1# Assembler-level macros for i386 2# Disassemble the next 10 instructions. 3define xi 4x/10i $eip 5end 6 7# Top 12 words on stack 8define xs 9x/12x $esp 10end 11 12# Top 12 words from frame pointer 13define xb 14x/12x $ebp 15end 16 17# single step through calls and disassemble the next instruction 18define z 19ni 20x/1i $eip 21end 22 23# single step over calls and disassemble the next instruction 24define zs 25si 26x/1i $eip 27end 28 29# show current stack frame and first 4 parameters 30define xp 31printf " esp: " 32output/x $esp 33echo ( 34output (((int)$ebp)-(int)$esp)/4-4 35printf " words on stack)\n ebp: " 36output/x $ebp 37printf "\n eip: " 38x/1i $eip 39printf "Saved ebp: " 40output/x *(int*)$ebp 41printf " (maximum of " 42output ((*(int*)$ebp)-(int)$ebp)/4-4 43printf " parameters possible)\nSaved eip: " 44x/1i *(int*)($ebp+4) 45printf "\nParm 1 at " 46output/x (int) ($ebp+8) 47printf ": " 48output (char*) *(int*)($ebp+8) 49printf "\nParm 2 at " 50output/x (int) ($ebp+12) 51printf ": " 52output (char*) *(int*)($ebp+12) 53printf "\nParm 3 at " 54output/x (int) ($ebp+16) 55printf ": " 56output (char*) *(int*)($ebp+16) 57printf "\nParm 4 at " 58output/x (int) ($ebp+20) 59printf ": " 60output (char*) *(int*)($ebp+20) 61echo \n 62end 63document xp 64Show the register contents and the first four parameter 65words of the current frame. 66end 67 68# show current stack frame and first 10 parameters 69define xxp 70printf " esp: " 71output/x $esp 72printf "\n ebp: " 73output/x $ebp 74printf "\n eip: " 75x/1i $eip 76printf "Saved ebp: " 77output/x *(int*)$ebp 78printf " (maximum of " 79output ((*(int*)$ebp)-(int)$ebp)/4-4 80printf " parameters possible)\nSaved eip: " 81x/1i *(int*)($ebp+4) 82printf "\nParm 1 at " 83output/x (int) ($ebp+8) 84printf ": " 85output (char*) *(int*)($ebp+8) 86printf "\nParm 2 at " 87output/x (int) ($ebp+12) 88printf ": " 89output (char*) *(int*)($ebp+12) 90printf "\nParm 3 at " 91output/x (int) ($ebp+16) 92printf ": " 93output (char*) *(int*)($ebp+16) 94printf "\nParm 4 at " 95output/x (int) ($ebp+20) 96printf ": " 97output (char*) *(int*)($ebp+20) 98printf "\nParm 5 at " 99output/x (int) ($ebp+24) 100printf ": " 101output (char*) *(int*)($ebp+24) 102printf "\nParm 6 at " 103output/x (int) ($ebp+28) 104printf ": " 105output (char*) *(int*)($ebp+28) 106printf "\nParm 7 at " 107output/x (int) ($ebp+32) 108printf ": " 109output (char*) *(int*)($ebp+32) 110printf "\nParm 8 at " 111output/x (int) ($ebp+36) 112printf ": " 113output (char*) *(int*)($ebp+36) 114printf "\nParm 9 at " 115output/x (int) ($ebp+40) 116printf ": " 117output (char*) *(int*)($ebp+40) 118printf "\nParm 10 at " 119output/x (int) ($ebp+44) 120printf ": " 121output (char*) *(int*)($ebp+44) 122echo \n 123end 124document xxp 125Show the register contents and the first ten parameter 126words of the current frame. 127end 128 129# Show first to fifth parameters of current frame as int, int * and char *. 130define xp0 131x/12x *(int*)$esp 132p *(int*)$esp 133p (char*)*$esp 134end 135define xp1 136x/12x *(int*)($ebp+4) 137p *(int*)($ebp+4) 138p (char**)($ebp+4) 139end 140define xp2 141x/12x *(int*)($ebp+8) 142p *(int*)($ebp+8) 143p *(char**)($ebp+8) 144end 145define xp3 146x/12x *(int*)($ebp+12) 147p *(int*)($ebp+12) 148p (char**)($ebp+12) 149end 150define xp4 151x/12x *(int*)($ebp+16) 152p *(int*)($ebp+16) 153p (char**)($ebp+16) 154end 155document xp0 156Show the first parameter of current stack frame in various formats 157end 158document xp1 159Show the second parameter of current stack frame in various formats 160end 161document xp2 162Show the third parameter of current stack frame in various formats 163end 164document xp3 165Show the fourth parameter of current stack frame in various formats 166end 167document xp4 168Show the fifth parameter of current stack frame in various formats 169end 170 171# Select frame 0 to 5 and show stack information. 172define f0 173f 0 174xp 175end 176define f1 177f 1 178xp 179end 180define f2 181f 2 182xp 183end 184define f3 185f 3 186xp 187end 188define f4 189f 4 190xp 191end 192define f5 193f 5 194xp 195end 196document f0 197Select stack frame 0 and show assembler-level details 198end 199document f1 200Select stack frame 1 and show assembler-level details 201end 202document f2 203Select stack frame 2 and show assembler-level details 204end 205document f3 206Select stack frame 3 and show assembler-level details 207end 208document f4 209Select stack frame 4 and show assembler-level details 210end 211document f5 212Select stack frame 5 and show assembler-level details 213end 214document z 215Single step 1 instruction (over calls) and show next instruction. 216end 217document zs 218Single step 1 instruction (through calls) and show next instruction. 219end 220document xi 221List the next 10 instructions from the current IP value 222end 223document xs 224Show the last 12 words on stack in hex 225end 226document xb 227Show 12 words starting at current BP value in hex 228end 229 230# pcb <pid> 231# show contents of pcb, currently only i386. 232define pcb 233 set $nproc = nprocs 234 set $aproc = allproc.lh_first 235 set $proc = allproc.lh_first 236 while (--$nproc >= 0) 237 set $pptr = $proc.p_pptr 238 if ($proc->p_pid == $arg0) 239 set $pcba = $proc->p_threads.tqh_first->td_pcb 240 printf "ip: %08x sp: %08x bp: %08x bx: %08x\n", $pcba->pcb_eip, $pcba->pcb_esp, $pcba->pcb_ebp, $pcba->pcb_ebx 241 x/1i $pcba->pcb_eip 242 set $nproc = 0 243 end 244 set $aproc = $proc.p_list.le_next 245 if ($aproc == 0 && $nproc > 0) 246 set $aproc = zombproc 247 end 248 set $proc = $aproc 249 end 250end 251document pcb 252Show some pcb contents of process whose pid is specified. 253end 254 255# btr <frame> 256# primitive backtrace. frame is a memory address. 257define btr 258set $frame = $arg0 259set $fno = 0 260while (*(int *) $frame > 0xc0000000) 261 set $myebp = *(int *) $frame 262 set $myeip = *(int *) ($frame + 4) 263 printf " frame %d at %p: ebp %8x, eip ", $fno, $frame, $myebp 264 x/1i $myeip 265 set $frame = $myebp 266 set $fno = $fno + 1 267end 268end 269document btr 270Show a backtrace from the ebp address specified. This can be used to get a backtrace from any stack resident in memory. It's the user's responsibility to ensure that the address is meaningful. 271end 272 273# btp <pid> 274# backtrace for process <pid>. Uses btr (machine dependent) to perform the backtrace. 275# may produce nonsense. 276define btp 277 set $nproc = nprocs 278 set $aproc = allproc.lh_first 279 set $proc = allproc.lh_first 280 while (--$nproc >= 0) 281 if ($proc->p_pid == $arg0) 282 btr $proc->p_threads.tqh_first->td_pcb->pcb_ebp 283 set $nproc = 0 284 else 285 set $aproc = $proc.p_list.le_next 286 if ($aproc == 0 && $nproc > 0) 287 set $aproc = zombproc 288 end 289 set $proc = $aproc 290 end 291 end 292end 293document btp 294Show a backtrace for the process whose pid is specified as a parameter. 295end 296 297# Do backtraces for all processes in the system. 298# Uses btr (machine dependent) to perform the backtrace. 299define btpa 300 set $nproc = nprocs 301 set $aproc = allproc.lh_first 302 set $proc = allproc.lh_first 303 printf " pid proc uid ppid pgrp flag stat comm wchan\n" 304 while (--$nproc >= 0) 305 set $pptr = $proc.p_pptr 306 if ($pptr == 0) 307 set $pptr = $proc 308 end 309 if ($proc.p_stat) 310 printf "%5d %08x %4d %5d %5d %06x %d %-10s ", \ 311 $proc.p_pid, $aproc, \ 312 $proc.p_cred->p_ruid, $pptr->p_pid, \ 313 $proc.p_pgrp->pg_id, $proc.p_flag, $proc.p_stat, \ 314 &$proc.p_comm[0] 315 if ($proc.p_wchan) 316 if ($proc.p_wmesg) 317 printf "%s ", $proc.p_wmesg 318 end 319 printf "%x", $proc.p_wchan 320 end 321 printf "\n" 322 if ($proc->p_flag & 4) 323 btr $proc->p_threads.tqh_first->td_pcb->pcb_ebp 324 else 325 echo (not loaded)\n 326 end 327 end 328 set $aproc = $proc.p_list.le_next 329 if ($aproc == 0 && $nproc > 0) 330 set $aproc = zombproc 331 end 332 set $proc = $aproc 333 end 334end 335document btpa 336Show backtraces for all processes in the system. 337end 338 339# Show backtrace for process selected with "defproc" 340define btpp 341btr $myvectorproc->p_threads.tqh_first->td_pcb->pcb_ebp 342end 343document btpp 344Show a backtrace for the process previously selected with 'defproc'. 345end 346 347# Specific stack fram of process selected with "defproc". 348define fr 349set $fno = 0 350set $searching = 1 351set $frame = $myvectorproc->p_threads.tqh_first->td_pcb->pcb_ebp 352while (($searching == 1) && (*(int *) $frame > 0xc0000000)) 353 set $myebp = *(int *) $frame 354 set $myeip = *(int *) ($frame + 4) 355 if ($fno == $arg0) 356 printf " frame %d at %p: ebp %8x, eip ", $fno, $frame, $myebp 357 x/1i $myeip 358 printf "Called from %8x, stack frame at %8x\n", *(int *) ($myebp+4), *(int *) $myebp 359 printf "last 20 local variables:\n" 360 x/20x ($myebp-80) 361 printf "call parameters:\n" 362 x/8x ($myebp+8) 363 set $searching = 0 364 else 365 set $frame = $myebp 366 set $fno = $fno + 1 367 end 368end 369if ($searching == 1) 370 echo frame not found\n 371end 372end 373document fr 374Show the frame of the stack of the process previously selected with 'defproc'. 375end 376