Re: instructions logged by Intel PT not always in the address range of NT_FILES

I guess that in coredump generated by `gcore`, there is a missing
segment item which contains:

    0xb7e1e740 - 0xb7f476dd is .text in /lib/i386-linux-gnu/libc.so.6

The above line is from `info files` when I did `gdb exec coredump`.

--
My best regards to you.

     No System Is Safe!
     Dongliang Mu


2016-09-18 23:47 GMT-04:00 慕冬亮 <[email protected]>:
> Dear all,
>
> When I did experiment about instructions logged by Intel PT, I found
> an problem: instructions logged by Intel PT are not always in the
> NT_FILES(executable, libraries) of coredump.
>
> I was using the following gdb script to log executed instructions and
> generate coredump:
>
> set pagination off
> set logging on
> set disassembly-flavor intel
> b _start
> r AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> record btrace pt
> continue
> gcore core         <= gcore to generate codeump, maybe the problem, not sure.
> info record
> set record instruction-history-size unlimited
> record instruction-history
> quit
>
> $ readelf -n core (Get all the address range of NT_FILES)
> ......
> Page size: 1
>          Start         End Page Offset
>     0x08048000  0x08049000  0x00000000
>         /home/mdl/Work/testsuites/simple2/simple
>     0x08049000  0x0804a000  0x00000000
>         /home/mdl/Work/testsuites/simple2/simple
>     0xb7fb4000  0xb7fb6000  0x001ac000
>         /lib/i386-linux-gnu/libc-2.23.so
>     0xb7fb6000  0xb7fb7000  0x001ae000
>         /lib/i386-linux-gnu/libc-2.23.so
>     0xb7fdb000  0xb7ffd000  0x00000000
>         /lib/i386-linux-gnu/ld-2.23.so
>     0xb7ffe000  0xb7fff000  0x00022000
>         /lib/i386-linux-gnu/ld-2.23.so
>     0xb7fff000  0xb8000000  0x00023000
>         /lib/i386-linux-gnu/ld-2.23.so
>
> When I checked the executed instructions, I found there are
> instructions whose address is not in those NT_FILES. For example,
> 0xb7e1f5f3 <__libc_start_main+243>:  call   DWORD PTR [esp+0x70]
>
> However, this instruction is from __libc_start_main function that
> should be in libc library.
>
> I don't know what is problem. If I said something wrong, please correct me.
>
> --
> My best regards to you.
>
>      No System Is Safe!
>      Dongliang Mu