linux-rootkit

commit 4942eb17ff614eedf9a3e1747e11538b4876dc04
parent 49010fb2cf779b6d2d49875b2d120ba35f40a0c7
Author: Tizian Leonhardt <tizianleonhardt@web.de>
Date:   Sun,  7 Feb 2021 21:31:33 +0100

Documentation for commands

Diffstat:
M
project/extract_sizeret.py
 | 
10
++++++----

1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/project/extract_sizeret.py b/project/extract_sizeret.py
@@ -52,7 +52,7 @@ entries = set()
 exits = set()
 types = {}
 
-# Maps address to tuples of (type, size, caller)
+# Address |-> (type, size, caller)
 mem_map = {}
 
 size_at_entry = None
@@ -66,6 +66,8 @@ class DebugLevel(IntEnum):
 debug_level = DebugLevel.INFO
 
 class RkPrintMem(gdb.Command):
+    """Print currently allocated memory"""
+
     def __init__(self):
         super(RkPrintMem, self).__init__("rk-print-mem", gdb.COMMAND_DATA)
 
@@ -81,6 +83,8 @@ class RkPrintMem(gdb.Command):
 RkPrintMem()
 
 class RkDebug(gdb.Command):
+    """Toggle between different modes of memory logging"""
+
     def __init__(self):
         super(RkDebug, self).__init__("rk-debug", gdb.COMMAND_USER)
 
@@ -348,14 +352,12 @@ class Stage3():
         # system can hang when pagination is on
         gdb.execute("set pagination off")
 
-        # for rk-data
+        # for printing structs with rk-data
         gdb.execute("set print pretty on")
 
         with open(self.dictfile, 'r') as dct:
             types = json.load(dct)
 
-        types["./kernel/fork.c:812"] = "type = struct task_struct *"
-
         for b in (break_arg.keys() | break_arg_access.keys()):
             # set breakpoint at function entry, to extract size
             b_entry = EntryExitBreakpoint(b)