radare2/shlr/windbg/windbg.c
2018-07-14 10:45:55 +02:00

1104 lines
24 KiB
C

// Copyright (c) 2014-2017, The Lemon Man, All rights reserved. LGPLv3
#include <stdio.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdbool.h>
#include <string.h>
#include <r_util.h>
#include <r_list.h>
#include "transport.h"
#include "windbg.h"
#include "kd.h"
#define O_FLAG_XPVAD 1
#define WIND_DBG if (true)
#define O_(n) ctx->os_profile->f[n]
#include "profiles.h"
Profile *p_table[] = {
&XP_SP2_X86,
&XP_SP3_X86,
&WIN7_SP0_X86,
&WIN7_SP1_X86,
&WIN7_SP0_X64,
&WIN7_SP1_X64,
&VISTA_SP0_X86,
&VISTA_SP0_X64,
&VISTA_SP1_X86,
&VISTA_SP1_X64,
&VISTA_SP2_X86,
&VISTA_SP2_X64,
&WIN2003_SP0_X86,
&WIN2003_SP1_X86,
&WIN2003_SP1_X64,
&WIN2003_SP2_X86,
&WIN2003_SP2_X64,
&WIN10_RS1_X64, // Windows 10 (Anniversary Update)
&WIN10_RS4_X64, // Windows 10 (April 2018 Update)
NULL,
};
Profile *windbg_get_profile(int bits, int build, int sp) {
int i;
for (i = 0; p_table[i]; i++) {
if (p_table[i]->build != build) {
continue;
}
if (p_table[i]->sp != sp) {
continue;
}
if (p_table[i]->bits != bits) {
continue;
}
return p_table[i];
}
return NULL;
}
#define LOG_REQ(r) { \
eprintf ("Request : %08x\nProcessor : %08x\nReturn : %08x\n",\
(r)->req, \
(r)->cpu, \
(r)->ret \
); \
}
struct _WindCtx {
void *io_ptr;
uint32_t seq_id;
int syncd;
int cpu_count;
int cpu;
int pae;
int is_x64;
Profile *os_profile;
RList *plist_cache;
RList *tlist_cache;
ut64 dbg_addr;
WindProc *target;
};
int windbg_get_cpus(WindCtx *ctx) {
if (!ctx) {
return -1;
}
return ctx->cpu_count;
}
bool windbg_set_cpu(WindCtx *ctx, int cpu) {
if (!ctx || cpu > ctx->cpu_count) {
return false;
}
ctx->cpu = cpu;
return true;
}
int windbg_get_cpu(WindCtx *ctx) {
if (!ctx) {
return -1;
}
return ctx->cpu;
}
bool windbg_set_target(WindCtx *ctx, uint32_t pid) {
WindProc *p;
RListIter *it;
if (pid) {
RList *l = windbg_list_process (ctx);
r_list_foreach (l, it, p) {
if (p->uniqueid == pid) {
ctx->target = p;
return true;
}
}
return false;
}
ctx->target = NULL;
return true;
}
uint32_t windbg_get_target(WindCtx *ctx) {
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return 0;
}
return ctx->target? ctx->target->uniqueid: 0;
}
ut64 windbg_get_target_base(WindCtx *ctx) {
ut64 ppeb;
ut64 base = 0;
if (!ctx || !ctx->io_ptr || !ctx->syncd || !ctx->target) {
return 0;
}
if (!windbg_va_to_pa (ctx, ctx->target->peb, &ppeb)) {
return 0;
}
if (!windbg_read_at_phys (ctx, (uint8_t *) &base,
ppeb + O_(P_ImageBaseAddress), 4 << ctx->is_x64)) {
return 0;
}
return base;
}
WindCtx *windbg_ctx_new(void *io_ptr) {
WindCtx *ctx = calloc (1, sizeof(WindCtx));
if (!ctx) {
return NULL;
}
ctx->io_ptr = io_ptr;
return ctx;
}
void windbg_ctx_free(WindCtx *ctx) {
if (!ctx) {
return;
}
r_list_free (ctx->plist_cache);
r_list_free (ctx->tlist_cache);
iob_close (ctx->io_ptr);
free (ctx);
}
#define PKT_REQ(p) ((kd_req_t *) (((kd_packet_t *) p)->data))
#define PKT_STC(p) ((kd_stc_64 *) (((kd_packet_t *) p)->data))
#if 0
static void dump_stc(kd_packet_t *p) {
kd_stc_64 *stc = PKT_STC (p);
eprintf ("New state: %08x\n", stc->state);
eprintf ("EIP: 0x%016"PFMT64x " Kthread: 0x%016"PFMT64x "\n",
(ut64) stc->pc, (ut64) stc->kthread);
eprintf ("On cpu %i/%i\n", stc->cpu + 1, stc->cpu_count);
if (stc->state == DbgKdExceptionStateChange) {
eprintf ("Exception\n");
eprintf (" Code : %08x\n", stc->exception.code);
eprintf (" Flags : %08x\n", stc->exception.flags);
eprintf (" Record : %016"PFMT64x "\n", (ut64) stc->exception.ex_record);
eprintf (" Addr : %016"PFMT64x "\n", (ut64) stc->exception.ex_addr);
}
}
#endif
static int do_io_reply(WindCtx *ctx, kd_packet_t *pkt) {
kd_ioc_t ioc = {
0
};
int ret;
ioc.req = 0x3430;
ioc.ret = KD_RET_ENOENT;
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_FILE_IO,
(ctx->seq_id ^= 1), (uint8_t *) &ioc, sizeof (kd_ioc_t), NULL, 0);
if (ret != KD_E_OK) {
return false;
}
WIND_DBG eprintf("Waiting for io_reply ack...\n");
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return false;
}
WIND_DBG eprintf("Ack received, restore flow\n");
return true;
}
int windbg_wait_packet(WindCtx *ctx, const uint32_t type, kd_packet_t **p) {
kd_packet_t *pkt = NULL;
int ret;
int retries = 10;
do {
if (pkt) free (pkt);
// Try to read a whole packet
ret = kd_read_packet (ctx->io_ptr, &pkt);
if (ret != KD_E_OK) {
break;
}
// eprintf ("Received %08x\n", pkt->type);
if (pkt->type != type) {
eprintf ("We were not waiting for this... %08x\n", type);
}
if (pkt->leader == KD_PACKET_DATA && pkt->type == KD_PACKET_TYPE_STATE_CHANGE64) {
// dump_stc (pkt);
eprintf ("State64\n");
}
if (pkt->leader == KD_PACKET_DATA && pkt->type == KD_PACKET_TYPE_FILE_IO) {
eprintf ("Replying IO\n");
do_io_reply (ctx, pkt);
}
// Check for RESEND
// The host didn't like our request
if (pkt->leader == KD_PACKET_CTRL && pkt->type == KD_PACKET_TYPE_RESEND) {
r_sys_backtrace ();
eprintf ("Waoh. You probably sent a malformed packet !\n");
ret = KD_E_MALFORMED;
//break;
}
} while (pkt->type != type && retries--);
if (ret != KD_E_OK) {
free (pkt);
return ret;
}
if (p) {
*p = pkt;
} else {
free (pkt);
}
return KD_E_OK;
}
// http://dfrws.org/2007/proceedings/p62-dolan-gavitt.pdf
R_PACKED (
typedef struct {
char tag[4];
uint32_t start_vpn;
uint32_t end_vpn;
uint32_t parent;
uint32_t left;
uint32_t right;
uint32_t flags;
}) mmvad_short;
int windbg_walk_vadtree(WindCtx *ctx, ut64 address, ut64 parent) {
mmvad_short entry = { { 0 } };
ut64 start, end;
int prot;
if (windbg_read_at (ctx, (uint8_t *) &entry, address - 0x4, sizeof(mmvad_short)) != sizeof (mmvad_short)) {
eprintf ("0x%"PFMT64x " Could not read the node!\n", (ut64) address);
return 0;
}
if (parent != UT64_MAX && entry.parent != parent) {
eprintf ("Wrong parent!\n");
return 0;
}
start = entry.start_vpn << 12;
end = ((entry.end_vpn + 1) << 12) - 1;
prot = (entry.flags >> 24) & 0x1F;
eprintf ("Start 0x%016"PFMT64x " End 0x%016"PFMT64x " Prot 0x%08"PFMT64x "\n",
(ut64) start, (ut64) end, (ut64) prot);
if (entry.left) {
windbg_walk_vadtree (ctx, entry.left, address);
}
if (entry.right) {
windbg_walk_vadtree (ctx, entry.right, address);
}
return 1;
}
RList *windbg_list_process(WindCtx *ctx) {
RList *ret;
