1from xnu import * 2from utils import * 3from process import * 4from pmap import * 5import struct 6 7def GetBinaryNameForPC(pc_val, user_lib_info = None): 8 """ find the binary in user_lib_info that the passed pc_val falls in range of. 9 params: 10 pc_val : int - integer form of the pc address 11 user_lib_info: [] of [] which hold start, end, binary name 12 returns: 13 str - Name of binary or "unknown" if not found. 14 """ 15 retval = "unknown" 16 if not user_lib_info: 17 return retval 18 matches = [] 19 for info in user_lib_info: 20 if pc_val >= info[0] and pc_val <= info[1]: 21 matches.append((pc_val - info[0], info[2])) 22 matches.sort() 23 if matches: 24 retval = matches[0][1] 25 return retval 26 27def ShowX86UserStack(thread, user_lib_info = None): 28 """ Display user space stack frame and pc addresses. 29 params: 30 thread: obj referencing thread value 31 returns: 32 Nothing 33 """ 34 iss = Cast(thread.machine.iss, 'x86_saved_state_t *') 35 abi = int(iss.flavor) 36 user_ip = 0 37 user_frame = 0 38 user_abi_ret_offset = 0 39 if abi == 0xf: 40 debuglog("User process is 64 bit") 41 user_ip = iss.uss.ss_64.isf.rip 42 user_frame = iss.uss.ss_64.rbp 43 user_abi_ret_offset = 8 44 user_abi_type = "uint64_t" 45 else: 46 debuglog("user process is 32 bit") 47 user_ip = iss.uss.ss_32.eip 48 user_frame = iss.uss.ss_32.ebp 49 user_abi_ret_offset = 4 50 user_abi_type = "uint32_t" 51 52 if user_ip == 0: 53 print("This activation does not appear to have a valid user context.") 54 return False 55 56 cur_ip = user_ip 57 cur_frame = user_frame 58 debuglog("ip= 0x%x , fr = 0x%x " % (cur_ip, cur_frame)) 59 60 frameformat = "{0:d} FP: 0x{1:x} PC: 0x{2:x}" 61 if user_lib_info is not None: 62 frameformat = "{0:d} {3: <30s} 0x{2:x}" 63 print(frameformat.format(0, cur_frame, cur_ip, GetBinaryNameForPC(cur_ip, user_lib_info))) 64 65 print(kern.Symbolicate(cur_ip)) 66 67 frameno = 0 68 while True: 69 frameno = frameno + 1 70 frame = GetUserDataAsString(thread.t_tro.tro_task, unsigned(cur_frame), user_abi_ret_offset*2) 71 cur_ip = _ExtractDataFromString(frame, user_abi_ret_offset, user_abi_type) 72 cur_frame = _ExtractDataFromString(frame, 0, user_abi_type) 73 if not cur_frame or cur_frame == 0x0000000800000008: 74 break 75 print(frameformat.format(frameno, cur_frame, cur_ip, GetBinaryNameForPC(cur_ip, user_lib_info))) 76 print(kern.Symbolicate(cur_ip)) 77 return 78 79def _PrintARMUserStack(task, cur_pc, cur_fp, framesize, frametype, frameformat, user_lib_info=None): 80 cur_pc = kern.StripUserPAC(cur_pc) 81 if cur_pc == 0: 82 "No valid user context for this activation." 83 return 84 frameno = 0 85 print(frameformat.format(frameno, cur_fp, cur_pc, GetBinaryNameForPC(cur_pc, user_lib_info))) 86 while True: 87 frameno = frameno + 1 88 frame = GetUserDataAsString(task, cur_fp, framesize) 89 cur_fp = _ExtractDataFromString(frame, 0, frametype) 90 cur_pc = _ExtractDataFromString(frame, (framesize // 2), frametype) 91 cur_pc = kern.StripUserPAC(cur_pc) 92 if not cur_fp: 93 break 94 print(frameformat.format(frameno, cur_fp, cur_pc, GetBinaryNameForPC(cur_pc, user_lib_info))) 95 96def ShowARM64UserStack(thread, user_lib_info = None): 97 SAVED_STATE_FLAVOR_ARM=20 98 SAVED_STATE_FLAVOR_ARM64=21 99 upcb_addr = kern.StripKernelPAC(thread.machine.upcb) 100 upcb = kern.GetValueFromAddress(upcb_addr, 'arm_saved_state_t *') 101 flavor = upcb.ash.flavor 102 frameformat = "{0:>2d} FP: 0x{1:x} PC: 0x{2:x}" 103 if flavor == SAVED_STATE_FLAVOR_ARM64: 104 cur_pc = unsigned(upcb.uss.ss_64.pc) 105 cur_fp = unsigned(upcb.uss.ss_64.fp) 106 if user_lib_info is not None: 107 frameformat = "{0:>2d} {3: <30s} 0x{2:x}" 108 framesize = 16 109 frametype = "uint64_t" 110 elif flavor == SAVED_STATE_FLAVOR_ARM: 111 cur_pc = unsigned(upcb.uss.ss_32.pc) 112 cur_fp = unsigned(upcb.uss.ss_32.r[7]) 113 if user_lib_info is not None: 114 frameformat = "{0:>2d}: {3: <30s} 0x{2:x}" 115 framesize = 8 116 frametype = "uint32_t" 117 else: 118 raise RuntimeError("Thread {0} has an invalid flavor {1}".format(unsigned(thread), flavor)) 119 120 _PrintARMUserStack(thread.t_tro.tro_task, cur_pc, cur_fp, framesize, frametype, frameformat, user_lib_info=user_lib_info) 121 122 123@lldb_command('showthreaduserstack') 124def ShowThreadUserStack(cmd_args=None): 125 """ Show user stack for a given thread. 126 Syntax: (lldb) showthreaduserstack <thread_ptr> 127 """ 128 if not cmd_args: 129 raise ArgumentError("Insufficient arguments") 130 131 thread = kern.GetValueFromAddress(ArgumentStringToInt(cmd_args[0]), 'thread *') 132 if kern.arch == "x86_64": 133 ShowX86UserStack(thread) 134 elif kern.arch.startswith("arm64"): 135 ShowARM64UserStack(thread) 136 return True 137 138@lldb_command('printuserdata','XO:') 139def PrintUserspaceData(cmd_args=None, cmd_options={}): 140 """ Read userspace data for given task and print based on format provided. 141 Syntax: (lldb) printuserdata <task_t> <uspace_address> <format_specifier> 142 params: 143 <task_t> : pointer to task 144 <uspace_address> : address to user space memory 145 <format_specifier> : String representation for processing the data and printing it. 146 e.g Q -> unsigned long long, q -> long long, I -> unsigned int, i -> int 147 10i -> 10 ints, 20s -> 20 character string, s -> null terminated string 148 See: https://docs.python.org/2/library/struct.html#format-characters 149 options: 150 -X : print all values in hex. 151 -O <file path>: Save data to file 152 """ 153 154 if not cmd_args or len(cmd_args) < 3: 155 raise ArgumentError("Insufficient arguments") 156 task = kern.GetValueFromAddress(cmd_args[0], 'task *') 157 uspace_addr = ArgumentStringToInt(cmd_args[1]) 158 format_specifier_str = cmd_args[2] 159 user_data_len = 0 160 if format_specifier_str == "s": 161 print("0x%x: " % uspace_addr + GetUserspaceString(task, uspace_addr)) 162 return True 163 164 try: 165 user_data_len = struct.calcsize(format_specifier_str) 166 except Exception as e: 167 raise ArgumentError("Invalid format specifier provided.") 168 169 user_data_string = GetUserDataAsString(task, uspace_addr, user_data_len) 170 if not user_data_string: 171 print("Could not read any data from userspace address.") 172 return False 173 if "-O" in cmd_options: 174 fh = open(cmd_options["-O"],"w") 175 fh.write(user_data_string) 176 fh.close() 177 print("Written %d bytes to %s." % (user_data_len, cmd_options['-O'])) 178 return True 179 upacked_data = struct.unpack(format_specifier_str, user_data_string) 180 element_size = user_data_len // len(upacked_data) 181 for i in range(len(upacked_data)): 182 if "-X" in cmd_options: 183 print("0x%x: " % (uspace_addr + i*element_size) + hex(upacked_data[i])) 184 else: 185 print("0x%x: " % (uspace_addr + i*element_size) + str(upacked_data[i])) 186 187 return True 188 189@lldb_command('showtaskuserargs') 190def ShowTaskUserArgs(cmd_args=None, cmd_options={}): 191 """ Read the process argv, env, and apple strings from the user stack 192 Syntax: (lldb) showtaskuserargs <task_t> 193 params: 194 <task_t> : pointer to task 195 """ 196 if not cmd_args or len(cmd_args) != 1: 197 raise ArgumentError("Insufficient arguments") 198 199 task = kern.GetValueFromAddress(cmd_args[0], 'task *') 200 if (proc := GetProcFromTask(task)) is None: 201 print("Task has no associated BSD process.") 202 return False 203 ptrsize = 8 if int(task.t_flags) & 0x1 else 4 204 205 format_string = "Q" if ptrsize == 8 else "I" 206 207 string_area_size = proc.p_argslen 208 string_area_addr = proc.user_stack - string_area_size 209 210 string_area = GetUserDataAsString(task, string_area_addr, string_area_size) 211 if not string_area: 212 print("Could not read any data from userspace address.") 213 return False 214 215 i = 0 216 pos = string_area_addr - ptrsize 217 218 for name in ["apple", "env", "argv"] : 219 while True: 220 if name == "argv" : 221 if i == proc.p_argc: 222 break 223 i += 1 224 225 pos -= ptrsize 226 227 user_data_string = GetUserDataAsString(task, pos, ptrsize) 228 ptr = struct.unpack(format_string, user_data_string)[0] 229 230 if ptr == 0: 231 break 232 233 if string_area_addr <= ptr and ptr < string_area_addr+string_area_size : 234 string_offset = ptr - string_area_addr 235 string = string_area[string_offset:].decode() 236 else: 237 string = GetUserspaceString(task, ptr) 238 239 print(name + "[]: " + string + '\n') 240 241 return True 242 243def ShowTaskUserStacks(task): 244 #print GetTaskSummary.header + " " + GetProcSummary.header 245 pval = GetProcFromTask(task) 246 #print GetTaskSummary(task) + " " + GetProcSummary(pval) + "\n \n" 247 crash_report_format_string = """\ 248Process: {pname:s} [{pid:d}] 249Path: {path: <50s} 250Identifier: {pname: <30s} 251Version: ??? (???) 252Code Type: {parch: <20s} 253Parent Process: {ppname:s} [{ppid:d}] 254 255Date/Time: {timest:s}.000 -0800 256OS Version: {osversion: <20s} 257Report Version: 8 258 259Exception Type: n/a 260Exception Codes: n/a 261Crashed Thread: 0 262 263Application Specific Information: 264Synthetic crash log generated from Kernel userstacks 265 266""" 267 user_lib_rex = re.compile("([0-9a-fx]+)\s-\s([0-9a-fx]+)\s+(.*?)