1
2
3
4
5
6
7
8#include "qemu/osdep.h"
9
10#include "err.h"
11#include "addrspace.h"
12#include "pe.h"
13#include "pdb.h"
14#include "kdbg.h"
15#include "download.h"
16#include "qemu/win_dump_defs.h"
17
18#define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/"
19#define PDB_NAME "ntkrnlmp.pdb"
20
21#define INITIAL_MXCSR 0x1f80
22
23typedef struct idt_desc {
24 uint16_t offset1;
25 uint16_t selector;
26 uint8_t ist;
27 uint8_t type_attr;
28 uint16_t offset2;
29 uint32_t offset3;
30 uint32_t rsrvd;
31} __attribute__ ((packed)) idt_desc_t;
32
33static uint64_t idt_desc_addr(idt_desc_t desc)
34{
35 return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) |
36 ((uint64_t)desc.offset3 << 32);
37}
38
39static const uint64_t SharedUserData = 0xfffff78000000000;
40
41#define KUSD_OFFSET_SUITE_MASK 0x2d0
42#define KUSD_OFFSET_PRODUCT_TYPE 0x264
43
44#define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
45 s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
46 eprintf("Failed to resolve "#s"\n"), s)
47
48static uint64_t rol(uint64_t x, uint64_t y)
49{
50 return (x << y) | (x >> (64 - y));
51}
52
53
54
55
56static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
57 uint64_t kwn, uint64_t kwa, uint64_t kdbe)
58{
59 size_t i;
60 assert(size % sizeof(uint64_t) == 0);
61 for (i = 0; i < size / sizeof(uint64_t); i++) {
62 uint64_t block;
63
64 block = src[i];
65 block = rol(block ^ kwn, (uint8_t)kwn);
66 block = __builtin_bswap64(block ^ kdbe) ^ kwa;
67 dst[i] = block;
68 }
69}
70
71static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
72 struct va_space *vs, uint64_t KdDebuggerDataBlock)
73{
74 const char OwnerTag[4] = "KDBG";
75 KDDEBUGGER_DATA64 *kdbg = NULL;
76 DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
77 bool decode = false;
78 uint64_t kwn, kwa, KdpDataBlockEncoded;
79
80 if (va_space_rw(vs,
81 KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
82 &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
83 eprintf("Failed to extract KDBG header\n");
84 return NULL;
85 }
86
87 if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
88 uint64_t KiWaitNever, KiWaitAlways;
89
90 decode = true;
91
92 if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) ||
93 !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) ||
94 !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
95 return NULL;
96 }
97
98 if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
99 va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
100 return NULL;
101 }
102
103 printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
104 printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);
105
106
107
108
109
110 printf("Decoding KDBG header...\n");
111 kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr,
112 sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);
113
114 printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
115 if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
116 eprintf("Failed to decode KDBG header\n");
117 return NULL;
118 }
119 }
120
121 kdbg = malloc(kdbg_hdr.Size);
122 if (!kdbg) {
123 return NULL;
124 }
125
126 if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
127 eprintf("Failed to extract entire KDBG\n");
128 return NULL;
129 }
130
131 if (!decode) {
132 return kdbg;
133 }
134
135 printf("Decoding KdDebuggerDataBlock...\n");
136 kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size,
137 kwn, kwa, KdpDataBlockEncoded);
138
139 va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);
140
141 return kdbg;
142}
143
144static void win_context_init_from_qemu_cpu_state(WinContext *ctx,
145 QEMUCPUState *s)
146{
147 WinContext win_ctx = (WinContext){
148 .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
