Add support for loading raw VMWare snapshots

src/CMakeLists.txt

@@ -16,6 +16,11 @@ include_directories(${CMAKE_CURRENT_LIST_DIR}/libs/CLI11/include)
 include_directories(${CMAKE_CURRENT_LIST_DIR}/libs/fmt/include)
 include_directories(${CMAKE_CURRENT_LIST_DIR}/libs/yas/include)
 
+option(ERROR_WARN "Relax error handling , for loading vmware snapshots" OFF)
+if (ERROR_WARN)
+  add_definitions(-DERROR_WARN)
+endif()
+
 file(
     GLOB_RECURSE
     wtf_srcfiles

src/build/build-release-vmware-support.bat

@@ -0,0 +1,2 @@
+cmake .. -GNinja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DERROR_WARN=ON
+cmake --build .

src/libs/kdmp-parser/src/lib/kdmp-parser.h

@@ -80,46 +80,49 @@ class KernelDumpParser {
     //
 
     if (!ParseDmpHeader()) {
-      printf("ParseDmpHeader failed.\n");
-      return false;
-    }
-
-    //
-    // Retrieve the physical memory according to the type of dump we have.
-    //
+      printf("ParseDmpHeader failed. Not a .dmp file? Trying to load as VMWare raw dump.\n");
+      //try to load it as a vmware snapshot
+      if(!BuildPhysmemRawDump()){
+        printf("BuildPhysmemRawDump failed. Not VMWare snapshot either?\n");
+         return false;
+       }
+    }else{
+      //
+      // Retrieve the physical memory according to the type of dump we have.
+      //
 
-    switch (DmpHdr_->DumpType) {
-    case DumpType_t::FullDump: {
-      if (!BuildPhysmemFullDump()) {
-        printf("BuildPhysmemFullDump failed.\n");
-        return false;
+      switch (DmpHdr_->DumpType) {
+      case DumpType_t::FullDump: {
+        if (!BuildPhysmemFullDump()) {
+          printf("BuildPhysmemFullDump failed.\n");
+          return false;
+        }
+        break;
       }
-      break;
-    }
-    case DumpType_t::BMPDump: {
-      if (!BuildPhysmemBMPDump()) {
-        printf("BuildPhysmemBMPDump failed.\n");
-        return false;
+      case DumpType_t::BMPDump: {
+        if (!BuildPhysmemBMPDump()) {
+          printf("BuildPhysmemBMPDump failed.\n");
+          return false;
+        }
+        break;
       }
-      break;
-    }
 
-    case DumpType_t::CompleteMemoryDump:
-    case DumpType_t::KernelAndUserMemoryDump:
-    case DumpType_t::KernelMemoryDump: {
-      if (!BuildPhysicalMemoryFromDump(DmpHdr_->DumpType)) {
-        printf("BuildPhysicalMemoryFromDump failed.\n");
-        return false;
+      case DumpType_t::CompleteMemoryDump:
+      case DumpType_t::KernelAndUserMemoryDump:
+      case DumpType_t::KernelMemoryDump: {
+        if (!BuildPhysicalMemoryFromDump(DmpHdr_->DumpType)) {
+          printf("BuildPhysicalMemoryFromDump failed.\n");
+          return false;
+        }
+        break;
       }
-      break;
-    }
-
-    default: {
-      printf("Invalid type\n");
-      return false;
-    }
-    }
 
+      default: {
+        printf("Invalid type\n");
+        return false;
+      }
+      }
+  }
     return true;
   }
 
@@ -675,6 +678,23 @@ class KernelDumpParser {
     return true;
   }
 
+bool BuildPhysmemRawDump(){
+  //vmware snapshot is just a raw linear dump of physical memory, with some gaps
+  //just fill up a structure for all the pages with appropriate physmem file offsets
+  //assuming physmem dump file is from a vm with 4gb of ram
+  uint8_t *base = (uint8_t *)FileMap_.ViewBase();
+  for(uint64_t i  = 0;i < 786432; i++ ){ //that many pages, first 3gb
+    uint64_t offset = i*4096;
+    Physmem_.try_emplace(offset, (uint8_t *)base+offset);
+  }
+  //there's a gap in VMWare's memory dump from 3 to 4gb, last 1gb is mapped above 4gb
+  for(uint64_t i  = 0;i < 262144; i++ ){
+    uint64_t offset = (i+786432)*4096;
+  Physmem_.try_emplace(i*4096+4294967296, (uint8_t *)base+offset);
+  }
+  return true;
+}
+
   //
   // Parse the DMP_HEADER.
   //

src/wtf/utils.cc

@@ -251,7 +251,11 @@ bool SanitizeCpuState(CpuState_t &CpuState) {
     if (Seg->Reserved != ((Seg->Limit >> 16) & 0xF)) {
       fmt::print("Segment with selector {:x} has invalid attributes.\n",
                  Seg->Selector);
+      #if defined(ERROR_WARN)
+      fmt::print("Above error could be fatal, but continuing anyway.");
+      #else
       return false;
+      #endif
     }
   }
 

src/wtf/wtf.cc

@@ -473,8 +473,13 @@ int main(int argc, const char *argv[]) {
     //
 
     if (!g_Dbg->Init(Opts.DumpPath, Opts.SymbolFilePath)) {
+      fmt::print("WARNING: Debugger init failed.\n");
+      #if defined(ERROR_WARN)
+      fmt::print("Above error could be fatal, but continuing anyway.");
+      #else
       return EXIT_FAILURE;
-    }
+      #endif
+   }
 
     //
     // Set an instruction limit to avoid infinite loops, etc.