forked from rust-minidump/rust-minidump
-
Notifications
You must be signed in to change notification settings - Fork 0
/
format.rs
2450 lines (2306 loc) · 92.4 KB
/
format.rs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
//! Minidump structure definitions.
//!
//! Types defined here should match those defined in [Microsoft's headers][msdn]. Additionally
//! some [Breakpad][breakpad] and [Crashpad][crashpad] extension types are defined here and should
//! match the definitions from those projects.
//!
//! # Type Layouts
//!
//! This library isn't a "proper" minidump-sys library because it doesn't use repr attributes
//! to force Rust to layout these structs identically to how they're laid out in memory.
//!
//! The reasons for this are 3-fold:
//!
//! 1. It isn't necessary because we specify how to serialize/deserialize things with `scroll`
//! via `derive(Pread, Pwrite)` which uses the declared field order and not the in-memory
//! layout, and assumes everything is packed anyway, which as a rule, minidump types are.
//! Specifically they're packed to align 4, but Microsoft is mercifully very attentive to
//! its type layouts so we're not aware of anywhere where packing to align 1 would change
//! offsets. Packing is mostly just there so 32-bit and 64-bit definitely agree on offsets.
//!
//! 2. We would have to mark several types as `repr(packed(4))`, making them dangerous to use
//! as several of the fields would become misaligned. This would create a bunch of
//! unnecessary and brittle `unsafe`.
//!
//! 3. It's not *actually* that useful to have structs with precise in-memory layouts since
//! a minidump parser needs to accept both little-endian and big-endian minidumps, and
//! is therefore swizzling the bytes of all the values anyway. Also it's dangerous to
//! reinterpret a pile of memory as arbitrary types without validation!
//!
//! [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/
//! [breakpad]: https://chromium.googlesource.com/breakpad/breakpad/
//! [crashpad]: https://chromium.googlesource.com/crashpad/crashpad/+/master/README.md
#![allow(non_camel_case_types)]
#![allow(non_upper_case_globals)]
use std::fmt;
use bitflags::bitflags;
use num_derive::FromPrimitive;
use scroll::{Endian, Pread, Pwrite, SizeWith};
use smart_default::SmartDefault;
/// An offset from the start of the minidump file.
pub type RVA = u32;
pub type RVA64 = u64;
/// The 4-byte magic number at the start of a minidump file.
///
/// In little endian this spells 'MDMP'.
pub const MINIDUMP_SIGNATURE: u32 = 0x504d444d;
/// The version of the minidump format.
pub const MINIDUMP_VERSION: u32 = 42899;
/// The header at the start of a minidump file.
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_header
#[derive(Debug, Clone, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_HEADER {
/// This should be [`MINIDUMP_SIGNATURE`][signature].
///
/// [signature]: constant.MINIDUMP_SIGNATURE.html
pub signature: u32,
/// This should be [`MINIDUMP_VERSION`][version].
///
/// [version]: constant.MINIDUMP_VERSION.html
pub version: u32,
/// The number of streams contained in the stream directory.
pub stream_count: u32,
/// The offset to the stream directory within the minidump. This usually points
/// to immediately after the header. The stream directory is an array containing
/// `stream_count` [`MINIDUMP_DIRECTORY`][dir] entries.
///
/// [dir]: struct.MINIDUMP_DIRECTORY.html
pub stream_directory_rva: RVA,
pub checksum: u32,
pub time_date_stamp: u32,
pub flags: u64,
}
/// A location within a minidump file comprised of an offset and a size.
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_location_descriptor
#[derive(Debug, Copy, Default, Clone, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_LOCATION_DESCRIPTOR {
/// The size of this data.
pub data_size: u32,
/// The offset to this data within the minidump file.
pub rva: RVA,
}
impl From<u8> for MINIDUMP_LOCATION_DESCRIPTOR {
fn from(_val: u8) -> Self {
Self::default()
}
}
/// A range of memory contained within a minidump consisting of a base address and a
/// location descriptor.
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_descriptor
#[derive(Debug, Copy, Clone, Default, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_MEMORY_DESCRIPTOR {
/// The base address of this memory range from the process.
pub start_of_memory_range: u64,
/// The offset and size of the actual bytes of memory contained in this dump.
pub memory: MINIDUMP_LOCATION_DESCRIPTOR,
}
/// A large range of memory contained within a minidump (usually a full dump)
/// consisting of a base address and a size.
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_descriptor64
#[derive(Debug, Copy, Clone, Default, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_MEMORY_DESCRIPTOR64 {
/// The base address of this memory range from the process.
pub start_of_memory_range: u64,
/// The size of this data.
pub data_size: u64,
}
/// Information about a data stream contained in a minidump file.
///
/// The minidump header contains a pointer to a list of these structs which allows locating
/// specific streams in the dump.
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_directory
#[derive(Debug, Clone, Default, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_DIRECTORY {
/// This is usually one of the values in [`MINIDUMP_STREAM_TYPE`][ty] for known stream types,
/// but user streams can have arbitrary values.
///
/// [ty]: enum.MINIDUMP_STREAM_TYPE.html
pub stream_type: u32,
/// The location of the stream contents within the dump.
pub location: MINIDUMP_LOCATION_DESCRIPTOR,
}
/// The types of known minidump data streams.
///
/// Most of these values are derived from the [Microsoft enum][msdn] of the same name, but
/// the values after `LastReservedStream` are Breakpad and Crashpad extensions.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_stream_type
#[repr(u32)]
#[derive(Copy, Clone, PartialEq, Eq, Debug, FromPrimitive)]
pub enum MINIDUMP_STREAM_TYPE {
/// An unused stream directory entry
UnusedStream = 0,
ReservedStream0 = 1,
ReservedStream1 = 2,
/// The list of threads from the process
///
/// See [`MINIDUMP_THREAD`].
///
/// Microsoft declares a [`MINIDUMP_THREAD_LIST`][list] struct which is the actual format
/// of this stream, but it is a variable-length struct so no matching definition is provided
/// in this crate.
///
/// [list]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_list
ThreadListStream = 3,
/// The list of executable modules from the process
///
/// See [`MINIDUMP_MODULE`].
///
/// Microsoft declares a [`MINIDUMP_MODULE_LIST`][list] struct which is the actual format
/// of this stream, but it is a variable-length struct so no matching definition is provided
/// in this crate.
///
/// [list]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_module_list
ModuleListStream = 4,
/// The list of memory regions from the process contained within this dump
///
/// See [`MINIDUMP_MEMORY_DESCRIPTOR`].
///
/// Microsoft declares a [`MINIDUMP_MEMORY_LIST`][list] struct which is the actual format
/// of this stream, but it is a variable-length struct so no matching definition is provided
/// in this crate.
///
/// [list]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_list
MemoryListStream = 5,
/// Information about the exception that caused the process to exit
///
/// See [`MINIDUMP_EXCEPTION_STREAM`].
ExceptionStream = 6,
/// System information
///
/// See [`MINIDUMP_SYSTEM_INFO`].
SystemInfoStream = 7,
ThreadExListStream = 8,
/// The list of large memory regions from the process contained within this dump
///
/// See [`MINIDUMP_MEMORY_DESCRIPTOR64`].
///
/// Microsoft declares a [`MINIDUMP_MEMORY64_LIST`][list] struct which is the actual format
/// of this stream, but it is a variable-length struct so no matching definition is provided
/// in this crate.
///
/// [list]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory64_list
Memory64ListStream = 9,
CommentStreamA = 10,
CommentStreamW = 11,
HandleDataStream = 12,
FunctionTable = 13,
/// The list of executable modules from the process that were unloaded by the time of the crash
///
/// See [`MINIDUMP_UNLOADED_MODULE`].
///
/// Microsoft declares a [`MINIDUMP_UNLOADED_MODULE_LIST`][list] struct which is the actual
/// format of this stream, but it is a variable-length struct so no matching definition is
/// in this crate.
///
/// Note that unlike other lists, this one has the newer "extended" header.
///
/// [list]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_unloaded_module_list
UnloadedModuleListStream = 14,
/// Miscellaneous process and system information
///
/// See ['MINIDUMP_MISC_INFO'].
MiscInfoStream = 15,
/// Information about memory regions from the process
///
/// See ['MINIDUMP_MEMORY_INFO_LIST'].
MemoryInfoListStream = 16,
ThreadInfoListStream = 17,
HandleOperationListStream = 18,
TokenStream = 19,
JavaScriptDataStream = 20,
SystemMemoryInfoStream = 21,
ProcessVmCountersStream = 22,
IptTraceStream = 23,
/// Names of threads
///
/// See ['MINIDUMP_THREAD_NAME'].
ThreadNamesStream = 24,
/* Windows CE types, the list is available here https://docs.microsoft.com/en-us/previous-versions/windows/embedded/ms939649(v=msdn.10) */
/// Start of the Windows CE enumerated list, unused.
ceStreamNull = 0x00008000,
/// System-wide information about the device and operating system where the fault occurred. Windows CE-specific.
ceStreamSystemInfo = 0x00008001,
/// Exception record and context for the exception that caused the dump file creation. Windows CE-specific.
ceStreamException = 0x00008002,
/// Modules that were active on the device at the time the dump file was created. Windows CE-specific.
ceStreamModuleList = 0x00008003,
/// Processes that were active on the device at the time the dump file was created. Windows CE-specific.
ceStreamProcessList = 0x00008004,
/// Threads that were active on the device at the time the dump file was created. Windows CE-specific.
ceStreamThreadList = 0x00008005,
/// List of thread context records. Windows CE-specific.
ceStreamThreadContextList = 0x00008006,
/// List of thread callstack records. Windows CE-specific.
ceStreamThreadCallStackList = 0x00008007,
/// List of virtual memory dumps. Windows CE-specific.
ceStreamMemoryVirtualList = 0x00008008,
/// List of physical memory dumps. Windows CE-specific.
ceStreamMemoryPhysicalList = 0x00008009,
/// Bucketing parameters for Watson server. Windows CE-specific.
ceStreamBucketParameters = 0x0000800a,
/// Undocumented Windows CE-specific stream.
ceStreamProcessModuleMap = 0x0000800b,
/// Undocumented Windows CE-specific stream.
ceStreamDiagnosisList = 0x0000800c,
/// Last stream reserved for use by Windows Operating Systems.
