Adding upstream version 6.0.4-dfsg.upstream/6.0.4-dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 813 insertions, 0 deletions

diff --git a/src/VBox/Runtime/r0drv/nt/nt3fakes-r0drv-nt.cpp b/src/VBox/Runtime/r0drv/nt/nt3fakes-r0drv-nt.cpp
new file mode 100644
index 00000000..375069e5
--- /dev/null
+++ b/src/VBox/Runtime/r0drv/nt/nt3fakes-r0drv-nt.cpp
@@ -0,0 +1,813 @@
+/* $Id: nt3fakes-r0drv-nt.cpp $ */
+/** @file
+ * IPRT - NT 3.x fakes for NT 4.0 KPIs.
+ */
+
+/*
+ * Copyright (C) 2006-2019 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+ * VirtualBox OSE distribution, in which case the provisions of the
+ * CDDL are applicable instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+
+/*********************************************************************************************************************************
+*   Header Files                                                                                                                 *
+*********************************************************************************************************************************/
+#define _IMAGE_NT_HEADERS           RT_CONCAT(_IMAGE_NT_HEADERS,ARCH_BITS)
+#include "the-nt-kernel.h"
+#include <iprt/mem.h>
+
+#include <iprt/assert.h>
+#include <iprt/asm.h>
+#include <iprt/ctype.h>
+#include <iprt/dbg.h>
+#include <iprt/err.h>
+#include <iprt/log.h>
+#include <iprt/string.h>
+#include <iprt/utf16.h>
+#include <iprt/x86.h>
+#include <iprt/formats/mz.h>
+#include <iprt/formats/pecoff.h>
+#include "internal-r0drv-nt.h"
+
+typedef uint32_t DWORD;
+#include <VerRsrc.h>
+
+
+/*********************************************************************************************************************************
+*   Internal Functions                                                                                                           *
+*********************************************************************************************************************************/
+DECLASM(void) rtNt3InitSymbolsAssembly(void); /* in nt3fakesA-r0drv-nt.asm */
+
+
+/*********************************************************************************************************************************
+*   Global Variables                                                                                                             *
+*********************************************************************************************************************************/
+static uint32_t         g_uNt3MajorVer  = 3;
+static uint32_t         g_uNt3MinorVer  = 51;
+static uint32_t         g_uNt3BuildNo   = 1057;
+static bool             g_fNt3Checked   = false;
+static bool             g_fNt3Smp       = false; /**< Not reliable. */
+static bool volatile    g_fNt3VersionInitialized = false;
+
+static uint8_t         *g_pbNt3OsKrnl   = (uint8_t *)UINT32_C(0x80100000);
+static uint32_t         g_cbNt3OsKrnl   = 0x300000;
+static uint8_t         *g_pbNt3Hal      = (uint8_t *)UINT32_C(0x80400000);
+static uint32_t         g_cbNt3Hal      = _512K;
+static bool volatile    g_fNt3ModuleInfoInitialized = false;
+
+
+RT_C_DECLS_BEGIN
+/** @name KPIs we provide fallback implementations for.
+ *
+ * The assembly init routine will point the __imp_xxx variable to the NT
+ * implementation if available, using the fallback if not.
+ * @{  */
+decltype(PsGetVersion)                     *g_pfnrtPsGetVersion;
+decltype(ZwQuerySystemInformation)         *g_pfnrtZwQuerySystemInformation;
+decltype(KeSetTimerEx)                     *g_pfnrtKeSetTimerEx;
+decltype(IoAttachDeviceToDeviceStack)      *g_pfnrtIoAttachDeviceToDeviceStack;
+decltype(PsGetCurrentProcessId)            *g_pfnrtPsGetCurrentProcessId;
+decltype(ZwYieldExecution)                 *g_pfnrtZwYieldExecution;
+decltype(ExAcquireFastMutex)               *g_pfnrtExAcquireFastMutex;
+decltype(ExReleaseFastMutex)               *g_pfnrtExReleaseFastMutex;
+/** @} */
+
+/** @name Fastcall optimizations not present in NT 3.1.
+ *
+ * We try resolve both the stdcall and fastcall variants and patch it up in
+ * assembly. The last four routines are in the hal.
