3fa2d384c2
elf2dmp is a converter from ELF dump (produced by 'dump-guest-memory') to Windows MEMORY.DMP format (also know as 'Complete Memory Dump') which can be opened in WinDbg. This tool can help if VMCoreInfo device/driver is absent in Windows VM and 'dump-guest-memory -w' is not available but dump can be created in ELF format. The tool works as follows: 1. Determine the system paging root looking at GS_BASE or KERNEL_GS_BASE to locate the PRCB structure and finds the kernel CR3 nearby if QEMU CPU state CR3 is not suitable. 2. Find an address within the kernel image by dereferencing the first IDT entry and scans virtual memory upwards until the start of the kernel. 3. Download a PDB matching the kernel from the Microsoft symbol store, and figure out the layout of certain relevant structures necessary for the dump. 4. Populate the corresponding structures in the memory image and create the appropriate dump header. Signed-off-by: Viktor Prutyanov <viktor.prutyanov@virtuozzo.com> Message-Id: <1535546488-30208-3-git-send-email-viktor.prutyanov@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
45 lines
976 B
C
45 lines
976 B
C
/*
|
|
* Copyright (c) 2018 Virtuozzo International GmbH
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2 or later.
|
|
*
|
|
*/
|
|
|
|
#ifndef ADDRSPACE_H
|
|
#define ADDRSPACE_H
|
|
|
|
#include "qemu_elf.h"
|
|
|
|
#define PAGE_BITS 12
|
|
#define PAGE_SIZE (1ULL << PAGE_BITS)
|
|
#define PFN_MASK (~(PAGE_SIZE - 1))
|
|
|
|
#define INVALID_PA UINT64_MAX
|
|
|
|
struct pa_block {
|
|
uint8_t *addr;
|
|
uint64_t paddr;
|
|
uint64_t size;
|
|
};
|
|
|
|
struct pa_space {
|
|
size_t block_nr;
|
|
struct pa_block *block;
|
|
};
|
|
|
|
struct va_space {
|
|
uint64_t dtb;
|
|
struct pa_space *ps;
|
|
};
|
|
|
|
int pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf);
|
|
void pa_space_destroy(struct pa_space *ps);
|
|
|
|
void va_space_create(struct va_space *vs, struct pa_space *ps, uint64_t dtb);
|
|
void va_space_set_dtb(struct va_space *vs, uint64_t dtb);
|
|
void *va_space_resolve(struct va_space *vs, uint64_t va);
|
|
int va_space_rw(struct va_space *vs, uint64_t addr,
|
|
void *buf, size_t size, int is_write);
|
|
|
|
#endif /* ADDRSPACE_H */
|