pkg/kd/kd.go

// Copyright 2017 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// Minimal KD protocol decoder.
// KD protocol is used by windows to talk to debuggers. Here are some links:
// https://github.com/radare/radare2/issues/1246#issuecomment-135565901
// http://articles.sysprogs.org/kdvmware/kdcom/
// https://doxygen.reactos.org/df/de3/windbgkd_8h_source.html
package kd

import (
	"bytes"
	"fmt"
	"unsafe"
)

var (
	dataHeader = []byte{0x30, 0x30, 0x30, 0x30}
)

const (
	typStateChange64 = 7
)

type packet struct {
	header uint32
	typ    uint16
	size   uint16
	id     uint32
	csum   uint32
}

func Decode(data []byte) (start, size int, decoded []byte) {
	if len(data) < len(dataHeader) {
		return
	}
	start = bytes.Index(data, dataHeader)
	if start == -1 {
		start = len(data) - len(dataHeader) - 1
		return
	}
	packetSize := int(unsafe.Sizeof(packet{}))
	if len(data)-start < packetSize {
		return // incomplete header
	}
	// Note: assuming little-endian machine.
	pkt := (*packet)(unsafe.Pointer(&data[start]))
	if len(data)-start < packetSize+int(pkt.size) {
		return // incomplete data
	}
	size = packetSize + int(pkt.size) // skip whole packet
	if pkt.typ == typStateChange64 {
		if int(pkt.size) < int(unsafe.Sizeof(stateChange64{})) {
			return
		}
		payload := (*stateChange64)(unsafe.Pointer(&data[start+packetSize]))
		chance := "second"
		if payload.exception.firstChance != 0 {
			chance = "first"
		}
		decoded = []byte(fmt.Sprintf("\n\nBUG: %v chance exception 0x%x\n\n%#v\n\n",
			chance, payload.exception.code, payload))
	}
	return
}

type stateChange64 struct {
	state          uint32
	processorLevel uint16
	processor      uint16
	numProcessors  uint32
	thread         uint64
	pc             uint64
	exception      exception64
	report         controlReport
}

type exception64 struct {
	code        uint32
	flags       uint32
	record      uint64
	address     uint64
	numParams   uint32
	unused      uint32
	params      [15]uint64
	firstChance uint32
}

type controlReport struct {
	dr6         uint64
	dr7         uint64
	eflags      uint32
	numInstr    uint16
	reportFlags uint16
	instr       [16]byte
	cs          uint16
	ds          uint16
	es          uint16
	fs          uint16
}