Search Posts

Category: Debugger

Description of the first few entries in GOT table

Description of the first few entries in GOT table GOT[0] : The table’ s entry zero is reserved to hold the address of the dynamic structure, referenced with the symbol _DYNAMIC . This allows a program, such as the dynamic linker, to fi nd its own dynamic structure without having yet processed its relocation entries. This is especially […]

Enhancement of the OS debug format, support scripting

OS debug format https://code.google.com/p/peter-bochs/wiki/OSDebugStandard is a xml based document stays in memory of the emulator, brining out the debug information in real time to the debugger, make the debugger understand what data structure they want to debug. In the early stage of kernel debugger, people rely on printk to dump out the debug information. At that […]

http://www.kaizou.org/2015/01/linux-libraries/

Originally from http://www.kaizou.org/2015/01/linux-libraries/ , it is a super professional article that explain the LD process. 08 Jan 2015 by David Corvoysier A few months ago I stumbled upon a linking problem with secondary dependencies I couldn’t solved without overlinking the corresponding libraries. I only realized today in a discussion with my friend Yann E. Morin that not only did I use the […]

gcc can’t handle too much #if macro

gcc can’t handle too much macro (#if, #define), the output dwarf will have wrong line number. So when you disassemble the assembly with c/c++ source, everything are wrong, including wrong line number, wrong assembly code to c source code, duplicated c/c++ line. https://github.com/gcc-mirror/gcc/blob/master/libgcc/libgcc2.c   In GKD, i add an on/off button to filter out those […]

How to lookup the value of each parameter from dwarf and memory location

Here are the steps to lookup the parameter value 1) Look into the “info” section from dwarf, “objdump –dwarf=info”. There is a die DW_AT_LOCATION (DW_OP_freg:0), telling you the offset to the frame register. 2) Look at the CIE from .eh_frames section, “objdump –dwarf=frames”. It will tell you the formula of calculating the CFA, such as […]

I finally understand why “DW_OP_fbreg: 0” is possible

In the following function kmalloc2, take a look the first parameter, the memory location of that parameter is stated by dwarf “DW_AT_location : 2 byte block: 91 0 (DW_OP_fbreg: 0)”, where “DW_OP_fbreg: 0” means stack+0. I was thinking why it is possible. Because when cpu executed call instruction, it already pushed 4 bytes into the […]

I finally understand why same parameter even has multiple locations

I finally understand why same parameter even has multiple locations. My pass concept is parameter stay in the stack. But after hacking the dwarf, it show me same parameter have multiple location during execution. Take a look below image, I wrote a function call kmalloc2 (blue arrow), the third parameter “size” has three locations (yellow […]

Finally can dump out the parameter type from dwarf standard

Finally can dump out the parameter type from dwarf standard. Some parameter is store recursively, so need to read out DW_AT_type and get the right die and decode again. Personally I think dwarf is just too hard to parse. Here is the code https://sourceforge.net/p/peter-dwarf/code/254/tree//trunk/src/main/java/com/peterdwarf/dwarf/DwarfLib.java https://sourceforge.net/p/peter-dwarf/code/254/tree//trunk/src/main/java/com/peterdwarf/dwarf/Dwarf.java

Tutorial : Add a debug command in bochs

This tutorial teach you how to add a debug command in boots, you need to touch these files only: debug.h dbg_main.cc lexer.l parser.y Step 1) First of all, you need to add your command (see below) to lexer.l, don’t add anything below the line “[A-Za-z_][A-Za-z0-9_]* { bxlval.sval = strdup(bxtext); return(BX_TOKEN_GENERIC); }”, because it will eat […]

i may know why the gdb command “x” only request one byte each time

I am playing the gdbstub in qemu, i found a bug there http://peter.kingofcoders.com/?p=859 , if i invoke the function cpu_physical_memory_rw(0xffff0, mem_buf, 50, 0) , qemu crashes. Then, i tested the gdb command “x /20bx 0xffff0” and use tcpflow to capture the gdb packet, i found out gdb send 20 command and each time request one byte only. […]

qemu 1.6.0 rc2 has bug

I found a bug in qemu, version 1.6.0 rc2. When i invoke: where addr=0xffff0 and noOfBytes=50, qemu will has segmentation fault. I called the cpu_physical_memory_rw right after the qemu is started (haven’t run yet) with gdb. The vm was in real mode, i am not sure it is crossing memory boundary problem. But i just […]