LastReservedStream = 0x0000ffff,
/* Breakpad extension types. 0x4767 = "Gg" */
/// Additional process information (Breakpad extension)
///
/// See ['MINIDUMP_BREAKPAD_INFO'].
BreakpadInfoStream = 0x47670001,
/// Assertion information (Breakpad extension)
///
/// See ['MINIDUMP_ASSERTION_INFO'].
AssertionInfoStream = 0x47670002,
/* These are additional minidump stream values which are specific to
* the linux breakpad implementation. */
/// The contents of /proc/cpuinfo from a Linux system
LinuxCpuInfo = 0x47670003,
/// The contents of /proc/self/status from a Linux system
LinuxProcStatus = 0x47670004,
/// The contents of /etc/lsb-release from a Linux system
LinuxLsbRelease = 0x47670005,
/// The contents of /proc/self/cmdline from a Linux system
LinuxCmdLine = 0x47670006,
/// The contents of /proc/self/environ from a Linux system
LinuxEnviron = 0x47670007,
/// The contents of /proc/self/auxv from a Linux system
LinuxAuxv = 0x47670008,
/// The contents of /proc/self/maps from a Linux system
LinuxMaps = 0x47670009,
/// Information from the Linux dynamic linker useful for writing core dumps
///
/// See ['DSO_DEBUG_64'] and ['DSO_DEBUG_32'].
LinuxDsoDebug = 0x4767000A,
// Crashpad extension types. 0x4350 = "CP"
/// Crashpad-specific information containing annotations.
///
/// See [`MINIDUMP_CRASHPAD_INFO`].
CrashpadInfoStream = 0x43500001,
/// Data from the __DATA,__crash_info section of every module which contains
/// one that has useful data. Only available on macOS. 0x4D7A = "Mz".
///
/// See ['MINIDUMP_MAC_CRASH_INFO'].
MozMacosCrashInfoStream = 0x4d7a0001,
/// The kernel boot args on the machine where the crashed process is
/// running. Only available on macOS. 0x4D7A = "Mz".
///
/// See ['MINIDUMP_MAC_BOOTARGS']
MozMacosBootargsStream = 0x4d7a0002,
}
impl From<MINIDUMP_STREAM_TYPE> for u32 {
fn from(ty: MINIDUMP_STREAM_TYPE) -> Self {
ty as u32
}
}
/// The name of a thread, found in the ThreadNamesStream.
#[derive(Debug, Clone, Default, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_THREAD_NAME {
/// The id of the thread.
pub thread_id: u32,
/// Where the name of the thread is stored (yes, the legendary RVA64 is real!!).
pub thread_name_rva: RVA64,
}
/// Information about a single module (executable or shared library) from a minidump
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_module
#[derive(Debug, Clone, Default, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_MODULE {
/// The base address of the executable image in memory.
pub base_of_image: u64,
/// The size of the executable image in memory, in bytes.
pub size_of_image: u32,
/// The checksum value from the PE headers.
pub checksum: u32,
/// The timestamp value from the PE headers in `time_t` format.
pub time_date_stamp: u32,
/// An offset to a length-prefixed UTF-16LE string containing the name of the module.
pub module_name_rva: RVA,
/// Version information for this module.
pub version_info: VS_FIXEDFILEINFO,
/// The location of a CodeView record describing debug information for this module.
///
/// This should be one of [`CV_INFO_PDB70`][pdb70], [`CV_INFO_PDB20`][pdb20], or
/// [`CV_INFO_ELF`][elf]. `PDB70` is the most common in practice, describing a standalone PDB
/// file by way of GUID, age, and PDB filename, and `ELF` is a Breakpad extension for
/// describing ELF modules with Build IDs.
///
/// See [Matching Debug Information][dbg] for more information.
///
/// [dbg]: http://web.archive.org/web/20210227224734/https://www.debuginfo.com/articles/debuginfomatch.html
/// [pdb70]: struct.CV_INFO_PDB70.html
/// [pdb20]: struct.CV_INFO_PDB20.html
/// [elf]: struct.CV_INFO_ELF.html
pub cv_record: MINIDUMP_LOCATION_DESCRIPTOR,
/// The location of an `IMAGE_DEBUG_MISC` record describing debug information for this module.
pub misc_record: MINIDUMP_LOCATION_DESCRIPTOR,
pub reserved0: [u32; 2],
pub reserved1: [u32; 2],
}
/// Information about a single unloaded module (executable or shared library) from a minidump.
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_unloaded_module
#[derive(Debug, Clone, Default, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_UNLOADED_MODULE {
/// The base address of the executable image in memory (when it was loaded).
pub base_of_image: u64,
/// The size of the executable image in memory, in bytes.
pub size_of_image: u32,
/// The checksum value from the PE headers.
pub checksum: u32,
/// The timestamp value from the PE headers in `time_t` format.
pub time_date_stamp: u32,
/// An offset to a length-prefixed UTF-16LE string containing the name of the module.
pub module_name_rva: RVA,
}
/// Version information for a file
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/verrsrc/ns-verrsrc-vs_fixedfileinfo
#[derive(Debug, Clone, Default, Pread, Pwrite, SizeWith)]
pub struct VS_FIXEDFILEINFO {
/// Contains the value of `VS_FFI_SIGNATURE`
pub signature: u32,
/// Should contain the value of `VS_FFI_STRUCVERSION`
pub struct_version: u32,
pub file_version_hi: u32,
pub file_version_lo: u32,
pub product_version_hi: u32,
pub product_version_lo: u32,
pub file_flags_mask: u32,
pub file_flags: u32,
pub file_os: u32,
pub file_type: u32,
pub file_subtype: u32,
pub file_date_hi: u32,
pub file_date_lo: u32,
}
/// The expected value of `VS_FIXEDFILEINFO.signature`
pub const VS_FFI_SIGNATURE: u32 = 0xfeef04bd;
/// The expected value of `VS_FIXEDFILEINFO.struct_version`
pub const VS_FFI_STRUCVERSION: u32 = 0x00010000;
/// Known values for the `signature` field of CodeView records
///
/// In addition to the two CodeView record formats used for linking
/// to external pdb files it is possible for debugging data to be carried
/// directly in the CodeView record itself. These signature values will
/// be found in the first 4 bytes of the CodeView record. Additional values
/// not commonly experienced in the wild are given by ["Microsoft Symbol and
/// Type Information"][sym] section 7.2. An in-depth description of the CodeView 4.1 format
/// is given by ["Undocumented Windows 2000 Secrets"][win2k], Windows 2000 Debugging Support/
/// Microsoft Symbol File Internals/CodeView Subsections.
///
/// [sym]: http://web.archive.org/web/20070915060650/http://www.x86.org/ftp/manuals/tools/sym.pdf
/// [win2k]: https://dl.acm.org/citation.cfm?id=375734
#[repr(u32)]
#[derive(Copy, Clone, PartialEq, Eq, Debug, FromPrimitive)]
pub enum CvSignature {
/// PDB 2.0 CodeView data: 'NB10': [`CV_INFO_PDB20`]
Pdb20 = 0x3031424e,
/// PDB 7.0 CodeView data: 'RSDS': [`CV_INFO_PDB70`]
Pdb70 = 0x53445352,
/// ELF Build ID, a Breakpad extension: 'BpEL': [`CV_INFO_ELF`]
Elf = 0x4270454c,
/// CodeView 4.10: 'NB09'
Cv41 = 0x3930424e,
/// CodeView 5.0: 'NB11'
Cv50 = 0x3131424e,
}
/// CodeView debug information in the older PDB 2.0 ("NB10") format.
///
/// This struct is defined as variable-length in C with a trailing PDB filename member.
#[derive(Debug, Clone)]
pub struct CV_INFO_PDB20 {
/// This field will always be [`CvSignature::Pdb20`].
pub cv_signature: u32,
pub cv_offset: u32,
pub signature: u32,
pub age: u32,
/// The PDB filename as a zero-terminated byte string
pub pdb_file_name: Vec<u8>,
}
impl<'a> scroll::ctx::TryFromCtx<'a, Endian> for CV_INFO_PDB20 {
type Error = scroll::Error;
fn try_from_ctx(src: &[u8], endian: Endian) -> Result<(Self, usize), Self::Error> {
let offset = &mut 0;
Ok((
CV_INFO_PDB20 {
cv_signature: src.gread_with(offset, endian)?,
cv_offset: src.gread_with(offset, endian)?,
signature: src.gread_with(offset, endian)?,
age: src.gread_with(offset, endian)?,
pdb_file_name: {
let size = src.len() - *offset;
src.gread_with::<&[u8]>(offset, size)?.to_owned()
},
},
*offset,
))
}
}
/// CodeView debug information in the current PDB 7.0 ("RSDS") format.
///
/// This struct is defined as variable-length in C with a trailing PDB filename member.
#[derive(Debug, Clone)]
pub struct CV_INFO_PDB70 {
/// This will always be [`CvSignature::Pdb70`]
pub cv_signature: u32,
/// A unique identifer for a module created on first build.
pub signature: GUID,
/// A counter, incremented for each rebuild that updates the PDB file.
pub age: u32,
/// The PDB filename as a zero-terminated byte string
pub pdb_file_name: Vec<u8>,
}
impl<'a> scroll::ctx::TryFromCtx<'a, Endian> for CV_INFO_PDB70 {
type Error = scroll::Error;
fn try_from_ctx(src: &[u8], endian: Endian) -> Result<(Self, usize), Self::Error> {
let offset = &mut 0;
Ok((
CV_INFO_PDB70 {
cv_signature: src.gread_with(offset, endian)?,
signature: src.gread_with(offset, endian)?,
age: src.gread_with(offset, endian)?,
pdb_file_name: {
let size = src.len() - *offset;
src.gread_with::<&[u8]>(offset, size)?.to_owned()
},
},
*offset,
))
}
}
/// A GUID as specified in Rpcdce.h
///
/// Matches the [Microsoft struct][msdn] of the same name.
///
/// # Display
///
/// There are two `Display` implementations for GUIDs. The regular formatting is lowercase with
/// hyphens. The alternate formatting used with `#` is the symbol server format (uppercase without
/// hyphens).
