tanelpoder / 0xtools

0x.Tools: X-Ray vision for Linux systems
https://0x.tools
GNU General Public License v2.0
1.41k stars 107 forks source link

unistd_64.h #33

Closed winstonmzhang closed 1 year ago

winstonmzhang commented 1 year ago

psn Traceback (most recent call last): File "/usr/bin/psn", line 47, in import proc, psnreport File "/usr/lib/0xtools/proc.py", line 331, in syscall_id_to_name = get_system_call_names() File "/usr/lib/0xtools/proc.py", line 328, in get_system_call_names raise Exception('unistd_64.h not found in' + ' or '.join(unistd_64_paths) + '.\n You may need to "yum install kernel-headers" or "apt-get install libc6-dev"\n until this dependency is removed in a newer pSnapper version') Exception: unistd_64.h not found in/usr/include/asm/unistd_64.h or /usr/include/x86_64-linux-gnu/asm/unistd_64.h or /usr/include/asm-x86_64/unistd.h or /usr/lib/0xtools/syscall_64_5.15.0.h or /usr/lib/0xtools/syscall_64.h. You may need to "yum install kernel-headers" or "apt-get install libc6-dev" until this dependency is removed in a newer pSnapper version

I'm on 5.15.0-1033-azure #40~20.04.1-Ubuntu SMP Tue Jan 24 16:06:12 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

after installed libc6-dev, the problem is still happening

sudo apt-get install libc6-dev Reading package lists... Done Building dependency tree Reading state information... Done libc6-dev is already the newest version (2.31-0ubuntu9.9). 0 upgraded, 0 newly installed, 0 to remove and 7 not upgraded.

tanelpoder commented 1 year ago

Thanks - I'll test it out on my Ubuntu VM.

If you search for this, do you see the unistd_64.h file anywhere?

find /usr -name unistd_64.h

winstonmzhang commented 1 year ago

No, it didn't find anything

tanelpoder commented 1 year ago

Ok I installed Ubuntu server 20.04 on (on my machine, not Azure) and looks like the package linux-libc-dev provides the required file:

tanel@ubuntu20:~$ cat /etc/os-release 
NAME="Ubuntu"
VERSION="20.04.5 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.5 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

tanel@ubuntu20:~$ uname -a
Linux ubuntu20 5.4.0-139-generic #156-Ubuntu SMP Fri Jan 20 17:27:18 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

tanel@ubuntu20:~$ sudo find /usr -name unistd_64.h
/usr/src/linux-headers-5.4.0-139/arch/sh/include/uapi/asm/unistd_64.h
/usr/src/linux-headers-5.4.0-139-generic/arch/x86/include/generated/uapi/asm/unistd_64.h
/usr/include/x86_64-linux-gnu/asm/unistd_64.h

tanel@ubuntu20:~$ dpkg -S /usr/include/x86_64-linux-gnu/asm/unistd_64.h
linux-libc-dev:amd64: /usr/include/x86_64-linux-gnu/asm/unistd_64.h

Can you install that package and try again (in my env psn worked ok). The psn binary is not using the .h file for any compilation or like that, it just parses it and uses it for syscall# to syscall name translation.

winstonmzhang commented 1 year ago

I installed the package again:

sudo apt-get install linux-libc-dev Reading package lists... Done Building dependency tree Reading state information... Done linux-libc-dev is already the newest version (5.4.0-139.156). linux-libc-dev set to manually installed. 0 upgraded, 0 newly installed, 0 to remove and 17 not upgraded.

still can't find the .h file: find /usr -name unistd_64.h

my uname -a returned: 5.15.0-1033-azure #40~20.04.1-Ubuntu SMP Tue Jan 24 16:06:12 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

would 'aarch64' make the difference?

tanelpoder commented 1 year ago

Yep, good catch! The low level stuff like syscall numbering (and relevant .h files) are different on ARM (and other platforms).

Looks like the file we need is this /usr/include/asm-generic/unistd.h. I will release a new version that's smarter about what platform it runs on (but will test only x86 & aarch).

However, I had to comment out this line too (as aarch apparently doesn't have a simple syscall named epoll_wait, but other flavors with slightly different names):

[tanel@rhel9 0xtools]$ psn
Traceback (most recent call last):
  File "/usr/bin/psn", line 47, in <module>
    import proc, psnreport
  File "/usr/lib/0xtools/proc.py", line 349, in <module>
    , syscall_name_to_id['epoll_wait']        

I commented out the "epoll_wait" line 349 above (so that my code doesn't try to translate such a syscall name to a number (these are the known syscalls that have a single-file-descriptor argument, so I can look up the corresponding filename too).

I think I can make that piece of code just more robust, so that if a syscall name doesn't exist on a platform, it won't just return any ID for it, instead of erroring out like now.

(But "porting" this thing to ARM/aarch is definitely worth it)

tanelpoder commented 1 year ago

Fixed in v1.2.3 (run a make uninstall & make install)