Reading user-space address address when debugging kext

Question

I'd like to read user space address from lldb when debugging remote machine driver (kext) via kdp. I know that in code I could use copyin in order to move the code to kernel space and read it easily, so as expected when I've tried to read user memory directly it failed :

(lldb) memory read 0x000070000d15a024
error: kdp read memory failed (error 4)

is there some alternative to copyin during runtime debugging session to convert my data somewhere I could read it from the debugger ?

thanks

Answer 1

Assuming you load the debug scripts for the specific kernel you use (should be in the appropriate KDK), you have the printuserdata command.

This is its description:

printuserdata:
    Read userspace data for given task and print based on format provided.
    Syntax: (lldb) printuserdata <task_t> <uspace_address> <format_specifier>
    params:
        <task_t> : pointer to task
        <uspace_address> : address to user space memory
        <format_specifier> : String representation for processing the data and printing it.
                             e.g Q -> unsigned long long, q -> long long, I -> unsigned int, i -> int
                             10i -> 10 ints, 20s -> 20 character string, s -> null terminated string
                             See: https://docs.python.org/2/library/struct.html#format-characters
    options:
        -X : print all values in hex.
        -O <file path>: Save data to file

Example invocation:

(lldb) printuserdata 0xffffff8013257d80 0x00007fff941f5000 10c