+ *
+ * @{  */
+decltype(IofCompleteRequest)               *g_pfnrtIofCompleteRequest;
+decltype(ObfDereferenceObject)             *g_pfnrtObfDereferenceObject;
+decltype(IofCallDriver)                    *g_pfnrtIofCallDriver;
+decltype(KfAcquireSpinLock)                *g_pfnrtKfAcquireSpinLock;
+decltype(KfReleaseSpinLock)                *g_pfnrtKfReleaseSpinLock;
+decltype(KefAcquireSpinLockAtDpcLevel)     *g_pfnrtKefAcquireSpinLockAtDpcLevel;
+decltype(KefReleaseSpinLockFromDpcLevel)   *g_pfnrtKefReleaseSpinLockFromDpcLevel;
+decltype(KfLowerIrql)                      *g_pfnrtKfLowerIrql;
+decltype(KfRaiseIrql)                      *g_pfnrtKfRaiseIrql;
+
+VOID                            (__stdcall *g_pfnrtIoCompleteRequest)(PIRP, CCHAR);
+LONG_PTR                        (__stdcall *g_pfnrtObDereferenceObject)(PVOID);
+NTSTATUS                        (__stdcall *g_pfnrtIoCallDriver)(PDEVICE_OBJECT, PIRP);
+KIRQL                           (__stdcall *g_pfnrtKeAcquireSpinLock)(PKSPIN_LOCK);
+VOID                            (__stdcall *g_pfnrtKeReleaseSpinLock)(PKSPIN_LOCK, KIRQL);
+KIRQL                           (__stdcall *g_pfnrtKeAcquireSpinLockAtDpcLevel)(PKSPIN_LOCK);
+VOID                            (__stdcall *g_pfnrtKeReleaseSpinLockFromDpcLevel)(PKSPIN_LOCK);
+VOID                            (__stdcall *g_pfnrtKeLowerIrql)(KIRQL);
+KIRQL                           (__stdcall *g_pfnrtKeRaiseIrql)(KIRQL);
+/** @} */
+
+/** @name DATA exports and associated stuff
+ * @{ */
+/** Import address table entry for KeTickCount (defined in asm). */
+extern KSYSTEM_TIME                        *_imp__KeTickCount;
+/** @} */
+
+RT_C_DECLS_END
+
+
+/*********************************************************************************************************************************
+*   Internal Functions                                                                                                           *
+*********************************************************************************************************************************/
+static void rtR0Nt3InitModuleInfo(void);
+
+
+/**
+ * Converts a string to a number, stopping at the first non-digit.
+ *
+ * @returns The value
+ * @param   ppwcValue       Pointer to the string pointer variable.  Updated.
+ * @param   pcwcValue       Pointer to the string length variable.  Updated.
+ */
+static uint32_t rtR0Nt3StringToNum(PCRTUTF16 *ppwcValue, size_t *pcwcValue)
+{
+    uint32_t  uValue   = 0;
+    PCRTUTF16 pwcValue = *ppwcValue;
+    size_t    cwcValue = *pcwcValue;
+
+    while (cwcValue > 0)
+    {
+        RTUTF16 uc = *pwcValue;
+        unsigned uDigit = (unsigned)uc - (unsigned)'0';
+        if (uDigit < (unsigned)10)
+        {
+            uValue *= 10;
+            uValue += uDigit;
+        }
+        else
+            break;
+        pwcValue++;
+        cwcValue--;
+    }
+
+    *ppwcValue = pwcValue;
+    *pcwcValue = cwcValue;
+    return uValue;
+}
+
+
+/**
+ * Implements RTL_QUERY_REGISTRY_ROUTINE for processing
+ * 'HKLM/Software/Microsoft/Window NT/CurrentVersion/CurrentVersion'
+ */
+static NTSTATUS NTAPI rtR0Nt3VerEnumCallback_CurrentVersion(PWSTR pwszValueName, ULONG uValueType,
+                                                            PVOID pvValue, ULONG cbValue, PVOID pvUser, PVOID pvEntryCtx)
+{
+    RT_NOREF(pwszValueName, pvEntryCtx);
+    if (   uValueType == REG_SZ
+        || uValueType == REG_EXPAND_SZ)
+    {
+        PCRTUTF16 pwcValue = (PCRTUTF16)pvValue;
+        size_t    cwcValue  = cbValue / sizeof(*pwcValue);
+        uint32_t uMajor = rtR0Nt3StringToNum(&pwcValue, &cwcValue);
+        uint32_t uMinor = 0;
+        if (cwcValue > 1)
+        {
+            pwcValue++;
+            cwcValue--;
+            uMinor = rtR0Nt3StringToNum(&pwcValue, &cwcValue);
+        }
+
+        if (uMajor >= 3)
+        {
+            g_uNt3MajorVer = uMajor;
+            g_uNt3MinorVer = uMinor;
+            RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentVersion found: uMajor=%u uMinor=%u\n", uMajor, uMinor);
+            *(uint32_t *)pvUser |= RT_BIT_32(0);
+            return STATUS_SUCCESS;
+        }
+
+        RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentVersion: '%.*ls'\n", cbValue / sizeof(RTUTF16), pvValue);
+    }
+    else
+        RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentVersion: uValueType=%u %.*Rhxs\n", uValueType, cbValue, pvValue);
+    return STATUS_SUCCESS;
+}
+
+
+/**
+ * Implements RTL_QUERY_REGISTRY_ROUTINE for processing
+ * 'HKLM/Software/Microsoft/Window NT/CurrentVersion/CurrentBuildNumber'
+ */
+static NTSTATUS NTAPI rtR0Nt3VerEnumCallback_CurrentBuildNumber(PWSTR pwszValueName, ULONG uValueType,
+                                                                PVOID pvValue, ULONG cbValue, PVOID pvUser, PVOID pvEntryCtx)
