1from __future__ import absolute_import, division, print_function 2 3from builtins import chr 4from builtins import hex 5from builtins import range 6from builtins import bytes 7 8from xnu import * 9from utils import * 10from process import * 11from pmap import * 12import struct 13 14def GetBinaryNameForPC(pc_val, user_lib_info = None): 15 """ find the binary in user_lib_info that the passed pc_val falls in range of. 16 params: 17 pc_val : int - integer form of the pc address 18 user_lib_info: [] of [] which hold start, end, binary name 19 returns: 20 str - Name of binary or "unknown" if not found. 21 """ 22 retval = "unknown" 23 if not user_lib_info: 24 return retval 25 matches = [] 26 for info in user_lib_info: 27 if pc_val >= info[0] and pc_val <= info[1]: 28 matches.append((pc_val - info[0], info[2])) 29 matches.sort() 30 if matches: 31 retval = matches[0][1] 32 return retval 33 34def ShowX86UserStack(thread, user_lib_info = None): 35 """ Display user space stack frame and pc addresses. 36 params: 37 thread: obj referencing thread value 38 returns: 39 Nothing 40 """ 41 iss = Cast(thread.machine.iss, 'x86_saved_state_t *') 42 abi = int(iss.flavor) 43 user_ip = 0 44 user_frame = 0 45 user_abi_ret_offset = 0 46 if abi == 0xf: 47 debuglog("User process is 64 bit") 48 user_ip = iss.uss.ss_64.isf.rip 49 user_frame = iss.uss.ss_64.rbp 50 user_abi_ret_offset = 8 51 user_abi_type = "uint64_t" 52 else: 53 debuglog("user process is 32 bit") 54 user_ip = iss.uss.ss_32.eip 55 user_frame = iss.uss.ss_32.ebp 56 user_abi_ret_offset = 4 57 user_abi_type = "uint32_t" 58 59 if user_ip == 0: 60 print("This activation does not appear to have a valid user context.") 61 return False 62 63 cur_ip = user_ip 64 cur_frame = user_frame 65 debuglog("ip= 0x%x , fr = 0x%x " % (cur_ip, cur_frame)) 66 67 frameformat = "{0:d} FP: 0x{1:x} PC: 0x{2:x}" 68 if user_lib_info is not None: 69 frameformat = "{0:d} {3: <30s} 0x{2:x}" 70 print(frameformat.format(0, cur_frame, cur_ip, GetBinaryNameForPC(cur_ip, user_lib_info))) 71 72 print(kern.Symbolicate(cur_ip)) 73 74 frameno = 0 75 while True: 76 frameno = frameno + 1 77 frame = GetUserDataAsString(thread.t_tro.tro_task, unsigned(cur_frame), user_abi_ret_offset*2) 78 cur_ip = _ExtractDataFromString(frame, user_abi_ret_offset, user_abi_type) 79 cur_frame = _ExtractDataFromString(frame, 0, user_abi_type) 80 if not cur_frame or cur_frame == 0x0000000800000008: 81 break 82 print(frameformat.format(frameno, cur_frame, cur_ip, GetBinaryNameForPC(cur_ip, user_lib_info))) 83 print(kern.Symbolicate(cur_ip)) 84 return 85 86def _PrintARMUserStack(task, cur_pc, cur_fp, framesize, frametype, frameformat, user_lib_info=None): 87 cur_pc = kern.StripUserPAC(cur_pc) 88 if cur_pc == 0: 89 "No valid user context for this activation." 90 return 91 frameno = 0 92 print(frameformat.format(frameno, cur_fp, cur_pc, GetBinaryNameForPC(cur_pc, user_lib_info))) 93 while True: 94 frameno = frameno + 1 95 frame = GetUserDataAsString(task, cur_fp, framesize) 96 cur_fp = _ExtractDataFromString(frame, 0, frametype) 97 cur_pc = _ExtractDataFromString(frame, (framesize // 2), frametype) 98 cur_pc = kern.StripUserPAC(cur_pc) 99 if not cur_fp: 100 break 101 print(frameformat.format(frameno, cur_fp, cur_pc, GetBinaryNameForPC(cur_pc, user_lib_info))) 102 103def ShowARM64UserStack(thread, user_lib_info = None): 104 SAVED_STATE_FLAVOR_ARM=20 105 SAVED_STATE_FLAVOR_ARM64=21 106 upcb_addr = kern.StripKernelPAC(thread.machine.upcb) 107 upcb = kern.GetValueFromAddress(upcb_addr, 'arm_saved_state_t *') 108 flavor = upcb.ash.flavor 109 frameformat = "{0:>2d} FP: 0x{1:x} PC: 0x{2:x}" 110 if flavor == SAVED_STATE_FLAVOR_ARM64: 111 cur_pc = unsigned(upcb.uss.ss_64.pc) 112 cur_fp = unsigned(upcb.uss.ss_64.fp) 113 if user_lib_info is not None: 114 frameformat = "{0:>2d} {3: <30s} 0x{2:x}" 115 framesize = 16 116 frametype = "uint64_t" 117 elif flavor == SAVED_STATE_FLAVOR_ARM: 118 cur_pc = unsigned(upcb.uss.ss_32.pc) 119 cur_fp = unsigned(upcb.uss.ss_32.r[7]) 120 if user_lib_info is not None: 121 frameformat = "{0:>2d}: {3: <30s} 0x{2:x}" 122 framesize = 8 123 frametype = "uint32_t" 124 else: 125 raise RuntimeError("Thread {0} has an invalid flavor {1}".format(unsigned(thread), flavor)) 126 127 _PrintARMUserStack(thread.t_tro.tro_task, cur_pc, cur_fp, framesize, frametype, frameformat, user_lib_info=user_lib_info) 128 129 130@lldb_command('showthreaduserstack') 131def ShowThreadUserStack(cmd_args=None): 132 """ Show user stack for a given thread. 133 Syntax: (lldb) showthreaduserstack <thread_ptr> 134 """ 135 if not cmd_args: 136 raise ArgumentError("Insufficient arguments") 137 138 thread = kern.GetValueFromAddress(ArgumentStringToInt(cmd_args[0]), 'thread *') 139 if kern.arch == "x86_64": 140 ShowX86UserStack(thread) 141 elif kern.arch.startswith("arm64"): 142 ShowARM64UserStack(thread) 143 return True 144 145@lldb_command('printuserdata','XO:') 146def PrintUserspaceData(cmd_args=None, cmd_options={}): 147 """ Read userspace data for given task and print based on format provided. 