Linux jprobe初探

1、kprobe的示例代码在内核源码/samples/kprobes下，可以根据示例代码改写自己想要用的代码

2、内核示例代码

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kprobes.h>

/*
 * Jumper probe for do_fork.
 * Mirror principle enables access to arguments of the probed routine
 * from the probe handler.
 */

/* Proxy routine having the same arguments as actual do_fork() routine */
static long jdo_fork(unsigned long clone_flags, unsigned long stack_start,
	      struct pt_regs *regs, unsigned long stack_size,
	      int __user *parent_tidptr, int __user *child_tidptr)
{
	printk(KERN_INFO "jprobe: clone_flags = 0x%lx, stack_size = 0x%lx,"
			" regs = 0x%p\n",
	       clone_flags, stack_size, regs);

	/* Always end with a call to jprobe_return(). */
	jprobe_return();
	return 0;
}

static struct jprobe my_jprobe = {
	.entry			= jdo_fork,
	.kp = {
		.symbol_name	= "do_fork",
	},
};

static int __init jprobe_init(void)
{
	int ret;

	ret = register_jprobe(&my_jprobe);
	if (ret < 0) {
		printk(KERN_INFO "register_jprobe failed, returned %d\n", ret);
		return -1;
	}
	printk(KERN_INFO "Planted jprobe at %p, handler addr %p\n",
	       my_jprobe.kp.addr, my_jprobe.entry);
	return 0;
}

static void __exit jprobe_exit(void)
{
	unregister_jprobe(&my_jprobe);
	printk(KERN_INFO "jprobe at %p unregistered\n", my_jprobe.kp.addr);
}

module_init(jprobe_init)
module_exit(jprobe_exit)
MODULE_LICENSE("GPL");

3、编写Makefile

obj-m += jprobe_example.o
CURRENT_PATH:=$(shell pwd)
LINUX_KERNEL:=$(shell uname -r)
LINUX_KERNEL_PATH:=/usr/src/kernels/${LINUX_KERNEL}/

all:
        make -C $(LINUX_KERNEL_PATH) M=$(CURRENT_PATH) modules
clean:
        make -C $(LINUX_KERNEL_PATH) M=$(CURRENT_PATH) clean

4、编译生成内核模块

[root@VM_0_11_centos jprobe]# make
make -C /usr/src/kernels/3.10.0-957.21.3.el7.x86_64/ M=/home/jprobe modules
make[1]: Entering directory `/usr/src/kernels/3.10.0-957.21.3.el7.x86_64'
  CC [M]  /home/jprobe/jprobe_example.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /home/jprobe/jprobe_example.mod.o
  LD [M]  /home/jprobe/jprobe_example.ko
make[1]: Leaving directory `/usr/src/kernels/3.10.0-957.21.3.el7.x86_64'
[root@VM_0_11_centos jprobe]# ll
total 456
-rw-r--r-- 1 root root   1333 Jan  3 09:23 jprobe_example.c
-rw-r--r-- 1 root root 219904 Jan  3 09:55 jprobe_example.ko
-rw-r--r-- 1 root root   1075 Jan  3 09:55 jprobe_example.mod.c
-rw-r--r-- 1 root root  58952 Jan  3 09:55 jprobe_example.mod.o
-rw-r--r-- 1 root root 164768 Jan  3 09:55 jprobe_example.o
-rw-r--r-- 1 root root    262 Jan  3 09:55 Makefile
-rw-r--r-- 1 root root     38 Jan  3 09:55 modules.order
-rw-r--r-- 1 root root      0 Jan  3 09:55 Module.symvers
[root@VM_0_11_centos jprobe]# 

5、加载内核

[root@VM_0_11_centos jprobe]# insmod jprobe_example.ko 
[root@VM_0_11_centos jprobe]# lsmod | grep jprobe
jprobe_example         12493  0 
[root@VM_0_11_centos jprobe]# 

6、执行一个shell命令，然后查看内核信息

[950178.311306] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950178.312989] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950178.315358] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950178.317573] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950178.318413] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950178.319937] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950179.320757] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950179.322938] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950179.325331] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950179.326451] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950180.081993] jprobe: clone_flags = 0x3d0f00, stack_size = 0x7f679b7fe9d0, regs = 0x          (null)
[950180.082623] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950180.085471] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950180.085583] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950180.085653] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950180.103219] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[950180.163802] jprobe: clone_flags = 0x1200011, stack_size = 0x0, regs = 0x          (null)
[root@VM_0_11_centos jprobe]#