windows-x64.c File Reference

#include <rz_debug.h>
#include <mdmp_windefs.h>
#include <librz/bin/format/pe/pe64.h>

Go to the source code of this file.

Macros
#define	CMP(x, y)   (st64)((st64)x - ((PE64_RUNTIME_FUNCTION *)y)->EndAddress)
#define	READ_AT(address, buf, size)   dbg->iob.read_at(dbg->iob.io, address, buf, size)

Functions
static int	is_pc_inside_module (const void *value, const void *list_data)
static bool	init_module_runtime_functions (RzDebug *dbg, RzVector *functions, ut64 module_base)
static ut64	read_register (RzDebug *dbg, ut64 at)
static ut32	read_slot32 (RzDebug *dbg, PE64_UNWIND_INFO *info, int *index)
static ut16	read_slot16 (RzDebug *dbg, PE64_UNWIND_INFO *info, int *index)
static ut64	get_frame_base (const PE64_UNWIND_INFO *info, const struct context_type_amd64 *context, const ut64 function_address)
static PE64_UNWIND_INFO *	read_unwind_info (RzDebug *dbg, ut64 at)
static bool	unwind_function (RzDebug *dbg, RzDebugFrame *frame, PE64_RUNTIME_FUNCTION *rfcn, struct context_type_amd64 *context, const ut64 module_address, const ut64 function_address)
static bool	backtrace_windows_x64 (RZ_IN RzDebug *dbg, RZ_INOUT RzList **out_frames, RZ_INOUT struct context_type_amd64 *context)

Macro Definition Documentation

CMP

#define CMP	(		x,
			y
	)		(st64)((st64)x - ((PE64_RUNTIME_FUNCTION *)y)->EndAddress)

Definition at line 14 of file windows-x64.c.

READ_AT

#define READ_AT	(		address,
			buf,
			size
	)		dbg->iob.read_at(dbg->iob.io, address, buf, size)

Definition at line 15 of file windows-x64.c.

Function Documentation

backtrace_windows_x64()

static bool backtrace_windows_x64 ( RZ_IN RzDebug *  dbg, RZ_INOUT RzList **  out_frames, RZ_INOUT struct context_type_amd64 *  context  )

static

Definition at line 273 of file windows-x64.c.

                                                                                                                                 {
    RzList *frames = *out_frames ? *out_frames : rz_list_newf(free);
    *out_frames = frames;
    if (!frames) {
        return true;
    }
    RzList *modules = rz_debug_modules_list(dbg);
    if (!modules) {
        return true;
    }
    if (!context->rsp) {
        int arena_size;
        ut8 *arena = rz_reg_get_bytes(dbg->reg, RZ_REG_TYPE_GPR, &arena_size);
        if (!arena || arena_size < sizeof(*context)) {
            rz_list_free(modules);
            free(arena);
            return true;
        }
        memcpy(context, arena, sizeof(*context));
        free(arena);
    }
    RzDebugMap *last_module = NULL;
    RzVector functions;
    rz_vector_init(&functions, 0, NULL, NULL);
    bool ret = true;
    while (true) {
        RzDebugFrame *frame = RZ_NEW0(RzDebugFrame);
        if (!frame) {
            break;
        }
        frame->addr = context->rip;
        frame->sp = context->rsp;
        rz_list_append(frames, frame);
 
        // Find in which module current rip is
        RzListIter *it = rz_list_find(modules, &context->rip, is_pc_inside_module);
        if (!it) {
            // Either broken stack or module info not avalable (PEB paged out, etc)
            break;
        }
        RzDebugMap *module = rz_list_iter_get_data(it);
        if (!module) {
            // Should never happen
            break;
        }
        if (module != last_module) {
            // Read runtime function entries for module
            if (!init_module_runtime_functions(dbg, &functions, module->addr)) {
                ret = false;
                break;
            }
            last_module = module;
        }
        int index;
        const ut64 offset_from_base = context->rip - module->addr;
        rz_vector_upper_bound(&functions, offset_from_base, index, CMP);
        if (index == rz_vector_len(&functions)) {
            // Leaf function
            frame->size = 0;
            context->rip = read_register(dbg, context->rsp);
            context->rsp += 8;
        } else {
            // Not a leaf function
            PE64_RUNTIME_FUNCTION *rfcn = rz_vector_index_ptr(&functions, index);
            ut64 function_address = module->addr + rfcn->BeginAddress;
            for (index--; function_address > context->rip && index >= 0; index--) {
                rfcn = rz_vector_index_ptr(&functions, index);
                function_address = module->addr + rfcn->BeginAddress;
            }
            if (index < 0 && function_address > context->rip) {
                ret = false;
                break;
            }
            if (!unwind_function(dbg, frame, rfcn, context, module->addr, function_address)) {
                break;
            }
        }
    }
    if (!ret) {
        free(rz_list_pop(frames));
    }
    rz_list_free(modules);
    rz_vector_fini(&functions);
    return ret;
}

References rz_debug_frame_t::addr, PE64_RUNTIME_FUNCTION::BeginAddress, CMP, dbg, free(), init_module_runtime_functions(), is_pc_inside_module(), memcpy(), regress::modules, NULL, read_register(), rz_debug_t::reg, rz_debug_modules_list(), rz_list_append(), rz_list_find(), rz_list_free(), rz_list_iter_get_data(), rz_list_newf(), rz_list_pop(), RZ_NEW0, rz_reg_get_bytes(), RZ_REG_TYPE_GPR, rz_vector_fini(), rz_vector_index_ptr(), rz_vector_init(), rz_vector_len(), rz_vector_upper_bound, rz_debug_frame_t::size, rz_debug_frame_t::sp, unwind_function(), and ut64().

Referenced by rz_debug_dmp_frames(), and rz_debug_winkd_frames().

get_frame_base()

static ut64 get_frame_base ( const PE64_UNWIND_INFO *  info, const struct context_type_amd64 *  context, const ut64  function_address  )

inlinestatic

Definition at line 87 of file windows-x64.c.

                                                                                                                                       {
    const ut64 rip_offset_to_function = context->rip - function_address;
    const ut64 *integer_registers = &context->rax;
    if (!info->FrameRegister) {
        // There is no register being used as the frame base, use rsp
        return context->rsp;
    } else if ((rip_offset_to_function >= info->SizeOfProlog) || ((info->Flags & PE64_UNW_FLAG_CHAININFO) != 0)) {
        // There is a register being used as a frame base, and we definetly already set it
        return integer_registers[info->FrameRegister] - info->FrameOffset * 16;
    } else {
        // There is a register being used as a frame base, unknown if we set it yet
        int i;
        // Find unwind of where frame register is being set
        for (i = 0; i < info->CountOfCodes; i++) {
            if (info->UnwindCode[i].UnwindOp == UWOP_SET_FPREG) {
                break;
            }
        }
        // Check if we already set the frame register
        if (rip_offset_to_function >= info->UnwindCode[i].CodeOffset) {
            return integer_registers[info->FrameRegister] - info->FrameOffset * 16;
        } else {
            return context->rsp;
        }
    }
}

References i, info(), PE64_UNW_FLAG_CHAININFO, ut64(), and UWOP_SET_FPREG.

Referenced by unwind_function().

init_module_runtime_functions()

static bool init_module_runtime_functions ( RzDebug *  dbg, RzVector *  functions, ut64  module_base  )

inlinestatic

Definition at line 17 of file windows-x64.c.

                                                                                                      {
    ut8 buf[4];
 
    const ut64 lfanew_offset = module_base + rz_offsetof(Pe64_image_dos_header, e_lfanew);
    READ_AT(lfanew_offset, buf, sizeof(buf));
    const ut64 pe_offset = module_base + rz_read_le32(buf);
 
    const ut64 exception_entry_offset = pe_offset + rz_offsetof(Pe64_image_nt_headers, optional_header.DataDirectory[PE_IMAGE_DIRECTORY_ENTRY_EXCEPTION]);
    READ_AT(exception_entry_offset, buf, sizeof(buf));
    const ut64 exception_table_va = module_base + rz_read_le32(buf);
 
    READ_AT(exception_entry_offset + 4, buf, sizeof(buf));
    const ut32 exception_table_size = rz_read_le32(buf);
    if (!exception_table_size || exception_table_size == UT32_MAX) {
        return false;
    }
 
    ut8 *section = malloc(exception_table_size);
    if (!section) {
        return false;
    }
 
    rz_vector_fini(functions);
    rz_vector_init(functions, sizeof(PE64_RUNTIME_FUNCTION), NULL, NULL);
    if (!rz_vector_reserve(functions, exception_table_size / sizeof(PE64_RUNTIME_FUNCTION))) {
        rz_vector_fini(functions);
        free(section);
        return false;
    }
 
    if (!READ_AT(exception_table_va, section, exception_table_size)) {
        rz_vector_fini(functions);
        free(section);
        return false;
    }
 
    ut64 offset;
    for (offset = 0; offset < exception_table_size; offset += sizeof(PE64_RUNTIME_FUNCTION)) {
        PE64_RUNTIME_FUNCTION rfcn;
        rfcn.BeginAddress = rz_read_le32(section + offset + rz_offsetof(PE64_RUNTIME_FUNCTION, BeginAddress));
        rfcn.EndAddress = rz_read_le32(section + offset + rz_offsetof(PE64_RUNTIME_FUNCTION, EndAddress));
        rfcn.UnwindData = rz_read_le32(section + offset + rz_offsetof(PE64_RUNTIME_FUNCTION, UnwindData));
        if (!rfcn.BeginAddress) {
            break;
        }
        rz_vector_push(functions, &rfcn);
    }
    free(section);
    return true;
}

References PE64_RUNTIME_FUNCTION::BeginAddress, patch_major_os_version::e_lfanew, PE64_RUNTIME_FUNCTION::EndAddress, free(), malloc(), NULL, PE_IMAGE_DIRECTORY_ENTRY_EXCEPTION, READ_AT, rz_offsetof, rz_read_le32(), rz_vector_fini(), rz_vector_init(), rz_vector_push(), rz_vector_reserve(), PE64_RUNTIME_FUNCTION::UnwindData, UT32_MAX, and ut64().

Referenced by backtrace_windows_x64().

is_pc_inside_module()

static int is_pc_inside_module ( const void *  value, const void *  list_data  )

static

Definition at line 8 of file windows-x64.c.

                                                                         {
    const ut64 pc = *(const ut64 *)value;
    const RzDebugMap *module = list_data;
    return !(pc >= module->addr && pc < module->addr_end);
}

References pc, ut64(), and value.

Referenced by backtrace_windows_x64().

read_register()

static ut64 read_register ( RzDebug *  dbg, ut64  at  )

inlinestatic

Definition at line 68 of file windows-x64.c.

                                                        {
    ut8 buf[8];
    dbg->iob.read_at(dbg->iob.io, at, buf, sizeof(buf));
    return rz_read_le64(buf);
}

References dbg, rz_io_bind_t::io, rz_debug_t::iob, rz_io_bind_t::read_at, and rz_read_le64().

Referenced by backtrace_windows_x64(), and unwind_function().

read_slot16()

static ut16 read_slot16 ( RzDebug *  dbg, PE64_UNWIND_INFO *  info, int *  index  )

inlinestatic

Definition at line 80 of file windows-x64.c.

                                                                                 {
    ut16 ret = rz_read_le16(&info->UnwindCode[*index]);
    *index += 1;
    return ret;
}

References info(), and rz_read_le16().

Referenced by unwind_function().

read_slot32()

static ut32 read_slot32 ( RzDebug *  dbg, PE64_UNWIND_INFO *  info, int *  index  )

inlinestatic

Definition at line 74 of file windows-x64.c.

                                                                                 {
    ut32 ret = rz_read_le32(&info->UnwindCode[*index]);
    *index += 2;
    return ret;
}

References info(), and rz_read_le32().

Referenced by unwind_function().

read_unwind_info()

static PE64_UNWIND_INFO* read_unwind_info ( RzDebug *  dbg, ut64  at  )

inlinestatic

Definition at line 114 of file windows-x64.c.

                                                                        {
    PE64_UNWIND_INFO *info = RZ_NEW0(PE64_UNWIND_INFO);
    if (!info) {
        return NULL;
    }
    READ_AT(at, (ut8 *)info, sizeof(*info));
    const size_t unwind_code_array_sz = info->CountOfCodes * sizeof(PE64_UNWIND_CODE);
    void *tmp = realloc(info, sizeof(PE64_UNWIND_INFO) + unwind_code_array_sz);
    if (!tmp) {
        free(info);
        return NULL;
    }
    info = tmp;
    READ_AT(at + rz_offsetof(PE64_UNWIND_INFO, UnwindCode), (ut8 *)info->UnwindCode, unwind_code_array_sz);
    return info;
}

References free(), info(), NULL, READ_AT, realloc(), RZ_NEW0, rz_offsetof, and autogen_x86imm::tmp.

Referenced by unwind_function().

unwind_function()

static bool unwind_function ( RzDebug *  dbg, RzDebugFrame *  frame, PE64_RUNTIME_FUNCTION *  rfcn, struct context_type_amd64 *  context, const ut64  module_address, const ut64  function_address  )

inlinestatic

Definition at line 131 of file windows-x64.c.

                                 {
 
    bool is_chained = false;
    ut64 *integer_registers = &context->rax;
    ut64 machine_frame_start;
    bool is_machine_frame = false;
 
    ut64 unwind_info_address = module_address + rfcn->UnwindInfoAddress;
 
    // Read initial unwind info structure
    PE64_UNWIND_INFO *info = read_unwind_info(dbg, unwind_info_address);
    if (!info) {
        return false;
    }
 
    // Get address that is used as the base for stack accesses
    ut64 frame_base = get_frame_base(info, context, function_address);
 
process_chained_info:
    if (info->Version != 1 && info->Version != 2) {
        // Version 1 found in user-space, version 2 in kernel
        RZ_LOG_ERROR("Unwind info version (%" PFMT32d ") for function 0x%" PFMT64x " is not recognized\n",
            (ut32)info->Version, function_address);
        free(info);
        return false;
    }
    int i = 0;
    while (i < info->CountOfCodes) {
        const PE64_UNWIND_CODE code = info->UnwindCode[i];
        i++;
        // Check if we are already past the prolog instruction
        // If we are processing a chained scope, always process all of them
        if (!is_chained && context->rip < function_address + code.CodeOffset) {
            // Skip, as it wasn't executed yet
            switch (code.UnwindOp) {
            case UWOP_ALLOC_LARGE:
                i++;
                if (code.OpInfo) {
                    i++;
                }
                break;
            case UWOP_SAVE_XMM128:
            case UWOP_SAVE_NONVOL:
            case UWOP_UNKNOWN1:
                i++;
                break;
            case UWOP_SAVE_XMM128_FAR:
            case UWOP_SAVE_NONVOL_FAR:
            case UWOP_UNKNOWN2:
                i += 2;
                break;
            default:
                break;
            }
            continue;
        }
        ut16 offset;
        switch (code.UnwindOp) {
        case UWOP_PUSH_NONVOL: /* info == register number */
            integer_registers[code.OpInfo] = read_register(dbg, context->rsp);
            context->rsp += 8;
            break;
        case UWOP_ALLOC_LARGE: /* info == unscaled or scaled, alloc size in next 1 or 2 slots */
            if (code.OpInfo) {
                context->rsp += read_slot32(dbg, info, &i);
            } else {
                context->rsp += read_slot16(dbg, info, &i) * 8;
            }
            break;
        case UWOP_ALLOC_SMALL: /* info == size of allocation / 8 - 1 */
            context->rsp += code.OpInfo * 8 + 8;
            break;
        case UWOP_SET_FPREG: /* no info, FP = RSP + UNWIND_INFO.FPRegOffset*16 */
            frame->bp = integer_registers[info->FrameRegister];
            context->rsp = integer_registers[info->FrameRegister] - info->FrameOffset * 16;
            break;
        case UWOP_SAVE_NONVOL: /* info == register number, offset in next slot */
            offset = read_slot16(dbg, info, &i) * 8;
            integer_registers[code.OpInfo] = read_register(dbg, frame_base + offset);
            break;
        case UWOP_SAVE_XMM128: /* info == XMM reg number, offset in next slot */
        case UWOP_UNKNOWN1: /* 1 extra slot */
            i++;
            break;
        case UWOP_SAVE_NONVOL_FAR: /* info == register number, offset in next 2 slots */
            offset = read_slot32(dbg, info, &i);
            integer_registers[code.OpInfo] = read_register(dbg, frame_base + offset);
            break;
        case UWOP_SAVE_XMM128_FAR: /* info == XMM reg number, offset in next 2 slots */
        case UWOP_UNKNOWN2: /* 2 extra slots */
            i += 2;
            break;
        case UWOP_PUSH_MACHFRAME: /* info == 0: no error-code, 1: error-code */
            if (code.OpInfo) {
                context->rsp += 8;
            }
            is_machine_frame = true;
            machine_frame_start = context->rsp + 40;
            context->rip = read_register(dbg, context->rsp);
            context->rsp = read_register(dbg, context->rsp + 24);
            break;
        }
    }
    if (info->Flags & PE64_UNW_FLAG_CHAININFO) {
        if (i % 2) {
            i++;
        }
 
        // Read chained RUNTIME_FUNCTION
        const ut64 chained_fcn_address = unwind_info_address + rz_offsetof(PE64_UNWIND_INFO, UnwindCode[i]);
        ut8 buf[sizeof(PE64_RUNTIME_FUNCTION)];
        READ_AT(chained_fcn_address, buf, sizeof(buf));
 
        // Get unwind info from the chained RUNTIME_FUNCTION
        unwind_info_address = module_address + rz_read_le32(buf + rz_offsetof(PE64_RUNTIME_FUNCTION, UnwindInfoAddress));
        free(info);
        info = read_unwind_info(dbg, unwind_info_address);
        if (!info) {
            return false;
        }
 
        // Make sure we process all the chained unwind ops
        is_chained = true;
        goto process_chained_info;
    }
    if (is_machine_frame) {
        frame->size = machine_frame_start - frame->sp;
    } else {
        frame->size = context->rsp - frame->sp;
        context->rip = read_register(dbg, context->rsp);
        context->rsp += 8;
    }
    free(info);
    return true;
}

References rz_debug_frame_t::bp, dbg, free(), get_frame_base(), i, info(), PE64_UNW_FLAG_CHAININFO, PFMT32d, PFMT64x, READ_AT, read_register(), read_slot16(), read_slot32(), read_unwind_info(), RZ_LOG_ERROR, rz_offsetof, rz_read_le32(), rz_debug_frame_t::size, rz_debug_frame_t::sp, PE64_RUNTIME_FUNCTION::UnwindInfoAddress, ut64(), UWOP_ALLOC_LARGE, UWOP_ALLOC_SMALL, UWOP_PUSH_MACHFRAME, UWOP_PUSH_NONVOL, UWOP_SAVE_NONVOL, UWOP_SAVE_NONVOL_FAR, UWOP_SAVE_XMM128, UWOP_SAVE_XMM128_FAR, UWOP_SET_FPREG, UWOP_UNKNOWN1, and UWOP_UNKNOWN2.

Referenced by backtrace_windows_x64().