1# $FreeBSD$ 2# Assembler-level macros for i386 3# Disassemble the next 10 instructions. 4define xi 5x/10i $eip 6end 7 8# Top 12 words on stack 9define xs 10x/12x $esp 11end 12 13# Top 12 words from frame pointer 14define xb 15x/12x $ebp 16end 17 18# single step through calls and disassemble the next instruction 19define z 20ni 21x/1i $eip 22end 23 24# single step over calls and disassemble the next instruction 25define zs 26si 27x/1i $eip 28end 29 30# show current stack frame and first 4 parameters 31define xp 32printf " esp: " 33output/x $esp 34echo ( 35output (((int)$ebp)-(int)$esp)/4-4 36printf " words on stack)\n ebp: " 37output/x $ebp 38printf "\n eip: " 39x/1i $eip 40printf "Saved ebp: " 41output/x *(int*)$ebp 42printf " (maximum of " 43output ((*(int*)$ebp)-(int)$ebp)/4-4 44printf " parameters possible)\nSaved eip: " 45x/1i *(int*)($ebp+4) 46printf "\nParm 1 at " 47output/x (int) ($ebp+8) 48printf ": " 49output (char*) *(int*)($ebp+8) 50printf "\nParm 2 at " 51output/x (int) ($ebp+12) 52printf ": " 53output (char*) *(int*)($ebp+12) 54printf "\nParm 3 at " 55output/x (int) ($ebp+16) 56printf ": " 57output (char*) *(int*)($ebp+16) 58printf "\nParm 4 at " 59output/x (int) ($ebp+20) 60printf ": " 61output (char*) *(int*)($ebp+20) 62echo \n 63end 64document xp 65Show the register contents and the first four parameter 66words of the current frame. 67end 68 69# show current stack frame and first 10 parameters 70define xxp 71printf " esp: " 72output/x $esp 73printf "\n ebp: " 74output/x $ebp 75printf "\n eip: " 76x/1i $eip 77printf "Saved ebp: " 78output/x *(int*)$ebp 79printf " (maximum of " 80output ((*(int*)$ebp)-(int)$ebp)/4-4 81printf " parameters possible)\nSaved eip: " 82x/1i *(int*)($ebp+4) 83printf "\nParm 1 at " 84output/x (int) ($ebp+8) 85printf ": " 86output (char*) *(int*)($ebp+8) 87printf "\nParm 2 at " 88output/x (int) ($ebp+12) 89printf ": " 90output (char*) *(int*)($ebp+12) 91printf "\nParm 3 at " 92output/x (int) ($ebp+16) 93printf ": " 94output (char*) *(int*)($ebp+16) 95printf "\nParm 4 at " 96output/x (int) ($ebp+20) 97printf ": " 98output (char*) *(int*)($ebp+20) 99printf "\nParm 5 at " 100output/x (int) ($ebp+24) 101printf ": " 102output (char*) *(int*)($ebp+24) 103printf "\nParm 6 at " 104output/x (int) ($ebp+28) 105printf ": " 106output (char*) *(int*)($ebp+28) 107printf "\nParm 7 at " 108output/x (int) ($ebp+32) 109printf ": " 110output (char*) *(int*)($ebp+32) 111printf "\nParm 8 at " 112output/x (int) ($ebp+36) 113printf ": " 114output (char*) *(int*)($ebp+36) 115printf "\nParm 9 at " 116output/x (int) ($ebp+40) 117printf ": " 118output (char*) *(int*)($ebp+40) 119printf "\nParm 10 at " 120output/x (int) ($ebp+44) 121printf ": " 122output (char*) *(int*)($ebp+44) 123echo \n 124end 125document xxp 126Show the register contents and the first ten parameter 127words of the current frame. 128end 129 130# Show first to fifth parameters of current frame as int, int * and char *. 131define xp0 132x/12x *(int*)$esp 133p *(int*)$esp 134p (char*)*$esp 135end 136define xp1 137x/12x *(int*)($ebp+4) 138p *(int*)($ebp+4) 139p (char**)($ebp+4) 140end 141define xp2 142x/12x *(int*)($ebp+8) 143p *(int*)($ebp+8) 144p *(char**)($ebp+8) 145end 146define xp3 147x/12x *(int*)($ebp+12) 148p *(int*)($ebp+12) 149p (char**)($ebp+12) 150end 151define xp4 152x/12x *(int*)($ebp+16) 153p *(int*)($ebp+16) 154p (char**)($ebp+16) 155end 156document xp0 157Show the first parameter of current stack frame in various formats 158end 159document xp1 160Show the second parameter of current stack frame in various formats 161end 162document xp2 163Show the third parameter of current stack frame in various formats 164end 165document xp3 166Show the fourth parameter of current stack frame in various formats 167end 168document xp4 169Show the fifth parameter of current stack frame in various formats 170end 171 172# Select frame 0 to 5 and show stack information. 173define f0 174f 0 175xp 176end 177define f1 178f 1 179xp 180end 181define f2 182f 2 183xp 184end 185define f3 186f 3 187xp 188end 189define f4 190f 4 191xp 192end 193define f5 194f 5 195xp 196end 197document f0 198Select stack frame 0 and show assembler-level details 199end 200document f1 201Select stack frame 1 and show assembler-level details 202end 203document f2 204Select stack frame 2 and show assembler-level details 205end 206document f3 207Select stack frame 3 and show assembler-level details 208end 209document f4 210Select stack frame 4 and show assembler-level details 211end 212document f5 213Select stack frame 5 and show assembler-level details 214end 215document z 216Single step 1 instruction (over calls) and show next instruction. 