1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
# gdb script: split the failing ucode image create (FUN_003e99d0).
#
# Run #9: FUN_00e21850 -> FUN_003e99d0 returned 1 for the membar-WAR blob.
# FUN_003e99d0 (file 0x2e99d0) calls FUN_003d1e70 (blob parse) at 0x2e9a1e
# and on success FUN_003e90c0 at 0x2e9a3a; break after each and stop on the
# first non-zero status.
#
# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz9.py
import gdb
import time
out = gdb.execute("info proc mappings", to_string=True)
base = None
for line in out.splitlines():
if "libcuda" in line and "r-xp" in line:
f = line.split()
base = int(f[0], 16) - int(f[3], 16)
break
print("BASE=0x%x" % (base or 0))
if base is None:
raise SystemExit
gdb.execute("set pagination off")
gdb.execute("set confirm off")
SITES = [
(0x2e9a23, "PARSE_RET"),
(0x2e9a3f, "CREATE2_RET"),
]
for off, name in SITES:
gdb.execute("break *0x%x" % (base + off))
t0 = time.time()
for hit in range(60):
try:
gdb.execute("continue")
except gdb.error as e:
print("CONTINUE_END %s" % e)
break
rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
off = rip - base
name = dict(SITES).get(off, "?")
eax = int(gdb.parse_and_eval("$eax")) & 0xffffffff
print("HIT t=%.3f off=0x%x %s eax=0x%x" % (time.time() - t0, off, name, eax))
if eax != 0:
print(" >>> FAILED STEP %s status=0x%x" % (name, eax))
try:
print(gdb.execute("bt 10", to_string=True))
except Exception as e:
print("bt_fail %s" % e)
break
try:
gdb.execute("detach")
except Exception:
pass
|
