diff options
| author | Viktor Prutyanov <viktor@daynix.com> | 2023-02-23 00:12:46 +0300 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2023-03-21 13:19:07 +0000 |
| commit | d399d6b179f07b9904de0e76d06c77a3d0a66b51 (patch) | |
| tree | 6e9ae93486930855a5f89f1259348e9f4f04feec /contrib/elf2dmp/pe.h | |
| parent | 06ac60b73e6abe1209d0ed1aca69d7f79f95b30b (diff) | |
| download | qemu-d399d6b179f07b9904de0e76d06c77a3d0a66b51.zip qemu-d399d6b179f07b9904de0e76d06c77a3d0a66b51.tar.gz qemu-d399d6b179f07b9904de0e76d06c77a3d0a66b51.tar.bz2 | |
contrib/elf2dmp: add PE name check and Windows Server 2022 support
Since its inception elf2dmp has checked MZ signatures within an
address space above IDT[0] interrupt vector and took first PE image
found as Windows Kernel.
But in Windows Server 2022 memory dump this address space range is
full of invalid PE fragments and the tool must check that PE image
is 'ntoskrnl.exe' actually.
So, introduce additional validation by checking image name from
Export Directory against 'ntoskrnl.exe'.
Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-4-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'contrib/elf2dmp/pe.h')
| -rw-r--r-- | contrib/elf2dmp/pe.h | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h index 807d006..71126af 100644 --- a/contrib/elf2dmp/pe.h +++ b/contrib/elf2dmp/pe.h @@ -88,6 +88,20 @@ typedef struct IMAGE_NT_HEADERS64 { IMAGE_OPTIONAL_HEADER64 OptionalHeader; } __attribute__ ((packed)) IMAGE_NT_HEADERS64; +typedef struct IMAGE_EXPORT_DIRECTORY { + uint32_t Characteristics; + uint32_t TimeDateStamp; + uint16_t MajorVersion; + uint16_t MinorVersion; + uint32_t Name; + uint32_t Base; + uint32_t NumberOfFunctions; + uint32_t NumberOfNames; + uint32_t AddressOfFunctions; + uint32_t AddressOfNames; + uint32_t AddressOfNameOrdinals; +} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY; + typedef struct IMAGE_DEBUG_DIRECTORY { uint32_t Characteristics; uint32_t TimeDateStamp; @@ -102,6 +116,7 @@ typedef struct IMAGE_DEBUG_DIRECTORY { #define IMAGE_DEBUG_TYPE_CODEVIEW 2 #endif +#define IMAGE_FILE_EXPORT_DIRECTORY 0 #define IMAGE_FILE_DEBUG_DIRECTORY 6 typedef struct guid_t { |