+{
+    RT_NOREF(pwszValueName, pvEntryCtx);
+    if (   uValueType == REG_SZ
+        || uValueType == REG_EXPAND_SZ)
+    {
+        PCRTUTF16 pwcValue = (PCRTUTF16)pvValue;
+        size_t    cwcValue  = cbValue / sizeof(*pwcValue);
+        uint32_t uBuildNo = rtR0Nt3StringToNum(&pwcValue, &cwcValue);
+
+        if (uBuildNo >= 100 && uBuildNo < _1M)
+        {
+            g_uNt3BuildNo = uBuildNo;
+            RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentBuildNumber found: uBuildNo=%u\n", uBuildNo);
+            *(uint32_t *)pvUser |= RT_BIT_32(1);
+            return STATUS_SUCCESS;
+        }
+
+        RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentBuildNumber: '%.*ls'\n", cbValue / sizeof(RTUTF16), pvValue);
+    }
+    else
+        RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentBuildNumber: uValueType=%u %.*Rhxs\n", uValueType, cbValue, pvValue);
+    return STATUS_SUCCESS;
+}
+
+
+/**
+ * Implements RTL_QUERY_REGISTRY_ROUTINE for processing
+ * 'HKLM/Software/Microsoft/Window NT/CurrentVersion/CurrentType'
+ */
+static NTSTATUS NTAPI rtR0Nt3VerEnumCallback_CurrentType(PWSTR pwszValueName, ULONG uValueType,
+                                                         PVOID pvValue, ULONG cbValue, PVOID pvUser, PVOID pvEntryCtx)
+{
+    RT_NOREF(pwszValueName, pvEntryCtx);
+    if (   uValueType == REG_SZ
+        || uValueType == REG_EXPAND_SZ)
+    {
+        PCRTUTF16 pwcValue = (PCRTUTF16)pvValue;
+        size_t    cwcValue = cbValue / sizeof(*pwcValue);
+
+        int fSmp = -1;
+        if (cwcValue >= 12 && RTUtf16NICmpAscii(pwcValue, "Uniprocessor", 12) == 0)
+        {
+            cwcValue -= 12;
+            pwcValue += 12;
+            fSmp = 0;
+        }
+        else if (cwcValue >= 14 && RTUtf16NICmpAscii(pwcValue, "Multiprocessor", 14) == 0)
+        {
+            cwcValue -= 14;
+            pwcValue += 14;
+            fSmp = 1;
+        }
+        if (fSmp != -1)
+        {
+            while (cwcValue > 0 && RT_C_IS_SPACE(*pwcValue))
+                cwcValue--, pwcValue++;
+
+            int fChecked = -1;
+            if (cwcValue >= 4 && RTUtf16NICmpAscii(pwcValue, "Free", 4) == 0)
+                fChecked = 0;
+            else if (cwcValue >= 7 && RTUtf16NICmpAscii(pwcValue, "Checked", 7) == 0)
+                fChecked = 1;
+            if (fChecked != -1)
+            {
+                g_fNt3Smp     = fSmp     != 0;
+                g_fNt3Checked = fChecked != 0;
+                RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentType found: fSmp=%d fChecked=%d\n", fSmp, fChecked);
+                *(uint32_t *)pvUser |= RT_BIT_32(2);
+                return STATUS_SUCCESS;
+            }
+        }
+
+        RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentType: '%.*ls'\n", cbValue / sizeof(RTUTF16), pvValue);
+    }
+    else
+        RTLogBackdoorPrintf("rtR0Nt3VerEnumCallback_CurrentType: uValueType=%u %.*Rhxs\n", uValueType, cbValue, pvValue);
+    return STATUS_SUCCESS;
+}
+
+
+/**
+ * Figure out the NT 3 version from the registry.
+ *
+ * @note this will be called before the rtR0Nt3InitSymbols is called.
+ */
+static void rtR0Nt3InitVersion(void)
+{
+    /*
+     * No PsGetVersion, so try the registry.  Unfortunately not necessarily
+     * initialized when we're loaded.
+     */
+    RTL_QUERY_REGISTRY_TABLE aQuery[4];
+    RT_ZERO(aQuery);
+    aQuery[0].QueryRoutine = rtR0Nt3VerEnumCallback_CurrentVersion;
+    aQuery[0].Flags        = 0;
+    aQuery[0].Name         = L"CurrentVersion";
+    aQuery[0].EntryContext = NULL;
+    aQuery[0].DefaultType  = REG_NONE;
+
+    aQuery[1].QueryRoutine = rtR0Nt3VerEnumCallback_CurrentBuildNumber;
+    aQuery[1].Flags        = 0;
+    aQuery[1].Name         = L"CurrentBuildNumber";
+    aQuery[1].EntryContext = NULL;
+    aQuery[1].DefaultType  = REG_NONE;
+
+    aQuery[2].QueryRoutine = rtR0Nt3VerEnumCallback_CurrentType;
+    aQuery[2].Flags        = 0;
+    aQuery[2].Name         = L"CurrentType";
+    aQuery[2].EntryContext = NULL;
+    aQuery[2].DefaultType  = REG_NONE;
+
+    uint32_t fFound = 0;
+    //NTSTATUS rcNt = RtlQueryRegistryValues(RTL_REGISTRY_WINDOWS_NT, NULL, &aQuery[0], &fFound, NULL /*Environment*/);
+    NTSTATUS rcNt = RtlQueryRegistryValues(RTL_REGISTRY_ABSOLUTE,
+                                           L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion",
+                                           &aQuery[0], &fFound, NULL /*Environment*/);
+    if (!NT_SUCCESS(rcNt))
+        RTLogBackdoorPrintf("rtR0Nt3InitVersion: RtlQueryRegistryValues failed: %#x\n", rcNt);
+    else
+        RTLogBackdoorPrintf("rtR0Nt3InitVersion: Didn't get all values: fFound=%#x\n", fFound);
+
+    /*
+     * We really need the version number.  Build, type and SMP is off less importance.
+     * Derive it from the NT kernel PE header.
+     */
+    if (!(fFound & RT_BIT_32(0)))
+    {
+        if (!g_fNt3ModuleInfoInitialized)
+            rtR0Nt3InitModuleInfo();
+
+        PIMAGE_DOS_HEADER   pMzHdr  = (PIMAGE_DOS_HEADER)g_pbNt3OsKrnl;
+        PIMAGE_NT_HEADERS32 pNtHdrs = (PIMAGE_NT_HEADERS32)&g_pbNt3OsKrnl[pMzHdr->e_lfanew];
+        if (pNtHdrs->OptionalHeader.MajorOperatingSystemVersion == 1)
+        {
+            /* NT 3.1 and NT 3.50 both set OS version to 1.0 in the optional header. */
+            g_uNt3MajorVer = 3;
+            if (   pNtHdrs->OptionalHeader.MajorLinkerVersion == 2
+                && pNtHdrs->OptionalHeader.MinorLinkerVersion < 50)
+                g_uNt3MinorVer = 10;
+            else
+                g_uNt3MinorVer = 50;
+        }
+        else
+        {
+            g_uNt3MajorVer = pNtHdrs->OptionalHeader.MajorOperatingSystemVersion;
+            g_uNt3MinorVer = pNtHdrs->OptionalHeader.MinorOperatingSystemVersion;
+        }
+        RTLogBackdoorPrintf("rtR0Nt3InitVersion: guessed %u.%u from PE header\n", g_uNt3MajorVer, g_uNt3MinorVer);
+
+        /* Check out the resource section, looking for VS_FIXEDFILEINFO. */
+        __try /* (pointless) */
+        {
+            PIMAGE_SECTION_HEADER paShdrs = (PIMAGE_SECTION_HEADER)(pNtHdrs + 1);
+            uint32_t const        cShdrs  = pNtHdrs->FileHeader.NumberOfSections;
+            uint32_t              iShdr   = 0;
+            while (iShdr < cShdrs && memcmp(paShdrs[iShdr].Name, ".rsrc", 6) != 0)
+                iShdr++;
+            if (iShdr < cShdrs)
+            {
+                if (   paShdrs[iShdr].VirtualAddress > 0
+                    && paShdrs[iShdr].VirtualAddress < pNtHdrs->OptionalHeader.SizeOfImage)
+                {
+                    uint32_t const  cbRsrc   = RT_MIN(paShdrs[iShdr].Misc.VirtualSize
+                                                      ? paShdrs[iShdr].Misc.VirtualSize : paShdrs[iShdr].SizeOfRawData,
+                                                      pNtHdrs->OptionalHeader.SizeOfImage - paShdrs[iShdr].VirtualAddress);
+                    uint8_t const  *pbRsrc   = &g_pbNt3OsKrnl[paShdrs[iShdr].VirtualAddress];
+                    uint32_t const *puDwords = (uint32_t const *)pbRsrc;
+                    uint32_t        cDWords  = (cbRsrc - sizeof(VS_FIXEDFILEINFO) + sizeof(uint32_t)) / sizeof(uint32_t);
+                    while (cDWords-- > 0)
+                    {
+                        if (   puDwords[0] == VS_FFI_SIGNATURE
+                            && puDwords[1] == VS_FFI_STRUCVERSION)
+                        {
+                            VS_FIXEDFILEINFO const *pVerInfo = (VS_FIXEDFILEINFO const *)puDwords;
+                            g_uNt3MajorVer = pVerInfo->dwProductVersionMS >> 16;
+                            g_uNt3MinorVer = pVerInfo->dwProductVersionMS >> 16;
+                            g_uNt3BuildNo  = pVerInfo->dwProductVersionLS >> 16;
+                            RTLogBackdoorPrintf("rtR0Nt3InitVersion: Found version info %u.%u build %u\n",
+                                                g_uNt3MajorVer, g_uNt3MinorVer, g_uNt3BuildNo);
+                            break;
+                        }
+                        puDwords++;
+                    }
+                }
+            }
+        }
+        __except(EXCEPTION_EXECUTE_HANDLER)
+        {
+            RTLogBackdoorPrintf("rtR0Nt3InitVersion: Exception scanning .rsrc section for version info!\n");
+        }
+    }
+
+    /*
+     * If we've got PsGetVersion, use it to override the above finding!
+     * (We may end up here for reasons other than the PsGetVersion fallback.)
+     */
+    if (g_pfnrtPsGetVersion)
+    {
+        WCHAR          wszCsd[64];
+        UNICODE_STRING UniStr;
+        UniStr.Buffer        = wszCsd;
+        UniStr.MaximumLength = sizeof(wszCsd) - sizeof(WCHAR);
+        UniStr.Length        = 0;
+        RT_ZERO(wszCsd);
+        ULONG   uMajor   = 3;
+        ULONG   uMinor   = 51;
+        ULONG   uBuildNo = 1057;
+        BOOLEAN fChecked = g_pfnrtPsGetVersion(&uMajor, &uMinor, &uBuildNo, &UniStr);
+
+        g_uNt3MajorVer           = uMajor;
+        g_uNt3MinorVer           = uMinor;
+        g_uNt3BuildNo            = uBuildNo;
+        g_fNt3Checked            = fChecked != FALSE;
+    }
+
+    g_fNt3VersionInitialized = true;
+}
+
+
+extern "C" DECLEXPORT(BOOLEAN) __stdcall
+Nt3Fb_PsGetVersion(ULONG *puMajor, ULONG *puMinor, ULONG *puBuildNo, UNICODE_STRING *pCsdStr)
+{
+    if (!g_fNt3VersionInitialized)
+        rtR0Nt3InitVersion();
+    if (puMajor)
+        *puMajor = g_uNt3MajorVer;
+    if (puMinor)
+        *puMinor = g_uNt3MinorVer;
+    if (puBuildNo)
+        *puBuildNo = g_uNt3BuildNo;
+    if (pCsdStr)
+    {
+        pCsdStr->Buffer[0] = '\0';
+        pCsdStr->Length = 0;
+    }
+    return g_fNt3Checked;
+}
+
+
+/**
+ * Worker for rtR0Nt3InitModuleInfo.
+ */
+static bool rtR0Nt3InitModuleInfoOne(const char *pszImage, uint8_t const *pbCode, uint8_t **ppbModule, uint32_t *pcbModule)
+{
+    uintptr_t const uImageAlign = _4K; /* XP may put the kernel at */
+
+    /* Align pbCode. */
+    pbCode = (uint8_t const *)((uintptr_t)pbCode & ~(uintptr_t)(uImageAlign - 1));
+
+    /* Scan backwards till we find a PE signature. */
+    for (uint32_t cbChecked = 0; cbChecked < _64M; cbChecked += uImageAlign, pbCode -= uImageAlign)
+    {
+        if (!MmIsAddressValid((void *)pbCode))
+            continue;
+
+        uint32_t uZero     = 0;
+        uint32_t offNewHdr = 0;
+        __try /* pointless */
+        {
+            uZero     = *(uint32_t const *)pbCode;
+            offNewHdr = *(uint32_t const *)&pbCode[RT_UOFFSETOF(IMAGE_DOS_HEADER, e_lfanew)];
+        }
+        __except(EXCEPTION_EXECUTE_HANDLER)
+        {
+            RTLogBackdoorPrintf("rtR0Nt3InitModuleInfo: Exception at %p scanning for DOS header...\n", pbCode);
+            continue;
+        }
+        if (   (uint16_t)uZero == IMAGE_DOS_SIGNATURE
+            && offNewHdr < _2K
+            && offNewHdr >= sizeof(IMAGE_DOS_HEADER))
+        {
+            RT_CONCAT(IMAGE_NT_HEADERS,ARCH_BITS) NtHdrs;
+            __try /* pointless */
+            {
+                NtHdrs = *(decltype(NtHdrs) const *)&pbCode[offNewHdr];
+            }
+            __except(EXCEPTION_EXECUTE_HANDLER)
+            {
+                RTLogBackdoorPrintf("rtR0Nt3InitModuleInfo: Exception at %p reading NT headers...\n", pbCode);
+                continue;
+            }
+            if (   NtHdrs.Signature == IMAGE_NT_SIGNATURE
+                && NtHdrs.FileHeader.SizeOfOptionalHeader == sizeof(NtHdrs.OptionalHeader)
+                && NtHdrs.FileHeader.NumberOfSections > 2
+                && NtHdrs.FileHeader.NumberOfSections < _4K
+                && NtHdrs.OptionalHeader.Magic == RT_CONCAT3(IMAGE_NT_OPTIONAL_HDR,ARCH_BITS,_MAGIC))
+            {
+                *ppbModule = (uint8_t *)pbCode;
+                *pcbModule = NtHdrs.OptionalHeader.SizeOfImage;
+                RTLogBackdoorPrintf("rtR0Nt3InitModuleInfo: Found %s at %#p LB %#x\n",
+                                    pszImage, pbCode, NtHdrs.OptionalHeader.SizeOfImage);
+                return true;
+            }
+        }
+    }
+    RTLogBackdoorPrintf("rtR0Nt3InitModuleInfo: Warning! Unable to locate %s...\n");
+    return false;
+}
+
+
+/**
+ * Initializes the module information (NTOSKRNL + HAL) using exported symbols.
+ * This only works as long as noone is intercepting the symbols.
