前言
比如 我们之前调试的 glibc 相关的库函数
glibc 相关是属于用户程序, 调用 操作系统的系统调用的时候, 会是 怎么样的一个情况呢?
系统调用 会有对应的系统栈帧来处理 系统调用的相关函数调用的堆栈支持
测试用例
我们这里主要是以 printf 中会分配缓冲区调用 malloc 库函数
malloc 库函数 会调用 brk 系统调用, 我们主要是 大致看一下 这个情况
#include "stdio.h"
int main(int argc, char** argv) {
int x = 4;
int y = 3;
int z = x + y;
printf(" x + y = %d\n ", z);
}
elf 的信息如下
ELF Header:
Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class: ELF64
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: Advanced Micro Devices X86-64
Version: 0x1
Entry point address: 0x400430
Start of program headers: 64 (bytes into file)
Start of section headers: 7480 (bytes into file)
Flags: 0x0
Size of this header: 64 (bytes)
Size of program headers: 56 (bytes)
Number of program headers: 9
Size of section headers: 64 (bytes)
Number of section headers: 36
Section header string table index: 33
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .interp PROGBITS 0000000000400238 00000238
000000000000001c 0000000000000000 A 0 0 1
[ 2] .note.ABI-tag NOTE 0000000000400254 00000254
0000000000000020 0000000000000000 A 0 0 4
[ 3] .note.gnu.build-i NOTE 0000000000400274 00000274
0000000000000024 0000000000000000 A 0 0 4
[ 4] .gnu.hash GNU_HASH 0000000000400298 00000298
000000000000001c 0000000000000000 A 5 0 8
[ 5] .dynsym DYNSYM 00000000004002b8 000002b8
0000000000000060 0000000000000018 A 6 1 8
[ 6] .dynstr STRTAB 0000000000400318 00000318
000000000000003f 0000000000000000 A 0 0 1
[ 7] .gnu.version VERSYM 0000000000400358 00000358
0000000000000008 0000000000000002 A 5 0 2
[ 8] .gnu.version_r VERNEED 0000000000400360 00000360
0000000000000020 0000000000000000 A 6 1 8
[ 9] .rela.dyn RELA 0000000000400380 00000380
0000000000000018 0000000000000018 A 5 0 8
[10] .rela.plt RELA 0000000000400398 00000398
0000000000000030 0000000000000018 AI 5 24 8
[11] .init PROGBITS 00000000004003c8 000003c8
000000000000001a 0000000000000000 AX 0 0 4
[12] .plt PROGBITS 00000000004003f0 000003f0
0000000000000030 0000000000000010 AX 0 0 16
[13] .plt.got PROGBITS 0000000000400420 00000420
0000000000000008 0000000000000000 AX 0 0 8
[14] .text PROGBITS 0000000000400430 00000430
00000000000001b2 0000000000000000 AX 0 0 16
[15] .fini PROGBITS 00000000004005e4 000005e4
0000000000000009 0000000000000000 AX 0 0 4
[16] .rodata PROGBITS 00000000004005f0 000005f0
0000000000000012 0000000000000000 A 0 0 4
[17] .eh_frame_hdr PROGBITS 0000000000400604 00000604
0000000000000034 0000000000000000 A 0 0 4
[18] .eh_frame PROGBITS 0000000000400638 00000638
00000000000000f4 0000000000000000 A 0 0 8
[19] .init_array INIT_ARRAY 0000000000600e10 00000e10
0000000000000008 0000000000000000 WA 0 0 8
[20] .fini_array FINI_ARRAY 0000000000600e18 00000e18
0000000000000008 0000000000000000 WA 0 0 8
[21] .jcr PROGBITS 0000000000600e20 00000e20
0000000000000008 0000000000000000 WA 0 0 8
[22] .dynamic DYNAMIC 0000000000600e28 00000e28
00000000000001d0 0000000000000010 WA 6 0 8
[23] .got PROGBITS 0000000000600ff8 00000ff8
0000000000000008 0000000000000008 WA 0 0 8
[24] .got.plt PROGBITS 0000000000601000 00001000
0000000000000028 0000000000000008 WA 0 0 8
[25] .data PROGBITS 0000000000601028 00001028
0000000000000010 0000000000000000 WA 0 0 8
[26] .bss NOBITS 0000000000601038 00001038
0000000000000008 0000000000000000 WA 0 0 1
[27] .comment PROGBITS 0000000000000000 00001038
0000000000000035 0000000000000001 MS 0 0 1
[28] .debug_aranges PROGBITS 0000000000000000 0000106d
0000000000000030 0000000000000000 0 0 1
[29] .debug_info PROGBITS 0000000000000000 0000109d
00000000000000e2 0000000000000000 0 0 1
[30] .debug_abbrev PROGBITS 0000000000000000 0000117f
000000000000006d 0000000000000000 0 0 1
[31] .debug_line PROGBITS 0000000000000000 000011ec
0000000000000043 0000000000000000 0 0 1
[32] .debug_str PROGBITS 0000000000000000 0000122f
00000000000000e0 0000000000000001 MS 0 0 1
[33] .shstrtab STRTAB 0000000000000000 00001bea
000000000000014c 0000000000000000 0 0 1
[34] .symtab SYMTAB 0000000000000000 00001310
00000000000006c0 0000000000000018 35 52 8
[35] .strtab STRTAB 0000000000000000 000019d0
000000000000021a 0000000000000000 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), l (large)
I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
O (extra OS processing required) o (OS specific), p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
PHDR 0x0000000000000040 0x0000000000400040 0x0000000000400040
0x00000000000001f8 0x00000000000001f8 R E 8
INTERP 0x0000000000000238 0x0000000000400238 0x0000000000400238
0x000000000000001c 0x000000000000001c R 1
[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
LOAD 0x0000000000000000 0x0000000000400000 0x0000000000400000
0x000000000000072c 0x000000000000072c R E 200000
LOAD 0x0000000000000e10 0x0000000000600e10 0x0000000000600e10
0x0000000000000228 0x0000000000000230 RW 200000
DYNAMIC 0x0000000000000e28 0x0000000000600e28 0x0000000000600e28
0x00000000000001d0 0x00000000000001d0 RW 8
NOTE 0x0000000000000254 0x0000000000400254 0x0000000000400254
0x0000000000000044 0x0000000000000044 R 4
GNU_EH_FRAME 0x0000000000000604 0x0000000000400604 0x0000000000400604
0x0000000000000034 0x0000000000000034 R 4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 10
GNU_RELRO 0x0000000000000e10 0x0000000000600e10 0x0000000000600e10
0x00000000000001f0 0x00000000000001f0 R 1
Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame
03 .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss
04 .dynamic
05 .note.ABI-tag .note.gnu.build-id
06 .eh_frame_hdr
07
08 .init_array .fini_array .jcr .dynamic .got
Dynamic section at offset 0xe28 contains 24 entries:
Tag Type Name/Value
0x0000000000000001 (NEEDED) Shared library: [libc.so.6]
0x000000000000000c (INIT) 0x4003c8
0x000000000000000d (FINI) 0x4005e4
0x0000000000000019 (INIT_ARRAY) 0x600e10
0x000000000000001b (INIT_ARRAYSZ) 8 (bytes)
0x000000000000001a (FINI_ARRAY) 0x600e18
0x000000000000001c (FINI_ARRAYSZ) 8 (bytes)
0x000000006ffffef5 (GNU_HASH) 0x400298
0x0000000000000005 (STRTAB) 0x400318
0x0000000000000006 (SYMTAB) 0x4002b8
0x000000000000000a (STRSZ) 63 (bytes)
0x000000000000000b (SYMENT) 24 (bytes)
0x0000000000000015 (DEBUG) 0x0
0x0000000000000003 (PLTGOT) 0x601000
0x0000000000000002 (PLTRELSZ) 48 (bytes)
0x0000000000000014 (PLTREL) RELA
0x0000000000000017 (JMPREL) 0x400398
0x0000000000000007 (RELA) 0x400380
0x0000000000000008 (RELASZ) 24 (bytes)
0x0000000000000009 (RELAENT) 24 (bytes)
0x000000006ffffffe (VERNEED) 0x400360
0x000000006fffffff (VERNEEDNUM) 1
0x000000006ffffff0 (VERSYM) 0x400358
0x0000000000000000 (NULL) 0x0
Relocation section '.rela.dyn' at offset 0x380 contains 1 entries:
Offset Info Type Sym. Value Sym. Name + Addend
000000600ff8 000300000006 R_X86_64_GLOB_DAT 0000000000000000 __gmon_start__ + 0
Relocation section '.rela.plt' at offset 0x398 contains 2 entries:
Offset Info Type Sym. Value Sym. Name + Addend
000000601018 000100000007 R_X86_64_JUMP_SLO 0000000000000000 printf@GLIBC_2.2.5 + 0
000000601020 000200000007 R_X86_64_JUMP_SLO 0000000000000000 __libc_start_main@GLIBC_2.2.5 + 0
The decoding of unwind sections for machine type Advanced Micro Devices X86-64 is not currently supported.
