DBGPlugInDarwin.cpp revision 2a2b173b54c259e34320ce0acf26f18e9382ce2a
/* $Id$ */
/** @file
* DBGPlugInDarwin - Debugger and Guest OS Digger Plugin For Darwin / OS X.
*/
/*
* Copyright (C) 2008-2013 Oracle Corporation
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* General Public License (GPL) as published by the Free Software
* Foundation, in version 2 as it comes in the "COPYING" file of the
* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
*/
/*******************************************************************************
* Header Files *
*******************************************************************************/
#include "DBGPlugIns.h"
/*******************************************************************************
* Structures and Typedefs *
*******************************************************************************/
/** @name Internal Darwin structures
* @{ */
/** @} */
/**
* Linux guest OS digger instance data.
*/
typedef struct DBGDIGGERDARWIN
{
/** Whether the information is valid or not.
* (For fending off illegal interface method calls.) */
bool fValid;
/** The address of an kernel version string (there are several).
* This is set during probing. */
/** Kernel base address.
* This is set during probing. */
/** Pointer to the linux guest OS digger instance data. */
typedef DBGDIGGERDARWIN *PDBGDIGGERDARWIN;
/*******************************************************************************
* Defined Constants And Macros *
*******************************************************************************/
/** Validates a 32-bit linux kernel address */
#define DARWIN32_VALID_ADDRESS(Addr) ((Addr) > UINT32_C(0x80000000) && (Addr) < UINT32_C(0xfffff000))
/** The max kernel size. */
#define DARWIN_MAX_KERNEL_SIZE 0x0f000000
/** AppleOsX on little endian ASCII systems. */
/*******************************************************************************
* Internal Functions *
*******************************************************************************/
/*******************************************************************************
* Global Variables *
*******************************************************************************/
/** Table of common linux kernel addresses. */
static uint64_t g_au64LnxKernelAddresses[] =
{
UINT64_C(0xc0100000),
UINT64_C(0x90100000),
UINT64_C(0xffffffff80200000)
};
/**
* @copydoc DBGFOSREG::pfnQueryInterface
*/
static DECLCALLBACK(void *) dbgDiggerDarwinQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
{
return NULL;
}
/**
* @copydoc DBGFOSREG::pfnQueryVersion
*/
static DECLCALLBACK(int) dbgDiggerDarwinQueryVersion(PUVM pUVM, void *pvData, char *pszVersion, size_t cchVersion)
{
/*
* It's all in the linux banner.
*/
if (RT_SUCCESS(rc))
{
while ( pszEnd > pszVersion
pszEnd--;
*pszEnd = '\0';
}
else
return rc;
}
/**
* @copydoc DBGFOSREG::pfnTerm
*/
{
}
/**
* @copydoc DBGFOSREG::pfnRefresh
*/
{
/*
* For now we'll flush and reload everything.
*/
}
/**
* Helper function that validates a segment (or section) name.
*
* @returns true if valid, false if not.
* @param pszName The name string.
* @param cbName The size of the string, including terminator.
*/
{
/* ascii chars */
char ch;
{
return false;
off++;
}
/* Not empty nor 100% full. */
return false;
/* remainder should be zeros. */
{
return false;
off++;
}
return true;
}
static int dbgDiggerDarwinAddModule(PDBGDIGGERDARWIN pThis, PUVM pUVM, uint64_t uModAddr, const char *pszName)
{
union
{
} uBuf;
/* Read the first page of the image. */
int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr), uBuf.ab, X86_PAGE_4K_SIZE);
if (RT_FAILURE(rc))
return rc;
/* Validate the header. */
return VERR_INVALID_EXE_SIGNATURE;
return VERR_LDR_ARCH_MISMATCH;
return VERR_BAD_EXE_FORMAT;
return VERR_BAD_EXE_FORMAT;
return VERR_BAD_EXE_FORMAT;
/* Do we need to read a 2nd page to get all the load commands? If so, do it. */
if (uBuf.Hdr32.sizeofcmds + (f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)) > X86_PAGE_4K_SIZE)
{
rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr + X86_PAGE_4K_SIZE),
if (RT_FAILURE(rc))
return rc;
}
/*
* Process the load commands.
*/
union
{
load_command_t const *pGenric;
segment_command_32_t const *pSeg32;
segment_command_64_t const *pSeg64;
section_32_t const *pSect32;
section_64_t const *pSect64;
symtab_command_t const *pSymTab;
uuid_command_t const *pUuid;
} uLCmd;
while (cLeft-- > 0)
{
return VERR_BAD_EXE_FORMAT;
{
case LC_SEGMENT_32:
return VERR_BAD_EXE_FORMAT;
return VERR_INVALID_NAME;
continue; /* This usually is discarded or not loaded at all. */
return VERR_BUFFER_OVERFLOW;
cSegs++;
break;
case LC_SEGMENT_64:
return VERR_BAD_EXE_FORMAT;
return VERR_INVALID_NAME;
continue; /* This usually is discarded or not loaded at all. */
return VERR_BUFFER_OVERFLOW;
cSegs++;
break;
case LC_UUID:
if (cbCmd != sizeof(uuid_command_t))
return VERR_BAD_EXE_FORMAT;
return VERR_BAD_EXE_FORMAT;
break;
default:
/* Current known max plus a lot of slack. */
return VERR_BAD_EXE_FORMAT;
break;
}
/* next */
}
if (cbLeft != 0)
return VERR_BAD_EXE_FORMAT;
/*
* Some post processing checks.
*/
break;
return VERR_ADDRESS_CONFLICT;
/*
* Create a debug module.
*/
rc = RTDbgModCreateFromMachOImage(&hMod, pszName, NULL, f64Bit ? RTLDRARCH_AMD64 : RTLDRARCH_X86_32, 0 /*cbImage*/,
if (RT_FAILURE(rc))
{
/*
* Final fallback is a container module.
*/
if (RT_FAILURE(rc))
return rc;
{
{
}
}
if (RT_FAILURE(rc))
{
return rc;
}
}
/* Tag the module. */
/*
* Link the module.
*/
if (hAs != NIL_RTDBGAS)
{
{
int rc2 = RTDbgAsModuleLinkSeg(hAs, hMod, iSeg, aSegs[iSeg].Address, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
if (RT_SUCCESS(rc2))
cLinked++;
else if (RT_SUCCESS(rc))
}
}
else
return rc;
}
/**
* @copydoc DBGFOSREG::pfnInit
*/
{
/*
* Add the kernel module (and later the other kernel modules we can find).
*/
if (RT_SUCCESS(rc))
{
/** @todo */
return VINF_SUCCESS;
}
return rc;
}
/**
* @copydoc DBGFOSREG::pfnProbe
*/
{
/*
* Look for a section + segment combo that normally only occures in
* mach_kernel. Follow it up with probing of the rest of the executable
* header. We must search a largish area because the more recent versions
* of darwin have random load address for security raisins.
*/
{
/* 64-bit: */
/* 32-bit - always search for this because of the hybrid 32-bit kernel
with cpu in long mode that darwin used for a number of versions. */
};
iRange++)
{
{
{
'_','_','t','e','x','t', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::sectname */
'_','_','K','L','D', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::segname. */
};
if (RT_FAILURE(rc))
break;
/*
* Read the first page of the image and check the headers.
*/
union
{
} uBuf;
if (RT_FAILURE(rc))
continue;
continue;
continue;
continue;
continue;
continue;
/* Seems good enough for now.
If the above causes false positives, check the segments and make
sure there is a kernel version string in the right one. */
/*
* Finally, find the kernel version string.
*/
rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, 32*_1M, 1, RT_STR_TUPLE("Darwin Kernel Version"),
if (RT_FAILURE(rc))
return true;
}
}
return false;
}
/**
* @copydoc DBGFOSREG::pfnDestruct
*/
{
}
/**
* @copydoc DBGFOSREG::pfnConstruct
*/
{
return VINF_SUCCESS;
}
const DBGFOSREG g_DBGDiggerDarwin =
{
/* .u32Magic = */ DBGFOSREG_MAGIC,
/* .fFlags = */ 0,
/* .cbData = */ sizeof(DBGDIGGERDARWIN),
/* .szName = */ "Darwin",
/* .pfnConstruct = */ dbgDiggerDarwinConstruct,
/* .pfnDestruct = */ dbgDiggerDarwinDestruct,
/* .pfnProbe = */ dbgDiggerDarwinProbe,
/* .pfnInit = */ dbgDiggerDarwinInit,
/* .pfnRefresh = */ dbgDiggerDarwinRefresh,
/* .pfnTerm = */ dbgDiggerDarwinTerm,
/* .pfnQueryVersion = */ dbgDiggerDarwinQueryVersion,
/* .pfnQueryInterface = */ dbgDiggerDarwinQueryInterface,
/* .u32EndMagic = */ DBGFOSREG_MAGIC
};