1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
# gdb script: catch where a hanging/failing cuCtxCreate goes.
#
# Arms the libcuda 999-scanner sites (FUN_0054fa00 entry/999/0x2cf returns)
# plus cuCtxCreate (symbol), then:
# - at the first stop: dump RIP, backtrace and, if it is a scanner frame,
# the RM error record chain (rdi -> ctx -> ctx[0x1291] -> +0x10 -> +0x10);
# - then `finish` to capture the return value (rax) of whatever frame it
# stopped in, and a backtrace of the caller.
# Use with a cdt that holds on failure (CDT_HOLD=<s>) so the state survives.
# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/ctx999.py
import gdb
out = gdb.execute("info proc mappings", to_string=True)
base = None
for line in out.splitlines():
if "libcuda" in line and "r-xp" in line:
f = line.split()
base = int(f[0], 16) - int(f[3], 16)
break
print("BASE=0x%x" % (base or 0))
if base is None:
print("NO_LIBCUDA_MAPPING")
raise SystemExit
gdb.execute("set pagination off")
gdb.execute("set confirm off")
for off in (0x44fa00, 0x44fb80, 0x44fb6c):
gdb.execute("break *0x%x" % (base + off))
try:
gdb.execute("break cuCtxCreate")
except gdb.error as e:
print("break cuCtxCreate: %s" % e)
try:
gdb.execute("continue")
except gdb.error as e:
print("CONTINUE_ERR %s" % e)
print("STOPPED")
try:
rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
print("RIP=0x%x off=0x%x" % (rip, rip - base))
except Exception as e:
print("rip_fail %s" % e)
try:
print(gdb.execute("info registers rdi rsi rax", to_string=True))
except Exception:
pass
try:
print(gdb.execute("bt 12", to_string=True))
except Exception as e:
print("bt_fail %s" % e)
def rd64(addr):
try:
return int(gdb.parse_and_eval("*(unsigned long *)0x%x" % addr)) & 0xffffffffffffffff
except Exception:
return None
def rd32(addr):
try:
return int(gdb.parse_and_eval("*(unsigned int *)0x%x" % addr)) & 0xffffffff
except Exception:
return None
try:
p1 = int(gdb.parse_and_eval("$rdi")) & 0xffffffffffffffff
ctx = rd64(p1)
print("param_1=0x%x ctx=0x%x" % (p1, ctx or 0))
if ctx:
mgr = rd64(ctx + 0x1291 * 8)
print("mgr=0x%x" % (mgr or 0))
if mgr:
for mo in (0x0, 0x8, 0x10, 0x18, 0x38):
print(" mgr[+0x%x]=0x%x" % (mo, rd64(mgr + mo) or 0))
reg = rd64(mgr + 0x10)
print("reg=0x%x" % (reg or 0))
if reg:
rec = rd64(reg + 0x10)
print("rec=0x%x" % (rec or 0))
if rec:
for i in range(0, 0x28, 4):
print(" rec[+0x%02x]=0x%08x" % (i, rd32(rec + i) or 0))
except Exception as e:
print("record_dump_fail %s" % e)
try:
gdb.execute("finish")
print("FINISHED")
print(gdb.execute("info registers rax", to_string=True))
except gdb.error as e:
print("finish_err %s" % e)
except Exception as e:
print("finish_other %s" % e)
try:
print(gdb.execute("bt 12", to_string=True))
except Exception:
pass
try:
gdb.execute("detach")
except Exception:
pass
|
