Rizin
unix-like reverse engineering framework and cli tools
Classes | Macros | Typedefs | Enumerations | Functions
linux_coredump.h File Reference
#include "elf_specs.h"
#include <sys/procfs.h>

Go to the source code of this file.

Classes

struct  proc_per_process
 
struct  proc_per_thread
 
struct  proc_content
 
struct  map_file
 
struct  linux_map_entry
 
struct  auxv_buff
 
struct  thread_elf_note
 
struct  proc_elf_note
 
struct  elf_note_types
 

Macros

#define SIZE_PR_FNAME   16
 
#define RZ_DEBUG_REG_T   struct user_regs_struct
 
#define SIZE_NT_FILE_DESCSZ   sizeof(unsigned long) * 3 /* start_address * end_address * offset_address */
 
#define X_MEM   0x1
 
#define W_MEM   0x2
 
#define RZ_MEM   0x4
 
#define P_MEM   0x8
 
#define S_MEM   0x10
 
#define WRG_PERM   0x20
 
#define MAP_ANON_PRIV   0x1
 
#define MAP_ANON_SHR   0x2
 
#define MAP_FILE_PRIV   0x4
 
#define MAP_FILE_SHR   0x8
 
#define MAP_ELF_HDR   0x10
 
#define MAP_HUG_PRIV   0x20
 
#define MAP_HUG_SHR   0x40
 
#define SH_FLAG   0x1
 
#define IO_FLAG   0x2
 
#define DD_FLAG   0x4
 
#define HT_FLAG   0x8
 
#define PV_FLAG   0x10 /* just for us */
 
#define ADD_MAP_NODE(p)
 

Typedefs

typedef struct proc_per_process proc_per_process_t
 
typedef struct proc_per_thread proc_per_thread_t
 
typedef struct proc_content proc_content_t
 
typedef struct map_file map_file_t
 
typedef struct linux_map_entry linux_map_entry_t
 
typedef struct auxv_buff auxv_buff_t
 
typedef struct thread_elf_note thread_elf_note_t
 
typedef struct proc_elf_note elf_proc_note_t
 
typedef struct elf_note_types note_info_t
 

Enumerations

enum  note_type_t {
  NT_PRPSINFO_T = 0 , NT_AUXV_T , NT_FILE_T , NT_PRSTATUS_T ,
  NT_SIGINFO_T , NT_FPREGSET_T , NT_LENGHT_T
}
 
enum  MAPS_FIELD {
  ADDR , PERM , OFFSET , DEV ,
  INODE , NAME
}
 

Functions

ssize_t process_vm_readv (pid_t pid, const struct iovec *local_iov, unsigned long liovcnt, const struct iovec *remote_iov, unsigned long riovcnt, unsigned long flags)
 
bool linux_generate_corefile (RzDebug *dbg, RzBuffer *dest)
 
int linux_reg_read (RzDebug *dbg, int type, ut8 *buf, int size)
 

Macro Definition Documentation

◆ ADD_MAP_NODE

#define ADD_MAP_NODE (   p)
Value:
{ \
if (me_head) { \
p->n = NULL; \
me_tail->n = p; \
me_tail = p; \
} else { \
me_head = p; \
me_tail = p; \
} \
}
NULL
#define NULL
Definition: cris-opc.c:27
p
void * p
Definition: libc.cpp:67

Definition at line 147 of file linux_coredump.h.

◆ DD_FLAG

#define DD_FLAG   0x4

Definition at line 94 of file linux_coredump.h.

◆ HT_FLAG

#define HT_FLAG   0x8

Definition at line 95 of file linux_coredump.h.

◆ IO_FLAG

#define IO_FLAG   0x2

Definition at line 93 of file linux_coredump.h.

◆ MAP_ANON_PRIV

#define MAP_ANON_PRIV   0x1

Definition at line 84 of file linux_coredump.h.

◆ MAP_ANON_SHR

#define MAP_ANON_SHR   0x2

Definition at line 85 of file linux_coredump.h.

◆ MAP_ELF_HDR

#define MAP_ELF_HDR   0x10

Definition at line 88 of file linux_coredump.h.

◆ MAP_FILE_PRIV

#define MAP_FILE_PRIV   0x4

Definition at line 86 of file linux_coredump.h.

◆ MAP_FILE_SHR

#define MAP_FILE_SHR   0x8

Definition at line 87 of file linux_coredump.h.

◆ MAP_HUG_PRIV

#define MAP_HUG_PRIV   0x20

Definition at line 89 of file linux_coredump.h.

◆ MAP_HUG_SHR

#define MAP_HUG_SHR   0x40

Definition at line 90 of file linux_coredump.h.

◆ P_MEM

#define P_MEM   0x8

Definition at line 80 of file linux_coredump.h.

◆ PV_FLAG

#define PV_FLAG   0x10 /* just for us */

Definition at line 96 of file linux_coredump.h.

◆ RZ_DEBUG_REG_T

#define RZ_DEBUG_REG_T   struct user_regs_struct

Definition at line 63 of file linux_coredump.h.

◆ RZ_MEM

#define RZ_MEM   0x4

Definition at line 79 of file linux_coredump.h.

◆ S_MEM

#define S_MEM   0x10

Definition at line 81 of file linux_coredump.h.

◆ SH_FLAG

#define SH_FLAG   0x1

Definition at line 92 of file linux_coredump.h.

◆ SIZE_NT_FILE_DESCSZ

#define SIZE_NT_FILE_DESCSZ   sizeof(unsigned long) * 3 /* start_address * end_address * offset_address */

Definition at line 65 of file linux_coredump.h.

◆ SIZE_PR_FNAME

#define SIZE_PR_FNAME   16

Definition at line 61 of file linux_coredump.h.

◆ W_MEM

#define W_MEM   0x2

Definition at line 78 of file linux_coredump.h.

◆ WRG_PERM

#define WRG_PERM   0x20

Definition at line 82 of file linux_coredump.h.

◆ X_MEM

#define X_MEM   0x1

Definition at line 77 of file linux_coredump.h.

Typedef Documentation

◆ auxv_buff_t

typedef struct auxv_buff auxv_buff_t

◆ elf_proc_note_t

typedef struct proc_elf_note elf_proc_note_t

◆ linux_map_entry_t

typedef struct linux_map_entry linux_map_entry_t

◆ map_file_t

typedef struct map_file map_file_t

◆ note_info_t

typedef struct elf_note_types note_info_t

◆ proc_content_t

typedef struct proc_content proc_content_t

◆ proc_per_process_t

typedef struct proc_per_process proc_per_process_t

◆ proc_per_thread_t

typedef struct proc_per_thread proc_per_thread_t

◆ thread_elf_note_t

typedef struct thread_elf_note thread_elf_note_t

Enumeration Type Documentation

◆ MAPS_FIELD

enum MAPS_FIELD
Enumerator
ADDR 
PERM 
OFFSET 
DEV 
INODE 
NAME 

Definition at line 214 of file linux_coredump.h.

214  {
215  ADDR,
216  PERM,
217  OFFSET,
218  DEV,
219  INODE,
220  NAME
221 } MAPS_FIELD;
MAPS_FIELD
MAPS_FIELD
Definition: linux_coredump.h:214
NAME
@ NAME
Definition: linux_coredump.h:220
OFFSET
@ OFFSET
Definition: linux_coredump.h:217
DEV
@ DEV
Definition: linux_coredump.h:218
ADDR
@ ADDR
Definition: linux_coredump.h:215
INODE
@ INODE
Definition: linux_coredump.h:219
PERM
@ PERM
Definition: linux_coredump.h:216

◆ note_type_t

enum note_type_t
Enumerator
NT_PRPSINFO_T 
NT_AUXV_T 
NT_FILE_T 
NT_PRSTATUS_T 
NT_SIGINFO_T 
NT_FPREGSET_T 
NT_LENGHT_T 

Definition at line 189 of file linux_coredump.h.

