when checking exploitability rating.
Linux minidumps do not support MD_MEMORY_INFO_LIST_STREAM, meaning the
processor cannot retrieve its memory mappings. However, it has its own
stream, MD_LINUX_MAPS, which contains memory mappings specific to Linux
(it contains the contents of /proc/self/maps). This CL allows the minidump
to gather information from the memory mappings for Linux minidumps.
In addition, exploitability rating for Linux dumps now use memory mappings
instead of checking the ELF headers of binaries. The basis for the change
is that checking the ELF headers requires the minidumps to store the memory
from the ELF headers, while the memory mapping data is already present,
meaning the size of a minidump will be unchanged.
As a result, of removing ELF header analysis, two unit tests have been removed.
Arguably, the cases that those unit tests check do not merit a high
exploitability rating and do not warrant a solid conclusion that was given
earlier.
R=ivanpe@chromium.org
Review URL: https://codereview.chromium.org/1251593007
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@1476 4c0a9323-5329-0410-9bdc-e9ce6186880e
- Convert time_t values to UTC correctly. It is incorrect to cast a uint32_t*
to time_t* because the two types may have different widths. This is the
case on many 64-bit systems, where time_t is a 64-bit signed integer.
Conversion is unified in a single function, and additional uses of time_t
in minidump files not previously displayed in UTC are now displayed.
- Interpret the IMAGE_DEBUG_MISC structure correctly.
- When printing MINIDUMP_SYSTEM_INFO structures, always show the "x86" side
of the union, and state whether it's expected to be valid. (Existing
Breakpad-produced non-Windows minidumps for x86_64 use the "x86" side of
union, but Windows minidumps for x86_64 use the "other" side, so I want to
print both.)
R=ivanpe@chromium.org
Review URL: https://breakpad.appspot.com/5674002
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@1339 4c0a9323-5329-0410-9bdc-e9ce6186880e
Tested with a minidump containing a version 3 structure to validate the string conversion routines. Interestingly enough the time_zone names does not appear to be abbreviation as the documentation was suggesting but full names, e.g. Eastern Standard Time:
MDRawMiscInfo
size_of_info = 232
flags1 = 0xf7
process_id = 0x54c4
process_create_time = 0x51a9323c
process_user_time = 0x1
process_kernel_time = 0x0
processor_max_mhz = 3100
processor_current_mhz = 1891
processor_mhz_limit = 3100
processor_max_idle_state = 0x1
processor_current_idle_state = 0x1
The new fileds follow:
process_integrity_level = 0x1000
process_execute_flags = 0x4d
protected_process = 0
time_zone_id = 2
time_zone.bias = 300
time_zone.standard_name = Eastern Standard Time
time_zone.daylight_name = Eastern Daylight Time
Review URL: https://breakpad.appspot.com/617002
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@1204 4c0a9323-5329-0410-9bdc-e9ce6186880e
doesn't see the correct thread stack memory. Instead, it loads garbage
(from offset 0 of the minidump file - well that's not garbage, but it is
not the stack memory region either) and attempts to walk it. A typical
symptom of this issue is when you get a single stack frame after
processing - the context frame - for which you don't need stack memory.
This issue is caused by an invalid RVA in the memory descriptor stored
inside the MINIDUMP_THREAD structure for the thread. Luckily, the
invalid RVA is 0, and the start_of_memory_region appears to be correct,
so this issue can be easily detected and the correct memory region can be
loaded using an RVA specified in the MinidumpMemoryList.
I couldn't find a reasonable description on MSDN regarding
MINIDUMP_MEMORY_DESCRIPTOR.MINIDUMP_LOCATION_DESCRIPTOR having RVA of 0
except maybe for full dumps where the 64-bit version of the structure
(MINIDUMP_MEMORY_DESCRIPTOR64) is used and it has no RVA at all. It has
a 64-bit DataSize which if interpreted as the 32-bit structure will very
likely result in 0 for the RVA:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms680384(v=vs.85).aspx
Anyways, the dump that I looked at was not a full dump so 0 for RVA is a
bit puzzling (at least easily detectable):
...
Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.
...
User Mini Dump File: Only registers, stack and portions of memory are available
...
MINIDUMP_HEADER:
Version A793 (62F0)
NumberOfStreams 11
Flags 160
0020 MiniDumpWithUnloadedModules
0040 MiniDumpWithIndirectlyReferencedMemory
0100 MiniDumpWithProcessThreadData
Review URL: https://breakpad.appspot.com/606002
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@1194 4c0a9323-5329-0410-9bdc-e9ce6186880e
In order to better distinguish Android and Linux minidumps, introduce
a new MD_OS_ANDROID definition, and modify related source code accordingly.
Also append the build-fingerprint to the minidump location descriptor.
This gives more information about the system image the device runs on.
Review URL: https://breakpad.appspot.com/405002
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@981 4c0a9323-5329-0410-9bdc-e9ce6186880e
Change MinidumpModuleList::GetMainModule() to use GetModuleAtIndex() instead
of GetModuleAtSequence() because the former gets the first module that was
in the minidump file, while the latter actually gets the first module when
sorted by address. While this is pretty much the same thing at the moment,
I have another change in the works that can sometimes affect the module
order in the file.
BUG=chromium-os:25355
TEST=Ran Breakpad tests
Review URL: https://breakpad.appspot.com/366001
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@941 4c0a9323-5329-0410-9bdc-e9ce6186880e
The value of MD_CONTEXT_CPU_MASK in use assumes that only the lower 6 bits are used for flags, and the upper 26 bits are for the CPU type. However, as of Windows 7 SP1, the 7th bit is being used as a flag (per http://msdn.microsoft.com/en-us/library/hh134238%28v=vs.85%29.aspx and the Windows SDK headers). Adjusting MD_CONTEXT_CPU_MASK works, but unfortunately that masks off the existing value of MD_CONTEXT_ARM. This patch also changes the value of MD_CONTEXT_ARM and adjusts the minidump context reading machinery to gracefully handle minidumps with the old value.
R=mark at http://breakpad.appspot.com/302001
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@831 4c0a9323-5329-0410-9bdc-e9ce6186880e
This patch avoids unnecessary use of the <cfoo> headers in files that don't
actually use the identifiers they declare in the std:: namespace.
It also changes some files to better conform with the "Names and Order of
Includes" rules in the Google C++ Style Guide.
A=jimb R=mark
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@619 4c0a9323-5329-0410-9bdc-e9ce6186880e
We've gotten mixed advice from the lawyery types about whether this
matters. But it's easy enough to do.
a=jimblandy, r=nealsid
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@517 4c0a9323-5329-0410-9bdc-e9ce6186880e
In order to be able to treat any MemoryRegion as const, the accessor
functions need to be declared this-const, which means annotations on
all the subclasses, etc. etc.
Since MinidumpMemoryRegion fills its memory_ member on demand, that
member needs to be marked 'mutable', but this is exactly the sort of
situation the 'mutable' keyword was intended for, so that seems all
right.
a=jimblandy, r=nealsid
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@509 4c0a9323-5329-0410-9bdc-e9ce6186880e
src/processor/minidump.cc:1067: warning: format ‘%llx’ expects type ‘long long unsigned int’, but argument 3 has type ‘unsigned int’
src/processor/stackwalker_arm.cc:83: warning: unused variable ‘last_frame’
src/processor/minidump_stackwalk.cc:163: warning: ‘trust_name’ may be used uninitialized in this function
a=jimblandy, r=ted.mielczarek
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@481 4c0a9323-5329-0410-9bdc-e9ce6186880e
This patch avoids comparisons between signed and unsigned values, as
warned about by G++ 4.4.1.
a=jimblandy, r=nealsid
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@469 4c0a9323-5329-0410-9bdc-e9ce6186880e
- Introduces a standard API for dealing with modules. MinidumpModule
is now a concrete implementation of this API. Code may interact with
single modules using the CodeModule interface, and collections of
modules using its container, the CodeModules interface.
- CodeModule is used directly by SymbolSupplier implementations and
SourceLineResolver. Reliance on the specific implementation in
MinidumpModule has been eliminated.
- Module lists are now added to ProcessState objects. Module references
in each stack frame are now pointers to objects in these module lists.
- The sample minidump_stackwalk tool prints the module list after printing
all threads' stacks.
http://groups.google.com/group/airbag-dev/browse_frm/thread/a9c0550edde54cf8
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@74 4c0a9323-5329-0410-9bdc-e9ce6186880e
- MinidumpProcessor now processes all threads and returns a new ProcessState
object. (Interface change.)
- ProcessState contains a CallStack for each thread in the process, and
additional information about whether the process crashed, which thread
crashed, the reason for the crash, and identifying attributes for the
OS and CPU.
- MinidumpSystemInfo now contains a GetCPUVendor() method that returns the
vendor information from CPUID 0 on x86 processors ("GenuineIntel").
http://groups.google.com/group/airbag-dev/browse_thread/thread/16dd2c981e3361ba
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@47 4c0a9323-5329-0410-9bdc-e9ce6186880e
- In class definitions, one-space indent for public/protected/private.
- Multi-line initializer format puts comma at end of line.
Also:
- Eliminate the long list of friends in Minidump by making swap() public.
(People who need to access unknown stream types directly will need
access to swap() too.)
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@16 4c0a9323-5329-0410-9bdc-e9ce6186880e
- Use gmtime (UTC) instead of localtime for human-readable presentation of
(MDRawHeader).time_date_stamp.
git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@15 4c0a9323-5329-0410-9bdc-e9ce6186880e
