import gdb, sys inf = gdb.selected_inferior() pid = inf.pid base = None for line in open("/proc/%d/maps" % pid): if "libnvidia-eglcore.so.570.144" in line: parts = line.split() lo, hi = [int(x, 16) for x in parts[0].split('-')] off = int(parts[2], 16) if off == 0: base = lo break if base is None: print("EGLBASE not found"); gdb.execute("detach"); sys.exit(1) COUNT = base + 0x2070b7c print("EGLBASE 0x%x PID %d COUNT_ADDR 0x%x" % (base, pid, COUNT)) def rd(a, n): return inf.read_memory(a, n).tobytes() def u32(a): return int.from_bytes(rd(a, 4), 'little') state = {"n": 0} class B(gdb.Breakpoint): def __init__(self, spec, limit=100000): super().__init__(spec, internal=False) self.limit = limit; self.hits = 0 self.silent = True def stop(self): self.hits += 1 try: v = u32(COUNT) if v: state["n"] += 1 if state["n"] <= 8: print("CLEAR count %u -> 0 (hit %d)" % (v, self.hits)) gdb.execute("set {unsigned int}0x%x = 0" % COUNT) except Exception as e: print("ERR", e) return self.hits >= 400 B("*0x%x" % (base+0xa85d24), 400) try: gdb.execute("continue") except gdb.error as e: print("CONT-ERR %s" % e) except KeyboardInterrupt: pass print("TRACE-END clears=%d" % state["n"]) try: gdb.execute("detach") except gdb.error as e: print("DETACH-ERR %s" % e) gdb.execute("quit")