ut64 ptr, base;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return NULL;
}
if (ctx->plist_cache) {
return ctx->plist_cache;
}
ptr = 0;
// Grab the PsActiveProcessHead from _KDDEBUGGER_DATA64
windbg_read_at (ctx, (uint8_t *) &ptr, ctx->dbg_addr + K_PsActiveProcessHead,
4 << ctx->is_x64);
base = ptr;
WIND_DBG eprintf("Process list head : 0x%016"PFMT64x "\n", ptr);
// Walk the LIST_ENTRY
windbg_read_at (ctx, (uint8_t *) &ptr, ptr, 4 << ctx->is_x64);
ret = r_list_newf (free);
do {
uint8_t buf[17];
ut64 next;
next = 0;
// Read the ActiveProcessLinks entry
windbg_read_at (ctx, (uint8_t *) &next, ptr, 4 << ctx->is_x64);
// This points to the 'ActiveProcessLinks' list, adjust the ptr so that it point to the
// EPROCESS base
ptr -= O_(E_ActiveProcessLinks);
// Read the short name
windbg_read_at (ctx, (uint8_t *) &buf, ptr + O_(E_ImageFileName), 16);
buf[16] = '\0';
ut64 vadroot = 0;
ut64 uniqueid = 0;
ut64 peb = 0;
ut64 dir_base_table = 0;
windbg_read_at (ctx, (uint8_t *) &vadroot, ptr + O_(E_VadRoot), 4 << ctx->is_x64);
windbg_read_at (ctx, (uint8_t *) &uniqueid, ptr + O_(E_UniqueProcessId), 4 << ctx->is_x64);
windbg_read_at (ctx, (uint8_t *) &peb, ptr + O_(E_Peb), 4 << ctx->is_x64);
windbg_read_at (ctx, (uint8_t *) &dir_base_table, ptr + O_(P_DirectoryTableBase), 4 << ctx->is_x64);
WindProc *proc = calloc (1, sizeof(WindProc));
strcpy (proc->name, (const char *) buf);
proc->eprocess = ptr;
proc->vadroot = vadroot;
proc->uniqueid = uniqueid;
proc->dir_base_table = dir_base_table;
proc->peb = peb;
r_list_append (ret, proc);
// windbg_walk_vadtree(ctx, vadroot, -1);
ptr = next;
} while (ptr != base);
ctx->plist_cache = ret;
return ret;
}
RList *windbg_list_threads(WindCtx *ctx) {
RList *ret;
ut64 ptr, base;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return NULL;
}
if (ctx->tlist_cache) {
return ctx->tlist_cache;
}
if (!ctx->target) {
WIND_DBG eprintf ("No target process\n");
return NULL;
}
ptr = ctx->target->eprocess;
if (!ptr) {
WIND_DBG eprintf ("No _EPROCESS\n");
return NULL;
}
// Grab the ThreadListHead from _EPROCESS
windbg_read_at (ctx, (uint8_t *) &ptr, ptr + O_(E_ThreadListHead), 4 << ctx->is_x64);
if (!ptr) {
return NULL;
}
base = ptr;
ret = r_list_newf (free);
do {
ut64 next = 0;
windbg_read_at (ctx, (uint8_t *) &next, ptr, 4 << ctx->is_x64);
if (!next) {
WIND_DBG eprintf ("Corrupted ThreadListEntry found at: 0x%"PFMT64x"\n", ptr);
break;
}
// Adjust the ptr so that it points to the ETHREAD base
ptr -= O_(ET_ThreadListEntry);
ut64 entrypoint = 0;
windbg_read_at (ctx, (uint8_t *) &entrypoint, ptr + O_(ET_Win32StartAddress), 4 << ctx->is_x64);
ut64 uniqueid = 0;
windbg_read_at (ctx, (uint8_t *) &uniqueid, ptr + O_(ET_Cid) + O_(C_UniqueThread), 4 << ctx->is_x64);
if (uniqueid) {
WindThread *thread = calloc (1, sizeof(WindThread));
thread->uniqueid = uniqueid;
thread->status = 's';
thread->runnable = true;
thread->ethread = ptr;
thread->entrypoint = entrypoint;
r_list_append (ret, thread);
}
ptr = next;
} while (ptr != base);
ctx->tlist_cache = ret;
return ret;
}
#define PTE_VALID 0x0001
#define PTE_LARGEPAGE 0x0080
#define PTE_PROTOTYPE 0x0400
