Closed onroadmuwl closed 1 year ago
We don't use gdb
to debug replace_function.so
. This debug option -DDEBUG
is used to debug mysqld
after the code replacement is done by Ocolos
. We developed this debug feature to check whether Ocolos
injected machine code to mysqld
's text section correctly. So the correct steps for -DDEBUG
are: after gdb
is attached to mysqld
, set a breakpoint in mysqld
's code rather than replace_function.so
's code, and then let mysqld
run.
This is how replace_function.so
works:
tracer
first pauses the target process and then changes the instruction pointer (rip
) of mysqld
to be the starting address of insert_machine_code() in replace_function.so
. tracer
resumes mysqld
, so mysqld
starts from the insert_machine_code()
function. insert_machine_code()
function inserts machine code to mysqld
's text section. insert_machine_code()
, the function raises a SIGSTOP
to tracer
and stops there.tracer
receives the SIGSTOP
signal and change the rip
back to the old rip
which points to the original mysqld
's codetracer
resumes mysqld
again. (The -DDEBUG
feature allows you to attach gdb to mysqld
at this point.)So it is expected to see replace_function.so
reports "Program received signal SIGSTOP, Stopped (signal)", because by the time you attached gdb
to that thread, the code in replace_function.so
had already finished execution.
To debug code in replace_function.so
, my suggestion is to redirect the debug message to a file. After replace_function.so
finishes its execution, you can check that file. There is a file called machine_code.txt
in your tmp_data_dir. It is the log file of replace_function.so
. It is now used for recording all machine code we've inserted to mysqld
. You can also write other information to that file or create your own file.
It’s clear to me now, thank you for your prompt and insightful response.
I am trying to understand the detailed process of ocolos's code replacement, but I am unable to reach the insert_machine_code() function through GDB. Would you like to guide me through the general steps of debugging replace_function.so? Here's what I've tried so far:
May I ask you how you usually debug and understand the code inside “replace_function.so”?