00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021 #include "formats.h"
00022 #include "htanaly.h"
00023 #include "htctrl.h"
00024 #include "htdata.h"
00025 #include "htendian.h"
00026 #include "htiobox.h"
00027 #include "htpal.h"
00028 #include "xbestruct.h"
00029 #include "htxbe.h"
00030 #include "htxbeimp.h"
00031 #include "stream.h"
00032 #include "htstring.h"
00033 #include "httag.h"
00034 #include "log.h"
00035 #include "xbe_analy.h"
00036 #include "snprintf.h"
00037 #include "tools.h"
00038
00039 #include <stdlib.h>
00040 #include <string.h>
00041
00042 static const char *xbox_exports[] = {
00043 NULL,
00044 "AvGetSavedDataAddress",
00045 "AvSendTVEncoderOption",
00046 "AvSetDisplayMode",
00047 "AvSetSavedDataAddress",
00048 "DbgBreakPoint",
00049 "DbgBreakPointWithStatus",
00050 "DbgLoadImageSymbols",
00051 "DbgPrint",
00052 "HalReadSMCTrayState",
00053 "DbgPrompt",
00054 "DbgUnLoadImageSymbols",
00055 "ExAcquireReadWriteLockExclusive",
00056 "ExAcquireReadWriteLockShared",
00057 "ExAllocatePool",
00058 "ExAllocatePoolWithTag",
00059 "ExEventObjectType",
00060 "ExFreePool",
00061 "ExInitializeReadWriteLock",
00062 "ExInterlockedAddLargeInteger",
00063 "ExInterlockedAddLargeStatistic",
00064 "ExInterlockedCompareExchange64",
00065 "ExMutantObjectType",
00066 "ExQueryPoolBlockSize",
00067 "ExQueryNonVolatileSetting",
00068 "ExReadWriteRefurbInfo",
00069 "ExRaiseException",
00070 "ExRaiseStatus",
00071 "ExReleaseReadWriteLock",
00072 "ExSaveNonVolatileSetting",
00073 "ExSemaphoreObjectType",
00074 "ExTimerObjectType",
00075 "ExfInterlockedInsertHeadList",
00076 "ExfInterlockedInsertTailList",
00077 "ExfInterlockedRemoveHeadList",
00078 "FscGetCacheSize",
00079 "FscInvalidateIdleBlocks",
00080 "FscSetCacheSize",
00081 "HalClearSoftwareInterrupt",
00082 "HalDisableSystemInterrupt",
00083 "HalDiskCachePartitionCount",
00084 "HalDiskModelNumber",
00085 "HalDiskSerialNumber",
00086 "HalEnableSystemInterrupt",
00087 "HalGetInterruptVector",
00088 "HalReadSMBusValue",
00089 "HalReadWritePCISpace",
00090 "HalRegisterShutdownNotification",
00091 "HalRequestSoftwareInterrupt",
00092 "HalReturnToFirmware",
00093 "HalWriteSMBusValue",
00094 "InterlockedCompareExchange",
00095 "InterlockedDecrement",
00096 "InterlockedIncrement",
00097 "InterlockedExchange",
00098 "InterlockedExchangeAdd",
00099 "InterlockedFlushSList",
00100 "InterlockedPopEntrySList",
00101 "InterlockedPushEntrySList",
00102 "IoAllocateIrp",
00103 "IoBuildAsynchronousFsdRequest",
00104 "IoBuildDeviceIoControlRequest",
00105 "IoBuildSynchronousFsdRequest",
00106 "IoCheckShareAccess",
00107 "IoCompletionObjectType",
00108 "IoCreateDevice",
00109 "IoCreateFile",
00110 "IoCreateSymbolicLink",
00111 "IoDeleteDevice",
00112 "IoDeleteSymbolicLink",
00113 "IoDeviceObjectType",
00114 "IoFileObjectType",
00115 "IoFreeIrp",
00116 "IoInitializeIrp",
00117 "IoInvalidDeviceRequest",
00118 "IoQueryFileInformation",
00119 "IoQueryVolumeInformation",
00120 "IoQueueThreadIrp",
00121 "IoRemoveShareAccess",
00122 "IoSetIoCompletion",
00123 "IoSetShareAccess",
00124 "IoStartNextPacket",
00125 "IoStartNextPacketByKey",
00126 "IoStartPacket",
00127 "IoSynchronousDeviceIoControlRequest",
00128 "IoSynchronousFsdRequest",
00129 "IofCallDriver",
00130 "IofCompleteRequest",
00131 "KdDebuggerEnabled",
00132 "KdDebuggerNotPresent",
00133 "IoDismountVolume",
00134 "IoDismountVolumeByName",
00135 "KeAlertResumeThread",
00136 "KeAlertThread",
00137 "KeBoostPriorityThread",
00138 "KeBugCheck",
00139 "KeBugCheckEx",
00140 "KeCancelTimer",
00141 "KeConnectInterrupt",
00142 "KeDelayExecutionThread",
00143 "KeDisconnectInterrupt",
00144 "KeEnterCriticalRegion",
00145 "MmGlobalData",
00146 "KeGetCurrentIrql",
00147 "KeGetCurrentThread",
00148 "KeInitializeApc",
00149 "KeInitializeDeviceQueue",
00150 "KeInitializeDpc",
00151 "KeInitializeEvent",
00152 "KeInitializeInterrupt",
00153 "KeInitializeMutant",
00154 "KeInitializeQueue",
00155 "KeInitializeSemaphore",
00156 "KeInitializeTimerEx",
00157 "KeInsertByKeyDeviceQueue",
00158 "KeInsertDeviceQueue",
00159 "KeInsertHeadQueue",
00160 "KeInsertQueue",
00161 "KeInsertQueueApc",
00162 "KeInsertQueueDpc",
00163 "KeInterruptTime",
00164 "KeIsExecutingDpc",
00165 "KeLeaveCriticalRegion",
00166 "KePulseEvent",
00167 "KeQueryBasePriorityThread",
00168 "KeQueryInterruptTime",
00169 "KeQueryPerformanceCounter",
00170 "KeQueryPerformanceFrequency",
00171 "KeQuerySystemTime",
00172 "KeRaiseIrqlToDpcLevel",
00173 "KeRaiseIrqlToSynchLevel",
00174 "KeReleaseMutant",
00175 "KeReleaseSemaphore",
00176 "KeRemoveByKeyDeviceQueue",
00177 "KeRemoveDeviceQueue",
00178 "KeRemoveEntryDeviceQueue",
00179 "KeRemoveQueue",
00180 "KeRemoveQueueDpc",
00181 "KeResetEvent",
00182 "KeRestoreFloatingPointState",
00183 "KeResumeThread",
00184 "KeRundownQueue",
00185 "KeSaveFloatingPointState",
00186 "KeSetBasePriorityThread",
00187 "KeSetDisableBoostThread",
00188 "KeSetEvent",
00189 "KeSetEventBoostPriority",
00190 "KeSetPriorityProcess",
00191 "KeSetPriorityThread",
00192 "KeSetTimer",
00193 "KeSetTimerEx",
00194 "KeStallExecutionProcessor",
00195 "KeSuspendThread",
00196 "KeSynchronizeExecution",
00197 "KeSystemTime",
00198 "KeTestAlertThread",
00199 "KeTickCount",
00200 "KeTimeIncrement",
00201 "KeWaitForMultipleObjects",
00202 "KeWaitForSingleObject",
00203 "KfRaiseIrql",
00204 "KfLowerIrql",
00205 "KiBugCheckData",
00206 "KiUnlockDispatcherDatabase",
00207 "LaunchDataPage",
00208 "MmAllocateContiguousMemory",
00209 "MmAllocateContiguousMemoryEx",
00210 "MmAllocateSystemMemory",
00211 "MmClaimGpuInstanceMemory",
00212 "MmCreateKernelStack",
00213 "MmDeleteKernelStack",
00214 "MmFreeContiguousMemory",
00215 "MmFreeSystemMemory",
00216 "MmGetPhysicalAddress",
00217 "MmIsAddressValid",
00218 "MmLockUnlockBufferPages",
00219 "MmLockUnlockPhysicalPage",
00220 "MmMapIoSpace",
00221 "MmPersistContiguousMemory",
00222 "MmQueryAddressProtect",
00223 "MmQueryAllocationSize",
00224 "MmQueryStatistics",
00225 "MmSetAddressProtect",
00226 "MmUnmapIoSpace",
00227 "NtAllocateVirtualMemory",
00228 "NtCancelTimer",
00229 "NtClearEvent",
00230 "NtClose",
00231 "NtCreateDirectoryObject",
00232 "NtCreateEvent",
00233 "NtCreateFile",
00234 "NtCreateIoCompletion",
00235 "NtCreateMutant",
00236 "NtCreateSemaphore",
00237 "NtCreateTimer",
00238 "NtDeleteFile",
00239 "NtDeviceIoControlFile",
00240 "NtDuplicateObject",
00241 "NtFlushBuffersFile",
00242 "NtFreeVirtualMemory",
00243 "NtFsControlFile",
00244 "NtOpenDirectoryObject",
00245 "NtOpenFile",
00246 "NtOpenSymbolicLinkObject",
00247 "NtProtectVirtualMemory",
00248 "NtPulseEvent",
00249 "NtQueueApcThread",
00250 "NtQueryDirectoryFile",
00251 "NtQueryDirectoryObject",
00252 "NtQueryEvent",
00253 "NtQueryFullAttributesFile",
00254 "NtQueryInformationFile",
00255 "NtQueryIoCompletion",
00256 "NtQueryMutant",
00257 "NtQuerySemaphore",
00258 "NtQuerySymbolicLinkObject",
00259 "NtQueryTimer",
00260 "NtQueryVirtualMemory",
00261 "NtQueryVolumeInformationFile",
00262 "NtReadFile",
00263 "NtReadFileScatter",
00264 "NtReleaseMutant",
00265 "NtReleaseSemaphore",
00266 "NtRemoveIoCompletion",
00267 "NtResumeThread",
00268 "NtSetEvent",
00269 "NtSetInformationFile",
00270 "NtSetIoCompletion",
00271 "NtSetSystemTime",
00272 "NtSetTimerEx",
00273 "NtSignalAndWaitForSingleObjectEx",
00274 "NtSuspendThread",
00275 "NtUserIoApcDispatcher",
00276 "NtWaitForSingleObject",
00277 "NtWaitForSingleObjectEx",
00278 "NtWaitForMultipleObjectsEx",
00279 "NtWriteFile",
00280 "NtWriteFileGather",
00281 "NtYieldExecution",
00282 "ObCreateObject",
00283 "ObDirectoryObjectType",
00284 "ObInsertObject",
00285 "ObMakeTemporaryObject",
00286 "ObOpenObjectByName",
00287 "ObOpenObjectByPointer",
00288 "ObpObjectHandleTable",
00289 "ObReferenceObjectByHandle",
00290 "ObReferenceObjectByName",
00291 "ObReferenceObjectByPointer",
00292 "ObSymbolicLinkObjectType",
00293 "ObfDereferenceObject",
00294 "ObfReferenceObject",
00295 "PhyGetLinkState",
00296 "PhyInitialize",
00297 "PsCreateSystemThread",
00298 "PsCreateSystemThreadEx",
00299 "PsQueryStatistics",
00300 "PsSetCreateThreadNotifyRoutine",
00301 "PsTerminateSystemThread",
00302 "PsThreadObjectType",
00303 "RtlAnsiStringToUnicodeString",
00304 "RtlAppendStringToString",
00305 "RtlAppendUnicodeStringToString",
00306 "RtlAppendUnicodeToString",
00307 "RtlAssert",
00308 "RtlCaptureContext",
00309 "RtlCaptureStackBackTrace",
00310 "RtlCharToInteger",
00311 "RtlCompareMemory",
00312 "RtlCompareMemoryUlong",
00313 "RtlCompareString",
00314 "RtlCompareUnicodeString",
00315 "RtlCopyString",
00316 "RtlCopyUnicodeString",
00317 "RtlCreateUnicodeString",
00318 "RtlDowncaseUnicodeChar",
00319 "RtlDowncaseUnicodeString",
00320 "RtlEnterCriticalSection",
00321 "RtlEnterCriticalSectionAndRegion",
