使用kvm接口探察内核空间的方法 - Chinaunix

#include <fcntl.h>
#include <kvm.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <net/route.h>
/* 这个数组用于向kvm_nlist()函数传递需要查找其地址的所有内核符号，
* 数组最后一个元素须设为NULL。
*/
struct nlist nl[] = {
{ "_rt_tables"},
{ NULL },
};
/* 这个数组用于复制内核中的rt_tables[]数组的内容 */
struct radix_node_head *rt_tables[AF_MAX+1];
int main(void)
{
kvm_t *kvmd;
char buf[100];
struct radix_node_head v4head;
struct radix_node rnode;
/* 获取kvm文件描述符 */
if ((kvmd = kvm_openfiles(NULL, NULL, NULL, O_RDONLY, buf)) == NULL) {
printf("kvm_openfiles fail! %s\n", kvm_geterr(kvmd));
exit(0);
}
/* 获取内核中的rt_tables符号的地址 */
if (kvm_nlist(kvmd, nl) < 0) {
printf("kvm_nlist fail! %s\n", kvm_geterr(kvmd));
exit(0);
}
/* 将内核中的路由表头指针数组复制到rt_tables[]指针数组中 */
if (kvm_read(kvmd, nl[0].n_value, &rt_tables, sizeof(rt_tables))
!= sizeof(rt_tables)) {
printf("kvm_read rt_tables fail! %s\n", kvm_geterr(kvmd));
exit(0);
}
/* 将内核中的ipv4路由表头节点复制到v4head结构体中 */
if (kvm_read(kvmd, (int)rt_tables[AF_INET], &v4head, sizeof(v4head))
!= sizeof(v4head)) {
printf("kvm_read v4 route headfail! %s\n", kvm_geterr(kvmd));
exit(0);
}
printf("v4head.rnh_treetop = %p\n", v4head.rnh_treetop);
/* 将内核中的ipv4路由表的中间根节点的内容复制到rnode结构体中 */
if (kvm_read(kvmd, (int)v4head.rnh_treetop, &rnode, sizeof(rnode))
!= sizeof(rnode)) {
printf("kvm_read v4 root node fail! %s\n", kvm_geterr(kvmd));
exit(0);
}
printf("rnode.rn_mklist = %p\n", rnode.rn_mklist);
printf("rnode.rn_parent = %p\n", rnode.rn_parent);
printf("rnode.rn_bit = %d\n", rnode.rn_bit);
printf("rnode.rn_bmask = %x\n", rnode.rn_bmask);
printf("rnode.rn_flags = %x\n", rnode.rn_flags);
printf("rnode.rn_offset = %d\n", rnode.rn_offset);
printf("rnode.rn_left = %p\n", rnode.rn_left);
printf("rnode.rn_right = %p\n", rnode.rn_right);
}

复制代码

#include <fcntl.h>
#include <kvm.h>
#include <sys/param.h>
#include <sys/sysctl.h>
#include <sys/user.h>
int main(int argc, char *argv[])
{
kvm_t *kvmd;
char buf[100];
int nentries;
struct kinfo_proc *kp;
struct vmspace pspace;
if (argc <= 1) {
printf("PID, please!\n");
exit(0);
}
/* 获取kvm文件描述符 */
if ((kvmd = kvm_openfiles(NULL, NULL, NULL, O_RDONLY, buf)) == NULL) {
printf("kvm_openfiles fail! %s\n", kvm_geterr(kvmd));
exit(0);
}
/* 获取指定进程的kinfo_proc结构体指针 */
if ((kp = kvm_getprocs(kvmd, KERN_PROC_PID, atoi(argv[1]),
&nentries)) == NULL) {
printf("kvm_getprocs fail! %s\n", kvm_geterr(kvmd));
exit(0);
}
printf("kp->ki_pid = %d\n", kp->ki_pid);
printf("kp->ki_uid = %d\n", kp->ki_uid);
printf("kp->ki_size = %d\n", kp->ki_size);
printf("kp->ki_rssize = %d\n", kp->ki_rssize);
/* 读出指定进程的vmspace结构体的内容 */
if (kvm_read(kvmd, (int)kp->ki_vmspace, &pspace, sizeof(pspace))
!= sizeof(pspace)) {
printf("kvm_read fail! %s\n", kvm_geterr(kvmd));
exit(0);
}
printf("pspace.vm_swrss = %d\n", pspace.vm_swrss);
printf("pspace.vm_tsize = %d\n", pspace.vm_tsize);
printf("pspace.vm_dsize = %d\n", pspace.vm_dsize);
printf("pspace.vm_ssize = %d\n", pspace.vm_ssize);
printf("pspace.vm_taddr = %p\n", pspace.vm_taddr);
printf("pspace.vm_daddr = %p\n", pspace.vm_daddr);
printf("pspace.vm_maxsaddr = %p\n", pspace.vm_maxsaddr);
}

复制代码

# ps -a -v
PID STAT TIME SL RE PAGEIN VSZ RSS LIM TSIZ %CPU %MEM COMMAND
4320 R+ 57:13.84 0 127 0 1168 444 - 4 98.0 0.1 ./a.out
#

复制代码