Symbol table '.dynsym' contains 4 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND
1: 0000000000000000 0 FUNC GLOBAL DEFAULT UND printf@GLIBC_2.2.5 (2)
2: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __libc_start_main@GLIBC_2.2.5 (2)
3: 0000000000000000 0 NOTYPE WEAK DEFAULT UND __gmon_start__
Symbol table '.symtab' contains 72 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND
1: 0000000000400238 0 SECTION LOCAL DEFAULT 1
2: 0000000000400254 0 SECTION LOCAL DEFAULT 2
3: 0000000000400274 0 SECTION LOCAL DEFAULT 3
4: 0000000000400298 0 SECTION LOCAL DEFAULT 4
5: 00000000004002b8 0 SECTION LOCAL DEFAULT 5
6: 0000000000400318 0 SECTION LOCAL DEFAULT 6
7: 0000000000400358 0 SECTION LOCAL DEFAULT 7
8: 0000000000400360 0 SECTION LOCAL DEFAULT 8
9: 0000000000400380 0 SECTION LOCAL DEFAULT 9
10: 0000000000400398 0 SECTION LOCAL DEFAULT 10
11: 00000000004003c8 0 SECTION LOCAL DEFAULT 11
12: 00000000004003f0 0 SECTION LOCAL DEFAULT 12
13: 0000000000400420 0 SECTION LOCAL DEFAULT 13
14: 0000000000400430 0 SECTION LOCAL DEFAULT 14
15: 00000000004005e4 0 SECTION LOCAL DEFAULT 15
16: 00000000004005f0 0 SECTION LOCAL DEFAULT 16
17: 0000000000400604 0 SECTION LOCAL DEFAULT 17
18: 0000000000400638 0 SECTION LOCAL DEFAULT 18
19: 0000000000600e10 0 SECTION LOCAL DEFAULT 19
20: 0000000000600e18 0 SECTION LOCAL DEFAULT 20
21: 0000000000600e20 0 SECTION LOCAL DEFAULT 21
22: 0000000000600e28 0 SECTION LOCAL DEFAULT 22
23: 0000000000600ff8 0 SECTION LOCAL DEFAULT 23
24: 0000000000601000 0 SECTION LOCAL DEFAULT 24
25: 0000000000601028 0 SECTION LOCAL DEFAULT 25
26: 0000000000601038 0 SECTION LOCAL DEFAULT 26
27: 0000000000000000 0 SECTION LOCAL DEFAULT 27
28: 0000000000000000 0 SECTION LOCAL DEFAULT 28
29: 0000000000000000 0 SECTION LOCAL DEFAULT 29
30: 0000000000000000 0 SECTION LOCAL DEFAULT 30
31: 0000000000000000 0 SECTION LOCAL DEFAULT 31
32: 0000000000000000 0 SECTION LOCAL DEFAULT 32
33: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c
34: 0000000000600e20 0 OBJECT LOCAL DEFAULT 21 __JCR_LIST__
35: 0000000000400460 0 FUNC LOCAL DEFAULT 14 deregister_tm_clones
36: 00000000004004a0 0 FUNC LOCAL DEFAULT 14 register_tm_clones
37: 00000000004004e0 0 FUNC LOCAL DEFAULT 14 __do_global_dtors_aux
38: 0000000000601038 1 OBJECT LOCAL DEFAULT 26 completed.7594
39: 0000000000600e18 0 OBJECT LOCAL DEFAULT 20 __do_global_dtors_aux_fin
40: 0000000000400500 0 FUNC LOCAL DEFAULT 14 frame_dummy
41: 0000000000600e10 0 OBJECT LOCAL DEFAULT 19 __frame_dummy_init_array_
42: 0000000000000000 0 FILE LOCAL DEFAULT ABS Test01Sum.c
43: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c
44: 0000000000400728 0 OBJECT LOCAL DEFAULT 18 __FRAME_END__
45: 0000000000600e20 0 OBJECT LOCAL DEFAULT 21 __JCR_END__
46: 0000000000000000 0 FILE LOCAL DEFAULT ABS
47: 0000000000600e18 0 NOTYPE LOCAL DEFAULT 19 __init_array_end
48: 0000000000600e28 0 OBJECT LOCAL DEFAULT 22 _DYNAMIC
49: 0000000000600e10 0 NOTYPE LOCAL DEFAULT 19 __init_array_start
50: 0000000000400604 0 NOTYPE LOCAL DEFAULT 17 __GNU_EH_FRAME_HDR
51: 0000000000601000 0 OBJECT LOCAL DEFAULT 24 _GLOBAL_OFFSET_TABLE_
52: 00000000004005e0 2 FUNC GLOBAL DEFAULT 14 __libc_csu_fini
53: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _ITM_deregisterTMCloneTab
54: 0000000000601028 0 NOTYPE WEAK DEFAULT 25 data_start
55: 0000000000601038 0 NOTYPE GLOBAL DEFAULT 25 _edata
56: 00000000004005e4 0 FUNC GLOBAL DEFAULT 15 _fini
57: 0000000000000000 0 FUNC GLOBAL DEFAULT UND printf@@GLIBC_2.2.5
58: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __libc_start_main@@GLIBC_
59: 0000000000601028 0 NOTYPE GLOBAL DEFAULT 25 __data_start
60: 0000000000000000 0 NOTYPE WEAK DEFAULT UND __gmon_start__
61: 0000000000601030 0 OBJECT GLOBAL HIDDEN 25 __dso_handle
62: 00000000004005f0 4 OBJECT GLOBAL DEFAULT 16 _IO_stdin_used
63: 0000000000400570 101 FUNC GLOBAL DEFAULT 14 __libc_csu_init
64: 0000000000601040 0 NOTYPE GLOBAL DEFAULT 26 _end
65: 0000000000400430 42 FUNC GLOBAL DEFAULT 14 _start
66: 0000000000601038 0 NOTYPE GLOBAL DEFAULT 26 __bss_start
67: 0000000000400526 67 FUNC GLOBAL DEFAULT 14 main
68: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _Jv_RegisterClasses
69: 0000000000601038 0 OBJECT GLOBAL HIDDEN 25 __TMC_END__
70: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _ITM_registerTMCloneTable
71: 00000000004003c8 0 FUNC GLOBAL DEFAULT 11 _init
Version symbols section '.gnu.version' contains 4 entries:
Addr: 0000000000400358 Offset: 0x000358 Link: 5 (.dynsym)
000: 0 (*local*) 2 (GLIBC_2.2.5) 2 (GLIBC_2.2.5) 0 (*local*)
Version needs section '.gnu.version_r' contains 1 entries:
Addr: 0x0000000000400360 Offset: 0x000360 Link: 6 (.dynstr)
000000: Version: 1 File: libc.so.6 Cnt: 1
0x0010: Name: GLIBC_2.2.5 Flags: none Version: 2
Displaying notes found at file offset 0x00000254 with length 0x00000020:
Owner Data size Description
GNU 0x00000010 NT_GNU_ABI_TAG (ABI version tag)
OS: Linux, ABI: 2.6.32
Displaying notes found at file offset 0x00000274 with length 0x00000024:
Owner Data size Description
GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring)我们这里主要是以 如下流程 来看一下 这个过程
我们这里 核心关注 内核栈帧相关
系统调用堆栈信息如下
内核栈帧 高地址有一个值为 0x00007ffeb8fe14a8
这个对应的就是 用户栈帧 中的相关需要保存的寄存器, 存储在了 内核栈帧
以下 内核栈帧数据分析来自于函数 entry_SYSCALL_64, SYSC_brk, do_brk
然后 系统调用完成之后, 根据 存储的 用户栈帧 信息, 恢复用户栈帧 相关寄存器信息
另外可以看到的一个问题就是 clion 中对于函数调用栈的分析描述, 上面实际上是有问题的, caller 应该是 glibc 中的 brk.c 中的 brk 系统调用的地方, 不是这里的 0x4005fd, 这个 0x4005fd 仅仅是 entry_SYSCALL_64 中的一个局部变量
-- main
(gdb) info registers
rax 0x0 0
rbx 0x615000 6377472
rcx 0xffff88007f5b4f80 -131939258642560
rdx 0xffff88007f5b4f80 -131939258642560
rsi 0x22000 139264
rdi 0x615000 6377472
rbp 0x22000 0x22000
rsp 0xffffc900005dbf60 0xffffc900005dbf60
rip 0x4005fd 0x4005fd
-- SYSCALL, push 0x00000000004005fd
(gdb) info registers
rax 0x0 0
rbx 0x615000 6377472
rcx 0xffff88007f5b4f80 -131939258642560
rdx 0xffff88007f5b4f80 -131939258642560
rsi 0x22000 139264
rdi 0x615000 6377472
rbp 0x22000 0x22000
rsp 0xffffc900005dbf58 0xffffc900005dbf58
rip 0xffffffff8185c7bb 0xffffffff8185c7bb <entry_SYSCALL_64+107>
- SYS_brk
(gdb) info registers
rax 0x0 0
rbx 0x637000 6516736
rcx 0xffff88007f5b4f80 -131939258642560
rdx 0xffff88007f5b4f80 -131939258642560
rsi 0x22000 139264
rdi 0x615000 6377472
rbp 0xffffc900005dbf48 0xffffc900005dbf48
rsp 0xffffc900005dbf18 0xffffc900005dbf18
rip 0xffffffff811dd3b0 0xffffffff811dd3b0 <SyS_brk+351>
-- SYSC_brk
(gdb) info registers
rax 0x0 0
rbx 0x1a21000 27398144
rcx 0xffff88007f5b4f80 -131939258642560
rdx 0xffff88007f5b4f80 -131939258642560
rsi 0x22000 139264
rdi 0x19ff000 27258880
rbp 0xffffc900005dbf48 0xffffc900005dbf48
rsp 0xffffc900005dbf18 0xffffc900005dbf18
rip 0xffffffff811dd3b0 0xffffffff811dd3b0 <SyS_brk+351>
-- do_brk
(gdb) info registers
rax 0x0 0
rbx 0x22000 139264
rcx 0xffff88007f5b4f80 -131939258642560
rdx 0xffff88007f5b4f80 -131939258642560
rsi 0x22000 139264
rdi 0x19ff000 27258880
rbp 0xffffc900005dbf08 0xffffc900005dbf08
rsp 0xffffc900005dbe88 0xffffc900005dbe88
rip 0xffffffff811dceea 0xffffffff811dceea <do_brk+60>
-- 内核栈帧
(gdb) x /100gx 0xffffc900005dbe88
0xffffc900005dbe88: 0xffffc900005dbec8 0xffffffff8150aaa9 do_brk_locals
0xffffc900005dbe98: 0x00000000b8fe1680 0x0000000000000000 do_brk_locals
0xffffc900005dbea8: 0x00007ffeb8fe15f0 0xffff88007fb0e700 do_brk_locals
0xffffc900005dbeb8: 0x0000000000000001 0xffffc900005dbee0 do_brk_locals
0xffffc900005dbec8: 0xffffffff811cc774 0x00000000019ff000 do_brk_locals
0xffffc900005dbed8: 0x00000000f42e5e76 0x0000000001a21000 do_brk_locals, rbx
0xffffc900005dbee8: 0xffff88007f7d4800 0xffff88007f7d4868 r12, r13
0xffffc900005dbef8: 0x0000000001a21000 0x00000000019ff000 r14, r15
0xffffc900005dbf08: 0xffffc900005dbf48 0xffffffff811dd3b0 rbp, SYSC_brk's returnAddress
0xffffc900005dbf18: 0x0000000001a22000 0x00000000019ff000 SYSC_brk_locals, rbx
0xffffc900005dbf28: 0x00007f0d0e0c4f58 0x00007f0d0e0c2b78 r12, r13
0xffffc900005dbf38: 0x0000000000022000 0x0000000000022000 r14, r15
0xffffc900005dbf48: 0x0000000000022000 0xffffffff8185c7bb rbp, entry_SYSCALL_64_locals's returnAddress
0xffffc900005dbf58: 0x00000000004005fd 0x0000000000000000 entry_SYSCALL_64_locals
0xffffc900005dbf68: 0x00000000004005f4 0x0000000000000009 entry_SYSCALL_64_locals
0xffffc900005dbf78: 0x00007f0d0e0c3620 0x00007f0d0e0c3620 entry_SYSCALL_64_locals
0xffffc900005dbf88: 0x0000000000000246 0x00007f0d0e0c2b78 r11, r10
0xffffc900005dbf98: 0x000000000000000d 0x00007f0d0ddaa9b0 r9, r8
0xffffc900005dbfa8: 0xffffffffffffffda 0x00007f0d0ddfaf19 ax, cx
0xffffc900005dbfb8: 0x00000000019ff000 0x00007f0d0e0c2b20 dx, si
0xffffc900005dbfc8: 0x0000000001a21000 0x000000000000000c di, orig_ax
0xffffc900005dbfd8: 0x00007f0d0ddfaf19 0x0000000000000033 ip, cs
0xffffc900005dbfe8: 0x0000000000000246 0x00007ffeb8fe14a8 flags, sp
0xffffc900005dbff8: 0x000000000000002b Cannot access memory at address 0xffffc900005dc000 ss
-- 用户栈帧
(gdb) x /400gx 0x00007ffeb8fe14a8
0x7ffeb8fe14a8: 0x00007f0d0ddfaff9 0x00007f0d0e0c2b20
0x7ffeb8fe14b8: 0x0000000000001010 0x0000000000000000
0x7ffeb8fe14c8: 0x00007f0d0dd85949 0x0000000000000000
0x7ffeb8fe14d8: 0x00007f0d0dd7f645 0x0000000000000000
0x7ffeb8fe14e8: 0x0000000000001030 0x0000000000000fff
0x7ffeb8fe14f8: 0xfffffffffffff000 0x00007f0d0e0c2b78
0x7ffeb8fe1508: 0x0000000000002000 0x0000000000000000
0x7ffeb8fe1518: 0x0000000000000000 0x00007ffeb8fe1340
0x7ffeb8fe1528: 0x00007f0d0dd148af 0x0000000000000000
0x7ffeb8fe1538: 0x00007f0d0e0d0a9d 0x00000001b8fe16e0
0x7ffeb8fe1548: 0x00007f0d0e0c2b20 0x0000000000001010
0x7ffeb8fe1558: 0x0000000000002710 0x00007f0d0e0c2b78
0x7ffeb8fe1568: 0x00007f0d0e0c2b78 0x00000000004005fd
0x7ffeb8fe1578: 0x00007f0d0dd80763 0x00007f0d00000063
0x7ffeb8fe1588: 0x0000000000001000 0x00007ffeb8fe1600
0x7ffeb8fe1598: 0x00007f0d0de4148b 0x0000000000000000
0x7ffeb8fe15a8: 0x00007ffeb8fe1608 0xffff80014701ea01
0x7ffeb8fe15b8: 0x00007ffeb8fe15ff 0x0000000000000040
0x7ffeb8fe15c8: 0x0000007000000101 0x0000000000000008
0x7ffeb8fe15d8: 0x0000000000000001 0x0000006f00000063
0x7ffeb8fe15e8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe15f8: 0x0000007c00000077 0x010004157f1c0300
0x7ffeb8fe1608: 0x00007f0d0e2eb000 0x00007f0d0e2efd60
0x7ffeb8fe1618: 0x00007f0d0dcfe000 0x0000000000000000
0x7ffeb8fe1628: 0x00007f0d0e0c2b20 0x0000000000001000
0x7ffeb8fe1638: 0x0000000000000000 0x00000000004005f4
0x7ffeb8fe1648: 0x0000000000000000 0x00000000004005fd
0x7ffeb8fe1658: 0x00007f0d0dd83908 0x0000000db8fe1600
0x7ffeb8fe1668: 0x0000000000001000 0x00007f0d0e0c3620
0x7ffeb8fe1678: 0x00007f0d0dd6b1e5 0x0000000000000006
0x7ffeb8fe1688: 0x0000000000001cef 0x0000000000000001
0x7ffeb8fe1698: 0x0000000000002180 0x0000000000000000
0x7ffeb8fe16a8: 0x0000000000000501 0x0000000000000000
0x7ffeb8fe16b8: 0x0000000000001000 0x0000000000000000
0x7ffeb8fe16c8: 0x00000000638af0e8 0x0000000011d151ee
0x7ffeb8fe16d8: 0x00000000638af0e8 0x0000000011d151ee
0x7ffeb8fe16e8: 0x00000000638af073 0x0000000011d151ee
0x7ffeb8fe16f8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1708: 0x0000000000000000 0x00007f0d0e0c3620
0x7ffeb8fe1718: 0x00000000ffffffff 0x0000000000000009
0x7ffeb8fe1728: 0x00007f0d0dd795a4 0x00007f0d0e0c3620
0x7ffeb8fe1738: 0x00000000ffffffff 0x0000000000000009
0x7ffeb8fe1748: 0x00007f0d0dd78908 0x00007f0d0e0c3620
0x7ffeb8fe1758: 0x0000000000000009 0x0000000000000009
0x7ffeb8fe1768: 0x00007f0d0dd7729d 0x0000000000196760
0x7ffeb8fe1778: 0x00007f0d0e0c3620 0x00007ffeb8fe1d20
0x7ffeb8fe1788: 0x00000000004005f4 0x00007ffeb8fe1d38
0x7ffeb8fe1798: 0x0000000000000000 0x00000000004005fd
0x7ffeb8fe17a8: 0x00007f0d0dd4b251 0x0000000000000000
0x7ffeb8fe17b8: 0x00000000001bfbe8 0x00000000001bfbe8
0x7ffeb8fe17c8: 0x0000000000200000 0x0000000600000001
0x7ffeb8fe17d8: 0x00000000001c07c0 0x00000000003c07c0
0x7ffeb8fe17e8: 0x00000000003c07c0 0x0000000000004f60
0x7ffeb8fe17f8: 0x00000000000091e0 0x0000000000200000
0x7ffeb8fe1808: 0x0000000600000002 0x00000000001c3ba0
0x7ffeb8fe1818: 0x00000000003c3ba0 0x00000000003c3ba0
0x7ffeb8fe1828: 0x00000000000001e0 0x00000000000001e0
0x7ffeb8fe1838: 0x0000000000000008 0x0000000400000004
0x7ffeb8fe1848: 0x0000000000000270 0x0000000000000270
0x7ffeb8fe1858: 0x0000000000000270 0x0000000000000044
0x7ffeb8fe1868: 0x0000000000000044 0x0000000000000009
0x7ffeb8fe1878: 0x0000000000000007 0x00000000001c07c0
0x7ffeb8fe1888: 0x00000000004005fd 0x00000000003c07c0
0x7ffeb8fe1898: 0x0000000000000010 0x0000000000000078
0x7ffeb8fe18a8: 0x0000000000000008 0x000000046474e550
0x7ffeb8fe18b8: 0x000000000019677c 0x000000000019677c
0x7ffeb8fe18c8: 0x0000003000000008 0x00007ffeb8fe1e10
0x7ffeb8fe18d8: 0x00007ffeb8fe1d50 0x00007f0d0dd69490
0x7ffeb8fe18e8: 0x00007f0d0e0c3620 0x0000000000000000
0x7ffeb8fe18f8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1908: 0x00007ffeb8fe1cc0 0x00007ffeb8fe1d20
0x7ffeb8fe1918: 0x00007f0d0e0d1e44 0x00007f0d0e2eb000
0x7ffeb8fe1928: 0x000000000000025b 0x00007f0d0e2eb000
0x7ffeb8fe1938: 0x00007f0d0dd01d80 0x00007f0d0dd0eff8
0x7ffeb8fe1948: 0x00007f0d0e0d267b 0x000000000000025b
0x7ffeb8fe1958: 0x00007f0d0dd0eff8 0x00007f0d0e2eb000
0x7ffeb8fe1968: 0x00007ffeb8fe1a08 0x00007ffeb8fe1a04
0x7ffeb8fe1978: 0x00007f0d0e0d2011 0x00007f0d0e0d5bb0
0x7ffeb8fe1988: 0x0000000000400323 0x00000000004002d0
0x7ffeb8fe1998: 0x00007ffeb8fe1a08 0x00000000156b2bb8
0x7ffeb8fe19a8: 0x000000000055acae 0x00007f0d00000038
0x7ffeb8fe19b8: 0x00007ffeb8fe1ae0 0x00007f0d0dd0eff8
0x7ffeb8fe19c8: 0x00007f0d0dd01d80 0x00007ffeb8fe1a04
0x7ffeb8fe19d8: 0x00007ffeb8fe1ad0 0x00007f0d0e2eb508
0x7ffeb8fe19e8: 0x00007f0d00000000 0x0000000000000003
0x7ffeb8fe19f8: 0x00007f0d0e0c8758 0x000000000e0c8450
0x7ffeb8fe1a08: 0x0000000000000000 0x000000003de00ec7
0x7ffeb8fe1a18: 0x00007f0d0e2ef4c0 0x00007ffeb8fe1b70
0x7ffeb8fe1a28: 0x00007f0d0e2eb550 0x0000000000000000
0x7ffeb8fe1a38: 0x00007f0d0e2ef168 0x00007ffeb8fe1b98
0x7ffeb8fe1a48: 0x00007f0d0e0d2b4f 0x0000000000000001
0x7ffeb8fe1a58: 0x00007f0d0e2eb550 0x0000000000000001
0x7ffeb8fe1a68: 0x0000000000000000 0x0000000000000001
0x7ffeb8fe1a78: 0x00007f0d0e2ef168 0x00000000004002e8
0x7ffeb8fe1a88: 0x00007ffeb8fe1af8 0x00000000f63d4e2e
0x7ffeb8fe1a98: 0x0000000000000000 0x00007f0d0e2ef4c0
0x7ffeb8fe1aa8: 0x00007ffeb8fe1ae0 0x000000010dd0eff8
0x7ffeb8fe1ab8: 0x00007ffeb8fe1ad0 0x00000000156b2bb8
0x7ffeb8fe1ac8: 0x0000000000400323 0x00000000ffffffff
0x7ffeb8fe1ad8: 0x0000000000000000 0x00007f0d0dd05608
0x7ffeb8fe1ae8: 0x00007f0d0e2eb000 0x0000000000000000
0x7ffeb8fe1af8: 0x0000000000000000 0x0000000000600e28
0x7ffeb8fe1b08: 0x00007f0d0e2ef4c0 0x00007ffeb8fe1c60
0x7ffeb8fe1b18: 0x00007f0d0e2eb550 0x0000000000000000
0x7ffeb8fe1b28: 0x00007f0d0e2ef168 0x00007ffeb8fe1c88
0x7ffeb8fe1b38: 0x00007f0d0e0d2b4f 0x0000000000000001
0x7ffeb8fe1b48: 0x0000000000601018 0x0000000000400430
0x7ffeb8fe1b58: 0x00007ffeb8fe1f10 0x0000000000000000
0x7ffeb8fe1b68: 0x0000000000000000 0x00007ffeb8fe1e30
0x7ffeb8fe1b78: 0x00007f0d0e0d7b06 0x0000000000000001
0x7ffeb8fe1b88: 0x0000000000000000 0x00007f0d0e2ef4c0
0x7ffeb8fe1b98: 0x00007f0d0dd05608 0x00007ffeb8fe1df0
0x7ffeb8fe1ba8: 0x00007f0d0e0dfe03 0x0000000000000000
0x7ffeb8fe1bb8: 0x0000000000000000 0x0000000000000002
0x7ffeb8fe1bc8: 0x0000000000000005 0x00000000004005f4
0x7ffeb8fe1bd8: 0x00000000004005e0 0x00007f0d0e0d8af0
0x7ffeb8fe1be8: 0x00007ffeb8fe1c88 0x000000000000037f
0x7ffeb8fe1bf8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1c08: 0x0000ffff00001f80 0x0000000000000000
0x7ffeb8fe1c18: 0x00007ffeb8fe0000 0x0000000000000000
0x7ffeb8fe1c28: 0x0000000001950000 0x0000000000000000
0x7ffeb8fe1c38: 0x0000000000600000 0x0000000000000000
0x7ffeb8fe1c48: 0x00007ffeb8fe0000 0x0000000000000000
0x7ffeb8fe1c58: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1c68: 0x00007f0d0e0d0000 0x0000000000000000
0x7ffeb8fe1c78: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1c88: 0x00007f0d0dd00000 0x000000000000ff00
0x7ffeb8fe1c98: 0x0000000000000000 0x2f2f2f2f2f2f2f2f
0x7ffeb8fe1ca8: 0x2f2f2f2f2f2f2f2f 0x0000000000000000
0x7ffeb8fe1cb8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1cc8: 0x00000000ff000000 0x5f5f00656d697474
0x7ffeb8fe1cd8: 0x7465675f6f736476 0x0000000000000000
0x7ffeb8fe1ce8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1cf8: 0x0000000000000000 0x0000000000400430
0x7ffeb8fe1d08: 0x00007ffeb8fe1f10 0x0000000000000000
0x7ffeb8fe1d18: 0x0000000000000000 0x00007ffeb8fe1e30
0x7ffeb8fe1d28: 0x00007f0d0dd538a9 0x0000000000000000
0x7ffeb8fe1d38: 0x0000003000000008 0x00007ffeb8fe1e10
0x7ffeb8fe1d48: 0x00007ffeb8fe1d50 0x0000000000000000
0x7ffeb8fe1d58: 0x0000000000000005 0x0000000000000002
0x7ffeb8fe1d68: 0x0000000000000000 0x00000000004005e0
0x7ffeb8fe1d78: 0x00007f0d0e0d8af0 0x0000000000000000
0x7ffeb8fe1d88: 0x0000000000000000 0x2f2f2f2f2f2f2f2f
0x7ffeb8fe1d98: 0x2f2f2f2f2f2f2f2f 0x0000000000000000
0x7ffeb8fe1da8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1db8: 0x00000000ff000000 0x5f5f00656d697474
0x7ffeb8fe1dc8: 0x7465675f6f736476 0x0000000000000000
0x7ffeb8fe1dd8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1de8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1df8: 0x00007f0d0e2ef168 0x0000000000000000
0x7ffeb8fe1e08: 0x0000000000400562 0x00007ffeb8fe1f18
0x7ffeb8fe1e18: 0x0000000100400430 0x00000002b8fe1f10
0x7ffeb8fe1e28: 0x0000000500000003 0x0000000000400570
0x7ffeb8fe1e38: 0x00007f0d0dd1e840 0x0000000000000000
0x7ffeb8fe1e48: 0x00007ffeb8fe1f18 0x0000000100000000
0x7ffeb8fe1e58: 0x0000000000400526 0x0000000000000000
0x7ffeb8fe1e68: 0xe3660fab9d01d4e3 0x0000000000400430
0x7ffeb8fe1e78: 0x00007ffeb8fe1f10 0x0000000000000000
0x7ffeb8fe1e88: 0x0000000000000000 0x1c9b7ed7ab61d4e3
0x7ffeb8fe1e98: 0x1d7c14885811d4e3 0x0000000000000000
0x7ffeb8fe1ea8: 0x0000000000000000 0x0000000000000000
0x7ffeb8fe1eb8: 0x00007ffeb8fe1f28 0x00007f0d0e2ef168
0x7ffeb8fe1ec8: 0x00007f0d0e0d880b 0x0000000000000000
0x7ffeb8fe1ed8: 0x0000000000000000 0x0000000000400430
0x7ffeb8fe1ee8: 0x00007ffeb8fe1f10 0x0000000000000000
0x7ffeb8fe1ef8: 0x0000000000400459 0x00007ffeb8fe1f08
0x7ffeb8fe1f08: 0x000000000000001c 0x0000000000000001
0x7ffeb8fe1f18: 0x00007ffeb8fe2e07 0x0000000000000000
关于上面内核栈帧 我们需要关注的主要有 orig_ax, 为该系统调用的系统调用号
比如我们这里 的 brk 系统调用, 系统调用号为 12, 0x000c
-- 内核栈帧
(gdb) x /100gx 0xffffc900005dbe88
0xffffc900005dbe88: 0xffffc900005dbec8 0xffffffff8150aaa9 do_brk_locals
0xffffc900005dbe98: 0x00000000b8fe1680 0x0000000000000000 do_brk_locals
0xffffc900005dbea8: 0x00007ffeb8fe15f0 0xffff88007fb0e700 do_brk_locals
0xffffc900005dbeb8: 0x0000000000000001 0xffffc900005dbee0 do_brk_locals
0xffffc900005dbec8: 0xffffffff811cc774 0x00000000019ff000 do_brk_locals
0xffffc900005dbed8: 0x00000000f42e5e76 0x0000000001a21000 do_brk_locals, rbx
0xffffc900005dbee8: 0xffff88007f7d4800 0xffff88007f7d4868 r12, r13
0xffffc900005dbef8: 0x0000000001a21000 0x00000000019ff000 r14, r15
0xffffc900005dbf08: 0xffffc900005dbf48 0xffffffff811dd3b0 rbp, SYSC_brk's returnAddress
0xffffc900005dbf18: 0x0000000001a22000 0x00000000019ff000 SYSC_brk_locals, rbx
0xffffc900005dbf28: 0x00007f0d0e0c4f58 0x00007f0d0e0c2b78 r12, r13
0xffffc900005dbf38: 0x0000000000022000 0x0000000000022000 r14, r15
0xffffc900005dbf48: 0x0000000000022000 0xffffffff8185c7bb rbp, entry_SYSCALL_64_locals's returnAddress
0xffffc900005dbf58: 0x00000000004005fd 0x0000000000000000 entry_SYSCALL_64_locals
0xffffc900005dbf68: 0x00000000004005f4 0x0000000000000009 entry_SYSCALL_64_locals
0xffffc900005dbf78: 0x00007f0d0e0c3620 0x00007f0d0e0c3620 entry_SYSCALL_64_locals
0xffffc900005dbf88: 0x0000000000000246 0x00007f0d0e0c2b78 r11, r10
0xffffc900005dbf98: 0x000000000000000d 0x00007f0d0ddaa9b0 r9, r8
0xffffc900005dbfa8: 0xffffffffffffffda 0x00007f0d0ddfaf19 ax, cx
0xffffc900005dbfb8: 0x00000000019ff000 0x00007f0d0e0c2b20 dx, si
0xffffc900005dbfc8: 0x0000000001a21000 0x000000000000000c di, orig_ax
0xffffc900005dbfd8: 0x00007f0d0ddfaf19 0x0000000000000033 ip, cs
0xffffc900005dbfe8: 0x0000000000000246 0x00007ffeb8fe14a8 flags, sp
0xffffc900005dbff8: 0x000000000000002b Cannot access memory at address 0xffffc900005dc000 ss
假设是 socket 系统调用, 调用号为 41, 0x29
(gdb) x /100gx 0xffffc90000713f28
0xffffc90000713f28: 0xffffc90000713f48 0x00000000ed729985
0xffffc90000713f38: 0x0000000000000000 0x0000000000400790
0xffffc90000713f48: 0x00007fff66f1dfc0 0xffffffff8185c7bb
0xffffc90000713f58: 0x00007fff66f1db86 0x00007fff66f1dae0
0xffffc90000713f68: 0x00007fff66f1dae2 0x00007fff66f1dae8
0xffffc90000713f78: 0x00000000ffffffff 0x00007fff66f1dae3
0xffffc90000713f88: 0x0000000000000206 0x000000000000002d
0xffffc90000713f98: 0x0000000000000000 0x1fffffffffffffff
0xffffc90000713fa8: 0xffffffffffffffda 0x00007f490b5346a7
0xffffc90000713fb8: 0x0000000000000000 0x0000000000000001
0xffffc90000713fc8: 0x0000000000000002 0x0000000000000029 di, orig_ax
0xffffc90000713fd8: 0x00007f490b5346a7 0x0000000000000033
0xffffc90000713fe8: 0x0000000000000206 0x00007fff66f1db28
0xffffc90000713ff8: 0x000000000000002b Cannot access memory at address 0xffffc90000714000
完
