支持追踪计算跳转地址偏移信息

Author: Your Name

README.md

@@ -64,6 +64,14 @@ chmod +x /data/local/tmp/stackplz
 ./stackplz --name com.sfx.ebpf stack --library libnative-lib.so --symbol _Z5func1v --unwindstack --regs
 ```
 
+通过`--reg`指定寄存器，对跳转目标地址进行偏移计算，再也不担心找不到跳哪儿去了
+
+`--reg`选项需要搭配`--regs`或者`--unwindstack`使用，后续进行优化
+
+```bash
+./stackplz --name com.xingin.xhs stack --library libtiny.so --offset 0x175248 --regs --reg x8
+```
+
 ![](./images/Snipaste_2022-11-13_14-11-03.png)
 
 通过**指定包名和配置文件**进行批量hook

cli/cmd/stack.go

@@ -66,6 +66,7 @@ func init() {
     stackCmd.PersistentFlags().StringVar(&stack_config.Library, "library", "/apex/com.android.runtime/lib64/bionic/libc.so", "full lib path")
     stackCmd.PersistentFlags().StringVar(&stack_config.Symbol, "symbol", "", "lib symbol")
     stackCmd.PersistentFlags().Uint64Var(&stack_config.Offset, "offset", 0, "lib hook offset")
+    stackCmd.PersistentFlags().StringVar(&stack_config.RegName, "reg", "", "get the offset of reg")
     stackCmd.PersistentFlags().StringVar(&stack_config.Config, "config", "", "hook config file")
     rootCmd.AddCommand(stackCmd)
 }
@@ -118,6 +119,7 @@ func stackCommandFunc(command *cobra.Command, args []string) {
             SConfig: config.SConfig{
                 UnwindStack: stack_config.UnwindStack,
                 ShowRegs:    stack_config.ShowRegs,
+                RegName:     stack_config.RegName,
                 Uid:         target_config.Uid,
                 Pid:         target_config.Pid,
             },

pkg/util/helper.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/binary"
 	"fmt"
+	"io/ioutil"
 	"math/rand"
 	"os"
 	"strings"
@@ -88,3 +89,34 @@ func FindLib(library string, search_paths []string) (string, error) {
 	}
 	return library, nil
 }
+
+func ParseReg(pid uint32, value uint64) (string, error) {
+	info := "UNKNOWN"
+	// 直接读取maps信息 计算value在什么地方 用于定位跳转目的地
+	filename := fmt.Sprintf("/proc/%d/maps", pid)
+	content, err := ioutil.ReadFile(filename)
+	if err != nil {
+		return info, fmt.Errorf("Error when opening file:%v", err)
+	}
+	var (
+		seg_start  uint64
+		seg_end    uint64
+		permission string
+		seg_offset uint64
+		device     string
+		inode      uint64
+		seg_path   string
+	)
+	for _, line := range strings.Split(string(content), "\n") {
+		reader := strings.NewReader(line)
+		n, err := fmt.Fscanf(reader, "%x-%x %s %x %s %d %s", &seg_start, &seg_end, &permission, &seg_offset, &device, &inode, &seg_path)
+		if err == nil && n == 7 {
+			if value >= seg_start && value < seg_end {
+				offset := seg_offset + (value - seg_start)
+				info = fmt.Sprintf("%s + 0x%x", seg_path, offset)
+				break
+			}
+		}
+	}
+	return info, err
+}

user/config/config_stack.go

@@ -6,6 +6,7 @@ type StackConfig struct {
     Library     string
     Symbol      string
     Offset      uint64
+    RegName     string
     Config      string
 }
 

user/config/iconfig.go

@@ -22,6 +22,7 @@ type SConfig struct {
 	Pid         uint64
 	UnwindStack bool
 	ShowRegs    bool
+	RegName     string
 	Debug       bool
 }
 

user/event/event_stack.go

@@ -9,6 +9,9 @@ import (
     "encoding/binary"
     "encoding/json"
     "fmt"
+    "stackplz/pkg/util"
+    "strconv"
+    "strings"
     "unsafe"
 )
 
@@ -23,6 +26,7 @@ type HookDataEvent struct {
     UnwindBuffer UnwindBuf
     UnwindStack  bool
     ShowRegs     bool
+    RegName      string
     UUID         string
 }
 
@@ -89,6 +93,39 @@ func (this *HookDataEvent) SetUUID(uuid string) {
 func (this *HookDataEvent) String() string {
     var s string
     s = fmt.Sprintf("[%s] PID:%d, Comm:%s, TID:%d", this.UUID, this.Pid, bytes.TrimSpace(bytes.Trim(this.Comm[:], "\x00")), this.Tid)
+    if this.RegName != "" && (this.ShowRegs || this.UnwindStack) {
+        // 如果设置了寄存器名字 那么尝试从获取到的寄存器数据中取值计算偏移
+        // 当然前提是取了寄存器数据
+        var tmp_regs [33]uint64
+        if this.UnwindStack {
+            tmp_regs = this.UnwindBuffer.Regs
+        } else {
+            tmp_regs = this.RegsBuffer.Regs
+        }
+        has_reg_value := false
+        var regvalue uint64
+        if strings.HasPrefix(this.RegName, "x") {
+            parts := strings.SplitN(this.RegName, "x", 2)
+            regno, _ := strconv.ParseUint(parts[1], 10, 32)
+            if regno >= 0 && regno <= 29 {
+                // 取到对应的寄存器值
+                regvalue = tmp_regs[regno]
+                has_reg_value = true
+            }
+        } else if this.RegName == "lr" {
+            regvalue = tmp_regs[30]
+            has_reg_value = true
+        }
+        if has_reg_value {
+            // 读取maps 获取偏移信息
+            info, err := util.ParseReg(this.Pid, regvalue)
+            if err != nil {
+                fmt.Printf("ParseReg for %s=0x%x failed", this.RegName, regvalue)
+            } else {
+                s += fmt.Sprintf(", Reg %s Info:\n%s", this.RegName, info)
+            }
+        }
+    }
     if this.ShowRegs {
         var tmp_regs [33]uint64
         if this.UnwindStack {

user/module/probe_stack.go

@@ -186,8 +186,9 @@ func (this *MStackProbe) Dispatcher(e event.IEventStruct) {
     // 事件类型指定为 EventTypeModuleData 直接使用当前方法处理
     // 如果需要多处联动收集信息 比如做统计之类的 那么使用 EventTypeEventProcessor 类型 并设计处理模式更合理
 
-    e.(*event.HookDataEvent).ShowRegs = this.probeConf.ShowRegs
-    e.(*event.HookDataEvent).UnwindStack = this.probeConf.UnwindStack
+    e.(*event.HookDataEvent).RegName = this.sconf.RegName
+    e.(*event.HookDataEvent).ShowRegs = this.sconf.ShowRegs
+    e.(*event.HookDataEvent).UnwindStack = this.sconf.UnwindStack
     this.logger.Println(e.(*event.HookDataEvent).String())
 }