-
-
[原创]逆向进入内核时代之APatch源码学习(05.VScode源码级调试)
-
发表于: 2024-11-11 09:59
-
前言
由于大家基本都是刚刚接触APatch，很多命令行和内部原理理解还是不太清楚，于是这里给大家演示下如何使用VScode进行源码级别的调试。
B站教程
VSCode如何配置
加载符号表
1 | add-symbol-file "xxx/vmlinux" 0xffffff8008080000 |
起始偏移计算
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | root@kk47 /s/K/KpDebug (debug)# readelf -h /share/KPProj/KernelPatchQEMU/vmlinuxELF Header: Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: AArch64 Version: 0x1 Entry point address: 0xffffff8008080000 Start of program headers: 64 (bytes into file) Start of section headers: 208748136 (bytes into file) Flags: 0x0 Size of this header: 64 (bytes) Size of program headers: 56 (bytes) Number of program headers: 4 Size of section headers: 64 (bytes) Number of section headers: 35 Section header string table index: 34 |
kpimg的偏移地址
1 2 3 4 5 6 7 8 | 0x0000000040000014 in ?? ()=> 0x0000000040000014: 80 00 1f d6 br x4(gdb)0x0000000040080000 in ?? ()=> 0x0000000040080000: 00 80 49 14 b 0x412e0000(gdb)0x00000000412e0000 in ?? () //这就是kpimg的起始地址=> 0x00000000412e0000: e9 03 00 91 mov x9, sp |
总结：
因为kpimg动态patch了对应内核， 因此有几次符号地址偏移需要自己手动计算一下。
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
感谢支持 |
|
|
|
|
|
|
