用户态硬件断点

63           24 23    20 19  16 15 14 13    9 8       5 4  3 2  1   0
 RES0         BT       LBN     SSC    HMC    BAS     PMC   RES  E

63    21 20 19 18  16 15    12 11 10 9    5 4   3 2 1    0
 RES0  MASK WT LBN     BAS     HMC   SSC    LSC PAC   E

PMC (BCR) / PAC (WCR) = 0b10   → EL0
HMC                     = 0
SSC                     = 0b01 → Non-Secure

ptrace(PTRACE_ATTACH, tid, ...);
waitpid(tid, ...);
struct user_hwdebug_state st;
iovec.iov_base = &st; iovec.iov_len = sizeof(st);
ptrace(PTRACE_SETREGSET, tid, NT_ARM_HW_BREAKPOINT, &iovec);
ptrace(PTRACE_CONT, tid, ...);
/* ... SIGTRAP delivered on hit ... */

static struct {
    /* 当前配置 */
    uint64_t bp_addr;
    uint32_t bp_type;     /* HW_BREAKPOINT_R/W/RW/X */
    uint32_t bp_len;      /* HW_BREAKPOINT_LEN_1/2/4/8 */
    int      bp_pid;      /* 目标进程 TGID */
 
    /* per-thread perf 监控 */
    struct hwbp_thread threads[HWBP_MAX_THREADS];  /* 256 */
    int thread_count;
    volatile int monitoring;
 
    /* hit SPSC 环 */
    struct hwbp_hit events[HWBP_MAX_EVENTS];  /* 4096 */
    volatile uint32_t write_idx;
    volatile uint32_t read_idx;
 
    pthread_mutex_t write_lock;
} g_hwbp;

struct hwbp_thread {
    int       tid;
    int       fd;                 /* perf_event_open 返回的 fd */
    void     *mmap_addr;
    size_t    mmap_size;
    pthread_t thread;             /* 监控 pthread */
    volatile int active;
};

static int hwbp_start(int pid, uint64_t addr,
                      uint32_t bp_type, uint32_t bp_len)
{
    hwbp_stop_all();                          /* 清场（单 BP 语义）*/
 
    g_hwbp.bp_pid  = pid;
    g_hwbp.bp_addr = addr;
    g_hwbp.bp_type = bp_type;
    g_hwbp.bp_len  = bp_len;
    g_hwbp.write_idx = g_hwbp.read_idx = 0;
 
    int tids[HWBP_MAX_THREADS];
    int n = hwbp_get_threads(pid, tids, HWBP_MAX_THREADS);
 
    g_hwbp.monitoring = 1;
    for (int i = 0; i < n; i++) {
        g_hwbp.threads[i].tid    = tids[i];
        g_hwbp.threads[i].active = 1;
        pthread_create(&g_hwbp.threads[i].thread, NULL,
                       hwbp_monitor_thread, &g_hwbp.threads[i]);
    }
    g_hwbp.thread_count = n;
    return n;
}

static int hwbp_get_threads(int pid, int *tids, int max)
{
    char path[256];
    snprintf(path, sizeof(path), "/proc/%d/task", pid);
    DIR *dir = opendir(path);
    if (!dir) return 0;
 
    static const char *blacklist[] = {
        "RenderThread", "FinalizerDaemon", "RxCachedThreadS",
        "mali-", "hwuiTask", "NDK MediaCodec_", NULL
    };
 
    int count = 0;
    struct dirent *ent;
    while ((ent = readdir(dir)) && count < max) {
        int tid = atoi(ent->d_name);
        if (tid <= 0) continue;
 
        char name[64] = {0};
        snprintf(path, sizeof(path), "/proc/%d/task/%d/comm", pid, tid);
        FILE *fp = fopen(path, "r");
        if (fp) { fgets(name, sizeof(name), fp); fclose(fp); }
 
        int skip = 0;
        for (int i = 0; blacklist[i]; i++)
            if (strstr(name, blacklist[i])) { skip = 1; break; }
        if (!strncmp(name, "binder:", 7)) skip = 1;
        if (skip) continue;
 
        tids[count++] = tid;
    }
    closedir(dir);
    return count;
}

struct perf_event_attr attr;
memset(&attr, 0, sizeof(attr));
attr.size              = sizeof(attr);
attr.type              = PERF_TYPE_BREAKPOINT;
attr.bp_type           = g_hwbp.bp_type;     /* HW_BREAKPOINT_R/W/RW/X */
attr.bp_addr           = g_hwbp.bp_addr;
attr.bp_len            = g_hwbp.bp_len;      /* HW_BREAKPOINT_LEN_1/2/4/8 */
attr.sample_type       = PERF_SAMPLE_TID | PERF_SAMPLE_REGS_USER;
attr.sample_period     = 1;                   /* 每次命中都采样 */
attr.sample_regs_user  = ((1ULL << 33) - 1); /* x0..pc 全 33 个 */
attr.wakeup_events     = 1;                   /* 每条 sample 都唤醒 poll */
attr.disabled          = 1;                   /* 先停再开，能稳地 enable */
attr.exclude_kernel    = 1;                   /* 只监视 EL0 */
attr.exclude_hv        = 1;
attr.precise_ip        = 2;                   /* 要求 PC 精确到指令 */
attr.mmap = attr.comm = attr.mmap_data = attr.mmap2 = 1;
 
int fd = syscall(__NR_perf_event_open, &attr,
                 tp->tid, /* cpu */ -1, /* group_fd */ -1,
                 PERF_FLAG_FD_CLOEXEC);
ioctl(fd, PERF_EVENT_IOC_RESET, 0);
ioctl(fd, PERF_EVENT_IOC_ENABLE, 0);

long syscall(__NR_perf_event_open,
             struct perf_event_attr *attr,
             pid_t pid,
             int cpu,
             int group_fd,
             unsigned long flags);

perf_event_open(attr, tid)
  → perf_event_alloc(attr, cpu=-1, task=find_task_by_vpid(tid))
    → hw_breakpoint_event_init()
      → hw_breakpoint_parse() — 把 attr 翻译成 arch_hw_breakpoint_ctrl
      → arch_validate_hwbkpt_settings() — 硬件参数 sanity check
      → bp->hw.task = task, 挂进 thread.debug.hbp_watch[]
  → ioctl(fd, PERF_EVENT_IOC_ENABLE)
    → perf_event_enable_on_exec()
      → __switch_to_user hooks 到 arch_install_hw_breakpoint()
        → msr DBGWVRn_EL1, addr; msr DBGWCRn_EL1, ctrl

size_t page_size = sysconf(_SC_PAGESIZE);     /* 4096 */
size_t mmap_size = (1 + HWBP_RING_PAGES) * page_size;  /* 1 + 16 = 17 pages */
void *mmap_addr = mmap(NULL, mmap_size,
                       PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

+0x0000  struct perf_event_mmap_page (metadata, 4 KB)
           ├─ data_head : 内核写指针 (mod data_size 后的绝对 offset)
           ├─ data_tail : 用户读指针 (用户更新)
           ├─ data_offset : ring 起点 = 0x1000
           └─ data_size : ring 大小 = 16 * 4096 = 64 KB
+0x1000  ring buffer 实际数据
+0x11000 ring 结尾

struct perf_event_mmap_page *meta = mmap_addr;
uint64_t data_offset = meta->data_offset;    /* 0x1000 */
uint64_t data_size   = meta->data_size;      /* 64 KB */
uint64_t read_pos    = 0;
uint8_t  tmp[1024];
 
struct pollfd pfd = { .fd = fd, .events = POLLIN };
 
while (g_hwbp.monitoring && tp->active) {
    int ret = poll(&pfd, 1, 200);   /* 200 ms 超时给 stop 机会 */
    if (ret <= 0) continue;
 
    while (meta->data_head != read_pos) {
        uint64_t ring_base = (uint64_t)mmap_addr + data_offset;
 
        /* 读 header（可能跨 ring 边界）*/
        struct perf_event_header hdr;
        uint64_t pos = read_pos % data_size;
        if (pos + sizeof(hdr) <= data_size) {
            memcpy(&hdr, (void *)(ring_base + pos), sizeof(hdr));
        } else {
            size_t first = data_size - pos;
            memcpy(&hdr, (void *)(ring_base + pos), first);
            memcpy((char *)&hdr + first, (void *)ring_base,
                   sizeof(hdr) - first);
        }
        if (hdr.size == 0 || hdr.size > data_size) {
            read_pos = meta->data_head;
            break;
        }
 
        if (hdr.type == PERF_RECORD_SAMPLE) {
            /* payload: [pid:4][tid:4][abi:8][regs:33*8] = 280 字节 */
            uint64_t spos = (read_pos + sizeof(hdr)) % data_size;
            size_t payload = hdr.size - sizeof(hdr);
            /* ... 跨边界 memcpy ... */
            if (payload >= 8 + 8 + 33 * 8) {
                uint32_t hit_pid, hit_tid;
                uint64_t regs[33];
                memcpy(&hit_pid, tmp + 0, 4);
                memcpy(&hit_tid, tmp + 4, 4);
                /* tmp + 8..16 是 abi，跳过 */
                memcpy(regs, tmp + 16, 33 * 8);
                hwbp_store_hit(hit_pid, hit_tid, regs);
            }
        }
 
        read_pos += hdr.size;
        meta->data_tail = read_pos;
    }
}

struct hwbp_hit {
    uint32_t pid;
    uint32_t tid;
    uint64_t regs[33];   /* PERF_REG_ARM64_MAX */
};   /* 272 字节 */
 
static void hwbp_store_hit(uint32_t pid, uint32_t tid,
                           const uint64_t regs[33])
{
    pthread_mutex_lock(&g_hwbp.write_lock);   /* 序列化多个 monitor 线程 */
    uint32_t idx = g_hwbp.write_idx % HWBP_MAX_EVENTS;
    g_hwbp.events[idx].pid = pid;
    g_hwbp.events[idx].tid = tid;
    memcpy(g_hwbp.events[idx].regs, regs, 33 * 8);
    g_hwbp.write_idx++;
    pthread_mutex_unlock(&g_hwbp.write_lock);
}

static void hwbp_stop_all(void)
{
    g_hwbp.monitoring = 0;   /* 广播给所有 monitor 线程 */
    for (int i = 0; i < g_hwbp.thread_count; i++) {
        if (g_hwbp.threads[i].active) {
            g_hwbp.threads[i].active = 0;
            pthread_join(g_hwbp.threads[i].thread, NULL);
        }
    }
    g_hwbp.thread_count = 0;
}

/* hwbp_monitor_thread 末尾 */
ioctl(fd, PERF_EVENT_IOC_DISABLE, 0);
munmap(mmap_addr, mmap_size);
close(fd);    /* 关 fd 会让内核调 arch_uninstall_hw_breakpoint() */
tp->active = 0;

→ [u8 0xCC] [u32 pid] [u64 addr] [u32 bp_type] [u32 bp_len]
← [u32 thread_count]

→ [u8 0xCD]
← [u8 ok]

→ [u8 0xCF] [u32 max_events]
← [u32 count] [hit0 (272B)] [hit1 (272B)] ...

每条 hit:
  [u32 pid] [u32 tid] [u64 regs[33]]

class CEClient:
    def hwbp_set(self, pid, addr, bp_type, bp_len):
        with self._lock:
            self._send(bytes([0xCC]))
            self._send(struct.pack("<I", pid))
            self._send(struct.pack("<Q", addr))
            self._send(struct.pack("<II", bp_type, bp_len))
            return struct.unpack("<I", self._recv(4))[0]
 
    def hwbp_clear(self):
        with self._lock:
            self._send(bytes([0xCD]))
            return self._recv(1)[0] == 1
 
    def hwbp_poll(self, max_events=256):
        with self._lock:
            self._send(bytes([0xCF]))
            self._send(struct.pack("<I", max_events))
            count = struct.unpack("<I", self._recv(4))[0]
            hits = []
            for _ in range(count):
                pid = struct.unpack("<I", self._recv(4))[0]
                tid = struct.unpack("<I", self._recv(4))[0]
                regs = list(struct.unpack("<33Q", self._recv(33 * 8)))
                hits.append((pid, tid, regs))
            return hits

class BreakpointEngine:
    _instance = None
    _lock = threading.Lock()
 
    def __init__(self, host, port, pid):
        self._host = host
        self._port = port
        self._pid = pid
        self._callbacks = {}  # {slot_id: callable(hits)}
        self._running = True
        self._backend = load_settings().get("bp_engine", "hwbp")
        self._next_hwbp_slot = 0
 
