aboutsummaryrefslogtreecommitdiff
path: root/contrib/elf2dmp/pe.h
AgeCommit message (Collapse)Author
2023-03-21contrib/elf2dmp: add PE name check and Windows Server 2022 supportViktor Prutyanov
Since its inception elf2dmp has checked MZ signatures within an address space above IDT[0] interrupt vector and took first PE image found as Windows Kernel. But in Windows Server 2022 memory dump this address space range is full of invalid PE fragments and the tool must check that PE image is 'ntoskrnl.exe' actually. So, introduce additional validation by checking image name from Export Directory against 'ntoskrnl.exe'. Signed-off-by: Viktor Prutyanov <viktor@daynix.com> Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com> Reviewed-by: Annie Li <annie.li@oracle.com> Message-id: 20230222211246.883679-4-viktor@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-03-21contrib/elf2dmp: fix code styleViktor Prutyanov
Originally elf2dmp were added with some code style issues, especially in pe.h header, and some were introduced by 2d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now. Signed-off-by: Viktor Prutyanov <viktor@daynix.com> Reviewed-by: Annie Li <annie.li@oracle.com> Message-id: 20230222211246.883679-2-viktor@daynix.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-02-05contrib/elf2dmp: fix structures definitionsViktor Prutyanov
Remove duplicate structures definitions in case of build for Windows hosts. Signed-off-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu> Message-Id: <20181220012441.13694-5-viktor.prutyanov@phystech.edu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-12-20Clean up includesMarkus Armbruster
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes, with the changes to the following files manually reverted: contrib/libvhost-user/libvhost-user-glib.h contrib/libvhost-user/libvhost-user.c contrib/libvhost-user/libvhost-user.h linux-user/mips64/cpu_loop.c linux-user/mips64/signal.c linux-user/sparc64/cpu_loop.c linux-user/sparc64/signal.c linux-user/x86_64/cpu_loop.c linux-user/x86_64/signal.c target/s390x/gen-features.c tests/migration/s390x/a-b-bios.c tests/test-rcu-simpleq.c tests/test-rcu-tailq.c Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20181204172535.2799-1-armbru@redhat.com> Acked-by: Eduardo Habkost <ehabkost@redhat.com> Acked-by: Halil Pasic <pasic@linux.ibm.com> Acked-by: Yuval Shaia <yuval.shaia@oracle.com> Acked-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
2018-10-02contrib: add elf2dmp toolViktor Prutyanov
elf2dmp is a converter from ELF dump (produced by 'dump-guest-memory') to Windows MEMORY.DMP format (also know as 'Complete Memory Dump') which can be opened in WinDbg. This tool can help if VMCoreInfo device/driver is absent in Windows VM and 'dump-guest-memory -w' is not available but dump can be created in ELF format. The tool works as follows: 1. Determine the system paging root looking at GS_BASE or KERNEL_GS_BASE to locate the PRCB structure and finds the kernel CR3 nearby if QEMU CPU state CR3 is not suitable. 2. Find an address within the kernel image by dereferencing the first IDT entry and scans virtual memory upwards until the start of the kernel. 3. Download a PDB matching the kernel from the Microsoft symbol store, and figure out the layout of certain relevant structures necessary for the dump. 4. Populate the corresponding structures in the memory image and create the appropriate dump header. Signed-off-by: Viktor Prutyanov <viktor.prutyanov@virtuozzo.com> Message-Id: <1535546488-30208-3-git-send-email-viktor.prutyanov@virtuozzo.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>