jexplore-scan.cpp

#include <iostream>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <string>
#include <sstream>
#include <fstream>
#include <sys/wait.h>
#include <sys/types.h>
#include <map>
#include <vector>
#include <algorithm>

#define _FILE_OFFSET_BITS 64

std::string help = "USAGE ./jexplore-scan -[f|s|c] coredump vtable-file|vtable-addr section1 [section2 ...]\n"
"\n"
"Program scans the coredump file searching for occurences of vptrs for respective polymorphic classes.\n"
"The address of vptr is calculated as vtable address + 0x10 (can be checked with -fdump-class-hierarchy g++ flag).\n"
"\n"
"Program has three modes: -f(default), -s, -c.\n"
"1) In the full mode the occurences of vptrs are printed as '0xaddress classname(vtable address if no typename available)'.\n"
"2) In the stats mode the number of occurences for each type is printed in sorted order to stderr.\n"
"3) Combined mode is the same as full, only that stats are written as in -s mode to stderr.\n"
"Instead of -stat, you can write -s[NUM], in this case only vptrs with occurences more than NUM will be printed\n"
"Same holds for -c[NUM]\n"
"\n"
"Coredump should be of a format parsible by objdump -h.\n"
"\n"
"Vtable-file must have a format with 0xaddress of vtable being the first word and classname following word 'for'.\n"
"It can be generated by:\n"
"1) gdb -ex 'info variable vtable*' -ex 'quit' binary coredump\n"
"2) nm binary | c++filt | grep vtable\n"
"\n"
"Vtable-addr should be of format 0xhex, if filename is of format 0xhex it is used as single vptr.\n"
"\n"
"Section# should be the name of objdump -h section.\n";

struct ELF_Section {
  std::string name;
  size_t size;
  size_t vma;
  size_t file_oft;
  
  ELF_Section(std::string n) : name(n) {}
};

struct Vptr {
  long vptr;
  std::string classname;
  size_t occur;

  Vptr(long vtable, std::string name) : 
    vptr(vtable+0x10), classname(name), occur(0) {}

  bool operator < (const Vptr& v) const {
    return (v.occur < occur);
  }
};

bool is_hex_notation(std::string const& s)
{
  return s.compare(0, 2, "0x") == 0
  && s.size() > 2
  && s.find_first_not_of("0123456789abcdefABCDEF", 2) == std::string::npos;
}

int parse_arguments(int argc, char** argv, int& full, size_t& limit, std::string& core_filename,
  std::vector<Vptr>& vptrs, std::vector<ELF_Section>& sections) {

  if (argc < 4) {
    std::cout << help;
    return -1;
  }

  full = 1;
  bool is_vptr_in_file = false;
  std::string vtable_filename;

  if (argv[1][0] == '-') {
    if (argv[1][1] == 'f') {
      full = 1;
    } else if (argv[1][1] == 's') {
      full = -1;
      std::stringstream ss;
      ss << &argv[1][2];
      ss >> limit;
    } else if (argv[1][1] == 'c') {
      full = 0;
      std::stringstream ss;
      ss << &argv[1][2];
      ss >> limit;
    } else {
      std::cout << help;
      return -1;
    }

    core_filename = std::string(argv[2]);

    if (is_hex_notation(argv[3])) {
      long vtable_addr;
      std::stringstream ss;
      ss << std::hex << argv[3];
      ss >> vtable_addr; 
      vptrs.push_back(Vptr(vtable_addr, std::string("Unknown"))); 
      is_vptr_in_file = false;
    } else {
      vtable_filename = argv[3];
      is_vptr_in_file = true;
    }

    for (int i=4; i < argc; i++)
      sections.push_back(ELF_Section(argv[i]));

  } else {
    core_filename = std::string(argv[1]); 

    if (is_hex_notation(argv[2])) {
      long vtable_addr;
      std::stringstream ss;
      ss << std::hex << argv[2];
      ss >> vtable_addr; 
      vptrs.push_back(Vptr(vtable_addr, std::string("Unknown"))); 
      is_vptr_in_file = false;
    } else {
      vtable_filename = argv[2];
      is_vptr_in_file = true;
    }

    for (int i=3; i < argc; i++)
      sections.push_back(ELF_Section(argv[i]));
  }

  if (is_vptr_in_file) {
    std::ifstream file;
    std::string line;
    int for_pos;

    file.open(vtable_filename.c_str());
    if (file.is_open()) {
      while (getline(file, line)) {
        std::istringstream iss(line);
        long vtable_addr;

        iss >> std::hex >> vtable_addr;
        for_pos = line.find(std::string("for"));

        vptrs.push_back(Vptr(vtable_addr, line.substr(for_pos + 4))); // "for " = 4 char
      }
      file.close();
    } else {
      std::cerr << "Could not open the file: " << vtable_filename << std::endl;
      return -1;
    }
  }

  return 0;
}

void readelf_header(std::string const& core_filename, std::vector<ELF_Section>& sections) {

  int objdump_awk[2];
  int awk_parent[2];
  pid_t obj_pid, awk_pid;

  if (pipe(objdump_awk) == -1) {
    perror("Pipe objdump | awk");
    exit(EXIT_FAILURE);
  }

  if ((obj_pid = fork()) == 0) { // objdump
    close(STDOUT_FILENO);
    dup(objdump_awk[1]);
    close(objdump_awk[0]);
    close(objdump_awk[1]);