        # Control socket — set/clear/query (GUI 主线程用)
        self._ctl = CEClient()
        self._ctl.connect(host, port)
        self._ctl.open_process(pid)
 
        # Poll socket — 后台线程专用
        self._poll_client = CEClient()
        self._poll_client.connect(host, port)
        self._poll_client.open_process(pid)
 
        self._thread = threading.Thread(
            target=self._poll_loop, daemon=True, name="bp-poll")
        self._thread.start()

def set_breakpoint(self, addr, bp_type, size=4):
    _type_map = {'r': 1, 'w': 2, 'rw': 3, 'x': 4}
    if isinstance(bp_type, str):
        bp_type = _type_map.get(bp_type, bp_type)
 
    if self._backend == "hwbp":
        self._ctl.hwbp_set(self._pid, addr, bp_type, size)
        slot_id = self._next_hwbp_slot
        self._next_hwbp_slot += 1
        return slot_id
    elif self._backend == "extreme_hwbp":
        ...  # 见 [极致优化硬件断点](extreme-hwbp)
    else:
        ...  # 见 [内核 PTE 断点](kernel-pte-bp)

def _poll_loop(self):
    while self._running:
        try:
            if self._backend == "hwbp":
                raw = self._poll_client.hwbp_poll(512)
                if not raw:
                    time.sleep(0.05)
                    continue
                # 补齐成统一格式 (pid, tid, slot_id=0, type=0, addr=0, regs)
                hits = []
                for pid, tid, regs in raw:
                    hits.append((pid, tid, 0, 0, 0, regs))
                for cb in list(self._callbacks.values()):
                    try:
                        cb(hits)
                    except Exception:
                        pass
            else:
                ...  # 其它 backend 见交叉链接
        except Exception:
            if not self._running:
                break
            time.sleep(0.2)

def clear_breakpoint(self, slot_id):
    try:
        if self._backend == "hwbp":
            self._ctl.hwbp_clear()        # 全清，单 BP 语义
        ...
    except Exception:
        pass
    self._callbacks.pop(slot_id, None)

def register(self, slot_id, callback):
    self._callbacks[slot_id] = callback
 
def unregister(self, slot_id):
    self._callbacks.pop(slot_id, None)

def _refresh(self):
    ...
    type_names = {1: "READ", 2: "WRITE", 3: "RW", 4: "EXEC"}
    alive = [w for w in self._hwbp_wins if w.isVisible()]
    self.tbl_wins.setRowCount(len(alive))
    for i, w in enumerate(alive):
        self.tbl_wins.setItem(i, 0, QTableWidgetItem(str(i)))
        self.tbl_wins.setItem(i, 1, QTableWidgetItem(f"0x{w.watch_addr:X}"))
        self.tbl_wins.setItem(i, 2, QTableWidgetItem(
            type_names.get(w.bp_type, str(w.bp_type))))
        total = sum(e["count"] for e in w.hit_map.values())
        self.tbl_wins.setItem(i, 3, QTableWidgetItem(str(total)))
    ...

┌──────────────────────────────────────────┬──────────────┐
│ hit_list (QListWidget, vertical stretch) │ Show disasm  │
│ count  address        hex       asm      │ Save all data│
│ ───────────────────────────────────────  │              │
│ 1234   libue4.so+0x1440  C8001AB9  str…  │              │
│  456   libue4.so+0x1448  E8001AB9  ldr…  │   (stretch)  │
│                                          │              │
├──────────────────────────────────────────┤              │
│ info_memo (QTextEdit)                    │              │
│ libue4.so+0x1440:                        │              │
│  >>str w8, [x0, #0x120]                  │              │
│  probable ptr: 0x76F1234000               │              │
│   ... x0..pc dump ...                    │              │
│                          ◀ [Hit 1/37] ▶  │   Stop       │
└──────────────────────────────────────────┴──────────────┘

class HwbpWindow(QWidget):
    _hit_signal = pyqtSignal(list)
 
    def __init__(self, engine, client_host, client_port, pid, handle,
                 watch_addr, bp_type, bp_len,
                 modules=None, open_memview_fn=None, parent=None):
        super().__init__(parent)
        ...
        # Read client — 只给反汇编用，不做 polling
        self._read_client = CEClient()
        self._read_client.connect(client_host, client_port)
        self._read_handle = self._read_client.open_process(pid)
 
