jinsdb
commented
10 years ago 我自己使用的是基于201309150版本做了1个丑陋的patch diff kgtp-org/gtp.c kgtp/gtp.c 135c135,138
<
include <asm/cacheflush.h>
include <asm/tlbflush.h>
include <asm/io.h>
include <asm/fixmap.h>
192c195
<
//#define GTPDEBUG 1 197c200
< /* #define GTP_DEBUG_V */
define GTP_DEBUG_V
860c863,867
<
/*added for revise_addr & revise_val*/ GTP_REVISE_ADDR_ID = 48, GTP_REVISE_SIZE_ID = 49, GTP_REVISE_VAL_ID = 50,1990a1998,2262 void gtp_action_get_current_reg(struct gtp_trace_s gts, int num) { void ret = NULL; struct pt_regs regs = NULL;
regs = gts->regs;//task_pt_regs(get_current()); switch (num) {
ifdef CONFIG_X86_32
if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,25))
case 0: ret = &(regs->ax); break; case 1: ret = &(regs->cx); break; case 2: ret = &(regs->dx); break; case 3: ret = &(regs->bx); break; case 4: ret = &(regs->x86_32_sp); break; case 5: ret = &(regs->bp); break; case 6: ret = &(regs->si); break; case 7: ret = &(regs->di); break; case 8: ret = &(regs->ip); break; case 9: ret = &(regs->flags); break; case 10: ret = &(regs->cs); break; case 11: ret = &(regs->ss); break; case 12: ret = &(regs->ds); break; case 13: ret = &(regs->es); break; case 14: ret = &(regs->fs); break; case 15: ret = &(regs->gs); break;
else
case 0: ret = &(regs->eax); break; case 1: ret = &(regs->ecx); break; case 2: ret = &(regs->edx); break; case 3: ret = &(regs->ebx); break; case 4: ret = &(regs->x86_32sp); break; case 5: ret = &(regs->ebp); break; case 6: ret = &(regs->esi); break; case 7: ret = &(regs->edi); break; case 8: ret = &(regs->eip); break; case 9: ret = &(regs->eflags); break; case 10: ret = &(regs->xcs); break; case 11: ret = &(regs->xss); break; case 12: ret = &(regs->xds); break; case 13: ret = &(regs->xes); break; case 14: /* ret = gts->regs->xfs; / ret = 0; break; case 15: /_ ret = gts->regs->xgs; */ ret = 0; break;
endif
else
if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,25))
case 0: ret = &(regs->ax); break; case 1: ret = &(regs->bx); break; case 2: ret = &(regs->cx); break; case 3: ret = &(regs->dx); break; case 4: ret = &(regs->si); break; case 5: ret = &(regs->di); break; case 6: ret = &(regs->bp); break; case 7: ret = &(regs->sp); break; case 16: ret = &(regs->ip); break; case 17: ret = &(regs->flags); break;
else
case 0: ret = &(regs->rax); break; case 1: ret = &(regs->rbx); break; case 2: ret = &(regs->rcx); break; case 3: ret = &(regs->rdx); break; case 4: ret = &(regs->rsi); break; case 5: ret = &(regs->rdi); break; case 6: ret = &(regs->rbp); break; case 7: ret = &(regs->rsp); break; case 16: ret = &(regs->rip); break; case 17: ret = &(regs->eflags); break;
endif
case 8: ret = &(regs->r8); break; case 9: ret = &(regs->r9); break; case 10: ret = &(regs->r10); break; case 11: ret = &(regs->r11); break; case 12: ret = &(regs->r12); break; case 13: ret = &(regs->r13); break; case 14: ret = &(regs->r14); break; case 15: ret = &(regs->r15); break; case 18: ret = &(regs->cs); break; case 19: ret = &(regs->ss); break;
endif
default: ret = NULL; gts->tpe->reason = gtp_stop_access_wrong_reg; break; }
return ret; } static int gtp_revise_addr_set_val(struct gtp_trace_s gts, struct gtp_var gtv, int64_t val) { printk("gtp_revise_addr_set_val:0x%llx\n",val); gts->revise_addr = val; return 0; }
static struct gtp_var_hooks gtp_revise_addr_hooks = { .agent_set_val = gtp_revise_addr_set_val, };
long gtp_kernel_write(void _dst, void *src, sizet size); /
Do action: revise the value of $revise_addr. / static int gtp_revise_val_set_val(struct gtp_trace_s gts, struct gtp_var gtv, int64_t val) { uint64_t value = 0; uint64_t regaddr = NULL; printk("gtp_revise_val_set_val:set revise_addr:0x%llx val to 0x%llx\n", gts->revise_addr,val); if ((gts->revise_addr >=0) && (gts->revise_addr <= 19)){
regaddr = gtp_action_get_current_reg(gts, gts->revise_addr); if (NULL != regaddr){ /*do action of modify reg value.*/ *regaddr = val; } return 0;}
/modify data or code in memory./ value = be64_to_cpu(val); gtp_kernelwrite((void)(gts->reviseaddr), (void)&value, gts->revise_size);
return 0; }
static struct gtp_var_hooks gtp_revise_val_hooks = { .agent_set_val = gtp_revise_val_set_val, };
static int gtp_revise_size_set_val(struct gtp_trace_s gts, struct gtp_var gtv, int64_t val) { printk("gtp_revise_size_set_val:0x%llx\n",val); gts->revise_size = val; return 0; } 1991a2264,2266 static struct gtp_var_hooks gtp_revise_size_hooks = { .agent_set_val = gtp_revise_size_set_val, }; 2230a2506,2520
var = gtp_var_special_add(GTP_REVISE_ADDR_ID, 0, 0, "revise_addr", >p_revise_addr_hooks);if (IS_ERR(var)) return PTR_ERR(var);
var = gtp_var_special_add(GTP_REVISE_SIZE_ID, 0, 0, "revise_size", >p_revise_size_hooks);if (IS_ERR(var)) return PTR_ERR(var);
var = gtp_var_special_add(GTP_REVISE_VAL_ID, 0, 0, "revise_val", >p_revise_val_hooks);if (IS_ERR(var)) return PTR_ERR(var); 3345c3635
< if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) {
if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) 3347c3637
< if (unlikely(vma->vm_flags & (VM_PFNMAP))) {
if (unlikely(vma->vm_flags & (VM_PFNMAP))) 3348a3639 { 3898d4188 < 5249a5540
5783a6075,6096 static char hex2rawcode(char pkg, unsigned char *ubytes,int len) { int i = 0; int j = 0;
while (hex2int(pkg[0], &i) && len) { pkg++; if (j == 0){ /high byte/ _ubytes = i & 0xf; ubytes = (_ubytes) << 4; j++; }else{ /low byte/ ubytes |= i & 0xf; j = 0; ubytes++; len--; }
}
return pkg; } 8442c8755
< || gtp_have_step)) {
|| gtp_have_step))8444c8757
< )) {
))8445a8759 { 8597c8911
< if (gtp_have_step || gtp_have_watch_tracepoint) {
if (gtp_have_step || gtp_have_watch_tracepoint) 8599c8913
< if (gtp_have_step) {
if (gtp_have_step) 8600a8915 { 8638c8953
< if (tpe->addr != 0) {
if (tpe->addr != 0)8640c8955
< if (tpe->disable == 0 && tpe->addr != 0) {
if (tpe->disable == 0 && tpe->addr != 0)8641a8957 { 8667c8983
< if (tpe->step || gtp_have_step) {
if (tpe->step || gtp_have_step)8669c8985
< if (tpe->step) {
if (tpe->step)8670a8987 { 9941c10258
< if (GTP_RB_PAGE_IS_EMPTY) {
if (GTP_RB_PAGE_IS_EMPTY) 9944c10261
< if (!gtp_frame) {
if (!gtp_frame) 9945a10263 { 10389c10707
< if (gtp_start || !gtp_frame_current) {
if (gtp_start || !gtp_frame_current) 10391c10709
< if (gtp_start || gtp_frame_current_num < 0) {
if (gtp_start || gtp_frame_current_num < 0) 10392a10711 { 10753a11073,11170 static void set_addr_rw(unsigned long addr, int flag) { unsigned int level; pte_t pte;
*flag = 1; pte = lookup_address(addr, &level); if (pte->pte & _PAGE_RW) *flag = 0; else pte->pte |= _PAGE_RW;}
static void set_addr_ro(unsigned long addr, int flag) { unsigned int level; pte_t *pte;
if (flag) { pte = lookup_address(addr, &level); pte->pte = pte->pte &~_PAGE_RW; }}
long gtp_kernel_write(void dst, void src, size_t size) { int is_rw; int ret = 0; unsigned long flags;
preempt_disable();local_irq_save(flags);
set_addr_rw((unsigned long)dst, &is_rw); ret = probe_kernel_write(dst, src, size); set_addr_ro((unsigned long)dst, is_rw); local_flush_tlb();sync_core(); local_irq_restore(flags);
preempt_enable();
return ret;}
define MAX_BYTES 12 /enough/
/pkg: ffffffffa0a6a5f0,1:c3/ static int gtp_gdbrsp_M(char *pkg) {
ifdef GTP_DEBUG
int i = 0;endif
int ret = 0; char *org_pkg = NULL;ULONGEST addr, len; unsigned char tmp_raw[MAX_BYTES];
if (pkg[0] == '\0') return -EINVAL; memset(tmp_raw, 0x0, sizeof(tmpraw)); /* Get add and len. / pkg = hex2ulongest(pkg, &addr); if (pkg[0] != ',') return -EINVAL; pkg++; pkg = hex2ulongest(pkg, &len); if (len == 0) return -EINVAL; len &= 0xffff; len = (ULONGEST) min((int)(GTP_RW_BUFP_MAX / 2), (int)len); if (pkg[0] != ':') return -EINVAL; pkg++; org_pkg = pkg; /_Get raw hex code*/ pkg = hex2rawcode(pkg, tmp_raw, sizeof(tmp_raw));
ifdef GTP_DEBUG
printk(GTP_DEBUG "gtp_gdbrsp_M: addr = 0x%lx len = %d\n", (unsigned long) addr, (int) len); for (i = 0; i < sizeof(tmp_raw);i++) { printk("0x%x ", tmp_raw[i]); } printk("\n");
endif
if (pkg == org_pkg) { printk("not found raw code.\n"); return -EINVAL; } ret = gtp_kernel_write((void*)addr, tmp_raw, len); return ret;10754a11172 } 10783c11201
< if (gtp_start || !gtp_frame_current) {
if (gtp_start || !gtp_frame_current) 10785c11203
< if (gtp_start || gtp_frame_current_num < 0) {
if (gtp_start || gtp_frame_current_num < 0) 10786a11205 { 11029c11448
< if (gtp_start || !gtp_frame_current) {
if (gtp_start || !gtp_frame_current) 11031c11450
< if (gtp_start || gtp_frame_current_num < 0) {
if (gtp_start || gtp_frame_current_num < 0) 11032a11452 { 11730a12151,12154 /case 'M':write memory/ case 'M': ret = gtp_gdbrsp_M(rsppkg + 1); break; 12169c12593
<
12453c12877
< if (GTP_RB_PAGE_IS_EMPTY) {
if (GTP_RB_PAGE_IS_EMPTY) 12455c12879
< if (!gtp_frame) {
if (!gtp_frame) 12456a12881 { 12509a12935
12536c12962
< if (GTP_RB_PAGE_IS_EMPTY) {
if (GTP_RB_PAGE_IS_EMPTY) 12538c12964
< if (!gtp_frame) {
if (!gtp_frame) 12539a12966 { 12544c12971
< !GTP_RB_PAGE_IS_EMPTY) == -ERESTARTSYS) {
!GTP_RB_PAGE_IS_EMPTY) == -ERESTARTSYS)12547c12974
< gtp_frame) == -ERESTARTSYS) {
gtp_frame) == -ERESTARTSYS)12548a12976 {
实现以下gdb命令： 1.(gdb) set (unsigned char )(0xxxxxx) = 0xc3 #修改0xxxxxx处的指令 2.添加trace point var $revise_addr、$revise_val、$revise_size在tracepoint处修改寄存器或内存内容 如，修改寄存器： 修改函数第一个参数 trace *xxxfunction actions
teval $revise_addr=5 teval $revise_val=0x22003 end 修改rdi寄存器的值为0x22003，$revise_addr的值从从0～19分别表示rax,rbx,rcx,rdx,rsi,rdi...ss
tracepoint触发时候，修改内存的内容的如下： 修改内存指令或数据 trace *xxxfuction actions
teval $revise_addr=0xxxxxx teval $revise_size=3 teval $revise_val=0x022003 end 表示修改0xxxxxx处3个字节内容为02 20 03
用tracepoint var的方式不是很好用，最好是能在tracepint actions中支持set指令，用类似如下的方式修改寄存器或内存的内容：set $pc = 0xxxxx，set v_inpointer->id = 0x485；
貌似早期版本的kgtp有个patch支持tracepoint 使用printf，这个功能挺方便的，不知道这个功能能否添加到最新版本中？
teawater
http://bbs.chinaunix.net/thread-3750800-1-1.html