149 .MxCsr = INITIAL_MXCSR,
150
151 .SegCs = s->cs.selector,
152 .SegSs = s->ss.selector,
153 .SegDs = s->ds.selector,
154 .SegEs = s->es.selector,
155 .SegFs = s->fs.selector,
156 .SegGs = s->gs.selector,
157 .EFlags = (uint32_t)s->rflags,
158
159 .Rax = s->rax,
160 .Rbx = s->rbx,
161 .Rcx = s->rcx,
162 .Rdx = s->rdx,
163 .Rsp = s->rsp,
164 .Rbp = s->rbp,
165 .Rsi = s->rsi,
166 .Rdi = s->rdi,
167 .R8 = s->r8,
168 .R9 = s->r9,
169 .R10 = s->r10,
170 .R11 = s->r11,
171 .R12 = s->r12,
172 .R13 = s->r13,
173 .R14 = s->r14,
174 .R15 = s->r15,
175
176 .Rip = s->rip,
177 .FltSave = {
178 .MxCsr = INITIAL_MXCSR,
179 },
180 };
181
182 *ctx = win_ctx;
183}
184
185
186
187
188
189static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
190{
191
192
193
194 if (va_space_resolve(vs, SharedUserData)) {
195 return 0;
196 }
197
198
199
200
201 size_t i;
202 for (i = 0; i < qe->state_nr; i++) {
203 QEMUCPUState *s = qe->state[i];
204
205 if (is_system(s)) {
206 va_space_set_dtb(vs, s->cr[3]);
207 printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
208 " as system task CR3\n", vs->dtb, i);
209 return !(va_space_resolve(vs, SharedUserData));
210 }
211 }
212
213
214
215
216
217 if (qe->has_kernel_gs_base) {
218 QEMUCPUState *s = qe->state[0];
219 uint64_t Prcb = s->kernel_gs_base;
220 uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
221
222 if (!cr3) {
223 return 1;
224 }
225
226 va_space_set_dtb(vs, *cr3);
227 printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
228 " as interrupt handling CR3\n", vs->dtb);
229 return !(va_space_resolve(vs, SharedUserData));
230 }
231
232 return 1;
233}
234
235static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
236 struct va_space *vs, uint64_t KdDebuggerDataBlock,
237 KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
238{
239 uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
240 KUSD_OFFSET_SUITE_MASK);
241 int32_t *product_type = va_space_resolve(vs, SharedUserData +
242 KUSD_OFFSET_PRODUCT_TYPE);
243 DBGKD_GET_VERSION64 kvb;
244 WinDumpHeader64 h;
245 size_t i;
246
247 QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE);
248 QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE);
249
250 if (!suite_mask || !product_type) {
251 return 1;
252 }
253
254 if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
255 eprintf("Failed to extract KdVersionBlock\n");
256 return 1;
257 }
258
259 h = (WinDumpHeader64) {
260 .Signature = "PAGE",
261 .ValidDump = "DU64",
262 .MajorVersion = kvb.MajorVersion,
263 .MinorVersion = kvb.MinorVersion,
264 .DirectoryTableBase = vs->dtb,
265 .PfnDatabase = kdbg->MmPfnDatabase,
266 .PsLoadedModuleList = kdbg->PsLoadedModuleList,
267 .PsActiveProcessHead = kdbg->PsActiveProcessHead,
268 .MachineImageType = kvb.MachineType,
269 .NumberProcessors = nr_cpus,
270 .BugcheckCode = LIVE_SYSTEM_DUMP,
271 .KdDebuggerDataBlock = KdDebuggerDataBlock,
272 .DumpType = 1,
273 .Comment = "Hello from elf2dmp!",
274 .SuiteMask = *suite_mask,
275 .ProductType = *product_type,
276 .SecondaryDataState = kvb.KdSecondaryVersion,
277 .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
278 .NumberOfRuns = ps->block_nr,
279 },
280 .RequiredDumpSpace = sizeof(h),
281 };
282
283 for (i = 0; i < ps->block_nr; i++) {
284 h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE;
285 h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
286 .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE,
287 .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE,
288 };
289 }
290
291 h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
292
293 *hdr = h;
294
295 return 0;
296}
297
298static int fill_context(KDDEBUGGER_DATA64 *kdbg,
299 struct va_space *vs, QEMU_Elf *qe)
300{
301 int i;
302 for (i = 0; i < qe->state_nr; i++) {