// http://blogs.msdn.com/b/ntdebugging/archive/2010/02/05/understanding-pte-part-1-let-s-get-physical.aspx
// http://blogs.msdn.com/b/ntdebugging/archive/2010/04/14/understanding-pte-part2-flags-and-large-pages.aspx
// http://blogs.msdn.com/b/ntdebugging/archive/2010/06/22/part-3-understanding-pte-non-pae-and-x64.aspx
bool windbg_va_to_pa(WindCtx *ctx, ut64 va, ut64 *pa) {
ut64 pml4i, pdpi, pdi, pti;
ut64 tmp, mask;
// We shouldn't really reach this
if (!ctx->target) {
return 0;
}
WIND_DBG eprintf("VA : %016"PFMT64x "\n", va);
if (ctx->is_x64) {
pti = (va >> 12) & 0x1ff;
pdi = (va >> 21) & 0x1ff;
pdpi = (va >> 30) & 0x1ff;
pml4i = (va >> 39) & 0x1ff;
// Grab the PageFrameNumber field off the _HARDWARE_PTE entry
mask = 0x000000fffffff000;
} else {
if (ctx->pae) {
pti = (va >> 12) & 0x1ff;
pdi = (va >> 21) & 0x1ff;
pdpi = (va >> 30) & 0x3;
pml4i = 0;
} else {
pti = (va >> 12) & 0x3ff;
pdi = (va >> 22) & 0x3ff;
pdpi = 0;
pml4i = 0;
}
// Grab the PageFrameNumber field off the _HARDWARE_PTE entry
mask = 0xfffff000;
}
tmp = ctx->target->dir_base_table;
tmp &= ~0x1f;
WIND_DBG eprintf("CR3 : %016"PFMT64x "\n", tmp);
if (ctx->is_x64) {
// PML4 lookup
if (!windbg_read_at_phys (ctx, (uint8_t *) &tmp, tmp + pml4i * 8, 8)) {
return false;
}
tmp &= mask;
WIND_DBG eprintf("PML4 : %016"PFMT64x "\n", tmp);
}
if (ctx->pae) {
// PDPT lookup
if (!windbg_read_at_phys (ctx, (uint8_t *) &tmp, tmp + pdpi * 8, 8)) {
return false;
}
tmp &= mask;
WIND_DBG eprintf("PDPE : %016"PFMT64x "\n", tmp);
}
// PDT lookup
if (!windbg_read_at_phys (ctx, (uint8_t *) &tmp, tmp + pdi * (4 << ctx->pae), 4 << ctx->pae)) {
return false;
}
WIND_DBG eprintf("PDE : %016"PFMT64x "\n", tmp);
// Large page entry
// The page size differs between pae and non-pae systems, the former points to 2MB pages while
// the latter points to 4MB pages
if (tmp & PTE_LARGEPAGE) {
*pa = ctx->pae?
(tmp & (~0x1fffff)) | (va & 0x1fffff):
(tmp & (~0x3fffff)) | (va & 0x3fffff);
return true;
}
// PT lookup
if (!windbg_read_at_phys (ctx, (uint8_t *) &tmp, (tmp & mask) + pti * (4 << ctx->pae), 4 << ctx->pae)) {
return false;
}
WIND_DBG eprintf("PTE : %016"PFMT64x "\n", tmp);
if (tmp & PTE_VALID) {
*pa = (tmp & mask) | (va & 0xfff);
return true;
}
if (tmp & PTE_PROTOTYPE) {
// TODO : prototype PTE support
eprintf ("Prototype PTE lookup is currently missing!\n");
}
return false;
}
bool windbg_read_ver(WindCtx *ctx) {
kd_req_t req = {
0
};
kd_packet_t *pkt;
int ret;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return false;
}
req.req = 0x3146;
req.cpu = ctx->cpu;
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE,
(ctx->seq_id ^= 1), (uint8_t *) &req, sizeof(kd_req_t), NULL, 0);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_MANIPULATE, &pkt);
if (ret != KD_E_OK) {
return 0;
}
kd_req_t *rr = PKT_REQ (pkt);
if (rr->ret) {
WIND_DBG eprintf("%s : req returned %08x\n", __FUNCTION__, rr->ret);
free (pkt);
return 0;
}
WIND_DBG {
eprintf ("Major : %i Minor %i\n", rr->r_ver.major, rr->r_ver.minor);
eprintf ("Protocol version : %i.%i\n", rr->r_ver.proto_major, rr->r_ver.proto_minor);
