summaryrefslogtreecommitdiff
path: root/source/notes/mono_jit
diff options
context:
space:
mode:
Diffstat (limited to 'source/notes/mono_jit')
-rw-r--r--source/notes/mono_jit/main.cs13
-rw-r--r--source/notes/mono_jit/mono_jit.md267
2 files changed, 280 insertions, 0 deletions
diff --git a/source/notes/mono_jit/main.cs b/source/notes/mono_jit/main.cs
new file mode 100644
index 0000000..d87dc51
--- /dev/null
+++ b/source/notes/mono_jit/main.cs
@@ -0,0 +1,13 @@
+public static void Main(System.String[] args) {
+ Console.ReadLine();
+ Console.WriteLine("asdf");
+ for (int i = 0; i < 60; i++) {
+ Console.WriteLine("looping... " + i);
+ Console.ReadLine();
+ mangler();
+ }
+ mangler();
+ Console.WriteLine("once...");
+ mangler();
+ Console.WriteLine("twice!");
+}
diff --git a/source/notes/mono_jit/mono_jit.md b/source/notes/mono_jit/mono_jit.md
new file mode 100644
index 0000000..1f6c073
--- /dev/null
+++ b/source/notes/mono_jit/mono_jit.md
@@ -0,0 +1,267 @@
+```
+(gdb) info address System_Console_ReadLine
+Symbol "System_Console_ReadLine" is a function at address 0x7f9a3ce60f50.
+```
+
+ok, time to look for something close to `0x7f9a3ce60f50` on the stack as a return address.
+
+<div class="codebox"><pre>
+(gdb) x/300xg $rsp
+0x7ffd84d06930: 0x0000000000000000 0x0000000000603f21
+0x7ffd84d06940: 0x0000000002106908 0x32bfbbdd7b4d2300
+0x7ffd84d06950: 0x0000000000000004 0x0000000000000000
+0x7ffd84d06960: 0x00007f9a3ec0a150 0x0000000000000400
+0x7ffd84d06970: 0x00007ffd84d06a80 0x00000000005d7c20
+0x7ffd84d06980: 0x000000003cd61c3d 0x32bfbbdd7b4d2300
+0x7ffd84d06990: 0x0000000000000000 0x00007ffd84d06a60
+0x7ffd84d069a0: 0x00007f9a3ec0a150 0x0000000000000000
+0x7ffd84d069b0: 0x0000000000000400 0x0000000041951b2a
+0x7ffd84d069c0: 0x0000000000000000 0x00007f9a3ec09ff8
+0x7ffd84d069d0: 0x00007f9a3ec0a150 0x0000000000000000
+0x7ffd84d069e0: 0x0000000000000400 0x00000000020b49b0
+0x7ffd84d069f0: 0x00007f9a3ec0a150 0x00007ffd84d06a60
+0x7ffd84d06a00: 0x00007ffd84d069c0 0x00007f9a3cd61b91
+0x7ffd84d06a10: 0x00007ffd84d06a80 0x0000000000000400
+0x7ffd84d06a20: 0x0000000000000000 0x00007f9a3ec0a150
+0x7ffd84d06a30: 0x00007f9a3ec0a068 0x00007f9a3ec0a118
+0x7ffd84d06a40: 0x00007f9a3ec0a170 0x0000000000000007
+0x7ffd84d06a50: 0x00007f9a3ec0a501 0x0000000000000400
+0x7ffd84d06a60: 0x0000000000000400 0x00007f9a3cd60348
+0x7ffd84d06a70: 0x0000000000000000 0x0000000000000400
+0x7ffd84d06a80: 0x00007f9a00000000 0x00007f9a3ec09ff8
+0x7ffd84d06a90: 0x00007f9a3ec0a068 0x00007f9a3ec0a150
+0x7ffd84d06aa0: 0x0000000000000400 0x00007f9a3cd5e517
+0x7ffd84d06ab0: 0x0000000000000400 0x00007ffd84d06d00
+0x7ffd84d06ac0: 0x00007f9a3ec09ff8 0x00007f9a3ec0a150
+0x7ffd84d06ad0: 0x0000000000000000 0x0000000000000400
+0x7ffd84d06ae0: 0x0000000000000400 0x00007f9a3cd5e382
+0x7ffd84d06af0: 0x00000000020f1e30 0x0000000000000000
+0x7ffd84d06b00: 0x00007f9a3ec00628 0x00007ffd84d06c38
+0x7ffd84d06b10: 0x00007f9a3ec0a0b0 0x0000000000000000
+0x7ffd84d06b20: 0x00007f9a3ec00628 0x00007f9a3cbcddc5
+0x7ffd84d06b30: 0x00000000020f1e30 0x00007ffd84d06d00
+0x7ffd84d06b40: 0x0000000000000000 0x00007f9a3ec00628
+0x7ffd84d06b50: 0x00007ffd84d06c38 0x00007f9a3ec0a0b0
+0x7ffd84d06b60: 0x00000000020f1e30 0x00007f9a3cbccc44
+0x7ffd84d06b70: 0x00000000020f1e30 0x0000000000000000
+0x7ffd84d06b80: 0x00007f9a3ec00628 0x00007f9a3ec00628
+0x7ffd84d06b90: 0x00007ffd84d06c38 0x00007f9a00000000
+0x7ffd84d06ba0: 0x00007ffd84d06b60 0x00007f9a3ce78294
+0x7ffd84d06bb0: 0x0000000000000000 0x0000000000000004
+0x7ffd84d06bc0: 0x00007f9a3ec272f8 0x00007ffd84d06c28
+0x7ffd84d06bd0: 0x00007f9a3ec08328 0x00007f9a3cc6f872
+0x7ffd84d06be0: 0x00007f9a3ec272f8 0x00007f9a3ce78a12
+0x7ffd84d06bf0: 0x00000000020f1e30 0x00007ffd84d06fe0
+0x7ffd84d06c00: 0x0000000000000000 0x00007f9a3ec08328
+0x7ffd84d06c10: 0x00007f9a3ec08328 0x0000000041952328
+0x7ffd84d06c20: 0x0000000041952315 0x0000000000000000
+0x7ffd84d06c30: 0x00007f9a00000000 0x00007f9a3ec07800
+0x7ffd84d06c40: 0x00007f9a3ec272f8 0x00007f9a3ce628c4
+<b>0x7ffd84d06c50: 0x00007f9a3ec08328 0x00007f9a3ce61027 &lt;--- this is our winner</b>
+0x7ffd84d06c60: 0x000000004194fe50 0x00007ffd84d06fe0
+0x7ffd84d06c70: 0x0000000000000005 0x000000004194fdca
+0x7ffd84d06c80: 0x000000004194fd50 0x000000004194fd50
+0x7ffd84d06c90: 0x000000004194fd50 0x000000004194ff19
+0x7ffd84d06ca0: 0x000000000000001f 0x0000000000000000
+0x7ffd84d06cb0: 0x31c01d4184d06f90 0x0000000000000000
+0x7ffd84d06cc0: 0x0000000000000000 0x32bfbbdd7b4d2300
+0x7ffd84d06cd0: 0x00000000020908b0 0x00000000020f1e30
+0x7ffd84d06ce0: 0x00007ffd84d06f90 0x000000004194fe50
+0x7ffd84d06cf0: 0x0000000002091d30 0x0000000000000000
+0x7ffd84d06d00: 0x00007ffd84d06f90 0x00000000004266b8
+0x7ffd84d06d10: 0x00000000020ed240 0x000000000208df90
+0x7ffd84d06d20: 0x0000000000000000 0x00000000020f9c00
+0x7ffd84d06d30: 0x0000000000000025 0x0000000000000000
+0x7ffd84d06d40: 0x0000000000000000 0x0000000000000000
+0x7ffd84d06d50: 0x000000000209bfa8 0x00007f9a00000000
+0x7ffd84d06d60: 0x0000000000000000 0x00007f9a3f733b20
+0x7ffd84d06d70: 0x0000000000000026 0x0000000000000025
+0x7ffd84d06d80: 0x00007ffd84d06df4 0x00007f9a3f749c89
+0x7ffd84d06d90: 0x0000000000000000 0x00000000006366fe
+0x7ffd84d06da0: 0x00007f9a401b4130 0x00000000020f1d80
+0x7ffd84d06db0: 0x00007ffd84d071f0 0x00007f9a3f3f398c
+0x7ffd84d06dc0: 0x00007ffd84d071f0 0x00007f9a3f3f35d4
+0x7ffd84d06dd0: 0x00000000020af860 0x0000000000632060
+0x7ffd84d06de0: 0x00000000020f1d80 0x0000000000000000
+0x7ffd84d06df0: 0x0000000000000000 0x000000000208df90
+0x7ffd84d06e00: 0x00000000020f1d80 0x00000000020f1d80
+0x7ffd84d06e10: 0x00007f9a401b4130 0x00000000020f1d80
+0x7ffd84d06e20: 0x00007ffd84d071f0 0x00007f9a3f3f398c
+0x7ffd84d06e30: 0x0000000000000000 0x32bfbbdd7b4d2300
+0x7ffd84d06e40: 0x00007ffd84d06eb0 0x000000000054537c
+0x7ffd84d06e50: 0x00000000020f1d80 0x000000000208df90
+0x7ffd84d06e60: 0x00000000020f1d80 0x00000000020f1d80
+0x7ffd84d06e70: 0x00007f9a401b4130 0x32bfbbdd7b4d2300
+0x7ffd84d06e80: 0x0000000000000000 0x0000000002091d30
+0x7ffd84d06e90: 0x0000000002091d30 0x0000000000000000
+0x7ffd84d06ea0: 0x00007f9a401b4130 0x00000000020f1d80
+0x7ffd84d06eb0: 0x00007ffd84d071f0 0x00000000005452d9
+0x7ffd84d06ec0: 0x0000000000000000 0x0000000002091d30
+0x7ffd84d06ed0: 0x00000000020911c0 0x0000000002091350
+0x7ffd84d06ee0: 0x0000000000000040 0x00000000020f1d80
+0x7ffd84d06ef0: 0x00007ffd84d071f0 0x000000000055fec6
+0x7ffd84d06f00: 0x0000000000000040 0x0000000002091350
+0x7ffd84d06f10: 0x00007f9a3ec00388 0x32bfbbdd7b4d2300
+0x7ffd84d06f20: 0x00007f9a401b4130 0x0000000002091d30
+0x7ffd84d06f30: 0x00000000020911c0 0x0000000000000000
+0x7ffd84d06f40: 0x00007f9a401b4130 0x00000000005b910a
+0x7ffd84d06f50: 0x000000000208df90 0x32bfbbdd7b4d2300
+0x7ffd84d06f60: 0x00007f9a401b4130 0x0000000002091d30
+0x7ffd84d06f70: 0x00007ffd84d06fe0 0x0000000000000000
+0x7ffd84d06f80: 0x00000000020f1d80 0x00007ffd84d071f0
+0x7ffd84d06f90: 0x0000000000000000 0x00000000005ac68d
+0x7ffd84d06fa0: 0x000000000208df90 0x0000000002091d30
+0x7ffd84d06fb0: 0x0000000000000000 0x0000000000000000
+0x7ffd84d06fc0: 0x00007f9a401b4130 0x00000000005ae9cc
+0x7ffd84d06fd0: 0x000000000208df90 0x0000000000000000
+0x7ffd84d06fe0: 0x00007f9a3ec00328 0x32bfbbdd7b4d2300
+0x7ffd84d06ff0: 0x00007ffd84d07484 0x000000000208df90
+0x7ffd84d07000: 0x0000000000000001 0x00000000020ed390
+0x7ffd84d07010: 0x0000000000000000 0x0000000000476967
+0x7ffd84d07020: 0x0000000000000000 0x00000000161169ff
+0x7ffd84d07030: 0x0000000000000000 0x0000000000000000
+0x7ffd84d07040: 0x0000000000000000 0x0000000000000000
+0x7ffd84d07050: 0x0000000000000004 0x0000000000000000
+0x7ffd84d07060: 0x0000000000000000 0x0000000000000000
+0x7ffd84d07070: 0x0000000000000000 0x0000000000000000
+0x7ffd84d07080: 0x0000000000000002 0x0000000100000001
+0x7ffd84d07090: 0x0000000000639710 0x000000000208df90
+0x7ffd84d070a0: 0x00007ffd84d071e0 0x0000000000000002
+0x7ffd84d070b0: 0x0000000000000000 0x0000000000422c0e
+0x7ffd84d070c0: 0x0000000000000001 0x32bfbbdd7b4d2300
+0x7ffd84d070d0: 0x0000000000000000 0x0000000000000000
+0x7ffd84d070e0: 0x0000000000639710 0x0000000000422e50
+0x7ffd84d070f0: 0x00007ffd84d071e0 0x0000000000000000
+0x7ffd84d07100: 0x0000000000000000 0x00007f9a3f390830
+0x7ffd84d07110: 0x0000000000000000 0x00007ffd84d071e8
+0x7ffd84d07120: 0x0000000240290ca0 0x0000000000422be0
+0x7ffd84d07130: 0x0000000000000000 0x42f8e52f22cfd5b5
+0x7ffd84d07140: 0x0000000000422e50 0x00007ffd84d071e0
+0x7ffd84d07150: 0x0000000000000000 0x0000000000000000
+0x7ffd84d07160: 0xbd03ec48eecfd5b5 0xbdcc9b9a033fd5b5
+0x7ffd84d07170: 0x00007ffd00000000 0x0000000000000000
+0x7ffd84d07180: 0x0000000000000000 0x0000000000639780
+0x7ffd84d07190: 0x00007f9a4007b8e0 0x00007f9a4007b5fb
+0x7ffd84d071a0: 0x0000000000000000 0x0000000000000000
+0x7ffd84d071b0: 0x0000000000422e50 0x00007ffd84d071e0
+0x7ffd84d071c0: 0x0000000000000000 0x0000000000422e79
+0x7ffd84d071d0: 0x00007ffd84d071d8 0x000000000000001c
+0x7ffd84d071e0: 0x0000000000000002 0x00007ffd84d0747f
+0x7ffd84d071f0: 0x00007ffd84d07484 0x0000000000000000
+0x7ffd84d07200: 0x00007ffd84d0748e 0x00007ffd84d07499
+0x7ffd84d07210: 0x00007ffd84d074aa 0x00007ffd84d074bd
+0x7ffd84d07220: 0x00007ffd84d074da 0x00007ffd84d074eb
+0x7ffd84d07230: 0x00007ffd84d074fb 0x00007ffd84d07507
+0x7ffd84d07240: 0x00007ffd84d07519 0x00007ffd84d07529
+0x7ffd84d07250: 0x00007ffd84d07536 0x00007ffd84d07565
+0x7ffd84d07260: 0x00007ffd84d07aed 0x00007ffd84d07b1c
+0x7ffd84d07270: 0x00007ffd84d07b33 0x00007ffd84d07e50
+0x7ffd84d07280: 0x00007ffd84d07e71 0x00007ffd84d07e81
+</pre></div>
+
+0x7ffd84d06c58: 0x00007f9a3ce61027 <-- this is a return address to the native code Console.ReadLine()
+
+which means slightly further up the stack:
+
+0x7ffd84d06c78: 0x000000004194fdca <-- this is a return address to the caller of Console.ReadLine() (this is main)
+
+Main(), for comparison:
+<div class="codebox">
+```cs
+#include main.cs
+```
+</div>
+
+<div class="codebox"><pre>
+(gdb) x/10i 0x000000004194fdca
+ 0x4194fdca: nop
+ 0x4194fdcb: callq 0x41953b10 <-- so this is the last statement in main - mangler()
+ 0x4194fdd0: inc %r15d <-- this is i++ in the loop on line 4 of main
+ 0x4194fdd3: cmp $0x3c,%r15d
+ 0x4194fdd7: jl 0x4194fd78
+ 0x4194fdd9: xchg %ax,%ax
+ 0x4194fddb: callq 0x4194fe26
+ 0x4194fde0: movabs $0x7f9a401a4158,%rdi
+ 0x4194fdea: movabs $0x4194fe1c,%r11
+ 0x4194fdf4: callq *%r11
+</pre></div>
+
+this makes sense as a return address because we see the first thing after ReadLine(), which is mangler()!
+
+stepping back a little:
+
+<div class="codebox"><pre>
+(gdb) x/30i 0x000000004194fdb0
+ 0x4194fdb0: movabs $0x7f9a3ce609d0,%r11 <- pointer to native code System_Console_ReadLine()
+ 0x4194fdba: callq *%r11
+ 0x4194fdbd: movabs $0x7f9a3ce60f50,%r11 <- pointer to native code System_Console_WriteLine()
+ 0x4194fdc7: callq *%r11
+ 0x4194fdca: nop
+ 0x4194fdcb: callq 0x41953b10 <- mangler()
+ 0x4194fdd0: inc %r15d
+ 0x4194fdd3: cmp $0x3c,%r15d
+ 0x4194fdd7: jl 0x4194fd78 <- loop end
+ 0x4194fdd9: xchg %ax,%ax
+ 0x4194fddb: callq 0x4194fe26 <- also mangler()??
+ 0x4194fde0: movabs $0x7f9a401a4158,%rdi <- ???
+ 0x4194fdea: movabs $0x4194fe1c,%r11 <- ???
+ 0x4194fdf4: callq *%r11 <- ???
+ 0x4194fdf7: callq 0x4194fe26
+ 0x4194fdfc: movabs $0x7f9a401a4180,%rdi
+ 0x4194fe06: movabs $0x4194fe1c,%r11
+ 0x4194fe10: callq *%r11
+ 0x4194fe13: mov (%rsp),%r15
+ 0x4194fe17: add $0x18,%rsp
+ 0x4194fe1b: retq <- main's end, whew
+</pre></div>
+
+looking at the weird mangler() call:
+<div class="codebox"><pre>
+(gdb) x/10i 0x4194fe26
+ 0x4194fe26: callq 0x40ee3000
+ 0x4194fe2b: add $0xf0,%al
+ 0x4194fe2d: lahf
+ 0x4194fe2e: lar %ax,%ebp
+ 0x4194fe31: lret
+ 0x4194fe32: xor %ebx,-0x1(%rcx)
+ 0x4194fe35: add $0xf0,%al
+ 0x4194fe37: cmp %cl,(%rdi)
+ 0x4194fe39: add %al,%ch
+ 0x4194fe3b: (bad)
+</pre></div>
+
+the only part of this that makes sense is the callq 0x40ee3000 - the rest is... nonsense-y. long return, really??? maybe at the call site we'll see something useful...
+
+<div class="codebox"><pre>
+(gdb) x/70i 0x40ee3000
+ 0x40ee3000: mov %r11,-0xd0(%rsp)
+ 0x40ee3008: pop %r11 <------------ WHAT
+ 0x40ee300a: push %rbp
+ 0x40ee300b: mov %rsp,%rbp
+ 0x40ee300e: sub $0x160,%rsp
+ 0x40ee3015: sub $0x5,%r11
+ 0x40ee3019: mov %r11,-0x10(%rbp)
+ 0x40ee301d: mov %rax,-0x128(%rbp)
+ 0x40ee3024: mov %rcx,-0x120(%rbp)
+ 0x40ee302b: mov %rdx,-0x118(%rbp)
+ 0x40ee3032: mov %rbx,-0x110(%rbp)
+ 0x40ee3039: mov %rsp,%r11
+ 0x40ee303c: add $0x170,%r11
+ 0x40ee3043: mov %r11,-0x108(%rbp)
+ 0x40ee304a: mov 0x0(%rbp),%rax
+ 0x40ee304e: mov %rax,-0x100(%rbp)
+ 0x40ee3055: mov %rsi,-0xf8(%rbp)
+ 0x40ee305c: mov %rdi,-0xf0(%rbp)
+ 0x40ee3063: mov %r8,-0xe8(%rbp)
+ 0x40ee306a: mov %r9,-0xe0(%rbp)
+ 0x40ee3071: mov %r10,-0xd8(%rbp)
+ 0x40ee3078: mov %r12,-0xc8(%rbp)
+ 0x40ee307f: mov %r13,-0xc0(%rbp)
+ 0x40ee3086: mov %r14,-0xb8(%rbp)
+ 0x40ee308d: mov %r15,-0xb0(%rbp)
+ 0x40ee3094: mov 0x8(%rbp),%r11
+ 0x40ee3098: mov %r11,-0xa8(%rbp)
+ 0x40ee309f: movsd %xmm0,-0xa0(%rbp)
+</pre></div>
+
+that pop pops the return address of this function, 0x4194fe2b, into r11, meaning we actually return to the *caller* of 0x4194fe26, back into main. so this method must use that pointer as information and probably is a 'patch-and-invoke' mechanism. the `sub $0x5, %r11` at 0x40ee3015 seals the deal, because that moves r11 back 5 bytes to point to the call here.