///
/// ```
/// use minidump_common::format::GUID;
///
/// let guid = GUID { data1: 10, data2: 11, data3: 12, data4: [1,2,3,4,5,6,7,8] };
///
/// // default formatting
/// assert_eq!("0000000a-000b-000c-0102-030405060708", guid.to_string());
///
/// // symbol server formatting
/// assert_eq!("0000000A000B000C0102030405060708", format!("{:#}", guid));
/// ```
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/guiddef/ns-guiddef-guid
#[derive(Clone, Copy, Debug, PartialEq, Eq, Pread, Pwrite, SizeWith)]
pub struct GUID {
pub data1: u32,
pub data2: u16,
pub data3: u16,
pub data4: [u8; 8],
}
/// Creates a GUID from a raw byte array. It is assumed that the components in
/// the array are in big-endian order.
///
/// ```
/// use minidump_common::format::GUID;
///
/// let mut buf = [0u8; 16];
/// buf[0..4].copy_from_slice(&0xdeadc0deu32.to_be_bytes());
/// buf[4..6].copy_from_slice(&0xb105u16.to_be_bytes());
/// buf[6..8].copy_from_slice(&0xc0deu16.to_be_bytes());
/// buf[8..].copy_from_slice(&[1, 2, 3, 4, 5, 6, 7, 8]);
///
/// let guid: GUID = buf.into();
///
/// let expected = GUID { data1: 0xdeadc0de, data2: 0xb105, data3: 0xc0de, data4: [1, 2, 3, 4, 5, 6, 7, 8] };
///
/// assert_eq!(guid, expected);
/// ```
impl From<[u8; 16]> for GUID {
fn from(uuid: [u8; 16]) -> Self {
let data1 = (uuid[0] as u32) << 24
| (uuid[1] as u32) << 16
| (uuid[2] as u32) << 8
| uuid[3] as u32;
let data2 = (uuid[4] as u16) << 8 | uuid[5] as u16;
let data3 = (uuid[6] as u16) << 8 | uuid[7] as u16;
let mut data4 = [0u8; 8];
data4.copy_from_slice(&uuid[8..]);
Self {
data1,
data2,
data3,
data4,
}
}
}
impl fmt::Display for GUID {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
// NB: This formatting is not endianness aware. GUIDs read from LE minidumps are printed
// with reversed fields.
if f.alternate() {
write!(
f,
"{:08X}{:04X}{:04X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}",
self.data1,
self.data2,
self.data3,
self.data4[0],
self.data4[1],
self.data4[2],
self.data4[3],
self.data4[4],
self.data4[5],
self.data4[6],
self.data4[7],
)
} else {
write!(
f,
"{:08x}-{:04x}-{:04x}-{:02x}{:02x}-{:02x}{:02x}{:02x}{:02x}{:02x}{:02x}",
self.data1,
self.data2,
self.data3,
self.data4[0],
self.data4[1],
self.data4[2],
self.data4[3],
self.data4[4],
self.data4[5],
self.data4[6],
self.data4[7],
)
}
}
}
/// An ELF Build ID.
///
/// Modern ELF toolchains insert a "[build id][buildid]" into the ELF headers that typically
/// contains a hash of some ELF headers and sections to uniquely identify a binary. The Build ID
/// is allowed to be an arbitrary number of bytes however, and [GNU binutils allows creating
/// ELF binaries with Build IDs of various formats][binutils].
///
/// [buildid]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/developer_guide/compiling-build-id
/// [binutils]: https://sourceware.org/binutils/docs-2.26/ld/Options.html#index-g_t_002d_002dbuild_002did-292
#[derive(Debug, Clone)]
pub struct CV_INFO_ELF {
/// This will always be [`CvSignature::Elf`]
pub cv_signature: u32,
/// The build id, a variable number of bytes
pub build_id: Vec<u8>,
}
impl<'a> scroll::ctx::TryFromCtx<'a, Endian> for CV_INFO_ELF {
type Error = scroll::Error;
fn try_from_ctx(src: &'a [u8], endian: Endian) -> Result<(Self, usize), Self::Error> {
let offset = &mut 0;
Ok((
CV_INFO_ELF {
cv_signature: src.gread_with(offset, endian)?,
build_id: {
let size = src.len() - *offset;
src.gread_with::<&[u8]>(offset, size)?.to_owned()
},
},
*offset,
))
}
}
/// Obsolete debug record type defined in WinNT.h.
#[derive(Debug, Clone, Pread, Pwrite, SizeWith)]
pub struct IMAGE_DEBUG_MISC {
pub data_type: u32,
pub length: u32,
pub unicode: u8,
pub reserved: [u8; 3],
pub data: [u8; 1],
}
/// Information about a single thread from a minidump
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread
#[derive(Debug, Clone, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_THREAD {
/// The identifier of this thread
pub thread_id: u32,
/// The suspend count for this thread
///
/// If greater than zero, the thread is suspended.
pub suspend_count: u32,
/// The priority class of the thread
///
/// See [Scheduling Priorities][msdn] on MSDN.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/ProcThread/scheduling-priorities
pub priority_class: u32,
/// The priority level of the thread
pub priority: u32,
/// The thread environment block
pub teb: u64,
/// The location and base address of this thread's stack memory
pub stack: MINIDUMP_MEMORY_DESCRIPTOR,
/// The location of a CPU-specific `CONTEXT_` struct for this thread's CPU context
pub thread_context: MINIDUMP_LOCATION_DESCRIPTOR,
}
/// Information about the exception that caused the process to terminate.
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_exception_stream
#[derive(Debug, Clone, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_EXCEPTION_STREAM {
/// The identifier of the thread that encountered the exception.
pub thread_id: u32,
pub __align: u32,
/// Detailed information about the exception encountered.
pub exception_record: MINIDUMP_EXCEPTION,
/// The offset of a CPU context record from the time the thread encountered the exception.
///
/// The actual data will be one of the `CONTEXT_*` structs defined here.
pub thread_context: MINIDUMP_LOCATION_DESCRIPTOR,
}
/// Detailed information about an exception.
///
/// This struct matches the [Microsoft struct][msdn] of the same name.
///
/// [msdn]: https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_exception
#[derive(Debug, Clone, Default, Pread, Pwrite, SizeWith)]
pub struct MINIDUMP_EXCEPTION {
/// The reason the exception occurred.
///
/// Possible values are in the following enums:
///
/// * [`ExceptionCodeWindows`](crate::errors::ExceptionCodeWindows)
/// * [`WinErrorWindows`](crate::errors::WinErrorWindows)
/// * [`NtStatusWindows`](crate::errors::NtStatusWindows)
/// * [`ExceptionCodeLinux`](crate::errors::ExceptionCodeLinux)
/// * [`ExceptionCodeMac`](crate::errors::ExceptionCodeMac)
pub exception_code: u32,
/// Flags related to the exception.
///
/// On Windows this is 1 for noncontinuable exceptions and 0 otherwise. For Breakpad-produced
/// minidumps on macOS this field is used to store additional exception information.
pub exception_flags: u32,
/// The address of an associated [`MINIDUMP_EXCEPTION`] for a nested exception.
///
/// This address is in the minidump producing host's memory.
pub exception_record: u64,
/// The address where the exception occurred.
///
/// For Breakpad-produced minidumps on macOS this is the exception subcode, which is
/// typically the address.
pub exception_address: u64,
/// The number of valid elements in [`MINIDUMP_EXCEPTION::exception_information`].
pub number_parameters: u32,
pub __align: u32,
/// An array of additional arguments that describe the exception.
///
/// For most exception codes the array elements are undefined, but for access violations
/// the array will contain two elements: a read/write flag in the first element and
/// the virtual address whose access caused the exception in the second element.
pub exception_information: [u64; 15], // EXCEPTION_MAXIMUM_PARAMETERS
}
/// Valid bits in a `context_flags` for [`ContextFlagsCpu`]
pub const CONTEXT_CPU_MASK: u32 = 0xffffff00;
/// x86 and x64 contexts have this bit set in their `context_flags` when they have
/// extra XSTATE beyond the traditional context definition.
pub const CONTEXT_HAS_XSTATE: u32 = 0x00000040;
bitflags! {
/// CPU type values in the `context_flags` member of `CONTEXT_` structs
///
/// This applies to the [`CONTEXT_ARM`], [`CONTEXT_PPC`], [`CONTEXT_MIPS`],
/// [`CONTEXT_AMD64`], [`CONTEXT_ARM64`], [`CONTEXT_PPC64`], [`CONTEXT_SPARC`] and
/// [`CONTEXT_ARM64_OLD`] structs.
pub struct ContextFlagsCpu: u32 {
const CONTEXT_IA64 = 0x80000;
/// Super-H, includes SH3, from winnt.h in the Windows CE 5.0 SDK
const CONTEXT_SHX = 0xc0;
/// From winnt.h in the Windows CE 5.0 SDK, no longer used
///
/// Originally used by Breakpad but changed after conflicts with other context
/// flag bits.
const CONTEXT_ARM_OLD = 0x40;
/// Alpha, from winnt.h in the Windows CE 5.0 SDK
const CONTEXT_ALPHA = 0x20000;
const CONTEXT_AMD64 = 0x100000;
const CONTEXT_ARM = 0x40000000;
const CONTEXT_ARM64 = 0x400000;
const CONTEXT_ARM64_OLD = 0x80000000;
const CONTEXT_MIPS = 0x40000;
const CONTEXT_MIPS64 = 0x80000;
const CONTEXT_PPC = 0x20000000;
const CONTEXT_PPC64 = 0x1000000;
const CONTEXT_SPARC = 0x10000000;
const CONTEXT_X86 = 0x10000;
}
}
impl ContextFlagsCpu {
/// Populate a [`ContextFlagsCpu`] with valid bits from `flags`
pub fn from_flags(flags: u32) -> ContextFlagsCpu {
ContextFlagsCpu::from_bits_truncate(flags & CONTEXT_CPU_MASK)
}
}
bitflags! {
/// Flags available for use in [`CONTEXT_AMD64.context_flags`]
pub struct ContextFlagsAmd64: u32 {
/// SegSs, Rsp, SegCs, Rip, and EFlags
const CONTEXT_AMD64_CONTROL = 0x00000001 | ContextFlagsCpu::CONTEXT_AMD64.bits;
/// Rax, Rcx, Rdx, Rbx, Rbp, Rsi, Rdi, and R8-R15
const CONTEXT_AMD64_INTEGER = 0x00000002 | ContextFlagsCpu::CONTEXT_AMD64.bits;
/// SegDs, SegEs, SegFs, and SegGs
const CONTEXT_AMD64_SEGMENTS = 0x00000004 | ContextFlagsCpu::CONTEXT_AMD64.bits;
/// Xmm0-Xmm15
const CONTEXT_AMD64_FLOATING_POINT = 0x00000008 | ContextFlagsCpu::CONTEXT_AMD64.bits;
/// Dr0-Dr3 and Dr6-Dr7
const CONTEXT_AMD64_DEBUG_REGISTERS = 0x00000010 | ContextFlagsCpu::CONTEXT_AMD64.bits;
const CONTEXT_AMD64_XSTATE = 0x00000020 | ContextFlagsCpu::CONTEXT_AMD64.bits;
const CONTEXT_AMD64_FULL = Self::CONTEXT_AMD64_CONTROL.bits | Self::CONTEXT_AMD64_INTEGER.bits | Self::CONTEXT_AMD64_FLOATING_POINT.bits;
const CONTEXT_AMD64_ALL = Self::CONTEXT_AMD64_FULL.bits | Self::CONTEXT_AMD64_SEGMENTS.bits | Self::CONTEXT_AMD64_DEBUG_REGISTERS.bits;
}
}
bitflags! {
/// Flags available for use in [`CONTEXT_X86.context_flags`]
pub struct ContextFlagsX86: u32 {
/// Ebp, Eip, SegCs, EFlags, Esp, SegSs
const CONTEXT_X86_CONTROL = 0x00000001 | ContextFlagsCpu::CONTEXT_X86.bits;
/// Edi, Esi, Ebx, Edx, Ecx, Eax
const CONTEXT_X86_INTEGER = 0x00000002 | ContextFlagsCpu::CONTEXT_X86.bits;
/// SegDs, SegEs, SegFs, and SegGs
const CONTEXT_X86_SEGMENTS = 0x00000004 | ContextFlagsCpu::CONTEXT_X86.bits;
/// Fpcr, Fpsr, Fptag, Fpioff, Fpisel, Fpdoff, Fpdsel, Mxcsr, Mxcsr_mask, Xmm0-Xmm7
const CONTEXT_X86_FLOATING_POINT = 0x00000008 | ContextFlagsCpu::CONTEXT_X86.bits;
/// Dr0-Dr3 and Dr6-Dr7
const CONTEXT_X86_DEBUG_REGISTERS = 0x00000010 | ContextFlagsCpu::CONTEXT_X86.bits;
const CONTEXT_X86_EXTENDED_REGISTERS = 0x00000020 | ContextFlagsCpu::CONTEXT_X86.bits;
const CONTEXT_X86_XSTATE = 0x00000040 | ContextFlagsCpu::CONTEXT_X86.bits;
const CONTEXT_X86_FULL = Self::CONTEXT_X86_CONTROL.bits | Self::CONTEXT_X86_INTEGER.bits | Self::CONTEXT_X86_SEGMENTS.bits;
const CONTEXT_X86_ALL = Self::CONTEXT_X86_FULL.bits | Self::CONTEXT_X86_FLOATING_POINT.bits | Self::CONTEXT_X86_DEBUG_REGISTERS.bits | Self::CONTEXT_X86_EXTENDED_REGISTERS.bits;
}
}
bitflags! {
/// Flags available for use in [`CONTEXT_ARM64.context_flags`]
pub struct ContextFlagsArm64: u32 {
/// FP, LR, SP, PC, and CPSR
const CONTEXT_ARM64_CONTROL = 0x00000001 | ContextFlagsCpu::CONTEXT_ARM64.bits;
/// X0-X28 (but maybe not X18)
const CONTEXT_ARM64_INTEGER = 0x00000002 | ContextFlagsCpu::CONTEXT_ARM64.bits;
/// Fpcr, Fpsr, D0-D31 (AKA Q0-Q31, AKA S0-S31)
const CONTEXT_ARM64_FLOATING_POINT = 0x00000004 | ContextFlagsCpu::CONTEXT_ARM64.bits;
/// DBGBVR, DBGBCR, DBGWVR, DBGWCR
const CONTEXT_ARM64_DEBUG_REGISTERS = 0x0000008 | ContextFlagsCpu::CONTEXT_ARM64.bits;
/// Whether x18 has a valid value, because on Windows it contains the TEB.
///
/// NOTE: at this precise moment breakpad doesn't define this, but Microsoft does!
