cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

main.c (16589B)

      1/*
      2 * Copyright (c) 2018 Virtuozzo International GmbH
      3 *
      4 * This work is licensed under the terms of the GNU GPL, version 2 or later.
      5 *
      6 */
      7
      8#include "qemu/osdep.h"
      9
     10#include "err.h"
     11#include "addrspace.h"
     12#include "pe.h"
     13#include "pdb.h"
     14#include "kdbg.h"
     15#include "download.h"
     16#include "qemu/win_dump_defs.h"
     17
     18#define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
     19#define PDB_NAME    "ntkrnlmp.pdb"
     20
     21#define INITIAL_MXCSR   0x1f80
     22
     23typedef struct idt_desc {
     24    uint16_t offset1;   /* offset bits 0..15 */
     25    uint16_t selector;
     26    uint8_t ist;
     27    uint8_t type_attr;
     28    uint16_t offset2;   /* offset bits 16..31 */
     29    uint32_t offset3;   /* offset bits 32..63 */
     30    uint32_t rsrvd;
     31} __attribute__ ((packed)) idt_desc_t;
     32
     33static uint64_t idt_desc_addr(idt_desc_t desc)
     34{
     35    return (uint64_t)desc.offset1 | ((uint64_t)desc.offset2 << 16) |
     36          ((uint64_t)desc.offset3 << 32);
     37}
     38
     39static const uint64_t SharedUserData = 0xfffff78000000000;
     40
     41#define KUSD_OFFSET_SUITE_MASK 0x2d0
     42#define KUSD_OFFSET_PRODUCT_TYPE 0x264
     43
     44#define SYM_RESOLVE(base, r, s) ((s = pdb_resolve(base, r, #s)),\
     45    s ? printf(#s" = 0x%016"PRIx64"\n", s) :\
     46    eprintf("Failed to resolve "#s"\n"), s)
     47
     48static uint64_t rol(uint64_t x, uint64_t y)
     49{
     50    return (x << y) | (x >> (64 - y));
     51}
     52
     53/*
     54 * Decoding algorithm can be found in Volatility project
     55 */
     56static void kdbg_decode(uint64_t *dst, uint64_t *src, size_t size,
     57        uint64_t kwn, uint64_t kwa, uint64_t kdbe)
     58{
     59    size_t i;
     60    assert(size % sizeof(uint64_t) == 0);
     61    for (i = 0; i < size / sizeof(uint64_t); i++) {
     62        uint64_t block;
     63
     64        block = src[i];
     65        block = rol(block ^ kwn, (uint8_t)kwn);
     66        block = __builtin_bswap64(block ^ kdbe) ^ kwa;
     67        dst[i] = block;
     68    }
     69}
     70
     71static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
     72        struct va_space *vs, uint64_t KdDebuggerDataBlock)
     73{
     74    const char OwnerTag[4] = "KDBG";
     75    KDDEBUGGER_DATA64 *kdbg = NULL;
     76    DBGKD_DEBUG_DATA_HEADER64 kdbg_hdr;
     77    bool decode = false;
     78    uint64_t kwn, kwa, KdpDataBlockEncoded;
     79
     80    if (va_space_rw(vs,
     81                KdDebuggerDataBlock + offsetof(KDDEBUGGER_DATA64, Header),
     82                &kdbg_hdr, sizeof(kdbg_hdr), 0)) {
     83        eprintf("Failed to extract KDBG header\n");
     84        return NULL;
     85    }
     86
     87    if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
     88        uint64_t KiWaitNever, KiWaitAlways;
     89
     90        decode = true;
     91
     92        if (!SYM_RESOLVE(KernBase, pdb, KiWaitNever) ||
     93                !SYM_RESOLVE(KernBase, pdb, KiWaitAlways) ||
     94                !SYM_RESOLVE(KernBase, pdb, KdpDataBlockEncoded)) {
     95            return NULL;
     96        }
     97
     98        if (va_space_rw(vs, KiWaitNever, &kwn, sizeof(kwn), 0) ||
     99                va_space_rw(vs, KiWaitAlways, &kwa, sizeof(kwa), 0)) {
    100            return NULL;
    101        }
    102
    103        printf("[KiWaitNever] = 0x%016"PRIx64"\n", kwn);
    104        printf("[KiWaitAlways] = 0x%016"PRIx64"\n", kwa);
    105
    106        /*
    107         * If KDBG header can be decoded, KDBG size is available
    108         * and entire KDBG can be decoded.
