pd 100% cpu

[zonkzonk]

X86_64

,r2 /bin/cp
 -- Heisenbug: A bug that disappears or alters its behavior when 
one attempts to probe or isolate it.
[0x00403695]> af
[0x00403695]> pdf
/ (fcn) entry0 42
|          0x00403695    31ed         xor ebp, ebp
|          0x00403697    4989d1       mov r9, rdx
|          0x0040369a    5e           pop rsi
|          0x0040369b    4889e2       mov rdx, rsp
|          0x0040369e    4883e4f0     and rsp, 0xfffffffffffffff0
|          0x004036a2    50           push rax
|          0x004036a3    54           push rsp
|          0x004036a4    49c7c0d0784. mov r8, fcn.004178c5 ; fcn.004178c5
|          0x004036ab    48c7c160784. mov rcx, fcn.00417860 ; 0x00417860 
|          0x004036b2    48c7c7002f4. mov rdi, main ; section..text
|          0x004036b9    e8f2f3ffff   call sym.imp.__libc_start_main
|             sym.imp.__libc_start_main(unk, unk)
\          0x004036be    f4           hlt
[0x00403695]> pd fcn.004178c5

gdb -p 555
[...]
Got object file from memory but can't read symbols: File truncated.
0x00007f2630a3c343 in inp_start (u=0x7f262ef51afc <sdb_const_get+48>) at decode.c:77
77      {
(gdb) bt
#0  0x00007f2630a3c343 in inp_start (u=0x7f262ef51afc <sdb_const_get+48>) at decode.c:77
#1  0x00007f2630a3e8a2 in ud_decode (u=0x7f262fbb9a00 <d>) at decode.c:1234
#2  0x00007f2630a4029a in ud_disassemble (u=0x7f262fbb9a00 <d>) at udis86.c:73
#3  0x00007f262f4ec2c4 in disassemble (a=0x2163160, op=0x2d90640, 
    buf=0x7f262a2ec821 "L\211\367\350b\363\377\377\204\300\017\204\036\377\377\377\213\205\270\374\377\377\203\340?\201", <incomplete sequence \373>, 
    len=42897423) at p/asm_x86.c:60
#4  0x00007f262f5070cd in r_asm_disassemble (a=0x2163160, op=0x2d90640, 
    buf=0x7f262a2ec821 "L\211\367\350b\363\377\377\204\300\017\204\036\377\377\377\213\205\270\374\377\377\203\340?\201", <incomplete sequence \373>, 
    len=42897423) at asm.c:309
#5  0x00007f2631cc55e8 in perform_disassembly (core=0x606940 <r>, ds=0x2d8f420, 
    buf=0x7f262a2ec821 "L\211\367\350b\363\377\377\204\300\017\204\036\377\377\377\213\205\270\374\377\377\203\340?\201", <incomplete sequence \373>, 
    len=42897423) at disasm.c:867
#6  0x00007f2631cc84d0 in r_core_print_disasm (p=0x21503b0, core=0x606940 <r>, addr=4208277, 
    buf=0x7f262a2ea010 "1\355I\211\321^H\211\342H\203\344\360PTI\307\300\320xA", len=42907680, l=4290768, invbreak=0, cbytes=0) at disasm.c:1668
#7  0x00007f2631c8b37b in cmd_print (data=0x606940 <r>, input=0x2d28141 "d fcn.
004178c5\032\032") at cmd_print.c:1257
#8  0x00007f2631cb3fba in r_cmd_call (cmd=0x218bcc0, input=0x2d28140 "pd fcn.004178c5\032\032") at cmd_api.c:179
#9  0x00007f2631c962cb in r_core_cmd_subst_i (core=0x606940 <r>, cmd=0x2d28140 "pd fcn.004178c5\032\032") at cmd.c:1236
#10 0x00007f2631c94a3b in r_core_cmd_subst (core=0x606940 <r>, cmd=0x2d28140 "pd fcn.004178c5\032\032") at cmd.c:789
#11 0x00007f2631c96dde in r_core_cmd (core=0x606940 <r>, cstr=0x21b3bf0 "pd fcn.004178c5\032\032", log=1) at cmd.c:1434
#12 0x00007f2631c67687 in r_core_prompt_exec (r=0x606940 <r>) at core.c:836
#13 0x000000000040497b in main (argc=2, argv=0x7fff9617f1d8, envp=0x7fff9617f1f0) at radare2.c:674
(gdb) disass 0x00007f2630a3c343
Dump of assembler code for function inp_start:
   0x00007f2630a3c342 <+0>:     push   %rbp
=> 0x00007f2630a3c343 <+1>:     mov    %rsp,%rbp
   0x00007f2630a3c346 <+4>:     mov    %rdi,-0x8(%rbp)
   0x00007f2630a3c34a <+8>:     mov    -0x8(%rbp),%rax
   0x00007f2630a3c34e <+12>:    movq   $0x0,0x30(%rax)
   0x00007f2630a3c356 <+20>:    pop    %rbp
   0x00007f2630a3c357 <+21>:    retq   
End of assembler dump.
(gdb)

[radare]

It should print block size, is this a clean rebuild? can you try to show the blocksize before running pd and use pD to verify?

On 27 Sep 2014, at 04:07, zonkzonk [email protected] wrote:

X86_64

,r2 /bin/cp
-- Heisenbug: A bug that disappears or alters its behavior when one attempts to probe or isolate it.
[0x00403695]> af
[0x00403695]> pdf
/ (fcn) entry0 42
| 0x00403695 31ed xor ebp, ebp
| 0x00403697 4989d1 mov r9, rdx
| 0x0040369a 5e pop rsi
| 0x0040369b 4889e2 mov rdx, rsp
| 0x0040369e 4883e4f and rsp, 0xfffffffffffffff0
| 0x004036a2 50 push rax
| 0x004036a3 54 push rsp
| 0x004036a4 49c7c0d0784. mov r8, fcn.004178c5 ; fcn.004178c5
| 0x004036ab 48c7c160784. mov rcx, fcn.00417860 ; 0x00417860
| 0x004036b2 48c7c7002f4. mov rdi, main ; section..text
| 0x004036b9 e8f2f3ffff call sym.imp.__libc_start_main
| sym.imp.__libc_start_main(unk, unk)
\ 0x004036be f4 hlt
[0x00403695]> pd fcn.004178c5

gdb -p 555
[...]
Got object file from memory but can't read symbols: File truncated.
0x00007f2630a3c343 in inp_start (u=0x7f262ef51afc <sdb_const_get+48>) at decode.c:77
77 {
(gdb) bt
#0 0x00007f2630a3c343 in inp_start (u=0x7f262ef51afc <sdb_const_get+48>) at decode.c:77
#1 0x00007f2630a3e8a2 in ud_decode (u=0x7f262fbb9a00 ) at decode.c:1234
#2 0x00007f2630a4029a in ud_disassemble (u=0x7f262fbb9a00 ) at udis86.c:73
#3 0x00007f262f4ec2c4 in disassemble (a=0x2163160, op=0x2d90640,
buf=0x7f262a2ec821 "L\211\367\350b\363\377\377\204\300\017\204\036\377\377\377\213\205\270\374\377\377\203\340?\201", <incomplete sequence \373>,
len=42897423) at p/asm_x86.c:60
#4 0x00007f262f5070cd in r_asm_disassemble (a=0x2163160, op=0x2d90640,
buf=0x7f262a2ec821 "L\211\367\350b\363\377\377\204\300\017\204\036\377\377\377\213\205\270\374\377\377\203\340?\201", <incomplete sequence \373>,
len=42897423) at asm.c:309
#5 0x00007f2631cc55e8 in perform_disassembly (core=0x606940 , ds=0x2d8f420,
buf=0x7f262a2ec821 "L\211\367\350b\363\377\377\204\300\017\204\036\377\377\377\213\205\270\374\377\377\203\340?\201", <incomplete sequence \373>,
len=42897423) at disasm.c:867
#6 0x00007f2631cc84d0 in r_core_print_disasm (p=0x21503b0, core=0x606940 , addr=4208277,
buf=0x7f262a2ea010 "1\355I\211\321^H\211\342H\203\344\360PTI\307\300\320xA", len=42907680, l=4290768, invbreak=0, cbytes=0) at disasm.c:1668
#7 0x00007f2631c8b37b in cmd_print (data=0x606940 , input=0x2d28141 "d fcn.004178c5\032\032") at cmd_print.c:1257
#8 0x00007f2631cb3fba in r_cmd_call (cmd=0x218bcc0, input=0x2d28140 "pd fcn.004178c5\032\032") at cmd_api.c:179
#9 0x00007f2631c962cb in r_core_cmd_subst_i (core=0x606940 , cmd=0x2d28140 "pd fcn.004178c5\032\032") at cmd.c:1236
#10 0x00007f2631c94a3b in r_core_cmd_subst (core=0x606940 , cmd=0x2d28140 "pd fcn.004178c5\032\032") at cmd.c:789
#11 0x00007f2631c96dde in r_core_cmd (core=0x606940 , cstr=0x21b3bf0 "pd fcn.004178c5\032\032", log=1) at cmd.c:1434
#12 0x00007f2631c67687 in r_core_prompt_exec (r=0x606940 ) at core.c:836
#13 0x000000000040497b in main (argc=2, argv=0x7fff9617f1d8, envp=0x7fff9617f1f0) at radare2.c:674
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n)
—
Reply to this email directly or view it on GitHub.

[zonkzonk]

yo, it was 'git clean -xdf' then new built, blocksize is 0x100 (b command used) pD seems equal to pd,
I will let it run for 1 hour.

[zonkzonk]

same thing :/

(gdb) bt
#0  0x00007f72ff6c982d in r_anal_get_fcn_in (anal=0x6f5900, addr=8272437, type=0) at fcn.c:586
#1  0x00007f7300a6d3ea in handle_print_labels (core=0x606940 <r>, ds=0x1321320, f=0x999980) at disasm.c:1296
#2  0x00007f7300a6ecaf in r_core_print_disasm (p=0x6e13b0, core=0x606940 <r>, addr=4208277, 
    buf=0x7f72fb14b010 "1\355I\211\321^H\211\342H\203\344\360PTI\307\300\320xA", len=4290768, l=4290768, invbreak=0, cbytes=1
#3  0x00007f7300a313e4 in cmd_print (data=0x606940 <r>, input=0x12bfd51 "D fcn.004178c5") at cmd_print.c:1267
#4  0x00007f7300a5a3b0 in r_cmd_call (cmd=0x71e730, input=0x12bfd50 "pD fcn.004178c5") at cmd_api.c:179
#5  0x00007f7300a3c432 in r_core_cmd_subst_i (core=0x606940 <r>, cmd=0x12bfd50 "pD fcn.004178c5") at cmd.c:1236
#6  0x00007f7300a3aba2 in r_core_cmd_subst (core=0x606940 <r>, cmd=0x12bfd50 "pD fcn.004178c5") at cmd.c:789
#7  0x00007f7300a3cf45 in r_core_cmd (core=0x606940 <r>, cstr=0x7451b0 "pD fcn.004178c5", log=1) at cmd.c:1434
#8  0x00007f7300a0d6f7 in r_core_prompt_exec (r=0x606940 <r>) at core.c:837
#9  0x000000000040497b in main (argc=2, argv=0x7fff3d964858, envp=0x7fff3d964870) at radare2.c:674

[radare]

The read length is large. No need to warm your cpu here. Wil try to
reproduce now
On Sep 27, 2014 11:07 PM, "zonkzonk" [email protected] wrote:

yo, it was 'git clean -xdf' then new built, blocksize is 0x100 (b command
used) pD seems equal to pd,
I will let it run for 1 hour.

—
Reply to this email directly or view it on GitHub
#1441 (comment).

[radare]

Oh.. I missread your input. Thats expected because thats what you told r2 to do, you should use the @ sign to specify the address :

pd @ addr