00322 "RtlEqualString",
00323 "RtlEqualUnicodeString",
00324 "RtlExtendedIntegerMultiply",
00325 "RtlExtendedLargeIntegerDivide",
00326 "RtlExtendedMagicDivide",
00327 "RtlFillMemory",
00328 "RtlFillMemoryUlong",
00329 "RtlFreeAnsiString",
00330 "RtlFreeUnicodeString",
00331 "RtlGetCallersAddress",
00332 "RtlInitAnsiString",
00333 "RtlInitUnicodeString",
00334 "RtlInitializeCriticalSection",
00335 "RtlIntegerToChar",
00336 "RtlIntegerToUnicodeString",
00337 "RtlLeaveCriticalSection",
00338 "RtlLeaveCriticalSectionAndRegion",
00339 "RtlLowerChar",
00340 "RtlMapGenericMask",
00341 "RtlMoveMemory",
00342 "RtlMultiByteToUnicodeN",
00343 "RtlMultiByteToUnicodeSize",
00344 "RtlNtStatusToDosError",
00345 "RtlRaiseException",
00346 "RtlRaiseStatus",
00347 "RtlTimeFieldsToTime",
00348 "RtlTimeToTimeFields",
00349 "RtlTryEnterCriticalSection",
00350 "RtlUlongByteSwap",
00351 "RtlUnicodeStringToAnsiString",
00352 "RtlUnicodeStringToInteger",
00353 "RtlUnicodeToMultiByteN",
00354 "RtlUnicodeToMultiByteSize",
00355 "RtlUnwind",
00356 "RtlUpcaseUnicodeChar",
00357 "RtlUpcaseUnicodeString",
00358 "RtlUpcaseUnicodeToMultiByteN",
00359 "RtlUpperChar",
00360 "RtlUpperString",
00361 "RtlUshortByteSwap",
00362 "RtlWalkFrameChain",
00363 "RtlZeroMemory",
00364 "XboxEEPROMKey",
00365 "XboxHardwareInfo",
00366 "XboxHDKey",
00367 "XboxKrnlVersion",
00368 "XboxSignatureKey",
00369 "XeImageFileName",
00370 "XeLoadSection",
00371 "XeUnloadSection",
00372 "READ_PORT_BUFFER_UCHAR",
00373 "READ_PORT_BUFFER_USHORT",
00374 "READ_PORT_BUFFER_ULONG",
00375 "WRITE_PORT_BUFFER_UCHAR",
00376 "WRITE_PORT_BUFFER_USHORT",
00377 "WRITE_PORT_BUFFER_ULONG",
00378 "XcSHAInit",
00379 "XcSHAUpdate",
00380 "XcSHAFinal",
00381 "XcRC4Key",
00382 "XcRC4Crypt",
00383 "XcHMAC",
00384 "XcPKEncPublic",
00385 "XcPKDecPrivate",
00386 "XcPKGetKeyLen",
00387 "XcVerifyPKCS1Signature",
00388 "XcModExp",
00389 "XcDESKeyParity",
00390 "XcKeyTable",
00391 "XcBlockCrypt",
00392 "XcBlockCryptCBC",
00393 "XcCryptService",
00394 "XcUpdateCrypto",
00395 "RtlRip",
00396 "XboxLANKey",
00397 "XboxAlternateSignatureKeys",
00398 "XePublicKeyData",
00399 "HalBootSMCVideoMode",
00400 "IdexChannelObject",
00401 "HalIsResetOrShutdownPending",
00402 "IoMarkIrpMustComplete",
00403 "HalInitiateShutdown",
00404 "snprintf",
00405 "sprintf",
00406 "vsnprintf",
00407 "vsprintf",
00408 "HalEnableSecureTrayEject",
00409 "HalWriteSMCScratchRegister"
00410 };
00411
00412 static ht_view *htxbeimports_init(bounds *b, ht_streamfile *file, ht_format_group *group)
00413 {
00414 ht_xbe_shared_data *xbe_shared=(ht_xbe_shared_data *)group->get_shared_data();
00415
00416 int h0=new_timer();
00417 start_timer(h0);
00418
00419 ht_group *g;
00420 bounds c;
00421
00422 c=*b;
00423 g=new ht_group();
00424 g->init(&c, VO_RESIZE, DESC_XBE_IMPORTS"-g");
00425 ht_statictext *head;
00426
00427 int function_count=0;
00428
00429 c.y++;
00430 c.h--;
00431 ht_xbe_import_viewer *v=new ht_xbe_import_viewer();
00432 v->init(&c, DESC_XBE_IMPORTS, group);
00433
00434 c.y--;
00435 c.h=1;
00436
00437 FILEOFS ofs;
00438 UINT thunktablerva = xbe_shared->header.kernel_image_thunk_address - xbe_shared->header.base_address;
00439 UINT *thunktable = (UINT *)malloc(sizeof(xbox_exports));
00440 if (!thunktable) goto xbe_read_error;
00441 memset(thunktable, 0, sizeof(xbox_exports));
00442
00443 if (!xbe_rva_to_ofs(&xbe_shared->sections, thunktablerva, &ofs))
00444 goto xbe_read_error;
00445
00446 file->seek(ofs);
00447 if (file->read(thunktable, sizeof(xbox_exports)-4) != sizeof(xbox_exports)-4)
00448 goto xbe_read_error;
00449
00450 for (; *thunktable; thunktable++, thunktablerva+=4) {
00451 UINT ordinal;
00452
00453 ordinal = create_host_int(thunktable, 4, little_endian);
00454 ht_xbe_import_function *func = new ht_xbe_import_function(thunktablerva, (char *)xbox_exports[ordinal & 0xfff], ordinal);
00455 xbe_shared->imports.funcs->insert(func);
00456 function_count++;
00457 }
00458
00459
00460 stop_timer(h0);
00461
00462 delete_timer(h0);
00463
00464 char iline[256];
00465 ht_snprintf(iline, sizeof iline, "* XBE kernel thunk table at offset %08x (%d functions)", xbe_shared->header.kernel_image_thunk_address, function_count);
00466 head=new ht_statictext();
00467 head->init(&c, iline, align_left);
00468
00469 g->insert(head);
00470 g->insert(v);
00471
00472 for (UINT i=0; i<xbe_shared->imports.funcs->count(); i++) {
00473 ht_xbe_import_function *func = (ht_xbe_import_function*)xbe_shared->imports.funcs->get(i);
00474 assert(func);
00475 char addr[32], name[256];
00476 ht_snprintf(addr, sizeof addr, "%08x", func->address);
00477 if (func->byname) {
00478 ht_snprintf(name, sizeof name, "%s", func->name.name);
00479 } else {
00480 ht_snprintf(name, sizeof name, "%04x (by ordinal)", func->ordinal);
00481 }
00482 v->insert_str(i, "NTOSKRNL.EXE", addr, name);
00483 }
00484
00485 v->update();
00486
00487 g->setpalette(palkey_generic_window_default);
00488
00489 xbe_shared->v_imports=v;
00490 return g;
00491 xbe_read_error:
00492 delete_timer(h0);
00493 errorbox("%s: XBE import section seems to be corrupted.", file->get_filename());
00494 g->done();
00495 delete g;
00496 v->done();
00497 delete v;
00498 return NULL;
00499 }
00500
00501 format_viewer_if htxbeimports_if = {
00502 htxbeimports_init,
00503 NULL
00504 };
00505
00506
00507
00508
00509 ht_xbe_import_function::ht_xbe_import_function(RVA a, UINT o)
00510 {
00511 ordinal = o;
00512 address = a;
00513 byname = false;
00514 }
00515
00516 ht_xbe_import_function::ht_xbe_import_function(RVA a, char *n, UINT h)
00517 {
00518 name.name = ht_strdup(n);
00519 name.hint = h;
00520 address = a;
00521 byname = true;
00522 }
00523
00524 ht_xbe_import_function::~ht_xbe_import_function()
00525 {
00526 if ((byname) && (name.name)) free(name.name);
00527 }
00528
00529
00530
00531
