March 2011 - Darwin-kernel - lists.apple.com

Re: cannot access memory errors with gdb
by Paul Nelson 09 Mar '11

09 Mar '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com You did not show show how you ran gdb. Are you running gdb -arch i386 /Volumes/KernelDebugKit/mach_kernel ? Paul On Mar 9, 2011, at 4:38 PM, mogambo wrote: > Hi there, > > I am triaging a kernel crash caused by our vfs plugin. For some reason, the corefile was never saved on the panic server, but I have the panic log. So, I looked up the load address (0x49ea8000) of the extension from the following line in the panic log. > > Kernel Extensions in backtrace (with dependencies): > com.company.kext.fsd(2.5)@0x49ea8000->0x49f65fff > > I ran the command to generate the symbol file with that load address: ./createsymbolfiles -s <sympath> fsd.kext > > I loaded the symbol file in gdb and tried to decipher the panic log: > > (gdb) add-symbol-file symbols/com.company.kext.fsd.sym > : > (gdb) add-symbol-file /Volumes/KernelDebugKit/mach_kernel > : > (gdb) x/i 0x49f1e3b1 > 0x49f1e3b1 <fsrwIssueRead+1663>: Cannot access memory at address 0x49f1e3b1 > : > (gdb) disass fsrwIssueRead > Dump of assembler code for function fsrwIssueRead: > 0x49f1dd32 <fsrwIssueRead+0>: Cannot access memory at address 0x49f1dd32 > > The OS X version is; > apple$ sw_vers > ProductName: Mac OS X > ProductVersion: 10.6.4 > BuildVersion: 10F569 > apple$ uname -a > Darwin MacProQA16.local 10.4.0 Darwin Kernel Version 10.4.0: Fri Apr 23 18:28:53 PDT 2010; root:xnu-1504.7.4~1/RELEASE_I386 i386 > > apple$ file /System/Library/Extensions/fsd.kext/Contents/MacOS/fsd > /System/Library/Extensions/fsd.kext/Contents/MacOS/fsd: Mach-O universal binary with 2 architectures > /System/Library/Extensions/fsd.kext/Contents/MacOS/fsd (for architecture ppc): Mach-O object ppc > /System/Library/Extensions/fsd.kext/Contents/MacOS/fsd (for architecture i386): Mach-O object i386 > apple$ file newsym/com.company.kext.fsd.sym > newsym/com.company.kext.fsd.sym: Mach-O object i386 > > Am I missing something? I am pretty sure I have done this before to debug a kernel crash. > > Thanks for your help. > -m. > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/nelson%40thursby.com > > This email sent to nelson(a)thursby.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

cannot access memory errors with gdb
by mogambo 09 Mar '11

09 Mar '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:date:message-id:subject:from:to :content-type; bh=1aI+v3gP4rR2ttQlOYnu/KSTTaQ2jEQNwXkd9430vWk=; b=N8th12gYViIbwXkjPLz3U4u4nbBKr6l7QUsxT4OqgRXbjIGQIw9IorL2zapJIZg2h+ 4N+l7qEUs2ZbPDWkINw98fuDtdUao6A1LDRusCW6J8IylIORbfRDvC60MEij22SA71Tf decolB4VzjLsAaKx03Ai0Nmiv/w6nBfJucOXc= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=xFOPTpCtfvW2JnzYosj4KW0vFHFtU8hkw++cyy6X3L5kDipFzMsNjM9UqhBqJTPdxo mBOaOKAh5xEz3CQs4Hdc7QLUDTXfZvEd4Gba1EpQcpuGWr0Y+hkqlkt4wAfPmekhvWQ0 agfJ9cu6Jx5n8H4tDxXtHguLfyPCS9z6XxdJk= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Porting from Windows to MAC related issues...
by sheetal phirke 07 Mar '11

07 Mar '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.co.in; s=s1024; t=1299474730; bh=Lptu2FuNQwQxjZ9CO+fIEBS+Bx+Uh0qP1AranD45bfA=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=R5d9c9N6RBDLfjQzkxQXI4TuAlgpLlJRHX3b/t/+KiiRP5QHBx4zKHMwDLYQ5t3GQjyJCHNu40k6dtq74QzQw8iAZPcK3aMACAFuLoRw0DLhyt8z6snn/+HtZwrRp361+UpwXx8gYarwwhDYur5HJhW4uDRTXwt/DHiN/sfyDC4= Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.co.in; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=2x6qUpCKysFHHKXNZRixJJUGpCqwaK5qrkd/FkBvnD0k8PnjR73k1pNUzwXFp/4gpB9ysry1tmjpJqXa3JaFS3SlFgch2i2bF+nx7JwNqXleC7HA+UuhyHB+NFWc/yPUskJhiBE5L8xrgJvN3403ffQRms6o17hikTvEGrrXN2U=; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Inspecting kernel memory
by snare+darwin-kernel＠ragequ.it 06 Mar '11

