webkit调试方法记录

发表于 | 分类于 | | 阅读次数:

调试crash的准备工作

下载 Webkit 源代码并编译:

1
2
3
4
5
-> git clone git://git.webkit.org/WebKit.git WebKit

for macOS:
-> Tools/Scripts/set-webkit-configuration --asan --debug 
-> Tools/Scripts/build-webkit

切换到漏洞影响的分支

1
git checkout -b localname commithash

调试
使用的调试器是 lldb. 通过以下命令运行 Safari:

1
-> Tools/Scripts/run-safari

或者获取源码后直接在xcode里打开webkit，


测试

测试，找一个poc运行，可以看到asna打印uaf。

run-jsc

通过run-jsc这个script我们能打印出JIT的log

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
sakura@sakuradeMBP:~/WebKit/Tools/Scripts$ pwd
/Users/sakura/WebKit/Tools/Scripts
sakura@sakuradeMBP:~/WebKit/Tools/Scripts$ ls | grep run-js
run-jsc
sakura@sakuradeMBP:~/WebKit/Tools/Scripts$ ./run-jsc --help
Running 1 time(s): DYLD_FRAMEWORK_PATH=/Users/sakura/WebKit/WebKitBuild/Debug /Users/sakura/WebKit/WebKitBuild/Debug/jsc --help
Usage: jsc [options] [files] [-- arguments]
  -d         Dumps bytecode (debug builds only)
  -e         Evaluate argument as script code
  -f         Specifies a source file (deprecated)
  -h|--help  Prints this help message
  -i         Enables interactive mode (default if no files are specified)
  -m         Execute as a module
  -s         Installs signal handlers that exit on a crash (Unix platforms only)
  -p <file>  Outputs profiling data to a file
  -x         Output exit code before terminating

  --sample                   Collects and outputs sampling profiler data
  --test262-async            Check that some script calls the print function with the string 'Test262:AsyncTestComplete'
  --strict-file=<file>       Parse the given file as if it were in strict mode (this option may be passed more than once)
  --module-file=<file>       Parse and evaluate the given file as module (this option may be passed more than once)
  --exception=<name>         Check the last script exits with an uncaught exception with the specified name
  --watchdog-exception-ok    Uncaught watchdog exceptions exit with success
  --dumpException            Dump uncaught exception text
  --options                  Dumps all JSC VM options and exits
  --dumpOptions              Dumps all non-default JSC VM options before continuing
  --<jsc VM option>=<value>  Sets the specified JSC VM option

选项	描述
JSC_dumpDisassembly = true	转储所有JIT编译函数的反汇编。
JSC_dumpDFGDisassembly = true	转储DFG和FTL编译函数的反汇编。
JSC_dumpFTLDisassembly = true	转储FTL编译函数的反汇编。
JSC_dumpSourceAtDFGTime = true	转储DFG/FTL编译函数的来源。
JSC_dumpBytecodeAtDFGTime = true	转储DFG/FTL编译函数的字节码。
JSC_dumpGraphAfterParsing = true	在DFG/FTL编译时解析函数字节码后转储DFG图。
JSC_dumpGraphAtEachPhase = true	在DFG/FTL编译的每个阶段之后转储DFG图。

例如
./run-jsc --dumpGraphAtEachPhase=true /Users/sakura/Desktop/for-in-side-effects.js &> ~/log.txt

./run-jsc --dumpDisassembly=true /Users/sakura/Desktop/for-in-side-effects.js &> ~/log.txt

for-in-side-effects.js

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
// Regression test for bug 179212

var p = { "a": {} };

var flag = 0;
var data = [];
var copy = [];

var z = new Proxy({}, {
    getPrototypeOf: function() {
        if (flag == 2) {
            data[0] = { "x": "I changed" };
        }

        if (flag == 1) {
            flag = 2;
        }

        return {"a": 1, "b": 2}
    }
});

p.__proto__ = z;

function reset()
{
    flag = 0;
    data = [1.1, 2.2, 3.3];
    copy = [];
}

function runTest(func)
{
    reset();

    for (var i = 0; i < 0x10000; i++)
        func();

    flag = 1;
    func();

    if (copy[0].x != "I changed")
        throw "Expected updated value for copy[0]";
}


function testWithFTL()
{
    function f()
    {
        data[0] = 2.2;
        for(var d in p) {
            copy[0] = data[0];
            copy[1] = data[1];
            copy[2] = data[2];
        }
    }

    runTest(f);
}

testWithFTL();

jsc运行报错

1
2
3
sakura@sakuradeMBP:~/WebKit/WebKitBuild/Debug$ export DYLD_FRAMEWORK_PATH=~/WebKit/WebKitBuild/Debug
sakura@sakuradeMBP:~/WebKit/WebKitBuild/Debug$ ./jsc
>>> quit()

其他

https://webkit.org/blog/6411/javascriptcore-csi-a-crash-site-investigation-story/