Re: [PATCH v5 0/3] MR8834: server: Use process_vm_writev / process_vm_readv instead of ptrace when available.
No idea, but I think it's unlikely, it's been crashing the same way on my nightly builds (which is why I looked into it) and with a local build. I find it unlikely they would match and produce the same build output.
Then yes, the address in lldb is weird, there's probably something going on. Disassembly of the bogus `write_process_memory`:
```
obj-wine-x86_64/server/mach.o: file format mach-o 64-bit x86-64
Disassembly of section __TEXT,__text:
0000000000000ce0 <_write_process_memory>: ; { ce0: 55 pushq %rbp ce1: 48 89 e5 movq %rsp, %rbp ce4: 41 57 pushq %r15 ce6: 41 56 pushq %r14 ce8: 41 55 pushq %r13 cea: 41 54 pushq %r12 cec: 53 pushq %rbx ced: 48 83 ec 68 subq $0x68, %rsp ; return process->trace_data; cf1: 44 8b bf 98 01 00 00 movl 0x198(%rdi), %r15d ; if (!process_port) cf8: 45 85 ff testl %r15d, %r15d cfb: 74 59 je 0xd56 <_write_process_memory+0x76> cfd: 49 89 cd movq %rcx, %r13 d00: 41 89 d6 movl %edx, %r14d d03: 49 89 f4 movq %rsi, %r12 d06: 4c 89 45 98 movq %r8, -0x68(%rbp) ; if (posix_memalign( (void **)&data, get_page_size(), size )) d0a: e8 00 00 00 00 callq 0xd0f <_write_process_memory+0x2f> d0f: 44 89 f3 movl %r14d, %ebx d12: 48 8d 7d b0 leaq -0x50(%rbp), %rdi ; if (posix_memalign( (void **)&data, get_page_size(), size )) d16: 48 89 c6 movq %rax, %rsi d19: 48 89 da movq %rbx, %rdx d1c: e8 00 00 00 00 callq 0xd21 <_write_process_memory+0x41> d21: 85 c0 testl %eax, %eax d23: 74 62 je 0xd87 <_write_process_memory+0xa7> ; static inline void set_error( unsigned int err ) { global_error = err; if (current) current->error = err; } d25: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xd2c <_write_process_memory+0x4c> d2c: c7 00 17 00 00 c0 movl $0xc0000017, (%rax) ## imm = 0xC0000017 d32: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xd39 <_write_process_memory+0x59> d39: 48 8b 08 movq (%rax), %rcx d3c: 31 c0 xorl %eax, %eax d3e: 48 85 c9 testq %rcx, %rcx d41: 0f 84 fd 02 00 00 je 0x1044 <_write_process_memory+0x364> d47: c7 81 70 01 00 00 17 00 00 c0 movl $0xc0000017, 0x170(%rcx) ## imm = 0xC0000017 d51: e9 ee 02 00 00 jmp 0x1044 <_write_process_memory+0x364> d56: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xd5d <_write_process_memory+0x7d> d5d: c7 00 22 00 00 c0 movl $0xc0000022, (%rax) ## imm = 0xC0000022 d63: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xd6a <_write_process_memory+0x8a> d6a: 48 8b 08 movq (%rax), %rcx d6d: 31 c0 xorl %eax, %eax ; static inline void set_error( unsigned int err ) { global_error = err; if (current) current->error = err; } d6f: 48 85 c9 testq %rcx, %rcx d72: 0f 84 cc 02 00 00 je 0x1044 <_write_process_memory+0x364> d78: c7 81 70 01 