189  {
190  NT_PRPSINFO_T = 0,
191  NT_AUXV_T,
192  NT_FILE_T,
193  NT_PRSTATUS_T,
194  NT_SIGINFO_T,
195  NT_FPREGSET_T,
196 #if __i386__
197  NT_PRXFPREG_T,
198 #endif
199 #if __i386__ || __x86_64__
200  NT_X86_XSTATE_T,
201 #elif __arm__ || __arm64__
202  NT_ARM_VFP_T,
203 #endif
204  NT_LENGHT_T
205 } note_type_t;
note_type_t
note_type_t
Definition: linux_coredump.h:189
NT_PRSTATUS_T
@ NT_PRSTATUS_T
Definition: linux_coredump.h:193
NT_LENGHT_T
@ NT_LENGHT_T
Definition: linux_coredump.h:204
NT_AUXV_T
@ NT_AUXV_T
Definition: linux_coredump.h:191
NT_FILE_T
@ NT_FILE_T
Definition: linux_coredump.h:192
NT_SIGINFO_T
@ NT_SIGINFO_T
Definition: linux_coredump.h:194
NT_PRPSINFO_T
@ NT_PRPSINFO_T
Definition: linux_coredump.h:190
NT_FPREGSET_T
@ NT_FPREGSET_T
Definition: linux_coredump.h:195

Function Documentation

◆ linux_generate_corefile()

bool linux_generate_corefile ( RzDebug *  dbg,
RzBuffer *  dest 
)

◆ linux_reg_read()

int linux_reg_read ( RzDebug *  dbg,
int  type,
ut8 *  buf,
int  size 
)

Definition at line 1090 of file linux_debug.c.

