blob: 6a0c23df54420056605de2e37c23e3f8d48a5fce (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
import gdb
gr = gdb.execute
inf = gdb.selected_inferior()
pid = inf.pid
base = None
for line in open("/proc/%d/maps" % pid):
parts = line.split()
try:
lo, hi = [int(x,16) for x in parts[0].split('-')]
except Exception:
continue
if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
base = lo
print("BASE 0x%x" % (base or 0))
class B(gdb.Breakpoint):
def __init__(self):
super().__init__("*0x%x" % (base + 0xB33D30), internal=False)
self.silent = True; self.done = False
def stop(self):
if self.done:
return True
self.done = True
try:
obj = int(gdb.parse_and_eval("$rdi"))
n = int(gdb.parse_and_eval("$rsi"))
print("RETRYFN obj=0x%x n=0x%x" % (obj, n))
cnt = int(gdb.parse_and_eval("*(unsigned int*)0x%x" % (obj + 0x22efc)))
print("CNT %d" % cnt)
wrote = 0
for i in range(0, min(cnt, 32)):
p = int(gdb.parse_and_eval("*(unsigned long*)0x%x" % (obj + 0x1428 + i*8)))
if not p:
continue
tgt = p + n * 0x10
try:
v16 = int(gdb.parse_and_eval("*(unsigned short*)0x%x" % (tgt + 0xe)))
v0 = int(gdb.parse_and_eval("*(unsigned int*)0x%x" % tgt))
print("E%d ptr=0x%x tgt=0x%x w0=0x%x w16e=0x%x" % (i, p, tgt, v0, v16))
if v16 == 0xffff:
gr("set {unsigned short}0x%x = 0" % (tgt + 0xe))
gr("set {unsigned int}0x%x = 0" % tgt)
gr("set {unsigned short}0x%x = 0" % (tgt + 0xc))
wrote += 1
except Exception as e:
print("E%d fail %s" % (i, e))
print("CLEARED %d" % wrote)
gr("detach")
except Exception as e:
print("fail %s" % e)
return True
try:
B()
print("BP-SET")
gr("continue")
except Exception as e:
print("bpfail %s" % e)
print("T92-DONE")
|