148 Syntax: (lldb) printuserdata <task_t> <uspace_address> <format_specifier> 149 params: 150 <task_t> : pointer to task 151 <uspace_address> : address to user space memory 152 <format_specifier> : String representation for processing the data and printing it. 153 e.g Q -> unsigned long long, q -> long long, I -> unsigned int, i -> int 154 10i -> 10 ints, 20s -> 20 character string, s -> null terminated string 155 See: https://docs.python.org/2/library/struct.html#format-characters 156 options: 157 -X : print all values in hex. 158 -O <file path>: Save data to file 159 """ 160 161 if not cmd_args or len(cmd_args) < 3: 162 raise ArgumentError("Insufficient arguments") 163 task = kern.GetValueFromAddress(cmd_args[0], 'task *') 164 uspace_addr = ArgumentStringToInt(cmd_args[1]) 165 format_specifier_str = cmd_args[2] 166 user_data_len = 0 167 if format_specifier_str == "s": 168 print("0x%x: " % uspace_addr + GetUserspaceString(task, uspace_addr)) 169 return True 170 171 try: 172 user_data_len = struct.calcsize(format_specifier_str) 173 except Exception as e: 174 raise ArgumentError("Invalid format specifier provided.") 175 176 user_data_string = GetUserDataAsString(task, uspace_addr, user_data_len) 177 if not user_data_string: 178 print("Could not read any data from userspace address.") 179 return False 180 if "-O" in cmd_options: 181 fh = open(cmd_options["-O"],"w") 182 fh.write(user_data_string) 183 fh.close() 184 print("Written %d bytes to %s." % (user_data_len, cmd_options['-O'])) 185 return True 186 upacked_data = struct.unpack(format_specifier_str, user_data_string) 187 element_size = user_data_len // len(upacked_data) 188 for i in range(len(upacked_data)): 189 if "-X" in cmd_options: 190 print("0x%x: " % (uspace_addr + i*element_size) + hex(upacked_data[i])) 191 else: 192 print("0x%x: " % (uspace_addr + i*element_size) + str(upacked_data[i])) 193 194 return True 195 196@lldb_command('showtaskuserargs') 197def ShowTaskUserArgs(cmd_args=None, cmd_options={}): 198 """ Read the process argv, env, and apple strings from the user stack 199 Syntax: (lldb) showtaskuserargs <task_t> 200 params: 201 <task_t> : pointer to task 202 """ 203 if not cmd_args or len(cmd_args) != 1: 204 raise ArgumentError("Insufficient arguments") 205 206 task = kern.GetValueFromAddress(cmd_args[0], 'task *') 207 proc = GetProcFromTask(task) 208 if not proc: 209 print("Task has no associated BSD process.") 210 return False 211 ptrsize = 8 if int(task.t_flags) & 0x1 else 4 212 213 format_string = "Q" if ptrsize == 8 else "I" 214 215 string_area_size = proc.p_argslen 216 string_area_addr = proc.user_stack - string_area_size 217 218 string_area = GetUserDataAsString(task, string_area_addr, string_area_size) 219 if not string_area: 220 print("Could not read any data from userspace address.") 221 return False 222 223 i = 0 224 pos = string_area_addr - ptrsize 225 226 for name in ["apple", "env", "argv"] : 227 while True: 228 if name == "argv" : 229 if i == proc.p_argc: 230 break 231 i += 1 232 233 pos -= ptrsize 234 235 user_data_string = GetUserDataAsString(task, pos, ptrsize) 236 ptr = struct.unpack(format_string, user_data_string)[0] 237 238 if ptr == 0: 239 break 240 241 if string_area_addr <= ptr and ptr < string_area_addr+string_area_size : 242 string_offset = ptr - string_area_addr 243 string = string_area[string_offset:] 244 else: 245 string = GetUserspaceString(task, ptr) 246 247 print(name + "[]: " + string) 248 249 return True 250 251def ShowTaskUserStacks(task): 252 #print GetTaskSummary.header + " " + GetProcSummary.header 253 pval = GetProcFromTask(task) 254 #print GetTaskSummary(task) + " " + GetProcSummary(pval) + "\n \n" 255 crash_report_format_string = """\ 256Process: {pname:s} [{pid:d}] 257Path: {path: <50s} 258Identifier: {pname: <30s} 259Version: ??? (???) 260Code Type: {parch: <20s} 261Parent Process: {ppname:s} [{ppid:d}] 262 263Date/Time: {timest:s}.000 -0800 264OS Version: {osversion: <20s} 265Report Version: 8 266 267Exception Type: n/a 268Exception Codes: n/a 269Crashed Thread: 0 270 271Application Specific Information: 272Synthetic crash log generated from Kernel userstacks 273 274""" 275 user_lib_rex = re.compile("([0-9a-fx]+)\s-\s([0-9a-fx]+)\s+(.*?)