获取系统调用的参数与kretprobes后处理程序 [英] Get syscall parameters with kretprobes post handler

问题描述

我要与这些系统调用返回后LKM的sys_connect和sys_accept右追查。
我发现，Kprobes的可以给你访问寄存器时，探测系统调用返回，通过定义一个后处理程序。

我的问题是，我不知道如何从数据的系统调用的参数，我在后处理（即结构pt_regs）
后处理程序的定义那样：

 无效post_handler（结构kprobe * P，结构pt_regs *暂存器，无符号长标志）;
 

解决方案

这结构体系结构相关，所以我只是假设你是在x86上。

在条目：

  orig_eax = syscall_nr;
  该函数的EBX =第一个参数;
  ECX =第2个参数...
  EDX =第三个参数...
  ESI = 4参数...
  EDI = 5参数...（你是幸运的，在其他弓这可能是在栈中...）
 

在退出：

该函数的

  orig_eax =返回值
 

您不能假设里面EBX，ECX，EDX价值......仍然指向退出函数的参数（即当你post_handler叫），所以在这里你需要注册的两个处理程序，一个在条目，您可以从中可以将保存指向该结构插座，一个退出，从中你会真正现在，它被填充检查插座结构的内容。要通过这两个处理器之间的数据，你可以使用 kretprobe_instance 结构的申请数据。不要忘了增加 DATA_SIZE 提交的结构kretprobe 您在注册kretprobe。

这似乎有点复杂，但是一旦你多一点熟悉它应该是正常的。

请还记得，如果你需要做的唯一事情是跟踪这些事件，你可能只是使用ftrace基础设施的sysfs并以最小的努力获得所需的跟踪。

I want to trace with a LKM the sys_connect and sys_accept right after these system calls return. I found that kprobes can give you access to the registers when a probed system call returns, by defining a post handler.

My problem is that I don't know how to get the system call parameters from the data that I have in the post handler (i.e. the struct pt_regs) The post handler is defined like that:

void post_handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags);

解决方案

This structure is architecture dependent so I will just assume you are on x86.

On entry:

  orig_eax = syscall_nr;
  ebx = 1st argument of the function;
  ecx = 2nd arg...
  edx = 3rd arg...
  esi = 4th arg...
  edi = 5th arg... (you are lucky, on other arch this can be on the stack...)

On exit:

  orig_eax = return value of the function

You cannot assume that the value inside ebx,ecx,edx... still points to the argument of the function on exit (i.e. when your post_handler is called) so here you would need to register two handlers, one on entry, from which you can can save a pointer to the struct socket, and one on exit, from which you will actually inspect the content of the struct socket now that it's been filled. To pass data between the two handlers, you can use the filed data of the kretprobe_instance structure. Don't forget to increase the data_size filed of the struct kretprobe when you register your kretprobe.

This might seem a little complex but it should be alright once you are a bit more familiar with it.

Please also remember that if the only thing you need to do is trace those events, you might just use the ftrace infrastructure in sysfs and with minimum efforts get the trace that you want.

这篇关于获取系统调用的参数与kretprobes后处理程序的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！