Я пытаюсь перебрать vm_area_struct всякий раз, когда программа пользовательского пространства вызывает функцию hello. Как это сделать?
mm->mmap больше недоступен. Нам нужно перебрать дерево клена mm_mt. Но for_each_vma не работает из-за ошибки, показанной ниже.
Я хочу в конечном итоге скопировать одну из страниц vm_area, но застрял на предыдущем этапе. Упоминаю об этом на случай, если это проблема X/Y.
Мой код:
from bcc import BPF
bpf_text = r"""
#include
#include
#include
#include
#include
int hello_enter(struct pt_regs *ctx) {
bpf_trace_printk("Hello\n");
struct task_struct *ts = (struct task_struct *)bpf_get_current_task();
bpf_trace_printk("%u\n", ts->pid);
struct mm_struct *mm = ts->mm;
if (mm) {
struct vm_area_struct *vma;
VMA_ITERATOR(iter, mm, 0);
for_each_vma(iter, vma) {
//virt_size += vma->vm_end - vma->vm_start;
//bpf_trace_printk("%lx\t%lx", vma->vm_start, vma->vm_end);
}
} else {
bpf_trace_printk("No memory management structure (mm) found\n");
}
return 0;
}
"""
# Load BPF program
b = BPF(text=bpf_text)
# Attach uprobe
b.attach_uprobe(name="./test.out", sym="hello", fn_name="hello_enter")
# Print traced messages
b.trace_print()
Ошибка:
sudo python as2.py
In file included from /virtual/main.c:2:
In file included from include/uapi/linux/ptrace.h:183:
In file included from arch/x86/include/asm/ptrace.h:5:
In file included from arch/x86/include/asm/segment.h:7:
arch/x86/include/asm/ibt.h:77:8: warning: 'nocf_check' attribute ignored; use -fcf-protection to enable the attribute [-Wignored-attributes]
extern __noendbr u64 ibt_save(bool disable);
^
arch/x86/include/asm/ibt.h:32:34: note: expanded from macro '__noendbr'
#define __noendbr __attribute__((nocf_check))
^
arch/x86/include/asm/ibt.h:78:8: warning: 'nocf_check' attribute ignored; use -fcf-protection to enable the attribute [-Wignored-attributes]
extern __noendbr void ibt_restore(u64 save);
^
arch/x86/include/asm/ibt.h:32:34: note: expanded from macro '__noendbr'
#define __noendbr __attribute__((nocf_check))
^
2 warnings generated.
bpf: Failed to load program: Invalid argument
jump out of range from insn 41 to 58
processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
Traceback (most recent call last):
File "/mnt/veracrypt3/projects/ebpf/as2.py", line 39, in
b.attach_uprobe(name="./test.out", sym="hello", fn_name="hello_enter")
File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 1383, in attach_uprobe
fn = self.load_func(fn_name, BPF.KPROBE)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 526, in load_func
raise Exception("Failed to load BPF program %s: %s" %
Exception: Failed to load BPF program b'hello_enter': Invalid argument
Источник: https://stackoverflow.com/questions/781 ... cc-program
