-
Notifications
You must be signed in to change notification settings - Fork 4.6k
/
dumpwritermacho.cpp
288 lines (251 loc) · 9.7 KB
/
dumpwritermacho.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.
#include "createdump.h"
#include "specialthreadinfo.h"
extern int g_readProcessMemoryResult;
//
// Write the core dump file
//
bool
DumpWriter::WriteDump()
{
BuildSegmentLoadCommands();
BuildThreadLoadCommands();
uint64_t fileOffset = 0;
if (!WriteHeader(&fileOffset)) {
return false;
}
TRACE("Writing %zd thread commands to core file\n", m_threadLoadCommands.size());
// Write thread commands
for (const ThreadCommand& thread : m_threadLoadCommands)
{
if (!WriteData(&thread, thread.command.cmdsize)) {
return false;
}
}
TRACE("Writing %zd segment commands to core file\n", m_segmentLoadCommands.size());
// Align first segment's file offset to the next page (0x1000) byte boundary
uint64_t alignment = 0;
if (fileOffset & (PAGE_SIZE - 1))
{
alignment = fileOffset;
fileOffset = (fileOffset + (PAGE_SIZE - 1)) & PAGE_MASK;
alignment = fileOffset - alignment;
}
// Write segment commands
for (segment_command_64& segment : m_segmentLoadCommands)
{
segment.fileoff = fileOffset;
fileOffset += segment.vmsize;
assert(segment.vmsize == segment.filesize);
if (!WriteData(&segment, segment.cmdsize)) {
return false;
}
}
// Write any segment alignment required to the core file
if (alignment > 0)
{
if (alignment > sizeof(m_tempBuffer)) {
printf_error("Internal error: segment alignment %llu > sizeof(m_tempBuffer)\n", alignment);
return false;
}
memset(m_tempBuffer, 0, alignment);
if (!WriteData(m_tempBuffer, alignment)) {
return false;
}
}
// Write memory regions
return WriteSegments();
}
vm_prot_t
ConvertFlags(uint32_t flags)
{
vm_prot_t prot = 0;
if (flags & PF_R) {
prot |= VM_PROT_READ;
}
if (flags & PF_W) {
prot |= VM_PROT_WRITE;
}
if (flags & PF_X) {
prot |= VM_PROT_EXECUTE;
}
return prot;
}
void
DumpWriter::BuildSegmentLoadCommands()
{
for (const MemoryRegion& memoryRegion : m_crashInfo.MemoryRegions())
{
uint64_t size = memoryRegion.Size();
uint32_t prot = ConvertFlags(memoryRegion.Permissions());
segment_command_64 segment = {
LC_SEGMENT_64, // uint32_t cmd;
sizeof(segment_command_64), // uint32_t cmdsize;
{0}, // char segname[16];
memoryRegion.StartAddress(), // uint64_t vmaddr;
size, // uint64_t vmsize;
0, // uint64_t fileoff;
size, // uint64_t filesize;
prot, // uint32_t maxprot;
prot, // uint32_t initprot;
0, // uint32_t nsects;
0 // uint32_t flags;
};
m_segmentLoadCommands.push_back(segment);
}
// Add special memory region containing the process and thread info
uint64_t size = sizeof(SpecialThreadInfoHeader) + (m_crashInfo.Threads().size() * sizeof(SpecialThreadInfoEntry));
segment_command_64 segment = {
LC_SEGMENT_64, // uint32_t cmd;
sizeof(segment_command_64), // uint32_t cmdsize;
{0}, // char segname[16];
SpecialThreadInfoAddress, // uint64_t vmaddr;
size, // uint64_t vmsize;
0, // uint64_t fileoff;
size, // uint64_t filesize;
VM_PROT_READ, // uint32_t maxprot;
VM_PROT_READ, // uint32_t initprot;
0, // uint32_t nsects;
0 // uint32_t flags;
};
m_segmentLoadCommands.push_back(segment);
}
void
DumpWriter::BuildThreadLoadCommands()
{
for (const ThreadInfo* thread : m_crashInfo.Threads())
{
ThreadCommand threadCommand = {
{ LC_THREAD, sizeof(ThreadCommand) },
};
#if defined(__x86_64__)
threadCommand.gpflavor = x86_THREAD_STATE64;
threadCommand.gpcount = x86_THREAD_STATE64_COUNT;
threadCommand.fpflavor = x86_FLOAT_STATE64;
threadCommand.fpcount = x86_FLOAT_STATE64_COUNT;
assert(x86_THREAD_STATE64_COUNT == sizeof(x86_thread_state64_t) / sizeof(uint32_t));
assert(x86_FLOAT_STATE64_COUNT == sizeof(x86_float_state64_t) / sizeof(uint32_t));
memcpy(&threadCommand.gpregisters, thread->GPRegisters(), sizeof(x86_thread_state64_t));
memcpy(&threadCommand.fpregisters, thread->FPRegisters(), sizeof(x86_float_state64_t));
#elif defined(__aarch64__)
threadCommand.gpflavor = ARM_THREAD_STATE64;
threadCommand.gpcount = ARM_THREAD_STATE64_COUNT;
threadCommand.fpflavor = ARM_NEON_STATE64;
threadCommand.fpcount = ARM_NEON_STATE64_COUNT;
assert(ARM_THREAD_STATE64_COUNT == sizeof(arm_thread_state64_t) / sizeof(uint32_t));
assert(ARM_NEON_STATE64_COUNT == sizeof(arm_neon_state64_t) / sizeof(uint32_t));
memcpy(&threadCommand.gpregisters, thread->GPRegisters(), sizeof(arm_thread_state64_t));
memcpy(&threadCommand.fpregisters, thread->FPRegisters(), sizeof(arm_neon_state64_t));
#endif
m_threadLoadCommands.push_back(threadCommand);
}
}
bool
DumpWriter::WriteHeader(uint64_t* pFileOffset)
{
mach_header_64 header;
memset(&header, 0, sizeof(mach_header_64));
header.magic = MH_MAGIC_64;
#if defined(__x86_64__)
header.cputype = CPU_TYPE_X86_64;
header.cpusubtype = CPU_SUBTYPE_I386_ALL | CPU_SUBTYPE_LITTLE_ENDIAN;
#elif defined(__aarch64__)
header.cputype = CPU_TYPE_ARM64;
header.cpusubtype = CPU_SUBTYPE_ARM64_ALL | CPU_SUBTYPE_LITTLE_ENDIAN;
#else
#error Unexpected architecture
#endif
header.filetype = MH_CORE;
for (const ThreadCommand& thread : m_threadLoadCommands)
{
header.ncmds++;
header.sizeofcmds += thread.command.cmdsize;
}
for (const segment_command_64& segment : m_segmentLoadCommands)
{
header.ncmds++;
header.sizeofcmds += segment.cmdsize;
}
*pFileOffset = sizeof(mach_header_64) + header.sizeofcmds;
TRACE("Macho header: magic %08x cputype %08x cpusubtype %08x filetype %08x ncmds %08x sizeofcmds %08x flags %08x reserved %08x\n",
header.magic,
header.cputype,
header.cpusubtype,
header.filetype,
header.ncmds,
header.sizeofcmds,
header.flags,
header.reserved);
// Write header
return WriteData(&header, sizeof(mach_header_64));
}
bool
DumpWriter::WriteSegments()
{
TRACE("Writing %" PRIu64 " memory regions to core file\n", m_segmentLoadCommands.size());
// Read from target process and write memory regions to core
uint64_t total = 0;
for (const segment_command_64& segment : m_segmentLoadCommands)
{
uint64_t address = segment.vmaddr;
size_t size = segment.vmsize;
total += size;
TRACE("%" PRIA PRIx64 " - %" PRIA PRIx64 " (%06" PRIx64 ") %" PRIA PRIx64 " %c%c%c %02x\n",
segment.vmaddr,
segment.vmaddr + segment.vmsize,
segment.vmsize / PAGE_SIZE,
segment.fileoff,
(segment.initprot & VM_PROT_READ) ? 'r' : '-',
(segment.initprot & VM_PROT_WRITE) ? 'w' : '-',
(segment.initprot & VM_PROT_EXECUTE) ? 'x' : '-',
segment.initprot);
if (address == SpecialThreadInfoAddress)
{
// Write the header
SpecialThreadInfoHeader header = {
{SPECIAL_THREADINFO_SIGNATURE},
m_crashInfo.Pid(),
m_crashInfo.Threads().size()
};
if (!WriteData(&header, sizeof(header))) {
return false;
}
// Write the tid and stack pointer for each thread
for (const ThreadInfo* thread : m_crashInfo.Threads())
{
SpecialThreadInfoEntry entry = {
thread->Tid(),
thread->GetStackPointer()
};
if (!WriteData(&entry, sizeof(entry))) {
return false;
}
}
}
else
{
while (size > 0)
{
size_t bytesToRead = std::min(size, sizeof(m_tempBuffer));
size_t read = 0;
if (!m_crashInfo.ReadProcessMemory((void*)address, m_tempBuffer, bytesToRead, &read)) {
printf_error("Error reading memory at %" PRIA PRIx64 " size %08zx FAILED %s (%x)\n", address, bytesToRead, mach_error_string(g_readProcessMemoryResult), g_readProcessMemoryResult);
return false;
}
// This can happen if the target process dies before createdump is finished
if (read == 0) {
printf_error("Error reading memory at %" PRIA PRIx64 " size %08zx returned 0 bytes read: %s (%x)\n", address, bytesToRead, mach_error_string(g_readProcessMemoryResult), g_readProcessMemoryResult);
return false;
}
if (!WriteData(m_tempBuffer, read)) {
return false;
}
address += read;
size -= read;
}
}
}
printf_status("Written %" PRId64 " bytes (%" PRId64 " pages) to core file\n", total, total / PAGE_SIZE);
return true;
}