一个想法可能是跟踪所有mmap(2)调用,方式类似于strace(1)跟踪调用(srace使用ptrace(2)API)的方式。
mmap2(NULL, 40654, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb80e5000
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb80e4000
mmap2(0x724000, 37456, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x724000
mmap2(0x72c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7) = 0x72c000
mmap2(0x27e000, 117704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x27e000
mmap2(0x299000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a) = 0x299000
mmap2(0x697000, 17008, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x697000
mmap2(0x69b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3) = 0x69b000
你必须每个描述符对应的文件名(从开放(2))的mmap(和返回值2:您可以通过检查出什么strace的使用strace (some command) 2> FOO看到,然后用grep mmap FOO尝试自己)将是映像在内存中映射的地址。
取决于你如何拦截过程中,你也可以注入上的dlopen钩,虽然上面的应该是足够