    const char* filename = core_filename.c_str();
    char* objdump[] = { const_cast<char*>("objdump"), const_cast<char*>("-h"), const_cast<char*>(core_filename.c_str()), 0 };
    execvp(objdump[0], objdump);
    perror("objdump fail to start");
    exit(EXIT_FAILURE);
  }

  if (pipe(awk_parent) == -1) {
    perror("Pipe awk | parent");
    exit(EXIT_FAILURE);
  }

  if ((awk_pid = fork()) == 0) { // awk '/^[ ]+[0-9]+/ {print $2" "$3" "$4" "$6}'
    close(STDIN_FILENO);
    dup(objdump_awk[0]);
    close(objdump_awk[1]);
    close(objdump_awk[0]);

    close(STDOUT_FILENO);
    dup(awk_parent[1]);
    close(awk_parent[0]);
    close(awk_parent[1]);

    char* awk[] = { const_cast<char*>("awk"), 
      const_cast<char*>("/^[ ]+[0-9]+/ {print $2\" \"$3\" \"$4\" \"$6}"), 0 };
    execvp(awk[0], awk);
    perror("awk fail to start");
    exit(EXIT_FAILURE);
  }

  close(objdump_awk[0]);
  close(objdump_awk[1]);
  close(awk_parent[1]);

  waitpid(obj_pid, NULL, 0);

  std::map<std::string, size_t> name_2_index;

  for (size_t i=0; i < sections.size(); i++)
    name_2_index[sections[i].name] = i;
  
  std::string name;
  size_t size;
  size_t vma;
  size_t file_oft;

  char c;
  char buf[50];
  int bp = 0; //buffer pointer
  int step = 0;
  while (read(awk_parent[0], &c, 1) > 0) {
    buf[bp++] = c;
    if (c == '\n' || c == ' ') { 
      std::stringstream ss;
      if (step == 0) {
        ss << buf;
        ss >> name;
        
        if (name_2_index.find(name) == name_2_index.end()) {
          bp = 0;
          continue;
        }

        bp = 0;
        step++;
      } else if (step == 1) {
        ss << std::hex << buf;
        ss >> size;
        bp = 0;
        step++;
      } else if (step == 2) {
        ss << std::hex << buf;
        ss >> vma;
        bp = 0;
        step++;
      } else {
        ss << std::hex << buf;
        ss >> file_oft;
        bp = 0;
        step = 0;
        int idx = name_2_index[name];
        sections[idx].size = size;
        sections[idx].vma = vma;
        sections[idx].file_oft = file_oft;
      }
    }
  }

  close(awk_parent[0]);

  waitpid(awk_pid, NULL, 0);
}

int main(int argc, char** argv) {

  int full;
  size_t limit = 0;
  std::string core_filename;
  std::vector<Vptr> vptrs;
  std::vector<ELF_Section> sections;

  if (parse_arguments(argc, argv, full, limit, core_filename, vptrs, sections) < 0) {
    exit(EXIT_FAILURE);
  }

  readelf_header(core_filename, sections);

  //std::cout << "Full: " << full << std::endl;
  //std::cout << "Core_filename: " <<  core_filename << std::endl;
  //std::cout << "Vptrs:\n";
  //for (size_t i=0; i < vptrs.size(); i++) {
  //  std::cout << std::hex << vptrs[i].vptr << " " << vptrs[i].classname << std::endl;
  //}
  //std::cout << "Sections:\n";
  //for (size_t i=0; i < sections.size(); i++) {
  //  std::cout << std::hex << sections[i].name << " " << sections[i].size << " " << sections[i].vma <<
  //  " " << sections[i].file_oft << std::endl;
  //}

  FILE *fcore;
  size_t read_size = 0;
  long* buffer;
  size_t page_size = getpagesize();
  size_t buffer_size = 8*page_size;
  size_t bc = 0; // byte count

  if ((fcore = fopen(core_filename.c_str(), "rb")) == NULL) {
    perror("Open fcore");
    exit(EXIT_FAILURE);
  }

  buffer = (long*)malloc(buffer_size); // equal to PAGESIZE

  for (size_t s = 0; s < sections.size(); s++) {

    if ((fseeko(fcore, sections[s].file_oft, SEEK_SET)) < 0)
    {
      perror("Seeking in coredump");
      exit(EXIT_FAILURE);
    }
 
    for (size_t i = 0; i < sections[s].size; i += buffer_size) {
      if ((read_size = fread(buffer, page_size, 8, fcore)) < 0) {
        perror("Reading coredump");
        exit(EXIT_FAILURE);
      }

      for (size_t j = 0; j < page_size; j++, bc += 0x8) {
        for (size_t v = 0; v < vptrs.size(); v++) {
          if (buffer[j] == vptrs[v].vptr) {
            if (full >= 0) {
              std::cout << std::hex << bc+sections[s].vma << " " << vptrs[v].classname << std::endl;
            } else {
              vptrs[v].occur++;
            }
          }
        }
      }
    }
  }

  free(buffer);

  if (full <= 0) {
    std::sort(vptrs.begin(), vptrs.end());
    for (size_t i=0; i < vptrs.size(); i++) {
      if (vptrs[i].occur < limit) {
        break;
      } else { 
        std::cerr << vptrs[i].occur << " " << vptrs[i].classname << " " << std::hex << vptrs[i].vptr << std::endl;
      }
    }
  }

  return 0;
}