+ */
+static void rtR0Nt3InitModuleInfo(void)
+{
+    rtR0Nt3InitModuleInfoOne("ntoskrnl.exe", (uint8_t const *)(uintptr_t)IoGetCurrentProcess, &g_pbNt3OsKrnl, &g_cbNt3OsKrnl);
+    rtR0Nt3InitModuleInfoOne("hal.dll",      (uint8_t const *)(uintptr_t)HalGetBusData,       &g_pbNt3Hal,    &g_cbNt3Hal);
+    g_fNt3ModuleInfoInitialized = true;
+}
+
+
+extern "C" DECLEXPORT(NTSTATUS) __stdcall
+Nt3Fb_ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS enmClass, PVOID pvBuf, ULONG cbBuf, PULONG pcbActual)
+{
+    switch (enmClass)
+    {
+        case SystemModuleInformation:
+        {
+            PRTL_PROCESS_MODULES pInfo    = (PRTL_PROCESS_MODULES)pvBuf;
+            ULONG                cbNeeded = RT_UOFFSETOF(RTL_PROCESS_MODULES, Modules[2]);
+            if (pcbActual)
+                *pcbActual = cbNeeded;
+            if (cbBuf < cbNeeded)
+                return STATUS_INFO_LENGTH_MISMATCH;
+
+            if (!g_fNt3ModuleInfoInitialized)
+                rtR0Nt3InitModuleInfo();
+
+            pInfo->NumberOfModules = 2;
+
+            /* ntoskrnl.exe */
+            pInfo->Modules[0].Section           = NULL;
+            pInfo->Modules[0].MappedBase        = g_pbNt3OsKrnl;
+            pInfo->Modules[0].ImageBase         = g_pbNt3OsKrnl;
+            pInfo->Modules[0].ImageSize         = g_cbNt3OsKrnl;
+            pInfo->Modules[0].Flags             = 0;
+            pInfo->Modules[0].LoadOrderIndex    = 0;
+            pInfo->Modules[0].InitOrderIndex    = 0;
+            pInfo->Modules[0].LoadCount         = 1024;
+            pInfo->Modules[0].OffsetToFileName  = sizeof("\\SystemRoot\\System32\\") - 1;
+            memcpy(pInfo->Modules[0].FullPathName, RT_STR_TUPLE("\\SystemRoot\\System32\\ntoskrnl.exe"));
+
+            /* hal.dll */
+            pInfo->Modules[1].Section           = NULL;
+            pInfo->Modules[1].MappedBase        = g_pbNt3Hal;
+            pInfo->Modules[1].ImageBase         = g_pbNt3Hal;
+            pInfo->Modules[1].ImageSize         = g_cbNt3Hal;
+            pInfo->Modules[1].Flags             = 0;
+            pInfo->Modules[1].LoadOrderIndex    = 1;
+            pInfo->Modules[1].InitOrderIndex    = 0;
+            pInfo->Modules[1].LoadCount         = 1024;
+            pInfo->Modules[1].OffsetToFileName  = sizeof("\\SystemRoot\\System32\\") - 1;
+            memcpy(pInfo->Modules[1].FullPathName, RT_STR_TUPLE("\\SystemRoot\\System32\\hal.dll"));
+
+            return STATUS_SUCCESS;
+        }
+
+        default:
+            return STATUS_INVALID_INFO_CLASS;
+    }
+}
+
+/**
+ * Calculates the length indicated by an ModR/M sequence.
+ *
+ * @returns Length, including RM byte.
+ * @param   bRm         The RM byte.
+ */
+static uint32_t rtR0Nt3CalcModRmLength(uint8_t bRm)
+{
+    uint32_t cbRm = 1;
+
+    if (   (bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT)
+        || (bRm & (X86_MODRM_MOD_MASK | X86_MODRM_RM_MASK)) == 5)
+        cbRm += 4; /* disp32 */
+    else if ((bRm & X86_MODRM_MOD_MASK) == (1 << X86_MODRM_MOD_SHIFT))
+        cbRm += 1; /* disp8 */
+    else if ((bRm & X86_MODRM_MOD_MASK) == (2 << X86_MODRM_MOD_SHIFT))
+        cbRm += 2; /* disp16 */
+
+    if ((bRm & X86_MODRM_RM_MASK) == 4 && (bRm & X86_MODRM_MOD_MASK) != (3 << X86_MODRM_MOD_SHIFT))
+        cbRm += 1; /* SIB */
+
+    return cbRm;
+}
+
+
+/**
+ * Init symbols.
+ *
+ * This is called after both ZwQuerySystemInformation and PsGetVersion are used
+ * for the first time.
+ *
+ * @returns IPRT status code
+ * @param   hKrnlInfo           Kernel symbol digger handle.
+ */
+DECLHIDDEN(int) rtR0Nt3InitSymbols(RTDBGKRNLINFO hKrnlInfo)
+{
+    /*
+     * Resolve symbols.  (We set C variables (g_pfnrtXxx) here, not the __imp__Xxx ones.)
