yasukata / zpoline

system call hook for Linux
Apache License 2.0
408 stars 32 forks source link

segmentfault #1

Open yangboyd opened 1 year ago

yangboyd commented 1 year ago

kernel: traps: ls[6598] general protection ip:7fc701007c85 sp:7ffc7f0f5248 error:0 in libc-2.17.so[7fc700f1a000+1b6000]

(gdb) bt

0 0x00007f7b40633c85 in tcgetattr () from /lib64/libc.so.6

1 0x00007f7b406301fc in isatty () from /lib64/libc.so.6

2 0x0000000000402a8f in ?? ()

3 0x00007f7b4118a8f0 in __frame_dummy_init_array_entry () from ./libzpoline.so

4 0x00007f7b40f680fe in asm_syscall_hook () from ./libzpoline.so

5 0x0000000000000000 in ?? ()

(gdb) f 3

3 0x00007f7b4118a8f0 in __frame_dummy_init_array_entry () from ./libzpoline.so

(gdb) disas Dump of assembler code for function __frame_dummy_init_array_entry: 0x00007f7b4118a8e8: (bad)
0x00007f7b4118a8e9: jg 0x7f7b4118a8e1 0x00007f7b4118a8eb: rex jnp 0x7f7b4118a96d <rexes.11457+77> 0x00007f7b4118a8ee: add %al,(%rax) => 0x00007f7b4118a8f0: mov $0x7b,%al 0x00007f7b4118a8f2: testb $0x7f,0x7b(%rax) 0x00007f7b4118a8f6: add %al,(%rax) End of assembler dump. (gdb) f 4

4 0x00007f7b40f680fe in asm_syscall_hook () from ./libzpoline.so

(gdb) disas Dump of assembler code for function asm_syscall_hook: 0x00007f7b40f680da <+0>: pop %rax 0x00007f7b40f680db <+1>: cmp $0xf,%rax 0x00007f7b40f680df <+5>: je 0x7f7b40f68110 0x00007f7b40f680e1 <+7>: push %rbp 0x00007f7b40f680e2 <+8>: mov %rsp,%rbp 0x00007f7b40f680e5 <+11>: and $0xfffffffffffffff0,%rsp 0x00007f7b40f680e9 <+15>: push %r11 0x00007f7b40f680eb <+17>: push %r9 0x00007f7b40f680ed <+19>: push %r8 0x00007f7b40f680ef <+21>: push %rdi 0x00007f7b40f680f0 <+22>: push %rsi 0x00007f7b40f680f1 <+23>: push %rdx 0x00007f7b40f680f2 <+24>: push %rcx 0x00007f7b40f680f3 <+25>: pushq 0x8(%rbp) 0x00007f7b40f680f6 <+28>: push %rax 0x00007f7b40f680f7 <+29>: push %r10 0x00007f7b40f680f9 <+31>: callq 0x7f7b40f67620 syscall_hook@plt => 0x00007f7b40f680fe <+36>: pop %r10 0x00007f7b40f68100 <+38>: add $0x10,%rsp 0x00007f7b40f68104 <+42>: pop %rcx 0x00007f7b40f68105 <+43>: pop %rdx 0x00007f7b40f68106 <+44>: pop %rsi 0x00007f7b40f68107 <+45>: pop %rdi 0x00007f7b40f68108 <+46>: pop %r8 0x00007f7b40f6810a <+48>: pop %r9 0x00007f7b40f6810c <+50>: pop %r11 0x00007f7b40f6810e <+52>: leaveq 0x00007f7b40f6810f <+53>: retq
End of assembler dump. (gdb) info registers rax 0x0 0 rbx 0x0 0 rcx 0x8a3b 35387 rdx 0x500 1280 rsi 0x10004157f1c03 281492517231619 rdi 0x500000500 21474837760 rbp 0x2 0x2 rsp 0x7ffd658780e0 0x7ffd658780e0 r8 0x8a3b000000bf 151986007703743 r9 0x10004157f1c0300 72062084411294464 r10 0x0 0 r11 0x170f12001a131100 1661566579169759488 r12 0x7ffd65878248 140726306832968 r13 0x7ffd65878240 140726306832960 r14 0x0 0 r15 0x0 0 rip 0x7f7b40f680fe 0x7f7b40f680fe <asm_syscall_hook+36> eflags 0x10246 [ PF ZF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0

yasukata commented 1 year ago

Thank you for your report.

Could you give me a bit more information so that I can reproduce this error?

Particularly, the following information will be helpful.

yangboyd commented 1 year ago

LIBZPHOOK=./apps/basic/libzphook_basic.so LD_PRELOAD=./libzpoline.so ls CentOS 7 x86_64 vm On centos7 the code cannot be compiled, so I use /opt/rh/devtoolset-8/root/usr/bin/gcc to compile, install via yum install devtoolset-8-binutils-devel

LIBZPHOOK=./apps/basic/libzphook_basic.so LD_PRELOAD=./libzpoline.so /opt/rh/devtoolset-8/root/usr/bin/gcc Initializing zpoline ... -- Setting up trampoline code -- Rewriting the code Loading hook library ... -- load ./apps/basic/libzphook_basic.so -- call hook init output from __hook_init: we can do some init work here output from hook_function: syscall number 1 Start main program output from hook_function: syscall number 12 output from hook_function: syscall number 12 output from hook_function: syscall number 12 output from hook_function: syscall number 2 output from hook_function: syscall number 5 output from hook_function: syscall number 9 output from hook_function: syscall number 3 output from hook_function: syscall number 2 output from hook_function: syscall number 5 output from hook_function: syscall number 9 output from hook_function: syscall number 0 output from hook_function: syscall number 0 output from hook_function: syscall number 3 output from hook_function: syscall number 11 output from hook_function: syscall number 2 output from hook_function: syscall number 2 output from hook_function: syscall number 2 output from hook_function: syscall number 2 output from hook_function: syscall number 2 output from hook_function: syscall number 2 output from hook_function: syscall number 21 output from hook_function: syscall number 16 Segmentation fault []# uname -a Linux 3.10.0-1062.12.1.el7.x86_64 #1 SMP Tue Feb 4 23:02:59 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

yasukata commented 1 year ago

I could reproduce the error.

I will look into this, and get back to you once I figure out the problem.

Thank you for reporting the issue.