kernel hack samples collection
- compile kernel with debug info
- replace kernel & modules
sudo gdb vmlinux /proc/kcore
kcore相当于一个物理内存的备份
kernel hacking -> compile-time checks and compiler options -> Compile the kernel with debug info(GDB scripts may leads to compile failure)
ebpf不能调用内核函数,只能调用bpf helper!!!!
Linux Extended BPF (eBPF) Tracing Tools
Variable | Description |
---|---|
pid | Process ID |
tid | Thread ID |
uid | User ID |
username | Username |
comm | Process or command name |
curtask | Current task_struct as a u64 |
nsecs | Current time in nanoseconds |
elapsed | Time in nanoseconds since bpftrace start |
kstack | Kernel stack trace |
ustack | User-level stack trace |
arg0...argN | Function arguments |
args | Tracepoint arguments |
retval | Function return value |
func | Function name |
probe | Full probe name |
$1...$N | Positional parameters |
cgroup | Default cgroup v2 ID |
Function | Description |
---|---|
printf("...") | Print formatted string |
time("...") | Print formatted time |
join(char *arr[]) | Join array of strings with a space |
str(char *s [, int length]) | Return string from s pointer |
buf(void *p [, int length]) | Return a hexadecimal string from p pointer |
strncmp(char *s1, char *s2, int length) | Compares two strings up to length |
sizeof(expression) | Returns the size of the expression |
kstack([limit]) | Kernel stack trace up to limit frames |
ustack([limit]) | User-level stack trace up to limit frames |
ksym(void *p) | Resolve kernel address to symbol |
usym(void *p) | Resolve user-space address to symbol |
kaddr(char *name) | Resolve kernel symbol name to address |
uaddr(char *name) | Resolve user-space symbol name to address |
ntop([int af,]int|char[4:16] addr) | Convert IP address data to text |
reg(char *name) | Return register value |
cgroupid(char *path) | Return cgroupid for /sys/fs/cgroup/... path |
time("...") | Print formatted time |
system("...") | Run shell command |
cat(char *filename) | Print file content |
signal(char[] sig | int sig) | Send a signal to the current task |
override(u64 rc) | Override a kernel function return value |
exit() | Exits bpftrace |
@ = count() | Count events |
@ = sum(x) | Sum the value |
@ = hist(x) | Power-of-2 histogram for x |
@ = lhist(x, min, max, step) | Linear histogram for x |
@ = min(x) | Record the minimum value seen |
@ = max(x) | Record the maximum value seen |
@ = stats(x) | Return the count, average, and total for this value |
delete(@x[key]) | Delete the map element |
clear(@x) | Delete all keys from the map |