1 /*
2 * Copyright (c) 2018 Virtuozzo International GmbH
3 *
4 * This work is licensed under the terms of the GNU GPL, version 2 or later.
5 *
6 */
7
8 #include "qemu/osdep.h"
9 #include "qemu/bitops.h"
10
11 #include "err.h"
12 #include "addrspace.h"
13 #include "pe.h"
14 #include "pdb.h"
15 #include "kdbg.h"
16 #include "download.h"
17 #include "qemu/win_dump_defs.h"
18
19 #define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/"
20 #define PDB_NAME "ntkrnlmp.pdb"
21 #define PE_NAME "ntoskrnl.exe"
22
23 #define INITIAL_MXCSR 0x1f80
24 #define MAX_NUMBER_OF_RUNS 42
25
26 typedef struct idt_desc {
27 uint16_t offset1; /* offset bits 0..15 */
28 uint16_t selector;
29 uint8_t ist;
30 uint8_t type_attr;
31 uint16_t offset2; /* offset bits 16..31 */
32 uint32_t offset3; /* offset bits 32..63 */
33 uint32_t rsrvd;
34 } __attribute__ ((packed)) idt_desc_t;
35
idt_desc_addr(idt_desc_t desc)36 static uint64_t idt_desc_addr(idt_desc_t desc)
37 {
38 return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) |
39 ((uint64_t)desc.offset3 << 32);
40 }
41
42 static const uint64_t SharedUserData = 0xfffff78000000000;
43
44 #define KUSD_OFFSET_SUITE_MASK 0x2d0
45 #define KUSD_OFFSET_PRODUCT_TYPE 0x264
46
47 #define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
48 s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
49 eprintf("Failed to resolve "#s"\n"), s)
50
51 /*
52 * Decoding algorithm can be found in Volatility project
53 */
kdbg_decode(uint64_t * dst,uint64_t * src,size_t size,uint64_t kwn,uint64_t kwa,uint64_t kdbe)54 static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
55 uint64_t kwn, uint64_t kwa, uint64_t kdbe)
56 {
57 size_t i;
58 assert(size % sizeof(uint64_t) == 0);
59 for (i = 0; i < size / sizeof(uint64_t); i++) {
60 uint64_t block;
61
62 block = src[i];
63 block = rol64(block ^ kwn, kwn);
64 block = __builtin_bswap64(block ^ kdbe) ^ kwa;
65 dst[i] = block;
66 }
67 }
68
get_kdbg(uint64_t KernBase,struct pdb_reader * pdb,struct va_space * vs,uint64_t KdDebuggerDataBlock)69 static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
70 struct va_space *vs, uint64_t KdDebuggerDataBlock)
71 {
72 const char OwnerTag[4] = "KDBG";
73 KDDEBUGGER_DATA64 *kdbg = NULL;
74 DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
75 bool decode = false;
76 uint64_t kwn, kwa, KdpDataBlockEncoded;
77
78 if (!va_space_rw(vs,
79 KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
80 &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
81 eprintf("Failed to extract KDBG header\n");
82 return NULL;
83 }
84
85 if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
86 uint64_t KiWaitNever, KiWaitAlways;
87
88 decode = true;
89
90 if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) ||
91 !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) ||
92 !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
93 return NULL;
94 }
95
96 if (!va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
97 !va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
98 return NULL;
99 }
100
101 printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
102 printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);
103
104 /*
105 * If KDBG header can be decoded, KDBG size is available
106 * and entire KDBG can be decoded.
107 */
108 printf("Decoding KDBG header...\n");
109 kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr,
110 sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);
111
112 printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
113 if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
114 eprintf("Failed to decode KDBG header\n");
115 return NULL;
116 }
117 }
118
119 kdbg = g_malloc(kdbg_hdr.Size);
120
121 if (!va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
122 eprintf("Failed to extract entire KDBG\n");
123 g_free(kdbg);
124 return NULL;
125 }
126
127 if (!decode) {
128 return kdbg;
129 }
130
131 printf("Decoding KdDebuggerDataBlock...\n");
132 kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size,
133 kwn, kwa, KdpDataBlockEncoded);
134
135 va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);
136
137 return kdbg;
138 }
139
win_context_init_from_qemu_cpu_state(WinContext64 * ctx,QEMUCPUState * s)140 static void win_context_init_from_qemu_cpu_state(WinContext64 *ctx,
141 QEMUCPUState *s)
142 {
143 WinContext64 win_ctx = (WinContext64){
144 .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
145 .MxCsr = INITIAL_MXCSR,
146
147 .SegCs = s->cs.selector,
148 .SegSs = s->ss.selector,
149 .SegDs = s->ds.selector,
150 .SegEs = s->es.selector,
151 .SegFs = s->fs.selector,
152 .SegGs = s->gs.selector,
153 .EFlags = (uint32_t)s->rflags,
154
155 .Rax = s->rax,
156 .Rbx = s->rbx,
157 .Rcx = s->rcx,
158 .Rdx = s->rdx,
159 .Rsp = s->rsp,
160 .Rbp = s->rbp,
161 .Rsi = s->rsi,
162 .Rdi = s->rdi,
163 .R8 = s->r8,
164 .R9 = s->r9,
165 .R10 = s->r10,
166 .R11 = s->r11,
167 .R12 = s->r12,
168 .R13 = s->r13,
169 .R14 = s->r14,
170 .R15 = s->r15,
171
172 .Rip = s->rip,
173 .FltSave = {
174 .MxCsr = INITIAL_MXCSR,
175 },
176 };
177
178 *ctx = win_ctx;
179 }
180
181 /*
182 * Finds paging-structure hierarchy base,
183 * if previously set doesn't give access to kernel structures
184 */
fix_dtb(struct va_space * vs,QEMU_Elf * qe)185 static bool fix_dtb(struct va_space *vs, QEMU_Elf *qe)
186 {
187 /*
188 * Firstly, test previously set DTB.
189 */
190 if (va_space_resolve(vs, SharedUserData)) {
191 return true;
192 }
193
194 /*
195 * Secondly, find CPU which run system task.
196 */
197 size_t i;
198 for (i = 0; i < qe->state_nr; i++) {
199 QEMUCPUState *s = qe->state[i];
200
201 if (is_system(s)) {
202 va_space_set_dtb(vs, s->cr[3]);
203 printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
204 " as system task CR3\n", vs->dtb, i);
205 return va_space_resolve(vs, SharedUserData);
206 }
207 }
208
209 /*
210 * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
211 * CR3 as [Prcb+0x7000]
212 */
213 if (qe->has_kernel_gs_base) {
214 QEMUCPUState *s = qe->state[0];
215 uint64_t Prcb = s->kernel_gs_base;
216 uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
217
218 if (!cr3) {
219 return false;
220 }
221
222 va_space_set_dtb(vs, *cr3);
223 printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
224 " as interrupt handling CR3\n", vs->dtb);
225 return va_space_resolve(vs, SharedUserData);
226 }
227
228 return true;
229 }
230
try_merge_runs(struct pa_space * ps,WinDumpPhyMemDesc64 * PhysicalMemoryBlock)231 static void try_merge_runs(struct pa_space *ps,
232 WinDumpPhyMemDesc64 *PhysicalMemoryBlock)
233 {
234 unsigned int merge_cnt = 0, run_idx = 0;
235
236 PhysicalMemoryBlock->NumberOfRuns = 0;
237
238 for (size_t idx = 0; idx < ps->block_nr; idx++) {
239 struct pa_block *blk = ps->block + idx;
240 struct pa_block *next = blk + 1;
241
