bpftrace用户空间地址解析

Posted 2022-02-18 王万林 Ben

root@VM-20-5-ubuntu:~/bpftrace-developing# bpftrace -e 'uprobe:/bin/bash:readline  printf("PS1: %s\\n", str(*uaddr("ps1_prompt"))); '
Attaching 1 probe...
PS1: 

上述命令，不支持Address space layout randomization (ASLR)的命令。

如果命令是ASLR的，可以使用以下命令查看，

root@VM-20-5-ubuntu:~/bpftrace-developing# bpftrace  --include linux/sched.h -e 'uprobe:/bin/bash:readline  printf("PS1: %s\\n", str(*(curtask->mm->mmap->vm_start + uaddr("ps1_prompt")))); '
Attaching 1 probe...
PS1: \\[\\e]0;\\u@\\h: \\w\\a\\]$debian_chroot:+($debian_chroot)\\u@\\h:\\w\\

参考资料

https://github.com/iovisor/bpftrace/blob/master/docs/reference_guide.md#9-uaddr-address-resolution-user-levelhttps://github.com/iovisor/bpftrace/blob/master/docs/reference_guide.md#9-uaddr-address-resolution-user-level

uaddr(), usym(), ustack to support PIE ASLR · Issue #75 · iovisor/bpftrace · GitHubUbuntu 18.04 Bionic (and other OSes) have switched to randomizing the address space layout, which breaks simple approaches for symbol resolution. From https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes#Security_Improvements: In Ubuntu 18....https://github.com/iovisor/bpftrace/issues/75#issuecomment-555386648