\s", re.IGNORECASE|re.MULTILINE) 276 from datetime import datetime 277 if pval: 278 ts = datetime.fromtimestamp(int(pval.p_start.tv_sec)) 279 date_string = ts.strftime('%Y-%m-%d %H:%M:%S') 280 else: 281 date_string = "none" 282 is_64 = True 283 if pval and (pval.p_flag & 0x4) == 0 : 284 is_64 = False 285 286 parch_s = "" 287 if kern.arch == "x86_64" or kern.arch == "i386": 288 osversion = "Mac OS X 10.8" 289 parch_s = "I386 (32 bit)" 290 if is_64: 291 parch_s = "X86-64 (Native)" 292 else: 293 parch_s = kern.arch 294 osversion = "iOS" 295 osversion += " ({:s})".format(kern.globals.osversion) 296 if pval: 297 pid = GetProcPID(pval) 298 pname = GetProcName(pval) 299 path = GetProcName(pval) 300 ppid = pval.p_ppid 301 else: 302 pid = 0 303 pname = "unknown" 304 path = "unknown" 305 ppid = 0 306 307 print(crash_report_format_string.format(pid = pid, 308 pname = pname, 309 path = path, 310 ppid = ppid, 311 ppname = GetProcNameForPid(ppid), 312 timest = date_string, 313 parch = parch_s, 314 osversion = osversion 315 )) 316 print("Binary Images:") 317 ShowTaskUserLibraries([hex(task)]) 318 usertask_lib_info = [] # will host [startaddr, endaddr, lib_name] entries 319 for entry in ShowTaskUserLibraries.found_images: 320 #print "processing line %s" % line 321 arr = user_lib_rex.findall(entry[3]) 322 #print "%r" % arr 323 if len(arr) == 0 : 324 continue 325 usertask_lib_info.append([int(arr[0][0],16), int(arr[0][1],16), str(arr[0][2]).strip()]) 326 327 printthread_user_stack_ptr = ShowX86UserStack 328 if kern.arch.startswith("arm64"): 329 printthread_user_stack_ptr = ShowARM64UserStack 330 331 counter = 0 332 for thval in IterateQueue(task.threads, 'thread *', 'task_threads'): 333 print("\nThread {0:d} name:0x{1:x}\nThread {0:d}:".format(counter, thval)) 334 counter += 1 335 try: 336 printthread_user_stack_ptr(thval, usertask_lib_info) 337 except Exception as exc_err: 338 print("Failed to show user stack for thread 0x{0:x}".format(thval)) 339 if config['debug']: 340 raise exc_err 341 else: 342 print("Enable debugging ('(lldb) xnudebug debug') to see detailed trace.") 343 return 344 345@lldb_command('showtaskuserstacks', "P:F:") 346def ShowTaskUserStacksCmdHelper(cmd_args=None, cmd_options={}): 347 """ Print out the user stack for each thread in a task, followed by the user libraries. 348 Syntax: (lldb) showtaskuserstacks <task_t> 349 or: (lldb) showtaskuserstacks -P <pid> 350 or: (lldb) showtaskuserstacks -F <task_name> 351 The format is compatible with CrashTracer. You can also use the speedtracer plugin as follows 352 (lldb) showtaskuserstacks <task_t> -p speedtracer 353 354 Note: the address ranges are approximations. Also the list may not be completely accurate. This command expects memory read failures 355 and hence will skip a library if unable to read information. Please use your good judgement and not take the output as accurate 356 """ 357 task_list = [] 358 if "-F" in cmd_options: 359 task_list = FindTasksByName(cmd_options["-F"]) 360 elif "-P" in cmd_options: 361 pidval = ArgumentStringToInt(cmd_options["-P"]) 362 for t in kern.tasks: 363 pval = GetProcFromTask(t) 364 if pval and GetProcPID(pval) == pidval: 365 task_list.append(t) 366 break 367 elif cmd_args: 368 t = kern.GetValueFromAddress(cmd_args[0], 'task *') 369 task_list.append(t) 370 else: 371 raise ArgumentError("Insufficient arguments") 372 373 for task in task_list: 374 ShowTaskUserStacks(task) 375 376def GetUserDataAsString(task, addr, size): 377 """ Get data from task's address space as a string of bytes 378 params: 379 task: task object from which to extract information 380 addr: int - start address to get data from. 381 size: int - no of bytes to read. 382 returns: 383 str - a stream of bytes. Empty string if read fails. 384 """ 385 err = lldb.SBError() 386 if GetConnectionProtocol() == "kdp": 387 kdp_pmap_addr = unsigned(addressof(kern.globals.kdp_pmap)) 388 if not WriteInt64ToMemoryAddress(unsigned(task.map.pmap), kdp_pmap_addr): 389 debuglog("Failed to write in kdp_pmap from GetUserDataAsString.") 390 return "" 391 content = LazyTarget.GetProcess().ReadMemory(addr, size, err) 392 if not err.Success(): 393 debuglog("Failed to read process memory. Error: " + err.description) 394 return "" 395 if not WriteInt64ToMemoryAddress(0, kdp_pmap_addr): 396 debuglog("Failed to reset in kdp_pmap from GetUserDataAsString.") 397 return "" 398 elif (kern.arch == 'x86_64' or kern.arch.startswith('arm')) and (int(size) < (2 * kern.globals.page_size)): 399 # Without the benefit of a KDP stub on the target, try to 400 # find the user task's physical mapping and memcpy the data. 401 # If it straddles a page boundary, copy in two passes 402 range1_addr = int(addr) 403 range1_size = int(size) 404 if kern.StraddlesPage(range1_addr, range1_size): 405 range2_addr = int(kern.TruncPage(range1_addr + range1_size)) 406 range2_size = int(range1_addr + range1_size - range2_addr) 407 range1_size = int(range2_addr - range1_addr) 408 else: 409 range2_addr = 0 410 range2_size = 0 411 range2_in_kva = 0 412 413 paddr_range1 = PmapWalk(task.map.pmap, range1_addr, vSILENT) 414 if not paddr_range1: 415 debuglog("Not mapped task 0x{:x} address 0x{:x}".format(task, addr)) 