+     */
+#define GET_SYSTEM_ROUTINE(a_fnName) do { \
+            RT_CONCAT(g_pfnrt, a_fnName) = (decltype(RT_CONCAT(g_pfnrt, a_fnName)))RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, #a_fnName); \
+        } while (0)
+
+    GET_SYSTEM_ROUTINE(PsGetVersion);
+    GET_SYSTEM_ROUTINE(ZwQuerySystemInformation);
+    GET_SYSTEM_ROUTINE(KeSetTimerEx);
+    GET_SYSTEM_ROUTINE(IoAttachDeviceToDeviceStack);
+    GET_SYSTEM_ROUTINE(PsGetCurrentProcessId);
+    GET_SYSTEM_ROUTINE(ZwYieldExecution);
+    GET_SYSTEM_ROUTINE(ExAcquireFastMutex);
+    GET_SYSTEM_ROUTINE(ExReleaseFastMutex);
+
+#define GET_FAST_CALL_SYSTEM_ROUTINE(a_fnFastcall, a_fnStdcall) do { \
+            GET_SYSTEM_ROUTINE(a_fnFastcall); \
+            GET_SYSTEM_ROUTINE(a_fnStdcall); \
+            AssertLogRelReturn(RT_CONCAT(g_pfnrt,a_fnFastcall) || RT_CONCAT(g_pfnrt,a_fnStdcall), VERR_INTERNAL_ERROR_3); \
+        } while (0)
+    GET_FAST_CALL_SYSTEM_ROUTINE(IofCompleteRequest,                IoCompleteRequest);
+    GET_FAST_CALL_SYSTEM_ROUTINE(ObfDereferenceObject,              ObDereferenceObject);
+    GET_FAST_CALL_SYSTEM_ROUTINE(IofCallDriver,                     IoCallDriver);
+    GET_FAST_CALL_SYSTEM_ROUTINE(KfAcquireSpinLock,                 KeAcquireSpinLock);
+    GET_FAST_CALL_SYSTEM_ROUTINE(KfReleaseSpinLock,                 KeReleaseSpinLock);
+    GET_FAST_CALL_SYSTEM_ROUTINE(KfLowerIrql,                       KeLowerIrql);
+    GET_FAST_CALL_SYSTEM_ROUTINE(KfRaiseIrql,                       KeRaiseIrql);
+    GET_FAST_CALL_SYSTEM_ROUTINE(KefAcquireSpinLockAtDpcLevel,      KeAcquireSpinLockAtDpcLevel);
+    GET_FAST_CALL_SYSTEM_ROUTINE(KefReleaseSpinLockFromDpcLevel,    KeReleaseSpinLockFromDpcLevel);
+
+    /*
+     * We need to call assembly to update the __imp__Xxx entries, since C
+     * doesn't allow '@' in symbols.
+     */
+    rtNt3InitSymbolsAssembly();
+
+    /*
+     * Tick count data.  We disassemble KeQueryTickCount until we find the
+     * first absolute address referenced in it.
+     *      %80105b70 8b 44 24 04             mov eax, dword [esp+004h]
+     *      %80105b74 c7 40 04 00 00 00 00    mov dword [eax+004h], 000000000h
+     *      %80105b7b 8b 0d 88 70 19 80       mov ecx, dword [080197088h]
+     *      %80105b81 89 08                   mov dword [eax], ecx
+     *      %80105b83 c2 04 00                retn 00004h
+     */
+    _imp__KeTickCount = (decltype(_imp__KeTickCount))RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "KeTickCount");
+    if (!_imp__KeTickCount)
+    {
+        if (!g_fNt3VersionInitialized)
+            rtR0Nt3InitVersion();
+        Assert(g_uNt3MajorVer == 3 && g_uNt3MinorVer < 50);
+
+        uint8_t const *pbCode = (uint8_t const *)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "KeQueryTickCount");
+        AssertLogRelReturn(pbCode, VERR_INTERNAL_ERROR_2);
+
+        for (uint32_t off = 0; off < 128 && _imp__KeTickCount == NULL;)
+        {
+            uint8_t const b1 = pbCode[off++];
+            switch (b1)
+            {
+                case 0x8b: /* mov reg, r/m     ; We're looking for absolute address in r/m. */
+                    if ((pbCode[off] & (X86_MODRM_MOD_MASK | X86_MODRM_RM_MASK)) == 5 /*disp32*/)
+                        _imp__KeTickCount = *(KSYSTEM_TIME **)&pbCode[off + 1];
+                    RT_FALL_THRU();
+                case 0x89: /* mov r/m, reg */
+                    off += rtR0Nt3CalcModRmLength(pbCode[off]);
+                    break;
+
+                case 0xc7:
+                    if ((pbCode[off] & X86_MODRM_REG_MASK) == 0) /* mov r/m, imm32 */
+                        off += rtR0Nt3CalcModRmLength(pbCode[off]) + 4;
+                    else
+                    {
+                        RTLogBackdoorPrintf("rtR0Nt3InitSymbols: Failed to find KeTickCount! Encountered unknown opcode at %#x! %.*Rhxs\n",
+                                            off - 1, RT_MAX(off + 16, RT_MIN(PAGE_SIZE - ((uintptr_t)pbCode & PAGE_OFFSET_MASK), 128)), pbCode);
+                        return VERR_INTERNAL_ERROR_3;
+                    }
+                    break;
+
+                case 0xc2: /* ret iw */
+                    RTLogBackdoorPrintf("rtR0Nt3InitSymbols: Failed to find KeTickCount! Encountered RET! %.*Rhxs\n",
+                                        off + 2, pbCode);
+                    return VERR_INTERNAL_ERROR_3;
+
+                default:
+                    RTLogBackdoorPrintf("rtR0Nt3InitSymbols: Failed to find KeTickCount! Encountered unknown opcode at %#x! %.*Rhxs\n",
+                                        off - 1, RT_MAX(off + 16, RT_MIN(PAGE_SIZE - ((uintptr_t)pbCode & PAGE_OFFSET_MASK), 128)), pbCode);
+                    return VERR_INTERNAL_ERROR_3;
+
+                /* Just in case: */
+
+                case 0xa1: /* mov eax, [m32] */
+                    _imp__KeTickCount = *(KSYSTEM_TIME **)&pbCode[off];
+                    off += 4;
+                    break;
+
+                case 50: case 51: case 52: case 53: case 54: case 55: case 56: case 57: /* push reg */
+                    break;
+            }
+        }
+        if (!_imp__KeTickCount)
+        {
+            RTLogBackdoorPrintf("rtR0Nt3InitSymbols: Failed to find KeTickCount after 128 bytes! %.*Rhxs\n", 128, pbCode);
+            return VERR_INTERNAL_ERROR_3;
+        }
+    }
+
+    return VINF_SUCCESS;
+}
+
+
+extern "C" DECLEXPORT(VOID)
+Nt3Fb_KeInitializeTimerEx(PKTIMER pTimer, TIMER_TYPE enmType)
+{
+    KeInitializeTimer(pTimer);
+    NOREF(enmType);
+    /** @todo Default is NotificationTimer, for SyncrhonizationTimer we need to
+     *        do more work.  timer-r0drv-nt.cpp is using the latter. :/  */
+}
+
+
+extern "C" DECLEXPORT(BOOLEAN) __stdcall
+Nt3Fb_KeSetTimerEx(PKTIMER pTimer, LARGE_INTEGER DueTime, LONG cMsPeriod, PKDPC pDpc)
+{
+    AssertReturn(cMsPeriod == 0, FALSE);
+    return KeSetTimer(pTimer, DueTime, pDpc);
+}
+
+
+extern "C" DECLEXPORT(PDEVICE_OBJECT)
+Nt3Fb_IoAttachDeviceToDeviceStack(PDEVICE_OBJECT pSourceDevice, PDEVICE_OBJECT pTargetDevice)
+{
+    NOREF(pSourceDevice); NOREF(pTargetDevice);
+    return NULL;
+}
+
+
+extern "C" DECLEXPORT(HANDLE)
+Nt3Fb_PsGetCurrentProcessId(void)
+{
+    if (!g_fNt3VersionInitialized)
+        rtR0Nt3InitVersion();
+
+    uint8_t const *pbProcess = (uint8_t const *)IoGetCurrentProcess();
+    if (   g_uNt3MajorVer > 3
+        || g_uNt3MinorVer >= 50)
+        return *(HANDLE const *)&pbProcess[0x94];
+    return *(HANDLE const *)&pbProcess[0xb0];
+}
+
+
+extern "C" DECLEXPORT(NTSTATUS)
+Nt3Fb_ZwYieldExecution(VOID)
+{
+    LARGE_INTEGER Interval;
+    Interval.QuadPart = 0;
+    KeDelayExecutionThread(KernelMode, FALSE, &Interval);
+    return STATUS_SUCCESS;
+}
+
+
+/**
+ * This is a simple implementation of the fast mutex api introduced in 3.50.
+ */
+extern "C" DECLEXPORT(VOID) FASTCALL
+Nt3Fb_ExAcquireFastMutex(PFAST_MUTEX pFastMtx)
+{
+    PETHREAD pSelf = PsGetCurrentThread();
+    KIRQL    OldIrql;
+    KeRaiseIrql(APC_LEVEL, &OldIrql);
+
+    /* The Count member is initialized to 1.  So if we decrement it to zero, we're
+       the first locker and owns the mutex.  Otherwise we must wait for our turn. */
+    int32_t  cLockers = ASMAtomicDecS32((int32_t volatile *)&pFastMtx->Count);
+    if (cLockers != 0)
+    {
+        ASMAtomicIncU32((uint32_t volatile *)&pFastMtx->Contention);
+        KeWaitForSingleObject(&pFastMtx->Event, Executive, KernelMode, FALSE /*fAlertable*/, NULL /*pTimeout*/);
+    }
+
+    pFastMtx->Owner   = (PKTHREAD)pSelf;
+    pFastMtx->OldIrql = OldIrql;
+}
+
+
+/**
+ * This is a simple implementation of the fast mutex api introduced in 3.50.
+ */
+extern "C" DECLEXPORT(VOID) FASTCALL
+Nt3Fb_ExReleaseFastMutex(PFAST_MUTEX pFastMtx)
+{
+    AssertMsg(pFastMtx->Owner == (PKTHREAD)PsGetCurrentThread(), ("Owner=%p, expected %p\n", pFastMtx->Owner, PsGetCurrentThread()));
+
+    KIRQL    OldIrql  = pFastMtx->OldIrql;
+    pFastMtx->Owner   = NULL;
+    int32_t  cLockers = ASMAtomicIncS32((int32_t volatile *)&pFastMtx->Count);
+    if (cLockers < 0)
+        KeSetEvent(&pFastMtx->Event, EVENT_INCREMENT, FALSE /*fWait*/);
+    if (OldIrql != APC_LEVEL)
+        KeLowerIrql(OldIrql);
+}
+