On Tue, Sep 26, 2017 at 1:04 PM, Mihail Abakumov
<mikhail.abaku...@ispras.ru> wrote:
> Added handler of fs/gs register. It tries to find and check KPCR and version
> address.
>
> Signed-off-by: Mihail Abakumov <mikhail.abaku...@ispras.ru>
> Signed-off-by: Pavel Dovgalyuk <dovga...@ispras.ru>
> Signed-off-by: Dmitriy Koltunov <koltu...@ispras.ru>
> ---
> include/exec/windbgstub-utils.h | 5 +++
> windbgstub-utils.c | 63
> ++++++++++++++++++++++++++++++++++++++-
> 2 files changed, 66 insertions(+), 2 deletions(-)
>
> diff --git a/include/exec/windbgstub-utils.h b/include/exec/windbgstub-utils.h
> index 90fb766839..f2402ebb34 100755
> --- a/include/exec/windbgstub-utils.h
> +++ b/include/exec/windbgstub-utils.h
> @@ -62,6 +62,11 @@
> _t; \
> })
>
> +typedef struct InitedAddr {
> + target_ulong addr;
> + bool is_init;
> +} InitedAddr;
> +
> bool windbg_on_load(void);
> void windbg_on_exit(void);
>
> diff --git a/windbgstub-utils.c b/windbgstub-utils.c
> index b5fb6db3f2..662096647e 100755
> --- a/windbgstub-utils.c
> +++ b/windbgstub-utils.c
> @@ -11,10 +11,69 @@
>
> #include "exec/windbgstub-utils.h"
>
> +#ifdef TARGET_X86_64
> +# define OFFSET_SELF_PCR 0x18
> +# define OFFSET_VERS 0x108
> +#else
> +# define OFFSET_SELF_PCR 0x1C
> +# define OFFSET_VERS 0x34
> +#endif
> +
> +typedef struct KDData {
> + InitedAddr KPCR;
> + InitedAddr version;
> +} KDData;
> +
> +static KDData *kd;
> +
> bool windbg_on_load(void)
> {
> - return false;
> + CPUState *cpu = qemu_get_cpu(0);
> + CPUArchState *env = cpu->env_ptr;
> +
> + if (!kd) {
> + kd = g_new0(KDData, 1);
> + }
> +
> + if (!kd->KPCR.is_init) {
> +
> + #ifdef TARGET_X86_64
> + kd->KPCR.addr = env->segs[R_GS].base;
> + #else
> + kd->KPCR.addr = env->segs[R_FS].base;
> + #endif
What if Windows is rebooted and FS/GS changes? Do you need to flip
KPCR.is_init back to false on system reset?
> + static target_ulong prev_KPCR;
> + if (!kd->KPCR.addr || prev_KPCR == kd->KPCR.addr) {
> + return false;
> + }
> + prev_KPCR = kd->KPCR.addr;
> +
> + if (kd->KPCR.addr != READ_VMEM(cpu, kd->KPCR.addr + OFFSET_SELF_PCR,
> + target_ulong)) {
> + return false;
> + }
> +
> + kd->KPCR.is_init = true;
> + }
> +
> + if (!kd->version.is_init && kd->KPCR.is_init) {
> + kd->version.addr = READ_VMEM(cpu, kd->KPCR.addr + OFFSET_VERS,
> + target_ulong);
> + if (!kd->version.addr) {
> + return false;
> + }
> + kd->version.is_init = true;
> + }
> +
> + WINDBG_DEBUG("windbg_on_load: KPCR " FMT_ADDR, kd->KPCR.addr);
> + WINDBG_DEBUG("windbg_on_load: version " FMT_ADDR, kd->version.addr);
> +
> + return true;
> }
>
> void windbg_on_exit(void)
> -{}
> +{
> + g_free(kd);
> + kd = NULL;
> +}
>
