therealdreg/bochs_linux_kernel_debuggingBochs에서 Linux 커널 디버깅을 위한 도구(심볼, 기본 Bochs 디버거 및 IDA PRO 포함)
Bochs에서 Linux 커널 디버깅을 위한 도구 (심볼, 네이티브 Bochs 디버거 및 IDA PRO 포함)
아래 단계를 따르세요:
디버그 커널 이미지에 nm 명령을 사용하세요. Debian 예시:
1- dbg 이미지 설치
root@debian# apt-get install linux-image-$(uname -r)-dbg
2- dbg 이미지에서 nm이 동작하는지 확인:
dreg@debian# nm /usr/lib/debug/boot/vmlinux-$(uname -r) | tail
ffffffff8207d7c0 d zswap_same_filled_pages_enabled
ffffffff8262b54c b zswap_stored_pages
ffffffff8262b420 b zswap_trees
ffffffff81225df0 t zswap_update_total_size
ffffffff81226a50 t zswap_writeback_entry
ffffffff8262b538 b zswap_written_back_pages
ffffffff81c41fb8 r zswap_zpool_ops
ffffffff8207d7e0 d zswap_zpool_param_ops
3- linsymtobch.py용 유효한 출력 파일 생성:
dreg@debian# nm /usr/lib/debug/boot/vmlinux-$(uname -r) > nm_output.txt
다른 종류의 도구도 사용/결합할 수 있습니다. 더 많은 힌트는 이 저장소를 참고하세요:
https://github.com/therealdreg/linux_kernel_debug_disassemble_ida_vmware
linsymtobch.py를 사용하여 nm 스타일 출력 파일을 Bochs 심볼 파일로 변환하세요:
python linsymbtobch.py symbol_file.txt output_bochs_syms.txt [letter 1] [letter 2] [letter 3] .... [--verbose]
예시:
./linsymtobch.py nm_output.txt output_bochs_syms.txt
출력:
https://github.com/therealdreg/bochs_linux_kernel_debugging
-
MIT LICENSE Copyright <2020>
David Reguera Garcia aka Dreg - [email protected]
http://www.fr33project.org/ - https://github.com/therealdreg
usage: python linsymbtobch.py symbol_file.txt output_bochs_syms.txt [letter 1] [letter 2] [letter 3] .... [--verbose]
where letters can be empty for all symbols or a combination:
If lowercase, the symbol is local; if uppercase, the symbol is global (external).
------------------------------------
"A" The symbol's value is absolute, and will not be changed by further linking.
"B" "b" The symbol is in the uninitialized data section (known as BSS ).
"C" The symbol is common. Common symbols are uninitialized data. When linking, multiple common symbols may appear with the same name. If the symbol is defined anywhere, the common symbols are treated as undefined references.
"D" "d" The symbol is in the initialized data section.
"G" "g" The symbol is in an initialized data section for small objects. Some object file formats permit more efficient access to small data objects, such as a global int variable as opposed to a large global array.
"i" For PE format files this indicates that the symbol is in a section specific to the implementation of DLLs. For ELF format files this indicates that the symbol is an indirect function. This is a GNU extension to the standard set of ELF symbol types. It indicates a symbol which if referenced by a relocation does not evaluate to its address, but instead must be invoked at runtime. The runtime execution will then return the value to be used in the relocation.
"N" The symbol is a debugging symbol.
"p" The symbols is in a stack unwind section.
"R" "r" The symbol is in a read only data section.
"S" "s" The symbol is in an uninitialized data section for small objects.
"T" "t" The symbol is in the text (code) section.
"U" The symbol is undefined.
"u" The symbol is a unique global symbol. This is a GNU extension to the standard set of ELF symbol bindings. For such a symbol the dynamic linker will make sure that in the entire process there is just one symbol with this name and type in use.
"V" "v" The symbol is a weak object. When a weak defined symbol is linked with a normal defined symbol, the normal defined symbol is used with no error. When a weak undefined symbol is linked and the symbol is not defined, the value of the weak symbol becomes zero with no error. On some systems, uppercase indicates that a default value has been specified.
