当用户模式下没有加载符号时，如何找到特定 C 函数的符号？
这个问题中提到了以下代码。
int (*my_printk)(const char *fmt, ...);
my_printk = find_symbol_address("printk");
(*my_printk)("Hello, world!\n");
如果LSM框架不导出其符号，OP如何找到符号地址？ OP的问题是在内核模式下；我很好奇如何在用户模式下做到这一点。
The following code is mentioned in this question.
int (*my_printk)(const char *fmt, ...);
my_printk = find_symbol_address("printk");
(*my_printk)("Hello, world!\n");
How does the OP find the symbol address if the LSM framework doesn't export its symbols? The OP's question is in kernel mode; I am curious how to do it in user mode.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您链接到的问题与用户空间非常不同：因为内核维护一个完整的符号表（请参阅
kernel/module.c函数lookup_symbol），所以这不是很困难扫描表格并查找特定符号，找到其地址，然后执行他正在执行的相当老套的插入操作。 （我理解他的推理，但遗憾的是他不仅仅将他的源代码打造成一个可以应用于分发内核甚至包含在主线内核树中的补丁。公平地说，他的代码，他的时间，他的游乐场，但它确实意味着他可以做一些非常古怪的事情。）用户模式有点不同；如果符号不可用，则它们就是不可用。内核开发人员付出了一些努力来模拟用户空间中常见的“有可用符号”的情况，如果您
strip(1)编辑了代码，它们就会消失。Your linked-to question is very different than userspace: because the kernel maintains a complete symbol table (see
kernel/module.cfunctionlookup_symbol), it isn't very difficult to scan the table and look for a specific symbol, find its address, and perform the fairly hacky interpositioning he is performing. (I understand his reasoning, but its a pity he didn't just make his source a patch that could be applied to distribution kernels or even included into the mainline kernel tree. Fair enough, his code, his time, his playground, but it does mean he gets to do some pretty hacky things.)User mode is a little different; if the symbols aren't available, they're just not available. The kernel developers went to some effort to emulate the case of "having symbols available" that is common in userspace, and if you've
strip(1)ed your code, they're gone.