Re: [Qemu-devel] [PATCH 41/43] windbg: implemented kd_api_search_memory

[Ladi Prosek]

On Tue, Sep 26, 2017 at 1:07 PM, Mihail Abakumov
<address@hidden> wrote:
> Signed-off-by: Mihail Abakumov <address@hidden>
> Signed-off-by: Pavel Dovgalyuk <address@hidden>
> Signed-off-by: Dmitriy Koltunov <address@hidden>
> ---
>  include/exec/windbgstub-utils.h |    1 +
>  windbgstub-utils.c              |   30 ++++++++++++++++++++++++++++++
>  windbgstub.c                    |    4 ++++
>  3 files changed, 35 insertions(+)
>
> diff --git a/include/exec/windbgstub-utils.h b/include/exec/windbgstub-utils.h
> index 23cafb1a89..ba001ddb42 100755
> --- a/include/exec/windbgstub-utils.h
> +++ b/include/exec/windbgstub-utils.h
> @@ -118,6 +118,7 @@ void kd_api_write_physical_memory(CPUState *cpu, 
> PacketData *pd);
>  void kd_api_get_version(CPUState *cpu, PacketData *pd);
>  void kd_api_read_msr(CPUState *cpu, PacketData *pd);
>  void kd_api_write_msr(CPUState *cpu, PacketData *pd);
> +void kd_api_search_memory(CPUState *cpu, PacketData *pd);
>  void kd_api_unsupported(CPUState *cpu, PacketData *pd);
>
>  SizedBuf kd_gen_exception_sc(CPUState *cpu);
> diff --git a/windbgstub-utils.c b/windbgstub-utils.c
> index 26bdb1f6ea..2d3fbcc41c 100755
> --- a/windbgstub-utils.c
> +++ b/windbgstub-utils.c
> @@ -1540,6 +1540,36 @@ void kd_api_write_msr(CPUState *cpu, PacketData *pd)
>      pd->m64.ReturnStatus = STATUS_SUCCESS;
>  }
>
> +void kd_api_search_memory(CPUState *cpu, PacketData *pd)
> +{
> +    DBGKD_SEARCH_MEMORY *m64c = &pd->m64.u.SearchMemory;
> +    int s_len = MAX(1, ldq_p(&m64c->SearchLength));
> +    int p_len = MIN(ldl_p(&m64c->PatternLength), pd->extra_size);
> +    target_ulong addr = ldq_p(&m64c->SearchAddress);
> +
> +    uint8_t mem[s_len - 1 + p_len];

s_len could be very large, people do things like

0:000> s -d 0x80000000 L?0x7fffffff <pattern>

You should not allocate this buffer on the stack and preferably break
large searches down to smaller ranges, i.e. don't allocate and read
~s_len bytes all at once.

> +    int err = cpu_memory_rw_debug(cpu, addr, mem, sizeof(mem), 0);
> +    if (!err) {
> +        int i;
> +        pd->m64.ReturnStatus = STATUS_NO_MORE_ENTRIES;
> +        for (i = 0; i < s_len; ++i) {
> +            if (memcmp(mem + i, pd->extra, p_len) == 0) {
> +                m64c->FoundAddress = addr + i;
> +                m64c->FoundAddress = ldq_p(&m64c->FoundAddress);
> +                pd->m64.ReturnStatus = STATUS_SUCCESS;
> +                break;
> +            }
> +        }

Use memmem instead?

> +    } else {
> +        pd->m64.ReturnStatus = STATUS_UNSUCCESSFUL;
> +        WINDBG_DEBUG("search_memory: No physical page mapped: " FMT_ADDR,
> +                     addr);
> +    }
> +
> +    pd->extra_size = 0;
> +}
> +
>  void kd_api_unsupported(CPUState *cpu, PacketData *pd)
>  {
>      WINDBG_ERROR("Catched unimplemented api %s",
> diff --git a/windbgstub.c b/windbgstub.c
> index 1ec4932ddc..7cff6bc514 100755
> --- a/windbgstub.c
> +++ b/windbgstub.c
> @@ -205,6 +205,10 @@ static void 
> windbg_process_manipulate_packet(ParsingContext *ctx)
>      case DbgKdClearAllInternalBreakpointsApi:
>          return;
>
> +    case DbgKdSearchMemoryApi:
> +        kd_api_search_memory(cpu, &ctx->data);
> +        break;
> +
>      default:
>          kd_api_unsupported(cpu, &ctx->data);
>          break;
>