1090  {
1091  bool showfpu = false;
1092  int pid = dbg->tid;
1093  int ret = 0;
1094  if (type < -1) {
1095  showfpu = true;
1096  type = -type;
1097  }
1098  switch (type) {
1099  case RZ_REG_TYPE_DRX:
1100 #if __POWERPC__
1101  // no drx for powerpc
1102  return false;
1103 #elif __i386__ || __x86_64__
1104 #if !__ANDROID__
1105  {
1106  int i;
1107  for (i = 0; i < 8; i++) { // DR0-DR7
1108  if (i == 4 || i == 5) {
1109  continue;
1110  }
1111  long ret = rz_debug_ptrace(dbg, PTRACE_PEEKUSER, pid,
1112  (void *)rz_offsetof(struct user, u_debugreg[i]), 0);
1113  if ((i + 1) * sizeof(ret) > size) {
1114  eprintf("linux_reg_get: Buffer too small %d\n", size);
1115  break;
1116  }
1117  memcpy(buf + (i * sizeof(ret)), &ret, sizeof(ret));
1118  }
1119  struct user a;
1120  return sizeof(a.u_debugreg);
1121  }
1122 #else
1123 #warning Android X86 does not support DRX
1124 #endif
1125 #endif
1126  return true;
1127  break;
1128  case RZ_REG_TYPE_FPU:
1129  case RZ_REG_TYPE_MMX:
1130  case RZ_REG_TYPE_XMM:
1131 #if __POWERPC__
1132  return false;
1133 #elif __x86_64__ || __i386__
1134  {
1135  struct user_fpregs_struct fpregs;
1136  if (type == RZ_REG_TYPE_FPU) {
1137 #if __x86_64__
1138  ret = rz_debug_ptrace(dbg, PTRACE_GETFPREGS, pid, NULL, &fpregs);
1139  if (ret != 0) {
1140  rz_sys_perror("PTRACE_GETFPREGS");
1141  return false;
1142  }
1143  if (showfpu) {
1144  print_fpu((void *)&fpregs);
1145  }
1146  size = RZ_MIN(sizeof(fpregs), size);
1147  memcpy(buf, &fpregs, size);
1148  return size;
1149 #elif __i386__
1150 #if !__ANDROID__
1151  struct user_fpxregs_struct fpxregs;
1152  ret = rz_debug_ptrace(dbg, PTRACE_GETFPXREGS, pid, NULL, &fpxregs);
1153  if (ret == 0) {
1154  if (showfpu) {
1155  print_fpu((void *)&fpxregs);
1156  }
1157  size = RZ_MIN(sizeof(fpxregs), size);
1158  memcpy(buf, &fpxregs, size);
1159  return size;
1160  } else {
1161  ret = rz_debug_ptrace(dbg, PTRACE_GETFPREGS, pid, NULL, &fpregs);
1162  if (showfpu) {
1163  print_fpu((void *)&fpregs);
1164  }
1165  if (ret != 0) {
1166  rz_sys_perror("PTRACE_GETFPREGS");
1167  return false;
1168  }
1169  size = RZ_MIN(sizeof(fpregs), size);
1170  memcpy(buf, &fpregs, size);
1171  return size;
1172  }
1173 #else
1174  ret = rz_debug_ptrace(dbg, PTRACE_GETFPREGS, pid, NULL, &fpregs);
1175  if (showfpu) {
1176  print_fpu((void *)&fpregs);
1177  }
1178  if (ret != 0) {
1179  rz_sys_perror("PTRACE_GETFPREGS");
1180  return false;
1181  }
1182  size = RZ_MIN(sizeof(fpregs), size);
1183  memcpy(buf, &fpregs, size);
1184  return size;
1185 #endif // !__ANDROID__
1186 #endif // __i386__
1187  }
1188  }
1189 #else
1190 #warning getfpregs not implemented for this platform
1191 #endif
1192  break;
1193  case RZ_REG_TYPE_SEG:
1194  case RZ_REG_TYPE_FLG:
1195  case RZ_REG_TYPE_GPR: {
1196  RZ_DEBUG_REG_T regs;
1197  memset(&regs, 0, sizeof(regs));
1198  memset(buf, 0, size);
1199 #if (__arm64__ || __aarch64__ || __s390x__) && defined(PTRACE_GETREGSET)
1200  struct iovec io = {
1201  .iov_base = &regs,
1202  .iov_len = sizeof(regs)
1203  };
1204  ret = rz_debug_ptrace(dbg, PTRACE_GETREGSET, pid, 1, &io);
1205  // ret = ptrace (PTRACE_GETREGSET, pid, (void*)(size_t)(NT_PRSTATUS), NULL); // &io);
1206  if (ret != 0) {
1207  rz_sys_perror("PTRACE_GETREGSET");
1208  return false;
1209  }
1210 #elif __BSD__ && (__POWERPC__ || __sparc__)
1211  ret = rz_debug_ptrace(dbg, PTRACE_GETREGS, pid, &regs, NULL);
1212 #else
1213  /* linux -{arm/mips/riscv/x86/x86_64} */
1214  ret = rz_debug_ptrace(dbg, PTRACE_GETREGS, pid, NULL, &regs);
1215 #endif
1216  /*
1217  * if perror here says 'no such process' and the
1218  * process exists still.. is because there's a missing call
1219  * to 'wait'. and the process is not yet available to accept
1220  * more ptrace queries.
1221  */
1222  if (ret != 0) {
1223  rz_sys_perror("PTRACE_GETREGS");
1224  return false;
1225  }
1226  size = RZ_MIN(sizeof(regs), size);
1227  memcpy(buf, &regs, size);
1228  return size;
1229  } break;
1230  case RZ_REG_TYPE_YMM: {
1231 #if HAVE_YMM && __x86_64__ && defined(PTRACE_GETREGSET)
1232  ut32 ymm_space[128]; // full ymm registers
1233  struct _xstate xstate;
1234  struct iovec iov;
1235  iov.iov_base = &xstate;
1236  iov.iov_len = sizeof(struct _xstate);
1237  ret = rz_debug_ptrace_get_x86_xstate(dbg, pid, &iov);
1238  if (ret == -1) {
1239  return false;
1240  }
1241  // stitch together xstate.fpstate._xmm and xstate.ymmh assuming LE
1242  int ri, rj;
1243  for (ri = 0; ri < 16; ri++) {
1244  for (rj = 0; rj < 4; rj++) {
1245 #ifdef __ANDROID__
1246  ymm_space[ri * 8 + rj] = ((struct _libc_fpstate *)&xstate.fpstate)->_xmm[ri].element[rj];
1247 #else
1248  ymm_space[ri * 8 + rj] = xstate.fpstate._xmm[ri].element[rj];
1249 #endif
1250  }
1251  for (rj = 0; rj < 4; rj++) {
1252  ymm_space[ri * 8 + (rj + 4)] = xstate.ymmh.ymmh_space[ri * 4 + rj];
1253  }
1254  }
1255  size = RZ_MIN(sizeof(ymm_space), size);
1256  memcpy(buf, &ymm_space, size);
1257  return size;
1258 #endif
1259  return false;
1260  } break;
1261  }
1262  return false;
1263 }
regs
static char * regs[]
Definition: analysis_sh.c:203
i
lzma_index ** i
Definition: index.h:629
RZ_DEBUG_REG_T
#define RZ_DEBUG_REG_T
Definition: bsd_debug.h:8
ut32
uint32_t ut32
Definition: demangler_util.h:31
dbg
RzDebug * dbg
Definition: desil.c:30
size
voidpf void uLong size
Definition: ioapi.h:138
buf
voidpf void * buf
Definition: ioapi.h:138
memset
return memset(p, 0, total)
memcpy
memcpy(mem, inblock.get(), min(CONTAINING_RECORD(inblock.get(), MEMBLOCK, data) ->size, size))
pid
static static fork const void static count static fd const char const char static newpath char char char static envp time_t static t const char static mode static whence const char static dir time_t static t unsigned static seconds const char struct utimbuf static buf static inc pid
Definition: sflib.h:64
rz_debug_ptrace_get_x86_xstate
long rz_debug_ptrace_get_x86_xstate(RzDebug *dbg, pid_t pid, struct iovec *iov)
Definition: linux_debug.c:50
print_fpu
static void print_fpu(void *f)
Definition: linux_debug.c:995
type
int type
Definition: mipsasm.c:17
eprintf
#define eprintf(x, y...)
Definition: rlcc.c:7
RZ_REG_TYPE_SEG
@ RZ_REG_TYPE_SEG
Definition: rz_reg.h:28
RZ_REG_TYPE_MMX
@ RZ_REG_TYPE_MMX
Definition: rz_reg.h:24
RZ_REG_TYPE_GPR
@ RZ_REG_TYPE_GPR
Definition: rz_reg.h:21
RZ_REG_TYPE_YMM
@ RZ_REG_TYPE_YMM
Definition: rz_reg.h:26
RZ_REG_TYPE_FLG
@ RZ_REG_TYPE_FLG
Definition: rz_reg.h:27
RZ_REG_TYPE_FPU
@ RZ_REG_TYPE_FPU
Definition: rz_reg.h:23
RZ_REG_TYPE_DRX
@ RZ_REG_TYPE_DRX
Definition: rz_reg.h:22
RZ_REG_TYPE_XMM
@ RZ_REG_TYPE_XMM
Definition: rz_reg.h:25
rz_sys_perror
#define rz_sys_perror(x)
Definition: rz_types.h:336
rz_offsetof
#define rz_offsetof(type, member)
Definition: rz_types.h:360
RZ_MIN
#define RZ_MIN(x, y)
Definition: rz_types_base.h:140
PTRACE_GETREGS
@ PTRACE_GETREGS
Definition: sftypes.h:598
PTRACE_GETFPREGS
@ PTRACE_GETFPREGS
Definition: sftypes.h:608
PTRACE_GETFPXREGS
@ PTRACE_GETFPXREGS
Definition: sftypes.h:626
PTRACE_PEEKUSER
@ PTRACE_PEEKUSER
Definition: sftypes.h:568
a
#define a(i)
Definition: sha256.c:41
iovec
Definition: sftypes.h:73
rz_debug_t::tid
int tid
Definition: rz_debug.h:248
iov
static uv_buf_t iov
Definition: main.c:15

References a, dbg, eprintf, i, iov, memcpy(), memset(), NULL, pid, print_fpu(), PTRACE_GETFPREGS, PTRACE_GETFPXREGS, PTRACE_GETREGS, PTRACE_PEEKUSER, regs, rz_debug_ptrace_get_x86_xstate(), RZ_DEBUG_REG_T, RZ_MIN, rz_offsetof, RZ_REG_TYPE_DRX, RZ_REG_TYPE_FLG, RZ_REG_TYPE_FPU, RZ_REG_TYPE_GPR, RZ_REG_TYPE_MMX, RZ_REG_TYPE_SEG, RZ_REG_TYPE_XMM, RZ_REG_TYPE_YMM, rz_sys_perror, rz_debug_t::tid, and type.

◆ process_vm_readv()

ssize_t process_vm_readv ( pid_t  pid,
const struct iovec *  local_iov,
unsigned long  liovcnt,
const struct iovec *  remote_iov,
unsigned long  riovcnt,
unsigned long  flags 
)