You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
232 lines
9.6 KiB
232 lines
9.6 KiB
4 months ago
|
#!/usr/bin/env python
|
||
|
|
|
||
|
|
import lldb
|
||
|
|
import struct
|
||
|
|
|
||
|
|
|
||
|
|
class OperatingSystemPlugIn(object):
|
||
|
|
"""Class that provides data for an instance of a LLDB 'OperatingSystemPython' plug-in class"""
|
||
|
|
|
||
|
|
def __init__(self, process):
|
||
|
|
'''Initialization needs a valid.SBProcess object.
|
||
|
|
|
||
|
|
This plug-in will get created after a live process is valid and has stopped for the
|
||
|
|
first time.'''
|
||
|
|
self.process = None
|
||
|
|
self.registers = None
|
||
|
|
self.threads = None
|
||
|
|
if isinstance(process, lldb.SBProcess) and process.IsValid():
|
||
|
|
self.process = process
|
||
|
|
self.threads = None # Will be an dictionary containing info for each thread
|
||
|
|
|
||
|
|
def get_target(self):
|
||
|
|
# NOTE: Don't use "lldb.target" when trying to get your target as the "lldb.target"
|
||
|
|
# tracks the current target in the LLDB command interpreter which isn't the
|
||
|
|
# correct thing to use for this plug-in.
|
||
|
|
return self.process.target
|
||
|
|
|
||
|
|
def create_thread(self, tid, context):
|
||
|
|
if tid == 0x444444444:
|
||
|
|
thread_info = {
|
||
|
|
'tid': tid,
|
||
|
|
'name': 'four',
|
||
|
|
'queue': 'queue4',
|
||
|
|
'state': 'stopped',
|
||
|
|
'stop_reason': 'none'}
|
||
|
|
self.threads.append(thread_info)
|
||
|
|
return thread_info
|
||
|
|
return None
|
||
|
|
|
||
|
|
def get_thread_info(self):
|
||
|
|
if not self.threads:
|
||
|
|
# The sample dictionary below shows the values that can be returned for a thread
|
||
|
|
# tid => thread ID (mandatory)
|
||
|
|
# name => thread name (optional key/value pair)
|
||
|
|
# queue => thread dispatch queue name (optional key/value pair)
|
||
|
|
# state => thred state (mandatory, set to 'stopped' for now)
|
||
|
|
# stop_reason => thread stop reason. (mandatory, usually set to 'none')
|
||
|
|
# Possible values include:
|
||
|
|
# 'breakpoint' if the thread is stopped at a breakpoint
|
||
|
|
# 'none' thread is just stopped because the process is stopped
|
||
|
|
# 'trace' the thread just single stepped
|
||
|
|
# The usual value for this while threads are in memory is 'none'
|
||
|
|
# register_data_addr => the address of the register data in memory (optional key/value pair)
|
||
|
|
# Specifying this key/value pair for a thread will avoid a call to get_register_data()
|
||
|
|
# and can be used when your registers are in a thread context structure that is contiguous
|
||
|
|
# in memory. Don't specify this if your register layout in memory doesn't match the layout
|
||
|
|
# described by the dictionary returned from a call to the
|
||
|
|
# get_register_info() method.
|
||
|
|
self.threads = [{'tid': 0x111111111,
|
||
|
|
'name': 'one',
|
||
|
|
'queue': 'queue1',
|
||
|
|
'state': 'stopped',
|
||
|
|
'stop_reason': 'breakpoint'},
|
||
|
|
{'tid': 0x222222222,
|
||
|
|
'name': 'two',
|
||
|
|
'queue': 'queue2',
|
||
|
|
'state': 'stopped',
|
||
|
|
'stop_reason': 'none'},
|
||
|
|
{'tid': 0x333333333,
|
||
|
|
'name': 'three',
|
||
|
|
'queue': 'queue3',
|
||
|
|
'state': 'stopped',
|
||
|
|
'stop_reason': 'trace',
|
||
|
|
'register_data_addr': 0x100000000}]
|
||
|
|
return self.threads
|
||
|
|
|
||
|
|
def get_register_info(self):
|
||
|
|
if self.registers is None:
|
||
|
|
self.registers = dict()
|
||
|
|
triple = self.process.target.triple
|
||
|
|
if triple:
|
||
|
|
arch = triple.split('-')[0]
|
||
|
|
if arch == 'x86_64':
|
||
|
|
self.registers['sets'] = ['GPR', 'FPU', 'EXC']
|
||
|
|
self.registers['registers'] = [
|
||
|
|
{'name': 'rax', 'bitsize': 64, 'offset': 0, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 0, 'dwarf': 0},
|
||
|
|
{'name': 'rbx', 'bitsize': 64, 'offset': 8, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 3, 'dwarf': 3},
|
||
|
|
{'name': 'rcx', 'bitsize': 64, 'offset': 16, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 2, 'dwarf': 2, 'generic': 'arg4', 'alt-name': 'arg4', },
|
||
|
|
{'name': 'rdx', 'bitsize': 64, 'offset': 24, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 1, 'dwarf': 1, 'generic': 'arg3', 'alt-name': 'arg3', },
|
||
|
|
{'name': 'rdi', 'bitsize': 64, 'offset': 32, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 5, 'dwarf': 5, 'generic': 'arg1', 'alt-name': 'arg1', },
|
||
|
|
{'name': 'rsi', 'bitsize': 64, 'offset': 40, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 4, 'dwarf': 4, 'generic': 'arg2', 'alt-name': 'arg2', },
|
||
|
|
{'name': 'rbp', 'bitsize': 64, 'offset': 48, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 6, 'dwarf': 6, 'generic': 'fp', 'alt-name': 'fp', },
|
||
|
|
{'name': 'rsp', 'bitsize': 64, 'offset': 56, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 7, 'dwarf': 7, 'generic': 'sp', 'alt-name': 'sp', },
|
||
|
|
{'name': 'r8', 'bitsize': 64, 'offset': 64, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 8, 'dwarf': 8, 'generic': 'arg5', 'alt-name': 'arg5', },