        # Capstone for ARM64 反汇编
        from capstone import Cs, CS_ARCH_ARM64, CS_MODE_ARM
        self._cs = Cs(CS_ARCH_ARM64, CS_MODE_ARM)
        self._cs.detail = True
 
        # 通过 engine 安装断点（复用 ctl socket）
        self._kf_slot_id = engine.set_breakpoint(watch_addr, bp_type_int, bp_len)
        engine.register(self._kf_slot_id, self._on_engine_hits)
 
        self._hit_signal.connect(self._process_hits)

def _on_engine_hits(self, hits):
    """Called from bp-poll thread — emit signal to Qt main thread."""
    if hits:
        self._hit_signal.emit(hits)

def _process_hits(self, hits):
    for hit in hits:
        if len(hit) == 6:
            pid, tid, _slot_id, _bp_type, _watch_addr, regs = hit
        else:
            pid, tid, regs = hit
        pc = regs[32]       # regs[32] = PC
        if pc in self.hit_map:
            self.hit_map[pc]["count"] += 1
            self.hit_map[pc]["regs"] = regs
            self.hit_map[pc]["tid"] = tid
            self.hit_map[pc]["history"].append((tid, regs))
        else:
            # 首次命中 — 拉指令 + Capstone 反汇编
            insn_bytes = self._read_insn(pc)
            asm_str = ""
            if insn_bytes and self._cs:
                insns = list(self._cs.disasm(insn_bytes, pc))
                if insns:
                    asm_str = f"{insns[0].mnemonic} {insns[0].op_str}"
            probable = None
            if insn_bytes:
                probable = _decode_probable(insn_bytes, regs, self.watch_addr)
            self.hit_map[pc] = {
                "count": 1, "regs": regs, "tid": tid,
                "asm": asm_str, "probable": probable,
                "addr_str": self._resolve(pc),
                "insn_bytes": insn_bytes,
                "history": [(tid, regs)],
            }
    self._refresh_list()

def _decode_probable(insn_bytes, regs, watched_addr):
    """ARM64 probable pointer: 从 STR/LDR 指令解码 base+offset。"""
    try:
        md = Cs(CS_ARCH_ARM64, CS_MODE_ARM)
        md.detail = True
        insns = list(md.disasm(insn_bytes[:4], 0))
        if not insns: return None
        insn = insns[0]
        mem_op = next((op for op in insn.operands if op.type == ARM64_OP_MEM), None)
        if not mem_op: return None
        base_name = insn.reg_name(mem_op.mem.base) if mem_op.mem.base else None
        if not base_name: return None
        disp = mem_op.mem.disp
        name_map = {f"x{i}": i for i in range(29)}
        name_map.update({"fp": 29, "lr": 30, "sp": 31})
        idx = name_map.get(base_name)
        if idx is None: return None
        return {
            "base_reg": base_name, "base_idx": idx,
            "offset": disp,
            "probable_ptr": (watched_addr - disp) & 0xFFFFFFFFFFFFFFFF,
            "asm": f"{insn.mnemonic} {insn.op_str}",
        }
    except Exception:
        return None

libue4.so+0x1440:
  >>str w8, [x0, #0x120]

  pointer → 0x76F12340E0
  base x0 = 0x76F1234000, offset = 0x120

def _read_insn(self, addr):
    try:
        return self._read_client.read_memory(self._read_handle, addr, 4)
    except:
        return None

000123_libue4.so+0x1440.txt
000045_libue4.so+0x1448.txt
_summary.txt

def _stop(self):
    sid = getattr(self, '_kf_slot_id', -1)
    if self._bp_engine and sid >= 0:
        self._bp_engine.clear_breakpoint(sid)
        self._kf_slot_id = -1
    self.btn_stop.setText("Close")
    self.btn_stop.clicked.disconnect()
    self.btn_stop.clicked.connect(self.close)