* instructions logged by Intel PT not always in the address range of NT_FILES
@ 2016-09-19 3:47 慕冬亮
2016-09-19 4:20 ` 慕冬亮
0 siblings, 1 reply; 2+ messages in thread
From: 慕冬亮 @ 2016-09-19 3:47 UTC (permalink / raw)
To: gdb
Dear all,
When I did experiment about instructions logged by Intel PT, I found
an problem: instructions logged by Intel PT are not always in the
NT_FILES(executable, libraries) of coredump.
I was using the following gdb script to log executed instructions and
generate coredump:
set pagination off
set logging on
set disassembly-flavor intel
b _start
r AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
record btrace pt
continue
gcore core <= gcore to generate codeump, maybe the problem, not sure.
info record
set record instruction-history-size unlimited
record instruction-history
quit
$ readelf -n core (Get all the address range of NT_FILES)
......
Page size: 1
Start End Page Offset
0x08048000 0x08049000 0x00000000
/home/mdl/Work/testsuites/simple2/simple
0x08049000 0x0804a000 0x00000000
/home/mdl/Work/testsuites/simple2/simple
0xb7fb4000 0xb7fb6000 0x001ac000
/lib/i386-linux-gnu/libc-2.23.so
0xb7fb6000 0xb7fb7000 0x001ae000
/lib/i386-linux-gnu/libc-2.23.so
0xb7fdb000 0xb7ffd000 0x00000000
/lib/i386-linux-gnu/ld-2.23.so
0xb7ffe000 0xb7fff000 0x00022000
/lib/i386-linux-gnu/ld-2.23.so
0xb7fff000 0xb8000000 0x00023000
/lib/i386-linux-gnu/ld-2.23.so
When I checked the executed instructions, I found there are
instructions whose address is not in those NT_FILES. For example,
0xb7e1f5f3 <__libc_start_main+243>: call DWORD PTR [esp+0x70]
However, this instruction is from __libc_start_main function that
should be in libc library.
I don't know what is problem. If I said something wrong, please correct me.
--
My best regards to you.
No System Is Safe!
Dongliang Mu
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: instructions logged by Intel PT not always in the address range of NT_FILES
2016-09-19 3:47 instructions logged by Intel PT not always in the address range of NT_FILES 慕冬亮
@ 2016-09-19 4:20 ` 慕冬亮
0 siblings, 0 replies; 2+ messages in thread
From: 慕冬亮 @ 2016-09-19 4:20 UTC (permalink / raw)
To: gdb
I guess that in coredump generated by `gcore`, there is a missing
segment item which contains:
0xb7e1e740 - 0xb7f476dd is .text in /lib/i386-linux-gnu/libc.so.6
The above line is from `info files` when I did `gdb exec coredump`.
--
My best regards to you.
No System Is Safe!
Dongliang Mu
2016-09-18 23:47 GMT-04:00 慕冬亮 <mudongliangabcd@gmail.com>:
> Dear all,
>
> When I did experiment about instructions logged by Intel PT, I found
> an problem: instructions logged by Intel PT are not always in the
> NT_FILES(executable, libraries) of coredump.
>
> I was using the following gdb script to log executed instructions and
> generate coredump:
>
> set pagination off
> set logging on
> set disassembly-flavor intel
> b _start
> r AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> record btrace pt
> continue
> gcore core <= gcore to generate codeump, maybe the problem, not sure.
> info record
> set record instruction-history-size unlimited
> record instruction-history
> quit
>
> $ readelf -n core (Get all the address range of NT_FILES)
> ......
> Page size: 1
> Start End Page Offset
> 0x08048000 0x08049000 0x00000000
> /home/mdl/Work/testsuites/simple2/simple
> 0x08049000 0x0804a000 0x00000000
> /home/mdl/Work/testsuites/simple2/simple
> 0xb7fb4000 0xb7fb6000 0x001ac000
> /lib/i386-linux-gnu/libc-2.23.so
> 0xb7fb6000 0xb7fb7000 0x001ae000
> /lib/i386-linux-gnu/libc-2.23.so
> 0xb7fdb000 0xb7ffd000 0x00000000
> /lib/i386-linux-gnu/ld-2.23.so
> 0xb7ffe000 0xb7fff000 0x00022000
> /lib/i386-linux-gnu/ld-2.23.so
> 0xb7fff000 0xb8000000 0x00023000
> /lib/i386-linux-gnu/ld-2.23.so
>
> When I checked the executed instructions, I found there are
> instructions whose address is not in those NT_FILES. For example,
> 0xb7e1f5f3 <__libc_start_main+243>: call DWORD PTR [esp+0x70]
>
> However, this instruction is from __libc_start_main function that
> should be in libc library.
>
> I don't know what is problem. If I said something wrong, please correct me.
>
> --
> My best regards to you.
>
> No System Is Safe!
> Dongliang Mu
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-09-19 4:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-19 3:47 instructions logged by Intel PT not always in the address range of NT_FILES 慕冬亮
2016-09-19 4:20 ` 慕冬亮
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox