ntoseye 0.10.1

Windows kernel debugger for Linux hosts running Windows under KVM/QEMU
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

use std::path::PathBuf;

use thiserror::Error;

use crate::types::{PhysAddr, VirtAddr};

#[derive(Debug, Error)]
pub enum Error {
    // Handle crate errors
    #[error(transparent)]
    Nix(#[from] nix::Error),

    #[error(transparent)]
    Io(#[from] std::io::Error),

    #[error(transparent)]
    Pdb2(#[from] pdb2::Error),

    #[error(transparent)]
    Reqwest(#[from] reqwest::Error),

    #[error(transparent)]
    PeLite(#[from] pelite::Error),

    #[error(transparent)]
    ParseInt(#[from] core::num::ParseIntError),

    #[error(transparent)]
    Hex(#[from] hex::FromHexError),

    #[error(transparent)]
    Indicatif(#[from] indicatif::style::TemplateError),

    #[error(transparent)]
    CtrlC(#[from] ctrlc::Error),

    #[error("GDB protocol failure: {0}")]
    Rsp(String),

    #[error("KD protocol failure: {0}")]
    Kd(String),

    #[error("Register '{0}' not found")]
    RegisterNotFound(String),

    #[error("Breakpoint '{0}' not found")]
    BPNotFound(u32),

    #[error("Not supported")]
    NotSupported,

    #[error("{0}")]
    DebugInfo(String),

    // Handle other errors
    #[error("PDB file not found for {0:?}")]
    PdbNotFound(PathBuf),

    #[error("Ntoskrnl not found")]
    NtoskrnlNotFound,

    #[error("PE view failed")]
    ViewFailed,

    #[error("Storage directory wasn't found")]
    StorageNotFound,

    #[error("Symbol '{0}' not found")]
    SymbolNotFound(String),

    #[error("No symbol found near {0:x}")]
    UnknownAddress(VirtAddr),

    #[error("Process '{0}' not found")]
    ProcessNotFound(u64),

    #[error("Structure '{0}' not found")]
    StructNotFound(String),

    #[error("Field '{0}' not found")]
    FieldNotFound(String),

    #[error("Invalid expression: {0}")]
    InvalidExpression(String),

    #[error("Expected loaded symbols")]
    ExpectedSymbols,

    #[error("Process missing PEB (kernel process?)")]
    MissingPEB,

    #[error("Process missing LDR")]
    MissingLDR,

    #[error("Process missing ImageBase")]
    MissingImageBase,

    #[error("Process image not found")]
    MissingImage,

    #[error("No memory regions found in kvm")]
    NoKvmRegions,

    #[error("KVM process not found")]
    KvmNotFound,

    #[error("Another instance of ntoseye is running")]
    AlreadyRunning,

    #[error("Data doesn't find in buffer")]
    BufferNotEnough,

    #[error("Invalid range")]
    InvalidRange,

    #[error("Partial read: {0}b")]
    PartialRead(usize),

    #[error("Partial write: {0}b")]
    PartialWrite(usize),

    #[error("Bad virtual address: {0:x}")]
    BadVirtualAddress(VirtAddr),

    #[error("Bad physical address: {0:x}")]
    BadPhysicalAddress(PhysAddr),
}

pub type Result<T> = std::result::Result<T, Error>;