Move vspace to option in isc command, adding custom addresses as positional arguments #6
Loading…
Reference in New Issue
No description provided.
Delete Branch "Dr-Carlos/fxos:isc"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Hello!
In these two commits, I have changed the syntax of
isc
fromisc [sort=true] [<vspace>]
toisc [sort=true] [vspace=<virtual_space>] [<address>...]
.vspace behaves as it should (there was a comment saying that it didn't work, but it works now), specifying the virtual space to calculate information in.
By default,
isc
still prints info for all syscalls, but if address(es) are provided, the command prints information on these instead. The original use case is that you can find out what syscall an adddress fromic
comes from, but there are many other uses.Example outputs:
I think this makes
isc
much more useful - future ideas that could be implemented are being able to print the syscall name, and being able to select which piece(s) of information you want.57e41ad913
to4d44180a27
Although the errors raised in
isc
are not in the parsing function, I have changed them to use FxOS_log at ERR level as well - as you said you were trying to get rid of errors in fxos.This is indeed super useful, that's exactly the direction these commands should take. Other options include filtering by name or wildcard, which would also be useful for symbols (I guess we could have a generic symbol query tool,
is
would use it, andisc
would use it + filter syscalls only).I can test this later today. Maybe a nitpick, but I'd rather perform symbol queries to fill the vector than materialize every entry and then remove the useless ones. This would be faster in almost every case, and also enrich the symbol query API, which can only be useful later.
2eb893b77a
toe037d5889c
I agree with changing the remove. I have changed this to use os->syscall_at to find the syscall entry for every item instead of removing the useless ones.
It also now prints %1 instead of %001 or %0001 when given addresses. I thought it made more sense, but what do you think?
@ -175,3 +178,2 @@
return;
// TODO: is <vspace_name> doesn't work
if(!space) {
This condition could also be triggered by
isc
with no argument and no current vspace. I'm not sure how legitimate "no current vspace" is, maybe we should just guarantee that there is always one. Currently the only way to not have one is to not load a file and have a useless fxosrcValid point - I added a check after getting the current vspace. If there is no space there, nothing is selected and we should exit.
@ -182,0 +185,4 @@
if(!os) {
if(!vspace_name.empty())
FxOS_log(ERR, "OS analysis on '%s' failed", vspace_name);
FxOS_log(ERR, "OS analysis failed");
I guess an
else
is missing here?Very cool! Thanks again. Another minor detail is
sort=true
is not honored with explicit aguments; but that's not blocking.I'll merge the PR probably tonight, and "fix" the details left at the same time.
Edit: you should resolve the vspace name at parsing time like in
e
so that symbol names can be interpreted properly:Yep, fixed. What are you referring to with
sort=true
?Sweet. Here's what I mean with
sort=true
:As you can see despite setting
sort=true
the entries are presented in argument order and not sorted. ^^Ah, thanks. I forgot about this when I changed it to search the addresses instead of remove_if. Fixed!
Slightly late, but there you go!