00532 void ht_xbe_import_viewer::init(bounds *b, char *Desc, ht_format_group *fg)
00533 {
00534 ht_text_listbox::init(b, 3, 2, LISTBOX_QUICKFIND);
00535 options |= VO_BROWSABLE;
00536 desc = strdup(Desc);
00537 format_group = fg;
00538 grouplib = false;
00539 sortby = 1;
00540 dosort();
00541 }
00542
00543 void ht_xbe_import_viewer::done()
00544 {
00545 ht_text_listbox::done();
00546 }
00547
00548 void ht_xbe_import_viewer::dosort()
00549 {
00550 ht_text_listbox_sort_order sortord[2];
00551 UINT l, s;
00552 if (grouplib) {
00553 l = 0;
00554 s = 1;
00555 } else {
00556 l = 1;
00557 s = 0;
00558 }
00559 sortord[l].col = 0;
00560 sortord[l].compare_func = strcmp;
00561 sortord[s].col = sortby;
00562 sortord[s].compare_func = strcmp;
00563 sort(2, sortord);
00564 }
00565
00566 char *ht_xbe_import_viewer::func(UINT i, bool execute)
00567 {
00568 switch (i) {
00569 case 2:
00570 if (execute) {
00571 grouplib = !grouplib;
00572 dosort();
00573 }
00574 return grouplib ? (char*)"nbylib" : (char*)"bylib";
00575 case 4:
00576 if (execute) {
00577 if (sortby != 1) {
00578 sortby = 1;
00579 dosort();
00580 }
00581 }
00582 return "byaddr";
00583 case 5:
00584 if (execute) {
00585 if (sortby != 2) {
00586 sortby = 2;
00587 dosort();
00588 }
00589 }
00590 return "byname";
00591 }
00592 return NULL;
00593 }
00594
00595 void ht_xbe_import_viewer::handlemsg(htmsg *msg)
00596 {
00597 switch (msg->msg) {
00598 case msg_funcexec:
00599 if (func(msg->data1.integer, 1)) {
00600 clearmsg(msg);
00601 return;
00602 }
00603 break;
00604 case msg_funcquery: {
00605 char *s=func(msg->data1.integer, 0);
00606 if (s) {
00607 msg->msg=msg_retval;
00608 msg->data1.str=s;
00609 }
00610 break;
00611 }
00612
00613
00614
00615
00616
00617
00618
00619
00620
00621 case msg_keypressed: {
00622 if (msg->data1.integer == K_Return) {
00623 select_entry(e_cursor);
00624 clearmsg(msg);
00625 }
00626 break;
00627 }
00628 }
00629 ht_text_listbox::handlemsg(msg);
00630 }
00631
00632 bool ht_xbe_import_viewer::select_entry(void *entry)
00633 {
00634 ht_text_listbox_item *i = (ht_text_listbox_item *)entry;
00635
00636 ht_xbe_shared_data *xbe_shared=(ht_xbe_shared_data *)format_group->get_shared_data();
00637
00638 ht_xbe_import_function *e = (ht_xbe_import_function*)xbe_shared->imports.funcs->get(i->id);
00639 if (!e) return true;
00640 if (xbe_shared->v_image) {
00641 ht_aviewer *av = (ht_aviewer*)xbe_shared->v_image;
00642 XBEAnalyser *a = (XBEAnalyser*)av->analy;
00643 Address *addr;
00644 addr = a->createAddress32(e->address+xbe_shared->header.base_address);
00645 if (av->gotoAddress(addr, NULL)) {
00646 app->focus(av);
00647 vstate_save();
00648 } else {
00649 global_analyser_address_string_format = ADDRESS_STRING_FORMAT_COMPACT | ADDRESS_STRING_FORMAT_ADD_0X;
00650 errorbox("can't follow: %s %y is not valid !", "import address", addr);
00651 }
00652 delete addr;
00653 } else errorbox("can't follow: no image viewer");
00654 return true;
00655 }
