Beispiel #1
0
            /// <summary>
            /// Processes the parsed note.
            /// </summary>
            /// <param name="name">The note name.</param>
            /// <param name="content">The note content.</param>
            /// <param name="type">The note type.</param>
            public void ProcessNote(string name, byte[] content, elf_note_type type)
            {
                if (type == elf_note_type.Prstatus)
                {
                    DwarfMemoryReader data     = new DwarfMemoryReader(content);
                    elf_prstatus      prstatus = data.ReadStructure <elf_prstatus>();

                    threads.Add(prstatus);
                }
                else if (type == elf_note_type.Prpsinfo)
                {
                    // TODO: Use when needed
                    //DwarfMemoryReader data = new DwarfMemoryReader(content);
                    //elf_prpsinfo prpsinfo = data.ReadStructure<elf_prpsinfo>();
                    //Console.WriteLine($"  Filename: {prpsinfo.Filename}");
                    //Console.WriteLine($"  ArgList: {prpsinfo.ArgList}");
                }
            }
Beispiel #2
0
            /// <summary>
            /// Gets the thread stack trace.
            /// </summary>
            /// <param name="threadIndex">Index of the thread.</param>
            /// <param name="dumpFileMemoryReader">The dump file memory reader.</param>
            /// <param name="process">Process being debugged.</param>
            /// <param name="symbolProvider">The symbol provider.</param>
            /// <returns>Array of tuples of instruction offset, stack offset and frame offset.</returns>
            public Tuple <ulong, ulong, ulong>[] GetThreadStackTrace(int threadIndex, DumpFileMemoryReader dumpFileMemoryReader, Process process, DwarfSymbolProvider symbolProvider)
            {
                const int    pointerSize = 8;
                elf_prstatus prstatus    = threads[threadIndex];
                ulong        bp          = prstatus.pr_reg[X64RegisterIndex.RBP];
                ulong        ip          = prstatus.pr_reg[X64RegisterIndex.RIP];
                List <Tuple <ulong, ulong, ulong> > result = new List <Tuple <ulong, ulong, ulong> >();
                ulong segmentStartAddress, segmentSize;

                dumpFileMemoryReader.GetMemoryRange(bp, out segmentStartAddress, out segmentSize);
                while (bp >= segmentStartAddress && bp < segmentStartAddress + segmentSize)
                {
                    result.Add(Tuple.Create(ip, bp, bp));

                    ulong  savedLocationForRegisters = bp;
                    Module module = process.GetModuleByInnerAddress(ip);

                    if (module != null)
                    {
                        DwarfSymbolProviderModule symbolProviderModule = symbolProvider.GetSymbolProviderModule(module) as DwarfSymbolProviderModule;

                        if (symbolProviderModule != null)
                        {
                            ThreadContext frameContext          = new ThreadContext(ip, bp, bp, null);
                            ulong         canonicalFrameAddress = symbolProviderModule.GetFunctionCanonicalFrameAddress(process, ip, frameContext);

                            if (canonicalFrameAddress != 0)
                            {
                                savedLocationForRegisters = canonicalFrameAddress - pointerSize * 2;
                            }
                        }
                    }

                    MemoryBuffer buffer = dumpFileMemoryReader.ReadMemory(savedLocationForRegisters, pointerSize * 2);
                    bp = UserType.ReadPointer(buffer, 0, pointerSize);
                    ip = UserType.ReadPointer(buffer, pointerSize, pointerSize);
                }
                return(result.ToArray());
            }