"W" "w" The symbol is a weak symbol that has not been specifically tagged as a weak object symbol. When a weak defined symbol is linked with a normal defined symbol, the normal defined symbol is used with no error. When a weak undefined symbol is linked and the symbol is not defined, the value of the symbol is determined in a system-specific manner without error. On some systems, uppercase indicates that a default value has been specified.
"-" The symbol is a stabs symbol in an a.out object file. In this case, the next values printed are the stabs other field, the stabs desc field, and the stab type. Stabs symbols are used to hold debugging information.
"?" The symbol type is unknown, or object file format specific.
------------------------------------
0xffffffff81412a30 T_aa_af_perm
0xffffffff813ff4f0 T_aa_alloc_profile
0xffffffff8140c420 T_aa_alloc_proxy
0xffffffff82c71f0d T_aa_alloc_root_ns
0xffffffff81409e20 T_aa_alloc_secid
0xffffffff813f7bc0 T_aa_apply_modes_to_perms
0xffffffff813f6030 T_aa_audit
0xffffffff8140a210 T_aa_audit_file
0xffffffff813f6010 T_aa_audit_msg
...
done!
total symbols written: 115131
total letters written: A B D R T V W a b d r t
total letters found: A B D R T V W a b d r t
일부 심볼 필터링 예시:
./linsymtobch.py nm_output.txt output_bochs_syms.txt T V d
생성된 파일을 "ldsym global"로 Bochs 디버거에 로드하세요. 예시:
ldsym global "C:\Users\leno\Desktop\bochs_linux_kernel_debugging\output_bochs_syms.txt"
완료! Bochs 디버거에서 다음 명령어를 실행하여 심볼이 동작하는지 확인해 보세요:
"C:\Program Files\IDA Pro 7.7\cfg\dbg_bochs.cfg" 편집
BOCHSDBG = "C:\\Users\\leno\\Desktop\\Bochs-pruebas\\bochs\\bochs.exe";
BOCHSRC = "C:\\Users\\leno\\Desktop\\Bochs-pruebas\\bochs\\.bochsrc";
IDA로 이동 .....
Debugger -> Run -> Local Bochs Debugger
애플리케이션:
C:\Users\leno\Desktop\Bochs-pruebas\bochs\.bochsrc
Debug Options -> Set specific options -> Select Disk image 를 클릭하세요
이 저장소에서 ida_load_names.py 다운로드:
https://github.com/therealdreg/symseghelper
IDA PRO를 열고 Bochs 디버그 세션을 시작한 다음 File -> Script File로 이동하세요.
ida_load_names.py를 선택하세요. 이 스크립트는 생성된 Bochs 심볼 파일을 요청합니다.
완료!
그 후에는 Native Bochs Debugger(IDA PRO 내부에서 실행 중)에도 심볼을 로드할 수 있습니다. IDA 명령줄에서 Bochs를 선택하고 "ldsym global"을 실행하기만 하면 됩니다.
IDA PRO에 Bochs 심볼(ida_load_names.py) + 심볼이 포함된 Bochs 네이티브 디버거(ldsym global), 두 세계의 장점:
경고: 자체 Bochs Instrumentation은 IDA PRO 로컬 Bochs에서 문제를 일으킬 수 있습니다
Bochs 및 IDA Pro용 Windows 디버깅 도우미 스크립트(PDB 파일 포함). 유저 모드 <--> 커널 모드에 매우 유용:
VMware + GDB 스텁에서 IDA Pro로 Linux 커널 디버깅을 위한 도우미 스크립트(일부 심볼 헬퍼 포함):
Bochs 디버깅 포맷 지원을 포함한 PDB 심볼 덤프(wine 지원 포함):
네이티브 Bochs 디버거에서 IDA Pro로 Windows 커널 디버깅을 위한 도우미 스크립트: