linux跟踪地址访问,在Linux上加载到内存中的图像的跟踪内存地址

一个想法可能是跟踪所有mmap(2)调用，方式类似于strace(1)跟踪调用(srace使用ptrace(2)API)的方式。

mmap2(NULL, 40654, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb80e5000

mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb80e4000

mmap2(0x724000, 37456, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x724000

mmap2(0x72c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7) = 0x72c000

mmap2(0x27e000, 117704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x27e000

mmap2(0x299000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a) = 0x299000

mmap2(0x697000, 17008, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x697000

mmap2(0x69b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3) = 0x69b000

你必须每个描述符对应的文件名(从开放(2))的mmap(和返回值2：您可以通过检查出什么strace的使用strace (some command) 2> FOO看到，然后用grep mmap FOO尝试自己)将是映像在内存中映射的地址。

取决于你如何拦截过程中，你也可以注入上的dlopen钩，虽然上面的应该是足够