416 return "" 417 418 range1_in_kva = kern.PhysToKernelVirt(paddr_range1) 419 content = LazyTarget.GetProcess().ReadMemory(range1_in_kva, range1_size, err) 420 if not err.Success(): 421 raise RuntimeError("Failed to read process memory. Error: " + err.description) 422 423 if range2_addr: 424 paddr_range2 = PmapWalk(task.map.pmap, range2_addr, vSILENT) 425 if not paddr_range2: 426 debuglog("Not mapped task 0x{:x} address 0x{:x}".format(task, addr)) 427 return "" 428 range2_in_kva = kern.PhysToKernelVirt(paddr_range2) 429 content += LazyTarget.GetProcess().ReadMemory(range2_in_kva, range2_size, err) 430 if not err.Success(): 431 raise RuntimeError("Failed to read process memory. Error: " + err.description) 432 else: 433 raise NotImplementedError("GetUserDataAsString does not support this configuration") 434 435 return content 436 437def _ExtractDataFromString(strdata, offset, data_type, length=0): 438 """ Extract specific data from string buffer 439 params: 440 strdata: str - string data give from GetUserDataAsString 441 offset: int - 0 based offset into the data. 442 data_type: str - defines what type to be read as. Supported values are: 443 'uint64_t', 'uint32_t', 'string' 444 length: int - used when data_type=='string' 445 returns 446 None - if extraction failed. 447 obj - based on what is requested in data_type 448 """ 449 unpack_str = "s" 450 if data_type == 'uint64_t': 451 length = 8 452 unpack_str = "Q" 453 elif data_type == "uint32_t": 454 length = 4 455 unpack_str = "I" 456 else: 457 unpack_str= "%ds" % length 458 459 data_len = len(strdata) 460 if offset > data_len or (offset + length) > data_len or offset < 0: 461 debuglog("Invalid arguments to _ExtractDataFromString.") 462 return 0 463 464 data = struct.unpack(unpack_str, strdata[offset:(offset + length)])[0] 465 if data_type == 'string': 466 return six.ensure_binary(data) 467 468 return data 469 470def GetUserspaceString(task, string_address): 471 """ Maps 32 bytes at a time and packs as string 472 params: 473 task: obj - referencing task to read data from 474 string_address: int - address where the image path is stored 475 returns: 476 str - string path of the file. "" if failed to read. 477 """ 478 done = False 479 retval = "" 480 481 if string_address == 0: 482 done = True 483 484 while not done: 485 str_data = bytes(GetUserDataAsString(task, string_address, 32), 'utf8') 486 if len(str_data) == 0: 487 break 488 i = 0 489 while i < 32: 490 if str_data[i]: 491 retval += chr(str_data[i]) 492 else: 493 break 494 i += 1 495 if i < 32: 496 done = True 497 else: 498 string_address += 32 499 return six.ensure_str(retval) 500 501def GetImageInfo(task, mh_image_address, mh_path_address, approx_end_address=None): 502 """ Print user library informaiton. 503 params: 504 task : obj referencing the task for which Image info printed 505 mh_image_address : int - address which has image info 506 mh_path_address : int - address which holds path name string 507 approx_end_address: int - address which lldbmacros think is end address. 508 returns: 509 str - string representing image info. "" if failure to read data. 510 """ 511 if approx_end_address: 512 image_end_load_address = int(approx_end_address) -1 513 else: 514 image_end_load_address = int(mh_image_address) + 0xffffffff 515 516 print_format = "0x{0:x} - 0x{1:x} {2: <50s} (??? - ???) <{3: <36s}> {4: <50s}" 517 # 32 bytes enough for mach_header/mach_header_64 518 mh_data = GetUserDataAsString(task, mh_image_address, 32) 519 if len(mh_data) == 0: 520 debuglog("unable to get userdata for task 0x{:x} img_addr 0x{:x} path_address 0x{:x}".format( 521 task, mh_image_address, mh_path_address)) 522 return "" 523 mh_magic = _ExtractDataFromString(mh_data, (4 * 0), "uint32_t") 524 mh_cputype = _ExtractDataFromString(mh_data,(4 * 1), "uint32_t") 525 mh_cpusubtype = _ExtractDataFromString(mh_data,(4 * 2), "uint32_t") 526 mh_filetype = _ExtractDataFromString(mh_data,(4 * 3), "uint32_t") 527 mh_ncmds = _ExtractDataFromString(mh_data,(4 * 4), "uint32_t") 528 mh_sizeofcmds = _ExtractDataFromString(mh_data,(4 * 5), "uint32_t") 529 mh_flags = _ExtractDataFromString(mh_data,(4 * 6), "uint32_t") 530 531 if mh_magic == 0xfeedfacf: 532 mh_64 = True 533 lc_address = mh_image_address + 32 534 else: 535 mh_64 = False 536 lc_address = mh_image_address + 28 537 538 lc_idx = 0 539 uuid_data = 0 540 found_uuid_data = False 541 retval = None 542 while lc_idx < mh_ncmds: 543 # 24 bytes is the size of uuid_command 544 lcmd_data = GetUserDataAsString(task, lc_address, 24) 545 lc_cmd = _ExtractDataFromString(lcmd_data, 4 * 0, "uint32_t") 546 lc_cmd_size = _ExtractDataFromString(lcmd_data, 4 * 1, "uint32_t") 547 lc_data = _ExtractDataFromString(lcmd_data, 4*2, "string", 16) 548 549 uuid_out_string = "" 550 path_out_string = "" 551 552 if lc_cmd == 0x1b: 553 # need to print the uuid now. 554 uuid_data = bytes(lc_data) 555 found_uuid_data = True 556 uuid_out_string = "{a[0]:02X}{a[1]:02X}{a[2]:02X}{a[3]:02X}-{a[4]:02X}{a[5]:02X}-{a[6]:02X}{a[7]:02X}-{a[8]:02X}{a[9]:02X}-{a[10]:02X}{a[11]:02X}{a[12]:02X}{a[13]:02X}{a[14]:02X}{a[15]:02X}".format(a=uuid_data) 557 #also print image path 558 path_out_string = GetUserspaceString(task, mh_path_address) 559 path_base_name = path_out_string.split("/")[-1] 560 retval = print_format.format(mh_image_address, image_end_load_address, path_base_name, uuid_out_string, path_out_string) 561 elif lc_cmd == 0xe: 562 ShowTaskUserLibraries.exec_load_path = lc_address + _ExtractDataFromString(lcmd_data, 4*2, "uint32_t") 563 debuglog("Found load command to be 0xe for address %s" % hex(ShowTaskUserLibraries.exec_load_path)) 564 lc_address = lc_address + lc_cmd_size 565 lc_idx += 1 566 567 if not found_uuid_data: 568 path_out_string = GetUserspaceString(task, mh_path_address) 569 path_base_name = path_out_string.split("/")[-1] 570 uuid_out_string = "" 571 572 retval = print_format.format(mh_image_address, image_end_load_address, path_base_name, uuid_out_string, path_out_string) 573 return retval 574 575@static_var("found_images", []) # holds entries of format (startaddr, endaddr, image_path_addr, infostring) 576@static_var("exec_load_path", 0) 577@lldb_command("showtaskuserlibraries") 578def ShowTaskUserLibraries(cmd_args=None): 579 """ Show binary images known by dyld in target task 580 For a given user task, inspect the dyld shared library state and print information about all Mach-O images. 581 Syntax: (lldb)showtaskuserlibraries <task_t> 582 Note: the address ranges are approximations. Also the list may not be completely accurate. This command expects memory read failures 583 and hence will skip a library if unable to read information. Please use your good judgement and not take the output as accurate 584 """ 585 if not cmd_args: 586 raise ArgumentError("Insufficient arguments") 587 588 #reset the found_images array 589 ShowTaskUserLibraries.found_images = [] 590 591 task = kern.GetValueFromAddress(cmd_args[0], 'task_t') 592 is_task_64 = int(task.t_flags) & 0x1 593 dyld_all_image_infos_address = unsigned(task.all_image_info_addr) 594 debuglog("dyld_all_image_infos_address = %s" % hex(dyld_all_image_infos_address)) 595 596 cur_data_offset = 0 597 if dyld_all_image_infos_address == 0: 598 print("No dyld shared library information available for task") 599 return False 600 601 debuglog("Extracting version information.") 602 vers_info_data = GetUserDataAsString(task, dyld_all_image_infos_address, 112) 603 version = _ExtractDataFromString(vers_info_data, cur_data_offset, "uint32_t") 604 cur_data_offset += 4 605 if version > 14: 606 print("Unknown dyld all_image_infos version number %d" % version) 607 image_info_count = _ExtractDataFromString(vers_info_data, cur_data_offset, "uint32_t") 608 debuglog("version = %d count = %d is_task_64 = %s" % (version, image_info_count, repr(is_task_64))) 609 610 ShowTaskUserLibraries.exec_load_path = 0 611 if is_task_64: 612 image_info_size = 24 613 image_info_array_address = _ExtractDataFromString(vers_info_data, 8, "uint64_t") 614 dyld_load_address = _ExtractDataFromString(vers_info_data, 8*4, "uint64_t") 615 dyld_all_image_infos_address_from_struct = _ExtractDataFromString(vers_info_data, 8*13, "uint64_t") 616 else: 617 image_info_size = 12 618 image_info_array_address = _ExtractDataFromString(vers_info_data, 4*2, "uint32_t") 619 dyld_load_address = _ExtractDataFromString(vers_info_data, 4*5, "uint32_t") 620 dyld_all_image_infos_address_from_struct = _ExtractDataFromString(vers_info_data, 4*14, "uint32_t") 621 # Account for ASLR slide before dyld can fix the structure 622 dyld_load_address = dyld_load_address + (dyld_all_image_infos_address - dyld_all_image_infos_address_from_struct) 623 624 i = 0 625 image_info_list = [] 626 while i < image_info_count: 627 image_info_address = image_info_array_address + i * image_info_size 628 debuglog("i = %d, image_info_address = %s, image_info_size = %d" % (i, hex(image_info_address), image_info_size)) 629 n_im_info_addr = None 630 img_data = "" 631 try: 632 img_data = GetUserDataAsString(task, image_info_address, image_info_size) 633 except Exception as e: 634 debuglog("Failed to read user data for task 0x{:x} addr 0x{:x}, exception {:s}".format(task, image_info_address, str(e))) 635 pass 636 637 if is_task_64: 638 image_info_addr = _ExtractDataFromString(img_data, 0, "uint64_t") 639 image_info_path = _ExtractDataFromString(img_data, 8, "uint64_t") 640 else: 641 image_info_addr = _ExtractDataFromString(img_data, 0, "uint32_t") 642 image_info_path = _ExtractDataFromString(img_data, 4, "uint32_t") 643 644 if image_info_addr : 645 debuglog("Found image: image_info_addr = %s, image_info_path= %s" % (hex(image_info_addr), hex(image_info_path))) 646 image_info_list.append((image_info_addr, image_info_path)) 647 i += 1 648 649 image_info_list.sort() 650 num_images_found = len(image_info_list) 651 652 for ii in range(num_images_found): 653 n_im_info_addr = dyld_load_address 654 if ii + 1 < num_images_found: 655 n_im_info_addr = image_info_list[ii+1][0] 656 657 image_info_addr = image_info_list[ii][0] 658 image_info_path = image_info_list[ii][1] 659 try: 660 image_print_s = GetImageInfo(task, image_info_addr, image_info_path, approx_end_address=n_im_info_addr) 661 if len(image_print_s) > 0: 662 print(image_print_s) 663 ShowTaskUserLibraries.found_images.append((image_info_addr, n_im_info_addr, image_info_path, image_print_s)) 664 else: 665 debuglog("Failed to print image info for task 0x{:x} image_info 0x{:x}".format(task, image_info_addr)) 666 except Exception as e: 667 if config['debug']: 668 raise e 669 670 # load_path might get set when the main executable is processed. 671 if ShowTaskUserLibraries.exec_load_path != 0: 672 debuglog("main executable load_path is set.") 673 image_print_s = GetImageInfo(task, dyld_load_address, ShowTaskUserLibraries.exec_load_path) 674 if len(image_print_s) > 0: 675 print(image_print_s) 676 ShowTaskUserLibraries.found_images.append((dyld_load_address, dyld_load_address + 0xffffffff, 677 ShowTaskUserLibraries.exec_load_path, image_print_s)) 678 else: 679 debuglog("Failed to print image for main executable for task 0x{:x} dyld_load_addr 0x{:x}".format(task, dyld_load_address)) 680 else: 681 debuglog("Falling back to vm entry method for finding executable load address") 682 print("# NOTE: Failed to find executable using all_image_infos. Using fuzzy match to find best possible load address for executable.") 683 ShowTaskLoadInfo([cmd_args[0]]) 684 return 685 686@lldb_command("showtaskuserdyldinfo") 687def ShowTaskUserDyldInfo(cmd_args=None): 688 """ Inspect the dyld global info for the given user task & print out all fields including error messages 689 Syntax: (lldb)showtaskuserdyldinfo <task_t> 690 """ 691 if cmd_args == None or len(cmd_args) < 1: 692 print("No arguments passed") 693 print(ShowTaskUserDyldInfo.__doc__.strip()) 694 return 695 696 out_str = "" 697 task = kern.GetValueFromAddress(cmd_args[0], 'task_t') 698 is_task_64 = int(task.t_flags) & 0x1 699 dyld_all_image_infos_address = unsigned(task.all_image_info_addr) 700 if dyld_all_image_infos_address == 0: 701 print("No dyld shared library information available for task") 702 return False 703 vers_info_data = GetUserDataAsString(task, dyld_all_image_infos_address, 112) 704 dyld_all_image_infos_version = _ExtractDataFromString(vers_info_data, 0, "uint32_t") 705 if dyld_all_image_infos_version > 14: 706 out_str += "Unknown dyld all_image_infos version number %d" % dyld_all_image_infos_version 707 708 # Find fields by byte offset. We assume at least version 9 is supported 709 if is_task_64: 710 dyld_all_image_infos_infoArrayCount = _ExtractDataFromString(vers_info_data, 4, "uint32_t") 711 dyld_all_image_infos_infoArray = _ExtractDataFromString(vers_info_data, 8, "uint64_t") 712 dyld_all_image_infos_notification = _ExtractDataFromString(vers_info_data, 16, "uint64_t") 713 dyld_all_image_infos_processDetachedFromSharedRegion = _ExtractDataFromString(vers_info_data, 24, "string") 714 dyld_all_image_infos_libSystemInitialized = _ExtractDataFromString(vers_info_data, 25, "string") 715 dyld_all_image_infos_dyldImageLoadAddress = _ExtractDataFromString(vers_info_data, 32, "uint64_t") 716 dyld_all_image_infos_jitInfo = _ExtractDataFromString(vers_info_data, 40, "uint64_t") 717 dyld_all_image_infos_dyldVersion = _ExtractDataFromString(vers_info_data, 48, "uint64_t") 718 dyld_all_image_infos_errorMessage = _ExtractDataFromString(vers_info_data, 56, "uint64_t") 719 dyld_all_image_infos_terminationFlags = _ExtractDataFromString(vers_info_data, 64, "uint64_t") 720 dyld_all_image_infos_coreSymbolicationShmPage = _ExtractDataFromString(vers_info_data, 72, "uint64_t") 721 dyld_all_image_infos_systemOrderFlag = _ExtractDataFromString(vers_info_data, 80, "uint64_t") 722 dyld_all_image_infos_uuidArrayCount = _ExtractDataFromString(vers_info_data, 88, "uint64_t") 723 dyld_all_image_infos_uuidArray = _ExtractDataFromString(vers_info_data, 96, "uint64_t") 724 dyld_all_image_infos_dyldAllImageInfosAddress = _ExtractDataFromString(vers_info_data, 104, "uint64_t") 725 else: 726 dyld_all_image_infos_infoArrayCount = _ExtractDataFromString(vers_info_data, 4, "uint32_t") 727 dyld_all_image_infos_infoArray = _ExtractDataFromString(vers_info_data, 8, "uint32_t") 728 dyld_all_image_infos_notification = _ExtractDataFromString(vers_info_data, 12, "uint32_t") 729 dyld_all_image_infos_processDetachedFromSharedRegion = _ExtractDataFromString(vers_info_data, 16, "string") 730 dyld_all_image_infos_libSystemInitialized = _ExtractDataFromString(vers_info_data, 17, "string") 731 dyld_all_image_infos_dyldImageLoadAddress = _ExtractDataFromString(vers_info_data, 20, "uint32_t") 732 dyld_all_image_infos_jitInfo = _ExtractDataFromString(vers_info_data, 24, "uint32_t") 733 dyld_all_image_infos_dyldVersion = _ExtractDataFromString(vers_info_data, 28, "uint32_t") 734 dyld_all_image_infos_errorMessage = _ExtractDataFromString(vers_info_data, 32, "uint32_t") 735 dyld_all_image_infos_terminationFlags = _ExtractDataFromString(vers_info_data, 36, "uint32_t") 736 dyld_all_image_infos_coreSymbolicationShmPage = _ExtractDataFromString(vers_info_data, 40, "uint32_t") 737 dyld_all_image_infos_systemOrderFlag = _ExtractDataFromString(vers_info_data, 44, "uint32_t") 738 dyld_all_image_infos_uuidArrayCount = _ExtractDataFromString(vers_info_data, 48, "uint32_t") 739 dyld_all_image_infos_uuidArray = _ExtractDataFromString(vers_info_data, 52, "uint32_t") 740 dyld_all_image_infos_dyldAllImageInfosAddress = _ExtractDataFromString(vers_info_data, 56, "uint32_t") 741 742 dyld_all_imfo_infos_slide = (dyld_all_image_infos_address - dyld_all_image_infos_dyldAllImageInfosAddress) 743 dyld_all_image_infos_dyldVersion_postslide = (dyld_all_image_infos_dyldVersion + dyld_all_imfo_infos_slide) 744 745 path_out = GetUserspaceString(task, dyld_all_image_infos_dyldVersion_postslide) 746 out_str += "[dyld-{:s}]\n".format(path_out) 747 out_str += "version \t\t\t\t: {:d}\n".format(dyld_all_image_infos_version) 748 out_str += "infoArrayCount \t\t\t\t: {:d}\n".format(dyld_all_image_infos_infoArrayCount) 749 out_str += "infoArray \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_infoArray) 750 out_str += "notification \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_notification) 751 752 out_str += "processDetachedFromSharedRegion \t: " 753 if dyld_all_image_infos_processDetachedFromSharedRegion != "": 754 out_str += "TRUE\n".format(dyld_all_image_infos_processDetachedFromSharedRegion) 755 else: 756 out_str += "FALSE\n" 757 758 out_str += "libSystemInitialized \t\t\t: " 759 if dyld_all_image_infos_libSystemInitialized != "": 760 out_str += "TRUE\n".format(dyld_all_image_infos_libSystemInitialized) 761 else: 762 out_str += "FALSE\n" 763 764 out_str += "dyldImageLoadAddress \t\t\t: {:#x}\n".format(dyld_all_image_infos_dyldImageLoadAddress) 765 out_str += "jitInfo \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_jitInfo) 766 out_str += "\ndyldVersion \t\t\t\t: {:#x}".format(dyld_all_image_infos_dyldVersion) 767 if (dyld_all_imfo_infos_slide != 0): 768 out_str += " (currently {:#x})\n".format(dyld_all_image_infos_dyldVersion_postslide) 769 else: 770 out_str += "\n" 771 772 out_str += "errorMessage \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_errorMessage) 773 if dyld_all_image_infos_errorMessage != 0: 774 out_str += GetUserspaceString(task, dyld_all_image_infos_errorMessage) 775 776 out_str += "terminationFlags \t\t\t: {:#x}\n".format(dyld_all_image_infos_terminationFlags) 777 out_str += "coreSymbolicationShmPage \t\t: {:#x}\n".format(dyld_all_image_infos_coreSymbolicationShmPage) 778 out_str += "systemOrderFlag \t\t\t: {:#x}\n".format(dyld_all_image_infos_systemOrderFlag) 779 out_str += "uuidArrayCount \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_uuidArrayCount) 780 out_str += "uuidArray \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_uuidArray) 781 out_str += "dyldAllImageInfosAddress \t\t: {:#x}".format(dyld_all_image_infos_dyldAllImageInfosAddress) 782 if (dyld_all_imfo_infos_slide != 0): 783 out_str += " (currently {:#x})\n".format(dyld_all_image_infos_address) 784 else: 785 out_str += "\n" 786 787 if is_task_64: 788 dyld_all_image_infos_address = dyld_all_image_infos_address + 112 789 dyld_all_image_infos_v10 = GetUserDataAsString(task, dyld_all_image_infos_address, 64) 790 dyld_all_image_infos_initialImageCount = _ExtractDataFromString(dyld_all_image_infos_v10, 112-112, "uint64_t") 791 dyld_all_image_infos_errorKind = _ExtractDataFromString(dyld_all_image_infos_v10, 120-112, "uint64_t") 792 dyld_all_image_infos_errorClientOfDylibPath = _ExtractDataFromString(dyld_all_image_infos_v10, 128-112, "uint64_t") 793 dyld_all_image_infos_errorTargetDylibPath = _ExtractDataFromString(dyld_all_image_infos_v10, 136-112, "uint64_t") 794 dyld_all_image_infos_errorSymbol = _ExtractDataFromString(dyld_all_image_infos_v10, 144-112, "uint64_t") 795 dyld_all_image_infos_sharedCacheSlide = _ExtractDataFromString(dyld_all_image_infos_v10, 152-112, "uint64_t") 796 dyld_all_image_infos_sharedCacheUUID = _ExtractDataFromString(dyld_all_image_infos_v10, 160-112, "string") 797 else: 798 dyld_all_image_infos_address = dyld_all_image_infos_address + 60 799 dyld_all_image_infos_v10 = GetUserDataAsString(task, dyld_all_image_infos_address, 