Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>As far as I know analysing the assembly code and finding function arguments will be a difficult task, especially in case of Linux kernel code. One of the ways to find out the function arguments is to use the debugging information. Let me put this in step by step way.</p> <p>1) Build your kernel or module with debugging information (-g option), for an example let's assume that I have built a module named 'test.ko' with debugging information.</p> <p>2) Use readelf command to decode the debugging information. Like this:</p> <pre><code> $readelf debug-dump=info test.ko &gt; log.info </code></pre> <p>Here I redirected readelf output to log.info file.</p> <p>3) Now open the log.info and search for the function for which you want to find out the function arguments, in our case let's say 'foobar()'. There will be a Dwarf entry with TAG DW_TAG_subprogram for the function foobar(). After this TAG you will find the some other dwarf entries with function arguments names. In this entries you will find the location of these function arguments when a function is called. For example, it says that first argument 'arg' will be in the ebx register, second arguments will be in the esp+8 and third argument will be in the ecx register and so on. </p> <p>4) After you get these information, in your kprobe prehandler print all registers. And also print the stack data, this you can print as you know the esp register in the prehandler. </p> <p>5) Based on the information you get in the 3rd step search for the arguments values.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload