1 | /* |
2 | * Copyright (c) 2018 Virtuozzo International GmbH |
3 | * |
4 | * This work is licensed under the terms of the GNU GPL, version 2 or later. |
5 | * |
6 | */ |
7 | |
8 | #include "qemu/osdep.h" |
9 | |
10 | #include "err.h" |
11 | #include "addrspace.h" |
12 | #include "pe.h" |
13 | #include "pdb.h" |
14 | #include "kdbg.h" |
15 | #include "download.h" |
16 | #include "qemu/win_dump_defs.h" |
17 | |
18 | #define SYM_URL_BASE "https://msdl.microsoft.com/download/symbols/" |
19 | #define PDB_NAME "ntkrnlmp.pdb" |
20 | |
21 | #define INITIAL_MXCSR 0x1f80 |
22 | |
23 | typedef struct idt_desc { |
24 | uint16_t offset1; /* offset bits 0..15 */ |
25 | uint16_t selector; |
26 | uint8_t ist; |
27 | uint8_t type_attr; |
28 | uint16_t offset2; /* offset bits 16..31 */ |
29 | uint32_t offset3; /* offset bits 32..63 */ |
30 | uint32_t rsrvd; |
31 | } __attribute__ ((packed)) idt_desc_t; |
32 | |
33 | static uint64_t idt_desc_addr(idt_desc_t desc) |
34 | { |
35 | return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) | |
36 | ((uint64_t)desc.offset3 << 32); |
37 | } |
38 | |
39 | static const uint64_t SharedUserData = 0xfffff78000000000; |
40 | |
41 | #define KUSD_OFFSET_SUITE_MASK 0x2d0 |
42 | #define KUSD_OFFSET_PRODUCT_TYPE 0x264 |
43 | |
44 | #define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\ |
45 | s ? printf(#s" = 0x%016"PRIx64"\n", s) :\ |
46 | eprintf("Failed to resolve "#s"\n"), s) |
47 | |
48 | static uint64_t rol(uint64_t x, uint64_t y) |
49 | { |
50 | return (x << y) | (x >> (64 - y)); |
51 | } |
52 | |
53 | /* |
54 | * Decoding algorithm can be found in Volatility project |
55 | */ |
56 | static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size, |
57 | uint64_t kwn, uint64_t kwa, uint64_t kdbe) |
58 | { |
59 | size_t i; |
60 | assert(size % sizeof(uint64_t) == 0); |
61 | for (i = 0; i < size / sizeof(uint64_t); i++) { |
62 | uint64_t block; |
63 | |
64 | block = src[i]; |
65 | block = rol(block ^ kwn, (uint8_t)kwn); |
66 | block = __builtin_bswap64(block ^ kdbe) ^ kwa; |
67 | dst[i] = block; |
68 | } |
69 | } |
70 | |
71 | static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb, |
72 | struct va_space *vs, uint64_t KdDebuggerDataBlock) |
73 | { |
74 | const char OwnerTag[4] = "KDBG" ; |
75 | KDDEBUGGER_DATA64 *kdbg = NULL; |
76 | DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr; |
77 | bool decode = false; |
78 | uint64_t kwn, kwa, KdpDataBlockEncoded; |
79 | |
80 | if (va_space_rw(vs, |
81 | KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header), |
82 | &kdbg_hdr, sizeof(kdbg_hdr), 0)) { |
83 | eprintf("Failed to extract KDBG header\n" ); |
84 | return NULL; |
85 | } |
86 | |
87 | if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) { |
88 | uint64_t KiWaitNever, KiWaitAlways; |
89 | |
90 | decode = true; |
91 | |
92 | if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) || |
93 | !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) || |
94 | !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) { |
95 | return NULL; |
96 | } |
97 | |
98 | if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) || |
99 | va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) { |
100 | return NULL; |
101 | } |
102 | |
103 | printf("[KiWaitNever] = 0x%016" PRIx64"\n" , kwn); |
104 | printf("[KiWaitAlways] = 0x%016" PRIx64"\n" , kwa); |
105 | |
106 | /* |
107 | * If KDBG header can be decoded, KDBG size is available |
108 | * and entire KDBG can be decoded. |
109 | */ |
110 | printf("Decoding KDBG header...\n" ); |
111 | kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr, |
112 | sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded); |
113 | |
114 | printf("Owner tag is \'%.4s\'\n" , (char *)&kdbg_hdr.OwnerTag); |
115 | if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) { |
116 | eprintf("Failed to decode KDBG header\n" ); |
117 | return NULL; |
118 | } |
119 | } |
120 | |
121 | kdbg = malloc(kdbg_hdr.Size); |
122 | if (!kdbg) { |
123 | return NULL; |
124 | } |
125 | |
126 | if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) { |
127 | eprintf("Failed to extract entire KDBG\n" ); |
128 | return NULL; |
129 | } |
130 | |
131 | if (!decode) { |
132 | return kdbg; |
133 | } |
134 | |
135 | printf("Decoding KdDebuggerDataBlock...\n" ); |
136 | kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size, |
137 | kwn, kwa, KdpDataBlockEncoded); |
138 | |
139 | va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1); |
140 | |
141 | return kdbg; |
142 | } |
143 | |
144 | static void win_context_init_from_qemu_cpu_state(WinContext *ctx, |
145 | QEMUCPUState *s) |
146 | { |
147 | WinContext win_ctx = (WinContext){ |
148 | .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL, |
149 | .MxCsr = INITIAL_MXCSR, |
150 | |
151 | .SegCs = s->cs.selector, |
152 | .SegSs = s->ss.selector, |
153 | .SegDs = s->ds.selector, |
154 | .SegEs = s->es.selector, |
155 | .SegFs = s->fs.selector, |
156 | .SegGs = s->gs.selector, |
157 | .EFlags = (uint32_t)s->rflags, |
158 | |
159 | .Rax = s->rax, |
160 | .Rbx = s->rbx, |
161 | .Rcx = s->rcx, |
162 | .Rdx = s->rdx, |
163 | .Rsp = s->rsp, |
164 | .Rbp = s->rbp, |
165 | .Rsi = s->rsi, |
166 | .Rdi = s->rdi, |
167 | .R8 = s->r8, |
168 | .R9 = s->r9, |
169 | .R10 = s->r10, |
170 | .R11 = s->r11, |
171 | .R12 = s->r12, |
172 | .R13 = s->r13, |
173 | .R14 = s->r14, |
174 | .R15 = s->r15, |
175 | |
176 | .Rip = s->rip, |
177 | .FltSave = { |
178 | .MxCsr = INITIAL_MXCSR, |
179 | }, |
180 | }; |
181 | |
182 | *ctx = win_ctx; |
183 | } |
184 | |
185 | /* |
186 | * Finds paging-structure hierarchy base, |
187 | * if previously set doesn't give access to kernel structures |
188 | */ |
189 | static int fix_dtb(struct va_space *vs, QEMU_Elf *qe) |
190 | { |
191 | /* |
192 | * Firstly, test previously set DTB. |
193 | */ |
194 | if (va_space_resolve(vs, SharedUserData)) { |
195 | return 0; |
196 | } |
197 | |
198 | /* |
199 | * Secondly, find CPU which run system task. |
200 | */ |
201 | size_t i; |
202 | for (i = 0; i < qe->state_nr; i++) { |
203 | QEMUCPUState *s = qe->state[i]; |
204 | |
205 | if (is_system(s)) { |
206 | va_space_set_dtb(vs, s->cr[3]); |
207 | printf("DTB 0x%016" PRIx64" has been found from CPU #%zu" |
208 | " as system task CR3\n" , vs->dtb, i); |
209 | return !(va_space_resolve(vs, SharedUserData)); |
210 | } |
211 | } |
212 | |
213 | /* |
214 | * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and |
215 | * CR3 as [Prcb+0x7000] |
216 | */ |
217 | if (qe->has_kernel_gs_base) { |
218 | QEMUCPUState *s = qe->state[0]; |
219 | uint64_t Prcb = s->kernel_gs_base; |
220 | uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000); |
221 | |
222 | if (!cr3) { |
223 | return 1; |
224 | } |
225 | |
226 | va_space_set_dtb(vs, *cr3); |
227 | printf("DirectoryTableBase = 0x%016" PRIx64" has been found from CPU #0" |
228 | " as interrupt handling CR3\n" , vs->dtb); |
229 | return !(va_space_resolve(vs, SharedUserData)); |
230 | } |
231 | |
232 | return 1; |
233 | } |
234 | |
235 | static int (WinDumpHeader64 *hdr, struct pa_space *ps, |
236 | struct va_space *vs, uint64_t KdDebuggerDataBlock, |
237 | KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus) |
238 | { |
239 | uint32_t *suite_mask = va_space_resolve(vs, SharedUserData + |
240 | KUSD_OFFSET_SUITE_MASK); |