40) 800 dyld_all_image_infos_initialImageCount = _ExtractDataFromString(dyld_all_image_infos_v10, 60-60, "uint32_t") 801 dyld_all_image_infos_errorKind = _ExtractDataFromString(dyld_all_image_infos_v10, 64-60, "uint32_t") 802 dyld_all_image_infos_errorClientOfDylibPath = _ExtractDataFromString(dyld_all_image_infos_v10, 68-60, "uint32_t") 803 dyld_all_image_infos_errorTargetDylibPath = _ExtractDataFromString(dyld_all_image_infos_v10, 72-60, "uint32_t") 804 dyld_all_image_infos_errorSymbol = _ExtractDataFromString(dyld_all_image_infos_v10, 76-60, "uint32_t") 805 dyld_all_image_infos_sharedCacheSlide = _ExtractDataFromString(dyld_all_image_infos_v10, 80-60, "uint32_t") 806 dyld_all_image_infos_sharedCacheUUID = _ExtractDataFromString(dyld_all_image_infos_v10, 84-60, "string") 807 808 if dyld_all_image_infos_version >= 10: 809 out_str += "\ninitialImageCount \t\t\t: {:#x}\n".format(dyld_all_image_infos_initialImageCount) 810 811 if dyld_all_image_infos_version >= 11: 812 out_str += "errorKind \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_errorKind) 813 out_str += "errorClientOfDylibPath \t\t\t: {:#x}\n".format(dyld_all_image_infos_errorClientOfDylibPath) 814 if dyld_all_image_infos_errorClientOfDylibPath != 0: 815 out_str += "\t\t\t\t" 816 out_str += GetUserspaceString(task, dyld_all_image_infos_errorClientOfDylibPath) 817 out_str += "\n" 818 out_str += "errorTargetDylibPath \t\t\t: {:#x}\n".format(dyld_all_image_infos_errorTargetDylibPath) 819 if dyld_all_image_infos_errorTargetDylibPath != 0: 820 out_str += "\t\t\t\t" 821 out_str += GetUserspaceString(task, dyld_all_image_infos_errorTargetDylibPath) 822 out_str += "\n" 823 out_str += "errorSymbol \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_errorSymbol) 824 if dyld_all_image_infos_errorSymbol != 0: 825 out_str += "\t\t\t\t" 826 out_str += GetUserspaceString(task, dyld_all_image_infos_errorSymbol) 827 out_str += "\n" 828 829 if dyld_all_image_infos_version >= 12: 830 out_str += "sharedCacheSlide \t\t\t: {:#x}\n".format(dyld_all_image_infos_sharedCacheSlide) 831 if dyld_all_image_infos_version >= 13 and dyld_all_image_infos_sharedCacheUUID != b"": 832 out_str += "sharedCacheUUID \t\t\t: {:s}\n".format(six.ensure_str(dyld_all_image_infos_sharedCacheUUID)) 833 else: 834 out_str += "No dyld information available for task\n" 835 print(out_str) 836 837def SaveDataToFile(start_addr, length, outputfile, task=None,): 838 """ Save the data at the specified address (of the specified length) to the file. 839 params: start_addr : start address of the region of memory to save 840 length : length of the region of memory to save 841 outputfile : file to save the data in 842 task (optional) : task containing the memory region (if from user data) 843 returns: True if we saved the requested data, False otherwise 844 """ 845 if task: 846 memory_data = GetUserDataAsString(task, start_addr, length) 847 else: 848 err = lldb.SBError() 849 memory_data = LazyTarget.GetProcess().ReadMemory(start_addr, length, err) 850 if not err.Success(): 851 print("Failed to read process memory. {:d} bytes from address {: <#020x}. Error: {}".format(length, start_addr, err.description)) 852 return False 853 854 if len(memory_data) != length: 855 print("Failed to read {:d} bytes from address {: <#020x}".format(length, start_addr)) 856 return False 857 858 fh = open(outputfile, 'wb') 859 fh.write(memory_data) 860 fh.close() 861 print("Saved {:d} bytes to file {:s}".format(length, outputfile)) 862 return True 863 864 865@lldb_command('savekcdata', 'T:O:') 866def SaveKCDataToFile(cmd_args=None, cmd_options={}): 867 """ Save the data referred by the kcdata_descriptor structure. 868 options: 869 -T: <task_t> pointer to task if memory referenced is in userstask. 870 -O: <output file path> path to file to save data. default: /tmp/kcdata.<timestamp>.bin 871 Usage: (lldb) savekcdata <kcdata_descriptor_t> -T <task_t> -O /path/to/outputfile.bin 872 """ 873 if not cmd_args: 874 raise ArgumentError('Please provide the kcdata descriptor.') 875 876 kcdata = kern.GetValueFromAddress(cmd_args[0], 'kcdata_descriptor_t') 877 878 outputfile = '/tmp/kcdata.{:s}.bin'.format(str(time.time())) 879 task = None 880 if '-O' in cmd_options: 881 outputfile = cmd_options['-O'] 882 if '-T' in cmd_options: 883 task = kern.GetValueFromAddress(cmd_options['-T'], 'task_t') 884 885 memory_begin_address = unsigned(kcdata.kcd_addr_begin) 886 memory_size = 16 + unsigned(kcdata.kcd_addr_end) - memory_begin_address 887 flags_copyout = unsigned(kcdata.kcd_flags) 888 if flags_copyout: 889 if not task: 890 raise ArgumentError('Invalid task pointer provided.') 891 return SaveDataToFile(memory_begin_address, memory_size, outputfile, task) 892 else: 893 return SaveDataToFile(memory_begin_address, memory_size, outputfile, None) 894