使用 kretprobes 后处理程序获取系统调用参数 [英] Get syscall parameters with kretprobes post handler

问题描述

我想在这些系统调用返回后立即使用 LKM 跟踪 sys_connect 和 sys_accept.我发现当被探测的系统调用返回时，kprobes 可以让你访问寄存器，通过定义一个后处理程序.

I want to trace with a LKM the sys_connect and sys_accept right after these system calls return. I found that kprobes can give you access to the registers when a probed system call returns, by defining a post handler.

我的问题是我不知道如何从我在后处理程序(即结构 pt_regs)中的数据中获取系统调用参数后处理程序定义如下:

My problem is that I don't know how to get the system call parameters from the data that I have in the post handler (i.e. the struct pt_regs) The post handler is defined like that:

void post_handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags);

推荐答案

这个结构依赖于架构，所以我假设你使用的是 x86.

This structure is architecture dependent so I will just assume you are on x86.

进入时:

  orig_eax = syscall_nr;
  ebx = 1st argument of the function;
  ecx = 2nd arg...
  edx = 3rd arg...
  esi = 4th arg...
  edi = 5th arg... (you are lucky, on other arch this can be on the stack...)

退出时:

  orig_eax = return value of the function

你不能假设 ebx,ecx,edx... 中的值仍然指向退出时函数的参数(即当你的 post_handler 被调用时)，所以在这里你需要注册两个 处理程序，一个在入口处，您可以从中保存指向 struct socket 的指针，另一个在退出时，您将在其中实际检查 struct socket 的内容，因为它已被填充.要在两个处理程序之间传递数据，您可以使用 kretprobe_instance 结构的归档 data.注册 kretprobe 时，不要忘记增加 struct kretprobe 的 data_size 字段.

You cannot assume that the value inside ebx,ecx,edx... still points to the argument of the function on exit (i.e. when your post_handler is called) so here you would need to register two handlers, one on entry, from which you can can save a pointer to the struct socket, and one on exit, from which you will actually inspect the content of the struct socket now that it's been filled. To pass data between the two handlers, you can use the filed data of the kretprobe_instance structure. Don't forget to increase the data_size filed of the struct kretprobe when you register your kretprobe.

这可能看起来有点复杂，但是一旦你熟悉它应该没问题.

This might seem a little complex but it should be alright once you are a bit more familiar with it.

还请记住，如果您唯一需要做的就是跟踪这些事件，您可能只需使用 sysfs 中的 ftrace 基础架构，并以最少的努力获得您想要的跟踪.

Please also remember that if the only thing you need to do is trace those events, you might just use the ftrace infrastructure in sysfs and with minimum efforts get the trace that you want.

这篇关于使用 kretprobes 后处理程序获取系统调用参数的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！