\s", re.IGNORECASE|re.MULTILINE) 268 from datetime import datetime 269 if pval is not None: 270 ts = datetime.fromtimestamp(int(pval.p_start.tv_sec)) 271 date_string = ts.strftime('%Y-%m-%d %H:%M:%S') 272 else: 273 date_string = "none" 274 is_64 = True 275 if pval and (pval.p_flag & 0x4) == 0 : 276 is_64 = False 277 278 parch_s = "" 279 if kern.arch == "x86_64" or kern.arch == "i386": 280 osversion = "Mac OS X 10.8" 281 parch_s = "I386 (32 bit)" 282 if is_64: 283 parch_s = "X86-64 (Native)" 284 else: 285 parch_s = kern.arch 286 osversion = "iOS" 287 osversion += " ({:s})".format(kern.globals.osversion) 288 if pval: 289 pid = GetProcPID(pval) 290 pname = GetProcName(pval) 291 path = GetProcName(pval) 292 ppid = pval.p_ppid 293 else: 294 pid = 0 295 pname = "unknown" 296 path = "unknown" 297 ppid = 0 298 299 print(crash_report_format_string.format(pid = pid, 300 pname = pname, 301 path = path, 302 ppid = ppid, 303 ppname = GetProcNameForPid(ppid), 304 timest = date_string, 305 parch = parch_s, 306 osversion = osversion 307 )) 308 print("Binary Images:") 309 ShowTaskUserLibraries([hex(task)]) 310 usertask_lib_info = [] # will host [startaddr, endaddr, lib_name] entries 311 for entry in ShowTaskUserLibraries.found_images: 312 #print "processing line %s" % line 313 arr = user_lib_rex.findall(entry[3]) 314 #print "%r" % arr 315 if len(arr) == 0 : 316 continue 317 usertask_lib_info.append([int(arr[0][0],16), int(arr[0][1],16), str(arr[0][2]).strip()]) 318 319 printthread_user_stack_ptr = ShowX86UserStack 320 if kern.arch.startswith("arm64"): 321 printthread_user_stack_ptr = ShowARM64UserStack 322 323 counter = 0 324 for thval in IterateQueue(task.threads, 'thread *', 'task_threads'): 325 print("\nThread {0:d} name:0x{1:x}\nThread {0:d}:".format(counter, thval)) 326 counter += 1 327 try: 328 printthread_user_stack_ptr(thval, usertask_lib_info) 329 except Exception as exc_err: 330 print("Failed to show user stack for thread 0x{0:x}".format(thval)) 331 if config['debug']: 332 raise exc_err 333 else: 334 print("Enable debugging ('(lldb) xnudebug debug') to see detailed trace.") 335 return 336 337@lldb_command('showtaskuserstacks', "P:F:") 338def ShowTaskUserStacksCmdHelper(cmd_args=None, cmd_options={}): 339 """ Print out the user stack for each thread in a task, followed by the user libraries. 340 Syntax: (lldb) showtaskuserstacks <task_t> 341 or: (lldb) showtaskuserstacks -P <pid> 342 or: (lldb) showtaskuserstacks -F <task_name> 343 The format is compatible with CrashTracer. You can also use the speedtracer plugin as follows 344 (lldb) showtaskuserstacks <task_t> -p speedtracer 345 346 Note: the address ranges are approximations. Also the list may not be completely accurate. This command expects memory read failures 347 and hence will skip a library if unable to read information. Please use your good judgement and not take the output as accurate 348 """ 349 task_list = [] 350 if "-F" in cmd_options: 351 task_list = FindTasksByName(cmd_options["-F"]) 352 elif "-P" in cmd_options: 353 pidval = ArgumentStringToInt(cmd_options["-P"]) 354 for t in kern.tasks: 355 pval = GetProcFromTask(t) 356 if pval is not None and GetProcPID(pval) == pidval: 357 task_list.append(t) 358 break 359 elif cmd_args: 360 t = kern.GetValueFromAddress(cmd_args[0], 'task *') 361 task_list.append(t) 362 else: 363 raise ArgumentError("Insufficient arguments") 364 365 for task in task_list: 366 ShowTaskUserStacks(task) 367 368def GetUserDataAsString(task, addr, size): 369 """ Get data from task's address space as a string of bytes 370 params: 371 task: task object from which to extract information 372 addr: int - start address to get data from. 373 size: int - no of bytes to read. 374 returns: 375 data - a stream of bytes. Empty bytes() if read fails. 376 """ 377 err = lldb.SBError() 378 if GetConnectionProtocol() == "kdp": 379 kdp_pmap_addr = unsigned(addressof(kern.globals.kdp_pmap)) 380 if not WriteInt64ToMemoryAddress(unsigned(task.map.pmap), kdp_pmap_addr): 381 debuglog("Failed to write in kdp_pmap from GetUserDataAsString.") 382 return b"" 383 content = LazyTarget.GetProcess().ReadMemory(addr, size, err) 384 if not err.Success(): 385 debuglog("Failed to read process memory. Error: " + err.description) 386 return b"" 387 if not WriteInt64ToMemoryAddress(0, kdp_pmap_addr): 388 debuglog("Failed to reset in kdp_pmap from GetUserDataAsString.") 389 return b"" 390 elif (kern.arch == 'x86_64' or kern.arch.startswith('arm')) and (int(size) < (2 * kern.globals.page_size)): 391 # Without the benefit of a KDP stub on the target, try to 392 # find the user task's physical mapping and memcpy the data. 393 # If it straddles a page boundary, copy in two passes 394 range1_addr = int(addr) 395 range1_size = int(size) 396 if kern.StraddlesPage(range1_addr, range1_size): 397 range2_addr = int(kern.TruncPage(range1_addr + range1_size)) 398 range2_size = int(range1_addr + range1_size - range2_addr) 399 range1_size = int(range2_addr - range1_addr) 400 else: 401 range2_addr = 0 402 range2_size = 0 403 range2_in_kva = 0 404 405 paddr_range1 = PmapWalk(task.map.pmap, range1_addr, vSILENT) 406 if not paddr_range1: 407 debuglog("Not mapped task 0x{:x} address 0x{:x}".format(task, addr)) 408 return b"" 409 410 range1_in_kva = kern.PhysToKernelVirt(paddr_range1) 411 content = LazyTarget.GetProcess().ReadMemory(range1_in_kva, range1_size, err) 412 if not err.Success(): 413 raise RuntimeError("Failed to read process memory. Error: " + err.description) 414 415 if range2_addr: 416 paddr_range2 = PmapWalk(task.map.pmap, range2_addr, vSILENT) 417 if not paddr_range2: 418 debuglog("Not mapped task 0x{:x} address 0x{:x}".format(task, addr)) 419 return b"" 420 range2_in_kva = kern.PhysToKernelVirt(paddr_range2) 421 content += LazyTarget.GetProcess().ReadMemory(range2_in_kva, range2_size, err) 422 if not err.Success(): 423 raise RuntimeError("Failed to read process memory. Error: " + err.description) 424 else: 425 raise NotImplementedError("GetUserDataAsString does not support this configuration") 426 427 return content 428 429def _ExtractDataFromString(strdata, offset, data_type, length=0): 430 """ Extract specific data from string buffer 431 params: 432 strdata: str - string data give from GetUserDataAsString 433 offset: int - 0 based offset into the data. 434 data_type: str - defines what type to be read as. Supported values are: 435 'uint64_t', 'uint32_t', 'string' 436 length: int - used when data_type=='string' 437 returns 438 None - if extraction failed. 439 obj - based on what is requested in data_type 440 """ 441 unpack_str = "s" 442 if data_type == 'uint64_t': 443 length = 8 444 unpack_str = "Q" 445 elif data_type == "uint32_t": 446 length = 4 447 unpack_str = "I" 448 else: 449 unpack_str= "%ds" % length 450 451 data_len = len(strdata) 452 if offset > data_len or (offset + length) > data_len or offset < 0: 453 debuglog("Invalid arguments to _ExtractDataFromString.") 454 return 0 455 456 data = struct.unpack(unpack_str, strdata[offset:(offset + length)])[0] 457 if data_type == 'string': 458 return data.decode() 459 460 return data 461 462def GetUserspaceString(task, string_address): 463 """ Maps 32 bytes at a time and packs as string 464 params: 465 task: obj - referencing task to read data from 466 string_address: int - address where the image path is stored 467 returns: 468 str - string path of the file. "" if failed to read. 469 """ 470 retval = [] 471 while string_address > 0: 472 str_data = GetUserDataAsString(task, string_address, 32) 473 if not str_data: 474 break 475 str_data = str_data.split(b"\x00", 1)[0] 476 retval.append(str_data) 477 if len(str_data) < 32: 478 break # short read or found NUL byte 479 string_address += 32 480 return b"".join(retval).decode() 481 482def GetImageInfo(task, mh_image_address, mh_path_address, approx_end_address=None): 483 """ Print user library informaiton. 484 params: 485 task : obj referencing the task for which Image info printed 486 mh_image_address : int - address which has image info 487 mh_path_address : int - address which holds path name string 488 approx_end_address: int - address which lldbmacros think is end address. 489 returns: 490 str - string representing image info. "" if failure to read data. 491 """ 492 if approx_end_address: 493 image_end_load_address = int(approx_end_address) -1 494 else: 495 image_end_load_address = int(mh_image_address) + 0xffffffff 496 497 print_format = "0x{0:x} - 0x{1:x} {2: <50s} (??? - ???) <{3: <36s}> {4: <50s}" 498 # 32 bytes enough for mach_header/mach_header_64 499 mh_data = GetUserDataAsString(task, mh_image_address, 32) 500 if len(mh_data) == 0: 501 debuglog("unable to get userdata for task 0x{:x} img_addr 0x{:x} path_address 0x{:x}".format( 502 task, mh_image_address, mh_path_address)) 503 return "" 504 mh_magic = _ExtractDataFromString(mh_data, (4 * 0), "uint32_t") 505 mh_cputype = _ExtractDataFromString(mh_data,(4 * 1), "uint32_t") 506 mh_cpusubtype = _ExtractDataFromString(mh_data,(4 * 2), "uint32_t") 507 mh_filetype = _ExtractDataFromString(mh_data,(4 * 3), "uint32_t") 508 mh_ncmds = _ExtractDataFromString(mh_data,(4 * 4), "uint32_t") 509 mh_sizeofcmds = _ExtractDataFromString(mh_data,(4 * 5), "uint32_t") 510 mh_flags = _ExtractDataFromString(mh_data,(4 * 6), "uint32_t") 511 512 if mh_magic == 0xfeedfacf: 513 mh_64 = True 514 lc_address = mh_image_address + 32 515 else: 516 mh_64 = False 517 lc_address = mh_image_address + 28 518 519 lc_idx = 0 520 uuid_data = 0 521 found_uuid_data = False 522 retval = None 523 while lc_idx < mh_ncmds: 524 # 24 bytes is the size of uuid_command 525 lcmd_data = GetUserDataAsString(task, lc_address, 24) 526 lc_cmd = _ExtractDataFromString(lcmd_data, 4 * 0, "uint32_t") 527 lc_cmd_size = _ExtractDataFromString(lcmd_data, 4 * 1, "uint32_t") 528 lc_data = _ExtractDataFromString(lcmd_data, 4*2, "string", 16) 529 530 uuid_out_string = "" 531 path_out_string = "" 532 533 if lc_cmd == 0x1b: 534 # need to print the uuid now. 535 uuid_data = bytes(lc_data) 536 found_uuid_data = True 537 uuid_out_string = "{a[0]:02X}{a[1]:02X}{a[2]:02X}{a[3]:02X}-{a[4]:02X}{a[5]:02X}-{a[6]:02X}{a[7]:02X}-{a[8]:02X}{a[9]:02X}-{a[10]:02X}{a[11]:02X}{a[12]:02X}{a[13]:02X}{a[14]:02X}{a[15]:02X}".format(a=uuid_data) 538 #also print image path 539 path_out_string = GetUserspaceString(task, mh_path_address) 540 path_base_name = path_out_string.split("/")[-1] 541 retval = print_format.format(mh_image_address, image_end_load_address, path_base_name, uuid_out_string, path_out_string) 542 elif lc_cmd == 0xe: 543 ShowTaskUserLibraries.exec_load_path = lc_address + _ExtractDataFromString(lcmd_data, 4*2, "uint32_t") 544 debuglog("Found load command to be 0xe for address %s" % hex(ShowTaskUserLibraries.exec_load_path)) 545 lc_address = lc_address + lc_cmd_size 546 lc_idx += 1 547 548 if not found_uuid_data: 549 path_out_string = GetUserspaceString(task, mh_path_address) 550 path_base_name = path_out_string.split("/")[-1] 551 uuid_out_string = "" 552 553 retval = print_format.format(mh_image_address, image_end_load_address, path_base_name, uuid_out_string, path_out_string) 554 return retval 555 556@static_var("found_images", []) # holds entries of format (startaddr, endaddr, image_path_addr, infostring) 557@static_var("exec_load_path", 0) 558@lldb_command("showtaskuserlibraries") 559def ShowTaskUserLibraries(cmd_args=None): 560 """ Show binary images known by dyld in target task 561 For a given user task, inspect the dyld shared library state and print information about all Mach-O images. 562 Syntax: (lldb)showtaskuserlibraries <task_t> 563 Note: the address ranges are approximations. Also the list may not be completely accurate. This command expects memory read failures 564 and hence will skip a library if unable to read information. Please use your good judgement and not take the output as accurate 565 """ 566 if not cmd_args: 567 raise ArgumentError("Insufficient arguments") 568 569 #reset the found_images array 570 ShowTaskUserLibraries.found_images = [] 571 572 task = kern.GetValueFromAddress(cmd_args[0], 'task_t') 573 is_task_64 = int(task.t_flags) & 0x1 574 dyld_all_image_infos_address = unsigned(task.all_image_info_addr) 575 debuglog("dyld_all_image_infos_address = %s" % hex(dyld_all_image_infos_address)) 576 577 cur_data_offset = 0 578 if dyld_all_image_infos_address == 0: 579 print("No dyld shared library information available for task") 580 return False 581 582 debuglog("Extracting version information.") 583 vers_info_data = GetUserDataAsString(task, dyld_all_image_infos_address, 112) 584 version = _ExtractDataFromString(vers_info_data, cur_data_offset, "uint32_t") 585 cur_data_offset += 4 586 if version > 14: 587 print("Unknown dyld all_image_infos version number %d" % version) 588 image_info_count = _ExtractDataFromString(vers_info_data, cur_data_offset, "uint32_t") 589 debuglog("version = %d count = %d is_task_64 = %s" % (version, image_info_count, repr(is_task_64))) 590 591 ShowTaskUserLibraries.exec_load_path = 0 592 if is_task_64: 593 image_info_size = 24 594 image_info_array_address = _ExtractDataFromString(vers_info_data, 8, "uint64_t") 595 dyld_load_address = _ExtractDataFromString(vers_info_data, 8*4, "uint64_t") 596 dyld_all_image_infos_address_from_struct = _ExtractDataFromString(vers_info_data, 8*13, "uint64_t") 597 else: 598 image_info_size = 12 599 image_info_array_address = _ExtractDataFromString(vers_info_data, 4*2, "uint32_t") 600 dyld_load_address = _ExtractDataFromString(vers_info_data, 4*5, "uint32_t") 601 dyld_all_image_infos_address_from_struct = _ExtractDataFromString(vers_info_data, 4*14, "uint32_t") 602 # Account for ASLR slide before dyld can fix the structure 603 dyld_load_address = dyld_load_address + (dyld_all_image_infos_address - dyld_all_image_infos_address_from_struct) 604 605 i = 0 606 image_info_list = [] 607 while i < image_info_count: 608 image_info_address = image_info_array_address + i * image_info_size 609 debuglog("i = %d, image_info_address = %s, image_info_size = %d" % (i, hex(image_info_address), image_info_size)) 610 n_im_info_addr = None 611 img_data = "" 612 try: 613 img_data = GetUserDataAsString(task, image_info_address, image_info_size) 614 except Exception as e: 615 debuglog("Failed to read user data for task 0x{:x} addr 0x{:x}, exception {:s}".format(task, image_info_address, str(e))) 616 pass 617 618 if is_task_64: 619 image_info_addr = _ExtractDataFromString(img_data, 0, "uint64_t") 620 image_info_path = _ExtractDataFromString(img_data, 8, "uint64_t") 621 else: 622 image_info_addr = _ExtractDataFromString(img_data, 0, "uint32_t") 623 image_info_path = _ExtractDataFromString(img_data, 4, "uint32_t") 624 625 if image_info_addr : 626 debuglog("Found image: image_info_addr = %s, image_info_path= %s" % (hex(image_info_addr), hex(image_info_path))) 627 image_info_list.append((image_info_addr, image_info_path)) 628 i += 1 629 630 image_info_list.sort() 631 num_images_found = len(image_info_list) 632 633 for ii in range(num_images_found): 634 n_im_info_addr = dyld_load_address 635 if ii + 1 < num_images_found: 636 n_im_info_addr = image_info_list[ii+1][0] 637 638 image_info_addr = image_info_list[ii][0] 639 image_info_path = image_info_list[ii][1] 640 try: 641 image_print_s = GetImageInfo(task, image_info_addr, image_info_path, approx_end_address=n_im_info_addr) 642 if len(image_print_s) > 0: 643 print(image_print_s) 644 ShowTaskUserLibraries.found_images.append((image_info_addr, n_im_info_addr, image_info_path, image_print_s)) 645 else: 646 debuglog("Failed to print image info for task 0x{:x} image_info 0x{:x}".format(task, image_info_addr)) 647 except Exception as e: 648 if config['debug']: 649 raise e 650 651 # load_path might get set when the main executable is processed. 652 if ShowTaskUserLibraries.exec_load_path != 0: 653 debuglog("main executable load_path is set.") 654 image_print_s = GetImageInfo(task, dyld_load_address, ShowTaskUserLibraries.exec_load_path) 655 if len(image_print_s) > 0: 656 print(image_print_s) 657 ShowTaskUserLibraries.found_images.append((dyld_load_address, dyld_load_address + 0xffffffff, 658 ShowTaskUserLibraries.exec_load_path, image_print_s)) 659 else: 660 debuglog("Failed to print image for main executable for task 0x{:x} dyld_load_addr 0x{:x}".format(task, dyld_load_address)) 661 else: 662 debuglog("Falling back to vm entry method for finding executable load address") 663 print("# NOTE: Failed to find executable using all_image_infos. Using fuzzy match to find best possible load address for executable.") 664 ShowTaskLoadInfo([cmd_args[0]]) 665 return 666 667@lldb_command("showtaskuserdyldinfo") 668def ShowTaskUserDyldInfo(cmd_args=None): 669 """ Inspect the dyld global info for the given user task & print out all fields including error messages 670 Syntax: (lldb)showtaskuserdyldinfo <task_t> 671 """ 672 if cmd_args is None or len(cmd_args) < 1: 673 print("No arguments passed") 674 print(ShowTaskUserDyldInfo.__doc__.strip()) 675 return 676 677 out_str = "" 678 task = kern.GetValueFromAddress(cmd_args[0], 'task_t') 679 is_task_64 = int(task.t_flags) & 0x1 680 dyld_all_image_infos_address = unsigned(task.all_image_info_addr) 681 if dyld_all_image_infos_address == 0: 682 print("No dyld shared library information available for task") 683 return False 684 vers_info_data = GetUserDataAsString(task, dyld_all_image_infos_address, 112) 685 dyld_all_image_infos_version = _ExtractDataFromString(vers_info_data, 0, "uint32_t") 686 if dyld_all_image_infos_version > 14: 687 out_str += "Unknown dyld all_image_infos version number %d" % dyld_all_image_infos_version 688 689 # Find fields by byte offset. We assume at least version 9 is supported 690 if is_task_64: 691 dyld_all_image_infos_infoArrayCount = _ExtractDataFromString(vers_info_data, 4, "uint32_t") 692 dyld_all_image_infos_infoArray = _ExtractDataFromString(vers_info_data, 8, "uint64_t") 693 dyld_all_image_infos_notification = _ExtractDataFromString(vers_info_data, 16, "uint64_t") 694 dyld_all_image_infos_processDetachedFromSharedRegion = _ExtractDataFromString(vers_info_data, 24, "string") 695 dyld_all_image_infos_libSystemInitialized = _ExtractDataFromString(vers_info_data, 25, "string") 696 dyld_all_image_infos_dyldImageLoadAddress = _ExtractDataFromString(vers_info_data, 32, "uint64_t") 697 dyld_all_image_infos_jitInfo = _ExtractDataFromString(vers_info_data, 40, "uint64_t") 698 dyld_all_image_infos_dyldVersion = _ExtractDataFromString(vers_info_data, 48, "uint64_t") 699 dyld_all_image_infos_errorMessage = _ExtractDataFromString(vers_info_data, 56, "uint64_t") 700 dyld_all_image_infos_terminationFlags = _ExtractDataFromString(vers_info_data, 64, "uint64_t") 701 dyld_all_image_infos_coreSymbolicationShmPage = _ExtractDataFromString(vers_info_data, 72, "uint64_t") 702 dyld_all_image_infos_systemOrderFlag = _ExtractDataFromString(vers_info_data, 80, "uint64_t") 703 dyld_all_image_infos_uuidArrayCount = _ExtractDataFromString(vers_info_data, 88, "uint64_t") 704 dyld_all_image_infos_uuidArray = _ExtractDataFromString(vers_info_data, 96, "uint64_t") 705 dyld_all_image_infos_dyldAllImageInfosAddress = _ExtractDataFromString(vers_info_data, 104, "uint64_t") 706 else: 707 dyld_all_image_infos_infoArrayCount = _ExtractDataFromString(vers_info_data, 4, "uint32_t") 708 dyld_all_image_infos_infoArray = _ExtractDataFromString(vers_info_data, 8, "uint32_t") 709 dyld_all_image_infos_notification = _ExtractDataFromString(vers_info_data, 12, "uint32_t") 710 dyld_all_image_infos_processDetachedFromSharedRegion = _ExtractDataFromString(vers_info_data, 16, "string") 711 dyld_all_image_infos_libSystemInitialized = _ExtractDataFromString(vers_info_data, 17, "string") 712 dyld_all_image_infos_dyldImageLoadAddress = _ExtractDataFromString(vers_info_data, 20, "uint32_t") 713 dyld_all_image_infos_jitInfo = _ExtractDataFromString(vers_info_data, 24, "uint32_t") 714 dyld_all_image_infos_dyldVersion = _ExtractDataFromString(vers_info_data, 28, "uint32_t") 715 dyld_all_image_infos_errorMessage = _ExtractDataFromString(vers_info_data, 32, "uint32_t") 716 dyld_all_image_infos_terminationFlags = _ExtractDataFromString(vers_info_data, 36, "uint32_t") 717 dyld_all_image_infos_coreSymbolicationShmPage = _ExtractDataFromString(vers_info_data, 40, "uint32_t") 718 dyld_all_image_infos_systemOrderFlag = _ExtractDataFromString(vers_info_data, 44, "uint32_t") 719 dyld_all_image_infos_uuidArrayCount = _ExtractDataFromString(vers_info_data, 48, "uint32_t") 720 dyld_all_image_infos_uuidArray = _ExtractDataFromString(vers_info_data, 52, "uint32_t") 721 dyld_all_image_infos_dyldAllImageInfosAddress = _ExtractDataFromString(vers_info_data, 56, "uint32_t") 722 723 dyld_all_imfo_infos_slide = (dyld_all_image_infos_address - dyld_all_image_infos_dyldAllImageInfosAddress) 724 dyld_all_image_infos_dyldVersion_postslide = (dyld_all_image_infos_dyldVersion + dyld_all_imfo_infos_slide) 725 726 path_out = GetUserspaceString(task, dyld_all_image_infos_dyldVersion_postslide) 727 out_str += "[dyld-{:s}]\n".format(path_out) 728 out_str += "version \t\t\t\t: {:d}\n".format(dyld_all_image_infos_version) 729 out_str += "infoArrayCount \t\t\t\t: {:d}\n".format(dyld_all_image_infos_infoArrayCount) 730 out_str += "infoArray \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_infoArray) 731 out_str += "notification \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_notification) 732 733 out_str += "processDetachedFromSharedRegion \t: " 734 if dyld_all_image_infos_processDetachedFromSharedRegion != "": 735 out_str += "TRUE\n".format(dyld_all_image_infos_processDetachedFromSharedRegion) 736 else: 737 out_str += "FALSE\n" 738 739 out_str += "libSystemInitialized \t\t\t: " 740 if dyld_all_image_infos_libSystemInitialized != "": 741 out_str += "TRUE\n".format(dyld_all_image_infos_libSystemInitialized) 742 else: 743 out_str += "FALSE\n" 744 745 out_str += "dyldImageLoadAddress \t\t\t: {:#x}\n".format(dyld_all_image_infos_dyldImageLoadAddress) 746 out_str += "jitInfo \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_jitInfo) 747 out_str += "\ndyldVersion \t\t\t\t: {:#x}".format(dyld_all_image_infos_dyldVersion) 748 if (dyld_all_imfo_infos_slide != 0): 749 out_str += " (currently {:#x})\n".format(dyld_all_image_infos_dyldVersion_postslide) 750 else: 751 out_str += "\n" 752 753 out_str += "errorMessage \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_errorMessage) 754 if dyld_all_image_infos_errorMessage != 0: 755 out_str += GetUserspaceString(task, dyld_all_image_infos_errorMessage) 756 757 out_str += "terminationFlags \t\t\t: {:#x}\n".format(dyld_all_image_infos_terminationFlags) 758 out_str += "coreSymbolicationShmPage \t\t: {:#x}\n".format(dyld_all_image_infos_coreSymbolicationShmPage) 759 out_str += "systemOrderFlag \t\t\t: {:#x}\n".format(dyld_all_image_infos_systemOrderFlag) 760 out_str += "uuidArrayCount \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_uuidArrayCount) 761 out_str += "uuidArray \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_uuidArray) 762 out_str += "dyldAllImageInfosAddress \t\t: {:#x}".format(dyld_all_image_infos_dyldAllImageInfosAddress) 763 if (dyld_all_imfo_infos_slide != 0): 764 out_str += " (currently {:#x})\n".format(dyld_all_image_infos_address) 765 else: 766 out_str += "\n" 767 768 if is_task_64: 769 dyld_all_image_infos_address = dyld_all_image_infos_address + 112 770 dyld_all_image_infos_v10 = GetUserDataAsString(task, dyld_all_image_infos_address, 64) 771 dyld_all_image_infos_initialImageCount = _ExtractDataFromString(dyld_all_image_infos_v10, 112-112, "uint64_t") 772 dyld_all_image_infos_errorKind = _ExtractDataFromString(dyld_all_image_infos_v10, 120-112, "uint64_t") 773 dyld_all_image_infos_errorClientOfDylibPath = _ExtractDataFromString(dyld_all_image_infos_v10, 128-112, "uint64_t") 774 dyld_all_image_infos_errorTargetDylibPath = _ExtractDataFromString(dyld_all_image_infos_v10, 136-112, "uint64_t") 775 dyld_all_image_infos_errorSymbol = _ExtractDataFromString(dyld_all_image_infos_v10, 144-112, "uint64_t") 776 dyld_all_image_infos_sharedCacheSlide = _ExtractDataFromString(dyld_all_image_infos_v10, 152-112, "uint64_t") 777 dyld_all_image_infos_sharedCacheUUID = _ExtractDataFromString(dyld_all_image_infos_v10, 160-112, "string") 778 else: 779 dyld_all_image_infos_address = dyld_all_image_infos_address + 60 780 dyld_all_image_infos_v10 = GetUserDataAsString(task, dyld_all_image_infos_address, 40) 781 dyld_all_image_infos_initialImageCount = _ExtractDataFromString(dyld_all_image_infos_v10, 60-60, "uint32_t") 782 dyld_all_image_infos_errorKind = _ExtractDataFromString(dyld_all_image_infos_v10, 64-60, "uint32_t") 783 dyld_all_image_infos_errorClientOfDylibPath = _ExtractDataFromString(dyld_all_image_infos_v10, 68-60, "uint32_t") 784 dyld_all_image_infos_errorTargetDylibPath = _ExtractDataFromString(dyld_all_image_infos_v10, 72-60, "uint32_t") 785 dyld_all_image_infos_errorSymbol = _ExtractDataFromString(dyld_all_image_infos_v10, 76-60, "uint32_t") 786 dyld_all_image_infos_sharedCacheSlide = _ExtractDataFromString(dyld_all_image_infos_v10, 80-60, "uint32_t") 787 dyld_all_image_infos_sharedCacheUUID = _ExtractDataFromString(dyld_all_image_infos_v10, 84-60, "string") 788 789 if dyld_all_image_infos_version >= 10: 790 out_str += "\ninitialImageCount \t\t\t: {:#x}\n".format(dyld_all_image_infos_initialImageCount) 791 792 if dyld_all_image_infos_version >= 11: 793 out_str += "errorKind \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_errorKind) 794 out_str += "errorClientOfDylibPath \t\t\t: {:#x}\n".format(dyld_all_image_infos_errorClientOfDylibPath) 795 if dyld_all_image_infos_errorClientOfDylibPath != 0: 796 out_str += "\t\t\t\t" 797 out_str += GetUserspaceString(task, dyld_all_image_infos_errorClientOfDylibPath) 798 out_str += "\n" 799 out_str += "errorTargetDylibPath \t\t\t: {:#x}\n".format(dyld_all_image_infos_errorTargetDylibPath) 800 if dyld_all_image_infos_errorTargetDylibPath != 0: 801 out_str += "\t\t\t\t" 802 out_str += GetUserspaceString(task, dyld_all_image_infos_errorTargetDylibPath) 803 out_str += "\n" 804 out_str += "errorSymbol \t\t\t\t: {:#x}\n".format(dyld_all_image_infos_errorSymbol) 805 if dyld_all_image_infos_errorSymbol != 0: 806 out_str += "\t\t\t\t" 807 out_str += GetUserspaceString(task, dyld_all_image_infos_errorSymbol) 808 out_str += "\n" 809 810 if dyld_all_image_infos_version >= 12: 811 out_str += "sharedCacheSlide \t\t\t: {:#x}\n".format(dyld_all_image_infos_sharedCacheSlide) 812 if dyld_all_image_infos_version >= 13 and dyld_all_image_infos_sharedCacheUUID != "": 813 out_str += "sharedCacheUUID \t\t\t: {:s}\n".format(dyld_all_image_infos_sharedCacheUUID) 814 else: 815 out_str += "No dyld information available for task\n" 816 print(out_str) 817 818def SaveDataToFile(start_addr, length, outputfile, task=None,): 819 """ Save the data at the specified address (of the specified length) to the file. 820 params: start_addr : start address of the region of memory to save 821 length : length of the region of memory to save 822 outputfile : file to save the data in 823 task (optional) : task containing the memory region (if from user data) 824 returns: True if we saved the requested data, False otherwise 825 """ 826 if task: 827 memory_data = GetUserDataAsString(task, start_addr, length) 828 else: 829 err = lldb.SBError() 830 memory_data = LazyTarget.GetProcess().ReadMemory(start_addr, length, err) 831 if not err.Success(): 832 print("Failed to read process memory. {:d} bytes from address {: <#020x}. Error: {}".format(length, start_addr, err.description)) 833 return False 834 835 if len(memory_data) != length: 836 print("Failed to read {:d} bytes from address {: <#020x}".format(length, start_addr)) 837 return False 838 839 fh = open(outputfile, 'wb') 840 fh.write(memory_data) 841 fh.close() 842 print("Saved {:d} bytes to file {:s}".format(length, outputfile)) 843 return True 844 845 846@lldb_command('savekcdata', 'T:O:') 847def SaveKCDataToFile(cmd_args=None, cmd_options={}): 848 """ Save the data referred by the kcdata_descriptor structure. 849 options: 850 -T: <task_t> pointer to task if memory referenced is in userstask. 851 -O: <output file path> path to file to save data. default: /tmp/kcdata.<timestamp>.bin 852 Usage: (lldb) savekcdata <kcdata_descriptor_t> -T <task_t> -O /path/to/outputfile.bin 853 """ 854 if not cmd_args: 855 raise ArgumentError('Please provide the kcdata descriptor.') 856 857 kcdata = kern.GetValueFromAddress(cmd_args[0], 'kcdata_descriptor_t') 858 859 outputfile = '/tmp/kcdata.{:s}.bin'.format(str(time.time())) 860 task = None 861 if '-O' in cmd_options: 862 outputfile = cmd_options['-O'] 863 if '-T' in cmd_options: 864 task = kern.GetValueFromAddress(cmd_options['-T'], 'task_t') 865 866 memory_begin_address = unsigned(kcdata.kcd_addr_begin) 867 memory_size = 16 + unsigned(kcdata.kcd_addr_end) - memory_begin_address 868 flags_copyout = unsigned(kcdata.kcd_flags) 869 if flags_copyout: 870 if not task: 871 raise ArgumentError('Invalid task pointer provided.') 872 return SaveDataToFile(memory_begin_address, memory_size, outputfile, task) 873 else: 874 return SaveDataToFile(memory_begin_address, memory_size, outputfile, None) 875