eprintf ("Flags : %08x\n", rr->r_ver.flags);
eprintf ("Machine : %08x\n", rr->r_ver.machine);
eprintf ("Module list : %016"PFMT64x "\n", (ut64) rr->r_ver.mod_addr);
eprintf ("Debug block : %016"PFMT64x "\n", (ut64) rr->r_ver.dbg_addr);
}
if (rr->r_ver.machine != KD_MACH_I386 && rr->r_ver.machine != KD_MACH_AMD64) {
eprintf ("Unsupported target host\n");
free (pkt);
return 0;
}
if (!(rr->r_ver.flags & DBGKD_VERS_FLAG_DATA)) {
eprintf ("No _KDDEBUGGER_DATA64 pointer has been supplied by the debugee!\n");
free (pkt);
return 0;
}
ctx->is_x64 = (rr->r_ver.machine == KD_MACH_AMD64);
ut64 ptr = 0;
if (!windbg_read_at (ctx, (uint8_t *) &ptr, rr->r_ver.dbg_addr, 4 << ctx->is_x64)) {
free (pkt);
return false;
}
ctx->dbg_addr = ptr;
WIND_DBG eprintf("_KDDEBUGGER_DATA64 at 0x%016"PFMT64x "\n", ctx->dbg_addr);
// Thanks to this we don't have to find a way to read the cr4
uint16_t pae_enabled;
if (!windbg_read_at (ctx, (uint8_t *) &pae_enabled, ctx->dbg_addr + K_PaeEnabled, sizeof(uint16_t))) {
free (pkt);
return false;
}
// Grab the CmNtCSDVersion field to extract the Service Pack number
windbg_read_at (ctx, (uint8_t *) &ptr, ctx->dbg_addr + K_CmNtCSDVersion, 8);
windbg_read_at (ctx, (uint8_t *) &ptr, ptr, 4 << ctx->is_x64);
ctx->pae = pae_enabled & 1;
ctx->os_profile = windbg_get_profile (32 << ctx->is_x64, rr->r_ver.minor, (ptr >> 8) & 0xff);
if (!ctx->os_profile) {
eprintf ("Could not find a suitable profile for the target OS\n");
free (pkt);
return false;
}
free (pkt);
return true;
}
int windbg_sync(WindCtx *ctx) {
int ret;
kd_packet_t *s;
if (!ctx || !ctx->io_ptr) {
return 0;
}
// Send the breakin packet
if (iob_write (ctx->io_ptr, (const uint8_t *) "b", 1) != 1) {
return 0;
}
// Reset the host
ret = kd_send_ctrl_packet (ctx->io_ptr, KD_PACKET_TYPE_RESET, 0);
if (ret != KD_E_OK) {
return 0;
}
// Wait for the response
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_RESET, NULL);
if (ret != KD_E_OK) {
return 0;
}
// Syncronize with the first KD_PACKET_TYPE_STATE_CHANGE64 packet
windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_CHANGE64, &s);
// Reset the sequence id
ctx->seq_id = 0x80800001;
kd_stc_64 *stc64 = (kd_stc_64*)s->data;
ctx->cpu = stc64->cpu;
ctx->cpu_count = stc64->cpu_count;
ctx->target = NULL;
r_list_free (ctx->plist_cache);
ctx->plist_cache = NULL;
r_list_free (ctx->tlist_cache);
ctx->tlist_cache = NULL;
ctx->pae = 0;
// We're ready to go
ctx->syncd = 1;
free (s);
eprintf ("Sync done! (%i cpus found)\n", ctx->cpu_count);
return 1;
}
int windbg_continue(WindCtx *ctx) {
kd_req_t req = {
0
};
int ret;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return 0;
}
req.req = DbgKdContinueApi2;
req.cpu = ctx->cpu;
req.r_cont.reason = 0x10001;
// The meaning of 0x400 is unknown, but Windows doesn't
// behave like suggested by ReactOS source
req.r_cont.tf = 0x400;
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE,
(ctx->seq_id ^= 1), (uint8_t *) &req, sizeof (kd_req_t), NULL, 0);
if (ret == KD_E_OK) {
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret == KD_E_OK) {
// XXX What about DbgKdContinueApi ?
r_list_free (ctx->plist_cache);
ctx->plist_cache = NULL;
return true;
}
}
return false;
}
bool windbg_write_reg(WindCtx *ctx, const uint8_t *buf, int size) {
kd_packet_t *pkt;
kd_req_t req = {
0
};
int ret;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return false;
}
req.req = DbgKdSetContextApi;
req.cpu = ctx->cpu;
req.r_ctx.flags = 0x1003F;
WIND_DBG eprintf("Regwrite() size: %x\n", size);
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE,
(ctx->seq_id ^= 1), (uint8_t *) &req, sizeof(kd_req_t), buf, size);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_MANIPULATE, &pkt);
if (ret != KD_E_OK) {
return 0;
}
kd_req_t *rr = PKT_REQ (pkt);
if (rr->ret) {
WIND_DBG eprintf("%s: req returned %08x\n", __FUNCTION__, rr->ret);
free (pkt);
return 0;
}
free (pkt);
return size;
}
int windbg_read_reg(WindCtx *ctx, uint8_t *buf, int size) {
kd_req_t req;
kd_packet_t *pkt;
int ret;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return 0;
}
memset (&req, 0, sizeof(kd_req_t));
req.req = DbgKdGetContextApi;
req.cpu = ctx->cpu;
req.r_ctx.flags = 0x1003F;
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE, (ctx->seq_id ^= 1), (uint8_t *) &req,
sizeof(kd_req_t), NULL, 0);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_MANIPULATE, &pkt);
if (ret != KD_E_OK) {
return 0;
}
kd_req_t *rr = PKT_REQ (pkt);
if (rr->ret) {
WIND_DBG eprintf("%s: req returned %08x\n", __FUNCTION__, rr->ret);
free (pkt);
return 0;
}
memcpy (buf, rr->data, size);
free (pkt);
return size;
}
int windbg_query_mem(WindCtx *ctx, const ut64 addr, int *address_space, int *flags) {
kd_req_t req;
kd_packet_t *pkt;
int ret;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return 0;
}
memset (&req, 0, sizeof(kd_req_t));
req.req = DbgKdQueryMemoryApi;
req.cpu = ctx->cpu;
req.r_query_mem.addr = addr;
req.r_query_mem.address_space = 0; // Tells the kernel that 'addr' is a virtual address
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE, (ctx->seq_id ^= 1), (uint8_t *) &req,
sizeof(kd_req_t), NULL, 0);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_MANIPULATE, &pkt);
if (ret != KD_E_OK) {
return 0;
}
kd_req_t *rr = PKT_REQ (pkt);
if (rr->ret) {
free (pkt);
return 0;
}
if (address_space) {
*address_space = rr->r_query_mem.address_space;
}
if (flags) {
*flags = rr->r_query_mem.flags;
}
free (pkt);
return ret;
}
int windbg_bkpt(WindCtx *ctx, const ut64 addr, const int set, const int hw, int *handle) {
kd_req_t req = {
0
};
kd_packet_t *pkt;
int ret;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return 0;
}
req.req = set? DbgKdWriteBreakPointApi: DbgKdRestoreBreakPointApi;
req.cpu = ctx->cpu;
if (set) {
req.r_set_bp.addr = addr;
} else {
req.r_del_bp.handle = *handle;
}
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE, (ctx->seq_id ^= 1), (uint8_t *) &req,
sizeof(kd_req_t), NULL, 0);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_MANIPULATE, &pkt);
if (ret != KD_E_OK) {
return 0;
}
kd_req_t *rr = PKT_REQ (pkt);
if (rr->ret) {
free (pkt);
return 0;
}
*handle = rr->r_set_bp.handle;
ret = !!rr->ret;
free (pkt);
return ret;
}
int windbg_read_at_phys(WindCtx *ctx, uint8_t *buf, const ut64 offset, const int count) {
kd_req_t req = {
0
}, *rr;
kd_packet_t *pkt;
int ret;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return 0;
}
req.req = DbgKdReadPhysicalMemoryApi;
req.cpu = ctx->cpu;
req.r_mem.addr = offset;
req.r_mem.length = R_MIN (count, KD_MAX_PAYLOAD);
req.r_mem.read = 0; // Default caching option
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE, (ctx->seq_id ^= 1),
(uint8_t *) &req, sizeof(kd_req_t), NULL, 0);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_MANIPULATE, &pkt);
if (ret != KD_E_OK) {
return 0;
}
rr = PKT_REQ (pkt);
if (rr->ret) {
free (pkt);
return 0;
}
memcpy (buf, rr->data, rr->r_mem.read);
ret = rr->r_mem.read;
free (pkt);
return ret;
}
int windbg_read_at(WindCtx *ctx, uint8_t *buf, const ut64 offset, const int count) {
kd_req_t *rr, req = {
0
};
kd_packet_t *pkt;
int ret;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return 0;
}
req.req = DbgKdReadVirtualMemoryApi;
req.cpu = ctx->cpu;
req.r_mem.addr = offset;
req.r_mem.length = R_MIN (count, KD_MAX_PAYLOAD);
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE,
(ctx->seq_id ^= 1), (uint8_t *) &req, sizeof(kd_req_t), NULL, 0);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_MANIPULATE, &pkt);
if (ret != KD_E_OK) {
return 0;
}
rr = PKT_REQ (pkt);
if (rr->ret) {
free (pkt);
return 0;
}
memcpy (buf, rr->data, rr->r_mem.read);
ret = rr->r_mem.read;
free (pkt);
return ret;
}
int windbg_write_at(WindCtx *ctx, const uint8_t *buf, const ut64 offset, const int count) {
kd_packet_t *pkt;
kd_req_t req = {
0
}, *rr;
int payload, ret;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return 0;
}
payload = R_MIN (count, KD_MAX_PAYLOAD - sizeof(kd_req_t));
req.req = DbgKdWriteVirtualMemoryApi;
req.cpu = ctx->cpu;
req.r_mem.addr = offset;
req.r_mem.length = payload;
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE,
(ctx->seq_id ^= 1), (uint8_t *) &req,
sizeof(kd_req_t), buf, payload);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_MANIPULATE, &pkt);
if (ret != KD_E_OK) {
return 0;
}
rr = PKT_REQ (pkt);
if (rr->ret) {
free (pkt);
return 0;
}
ret = rr->r_mem.read;
free (pkt);
return ret;
}
int windbg_write_at_phys(WindCtx *ctx, const uint8_t *buf, const ut64 offset, const int count) {
kd_packet_t *pkt;
kd_req_t req;
int ret;
int payload;
if (!ctx || !ctx->io_ptr || !ctx->syncd) {
return 0;
}
payload = R_MIN (count, KD_MAX_PAYLOAD - sizeof(kd_req_t));
memset (&req, 0, sizeof(kd_req_t));
req.req = DbgKdWritePhysicalMemoryApi;
req.cpu = ctx->cpu;
req.r_mem.addr = offset;
req.r_mem.length = payload;
req.r_mem.read = 0; // Default caching option
ret = kd_send_data_packet (ctx->io_ptr, KD_PACKET_TYPE_STATE_MANIPULATE,
(ctx->seq_id ^= 1), (uint8_t *) &req, sizeof(kd_req_t), buf, payload);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_ACKNOWLEDGE, NULL);
if (ret != KD_E_OK) {
return 0;
}
ret = windbg_wait_packet (ctx, KD_PACKET_TYPE_STATE_MANIPULATE, &pkt);
if (ret != KD_E_OK) {
return 0;
}
kd_req_t *rr = PKT_REQ (pkt);
if (rr->ret) {
free (pkt);
return 0;
}
ret = rr->r_mem.read;
free (pkt);
return ret;
}
bool windbg_break(WindCtx *ctx) {
return iob_write (ctx->io_ptr, (const uint8_t *) "b", 1) == 1;
}
int windbg_break_read(WindCtx *ctx) {
#if __WINDOWS__ && !defined(_MSC_VER)
static BOOL WINAPI (*w32_CancelIoEx)(HANDLE, LPOVERLAPPED) = NULL;
if (!w32_CancelIoEx) {
w32_CancelIoEx = (BOOL WINAPI (*)(HANDLE, LPOVERLAPPED))
GetProcAddress (GetModuleHandle (TEXT ("kernel32")),
"CancelIoEx");
}
if (w32_CancelIoEx) {
w32_CancelIoEx (ctx->io_ptr, NULL);
}
#endif
return 1;
}