QMP Supported Commands

QMP Supported Commands:   This document describes all commands currently supported by QMP. Most of the time their usage is exactly the same as in the user Monitor, this means that any other document which also describe commands (the manpage, QEMU’s manual, etc) can and should be consulted. QMP has two types of commands: regular […]

GDB two-breakpoints inter-communication between gdb and gdbstub of qemu

$tcpflow -c -i lo0 port 1234 tcpflow[5508]: 127.000.000.001.01234-127.000.000.001.58366: new flow 127.000.000.001.58366-127.000.000.001.01234: + 127.000.000.001.58366-127.000.000.001.01234: $qSupported:multiprocess+;xmlRegisters=i386;qRelocInsn+#b5 127.000.000.001.01234-127.000.000.001.58366: + 127.000.000.001.01234-127.000.000.001.58366: $PacketSize=1000#f1 127.000.000.001.58366-127.000.000.001.01234: + 127.000.000.001.58366-127.000.000.001.01234: $Hg0#df 127.000.000.001.01234-127.000.000.001.58366: + 127.000.000.001.01234-127.000.000.001.58366: $OK#9a 127.000.000.001.58366-127.000.000.001.01234: + 127.000.000.001.58366-127.000.000.001.01234: $?#3f 127.000.000.001.01234-127.000.000.001.58366: + 127.000.000.001.01234-127.000.000.001.58366: $T05thread:01;#07 127.000.000.001.58366-127.000.000.001.01234: + 127.000.000.001.58366-127.000.000.001.01234: $Hc-1#09 127.000.000.001.01234-127.000.000.001.58366: + 127.000.000.001.01234-127.000.000.001.58366: $OK#9a 127.000.000.001.58366-127.000.000.001.01234: + 127.000.000.001.58366-127.000.000.001.01234: $qC#b4 127.000.000.001.01234-127.000.000.001.58366: + 127.000.000.001.01234-127.000.000.001.58366: $QC1#c5 127.000.000.001.58366-127.000.000.001.01234: + 127.000.000.001.58366-127.000.000.001.01234: $qAttached#8f 127.000.000.001.01234-127.000.000.001.58366: […]

gdb crash, for another debug server

if you are create your own debug server,  gdb will crash, take a look: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffebfff700 (LWP 32202)] 0x000055555577632b in gdb_set_stop_cpu (env=env@entry=0x5555564f6d20) at /root/workspace/qemu-1.5.0/gdbstub.c:2510 2510 gdbserver_state->c_cpu = env; Missing separate debuginfos, use: debuginfo-install SDL-1.2.15-3.fc18.x86_64 cyrus-sasl-lib-2.1.23-37.fc18.x86_64 glib2-2.34.2-2.fc18.x86_64 glibc-2.16-28.fc18.x86_64 libX11-1.5.0-3.fc18.x86_64 libXau-1.0.6-4.fc18.x86_64 libXcursor-1.1.13-2.fc18.x86_64 libXext-1.3.1-2.fc18.x86_64 libXfixes-5.0-3.fc18.x86_64 libXrandr-1.4.0-1.fc18.x86_64 libXrender-0.9.7-2.fc18.x86_64 libpng-1.5.13-1.fc18.x86_64 libxcb-1.9-1.fc18.x86_64 nss-softokn-freebl-3.14.3-1.fc18.x86_64 […]

Next Page »