- (* Optional callback into the tool before we start looking for
- * kernel symbols.
- *)
- (match beforeksyms with
- | None -> ()
- | Some beforeksyms -> beforeksyms debug images
- );
-
- (* If there is no run function, then there is no point continuing
- * with the rest of the program (kernel symbol analysis) ...
- *)
- if run = None then exit 0;
-
- (* Now kernel symbol analysis starts ... *)
- let images =
- List.map (
- fun (domid, name, arch, mem) ->
- (* Look for some common entries in the exported symbol table and
- * from that find the symbol table itself. These are just
- * supposed to be symbols which are very likely to be present
- * in any Linux kernel, although we only need one of them to be
- * present to find the symbol table.
- *
- * NB. Must not be __initdata, must be in EXPORT_SYMBOL.
- *)
- let common_ksyms = [
- "init_task"; (* first task_struct *)
- "root_mountflags"; (* flags for mounting root fs *)
- "init_uts_ns"; (* uname strings *)
- "sys_open"; (* open(2) entry point *)
- "sys_chdir"; (* chdir(2) entry point *)
- "sys_chroot"; (* chroot(2) entry point *)
- "sys_umask"; (* umask(2) entry point *)
- "schedule"; (* scheduler entry point *)
- ] in
- (* Searching for <NUL>string<NUL> *)
- let common_ksyms_nul = List.map (sprintf "\000%s\000") common_ksyms in
-
- let start_t = gettimeofday () in
-
- (* Search for these strings in the memory image. *)
- let ksym_strings = List.map (MMap.find_all mem) common_ksyms_nul in
- let ksym_strings = List.concat ksym_strings in
- (* Adjust found addresses to start of the string (skip <NUL>). *)
- let ksym_strings = List.map Int64.succ ksym_strings in
-
- if debug then (
- let end_t = gettimeofday () in
- eprintf "timing: searching for common_ksyms took %f seconds\n%!"
- (end_t -. start_t)
- );
-
- let start_t = gettimeofday () in
-
- (* For any we found, try to look up the symbol table
- * base addr and size.
- *)
- let ksymtabs = List.map (
- fun addr ->
- (* Search for 'addr' appearing in the image. *)
- let addrs = MMap.find_pointer_all mem addr in
-
- (* Now consider each of these addresses and search back
- * until we reach the beginning of the (possible) symbol
- * table.
- *
- * Kernel symbol table struct is:
- * struct kernel_symbol {
- * unsigned long value;
- * const char *name; <-- initial pointer
- * } symbols[];
- *)
- let pred_long2 addr =
- MMap.pred_long mem (MMap.pred_long mem addr)
- in
- let base_addrs = List.map (
- fun addr ->
- let rec loop addr =
- (* '*addr' should point to a C identifier. If it does,
- * step backwards to the previous symbol table entry.
- *)
- let addrp = MMap.follow_pointer mem addr in
- if MMap.is_C_identifier mem addrp then
- loop (pred_long2 addr)
- else
- MMap.succ_long mem addr
- in
- loop addr
- ) addrs in
-
- (* Also look for the end of the symbol table and
- * calculate its size.
- *)
- let base_addrs_sizes = List.map (
- fun base_addr ->
- let rec loop addr =
- let addr2 = MMap.succ_long mem addr in
- let addr2p = MMap.follow_pointer mem addr2 in
- if MMap.is_C_identifier mem addr2p then
- loop (MMap.succ_long mem addr2)
- else
- addr
- in
- let end_addr = loop base_addr in
- base_addr, end_addr -^ base_addr
- ) base_addrs in
-
- base_addrs_sizes
- ) ksym_strings in
- let ksymtabs = List.concat ksymtabs in
-
- (* Simply ignore any symbol table candidates which are too small. *)
- let ksymtabs = List.filter (fun (_, size) -> size > 64L) ksymtabs in
-
- if debug then (
- eprintf "%s: candidate symbol tables at:\n" name;
- List.iter (
- fun (addr, size) ->
- eprintf "\t%Lx\t%Lx\t%!" addr size;
- eprintf "first symbol: %s\n%!"
- (MMap.get_string mem
- (MMap.follow_pointer mem
- (MMap.succ_long mem addr)))
- ) ksymtabs
- );
-
- (* Vote for the most popular symbol table candidate and from this
- * generate a function to look up ksyms.
- *)
- let lookup_ksym =
- let freqs = frequency ksymtabs in
- match freqs with
- | [] ->
- eprintf (f_"%s: cannot find start of kernel symbol table\n") name;
- (fun _ -> raise Not_found)
-
- | (_, (ksymtab_addr, ksymtab_size)) :: _ ->
- if debug then
- eprintf
- "%s: Kernel symbol table found at %Lx, size %Lx bytes\n%!"
- name ksymtab_addr ksymtab_size;
-
- (* Load the whole symbol table as a bitstring. *)
- let ksymtab =
- Bitstring.bitstring_of_string
- (MMap.get_bytes mem ksymtab_addr
- (Int64.to_int ksymtab_size)) in
-
- (* Function to look up an address in the symbol table. *)
- let lookup_ksym sym =
- let bits = bits_of_wordsize (MMap.get_wordsize mem) in
- let e = MMap.get_endian mem in
- let rec loop bs =
- bitmatch bs with
- | { value : bits : endian(e);
- name_ptr : bits : endian(e) }
- when MMap.get_string mem name_ptr = sym ->
- value
- | { _ : bits : endian(e);
- _ : bits : endian(e);
- bs : -1 : bitstring } ->
- loop bs
- | { _ } -> raise Not_found
+ (* Certain needs are dependent on others ... *)
+ let needs_ksyms =
+ if needs_utsname then true
+ else needs_ksyms in
+ let needs_ksyms, needs_utsname =
+ if needs_tasks then true, true
+ else needs_ksyms, needs_utsname in
+ let needs_ksyms, needs_utsname =
+ if needs_net_devices then true, true
+ else needs_ksyms, needs_utsname in
+ let needs_ksyms, needs_utsname, needs_tasks, needs_net_devices =
+ if needs_everything then true, true, true, true
+ else needs_ksyms, needs_utsname, needs_tasks, needs_net_devices in
+
+ let errors = ref 0 in
+
+ List.iter (
+ fun kimage ->
+ try
+ (* Do the kernel symbol analysis. *)
+ let kimage =
+ if not needs_ksyms then kimage
+ else (
+ (* Look for ordinary kernel symbols: *)
+ let kimage = Virt_mem_ksyms.find_kernel_symbols debug kimage in
+
+ if kimage.have_ksyms then
+ (* Look for kallsyms: *)
+ Virt_mem_kallsyms.find_kallsyms debug kimage
+ else kimage
+ ) in
+
+ (* Get the kernel version (utsname analysis). *)
+ let kimage =
+ if not needs_utsname then kimage
+ else (
+ if kimage.have_ksyms then
+ Virt_mem_utsname.find_utsname debug kimage
+ else
+ kimage
+ ) in
+
+ (* Get the tasks. *)
+ let kimage =
+ if not needs_tasks then kimage
+ else (
+ let { ksyms = ksyms; have_ksyms = have_ksyms; utsname = utsname;
+ addrmap = addrmap } = kimage in
+ match have_ksyms, utsname with
+ | true, Some { uts_kernel_release = kernel_version } ->
+ let kimage = ref kimage in
+ let load struct_name addr size =
+ if debug then
+ eprintf "load for task, %s: %Lx %d ...\n"
+ struct_name addr size;
+ let mapped =
+ Virt_mem_mmap.is_mapped_range !kimage.mem addr size in
+ if not mapped then kimage := load_memory !kimage addr size;
+ let bits = Virt_mem_mmap.get_bytes !kimage.mem addr size in
+ Bitstring.bitstring_of_string bits