Re: How to get value of gs:0xc with LTS note in coredump?

On Tue, 04 Oct 2016 02:59:45 +0200,  wrote:
> I have a question about gs and TLS in core dump. When I read the
> assembly code from one coredump, there is one memory dereference :
> gs:[edx] or gs:0xc.
> 
> I googled gs register and found it points to Thread Local Storage.
> However, gs is a selector to GDT and this structure is in the kernel.
> And I could not obtain it in coredump.

%gs on i386 (and %fs on x86_64) points to pthread_self() which is
'struct pthread *' (if you have glibc debug info available) where at offset 0xc
is 'void *self' which is the pthread_self() pointer itself (%gs:0xc is faster
to access).


> Then I searched all the segments in core dump. I found a note entry
> with type NT_386_TLS, length 0x30. Is gs:0xc in this note ? And gs:0xc
> is the 12th element of this note entry?

Yes, pthread_self() is coincidentally also the value of %gsbase (%fsbase on
x86_64) but GDB cannot show that register, in a core file you can see it by
"eu-readelf -n" (from elfutils, "readelf -n" from binutils does not show it)
as:
  LINUX                 48  386_TLS
    index: 12, base: 0xf7778800, limit: 0x000fffff, flags: 0x00000051
                     ^^^^^^^^^^=pthread_self()


Jan