217end 218document zs 219Single step 1 instruction (through calls) and show next instruction. 220end 221document xi 222List the next 10 instructions from the current IP value 223end 224document xs 225Show the last 12 words on stack in hex 226end 227document xb 228Show 12 words starting at current BP value in hex 229end 230 231# pcb <pid> 232# show contents of pcb, currently only i386. 233define pcb 234y 235 set $nproc = nprocs 236 set $aproc = allproc.lh_first 237 set $proc = allproc.lh_first 238 while (--$nproc >= 0) 239 set $pptr = $proc.p_pptr 240 if ($proc->p_pid == $arg0) 241 set $pcba = $proc->p_threads.tqh_first->td_pcb 242 printf "ip: %08x sp: %08x bp: %08x bx: %08x\n", $pcba->pcb_eip, $pcba->pcb_esp, $pcba->pcb_ebp, $pcba->pcb_ebx 243 x/1i $pcba->pcb_eip 244 set $nproc = 0 245 end 246 set $aproc = $proc.p_list.le_next 247 if ($aproc == 0 && $nproc > 0) 248 set $aproc = zombproc 249 end 250 set $proc = $aproc 251 end 252end 253document pcb 254Show some pcb contents of process whose pid is specified. 255end 256 257# btr <frame> 258# primitive backtrace. frame is a memory address. 259define btr 260set $frame = $arg0 261set $fno = 0 262while (*(int *) $frame > 0xc0000000) 263 set $myebp = *(int *) $frame 264 set $myeip = *(int *) ($frame + 4) 265 printf " frame %d at %p: ebp %8x, eip ", $fno, $frame, $myebp 266 x/1i $myeip 267 set $frame = $myebp 268 set $fno = $fno + 1 269end 270end 271document btr 272Show a backtrace from the ebp address specified. This can be used to get a backtrace from any stack resident in memory. It's the user's responsiblity to ensure that the address is meaningful. 273end 274 275# btp <pid> 276# backtrace for process <pid>. Uses btr (machine dependent) to perform the backtrace. 277# may produce nonsense. 278define btp 279y 280 set $nproc = nprocs 281 set $aproc = allproc.lh_first 282 set $proc = allproc.lh_first 283 while (--$nproc >= 0) 284 if ($proc->p_pid == $arg0) 285 btr $proc->p_threads.tqh_first->td_pcb->pcb_ebp 286 set $nproc = 0 287 else 288 set $aproc = $proc.p_list.le_next 289 if ($aproc == 0 && $nproc > 0) 290 set $aproc = zombproc 291 end 292 set $proc = $aproc 293 end 294 end 295end 296document btp 297Show a backtrace for the process whose pid is specified as a parameter. 298end 299 300# Do backtraces for all processes in the system. 301# Uses btr (machine dependent) to perform the backtrace. 302define btpa 303 set $nproc = nprocs 304 set $aproc = allproc.lh_first 305 set $proc = allproc.lh_first 306 printf " pid proc addr uid ppid pgrp flag stat comm wchan\n" 307 while (--$nproc >= 0) 308 set $pptr = $proc.p_pptr 309 if ($pptr == 0) 310 set $pptr = $proc 311 end 312 if ($proc.p_stat) 313 printf "%5d %08x %08x %4d %5d %5d %06x %d %-10s ", \ 314 $proc.p_pid, $aproc, \ 315 $proc.p_uarea, $proc.p_cred->p_ruid, $pptr->p_pid, \ 316 $proc.p_pgrp->pg_id, $proc.p_flag, $proc.p_stat, \ 317 &$proc.p_comm[0] 318 if ($proc.p_wchan) 319 if ($proc.p_wmesg) 320 printf "%s ", $proc.p_wmesg 321 end 322 printf "%x", $proc.p_wchan 323 end 324 printf "\n" 325 if ($proc->p_flag & 4) 326 btr $proc->p_threads.tqh_first->td_pcb->pcb_ebp 327 else 328 echo (not loaded)\n 329 end 330 end 331 set $aproc = $proc.p_list.le_next 332 if ($aproc == 0 && $nproc > 0) 333 set $aproc = zombproc 334 end 335 set $proc = $aproc 336 end 337end 338document btpa 339Show backtraces for all processes in the system. 340end 341 342# Show backtrace for process selected with "defproc" 343define btpp 344btr $myvectorproc->p_threads.tqh_first->td_pcb->pcb_ebp 345end 346document btpp 347Show a backtrace for the process previously selected with 'defproc'. 348end 349 350# Specific stack fram of process selected with "defproc". 351define fr 352set $fno = 0 353set $searching = 1 354set $frame = $myvectorproc->p_threads.tqh_first->td_pcb->pcb_ebp 355while (($searching == 1) && (*(int *) $frame > 0xc0000000)) 356 set $myebp = *(int *) $frame 357 set $myeip = *(int *) ($frame + 4) 358 if ($fno == $arg0) 359 printf " frame %d at %p: ebp %8x, eip ", $fno, $frame, $myebp 360 x/1i $myeip 361 printf "Called from %8x, stack frame at %8x\n", *(int *) ($myebp+4), *(int *) $myebp 362 printf "last 20 local variables:\n" 363 x/20x ($myebp-80) 364 printf "call parameters:\n" 365 x/8x ($myebp+8) 366 set $searching = 0 367 else 368 set $frame = $myebp 369 set $fno = $fno + 1 370 end 371end 372if ($searching == 1) 373 echo frame not found\n 374end 375end 376document fr 377Show the frame of the stack of the process previously selected with 'defproc'. 378end 379