mirror of
https://github.com/nganhkhoa/CTF-All-In-One.git
synced 2024-12-25 11:41:16 +07:00
105 lines
3.7 KiB
Markdown
105 lines
3.7 KiB
Markdown
# 4.1 Linux 内核调试
|
||
|
||
- [准备工作](#准备工作)
|
||
|
||
|
||
## 准备工作
|
||
与用户态程序不同，为了进行内核调试，我们需要两台机器，一台调试，另一台被调试。在调试机上需要安装必要的调试器（如GDB），被调试机上运行着被调试的内核。
|
||
|
||
这里选择用 Ubuntu16.04 来展示，因为该发行版默认已经开启了内核调试支持：
|
||
```
|
||
$ cat /boot/config-4.13.0-38-generic | grep GDB
|
||
# CONFIG_CFG80211_INTERNAL_REGDB is not set
|
||
CONFIG_SERIAL_KGDB_NMI=y
|
||
CONFIG_GDB_SCRIPTS=y
|
||
CONFIG_HAVE_ARCH_KGDB=y
|
||
CONFIG_KGDB=y
|
||
CONFIG_KGDB_SERIAL_CONSOLE=y
|
||
# CONFIG_KGDB_TESTS is not set
|
||
CONFIG_KGDB_LOW_LEVEL_TRAP=y
|
||
CONFIG_KGDB_KDB=y
|
||
```
|
||
|
||
#### 获取符号文件
|
||
下面我们来准备调试需要的符号文件。看一下该版本的 code name：
|
||
```
|
||
$ lsb_release -c
|
||
Codename: xenial
|
||
```
|
||
然后在下面的目录下新建文件 `ddebs.list`，其内容如下（注意看情况修改Codename）：
|
||
```
|
||
$ cat /etc/apt/sources.list.d/ddebs.list
|
||
deb http://ddebs.ubuntu.com/ xenial main restricted universe multiverse
|
||
deb http://ddebs.ubuntu.com/ xenial-security main restricted universe multiverse
|
||
deb http://ddebs.ubuntu.com/ xenial-updates main restricted universe multiverse
|
||
deb http://ddebs.ubuntu.com/ xenial-proposed main restricted universe multiverse
|
||
```
|
||
`http://ddebs.ubuntu.com` 是 Ubuntu 的符号服务器。执行下面的命令添加密钥：
|
||
```
|
||
$ wget -O - http://ddebs.ubuntu.com/dbgsym-release-key.asc | sudo apt-key add -
|
||
```
|
||
然后就可以更新并下载符号文件了：
|
||
```
|
||
$ sudo apt-get update
|
||
$ uname -r
|
||
4.13.0-38-generic
|
||
$ sudo apt-get install linux-image-4.13.0-38-generic-dbgsym
|
||
```
|
||
完成后，符号文件将会放在下面的目录下：
|
||
```
|
||
$ file /usr/lib/debug/boot/vmlinux-4.13.0-38-generic
|
||
/usr/lib/debug/boot/vmlinux-4.13.0-38-generic: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=f00f4b7ef0ab8fa738b6a9caee91b2cbe23fef97, not stripped
|
||
```
|
||
可以看到这是一个静态链接的可执行文件，使用 gdb 即可进行调试，例如这样：
|
||
```
|
||
$ gdb -q /usr/lib/debug/boot/vmlinux-4.13.0-38-generic
|
||
Reading symbols from /usr/lib/debug/boot/vmlinux-4.13.0-38-generic...done.
|
||
gdb-peda$ p init_uts_ns
|
||
$1 = {
|
||
kref = {
|
||
refcount = {
|
||
refs = {
|
||
counter = 0x2
|
||
}
|
||
}
|
||
},
|
||
name = {
|
||
sysname = "Linux", '\000' <repeats 59 times>,
|
||
nodename = "(none)", '\000' <repeats 58 times>,
|
||
release = "4.13.0-38-generic", '\000' <repeats 47 times>,
|
||
version = "#43~16.04.1-Ubuntu SMP Wed Mar 14 17:48:43 UTC 2018", '\000' <repeats 13 times>,
|
||
machine = "x86_64", '\000' <repeats 58 times>,
|
||
domainname = "(none)", '\000' <repeats 58 times>
|
||
},
|
||
user_ns = 0xffffffff822517a0 <init_user_ns>,
|
||
ucounts = 0x0 <irq_stack_union>,
|
||
ns = {
|
||
stashed = {
|
||
counter = 0x0
|
||
},
|
||
ops = 0xffffffff81e2cc80 <utsns_operations>,
|
||
inum = 0xeffffffe
|
||
}
|
||
}
|
||
```
|
||
|
||
#### 获取源文件
|
||
将 `/etc/apt/sources.list` 里的 `deb-src` 行都取消掉注释：
|
||
```
|
||
$ sed -i '/^#\sdeb-src /s/^#//' "/etc/apt/sources.list"
|
||
```
|
||
然后就可以更新并获取 Linux 内核源文件了：
|
||
```
|
||
$ sudo apt-get update
|
||
$ mkdir -p ~/kernel/source
|
||
$ cd ~/kernel/source
|
||
$ apt-get source $(dpkg-query '--showformat=${source:Package}=${source:Version}' --show linux-image-$(uname -r))
|
||
```
|
||
```
|
||
$ ls linux-hwe-4.13.0/
|
||
arch CREDITS debian.master firmware ipc lib net security tools zfs
|
||
block crypto Documentation fs Kbuild MAINTAINERS README snapcraft.yaml ubuntu
|
||
certs debian drivers include Kconfig Makefile samples sound usr
|
||
COPYING debian.hwe dropped.txt init kernel mm scripts spl
|
||
```
|