242 PhysicalMemoryBlock->NumberOfPages += blk->size / ELF2DMP_PAGE_SIZE;
243
244 if (idx + 1 != ps->block_nr && blk->paddr + blk->size == next->paddr) {
245 printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
246 " merged\n", idx, blk->paddr, blk->size, merge_cnt);
247 merge_cnt++;
248 } else {
249 struct pa_block *first_merged = blk - merge_cnt;
250
251 printf("Block #%zu 0x%"PRIx64"+:0x%"PRIx64" and %u previous will be"
252 " merged to 0x%"PRIx64"+:0x%"PRIx64" (run #%u)\n",
253 idx, blk->paddr, blk->size, merge_cnt, first_merged->paddr,
254 blk->paddr + blk->size - first_merged->paddr, run_idx);
255 PhysicalMemoryBlock->Run[run_idx] = (WinDumpPhyMemRun64) {
256 .BasePage = first_merged->paddr / ELF2DMP_PAGE_SIZE,
257 .PageCount = (blk->paddr + blk->size - first_merged->paddr) /
258 ELF2DMP_PAGE_SIZE,
259 };
260 PhysicalMemoryBlock->NumberOfRuns++;
261 run_idx++;
262 merge_cnt = 0;
263 }
264 }
265 }
266
fill_header(WinDumpHeader64 * hdr,struct pa_space * ps,struct va_space * vs,uint64_t KdDebuggerDataBlock,KDDEBUGGER_DATA64 * kdbg,uint64_t KdVersionBlock,int nr_cpus)267 static bool fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
268 struct va_space *vs, uint64_t KdDebuggerDataBlock,
269 KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock,
270 int nr_cpus)
271 {
272 uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
273 KUSD_OFFSET_SUITE_MASK);
274 int32_t *product_type = va_space_resolve(vs, SharedUserData +
275 KUSD_OFFSET_PRODUCT_TYPE);
276 DBGKD_GET_VERSION64 kvb;
277 WinDumpHeader64 h;
278
279 QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE);
280 QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE);
281
282 if (!suite_mask || !product_type) {
283 return false;
284 }
285
286 if (!va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
287 eprintf("Failed to extract KdVersionBlock\n");
288 return false;
289 }
290
291 h = (WinDumpHeader64) {
292 .Signature = "PAGE",
293 .ValidDump = "DU64",
294 .MajorVersion = kvb.MajorVersion,
295 .MinorVersion = kvb.MinorVersion,
296 .DirectoryTableBase = vs->dtb,
297 .PfnDatabase = kdbg->MmPfnDatabase,
298 .PsLoadedModuleList = kdbg->PsLoadedModuleList,
299 .PsActiveProcessHead = kdbg->PsActiveProcessHead,
300 .MachineImageType = kvb.MachineType,
301 .NumberProcessors = nr_cpus,
302 .BugcheckCode = LIVE_SYSTEM_DUMP,
303 .KdDebuggerDataBlock = KdDebuggerDataBlock,
304 .DumpType = 1,
305 .Comment = "Hello from elf2dmp!",
306 .SuiteMask = *suite_mask,
307 .ProductType = *product_type,
308 .SecondaryDataState = kvb.KdSecondaryVersion,
309 .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
310 .NumberOfRuns = ps->block_nr,
311 },
312 .RequiredDumpSpace = sizeof(h),
313 };
314
315 if (h.PhysicalMemoryBlock.NumberOfRuns <= MAX_NUMBER_OF_RUNS) {
316 for (size_t idx = 0; idx < ps->block_nr; idx++) {
317 h.PhysicalMemoryBlock.NumberOfPages +=
318 ps->block[idx].size / ELF2DMP_PAGE_SIZE;
319 h.PhysicalMemoryBlock.Run[idx] = (WinDumpPhyMemRun64) {
320 .BasePage = ps->block[idx].paddr / ELF2DMP_PAGE_SIZE,
321 .PageCount = ps->block[idx].size / ELF2DMP_PAGE_SIZE,
322 };
323 }
324 } else {
325 try_merge_runs(ps, &h.PhysicalMemoryBlock);
326 }
327
328 h.RequiredDumpSpace +=
329 h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
330
331 *hdr = h;
332
333 return true;
334 }
335
336 /*
337 * fill_context() continues even if it fails to fill contexts of some CPUs.
338 * A dump may still contain valuable information even if it lacks contexts of
339 * some CPUs due to dump corruption or a failure before starting CPUs.
340 */
fill_context(KDDEBUGGER_DATA64 * kdbg,struct va_space * vs,QEMU_Elf * qe)341 static void fill_context(KDDEBUGGER_DATA64 *kdbg,
342 struct va_space *vs, QEMU_Elf *qe)
343 {
344 int i;
345
346 for (i = 0; i < qe->state_nr; i++) {
347 uint64_t Prcb;
348 uint64_t Context;
349 WinContext64 ctx;
350 QEMUCPUState *s = qe->state[i];
351
352 if (!va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
353 &Prcb, sizeof(Prcb), 0)) {
354 eprintf("Failed to read CPU #%d PRCB location\n", i);
355 continue;
356 }
357
358 if (!Prcb) {
359 eprintf("Context for CPU #%d is missing\n", i);
360 continue;
361 }
362
363 if (!va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
364 &Context, sizeof(Context), 0)) {
365 eprintf("Failed to read CPU #%d ContextFrame location\n", i);
366 continue;
367 }
368
369 printf("Filling context for CPU #%d...\n", i);
370 win_context_init_from_qemu_cpu_state(&ctx, s);
371
372 if (!va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
373 eprintf("Failed to fill CPU #%d context\n", i);
374 continue;
375 }
376 }
377 }
378
pe_get_data_dir_entry(uint64_t base,void * start_addr,int idx,void * entry,size_t size,struct va_space * vs)379 static bool pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
380 void *entry, size_t size, struct va_space *vs)
381 {
382 const char e_magic[2] = "MZ";
383 const char Signature[4] = "PE\0\0";
384 IMAGE_DOS_HEADER *dos_hdr = start_addr;
385 IMAGE_NT_HEADERS64 nt_hdrs;
386 IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
387 IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
388 IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
389
390 QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
391
392 if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
393 return false;
394 }
395
396 if (!va_space_rw(vs, base + dos_hdr->e_lfanew,
397 &nt_hdrs, sizeof(nt_hdrs), 0)) {
398 return false;
399 }
400
401 if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
402 file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
403 return false;
404 }
405
406 if (!va_space_rw(vs, base + data_dir[idx].VirtualAddress, entry, size, 0)) {
407 return false;
408 }
409
410 printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
411 (uint32_t)data_dir[idx].VirtualAddress);
412
413 return true;
414 }
415
write_dump(struct pa_space * ps,WinDumpHeader64 * hdr,const char * name)416 static bool write_dump(struct pa_space *ps,
417 WinDumpHeader64 *hdr, const char *name)
418 {
419 FILE *dmp_file = fopen(name, "wb");
420 size_t i;
421
422 if (!dmp_file) {
423 eprintf("Failed to open output file \'%s\'\n", name);
424 return false;
425 }
426
427 printf("Writing header to file...\n");
428
429 if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
430 eprintf("Failed to write dump header\n");
431 fclose(dmp_file);
432 return false;
433 }
434
435 for (i = 0; i < ps->block_nr; i++) {
436 struct pa_block *b = &ps->block[i];
437
438 printf("Writing block #%zu/%zu of %"PRIu64" bytes to file...\n", i,
439 ps->block_nr, b->size);
440 if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
441 eprintf("Failed to write block\n");
442 fclose(dmp_file);
443 return false;
444 }
445 }
446
447 return !fclose(dmp_file);
448 }
449
pe_check_pdb_name(uint64_t base,void * start_addr,struct va_space * vs,OMFSignatureRSDS * rsds)450 static bool pe_check_pdb_name(uint64_t base, void *start_addr,
451 struct va_space *vs, OMFSignatureRSDS *rsds)
452 {
453 const char sign_rsds[4] = "RSDS";
454 IMAGE_DEBUG_DIRECTORY debug_dir;
455 char pdb_name[sizeof(PDB_NAME)];
456
457 if (!pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
458 &debug_dir, sizeof(debug_dir), vs)) {
459 eprintf("Failed to get Debug Directory\n");
460 return false;
461 }
462
463 if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
464 eprintf("Debug Directory type is not CodeView\n");
465 return false;
466 }
467
468 if (!va_space_rw(vs, base + debug_dir.AddressOfRawData,
469 rsds, sizeof(*rsds), 0)) {
470 eprintf("Failed to resolve OMFSignatureRSDS\n");
471 return false;
472 }
473
474 if (memcmp(&rsds->Signature, sign_rsds, sizeof(sign_rsds))) {
475 eprintf("CodeView signature is \'%.4s\', \'%.4s\' expected\n",
476 rsds->Signature, sign_rsds);
477 return false;
478 }
479
480 if (debug_dir.SizeOfData - sizeof(*rsds) != sizeof(PDB_NAME)) {
481 eprintf("PDB name size doesn't match\n");
482 return false;
483 }
484
485 if (!va_space_rw(vs, base + debug_dir.AddressOfRawData +
486 offsetof(OMFSignatureRSDS, name),
487 pdb_name, sizeof(PDB_NAME), 0)) {
488 eprintf("Failed to resolve PDB name\n");
489 return false;
490 }
491
492 printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
493
494 return !strcmp(pdb_name, PDB_NAME);
495 }
496
pe_get_pdb_symstore_hash(OMFSignatureRSDS * rsds,char * hash)497 static void pe_get_pdb_symstore_hash(OMFSignatureRSDS *rsds, char *hash)
498 {
499 sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds->guid.a, rsds->guid.b,
500 rsds->guid.c, rsds->guid.d[0], rsds->guid.d[1]);
501 hash += 20;
502 for (unsigned int i = 0; i < 6; i++, hash += 2) {
503 sprintf(hash, "%.02x", rsds->guid.e[i]);
504 }
505
506 sprintf(hash, "%.01x", rsds->age);
507 }
508
main(int argc,char * argv[])509 int main(int argc, char *argv[])
510 {
511 int err = 1;
512 QEMU_Elf qemu_elf;
513 struct pa_space ps;
514 struct va_space vs;
515 QEMUCPUState *state;
516 idt_desc_t first_idt_desc;
517 uint64_t KernBase;
518 void *nt_start_addr = NULL;
519 WinDumpHeader64 header;
520 char pdb_hash[34];
521 char pdb_url[] = SYM_URL_BASE PDB_NAME
522 "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
523 struct pdb_reader pdb;
524 uint64_t KdDebuggerDataBlock;
525 KDDEBUGGER_DATA64 *kdbg;
526 uint64_t KdVersionBlock;
527 bool kernel_found = false;
528 OMFSignatureRSDS rsds;
529
530 if (argc != 3) {
531 eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
532 return 1;
533 }
534
535 if (!QEMU_Elf_init(&qemu_elf, argv[1])) {
536 eprintf("Failed to initialize QEMU ELF dump\n");
537 return 1;
538 }
539
540 pa_space_create(&ps, &qemu_elf);
541
542 state = qemu_elf.state[0];
543 printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);
544
545 va_space_create(&vs, &ps, state->cr[3]);
546 if (!fix_dtb(&vs, &qemu_elf)) {
547 eprintf("Failed to find paging base\n");
548 goto out_ps;
549 }
550
551 printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);
552
553 if (!va_space_rw(&vs, state->idt.base,
554 &first_idt_desc, sizeof(first_idt_desc), 0)) {
555 eprintf("Failed to get CPU #0 IDT[0]\n");
556 goto out_ps;
557 }
558 printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));
559
560 KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1);
561 printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);
562
563 for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) {
564 nt_start_addr = va_space_resolve(&vs, KernBase);
565 if (!nt_start_addr) {
566 continue;
567 }
568
569 if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
570 printf("Checking candidate KernBase = 0x%016"PRIx64"\n", KernBase);
571 if (pe_check_pdb_name(KernBase, nt_start_addr, &vs, &rsds)) {
572 kernel_found = true;
573 break;
574 }
575 }
576 }
577
578 if (!kernel_found) {
579 eprintf("Failed to find NT kernel image\n");
580 goto out_ps;
581 }
582
583 printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
584 (char *)nt_start_addr);
585
586 pe_get_pdb_symstore_hash(&rsds, pdb_hash);
587
588 sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
589 printf("PDB URL is %s\n", pdb_url);
590
591 if (!download_url(PDB_NAME, pdb_url)) {
592 eprintf("Failed to download PDB file\n");
593 goto out_ps;
594 }
595
596 if (!pdb_init_from_file(PDB_NAME, &pdb)) {
597 eprintf("Failed to initialize PDB reader\n");
598 goto out_pdb_file;
599 }
600
601 if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
602 !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
603 goto out_pdb;
604 }
605
606 kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
607 if (!kdbg) {
608 goto out_pdb;
609 }
610
611 if (!fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
612 KdVersionBlock, qemu_elf.state_nr)) {
613 goto out_kdbg;
614 }
615
616 fill_context(kdbg, &vs, &qemu_elf);
617
618 if (!write_dump(&ps, &header, argv[2])) {
619 eprintf("Failed to save dump\n");
620 goto out_kdbg;
621 }
622
623 err = 0;
624
625 out_kdbg:
626 g_free(kdbg);
627 out_pdb:
628 pdb_exit(&pdb);
629 out_pdb_file:
630 unlink(PDB_NAME);
631 out_ps:
632 pa_space_destroy(&ps);
633 QEMU_Elf_exit(&qemu_elf);
634
635 return err;
636 }
637