const CONTEXT_ARM64_X18 = 0x0000010 | ContextFlagsCpu::CONTEXT_ARM64.bits;
const CONTEXT_ARM64_FULL = Self::CONTEXT_ARM64_CONTROL.bits | Self::CONTEXT_ARM64_INTEGER.bits | Self::CONTEXT_ARM64_FLOATING_POINT.bits;
const CONTEXT_ARM64_ALL = Self::CONTEXT_ARM64_FULL.bits | Self::CONTEXT_ARM64_DEBUG_REGISTERS.bits | Self::CONTEXT_ARM64_X18.bits;
}
}
bitflags! {
/// Flags available for use in [`CONTEXT_ARM64_OLD.context_flags`]
pub struct ContextFlagsArm64Old: u32 {
// Yes, breakpad never defined CONTROL for this context
/// FP, LR, SP, PC, CPSR, and X0-X28
const CONTEXT_ARM64_OLD_INTEGER = 0x00000002 | ContextFlagsCpu::CONTEXT_ARM64_OLD.bits;
/// Fpcr, Fpsr, D0-D31 (AKA Q0-Q31, AKA S0-S31)
const CONTEXT_ARM64_OLD_FLOATING_POINT = 0x00000004 | ContextFlagsCpu::CONTEXT_ARM64_OLD.bits;
const CONTEXT_ARM64_OLD_FULL = Self::CONTEXT_ARM64_OLD_INTEGER.bits | Self::CONTEXT_ARM64_OLD_FLOATING_POINT.bits;
const CONTEXT_ARM64_OLD_ALL = Self::CONTEXT_ARM64_OLD_FULL.bits;
}
}
bitflags! {
/// Flags available for use in [`CONTEXT_ARM.context_flags`]
pub struct ContextFlagsArm: u32 {
// Yes, breakpad never defined CONTROL for this context
/// SP, LR, PC, and CPSR
const CONTEXT_ARM_CONTROL = 0x00000001 | ContextFlagsCpu::CONTEXT_ARM.bits;
/// R0-R12
const CONTEXT_ARM_INTEGER = 0x00000002 | ContextFlagsCpu::CONTEXT_ARM.bits;
/// Q0-Q15 / D0-D31 / S0-S31
const CONTEXT_ARM_FLOATING_POINT = 0x00000004 | ContextFlagsCpu::CONTEXT_ARM.bits;
/// DBGBVR, DBGBCR, DBGWVR, DBGWCR
const CONTEXT_ARM_DEBUG_REGISTERS = 0x00000008 | ContextFlagsCpu::CONTEXT_ARM.bits;
const CONTEXT_ARM_FULL = Self::CONTEXT_ARM_CONTROL.bits | Self::CONTEXT_ARM_INTEGER.bits | Self::CONTEXT_ARM_FLOATING_POINT.bits;
const CONTEXT_ARM_ALL = Self::CONTEXT_ARM_FULL.bits | Self::CONTEXT_ARM_DEBUG_REGISTERS.bits;
}
}
/// Possible contents of [`CONTEXT_AMD64::float_save`].
///
/// This struct matches the definition of the struct with the same name from WinNT.h.
#[derive(Debug, SmartDefault, Clone, Pread, Pwrite, SizeWith)]
pub struct XMM_SAVE_AREA32 {
pub control_word: u16,
pub status_word: u16,
pub tag_word: u8,
pub reserved1: u8,
pub error_opcode: u16,
pub error_offset: u32,
pub error_selector: u16,
pub reserved2: u16,
pub data_offset: u32,
pub data_selector: u16,
pub reserved3: u16,
pub mx_csr: u32,
pub mx_csr_mask: u32,
#[default([0; 8])]
pub float_registers: [u128; 8],
#[default([0; 16])]
pub xmm_registers: [u128; 16],
#[default([0; 96])]
pub reserved4: [u8; 96],
}
/// Possible contents of [`CONTEXT_AMD64::float_save`].
///
/// This is defined as an anonymous struct inside an anonymous union in
/// the x86-64 CONTEXT struct in WinNT.h.
#[derive(Debug, Clone, Pread, Pwrite, SizeWith)]
pub struct SSE_REGISTERS {
pub header: [u128; 2],
pub legacy: [u128; 8],
pub xmm0: u128,
pub xmm1: u128,
pub xmm2: u128,
pub xmm3: u128,
pub xmm4: u128,
pub xmm5: u128,
pub xmm6: u128,
pub xmm7: u128,
pub xmm8: u128,
pub xmm9: u128,
pub xmm10: u128,
pub xmm11: u128,
pub xmm12: u128,
pub xmm13: u128,
pub xmm14: u128,
pub xmm15: u128,
}
/// An x86-64 (amd64) CPU context
///
/// This struct matches the definition of `CONTEXT` in WinNT.h for x86-64.
#[derive(Debug, SmartDefault, Clone, Pread, Pwrite, SizeWith)]
#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
pub struct CONTEXT_AMD64 {
pub p1_home: u64,
pub p2_home: u64,
pub p3_home: u64,
pub p4_home: u64,
pub p5_home: u64,
pub p6_home: u64,
pub context_flags: u32,
pub mx_csr: u32,
pub cs: u16,
pub ds: u16,
pub es: u16,
pub fs: u16,
pub gs: u16,
pub ss: u16,
pub eflags: u32,
pub dr0: u64,
pub dr1: u64,
pub dr2: u64,
pub dr3: u64,
pub dr6: u64,
pub dr7: u64,
pub rax: u64,
pub rcx: u64,
pub rdx: u64,
pub rbx: u64,
pub rsp: u64,
pub rbp: u64,
pub rsi: u64,
pub rdi: u64,
pub r8: u64,
pub r9: u64,
pub r10: u64,
pub r11: u64,
pub r12: u64,
pub r13: u64,
pub r14: u64,
pub r15: u64,
pub rip: u64,
/// Floating point state
///
/// This is defined as a union in the C headers, but also
/// ` MAXIMUM_SUPPORTED_EXTENSION` is defined as 512 bytes.
///