06 Mar '11

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Sure. I'm adapting some code written by Dino Dai Zovi for the 10.5 kernel to scan VM regions and find Mach-O objects loaded into kernel memory as a means of identifying potentially malicious code. It's purely a proof of concept and an exercise in understanding the kernel VM system, not something I'm going to release or expecting to work with future kernel versions. - snare On 06/03/2011, at 7:45 PM, Alexander von Below wrote: > Would you mind explaining it to the rest? I am not saying you are doing something bad, but perhaps something that is prone to break with even a minor update of the core > > Alex > > Von meinem iPhone gesendet > > Am 06.03.2011 um 04:25 schrieb snare+darwin-kernel(a)ragequ.it: > >>> I won't ask what you are trying to do, since there is no legitimate use for inspecting kernel memory. >> >> If you say so. I won't explain why you're wrong since you seem convinced I'm doing something bad. >> >> - snare. >> _______________________________________________ >> Do not post admin requests to the list. They will be ignored. >> Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) >> Help/Unsubscribe/Update your Subscription: >> http://lists.apple.com/mailman/options/darwin-kernel/below%40mac.com >> >> This email sent to below(a)mac.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Inspecting kernel memory
by Alexander von Below 06 Mar '11

06 Mar '11

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Would you mind explaining it to the rest? I am not saying you are doing something bad, but perhaps something that is prone to break with even a minor update of the core Alex Von meinem iPhone gesendet Am 06.03.2011 um 04:25 schrieb snare+darwin-kernel(a)ragequ.it: >> I won't ask what you are trying to do, since there is no legitimate use for inspecting kernel memory. > > If you say so. I won't explain why you're wrong since you seem convinced I'm doing something bad. > > - snare. > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/below%40mac.com > > This email sent to below(a)mac.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Inspecting kernel memory
by snare+darwin-kernel＠ragequ.it 06 Mar '11

06 Mar '11

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Inspecting kernel memory
by Shantonu Sen 05 Mar '11

05 Mar '11

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Inspecting kernel memory
by snare+darwin-kernel＠ragequ.it 05 Mar '11

05 Mar '11

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

AUTO: Arunasree Swapna (returning 03/07/2011)
by Arunasree_Swapna＠logitech.com 05 Mar '11

05 Mar '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Porting from Windows to MAC related issues...
by David Gatwood 04 Mar '11

04 Mar '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Mar 4, 2011, sheetal phirke wrote: > We want to port a product from Windows to MAC. We are new to mac, we have > Windows experience. > After doing certain analysis we have list of queries such as : * Character set > support for UNICODE (like we use wchar in windows) > * How can we avoid string related buffer overflows? ( similar to string safe > functions in windows) > * Is there any support for Exporting functions using ordinals? > * Are there any porting related issues for 64 bit platform? > * We have various file related operations, so if we decide to use POSIX > functions which provides only interface for character (char *), there will be a > need for conversion of wide char path to char each time. Is there any feasible > solution for it? > * Can all these issues be resolved if we go with Objective C (Cocoa framework) Are we talking about a driver here? If not, you're on the wrong mailing list. Assuming you mean an application: 1. For wide characters, although Mac OS X does provide wchar, most folks working with them on the Mac side tend to prefer the CFString/NSString functionality. YMMV. 2. Depends on what API you're using. With CFString and NSString, you get this for free. For C strings, we generally recommend the "l" variants, e.g. strlcat, strlcpy, etc., but Mac OS X also provides the 'n' variants. 3. Not to my knowledge. AFAIK, a function must be exported by name. 4. Yes, there are lots of 64-bit-specific things to pay attention to; not all APIs are available in a 64-bit environment. See 64-bit Transition Guide on developer.apple.com and the docs that it links to for more information. 5. Mac OS X's POSIX functions take UTF-8 strings. I'm not aware of any way around having to convert to UTF-8. 6. If you use NSString/CFString instead of wchar, then probably, yes. In all of the above answers, I'm assuming that you're talking about an application here and not kernel code. If you really are talking about a kernel extension, then the answers are: 1. No. The kernel does not provide any wide character support internally, period. As far as the kernel is concerned, filenames are a bag of bytes. 2. Same as #2 in the previous list. 3. Same as #3 in the previous list. 4. same as #4 in the previous list. 5. Again, no support for wchar in the kernel, so you'll have to do that conversion before you pass it up to the kernel from your application. Also, POSIX file operations are not supported in the kernel, so if that's what you're trying to do, you're in for a significant re-architecting of your code. 6. Cocoa and friends are not supported in the kernel. David _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0