X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/cc8bc92ae4a8e9f1a1ab61bf83d34ad8150b3405..eb6b6ca394357805f2bdba989abae309f718b4d8:/tools/lldbmacros/core/kernelcore.py diff --git a/tools/lldbmacros/core/kernelcore.py b/tools/lldbmacros/core/kernelcore.py index 580887584..01067a75d 100755 --- a/tools/lldbmacros/core/kernelcore.py +++ b/tools/lldbmacros/core/kernelcore.py @@ -6,6 +6,7 @@ from cvalue import * from lazytarget import * from configuration import * +from utils import * import caching import lldb @@ -109,6 +110,30 @@ def IterateLinkageChain(queue_head, element_type, field_name, field_ofst=0): yield obj link = link.next +def IterateCircleQueue(queue_head, element_ptr_type, element_field_name): + """ iterate over a circle queue in kernel of type circle_queue_head_t. refer to osfmk/kern/circle_queue.h + params: + queue_head - lldb.SBValue : Value object for queue_head. + element_type - lldb.SBType : a pointer type of the element 'next' points to. Typically its structs like thread, task etc.. + element_field_name - str : name of the field in target struct. + returns: + A generator does not return. It is used for iterating. + SBValue : an object thats of type (element_type) queue_head->next. Always a pointer object + """ + head = queue_head.head.GetSBValue() + queue_head_addr = 0x0 + if head.TypeIsPointerType(): + queue_head_addr = head.GetValueAsUnsigned() + else: + queue_head_addr = head.GetAddress().GetLoadAddress(osplugin_target_obj) + cur_elt = head + while True: + if not cur_elt.IsValid() or cur_elt.GetValueAsUnsigned() == 0: + break + yield containerof(value(cur_elt), element_ptr_type, element_field_name) + cur_elt = cur_elt.GetChildMemberWithName('next') + if cur_elt.GetValueAsUnsigned() == queue_head_addr: + break def IterateQueue(queue_head, element_ptr_type, element_field_name, backwards=False, unpack_ptr_fn=None): """ Iterate over an Element Chain queue in kernel of type queue_head_t. (osfmk/kern/queue.h method 2) @@ -222,6 +247,43 @@ def IterateRBTreeEntry(element, element_type, field_name): elt = cast(elt, element_type) +def IteratePriorityQueue(root, element_type, field_name): + """ iterate over a priority queue as defined with struct priority_queue from osfmk/kern/priority_queue.h + root - value : Value object for the priority queue + element_type - str : Type of the link element + field_name - str : Name of the field in link element's structure + returns: + A generator does not return. It is used for iterating + value : an object thats of type (element_type). Always a pointer object + """ + def _make_pqe(addr): + return value(root.GetSBValue().CreateValueFromExpression(None,'(struct priority_queue_entry *)'+str(addr))) + + queue = [unsigned(root.pq_root_packed) & ~3] + + while len(queue): + elt = _make_pqe(queue.pop()) + + while elt: + yield containerof(elt, element_type, field_name) + addr = unsigned(elt.child) + if addr: queue.append(addr) + elt = elt.next + +def IterateMPSCQueue(root, element_type, field_name): + """ iterate over an MPSC queue as defined with struct mpsc_queue_head from osfmk/kern/mpsc_queue.h + root - value : Value object for the mpsc queue + element_type - str : Type of the link element + field_name - str : Name of the field in link element's structure + returns: + A generator does not return. It is used for iterating + value : an object thats of type (element_type). Always a pointer object + """ + elt = root.mpqh_head.mpqc_next + while unsigned(elt): + yield containerof(elt, element_type, field_name) + elt = elt.mpqc_next + class KernelTarget(object): """ A common kernel object that provides access to kernel objects and information. The class holds global lists for task, terminated_tasks, procs, zones, zombroc etc. @@ -302,6 +364,7 @@ class KernelTarget(object): addr = int(addr, 16) else: addr = int(addr) + addr = self.StripKernelPAC(addr) ret_array = [] symbolicator = self._GetSymbolicator() syms = symbolicator.symbolicate(addr) @@ -399,9 +462,30 @@ class KernelTarget(object): val = ((addr + size) & (unsigned(self.GetGlobalVariable("page_size"))-1)) return (val < size and val > 0) + def StripUserPAC(self, addr): + if self.arch != 'arm64e': + return addr + T0Sz = self.GetGlobalVariable('gT0Sz') + return StripPAC(addr, T0Sz) + + def StripKernelPAC(self, addr): + if self.arch != 'arm64e': + return addr + T1Sz = self.GetGlobalVariable('gT1Sz') + return StripPAC(addr, T1Sz) + + def PhysToKVARM64(self, addr): + ptov_table = self.GetGlobalVariable('ptov_table') + for i in range(0, self.GetGlobalVariable('ptov_index')): + if (addr >= long(unsigned(ptov_table[i].pa))) and (addr < (long(unsigned(ptov_table[i].pa)) + long(unsigned(ptov_table[i].len)))): + return (addr - long(unsigned(ptov_table[i].pa)) + long(unsigned(ptov_table[i].va))) + return (addr - unsigned(self.GetGlobalVariable("gPhysBase")) + unsigned(self.GetGlobalVariable("gVirtBase"))) + def PhysToKernelVirt(self, addr): if self.arch == 'x86_64': return (addr + unsigned(self.GetGlobalVariable('physmap_base'))) + elif self.arch.startswith('arm64'): + return self.PhysToKVARM64(addr) elif self.arch.startswith('arm'): return (addr - unsigned(self.GetGlobalVariable("gPhysBase")) + unsigned(self.GetGlobalVariable("gVirtBase"))) else: @@ -548,7 +632,7 @@ class KernelTarget(object): self._ptrsize = caching.GetStaticCacheData("kern.ptrsize", None) if self._ptrsize != None : return self._ptrsize arch = LazyTarget.GetTarget().triple.split('-')[0] - if arch in ('x86_64', 'arm64'): + if arch == 'x86_64' or arch.startswith('arm64'): self._ptrsize = 8 else: self._ptrsize = 4 @@ -558,7 +642,7 @@ class KernelTarget(object): if name == 'VM_MIN_KERNEL_ADDRESS': if self.arch == 'x86_64': return unsigned(0xFFFFFF8000000000) - elif self.arch == 'arm64': + elif self.arch.startswith('arm64'): return unsigned(0xffffffe000000000) else: return unsigned(0x80000000)