Skip to content

Instantly share code, notes, and snippets.

@quarnster
Created April 5, 2014 13:47
Show Gist options
  • Save quarnster/9992193 to your computer and use it in GitHub Desktop.
Save quarnster/9992193 to your computer and use it in GitHub Desktop.
small lldb script to print out details when sigaction is called
# lldb -o "script lldb.target" -o "command script import ./regs.py" -o "r" -o "c" python -- -c "print 'hello'"
# lldb -o "script lldb.target" -o "command script import ./regs.py" -o "r" -o "c" java Hello
import lldb
import re
r = re.compile("#define\s+(SIG[^_\s]+)\s+(\d+)")
f = open("/usr/include/sys/signal.h", "r")
sigs = dict(map(lambda a: (int(a.group(2),10), a.group(1)), map(r.search, filter(r.match, f.readlines()))))
f.close()
first = True
def breakpoint_callback(frame, bp_loc, dict):
global first
if first:
first = False
# Just so that we can cast to struct sigaction
lldb.target.AddModule("./hack.o", "", "", "")
gpr = frame.registers["General Purpose Registers"][0]
rdi = gpr.GetChildMemberWithName("rdi").GetValueAsUnsigned()
rsi = gpr.GetChildMemberWithName("rsi").Cast(frame.thread.process.target.FindFirstType('struct sigaction').GetPointerType()).GetChildMemberWithName("__sigaction_u").GetChildMemberWithName("__sa_handler")
if rsi.GetValueAsUnsigned() != 0:
print "Installed a new signal handler for signal: %s: %s" % (sigs[rdi], "ignore" if rsi.GetValueAsUnsigned() == 1 else rsi)
return False
bt = lldb.target.BreakpointCreateByName("sigaction")
dbg = lldb.target.GetDebugger()
dbg.HandleCommand("break command add -F regs.breakpoint_callback %s" % bt.GetID())
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment