我试图在ptrace内部出现malloc时捕获。
我已经能够在调用malloc时挂起,所以我应该能够
capture
通过一些定制模块;但是,这是在使用动态库时(-static标志为
不
使用)。
有没有一种方法可以让我以通用的方式做到这一点?
如果我们看下面的集合,我知道我需要捕捉的地方。我只是不知道怎么做:
.file "new.c"
.section .rodata
.LC0:
.string "Hello World"
.text
.globl main
.type main, @function
main:
.LFB2:
.cfi_startproc
pushq %rbp
.cfi_def_cfa_offset 16
.cfi_offset 6, -16
movq %rsp, %rbp
.cfi_def_cfa_register 6
subq $16, %rsp
movl $4, %edi
call malloc ;<= TRAP HERE
movq %rax, -8(%rbp)
movl $.LC0, %edi
call puts
movq -8(%rbp), %rax
movq %rax, %rdi
call free
leave
.cfi_def_cfa 7, 8
ret
.cfi_endproc
.LFE2:
.size main, .-main
.ident "GCC: (SUSE Linux) 4.8.1 20130909 [gcc-4_8-branch revision 202388]"
.section .note.GNU-stack,"",@progbits
从…起
ptrace(2)
,
PTRACE_inlestep
对于PTRACE_CONT,重新启动已停止的跟踪,但应分别在系统调用的下一个入口或出口处,或在执行单个指令后停止跟踪。(通常,在收到信号后,跟踪也将停止。)`
所以我很确定我需要这个选项。从
tutorial
我读过书,我能迈出一步;然而,这些输出都没有意义。特别是如果我有某种输出语句。以下是有输出时的简短输出:
RIP: 7ff6cc4387c2 Instruction executed: 63158b48c35d5e41
RIP: 7ff6cc4387c4 Instruction executed: 2f0663158b48c35d
RIP: 7ff6cc4387c5 Instruction executed: 2f0663158b48c3
RIP: 400c38 Instruction executed: 7500e87d83e84589
RIP: 400c3b Instruction executed: b93c7500e87d83
RIP: 400c3f Instruction executed: ba00000000b93c75
RIP: 400c41 Instruction executed: ba00000000b9
RIP: 400c46 Instruction executed: be00000000ba
RIP: 400c4b Instruction executed: bf00000000be
RIP: 400c50 Instruction executed: b800000000bf
RIP: 400c55 Instruction executed: fe61e800000000b8
RIP: 400c5a Instruction executed: bafffffe61e8
RIP: 400ac0 Instruction executed: a68002015a225ff
RIP: 400ac6 Instruction executed: ff40e90000000a68
RIP: 400acb Instruction executed: 9a25ffffffff40e9
RIP: 400a10 Instruction executed: 25ff002015f235ff
RIP: 400a16 Instruction executed: 1f0f002015f425ff
RIP: 7ff6ccf6c160 Instruction executed: 2404894838ec8348
RIP: 7ff6ccf6c164 Instruction executed: 244c894824048948
RIP: 7ff6ccf6c168 Instruction executed: 54894808244c8948
RIP: 7ff6ccf6c16d Instruction executed: 7489481024548948
....
Hello world
....
为什么IP的价值变化如此剧烈?这是因为我现在处于内核模式吗?
此外,看起来执行的指令的输出没有正确排列(就像它被分割成多行),但这可能只是我试图在没有模式的地方放置一个模式。
无论如何,这是我正在运行的程序,用于输出:
警告,讨厌的C\C++混合物
#include <iostream>
#include <sys/ptrace.h>
#include <unistd.h>
#include <asm/unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/syscall.h>
#include <sys/reg.h>
#include <sys/user.h>
#include <iomanip>
using namespace std;
#if __WORDSIZE == 64
#define REG(reg) reg.orig_rax
#else
#define REG(reg) reg.orig_eax
#endif
int main()
{
pid_t child;
long orig_eax;
const int long_size = sizeof(long);
child = fork();
long ins;
if(child == 0)
{
ptrace(PTRACE_TRACEME, 0, NULL, NULL);
execl("./dummy", "dummy", NULL);
}
else
{
ptrace(PTRACE_ATTACH, child, NULL, NULL);
ptrace(PTRACE_SYSCALL, child, NULL, NULL);
int status;
union u {
long val;
char chars[long_size];
}data;
struct user_regs_struct regs;
int start = 0;
long ins;
while(1)
{
wait(&status);
if(WIFEXITED(status))
break;
ptrace(PTRACE_GETREGS,child, NULL, ®s);
ins = ptrace(PTRACE_PEEKTEXT, child, regs.rip, NULL);
cout << "RIP: " << hex << regs.rip << " Instruction executed: " << ins << endl;
ptrace(PTRACE_SINGLESTEP, child, NULL, NULL);
}
ptrace(PTRACE_DETACH, child, NULL, NULL);
}
}
如果还有其他需要的信息,请告诉我。我知道我有点啰嗦,但如果回答了这个问题,希望它能为下一个试图学习ptrace的人提供足够的信息。