|
||
|
|
{'name': 'r9', 'bitsize': 64, 'offset': 72, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 9, 'dwarf': 9, 'generic': 'arg6', 'alt-name': 'arg6', },
|
||
|
|
{'name': 'r10', 'bitsize': 64, 'offset': 80, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 10, 'dwarf': 10},
|
||
|
|
{'name': 'r11', 'bitsize': 64, 'offset': 88, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 11, 'dwarf': 11},
|
||
|
|
{'name': 'r12', 'bitsize': 64, 'offset': 96, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 12, 'dwarf': 12},
|
||
|
|
{'name': 'r13', 'bitsize': 64, 'offset': 104, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 13, 'dwarf': 13},
|
||
|
|
{'name': 'r14', 'bitsize': 64, 'offset': 112, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 14, 'dwarf': 14},
|
||
|
|
{'name': 'r15', 'bitsize': 64, 'offset': 120, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 15, 'dwarf': 15},
|
||
|
|
{'name': 'rip', 'bitsize': 64, 'offset': 128, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'gcc': 16, 'dwarf': 16, 'generic': 'pc', 'alt-name': 'pc'},
|
||
|
|
{'name': 'rflags', 'bitsize': 64, 'offset': 136, 'encoding': 'uint', 'format': 'hex', 'set': 0, 'generic': 'flags', 'alt-name': 'flags'},
|
||
|
|
{'name': 'cs', 'bitsize': 64, 'offset': 144, 'encoding': 'uint', 'format': 'hex', 'set': 0},
|
||
|
|
{'name': 'fs', 'bitsize': 64, 'offset': 152, 'encoding': 'uint', 'format': 'hex', 'set': 0},
|
||
|
|
{'name': 'gs', 'bitsize': 64, 'offset': 160, 'encoding': 'uint', 'format': 'hex', 'set': 0},
|
||
|
|
]
|
||
|
|
return self.registers
|
||
|
|
|
||
|
|
def get_register_data(self, tid):
|
||
|
|
if tid == 0x111111111:
|
||
|
|
return struct.pack(
|
||
|
|
'21Q',
|
||
|
|
1,
|
||
|
|
2,
|
||
|
|
3,
|
||
|
|
4,
|
||
|
|
5,
|
||
|
|
6,
|
||
|
|
7,
|
||
|
|
8,
|
||
|
|
9,
|
||
|
|
10,
|
||
|
|
11,
|
||
|
|
12,
|
||
|
|
13,
|
||
|
|
14,
|
||
|
|
15,
|
||
|
|
16,
|
||
|
|
17,
|
||
|
|
18,
|
||
|
|
19,
|
||
|
|
20,
|
||
|
|
21)
|
||
|
|
elif tid == 0x222222222:
|
||
|
|
return struct.pack(
|
||
|
|
'21Q',
|
||
|
|
11,
|
||
|
|
12,
|
||
|
|
13,
|
||
|
|
14,
|
||
|
|
15,
|
||
|
|
16,
|
||
|
|
17,
|
||
|
|
18,
|
||
|
|
19,
|
||
|
|
110,
|
||
|
|
111,
|
||
|
|
112,
|
||
|
|
113,
|
||
|
|
114,
|
||
|
|
115,
|
||
|
|
116,
|
||
|
|
117,
|
||
|
|
118,
|
||
|
|
119,
|
||
|
|
120,
|
||
|
|
121)
|
||
|
|
elif tid == 0x333333333:
|
||
|
|
return struct.pack(
|
||
|
|
'21Q',
|
||
|
|
21,
|
||
|
|
22,
|
||
|
|
23,
|
||
|
|
24,
|
||
|
|
25,
|
||
|
|
26,
|
||
|
|
27,
|
||
|
|
28,
|
||
|
|
29,
|
||
|
|
210,
|
||
|
|
211,
|
||
|
|
212,
|
||
|
|
213,
|
||
|
|
214,
|
||
|
|
215,
|
||
|
|
216,
|
||
|
|
217,
|
||
|
|
218,
|
||
|
|
219,
|
||
|
|
220,
|
||
|
|
221)
|
||
|
|
elif tid == 0x444444444:
|
||
|
|
return struct.pack(
|
||
|
|
'21Q',
|
||
|
|
31,
|
||
|
|
32,
|
||
|
|
33,
|
||
|
|
34,
|
||
|
|
35,
|
||
|
|
36,
|
||
|
|
37,
|
||
|
|
38,
|
||
|
|
39,
|
||
|
|
310,
|
||
|
|
311,
|
||
|
|
312,
|
||
|
|
313,
|
||
|
|
314,
|
||
|
|
315,
|
||
|
|
316,
|
||
|
|
317,
|
||
|
|
318,
|
||
|
|
319,
|
||
|
|
320,
|
||
|
|
321)
|
||
|
|
else:
|
||
|
|
return struct.pack(
|
||
|
|
'21Q',
|
||
|
|
41,
|
||
|
|
42,
|
||
|
|
43,
|
||
|
|
44,
|
||
|
|
45,
|
||
|
|
46,
|
||
|
|
47,
|
||
|
|
48,
|
||
|
|
49,
|
||
|
|
410,
|
||
|
|
411,
|
||
|
|
412,
|
||
|
|
413,
|
||
|
|
414,
|
||
|
|
415,
|
||
|
|
416,
|
||
|
|
417,
|
||
|
|
418,
|
||
|
|
419,
|
||
|
|
420,
|
||
|
|
421)
|
||
|
|
return None
|