Re: How to get value of gs:0xc with LTS note in coredump?

2016-10-03 21:20 GMT-04:00 Jan Kratochvil <[email protected]>:
> On Tue, 04 Oct 2016 02:59:45 +0200, 慕冬亮 wrote:
>> I have a question about gs and TLS in core dump. When I read the
>> assembly code from one coredump, there is one memory dereference :
>> gs:[edx] or gs:0xc.
>>
>> I googled gs register and found it points to Thread Local Storage.
>> However, gs is a selector to GDT and this structure is in the kernel.
>> And I could not obtain it in coredump.
>
> %gs on i386 (and %fs on x86_64) points to pthread_self() which is
> 'struct pthread *' (if you have glibc debug info available) where at offset 0xc
> is 'void *self' which is the pthread_self() pointer itself (%gs:0xc is faster
> to access).
>
>
>> Then I searched all the segments in core dump. I found a note entry
>> with type NT_386_TLS, length 0x30. Is gs:0xc in this note ? And gs:0xc
>> is the 12th element of this note entry?
>
> Yes, pthread_self() is coincidentally also the value of %gsbase (%fsbase on
> x86_64) but GDB cannot show that register, in a core file you can see it by
> "eu-readelf -n" (from elfutils, "readelf -n" from binutils does not show it)
> as:
>   LINUX                 48  386_TLS
>     index: 12, base: 0xf7778800, limit: 0x000fffff, flags: 0x00000051
>                      ^^^^^^^^^^=pthread_self()
>

I need to analyze this note entry in my C code. How is it arranged by
kernel or gdb?
And what's the data structure for every item in this entry?

LINUX                 48  386_TLS
    index: 6, base: 0xb7fd57c0, limit: 0x000fffff, flags: 0x00000051
    index: 7, base: 0x00000000, limit: 0x00000000, flags: 0x00000028
    index: 8, base: 0x00000000, limit: 0x00000000, flags: 0x00000028

The above is output from "eu-readelf -n  mycore".

--
My best regards to you.

     No System Is Safe!
     Dongliang Mu


>
> Jan