303 uint64_t Prcb;
304 uint64_t Context;
305 WinContext ctx;
306 QEMUCPUState *s = qe->state[i];
307
308 if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
309 &Prcb, sizeof(Prcb), 0)) {
310 eprintf("Failed to read CPU #%d PRCB location\n", i);
311 return 1;
312 }
313
314 if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
315 &Context, sizeof(Context), 0)) {
316 eprintf("Failed to read CPU #%d ContextFrame location\n", i);
317 return 1;
318 }
319
320 printf("Filling context for CPU #%d...\n", i);
321 win_context_init_from_qemu_cpu_state(&ctx, s);
322
323 if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
324 eprintf("Failed to fill CPU #%d context\n", i);
325 return 1;
326 }
327 }
328
329 return 0;
330}
331
332static int write_dump(struct pa_space *ps,
333 WinDumpHeader64 *hdr, const char *name)
334{
335 FILE *dmp_file = fopen(name, "wb");
336 size_t i;
337
338 if (!dmp_file) {
339 eprintf("Failed to open output file \'%s\'\n", name);
340 return 1;
341 }
342
343 printf("Writing header to file...\n");
344
345 if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
346 eprintf("Failed to write dump header\n");
347 fclose(dmp_file);
348 return 1;
349 }
350
351 for (i = 0; i < ps->block_nr; i++) {
352 struct pa_block *b = &ps->block[i];
353
354 printf("Writing block #%zu/%zu to file...\n", i, ps->block_nr);
355 if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
356 eprintf("Failed to write dump header\n");
357 fclose(dmp_file);
358 return 1;
359 }
360 }
361
362 return fclose(dmp_file);
363}
364
365static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
366 char *hash, struct va_space *vs)
367{
368 const char e_magic[2] = "MZ";
369 const char Signature[4] = "PE\0\0";
370 const char sign_rsds[4] = "RSDS";
371 IMAGE_DOS_HEADER *dos_hdr = start_addr;
372 IMAGE_NT_HEADERS64 nt_hdrs;
373 IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
374 IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
375 IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
376 IMAGE_DEBUG_DIRECTORY debug_dir;
377 OMFSignatureRSDS rsds;
378 char *pdb_name;
379 size_t pdb_name_sz;
380 size_t i;
381
382 QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
383
384 if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
385 return 1;
386 }
387
388 if (va_space_rw(vs, base + dos_hdr->e_lfanew,
389 &nt_hdrs, sizeof(nt_hdrs), 0)) {
390 return 1;
391 }
392
393 if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
394 file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
395 return 1;
396 }
397
398 printf("Debug Directory RVA = 0x%08"PRIx32"\n",
399 (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
400
401 if (va_space_rw(vs,
402 base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
403 &debug_dir, sizeof(debug_dir), 0)) {
404 return 1;
405 }
406
407 if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
408 return 1;
409 }
410
411 if (va_space_rw(vs,
412 base + debug_dir.AddressOfRawData,
413 &rsds, sizeof(rsds), 0)) {
414 return 1;
415 }
416
417 printf("CodeView signature is \'%.4s\'\n", rsds.Signature);
418
419 if (memcmp(&rsds.Signature, sign_rsds, sizeof(sign_rsds))) {
420 return 1;
421 }
422
423 pdb_name_sz = debug_dir.SizeOfData - sizeof(rsds);
424 pdb_name = malloc(pdb_name_sz);
425 if (!pdb_name) {
426 return 1;
427 }
428
429 if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
430 offsetof(OMFSignatureRSDS, name), pdb_name, pdb_name_sz, 0)) {
431 free(pdb_name);
432 return 1;
433 }
434
435 printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
436
437 if (strcmp(pdb_name, PDB_NAME)) {
438 eprintf("Unexpected PDB name, it seems the kernel isn't found\n");
439 free(pdb_name);
440 return 1;
441 }
442
443 free(pdb_name);
444
445 sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds.guid.a, rsds.guid.b,
446 rsds.guid.c, rsds.guid.d[0], rsds.guid.d[1]);
447 hash += 20;
448 for (i = 0; i < 6; i++, hash += 2) {
449 sprintf(hash, "%.02x", rsds.guid.e[i]);
450 }
451
452 sprintf(hash, "%.01x", rsds.age);
453
454 return 0;
455}
456
457int main(int argc, char *argv[])
458{
459 int err = 0;
460 QEMU_Elf qemu_elf;
461 struct pa_space ps;
462 struct va_space vs;
463 QEMUCPUState *state;
464 idt_desc_t first_idt_desc;
465 uint64_t KernBase;
466 void *nt_start_addr = NULL;
467 WinDumpHeader64 header;
468 char pdb_hash[34];
469 char pdb_url[] = SYM_URL_BASE PDB_NAME
470 "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
471 struct pdb_reader pdb;
472 uint64_t KdDebuggerDataBlock;
473 KDDEBUGGER_DATA64 *kdbg;
474 uint64_t KdVersionBlock;
475
476 if (argc != 3) {
477 eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
478 return 1;
479 }
480
481 if (QEMU_Elf_init(&qemu_elf, argv[1])) {
482 eprintf("Failed to initialize QEMU ELF dump\n");
483 return 1;
484 }
485
486 if (pa_space_create(&ps, &qemu_elf)) {
487 eprintf("Failed to initialize physical address space\n");
488 err = 1;
489 goto out_elf;
490 }
491
492 state = qemu_elf.state[0];
493 printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);
494
495 va_space_create(&vs, &ps, state->cr[3]);
496 if (fix_dtb(&vs, &qemu_elf)) {
497 eprintf("Failed to find paging base\n");
498 err = 1;
499 goto out_elf;
500 }
501
502 printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);
503
504 if (va_space_rw(&vs, state->idt.base,
505 &first_idt_desc, sizeof(first_idt_desc), 0)) {
506 eprintf("Failed to get CPU #0 IDT[0]\n");
507 err = 1;
508 goto out_ps;
509 }
510 printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));
511
512 KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1);
513 printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);
514
515 for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) {
516 nt_start_addr = va_space_resolve(&vs, KernBase);
517 if (!nt_start_addr) {
518 continue;
519 }
520
521 if (*(uint16_t *)nt_start_addr == 0x5a4d) {
522 break;
523 }
524 }
525
526 if (!nt_start_addr) {
527 eprintf("Failed to find NT kernel image\n");
528 err = 1;
529 goto out_ps;
530 }
531
532 printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
533 (char *)nt_start_addr);
534
535 if (pe_get_pdb_symstore_hash(KernBase, nt_start_addr, pdb_hash, &vs)) {
536 eprintf("Failed to get PDB symbol store hash\n");
537 err = 1;
538 goto out_ps;
539 }
540
541 sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
542 printf("PDB URL is %s\n", pdb_url);
543
544 if (download_url(PDB_NAME, pdb_url)) {
545 eprintf("Failed to download PDB file\n");
546 err = 1;
547 goto out_ps;
548 }
549
550 if (pdb_init_from_file(PDB_NAME, &pdb)) {
551 eprintf("Failed to initialize PDB reader\n");
552 err = 1;
553 goto out_pdb_file;
554 }
555
556 if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
557 !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
558 err = 1;
559 goto out_pdb;
560 }
561
562 kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
563 if (!kdbg) {
564 err = 1;
565 goto out_pdb;
566 }
567
568 if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
569 KdVersionBlock, qemu_elf.state_nr)) {
570 err = 1;
571 goto out_kdbg;
572 }
573
574 if (fill_context(kdbg, &vs, &qemu_elf)) {
575 err = 1;
576 goto out_kdbg;
577 }
578
579 if (write_dump(&ps, &header, argv[2])) {
580 eprintf("Failed to save dump\n");
581 err = 1;
582 goto out_kdbg;
583 }
584
585out_kdbg:
586 free(kdbg);
587out_pdb:
588 pdb_exit(&pdb);
589out_pdb_file:
590 unlink(PDB_NAME);
591out_ps:
592 pa_space_destroy(&ps);
593out_elf:
594 QEMU_Elf_exit(&qemu_elf);
595
596 return err;
597}
598