241 | int32_t *product_type = va_space_resolve(vs, SharedUserData + |
242 | KUSD_OFFSET_PRODUCT_TYPE); |
243 | DBGKD_GET_VERSION64 kvb; |
244 | WinDumpHeader64 h; |
245 | size_t i; |
246 | |
247 | QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= PAGE_SIZE); |
248 | QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= PAGE_SIZE); |
249 | |
250 | if (!suite_mask || !product_type) { |
251 | return 1; |
252 | } |
253 | |
254 | if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) { |
255 | eprintf("Failed to extract KdVersionBlock\n" ); |
256 | return 1; |
257 | } |
258 | |
259 | h = (WinDumpHeader64) { |
260 | .Signature = "PAGE" , |
261 | .ValidDump = "DU64" , |
262 | .MajorVersion = kvb.MajorVersion, |
263 | .MinorVersion = kvb.MinorVersion, |
264 | .DirectoryTableBase = vs->dtb, |
265 | .PfnDatabase = kdbg->MmPfnDatabase, |
266 | .PsLoadedModuleList = kdbg->PsLoadedModuleList, |
267 | .PsActiveProcessHead = kdbg->PsActiveProcessHead, |
268 | .MachineImageType = kvb.MachineType, |
269 | .NumberProcessors = nr_cpus, |
270 | .BugcheckCode = LIVE_SYSTEM_DUMP, |
271 | .KdDebuggerDataBlock = KdDebuggerDataBlock, |
272 | .DumpType = 1, |
273 | .Comment = "Hello from elf2dmp!" , |
274 | .SuiteMask = *suite_mask, |
275 | .ProductType = *product_type, |
276 | .SecondaryDataState = kvb.KdSecondaryVersion, |
277 | .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) { |
278 | .NumberOfRuns = ps->block_nr, |
279 | }, |
280 | .RequiredDumpSpace = sizeof(h), |
281 | }; |
282 | |
283 | for (i = 0; i < ps->block_nr; i++) { |
284 | h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / PAGE_SIZE; |
285 | h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) { |
286 | .BasePage = ps->block[i].paddr / PAGE_SIZE, |
287 | .PageCount = ps->block[i].size / PAGE_SIZE, |
288 | }; |
289 | } |
290 | |
291 | h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << PAGE_BITS; |
292 | |
293 | *hdr = h; |
294 | |
295 | return 0; |
296 | } |
297 | |
298 | static int fill_context(KDDEBUGGER_DATA64 *kdbg, |
299 | struct va_space *vs, QEMU_Elf *qe) |
300 | { |
301 | int i; |
302 | for (i = 0; i < qe->state_nr; i++) { |
303 | uint64_t Prcb; |
304 | uint64_t Context; |
305 | WinContext ctx; |
306 | QEMUCPUState *s = qe->state[i]; |
307 | |
308 | if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i, |
309 | &Prcb, sizeof(Prcb), 0)) { |
310 | eprintf("Failed to read CPU #%d PRCB location\n" , i); |
311 | return 1; |
312 | } |
313 | |
314 | if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext, |
315 | &Context, sizeof(Context), 0)) { |
316 | eprintf("Failed to read CPU #%d ContextFrame location\n" , i); |
317 | return 1; |
318 | } |
319 | |
320 | printf("Filling context for CPU #%d...\n" , i); |
321 | win_context_init_from_qemu_cpu_state(&ctx, s); |
322 | |
323 | if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) { |
324 | eprintf("Failed to fill CPU #%d context\n" , i); |
325 | return 1; |
326 | } |
327 | } |
328 | |
329 | return 0; |
330 | } |
331 | |
332 | static int write_dump(struct pa_space *ps, |
333 | WinDumpHeader64 *hdr, const char *name) |
334 | { |
335 | FILE *dmp_file = fopen(name, "wb" ); |
336 | size_t i; |
337 | |
338 | if (!dmp_file) { |
339 | eprintf("Failed to open output file \'%s\'\n" , name); |
340 | return 1; |
341 | } |
342 | |
343 | printf("Writing header to file...\n" ); |
344 | |
345 | if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) { |
346 | eprintf("Failed to write dump header\n" ); |
347 | fclose(dmp_file); |
348 | return 1; |
349 | } |
350 | |
351 | for (i = 0; i < ps->block_nr; i++) { |
352 | struct pa_block *b = &ps->block[i]; |
353 | |
354 | printf("Writing block #%zu/%zu to file...\n" , i, ps->block_nr); |
355 | if (fwrite(b->addr, b->size, 1, dmp_file) != 1) { |
356 | eprintf("Failed to write dump header\n" ); |
357 | fclose(dmp_file); |
358 | return 1; |
359 | } |
360 | } |
361 | |
362 | return fclose(dmp_file); |
363 | } |
364 | |
365 | static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr, |
366 | char *hash, struct va_space *vs) |
367 | { |
368 | const char e_magic[2] = "MZ" ; |
369 | const char Signature[4] = "PE\0\0" ; |
370 | const char sign_rsds[4] = "RSDS" ; |
371 | IMAGE_DOS_HEADER *dos_hdr = start_addr; |
372 | IMAGE_NT_HEADERS64 nt_hdrs; |
373 | IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader; |
374 | IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader; |
375 | IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory; |
376 | IMAGE_DEBUG_DIRECTORY debug_dir; |
377 | OMFSignatureRSDS rsds; |
378 | char *pdb_name; |
379 | size_t pdb_name_sz; |
380 | size_t i; |
381 | |
382 | QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= PAGE_SIZE); |
383 | |
384 | if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) { |
385 | return 1; |
386 | } |
387 | |
388 | if (va_space_rw(vs, base + dos_hdr->e_lfanew, |
389 | &nt_hdrs, sizeof(nt_hdrs), 0)) { |
390 | return 1; |
391 | } |
392 | |
393 | if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) || |
394 | file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) { |
395 | return 1; |
396 | } |
397 | |
398 | printf("Debug Directory RVA = 0x%08" PRIx32"\n" , |
399 | (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress); |
400 | |
401 | if (va_space_rw(vs, |
402 | base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress, |
403 | &debug_dir, sizeof(debug_dir), 0)) { |
404 | return 1; |
405 | } |
406 | |
407 | if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) { |
408 | return 1; |
409 | } |
410 | |
411 | if (va_space_rw(vs, |
412 | base + debug_dir.AddressOfRawData, |
413 | &rsds, sizeof(rsds), 0)) { |
414 | return 1; |
415 | } |
416 | |
417 | printf("CodeView signature is \'%.4s\'\n" , rsds.Signature); |
418 | |
419 | if (memcmp(&rsds.Signature, sign_rsds, sizeof(sign_rsds))) { |
420 | return 1; |
421 | } |
422 | |
423 | pdb_name_sz = debug_dir.SizeOfData - sizeof(rsds); |
424 | pdb_name = malloc(pdb_name_sz); |
425 | if (!pdb_name) { |
426 | return 1; |
427 | } |
428 | |
429 | if (va_space_rw(vs, base + debug_dir.AddressOfRawData + |
430 | offsetof(OMFSignatureRSDS, name), pdb_name, pdb_name_sz, 0)) { |
431 | free(pdb_name); |
432 | return 1; |
433 | } |
434 | |
435 | printf("PDB name is \'%s\', \'%s\' expected\n" , pdb_name, PDB_NAME); |
436 | |
437 | if (strcmp(pdb_name, PDB_NAME)) { |
438 | eprintf("Unexpected PDB name, it seems the kernel isn't found\n" ); |
439 | free(pdb_name); |
440 | return 1; |
441 | } |
442 | |
443 | free(pdb_name); |
444 | |
445 | sprintf(hash, "%.08x%.04x%.04x%.02x%.02x" , rsds.guid.a, rsds.guid.b, |
446 | rsds.guid.c, rsds.guid.d[0], rsds.guid.d[1]); |
447 | hash += 20; |
448 | for (i = 0; i < 6; i++, hash += 2) { |
449 | sprintf(hash, "%.02x" , rsds.guid.e[i]); |
450 | } |
451 | |
452 | sprintf(hash, "%.01x" , rsds.age); |
453 | |
454 | return 0; |
455 | } |
456 | |
457 | int main(int argc, char *argv[]) |
458 | { |
459 | int err = 0; |
460 | QEMU_Elf qemu_elf; |
461 | struct pa_space ps; |
462 | struct va_space vs; |
463 | QEMUCPUState *state; |
464 | idt_desc_t first_idt_desc; |
465 | uint64_t KernBase; |
466 | void *nt_start_addr = NULL; |
467 | WinDumpHeader64 ; |
468 | char pdb_hash[34]; |
469 | char pdb_url[] = SYM_URL_BASE PDB_NAME |
470 | "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME; |
471 | struct pdb_reader pdb; |
472 | uint64_t KdDebuggerDataBlock; |
473 | KDDEBUGGER_DATA64 *kdbg; |
474 | uint64_t KdVersionBlock; |
475 | |
476 | if (argc != 3) { |
477 | eprintf("usage:\n\t%s elf_file dmp_file\n" , argv[0]); |
478 | return 1; |
479 | } |
480 | |
481 | if (QEMU_Elf_init(&qemu_elf, argv[1])) { |
482 | eprintf("Failed to initialize QEMU ELF dump\n" ); |
483 | return 1; |
484 | } |
485 | |
486 | if (pa_space_create(&ps, &qemu_elf)) { |
487 | eprintf("Failed to initialize physical address space\n" ); |
488 | err = 1; |
489 | goto out_elf; |
490 | } |
491 | |
492 | state = qemu_elf.state[0]; |
493 | printf("CPU #0 CR3 is 0x%016" PRIx64"\n" , state->cr[3]); |
494 | |
495 | va_space_create(&vs, &ps, state->cr[3]); |
496 | if (fix_dtb(&vs, &qemu_elf)) { |
497 | eprintf("Failed to find paging base\n" ); |
498 | err = 1; |
499 | goto out_elf; |
500 | } |
501 | |
502 | printf("CPU #0 IDT is at 0x%016" PRIx64"\n" , state->idt.base); |
503 | |
504 | if (va_space_rw(&vs, state->idt.base, |
505 | &first_idt_desc, sizeof(first_idt_desc), 0)) { |
506 | eprintf("Failed to get CPU #0 IDT[0]\n" ); |
507 | err = 1; |
508 | goto out_ps; |
509 | } |
510 | printf("CPU #0 IDT[0] -> 0x%016" PRIx64"\n" , idt_desc_addr(first_idt_desc)); |
511 | |
512 | KernBase = idt_desc_addr(first_idt_desc) & ~(PAGE_SIZE - 1); |
513 | printf("Searching kernel downwards from 0x%016" PRIx64"...\n" , KernBase); |
514 | |
515 | for (; KernBase >= 0xfffff78000000000; KernBase -= PAGE_SIZE) { |
516 | nt_start_addr = va_space_resolve(&vs, KernBase); |
517 | if (!nt_start_addr) { |
518 | continue; |
519 | } |
520 | |
521 | if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */ |
522 | break; |
523 | } |
524 | } |
525 | |
526 | if (!nt_start_addr) { |
527 | eprintf("Failed to find NT kernel image\n" ); |
528 | err = 1; |
529 | goto out_ps; |
530 | } |
531 | |
532 | printf("KernBase = 0x%016" PRIx64", signature is \'%.2s\'\n" , KernBase, |
533 | (char *)nt_start_addr); |
534 | |
535 | if (pe_get_pdb_symstore_hash(KernBase, nt_start_addr, pdb_hash, &vs)) { |
536 | eprintf("Failed to get PDB symbol store hash\n" ); |
537 | err = 1; |
538 | goto out_ps; |
539 | } |
540 | |
541 | sprintf(pdb_url, "%s%s/%s/%s" , SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME); |
542 | printf("PDB URL is %s\n" , pdb_url); |
543 | |
544 | if (download_url(PDB_NAME, pdb_url)) { |
545 | eprintf("Failed to download PDB file\n" ); |
546 | err = 1; |
547 | goto out_ps; |
548 | } |
549 | |
550 | if (pdb_init_from_file(PDB_NAME, &pdb)) { |
551 | eprintf("Failed to initialize PDB reader\n" ); |
552 | err = 1; |
553 | goto out_pdb_file; |
554 | } |
555 | |
556 | if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) || |
557 | !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) { |
558 | err = 1; |
559 | goto out_pdb; |
560 | } |
561 | |
562 | kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock); |
563 | if (!kdbg) { |
564 | err = 1; |
565 | goto out_pdb; |
566 | } |
567 | |
568 | if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg, |
569 | KdVersionBlock, qemu_elf.state_nr)) { |
570 | err = 1; |
571 | goto out_pdb; |
572 | } |
573 | |
574 | if (fill_context(kdbg, &vs, &qemu_elf)) { |
575 | err = 1; |
576 | goto out_pdb; |
577 | } |
578 | |
579 | if (write_dump(&ps, &header, argv[2])) { |
580 | eprintf("Failed to save dump\n" ); |
581 | err = 1; |
582 | goto out_kdbg; |
583 | } |
584 | |
585 | out_kdbg: |
586 | free(kdbg); |
587 | out_pdb: |
588 | pdb_exit(&pdb); |
589 | out_pdb_file: |
590 | unlink(PDB_NAME); |
591 | out_ps: |
592 | pa_space_destroy(&ps); |
593 | out_elf: |
594 | QEMU_Elf_exit(&qemu_elf); |
595 | |
596 | return err; |
597 | } |
598 | |