New Linux plugin: fbdev graphics API

[Abyss-W4tcher]

Hi 👋,

The Linux fbdev API allows user space software to interact with the framebuffer (memory representation of a pixel bitmap). Present since 2.1.109, it was basically appreciated for its simplicity and its ability to create text consoles or graphics outputs without a video adapter or an X server.

Nowadays, it has mostly been replaced by the DRM subsystem, but a lot of drivers still provide backward compatibility for it, meaning that frames will still be stored in RAM/iomem !

The framebuffers can contain the terminal view (CTRL+ALT+FX), or any frame currently displayed by a software (e.g. video streaming) application. Here is a sample plugin run :

$ python3 vol.py -f sample.bin -o out_dir/ linux.graphics.fbdev --dump
  |        Address | Device |             ID |    Size | Virtual resolution | BPP |   State |                           Filename
* | 0x981240641000 |    fb0 | vboxvideodrmfb | 1920000 |            800x600 |  32 | RUNNING | vboxvideodrmfb_800x600_32bpp.png

With its associated image:

From a very high user abstraction view, this is basically a "screenshot" plugin, but it is not magical in any way.

Running this plugin against your old samples can sometimes give suprisingly accurate markers.

Relevance

Captures of terminals and displays can provide interesting insights about the activity at capture time, and UI settings details.

---

Additional runs :

  |        Address | Device |        ID |    Size | Virtual resolution | BPP |   State |                     Filename
* | 0xaaf803801000 |    fb0 | svgadrmfb | 4163040 |           1176x885 |  32 | RUNNING | svgadrmfb_1176x885_32bpp.png

  |        Address | Device |        ID |    Size | Virtual resolution | BPP |   State |                    Filename
* | 0xc90000162000 |    fb0 | vboxdrmfb | 1920000 |            800x600 |  32 | RUNNING | vboxdrmfb_800x600_32bpp.png

---

This plugin is the first part of the graphics release, with a DRM plugin parser coming (hopefully) soon. However, it is more complex and needs a few things (and possibly more, regarding the recent BTF work) to move before even getting to the PR stage.