;
450 if (SymFindFileInPathW(hProc
, NULL
, nameW
, (void*)(DWORD_PTR
)mm
->TimeDateStamp
,
451 mm
->SizeOfImage
, 0, SSRVOPT_DWORD
, buffer
, validate_file
, NULL
))
452 dbg_load_module(hProc
, NULL
, buffer
, get_addr64(mm
->BaseOfImage
),
454 else if (is_pe_module_embedded(data
, mm
))
455 dbg_load_module(hProc
, NULL
, nameW
, get_addr64(mm
->BaseOfImage
),
458 SymLoadModuleExW(hProc
, NULL
, nameW
, NULL
, get_addr64(mm
->BaseOfImage
),
459 mm
->SizeOfImage
, NULL
, SLMFLAG_VIRTUAL
);
462 if (MiniDumpReadDumpStream(data
->mapping
, ExceptionStream
, NULL
, &stream
, NULL
))
464 MINIDUMP_EXCEPTION_STREAM
* mes
= stream
;
466 if ((dbg_curr_thread
= dbg_get_thread(dbg_curr_process
, mes
->ThreadId
)))
470 dbg_curr_tid
= mes
->ThreadId
;
471 dbg_curr_thread
->in_exception
= TRUE
;
472 dbg_curr_thread
->excpt_record
.ExceptionCode
= mes
->ExceptionRecord
.ExceptionCode
;
473 dbg_curr_thread
->excpt_record
.ExceptionFlags
= mes
->ExceptionRecord
.ExceptionFlags
;
474 dbg_curr_thread
->excpt_record
.ExceptionRecord
= (void*)(DWORD_PTR
)get_addr64(mes
->ExceptionRecord
.ExceptionRecord
);
475 dbg_curr_thread
->excpt_record
.ExceptionAddress
= (void*)(DWORD_PTR
)get_addr64(mes
->ExceptionRecord
.ExceptionAddress
);
476 dbg_curr_thread
->excpt_record
.NumberParameters
= mes
->ExceptionRecord
.NumberParameters
;
477 for (i
= 0; i
< dbg_curr_thread
->excpt_record
.NumberParameters
; i
++)
479 dbg_curr_thread
->excpt_record
.ExceptionInformation
[i
] = mes
->ExceptionRecord
.ExceptionInformation
[i
];
481 memcpy(&dbg_context
, (char*)data
->mapping
+ mes
->ThreadContext
.Rva
,
482 min(sizeof(dbg_context
), mes
->ThreadContext
.DataSize
));
483 memory_get_current_pc(&addr
);
484 stack_fetch_frames(&dbg_context
);
485 dbg_curr_process
->be_cpu
->print_context(dbg_curr_thread
->handle
, &dbg_context
, 0);
487 dbg_curr_process
->be_cpu
->print_segment_info(dbg_curr_thread
->handle
, &dbg_context
);
488 stack_backtrace(mes
->ThreadId
);
489 source_list_from_addr(&addr
, 0);
495 static void cleanup(struct tgt_process_minidump_data
* data
)
497 if (data
->mapping
) UnmapViewOfFile(data
->mapping
);
498 if (data
->hMap
) CloseHandle(data
->hMap
);
499 if (data
->hFile
!= INVALID_HANDLE_VALUE
) CloseHandle(data
->hFile
);
500 HeapFree(GetProcessHeap(), 0, data
);
503 static struct be_process_io be_process_minidump_io
;
505 enum dbg_start
minidump_reload(int argc
, char* argv
[])
507 struct tgt_process_minidump_data
* data
;
508 enum dbg_start ret
= start_error_parse
;
510 /* try the form <myself> minidump-file */
511 if (argc
!= 1) return start_error_parse
;
513 WINE_TRACE("Processing Minidump file %s\n", argv
[0]);
515 data
= HeapAlloc(GetProcessHeap(), 0, sizeof(struct tgt_process_minidump_data
));
516 if (!data
) return start_error_init
;
517 data
->mapping
= NULL
;
519 data
->hFile
= INVALID_HANDLE_VALUE
;
521 if ((data
->hFile
= CreateFileA(argv
[0], GENERIC_READ
, FILE_SHARE_READ
, NULL
,
522 OPEN_EXISTING
, FILE_ATTRIBUTE_NORMAL
, NULL
)) != INVALID_HANDLE_VALUE
&&
523 ((data
->hMap
= CreateFileMappingA(data
->hFile
, NULL
, PAGE_READONLY
, 0, 0, NULL
)) != 0) &&
524 ((data
->mapping
= MapViewOfFile(data
->hMap
, FILE_MAP_READ
, 0, 0, 0)) != NULL
))
528 if (((MINIDUMP_HEADER
*)data
->mapping
)->Signature
== MINIDUMP_SIGNATURE
)
530 ret
= minidump_do_reload(data
);
535 dbg_printf("Unexpected fault while reading minidump %s\n", argv
[0]);
540 if (ret
!= start_ok
) cleanup(data
);
544 static BOOL
tgt_process_minidump_close_process(struct dbg_process
* pcs
, BOOL kill
)
546 struct tgt_process_minidump_data
* data
= private_data(pcs
);
549 pcs
->pio_data
= NULL
;
550 SymCleanup(pcs
->handle
);
551 dbg_del_process(pcs
);
555 static BOOL
tgt_process_minidump_get_selector(HANDLE hThread
, DWORD sel
, LDT_ENTRY
* le
)
557 /* so far, pretend all selectors are valid, and mapped to a 32bit flat address space */
558 memset(le
, 0, sizeof(*le
));
559 le
->HighWord
.Bits
.Default_Big
= 1;
563 static struct be_process_io be_process_minidump_io
=
565 tgt_process_minidump_close_process
,
566 tgt_process_minidump_read
,
567 tgt_process_minidump_write
,
568 tgt_process_minidump_get_selector
,