    109         */
    110        printf("Decoding KDBG header...\n");
    111        kdbg_decode((uint64_t *)&kdbg_hdr, (uint64_t *)&kdbg_hdr,
    112                sizeof(kdbg_hdr), kwn, kwa, KdpDataBlockEncoded);
    113
    114        printf("Owner tag is \'%.4s\'\n", (char *)&kdbg_hdr.OwnerTag);
    115        if (memcmp(&kdbg_hdr.OwnerTag, OwnerTag, sizeof(OwnerTag))) {
    116            eprintf("Failed to decode KDBG header\n");
    117            return NULL;
    118        }
    119    }
    120
    121    kdbg = malloc(kdbg_hdr.Size);
    122    if (!kdbg) {
    123        return NULL;
    124    }
    125
    126    if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
    127        eprintf("Failed to extract entire KDBG\n");
    128        return NULL;
    129    }
    130
    131    if (!decode) {
    132        return kdbg;
    133    }
    134
    135    printf("Decoding KdDebuggerDataBlock...\n");
    136    kdbg_decode((uint64_t *)kdbg, (uint64_t *)kdbg, kdbg_hdr.Size,
    137                kwn, kwa, KdpDataBlockEncoded);
    138
    139    va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 1);
    140
    141    return kdbg;
    142}
    143
    144static void win_context_init_from_qemu_cpu_state(WinContext *ctx,
    145        QEMUCPUState *s)
    146{
    147    WinContext win_ctx = (WinContext){
    148        .ContextFlags = WIN_CTX_X64 | WIN_CTX_INT | WIN_CTX_SEG | WIN_CTX_CTL,
    149        .MxCsr = INITIAL_MXCSR,
    150
    151        .SegCs = s->cs.selector,
    152        .SegSs = s->ss.selector,
    153        .SegDs = s->ds.selector,
    154        .SegEs = s->es.selector,
    155        .SegFs = s->fs.selector,
    156        .SegGs = s->gs.selector,
    157        .EFlags = (uint32_t)s->rflags,
    158
    159        .Rax = s->rax,
    160        .Rbx = s->rbx,
    161        .Rcx = s->rcx,
    162        .Rdx = s->rdx,
    163        .Rsp = s->rsp,
    164        .Rbp = s->rbp,
    165        .Rsi = s->rsi,
    166        .Rdi = s->rdi,
    167        .R8  = s->r8,
    168        .R9  = s->r9,
    169        .R10 = s->r10,
    170        .R11 = s->r11,
    171        .R12 = s->r12,
    172        .R13 = s->r13,
    173        .R14 = s->r14,
    174        .R15 = s->r15,
    175
    176        .Rip = s->rip,
    177        .FltSave = {
    178            .MxCsr = INITIAL_MXCSR,
    179        },
    180    };
    181
    182    *ctx = win_ctx;
    183}
    184
    185/*
    186 * Finds paging-structure hierarchy base,
    187 * if previously set doesn't give access to kernel structures
    188 */
    189static int fix_dtb(struct va_space *vs, QEMU_Elf *qe)
    190{
    191    /*
    192     * Firstly, test previously set DTB.
    193     */
    194    if (va_space_resolve(vs, SharedUserData)) {
    195        return 0;
    196    }
    197
    198    /*
    199     * Secondly, find CPU which run system task.
    200     */
    201    size_t i;
    202    for (i = 0; i < qe->state_nr; i++) {
    203        QEMUCPUState *s = qe->state[i];
    204
    205        if (is_system(s)) {
    206            va_space_set_dtb(vs, s->cr[3]);
    207            printf("DTB 0x%016"PRIx64" has been found from CPU #%zu"
    208                    " as system task CR3\n", vs->dtb, i);
    209            return !(va_space_resolve(vs, SharedUserData));
    210        }
    211    }
    212
    213    /*
    214     * Thirdly, use KERNEL_GS_BASE from CPU #0 as PRCB address and
    215     * CR3 as [Prcb+0x7000]
    216     */
    217    if (qe->has_kernel_gs_base) {
    218        QEMUCPUState *s = qe->state[0];
    219        uint64_t Prcb = s->kernel_gs_base;
    220        uint64_t *cr3 = va_space_resolve(vs, Prcb + 0x7000);
    221
    222        if (!cr3) {
    223            return 1;
    224        }
    225
    226        va_space_set_dtb(vs, *cr3);
    227        printf("DirectoryTableBase = 0x%016"PRIx64" has been found from CPU #0"
    228                " as interrupt handling CR3\n", vs->dtb);
    229        return !(va_space_resolve(vs, SharedUserData));
    230    }
    231
    232    return 1;
    233}
    234
    235static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
    236        struct va_space *vs, uint64_t KdDebuggerDataBlock,
    237        KDDEBUGGER_DATA64 *kdbg, uint64_t KdVersionBlock, int nr_cpus)
    238{
    239    uint32_t *suite_mask = va_space_resolve(vs, SharedUserData +
    240            KUSD_OFFSET_SUITE_MASK);
    241    int32_t *product_type = va_space_resolve(vs, SharedUserData +
    242            KUSD_OFFSET_PRODUCT_TYPE);
    243    DBGKD_GET_VERSION64 kvb;
    244    WinDumpHeader64 h;
    245    size_t i;
    246
    247    QEMU_BUILD_BUG_ON(KUSD_OFFSET_SUITE_MASK >= ELF2DMP_PAGE_SIZE);
    248    QEMU_BUILD_BUG_ON(KUSD_OFFSET_PRODUCT_TYPE >= ELF2DMP_PAGE_SIZE);
    249
    250    if (!suite_mask || !product_type) {
    251        return 1;
    252    }
    253
    254    if (va_space_rw(vs, KdVersionBlock, &kvb, sizeof(kvb), 0)) {
    255        eprintf("Failed to extract KdVersionBlock\n");
    256        return 1;
    257    }
    258
    259    h = (WinDumpHeader64) {
    260        .Signature = "PAGE",
    261        .ValidDump = "DU64",
    262        .MajorVersion = kvb.MajorVersion,
    263        .MinorVersion = kvb.MinorVersion,
    264        .DirectoryTableBase = vs->dtb,
    265        .PfnDatabase = kdbg->MmPfnDatabase,
    266        .PsLoadedModuleList = kdbg->PsLoadedModuleList,
    267        .PsActiveProcessHead = kdbg->PsActiveProcessHead,
    268        .MachineImageType = kvb.MachineType,
    269        .NumberProcessors = nr_cpus,
    270        .BugcheckCode = LIVE_SYSTEM_DUMP,
    271        .KdDebuggerDataBlock = KdDebuggerDataBlock,
    272        .DumpType = 1,
    273        .Comment = "Hello from elf2dmp!",
    274        .SuiteMask = *suite_mask,
    275        .ProductType = *product_type,
    276        .SecondaryDataState = kvb.KdSecondaryVersion,
    277        .PhysicalMemoryBlock = (WinDumpPhyMemDesc64) {
    278            .NumberOfRuns = ps->block_nr,
    279        },
    280        .RequiredDumpSpace = sizeof(h),
    281    };
    282
    283    for (i = 0; i < ps->block_nr; i++) {
    284        h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE;
    285        h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
    286            .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE,
    287            .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE,
    288        };
    289    }
    290
    291    h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
    292
    293    *hdr = h;
    294
    295    return 0;
    296}
    297
    298static int fill_context(KDDEBUGGER_DATA64 *kdbg,
    299        struct va_space *vs, QEMU_Elf *qe)
    300{
    301        int i;
    302    for (i = 0; i < qe->state_nr; i++) {
    303        uint64_t Prcb;
    304        uint64_t Context;
    305        WinContext ctx;
    306        QEMUCPUState *s = qe->state[i];
    307
    308        if (va_space_rw(vs, kdbg->KiProcessorBlock + sizeof(Prcb) * i,
    309                    &Prcb, sizeof(Prcb), 0)) {
    310            eprintf("Failed to read CPU #%d PRCB location\n", i);
    311            return 1;
    312        }
    313
    314        if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
    315                    &Context, sizeof(Context), 0)) {
    316            eprintf("Failed to read CPU #%d ContextFrame location\n", i);
    317            return 1;
    318        }
    319
    320        printf("Filling context for CPU #%d...\n", i);
    321        win_context_init_from_qemu_cpu_state(&ctx, s);
    322
    323        if (va_space_rw(vs, Context, &ctx, sizeof(ctx), 1)) {
    324            eprintf("Failed to fill CPU #%d context\n", i);
    325            return 1;
    326        }
    327    }
    328
    329    return 0;
    330}
    331
    332static int write_dump(struct pa_space *ps,
    333        WinDumpHeader64 *hdr, const char *name)
    334{
    335    FILE *dmp_file = fopen(name, "wb");
    336    size_t i;
    337
    338    if (!dmp_file) {
    339        eprintf("Failed to open output file \'%s\'\n", name);
    340        return 1;
    341    }
    342
    343    printf("Writing header to file...\n");
    344
    345    if (fwrite(hdr, sizeof(*hdr), 1, dmp_file) != 1) {
    346        eprintf("Failed to write dump header\n");
    347        fclose(dmp_file);
    348        return 1;
    349    }
    350
    351    for (i = 0; i < ps->block_nr; i++) {
    352        struct pa_block *b = &ps->block[i];
    353
    354        printf("Writing block #%zu/%zu to file...\n", i, ps->block_nr);
    355        if (fwrite(b->addr, b->size, 1, dmp_file) != 1) {
    356            eprintf("Failed to write dump header\n");
    357            fclose(dmp_file);
    358            return 1;
    359        }
    360    }
    361
    362    return fclose(dmp_file);
    363}
    364
    365static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
    366        char *hash, struct va_space *vs)
    367{
    368    const char e_magic[2] = "MZ";
    369    const char Signature[4] = "PE\0\0";
    370    const char sign_rsds[4] = "RSDS";
    371    IMAGE_DOS_HEADER *dos_hdr = start_addr;
    372    IMAGE_NT_HEADERS64 nt_hdrs;
    373    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
    374    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
    375    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
    376    IMAGE_DEBUG_DIRECTORY debug_dir;
    377    OMFSignatureRSDS rsds;
    378    char *pdb_name;
    379    size_t pdb_name_sz;
    380    size_t i;
    381
    382    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
    383
    384    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
    385        return 1;
    386    }
    387
    388    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
    389                &nt_hdrs, sizeof(nt_hdrs), 0)) {
    390        return 1;
    391    }
    392
    393    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
    394            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
    395        return 1;
    396    }
    397
    398    printf("Debug Directory RVA = 0x%08"PRIx32"\n",
    399            (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
    400
    401    if (va_space_rw(vs,
    402                base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
    403                &debug_dir, sizeof(debug_dir), 0)) {
    404        return 1;
    405    }
    406
    407    if (debug_dir.Type != IMAGE_DEBUG_TYPE_CODEVIEW) {
    408        return 1;
    409    }
    410
    411    if (va_space_rw(vs,
    412                base + debug_dir.AddressOfRawData,
    413                &rsds, sizeof(rsds), 0)) {
    414        return 1;
    415    }
    416
    417    printf("CodeView signature is \'%.4s\'\n", rsds.Signature);
    418
    419    if (memcmp(&rsds.Signature, sign_rsds, sizeof(sign_rsds))) {
    420        return 1;
    421    }
    422
    423    pdb_name_sz = debug_dir.SizeOfData - sizeof(rsds);
    424    pdb_name = malloc(pdb_name_sz);
    425    if (!pdb_name) {
    426        return 1;
    427    }
    428
    429    if (va_space_rw(vs, base + debug_dir.AddressOfRawData +
    430                offsetof(OMFSignatureRSDS, name), pdb_name, pdb_name_sz, 0)) {
    431        free(pdb_name);
    432        return 1;
    433    }
    434
    435    printf("PDB name is \'%s\', \'%s\' expected\n", pdb_name, PDB_NAME);
    436
    437    if (strcmp(pdb_name, PDB_NAME)) {
    438        eprintf("Unexpected PDB name, it seems the kernel isn't found\n");
    439        free(pdb_name);
    440        return 1;
    441    }
    442
    443    free(pdb_name);
    444
    445    sprintf(hash, "%.08x%.04x%.04x%.02x%.02x", rsds.guid.a, rsds.guid.b,
    446            rsds.guid.c, rsds.guid.d[0], rsds.guid.d[1]);
    447    hash += 20;
    448    for (i = 0; i < 6; i++, hash += 2) {
    449        sprintf(hash, "%.02x", rsds.guid.e[i]);
    450    }
    451
    452    sprintf(hash, "%.01x", rsds.age);
    453
    454    return 0;
    455}
    456
    457int main(int argc, char *argv[])
    458{
    459    int err = 0;
    460    QEMU_Elf qemu_elf;
    461    struct pa_space ps;
    462    struct va_space vs;
    463    QEMUCPUState *state;
    464    idt_desc_t first_idt_desc;
    465    uint64_t KernBase;
    466    void *nt_start_addr = NULL;
    467    WinDumpHeader64 header;
    468    char pdb_hash[34];
    469    char pdb_url[] = SYM_URL_BASE PDB_NAME
    470        "/0123456789ABCDEF0123456789ABCDEFx/" PDB_NAME;
    471    struct pdb_reader pdb;
    472    uint64_t KdDebuggerDataBlock;
    473    KDDEBUGGER_DATA64 *kdbg;
    474    uint64_t KdVersionBlock;
    475
    476    if (argc != 3) {
    477        eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
    478        return 1;
    479    }
    480
    481    if (QEMU_Elf_init(&qemu_elf, argv[1])) {
    482        eprintf("Failed to initialize QEMU ELF dump\n");
    483        return 1;
    484    }
    485
    486    if (pa_space_create(&ps, &qemu_elf)) {
    487        eprintf("Failed to initialize physical address space\n");
    488        err = 1;
    489        goto out_elf;
    490    }
    491
    492    state = qemu_elf.state[0];
    493    printf("CPU #0 CR3 is 0x%016"PRIx64"\n", state->cr[3]);
    494
    495    va_space_create(&vs, &ps, state->cr[3]);
    496    if (fix_dtb(&vs, &qemu_elf)) {
    497        eprintf("Failed to find paging base\n");
    498        err = 1;
    499        goto out_elf;
    500    }
    501
    502    printf("CPU #0 IDT is at 0x%016"PRIx64"\n", state->idt.base);
    503
    504    if (va_space_rw(&vs, state->idt.base,
    505                &first_idt_desc, sizeof(first_idt_desc), 0)) {
    506        eprintf("Failed to get CPU #0 IDT[0]\n");
    507        err = 1;
    508        goto out_ps;
    509    }
    510    printf("CPU #0 IDT[0] -> 0x%016"PRIx64"\n", idt_desc_addr(first_idt_desc));
    511
    512    KernBase = idt_desc_addr(first_idt_desc) & ~(ELF2DMP_PAGE_SIZE - 1);
    513    printf("Searching kernel downwards from 0x%016"PRIx64"...\n", KernBase);
    514
    515    for (; KernBase >= 0xfffff78000000000; KernBase -= ELF2DMP_PAGE_SIZE) {
    516        nt_start_addr = va_space_resolve(&vs, KernBase);
    517        if (!nt_start_addr) {
    518            continue;
    519        }
    520
    521        if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
    522            break;
    523        }
    524    }
    525
    526    if (!nt_start_addr) {
    527        eprintf("Failed to find NT kernel image\n");
    528        err = 1;
    529        goto out_ps;
    530    }
    531
    532    printf("KernBase = 0x%016"PRIx64", signature is \'%.2s\'\n", KernBase,
    533            (char *)nt_start_addr);
    534
    535    if (pe_get_pdb_symstore_hash(KernBase, nt_start_addr, pdb_hash, &vs)) {
    536        eprintf("Failed to get PDB symbol store hash\n");
    537        err = 1;
    538        goto out_ps;
    539    }
    540
    541    sprintf(pdb_url, "%s%s/%s/%s", SYM_URL_BASE, PDB_NAME, pdb_hash, PDB_NAME);
    542    printf("PDB URL is %s\n", pdb_url);
    543
    544    if (download_url(PDB_NAME, pdb_url)) {
    545        eprintf("Failed to download PDB file\n");
    546        err = 1;
    547        goto out_ps;
    548    }
    549
    550    if (pdb_init_from_file(PDB_NAME, &pdb)) {
    551        eprintf("Failed to initialize PDB reader\n");
    552        err = 1;
    553        goto out_pdb_file;
    554    }
    555
    556    if (!SYM_RESOLVE(KernBase, &pdb, KdDebuggerDataBlock) ||
    557            !SYM_RESOLVE(KernBase, &pdb, KdVersionBlock)) {
    558        err = 1;
    559        goto out_pdb;
    560    }
    561
    562    kdbg = get_kdbg(KernBase, &pdb, &vs, KdDebuggerDataBlock);
    563    if (!kdbg) {
    564        err = 1;
    565        goto out_pdb;
    566    }
    567
    568    if (fill_header(&header, &ps, &vs, KdDebuggerDataBlock, kdbg,
    569            KdVersionBlock, qemu_elf.state_nr)) {
    570        err = 1;
    571        goto out_kdbg;
    572    }
    573
    574    if (fill_context(kdbg, &vs, &qemu_elf)) {
    575        err = 1;
    576        goto out_kdbg;
    577    }
    578
    579    if (write_dump(&ps, &header, argv[2])) {
    580        eprintf("Failed to save dump\n");
    581        err = 1;
    582        goto out_kdbg;
    583    }
    584
    585out_kdbg:
    586    free(kdbg);
    587out_pdb:
    588    pdb_exit(&pdb);
    589out_pdb_file:
    590    unlink(PDB_NAME);
    591out_ps:
    592    pa_space_destroy(&ps);
    593out_elf:
    594    QEMU_Elf_exit(&qemu_elf);
    595
    596    return err;
    597}