1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
|
#!/bin/sh -eu
#
# Copyright © 2024 Samuel Lidén Borell <samuel@kodafritt.se>
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
#
if [ $# = 0 ]; then
cat <<EOF
usage: $0 PROGRAM [ARGUMENTS]...
This little script allows a buggy program to be stopped just before it
crashes, in the start of the function that crashes (or optionally, in
any other function in a call stack given in the TRACKED_FUNC environment
variable).
This is useful in the following circumstances:
* When you have a crashing program, and
* it crashes on a large input, that makes reverse-execution too slow, and
* the crashing function is called multiple times (so you can just simply
set a plain breakpoint on it).
NOTE: It only works for deterministic and non-interactive programs!
Environment variables (optional):
- TRACKED_FUNC: Overrides the function in the call chain to stop at.
- STEPS_BEFORE: Allows stopping several steps/calls before the crash.
EOF
exit 0
fi
export LC_ALL=C.UTF-8
export LANG=C.UTF-8
: ${TRACKED_FUNC:=}
: ${STEPS_BEFORE:=1}
# a large value that is used for the ignore count for a breakpoint
very_large_number=999999999
filter_bt() {
case "$1" in
# Ignore __GI___assert_fail etc.
"#"*__*)
;;
*)
func="${1#* in }"
func="${func%% *}"
if [ -z "$TRACKED_FUNC" ]; then
TRACKED_FUNC="$func"
found_tracked_func=1
#echo "TRACKED_FUNC:$func"
elif [ "x$func" = "x$TRACKED_FUNC" ]; then
found_tracked_func=1
fi
printf "%s\n" "$1";;
esac
}
read_response() {
while read -r line; do
#echo "line=$line"
case "$line" in
"(gdb)")
break;;
"*running"*)
status=running;;
"*stopped"*"reason=\"exited-normally\""*)
status=exited;;
"*stopped"*"reason=\"signal-received\""*)
status=signal;;
"*stopped"*"reason=\"breakpoint-hit\""*)
status=breakpoint;;
"*stopped"*)
status=stopped;;
"^done,BreakpointTable="*)
if [ "x$line" = "x${line#*times=\"}" ]; then
echo "Error: No breakpoint in BreakpointTable" >&2
exit 1
fi
times=${line#*times=\"}
times=${times%%\"*};;
"^error"*)
msg=${line#*msg=\"}
msg=${msg%\"}
echo "Error from GDB: $msg" >&2
exit 1;;
"~\"#"*)
if [ $show_bt = 1 ]; then
btline=${line#~\"}
btline=${btline%\\n\"}
filter_bt "$btline"
fi
esac
done
}
wait_for_stop() {
while [ $status = running ]; do
read_response
done
}
cmd() {
echo "$@" >&3
read_response
}
status() {
#printf '\033[1K%s' "$1" 2>&1
printf '%s\n' "$1" 2>&1
}
handle_commands() {
status=none
show_bt=0
found_tracked_func=0
status "First run (analysis)..."
read_response
cmd -exec-run
wait_for_stop
if [ $status = exited ]; then
echo "No crash"
exit 0
fi
show_bt=1
# TODO should probably use `-stack-list-frames` for parsing info (but `bt` for output)
cmd bt
show_bt=0
if [ $found_tracked_func = 0 ]; then
echo "Tracked function '$TRACKED_FUNC' not found" >&2
exit 2
fi
cmd -break-insert -i "$very_large_number" --function "$TRACKED_FUNC"
status "Second run (to breakpoint)..."
cmd -exec-run
wait_for_stop
#status ""
cmd -break-info
cmd -gdb-exit
printf "%s %s\n" $times $TRACKED_FUNC > "$resultfile"
}
cleanup() {
[ ! -e "$resultfile" ] || rm "$resultfile"
[ ! -e "$fifo" ] || rm "$fifo"
[ ! -d "$fifodir" ] || rmdir "$fifodir"
}
fifodir=$(mktemp -d beforecrash_XXXXXX --tmpdir)
fifo="$fifodir/gdb_input_fifo"
resultfile="$fifodir/result"
trap 'cleanup' EXIT
mkfifo "$fifo" || {
echo "Failed to create fifo '$fifo'" >&2
exit 1
}
# Determine number of times that the TRACKED_FUNC function
# was executed before the crash.
gdb -q --interpreter=mi2 --args "$@" <"$fifo" | handle_commands 3>"$fifo"
if [ ! -e "$resultfile" ]; then
# E.g. a non-crashing program. Abort early
exit
fi
read -r bp_times TRACKED_FUNC <"$resultfile"
#echo "times: $bp_times"
bp_times=$(($bp_times - $STEPS_BEFORE))
# Run until the last function call before the crash
gdb -q -ex "break $TRACKED_FUNC" -ex "ignore 1 $bp_times" -ex "run" --args "$@"
|
