使用 kretprobes 后处理程序获取系统调用参数

发布于 2024-12-20 01:57:51 字数 277 浏览 1 评论 0原文

我想在这些系统调用返回后立即使用 LKM 跟踪 sys_connect 和 sys_accept。我发现当被探测的系统调用返回时，kprobes 可以通过定义一个后处理程序让您访问寄存器。

我的问题是我不知道如何从后处理程序中的数据（即 struct pt_regs）获取系统调用参数帖子处理程序的定义如下：

void post_handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags);

原文

I want to trace with a LKM the sys_connect and sys_accept right after these system calls return.
I found that kprobes can give you access to the registers when a probed system call returns, by defining a post handler.

My problem is that I don't know how to get the system call parameters from the data that I have in the post handler (i.e. the struct pt_regs)
The post handler is defined like that:

void post_handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags);

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

格子衫的從容 2024-12-27 01:57:51

此结构依赖于体系结构，因此我假设您使用的是 x86。

进入时：

  orig_eax = syscall_nr;
  ebx = 1st argument of the function;
  ecx = 2nd arg...
  edx = 3rd arg...
  esi = 4th arg...
  edi = 5th arg... (you are lucky, on other arch this can be on the stack...)

退出时：

  orig_eax = return value of the function

你不能假设 ebx,ecx,edx... 中的值仍然指向退出时函数的参数（即当你的 post_handler 被调用时），所以在这里你需要注册两个处理程序，一个在入口处，您可以在其中保存指向结构套接字的指针，另一个在退出处，您将在其中实际检查结构套接字的内容，因为它已被填充。要在两个处理程序之间传递数据，您可以使用 kretprobe_instance 结构的归档data。当您注册 kretprobe 时，不要忘记增加 struct kretprobe 的 data_size 字段。

这可能看起来有点复杂，但是一旦您更加熟悉它就应该没问题。

另请记住，如果您唯一需要做的就是跟踪这些事件，您可能只需使用 sysfs 中的 ftrace 基础设施，并以最小的努力获得您想要的跟踪。

This structure is architecture dependent so I will just assume you are on x86.

On entry:

  orig_eax = syscall_nr;
  ebx = 1st argument of the function;
  ecx = 2nd arg...
  edx = 3rd arg...
  esi = 4th arg...
  edi = 5th arg... (you are lucky, on other arch this can be on the stack...)

On exit:

  orig_eax = return value of the function

You cannot assume that the value inside ebx,ecx,edx... still points to the argument of the function on exit (i.e. when your post_handler is called) so here you would need to register two handlers, one on entry, from which you can can save a pointer to the struct socket, and one on exit, from which you will actually inspect the content of the struct socket now that it's been filled. To pass data between the two handlers, you can use the filed data of the kretprobe_instance structure. Don't forget to increase the data_size filed of the struct kretprobe when you register your kretprobe.

This might seem a little complex but it should be alright once you are a bit more familiar with it.

Please also remember that if the only thing you need to do is trace those events, you might just use the ftrace infrastructure in sysfs and with minimum efforts get the trace that you want.

回复收藏 0 原文

~没有更多了~