DBGPlugInDarwin.cpp revision a2ef8e11a034b72f427ba7a9ceff03abf2144b83
/* $Id$ */
/** @file
* DBGPlugInDarwin - Debugger and Guest OS Digger Plugin For Darwin / OS X.
*/
/*
* Copyright (C) 2008-2013 Oracle Corporation
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* General Public License (GPL) as published by the Free Software
* Foundation, in version 2 as it comes in the "COPYING" file of the
* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
*/
/*******************************************************************************
* Header Files *
*******************************************************************************/
#include "DBGPlugIns.h"
/*******************************************************************************
* Structures and Typedefs *
*******************************************************************************/
/** @name Internal Darwin structures
* @{ */
/**
* 32-bit darwin kernel module info structure (kmod_info_t).
*/
typedef struct OSX32_kmod_info
{
char name[64];
char version[64];
/**
* 32-bit darwin kernel module info structure (kmod_info_t).
*/
#pragma pack(1)
typedef struct OSX64_kmod_info
{
char name[64];
char version[64];
#pragma pack()
/** The value of the info_version field. */
/** @} */
/**
* Linux guest OS digger instance data.
*/
typedef struct DBGDIGGERDARWIN
{
/** Whether the information is valid or not.
* (For fending off illegal interface method calls.) */
bool fValid;
/** The address of an kernel version string (there are several).
* This is set during probing. */
/** Kernel base address.
* This is set during probing. */
/** Pointer to the linux guest OS digger instance data. */
typedef DBGDIGGERDARWIN *PDBGDIGGERDARWIN;
/*******************************************************************************
* Defined Constants And Macros *
*******************************************************************************/
/** Validates a 32-bit darwin kernel address */
/** Validates a 64-bit darwin kernel address */
#define OSX64_VALID_ADDRESS(Addr) ((Addr) > UINT64_C(0xffff800000000000) && (Addr) < UINT64_C(0xfffffffffffff000))
/** Validates a 32-bit or 64-bit darwin kernel address. */
/** AppleOsX on little endian ASCII systems. */
/*******************************************************************************
* Internal Functions *
*******************************************************************************/
/**
* @copydoc DBGFOSREG::pfnQueryInterface
*/
static DECLCALLBACK(void *) dbgDiggerDarwinQueryInterface(PUVM pUVM, void *pvData, DBGFOSINTERFACE enmIf)
{
return NULL;
}
/**
* @copydoc DBGFOSREG::pfnQueryVersion
*/
static DECLCALLBACK(int) dbgDiggerDarwinQueryVersion(PUVM pUVM, void *pvData, char *pszVersion, size_t cchVersion)
{
/*
* It's all in the linux banner.
*/
if (RT_SUCCESS(rc))
{
while ( pszEnd > pszVersion
pszEnd--;
*pszEnd = '\0';
}
else
return rc;
}
/**
* @copydoc DBGFOSREG::pfnTerm
*/
{
}
/**
* @copydoc DBGFOSREG::pfnRefresh
*/
{
/*
* For now we'll flush and reload everything.
*/
}
/**
* Helper function that validates a segment (or section) name.
*
* @returns true if valid, false if not.
* @param pszName The name string.
* @param cbName The size of the string, including terminator.
*/
{
/* ascii chars */
char ch;
{
return false;
off++;
}
/* Not empty nor 100% full. */
return false;
/* remainder should be zeros. */
{
return false;
off++;
}
return true;
}
static int dbgDiggerDarwinAddModule(PDBGDIGGERDARWIN pThis, PUVM pUVM, uint64_t uModAddr, const char *pszName, bool *pf64Bit)
{
union
{
} uBuf;
/* Read the first page of the image. */
int rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr), uBuf.ab, X86_PAGE_4K_SIZE);
if (RT_FAILURE(rc))
return rc;
/* Validate the header. */
return VERR_INVALID_EXE_SIGNATURE;
return VERR_LDR_ARCH_MISMATCH;
return VERR_BAD_EXE_FORMAT;
return VERR_BAD_EXE_FORMAT;
return VERR_BAD_EXE_FORMAT;
/* Do we need to read a 2nd page to get all the load commands? If so, do it. */
if (uBuf.Hdr32.sizeofcmds + (f64Bit ? sizeof(mach_header_64_t) : sizeof(mach_header_32_t)) > X86_PAGE_4K_SIZE)
{
rc = DBGFR3MemRead(pUVM, 0 /*idCpu*/, DBGFR3AddrFromFlat(pUVM, &ModAddr, uModAddr + X86_PAGE_4K_SIZE),
if (RT_FAILURE(rc))
return rc;
}
/*
* Process the load commands.
*/
union
{
load_command_t const *pGenric;
segment_command_32_t const *pSeg32;
segment_command_64_t const *pSeg64;
section_32_t const *pSect32;
section_64_t const *pSect64;
symtab_command_t const *pSymTab;
uuid_command_t const *pUuid;
} uLCmd;
while (cLeft-- > 0)
{
return VERR_BAD_EXE_FORMAT;
{
case LC_SEGMENT_32:
return VERR_BAD_EXE_FORMAT;
return VERR_INVALID_NAME;
break; /* This usually is discarded or not loaded at all. */
return VERR_BUFFER_OVERFLOW;
cSegs++;
break;
case LC_SEGMENT_64:
return VERR_BAD_EXE_FORMAT;
return VERR_INVALID_NAME;
break; /* This usually is discarded or not loaded at all. */
return VERR_BUFFER_OVERFLOW;
cSegs++;
break;
case LC_UUID:
if (cbCmd != sizeof(uuid_command_t))
return VERR_BAD_EXE_FORMAT;
return VERR_BAD_EXE_FORMAT;
break;
default:
/* Current known max plus a lot of slack. */
return VERR_BAD_EXE_FORMAT;
break;
}
/* next */
}
if (cbLeft != 0)
return VERR_BAD_EXE_FORMAT;
/*
* Some post processing checks.
*/
break;
return VERR_ADDRESS_CONFLICT;
/*
* Create a debug module.
*/
rc = RTDbgModCreateFromMachOImage(&hMod, pszName, NULL, f64Bit ? RTLDRARCH_AMD64 : RTLDRARCH_X86_32, 0 /*cbImage*/,
if (RT_FAILURE(rc))
{
/*
* Final fallback is a container module.
*/
if (RT_FAILURE(rc))
return rc;
{
{
}
}
if (RT_FAILURE(rc))
{
return rc;
}
}
/* Tag the module. */
/*
* Link the module.
*/
if (hAs != NIL_RTDBGAS)
{
while (iSeg-- > 0) /* HACK: Map in reverse order to avoid replacing __TEXT. */
{
/* Find matching segment in the debug module. */
{
break;
iDbgSeg++;
}
/* Map it. */
int rc2 = RTDbgAsModuleLinkSeg(hAs, hMod, iDbgSeg, aSegs[iSeg].Address, RTDBGASLINK_FLAGS_REPLACE /*fFlags*/);
if (RT_SUCCESS(rc2))
cLinked++;
else if (RT_SUCCESS(rc))
}
}
else
if (pf64Bit)
return rc;
}
static bool dbgDiggerDarwinIsValidName(const char *pszName)
{
char ch;
{
return false;
}
return true;
}
static bool dbgDiggerDarwinIsValidVersion(const char *pszVersion)
{
char ch;
{
return false;
}
return true;
}
/**
* @copydoc DBGFOSREG::pfnInit
*/
{
/*
* Add the kernel module.
*/
bool f64Bit;
if (RT_SUCCESS(rc))
{
/*
* The list of modules can be found at the 'kmod' symbol, that means
* that we currently require some kind of symbol file for the kernel
* to be loaded at this point.
*
* Note! Could also use the 'gLoadedKextSummaries', but I don't think
* it's any easier to find without any kernel map than 'kmod'.
*/
if (RT_FAILURE(rc))
if (RT_SUCCESS(rc))
{
/* Read the variable. */
RTUINT64U uKmodValue = { 0 };
if (f64Bit)
else
if (RT_SUCCESS(rc))
{
/* Walk the list of modules. */
uint32_t cIterations = 0;
while (AddrModInfo.FlatPtr != 0)
{
/* Some extra loop conditions... */
{
break;
}
{
Log(("OSXDig: kmod_info list looped back to the start.\n"));
break;
}
if (cIterations++ >= 2048)
{
break;
}
/*
* Read the kmod_info_t structure.
*/
union
{
} uMod;
if (RT_FAILURE(rc))
{
break;
}
/*
* Validate the kmod_info_t structure.
*/
if (iInfoVer != OSX_KMOD_INFO_VERSION)
{
break;
}
if ( !*pszName
{
break;
}
{
break;
}
{
break;
}
{
break;
}
{
break;
}
{
break;
}
{
break;
}
{
break;
}
/*
* Try add the module.
*/
Log(("OSXDig: kmod_info @%RGv: '%s' ver '%s', image @%#llx LB %#llx cbHdr=%#llx\n", AddrModInfo.FlatPtr,
/*
* Advance to the next kmod_info entry.
*/
}
}
else
}
else
Log(("OSXDig: Failed to locate the 'kmod' variable in mach_kernel.\n"));
return VINF_SUCCESS;
}
return rc;
}
/**
* @copydoc DBGFOSREG::pfnProbe
*/
{
/*
* Look for a section + segment combo that normally only occures in
* mach_kernel. Follow it up with probing of the rest of the executable
* header. We must search a largish area because the more recent versions
* of darwin have random load address for security raisins.
*/
{
/* 64-bit: */
/* 32-bit - always search for this because of the hybrid 32-bit kernel
with cpu in long mode that darwin used for a number of versions. */
};
iRange++)
{
{
{
'_','_','t','e','x','t', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::sectname */
'_','_','K','L','D', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* section_32_t::segname. */
};
if (RT_FAILURE(rc))
break;
/*
* Read the first page of the image and check the headers.
*/
union
{
} uBuf;
if (RT_FAILURE(rc))
continue;
continue;
continue;
continue;
continue;
continue;
/* Seems good enough for now.
If the above causes false positives, check the segments and make
sure there is a kernel version string in the right one. */
/*
* Finally, find the kernel version string.
*/
rc = DBGFR3MemScan(pUVM, 0 /*idCpu*/, &KernelAddr, 32*_1M, 1, RT_STR_TUPLE("Darwin Kernel Version"),
if (RT_FAILURE(rc))
return true;
}
}
return false;
}
/**
* @copydoc DBGFOSREG::pfnDestruct
*/
{
}
/**
* @copydoc DBGFOSREG::pfnConstruct
*/
{
return VINF_SUCCESS;
}
const DBGFOSREG g_DBGDiggerDarwin =
{
/* .u32Magic = */ DBGFOSREG_MAGIC,
/* .fFlags = */ 0,
/* .cbData = */ sizeof(DBGDIGGERDARWIN),
/* .szName = */ "Darwin",
/* .pfnConstruct = */ dbgDiggerDarwinConstruct,
/* .pfnDestruct = */ dbgDiggerDarwinDestruct,
/* .pfnProbe = */ dbgDiggerDarwinProbe,
/* .pfnInit = */ dbgDiggerDarwinInit,
/* .pfnRefresh = */ dbgDiggerDarwinRefresh,
/* .pfnTerm = */ dbgDiggerDarwinTerm,
/* .pfnQueryVersion = */ dbgDiggerDarwinQueryVersion,
/* .pfnQueryInterface = */ dbgDiggerDarwinQueryInterface,
/* .u32EndMagic = */ DBGFOSREG_MAGIC
};