00 00 22 00 00 c0 movl $0xc0000022, 0x170(%rcx) ## imm = 0xC0000022 d82: e9 bd 02 00 00 jmp 0x1044 <_write_process_memory+0x364> ; memcpy( (void *)data, src, size ); d87: 48 8b 7d b0 movq -0x50(%rbp), %rdi d8b: 4c 89 ee movq %r13, %rsi d8e: 48 89 da movq %rbx, %rdx d91: e8 00 00 00 00 callq 0xd96 <_write_process_memory+0xb6> ; ret = mach_vm_write( process_port, (mach_vm_address_t)ptr, data, (mach_msg_type_number_t)size ); d96: 48 8b 55 b0 movq -0x50(%rbp), %rdx d9a: 44 89 ff movl %r15d, %edi d9d: 4c 89 e6 movq %r12, %rsi da0: 44 89 f1 movl %r14d, %ecx da3: e8 00 00 00 00 callq 0xda8 <_write_process_memory+0xc8> da8: 41 89 c5 movl %eax, %r13d ; if (ret == KERN_INVALID_ADDRESS) dab: 83 f8 01 cmpl $0x1, %eax dae: 0f 85 91 01 00 00 jne 0xf45 <_write_process_memory+0x265> ; mach_vm_address_t region_address = current_address; db4: 4c 89 65 c8 movq %r12, -0x38(%rbp) ; mach_msg_type_number_t info_count = VM_REGION_BASIC_INFO_COUNT_64; db8: c7 45 d4 09 00 00 00 movl $0x9, -0x2c(%rbp) dbf: 48 8d 45 a4 leaq -0x5c(%rbp), %rax ; ret = mach_vm_region( process_port, ®ion_address, ®ion_size, VM_REGION_BASIC_INFO_64, dc3: 48 89 04 24 movq %rax, (%rsp) dc7: 48 8d 75 c8 leaq -0x38(%rbp), %rsi dcb: 48 8d 55 b8 leaq -0x48(%rbp), %rdx dcf: 4c 8d 85 78 ff ff ff leaq -0x88(%rbp), %r8 dd6: 4c 8d 4d d4 leaq -0x2c(%rbp), %r9 dda: 44 89 ff movl %r15d, %edi ddd: b9 09 00 00 00 movl $0x9, %ecx de2: e8 00 00 00 00 callq 0xde7 <_write_process_memory+0x107> ; if (ret != KERN_SUCCESS) de7: 85 c0 testl %eax, %eax de9: 74 08 je 0xdf3 <_write_process_memory+0x113> deb: 41 89 c5 movl %eax, %r13d ; if ((ret = task_suspend( process_port )) != KERN_SUCCESS) dee: e9 52 01 00 00 jmp 0xf45 <_write_process_memory+0x265> ; if (region_address > current_address || df3: 48 8b 45 c8 movq -0x38(%rbp), %rax df7: 41 bd 01 00 00 00 movl $0x1, %r13d ; if (region_address > current_address || dfd: 4c 39 e0 cmpq %r12, %rax e00: 0f 87 3f 01 00 00 ja 0xf45 <_write_process_memory+0x265> ; region_address + region_size <= current_address) e06: 48 03 45 b8 addq -0x48(%rbp), %rax e0a: 4c 39 e0 cmpq %r12, %rax ; if (region_address > current_address || e0d: 0f 86 32 01 00 00 jbe 0xf45 <_write_process_memory+0x265> ; if (!is_rosetta() && !(info.protection & VM_PROT_WRITE)) e13: e8 00 00 00 00 callq 0xe18 <_write_process_memory+0x138> e18: 85 c0 testl %eax, %eax e1a: 75 13 jne 0xe2f <_write_process_memory+0x14f> e1c: 41 bd 02 00 00 00 movl $0x2, %r13d ; if (!is_rosetta() && !(info.protection & VM_PROT_WRITE)) e22: f6 85 78 ff ff ff 02 testb $0x2, -0x88(%rbp) e29: 0f 84 16 01 00 00 je 0xf45 <_write_process_memory+0x265> ; if ((ret = task_suspend( process_port )) != KERN_SUCCESS) e2f: 44 89 ff movl %r15d, %edi e32: e8 00 00 00 00 callq 0xe37 <_write_process_memory+0x157> e37: 85 c0 testl %eax, %eax e39: 75 b0 jne 0xdeb <_write_process_memory+0x10b> ; while (remaining_size) e3b: 45 85 f6 testl %r14d, %r14d e3e: 0f 84 f1 00 00 00 je 0xf35 <_write_process_memory+0x255> e44: 44 89 75 c4 movl %r14d, -0x3c(%rbp) e48: 4c 89 e3 movq %r12, %rbx ; region_address = current_address; e4b: 48 89 5d c8 movq %rbx, -0x38(%rbp) ; info_count = VM_REGION_BASIC_INFO_COUNT_64; e4f: c7 45 d4 09 00 00 00 movl $0x9, -0x2c(%rbp) ; ret = mach_vm_region( process_port, ®ion_address, ®ion_size, VM_REGION_BASIC_INFO_64, e56: 48 8d 45 a4 leaq -0x5c(%rbp), %rax e5a: 48 89 04 24 movq %rax, (%rsp) e5e: 44 89 ff movl %r15d, %edi e61: 48 8d 75 c8 leaq -0x38(%rbp), %rsi e65: 48 8d 55 b8 leaq -0x48(%rbp), %rdx e69: b9 09 00 00 00 movl $0x9, %ecx e6e: 4c 8d 85 78 ff ff ff leaq -0x88(%rbp), %r8 e75: 4c 8d 4d d4 leaq -0x2c(%rbp), %r9 e79: e8 00 00 00 00 callq 0xe7e <_write_process_memory+0x19e> ; if (ret != KERN_SUCCESS) break; e7e: 85 c0 testl %eax, %eax e80: 0f 85 b4 00 00 00 jne 0xf3a <_write_process_memory+0x25a> ; if (region_address > current_address || e86: 48 8b 45 c8 movq -0x38(%rbp), %rax e8a: 41 bd 01 00 00 00 movl $0x1, %r13d ; if (region_address > current_address || e90: 48 39 d8 cmpq %rbx, %rax e93: 0f 87 a4 00 00 00 ja 0xf3d <_write_process_memory+0x25d> ; region_address + region_size <= current_address) e99: 48 03 45 b8 addq -0x48(%rbp), %rax e9d: 48 39 d8 cmpq %rbx, %rax ; if (region_address > current_address || ea0: 0f 86 97 00 00 00 jbe 0xf3d <_write_process_memory+0x25d> ; if (!is_rosetta() && !(info.protection & VM_PROT_WRITE)) ea6: e8 00 00 00 00 callq 0xeab <_write_process_memory+0x1cb> eab: 85 c0 testl %eax, %eax ead: 75 0d jne 0xebc <_write_process_memory+0x1dc> eaf: f6 85 78 ff ff ff 02 testb $0x2, -0x88(%rbp) eb6: 0f 84 97 01 00 00 je 0x1053 <_write_process_memory+0x373> ; write_size = region_size - (current_address - region_address); ebc: 48 8b 55 b8 movq -0x48(%rbp), %rdx ec0: 48 29 da subq %rbx, %rdx ec3: 48 03 55 c8 addq -0x38(%rbp), %rdx ; if (write_size > remaining_size) write_size = remaining_size; ec7: 8b 45 c4 movl -0x3c(%rbp), %eax eca: 48 39 c2 cmpq %rax, %rdx ecd: 48 0f 43 d0 cmovaeq %rax, %rdx ; ret = mach_vm_protect( process_port, current_address, write_size, 0, ed1: 44 89 ff movl %r15d, %edi ed4: 48 89 de movq %rbx, %rsi ed7: 48 89 55 a8 movq %rdx, -0x58(%rbp) edb: 31 c9 xorl %ecx, %ecx edd: 41 b8 03 00 00 00 movl $0x3, %r8d ee3: e8 00 00 00 00 callq 0xee8 <_write_process_memory+0x208> ; if (ret != KERN_SUCCESS) break; ee8: 85 c0 testl %eax, %eax eea: 75 4e jne 0xf3a <_write_process_memory+0x25a> ; data + (current_address - (mach_vm_address_t)ptr), write_size ); eec: 48 89 da movq %rbx, %rdx eef: 4c 29 e2 subq %r12, %rdx ef2: 48 03 55 b0 addq -0x50(%rbp), %rdx ; ret = mach_vm_write( process_port, current_address, ef6: 44 89 ff movl %r15d, %edi ef9: 48 89 de movq %rbx, %rsi efc: 48 8b 4d a8 movq -0x58(%rbp), %rcx f00: e8 00 00 00 00 callq 0xf05 <_write_process_memory+0x225> ; if (ret != KERN_SUCCESS) break; f05: 85 c0 testl %eax, %eax f07: 75 31 jne 0xf3a <_write_process_memory+0x25a> ; info.protection ); f09: 44 8b 85 78 ff ff ff movl -0x88(%rbp), %r8d ; ret = mach_vm_protect( process_port, current_address, write_size, 0, f10: 44 89 ff movl %r15d, %edi f13: 48 89 de movq %rbx, %rsi f16: 48 8b 55 a8 movq -0x58(%rbp), %rdx f1a: 31 c9 xorl %ecx, %ecx f1c: e8 00 00 00 00 callq 0xf21 <_write_process_memory+0x241> ; if (ret != KERN_SUCCESS) break; f21: 85 c0 testl %eax, %eax f23: 75 15 jne 0xf3a <_write_process_memory+0x25a> f25: 48 8b 45 a8 movq -0x58(%rbp), %rax ; current_address += write_size; f29: 48 01 c3 addq %rax, %rbx ; while (remaining_size) f2c: 29 45 c4 subl %eax, -0x3c(%rbp) f2f: 0f 85 16 ff ff ff jne 0xe4b <_write_process_memory+0x16b> f35: 45 31 ed xorl %r13d, %r13d f38: eb 03 jmp 0xf3d <_write_process_memory+0x25d> f3a: 41 89 c5 movl %eax, %r13d ; task_resume( process_port ); f3d: 44 89 ff movl %r15d, %edi f40: e8 00 00 00 00 callq 0xf45 <_write_process_memory+0x265> ; free( (void *)data ); f45: 48 8b 7d b0 movq -0x50(%rbp), %rdi f49: e8 00 00 00 00 callq 0xf4e <_write_process_memory+0x26e> ; switch (mach_error) f4e: 41 83 fd 04 cmpl $0x4, %r13d f52: 0f 87 a9 00 00 00 ja 0x1001 <_write_process_memory+0x321> f58: 44 89 e8 movl %r13d, %eax f5b: 48 8d 0d fe 00 00 00 leaq 0xfe(%rip), %rcx ## 0x1060 <_write_process_memory+0x380> ; switch (mach_error) f62: 48 63 04 81 movslq (%rcx,%rax,4), %rax f66: 48 01 c8 addq %rcx, %rax f69: 48 8b 55 98 movq -0x68(%rbp), %rdx f6d: ff e0 jmpq *%rax ; static inline void set_error( unsigned int err ) { global_error = err; if (current) current->error = err; } f6f: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xf76 <_write_process_memory+0x296> f76: c7 00 05 00 00 c0 movl $0xc0000005, (%rax) ## imm = 0xC0000005 f7c: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xf83 <_write_process_memory+0x2a3> f83: 48 8b 00 movq (%rax), %rax f86: b9 05 00 00 c0 movl $0xc0000005, %ecx ## imm = 0xC0000005 f8b: 48 85 c0 testq %rax, %rax f8e: 0f 85 92 00 00 00 jne 0x1026 <_write_process_memory+0x346> f94: eb 67 jmp 0xffd <_write_process_memory+0x31d> f96: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xf9d <_write_process_memory+0x2bd> f9d: c7 00 0d 00 00 c0 movl $0xc000000d, (%rax) ## imm = 0xC000000D fa3: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xfaa <_write_process_memory+0x2ca> faa: 48 8b 00 movq (%rax), %rax fad: b9 0d 00 00 c0 movl $0xc000000d, %ecx ## imm = 0xC000000D fb2: 48 85 c0 testq %rax, %rax fb5: 75 6f jne 0x1026 <_write_process_memory+0x346> fb7: eb 44 jmp 0xffd <_write_process_memory+0x31d> fb9: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xfc0 <_write_process_memory+0x2e0> fc0: c7 00 22 00 00 c0 movl $0xc0000022, (%rax) ## imm = 0xC0000022 fc6: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xfcd <_write_process_memory+0x2ed> fcd: 48 8b 00 movq (%rax), %rax fd0: b9 22 00 00 c0 movl $0xc0000022, %ecx ## imm = 0xC0000022 fd5: 48 85 c0 testq %rax, %rax fd8: 75 4c jne 0x1026 <_write_process_memory+0x346> fda: eb 21 jmp 0xffd <_write_process_memory+0x31d> fdc: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xfe3 <_write_process_memory+0x303> fe3: c7 00 17 00 00 c0 movl $0xc0000017, (%rax) ## imm = 0xC0000017 fe9: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0xff0 <_write_process_memory+0x310> ff0: 48 8b 00 movq (%rax), %rax ff3: b9 17 00 00 c0 movl $0xc0000017, %ecx ## imm = 0xC0000017 ff8: 48 85 c0 testq %rax, %rax ffb: 75 29 jne 0x1026 <_write_process_memory+0x346> ffd: 31 c0 xorl %eax, %eax ; static inline void set_error( unsigned int err ) { global_error = err; if (current) current->error = err; } fff: eb 40 jmp 0x1041 <_write_process_memory+0x361> 1001: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0x1008 <_write_process_memory+0x328> 1008: c7 00 01 00 00 c0 movl $0xc0000001, (%rax) ## imm = 0xC0000001 100e: 48 8b 05 00 00 00 00 movq (%rip), %rax ## 0x1015 <_write_process_memory+0x335> 1015: 48 8b 00 movq (%rax), %rax 1018: b9 01 00 00 c0 movl $0xc0000001, %ecx ## imm = 0xC0000001 101d: 48 85 c0 testq %rax, %rax 1020: 48 8b 55 98 movq -0x68(%rbp), %rdx 1024: 74 06 je 0x102c <_write_process_memory+0x34c> 1026: 89 88 70 01 00 00 movl %ecx, 0x170(%rax) ; if (ret == KERN_SUCCESS && written) *written = size; 102c: 45 85 ed testl %r13d, %r13d 102f: 0f 94 c0 sete %al 1032: 48 85 d2 testq %rdx, %rdx 1035: 74 0a je 0x1041 <_write_process_memory+0x361> 1037: 45 85 ed testl %r13d, %r13d 103a: 75 05 jne 0x1041 <_write_process_memory+0x361> 103c: 44 89 32 movl %r14d, (%rdx) 103f: b0 01 movb $0x1, %al ; return (ret == KERN_SUCCESS); 1041: 0f b6 c0 movzbl %al, %eax ; } 1044: 48 83 c4 68 addq $0x68, %rsp 1048: 5b popq %rbx 1049: 41 5c popq %r12 104b: 41 5d popq %r13 104d: 41 5e popq %r14 104f: 41 5f popq %r15 1051: 5d popq %rbp 1052: c3 retq 1053: 41 bd 02 00 00 00 movl $0x2, %r13d ; if (!is_rosetta() && !(info.protection & VM_PROT_WRITE)) 1059: e9 df fe ff ff jmp 0xf3d <_write_process_memory+0x25d> 105e: 66 90 nop 1060: cc int3 1061: ff ff <unknown> 1063: ff 0f decl (%rdi) 1065: ff ff <unknown> 1067: ff 59 ff lcalll *-0x1(%rcx) 106a: ff ff <unknown> 106c: 7c ff jl 0x106d <_write_process_memory+0x38d> 106e: ff ff <unknown> 1070: 36 ff ff <unknown> 1073: ff <unknown> ```
-
Rémi Bernon (＠rbernon)