Question

我在x86_64上，我想使用关联的寄存器检索打开调用的路径-这样可以在打印时显示SIGSEGV

syscall.PtraceGetRegs(pid, &regs)
ptr := uintptr(regs.Rdi)
path := (*[]byte)(unsafe.Pointer(ptr))
//path := C.GoString((*C.char)(unsafe.Pointer(ptr)))
fmt.Printf("<path> %v\n", *path)

http://man7.org/linux/man-pages/man2/syscall.2.html将RDI列为寄存器，我尝试了其他方法，但都发生了段错误。

寄存器的值是：

syscall.PtraceRegs{R15:0x0, R14:0x0, R13:0x1, R12:0x7fe899dbe0a8,
Rbp:0xffffffffffffffff, Rbx:0x55fb7ac6ca21, R11:0x287, R10:0x0, 
R9:0x0, R8:0x0, Rax:0x3, Rcx:0x7fe899bb1cdd, Rdx:0x80000, 
Rsi:0x7fe899bb6428, Rdi:0xffffff9c, Orig_rax:0x101, 
Rip:0x7fe899bb1cdd, Cs:0x33, Eflags:0x287, Rsp:0x7ffc421ad9d8, 
Ss:0x2b, Fs_base:0x0, Gs_base:0x0, Ds:0x0, Es:0x0, Fs:0x0, Gs:0x0}

基于我发现的一些代码
https://github.com/orivej/fptrace/search?q=readString&unscoped_q=readString

然后我尝试了此操作-但什么也没回来，并且for循环永远存在

fmt.Printf("<data> %s\n", readString(pid,regs.Rdi))

func readString(pid int, addr uint64) string {
    var chunk [64]byte
    var buf []byte
    for {
        n, err := syscall.PtracePeekData(pid, uintptr(addr), chunk[:])
        if err != syscall.EIO {
            fmt.Print(err)
        }
        end := bytes.IndexByte(chunk[:n], 0)
        if end != -1 {
            buf = append(buf, chunk[:end]...)
            return string(buf)
        }
        buf = append(buf, chunk[:n]...)
        addr += uint64(n)
    }
}

我将克隆https://github.com/orivej/fptrace并查看是否可行，然后从那里找出我需要做的事情。

如何从syscall.PtraceGetRegs获取打开调用的字符串路径

0 个答案: