Skip to content

Support base64 buffer dumps and complex hardware breakpoint reads#84

Open
anonymousException wants to merge 3 commits into
SeeFlowerX:devfrom
anonymousException:dev
Open

Support base64 buffer dumps and complex hardware breakpoint reads#84
anonymousException wants to merge 3 commits into
SeeFlowerX:devfrom
anonymousException:dev

Conversation

@anonymousException

@anonymousException anonymousException commented Jan 31, 2026

Copy link
Copy Markdown
Contributor

Support base64 buffer dumps

usage 1:
./stackplz_arm64 -n com.example.test -c tests/config_uprobe_test_base64.json
usage 2:
./stackplz_arm64 -n com.example.test --lib libtest.so --dumpbase64 -w testBytesBase64[buf:x1]
output:
with base64 :
[13173|13173|om.example.test] testBytesBase64(buf_bytes=0x7ff8c514e8 (base64:EgA0VngREhM=)) LR:0x731f123bc8 PC:0x731f123aa4 SP:0x7ff8c51430
without base64 :
[13268|13268|om.example.test] testBytesBase64(buf_bytes=0x7ff8c514e8(\x12\x004Vx\x11\x12\x13)) LR:0x731e066bc8 PC:0x731e066aa4 SP:0x7ff8c51430

usage:
./stackplz_arm64 -n com.example.test -c tests/config_uprobe_test_base64.json
./stackplz_arm64 -n com.example.test --lib libtest.so --dumpbase64 -w testBytesBase64[buf:x1]
@anonymousException anonymousException changed the title support dump base64 from buf Support base64 buffer dumps and complex hardware breakpoint reads Jun 19, 2026
@anonymousException

anonymousException commented Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

Support complex hardware breakpoint reads

Summary

  • Add --brk-point for hardware breakpoints.
  • Reuse the existing uprobe-style complex argument expression parser for hardware breakpoint hits.
  • Read args from sampled registers and /proc/<pid>/mem, then format them through the existing arg formatter.
  • Keep dump parsing and RPC hardware breakpoint paths compatible with --brk-point.

Usage

Read simple registers when a hardware breakpoint hits:

./stackplz --pid <pid> \
  --brk <absolute_addr>:x \
  --brk-len 4 \
  --brk-point '[int:x0,uint64:x1]'

Read buffers through complex expressions:
./stackplz --pid <pid> \
  --brk <absolute_addr>:x \
  --brk-len 4 \
  --brk-point '[buf:4096:x0,buf:4096:x0+0x1000]' \
  --dumpbase64
Read through a pointer chain:
./stackplz --pid <pid> \
  --brk <absolute_addr>:x \
  --brk-len 4 \
  --brk-point '[*int:x0+0x18,buf:1000:x0+0x10.+0x20]' \
  --dumpbase64
Example output:
[pid|tid] event_addr:0x... hit_count:1 args(arg_0=..., arg_1=0x... (base64:...))
Notes
Unlike uprobe, this does not patch target instructions with BRK #5. Hardware breakpoint arg reads happen after perf sample delivery in userspace, so there is a small timing window.

@anonymousException

Copy link
Copy Markdown
Contributor Author

Passed Auto built result:
stackplz_arm64

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant