From: "Pierre Muller" <muller@ics.u-strasbg.fr>
To: "'Mark Kettenis'" <mark.kettenis@xs4all.nl>
Cc: <gdb-patches@sourceware.org>
Subject: [RFC-v2] Enhance backtrace for microsoft system DLL calls
Date: Mon, 14 Jan 2008 10:16:00 -0000 [thread overview]
Message-ID: <003101c85696$6f4d9e20$4de8da60$@u-strasbg.fr> (raw)
In-Reply-To: <002701c83be2$ac2a9a60$047fcf20$@u-strasbg.fr>
I wrote a i386_skip_noop function.
It currently only tests for 'nop' and 'mov %edi,%edi'
instructions, but the way it is written, other
instructions should be easy to add.
I also tried to explain the reason of the presence
of the 'mov %edi,%edi' instruction in the win32 system DLL prologue,
as explained by Pedro.
Tested on cygwin target, no regressions found.
The patch allows to get the backtrace of the main thread of gdb
to come up to the functions that called the systems DLL.
If I use ./gdb ./gdb with 'set new-console on'
and use Ctrl-C on the debuggee gdb window.
Without the patch, the backtrace only shows
3 levels in ntdll.dll and kernel32.dll
Questions:
1) Is the 'nop' test useful or should it be removed?
2) Should we add other possible no-ops?
As said in my previous email, the number of
possible no-ops is big, and it is probably not wise to test all of
them.
3) this call is used for all i386 targets, but it
is probably useless for all operating systems but Microsoft Windows,
so should it be called only for that OS, and if yes, how should
we code this?
4) Any suggestions to make the comment clearer will be
most appreciated.
Pierre Muller
ChangeLog entry:
2008-01-14 Pierre Muller <muller@ics.u-strasbg.fr>
* i386-tdep.c (i386_skip_noop): New function.
(i386_analyze_prologue): Call i386_skip_noop function.
Index: gdb/i386-tdep.c
===================================================================
RCS file: /cvs/src/src/gdb/i386-tdep.c,v
retrieving revision 1.248
diff -u -p -r1.248 i386-tdep.c
--- gdb/i386-tdep.c 11 Jan 2008 13:20:00 -0000 1.248
+++ gdb/i386-tdep.c 14 Jan 2008 08:11:27 -0000
@@ -632,6 +632,51 @@ struct i386_insn i386_frame_setup_skip_i
{ 0 }
};
+
+/* Check whether PC points to a no-op instruction. */
+static CORE_ADDR
+i386_skip_noop (CORE_ADDR pc)
+{
+ gdb_byte op;
+ int check = 1;
+
+ read_memory_nobpt (pc, &op, 1);
+
+ while (check)
+ {
+ check = 0;
+ /* Ignore `nop' instruction. */
+ if (op == 0x90)
+ {
+ pc += 1;
+ read_memory_nobpt (pc, &op, 1);
+ check = 1;
+ }
+ /* Ignore no-op instruction `mov %edi, %edi'.
+ Microsoft system dlls often start with
+ a `mov %edi,%edi' instruction.
+ The 5 bytes before the function start are
+ filled with `nop' instructions.
+ This pattern can be used for hot-patching:
+ The `mov %edi, %edi' instruction can be replaced by a
+ near jump to the location of the 5 `nop' instructions
+ which can be replaced by a 32-bit jump to anywhere
+ in the 32-bit address space. */
+
+ else if (op == 0x8b)
+ {
+ read_memory_nobpt (pc + 1, &op, 1);
+ if (op == 0xff)
+ {
+ pc += 2;
+ read_memory_nobpt (pc, &op, 1);
+ check = 1;
+ }
+ }
+ }
+ return pc;
+}
+
/* Check whether PC points at a code that sets up a new stack frame.
If so, it updates CACHE and returns the address of the first
instruction after the sequence that sets up the frame or LIMIT,
@@ -817,6 +862,7 @@ static CORE_ADDR
i386_analyze_prologue (CORE_ADDR pc, CORE_ADDR current_pc,
struct i386_frame_cache *cache)
{
+ pc = i386_skip_noop (pc);
pc = i386_follow_jump (pc);
pc = i386_analyze_struct_return (pc, current_pc, cache);
pc = i386_skip_probe (pc);
next prev parent reply other threads:[~2008-01-14 10:16 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-12-10 16:45 [RFC] " Pierre Muller
2007-12-10 17:37 ` Pedro Alves
2007-12-10 18:08 ` Daniel Jacobowitz
2007-12-10 18:41 ` Pedro Alves
2007-12-11 10:44 ` Mark Kettenis
2007-12-11 17:29 ` Pierre Muller
2008-01-14 10:16 ` Pierre Muller [this message]
2008-01-24 0:52 ` [RFC-v2] " Pedro Alves
2008-01-24 17:51 ` Mark Kettenis
2008-01-25 14:16 ` [RFA] i386-tdep.c: Add i386_skip_noop function Pierre Muller
2008-01-25 16:38 ` Joel Brobecker
2008-01-25 16:46 ` [RFA] i386-tdep.c: Add i386_skip_noop function; updated Pierre Muller
2008-01-25 17:05 ` Mark Kettenis
2008-01-25 17:26 ` Joel Brobecker
2008-01-25 18:50 ` Pierre Muller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='003101c85696$6f4d9e20$4de8da60$@u-strasbg.fr' \
--to=muller@ics.u-strasbg.fr \
--cc=gdb-patches@sourceware.org \
--cc=mark.kettenis@xs4all.nl \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox