3fa2d384c2
elf2dmp is a converter from ELF dump (produced by 'dump-guest-memory') to Windows MEMORY.DMP format (also know as 'Complete Memory Dump') which can be opened in WinDbg. This tool can help if VMCoreInfo device/driver is absent in Windows VM and 'dump-guest-memory -w' is not available but dump can be created in ELF format. The tool works as follows: 1. Determine the system paging root looking at GS_BASE or KERNEL_GS_BASE to locate the PRCB structure and finds the kernel CR3 nearby if QEMU CPU state CR3 is not suitable. 2. Find an address within the kernel image by dereferencing the first IDT entry and scans virtual memory upwards until the start of the kernel. 3. Download a PDB matching the kernel from the Microsoft symbol store, and figure out the layout of certain relevant structures necessary for the dump. 4. Populate the corresponding structures in the memory image and create the appropriate dump header. Signed-off-by: Viktor Prutyanov <viktor.prutyanov@virtuozzo.com> Message-Id: <1535546488-30208-3-git-send-email-viktor.prutyanov@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
52 lines
1.1 KiB
C
52 lines
1.1 KiB
C
/*
|
|
* Copyright (c) 2018 Virtuozzo International GmbH
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2 or later.
|
|
*
|
|
*/
|
|
|
|
#ifndef QEMU_ELF_H
|
|
#define QEMU_ELF_H
|
|
|
|
#include <stdint.h>
|
|
#include <elf.h>
|
|
|
|
typedef struct QEMUCPUSegment {
|
|
uint32_t selector;
|
|
uint32_t limit;
|
|
uint32_t flags;
|
|
uint32_t pad;
|
|
uint64_t base;
|
|
} QEMUCPUSegment;
|
|
|
|
typedef struct QEMUCPUState {
|
|
uint32_t version;
|
|
uint32_t size;
|
|
uint64_t rax, rbx, rcx, rdx, rsi, rdi, rsp, rbp;
|
|
uint64_t r8, r9, r10, r11, r12, r13, r14, r15;
|
|
uint64_t rip, rflags;
|
|
QEMUCPUSegment cs, ds, es, fs, gs, ss;
|
|
QEMUCPUSegment ldt, tr, gdt, idt;
|
|
uint64_t cr[5];
|
|
uint64_t kernel_gs_base;
|
|
} QEMUCPUState;
|
|
|
|
int is_system(QEMUCPUState *s);
|
|
|
|
typedef struct QEMU_Elf {
|
|
int fd;
|
|
size_t size;
|
|
void *map;
|
|
QEMUCPUState **state;
|
|
size_t state_nr;
|
|
int has_kernel_gs_base;
|
|
} QEMU_Elf;
|
|
|
|
int QEMU_Elf_init(QEMU_Elf *qe, const char *filename);
|
|
void QEMU_Elf_exit(QEMU_Elf *qe);
|
|
|
|
Elf64_Phdr *elf64_getphdr(void *map);
|
|
Elf64_Half elf_getphdrnum(void *map);
|
|
|
|
#endif /* QEMU_ELF_H */
|