linux-rootkit

commit a6920c1dd9c92762b4d1306fdf171e037b58c6c9
parent 63199e950d54fcb1d9b926e4f7debb53c33c8892
Author: Tizian Leonhardt <tizianleonhardt@web.de>
Date:   Wed,  3 Feb 2021 20:30:42 +0100

Use read_register and early return when type is not available

Diffstat:
M
project/extract_sizeret.py
 | 
24
++++++++++++++++--------

1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/project/extract_sizeret.py b/project/extract_sizeret.py
@@ -6,9 +6,9 @@ import json
 
 # allocator mapped to register containing size argument
 break_arg = {
-    "kmem_cache_alloc_trace": "$rdx",
-    "kmalloc_order": "$rdi",
-    "__kmalloc": "$rdi",
+    "kmem_cache_alloc_trace": "rdx",
+    "kmalloc_order": "rdi",
+    "__kmalloc": "rdi",
 }
 
 entries = set()
@@ -31,8 +31,14 @@ class EntryExitBreakpoint(gdb.Breakpoint):
         if f.unwind_stop_reason() != gdb.FRAME_UNWIND_NO_REASON:
             return False
 
+        t = self.type_lookup(f)
+
+        if t is None:
+            return False
+
         self.extract(f)
-        self.type_lookup(f)
+
+        print(t, prev_entry)
 
         return False
 
@@ -44,11 +50,11 @@ class EntryExitBreakpoint(gdb.Breakpoint):
 
         if self.number in entries:
             # extract size from correct register
-            if int(gdb.parse_and_eval(break_arg[frame.name()])) > 0:
-                prev_entry = f"size={gdb.parse_and_eval(break_arg[frame.name()])}"
+            if int(frame.read_register(break_arg[frame.name()])) > 0:
+                prev_entry = f"size={frame.read_register(break_arg[frame.name()])}"
         elif self.number in exits and prev_entry is not None:
             # extract return value, print for now
-            print(f"{prev_entry}, ret={hex(int(str(gdb.parse_and_eval('$rax')), 10) & (2 ** 64 - 1))}", flush=True)
+            print(f"{prev_entry}, ret={hex(int(str(frame.read_register('rax')), 10) & (2 ** 64 - 1))}", flush=True)
             prev_entry = None
 
     def type_lookup(self, frame):
@@ -66,10 +72,12 @@ class EntryExitBreakpoint(gdb.Breakpoint):
             key = f"{symtab.filename}:{sym.line}"
 
             if key in types:
-                print(types[key])
+                return types[key]
 
             f_iter = f_iter.older()
 
+        return None
+
 class Stage3():
     breakpoints = []