-
-
Notifications
You must be signed in to change notification settings - Fork 784
Description
Is your feature request related to a problem? Please describe.
Currently, gef only correctly displays tcachebins for the main thread. (See screenshot at the bottom for example.)
Describe the solution you'd like
I'd like to upgrade gef to correctly display all tcachebins. I'd like to do this myself, but I think this will actually take a little bit of redesign, so I wanted to get some feedback before starting.
gef lists tcachebins as if they are associated with arenas - they are not. You can't get the address of a tcache from the information an arena gives you because each tcache is allocated (source). (The main thread's tcache is an exception. Since it's allocated early, we can guarantee that it will be at the same offset from the main arena. This is how gef finds tcaches currently.)
So the tcache command should be redesigned to be independent of arenas.
Potential implementation
It's relatively easy to get the address of each tcache using native gdb commands, though they aren't printed in an easy-to-parse output.
thread apply all p (void *) tcache
It gets a little bit more difficult inside gef. gdb.inferiors.threads
will get you all the thread objects, but gdb.InferiorThread
doesn't expose any tcache information. The dumb way is to switch between each thread and get the tcache for each one. Semi-plausible code might look like:
current_thread = gdb.selected_thread()
for thread in gdb.inferiors.thread():
thread.switch()
tcache_addr = gdb.parse_and_eval("tcache")
# all the tcache parsing and printing
current_thread.switch() # restore current thread context
Interface
It seems reasonable to allow the user to 1) allow the user to print all the tcachebins, and 2) print only the tcache bin for a specific thread. The interesting question is what to do when the user types heap bins
. Should we display all the tcachebins? Only the tcachebins for the current thread? None of the tcachebins? My initial preference would be to display the tcachebins for the current thread, but change the title from tcachebins for arena 0xdeadbeef
to tcachebins for thread 1
.
Additional context
Example of gef not displaying tcachebins correctly using heap-non-main-arena.out
. I can find the thread's tcache manually, but gef won't display it.