C程序來轉儲運行的進程的堆棧在Linux上

我想傾倒在Linux Fedora的運行工藝在堆20（我想自己做沒有GDB/...）C程序來轉儲運行的進程的堆棧在Linux上

但看起來像我的緩衝區（buf）的默認值從來沒有被替換，即使/ proc/x/mem的read（）返回了我的正數。

我禁用了SELinux

[[email protected] ~]$ cat /proc/2419/maps 
00400000-00401000 r-xp 00000000 fd:02 164622        /home/me/memo 
00600000-00601000 r--p 00000000 fd:02 164622        /home/me/memo 
00601000-00602000 rw-p 00001000 fd:02 164622        /home/me/memo 
7fd7cbea2000-7fd7cc056000 r-xp 00000000 fd:02 8636      /usr/lib64/libc-2.18.so 
7fd7cc056000-7fd7cc256000 ---p 001b4000 fd:02 8636      /usr/lib64/libc-2.18.so 
7fd7cc256000-7fd7cc25a000 r--p 001b4000 fd:02 8636      /usr/lib64/libc-2.18.so 
7fd7cc25a000-7fd7cc25c000 rw-p 001b8000 fd:02 8636      /usr/lib64/libc-2.18.so 
7fd7cc25c000-7fd7cc261000 rw-p 00000000 00:00 0 
7fd7cc261000-7fd7cc281000 r-xp 00000000 fd:02 723      /usr/lib64/ld-2.18.so 
7fd7cc469000-7fd7cc46c000 rw-p 00000000 00:00 0 
7fd7cc47d000-7fd7cc480000 rw-p 00000000 00:00 0 
7fd7cc480000-7fd7cc481000 r--p 0001f000 fd:02 723      /usr/lib64/ld-2.18.so 
7fd7cc481000-7fd7cc482000 rw-p 00020000 fd:02 723      /usr/lib64/ld-2.18.so 
7fd7cc482000-7fd7cc483000 rw-p 00000000 00:00 0 
7fffc8479000-7fffc849a000 rw-p 00000000 00:00 0       [stack] 
7fffc854e000-7fffc8550000 r-xp 00000000 00:00 0       [vdso] 
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0     [vsyscall] 


[[email protected] ~]$ cat analyse.c 
#include <stdio.h> 
#include <stdlib.h> 
#include <unistd.h> 
#include <sys/ptrace.h> 
#include <fcntl.h> 

#define STACK_BEGIN 0x7fffc8479000 
#define STACK_END 0x7fffc849a000 
#define STACK_SIZE STACK_END - STACK_BEGIN 

void main(int argc, char** argv) 
{ 
    int pid = atoi(argv[1]); 
    char mem_file_name[30]; 

    int mem_fd; 
    char buf[STACK_SIZE]; 

    sprintf(mem_file_name, "/proc/%d/mem", pid); 
    mem_fd = open(mem_file_name, O_RDONLY); 
    printf("PID=%d\n\ 
      NAME=%s\n\ 
      FD=%d\n\ 
      Initial value of buf : %x\n", pid, mem_file_name, mem_fd, buf); 

    int ptrace_log = ptrace(PTRACE_ATTACH, pid, NULL, NULL); 

    waitpid(pid, NULL, 0); 
    int lseek_log = lseek(mem_fd, STACK_BEGIN, SEEK_SET); 
    int rd = read(mem_fd, buf, STACK_SIZE); 

    printf("in Memory at : %zd, %x (readed %d chari - ptrace ret = %d - lseek ret = %d)\n", STACK_BEGIN, buf, rd, ptrace_log, lseek_log); 

    ptrace(PTRACE_DETACH, pid, NULL, NULL); 
    close(mem_fd); 
} 

[[email protected] ~]$sudo ./analyse 2419 
PID=2419 
NAME=/proc/2419/mem 
FD=3 
Initial value of buf : da5030f0 
in Memory at : 140736553521152, da5030f0 (readed 135168 chari - ptrace ret = 0 - lseek ret = -934834176)

來源

2014-02-11 IggY

您正在輸出'buf'的地址，而不是其內容。 – Barmar

打印'* buf'或'BUF [0]'相反，你應該看到一個區別。 – Barmar

我仍然得到麻煩（因爲0的buf中），所以我用寫（STDOUT_FILENO，臭蟲，STACK_SIZE）; 我現在的工作，謝謝:) – IggY

read()不會改變的buf地址（怎麼可能呢？），它改變的內容。如果你想看到更改，你必須打印內容。打印*buf將顯示緩衝區的第一個字符。

void main(int argc, char** argv) 
{ 
    int pid = atoi(argv[1]); 
    char mem_file_name[30]; 

    int mem_fd; 
    char buf[STACK_SIZE]; 

    sprintf(mem_file_name, "/proc/%d/mem", pid); 
    mem_fd = open(mem_file_name, O_RDONLY); 
    printf("PID=%d\n\ 
      NAME=%s\n\ 
      FD=%d\n\ 
      Initial value of buf : %c\n", pid, mem_file_name, mem_fd, *buf); 

    int ptrace_log = ptrace(PTRACE_ATTACH, pid, NULL, NULL); 

    waitpid(pid, NULL, 0); 
    int lseek_log = lseek(mem_fd, STACK_BEGIN, SEEK_SET); 
    int rd = read(mem_fd, buf, STACK_SIZE); 

    printf("in Memory at : %zd, %c (readed %d chari - ptrace ret = %d - lseek ret = %d)\n", STACK_BEGIN, *buf, rd, ptrace_log, lseek_log); 

    ptrace(PTRACE_DETACH, pid, NULL, NULL); 
    close(mem_fd); 
}

來源

2014-03-11 14:42:30 Barmar

C程序來轉儲運行的進程的堆棧在Linux上

回答

相關問題