Skip to content

Instantly share code, notes, and snippets.

@Birch-san
Created July 25, 2020 20:29
Show Gist options
  • Save Birch-san/987cc0099a76a2347dc44f53d0d44fa5 to your computer and use it in GitHub Desktop.
Save Birch-san/987cc0099a76a2347dc44f53d0d44fa5 to your computer and use it in GitHub Desktop.
5-byte memcpy, 8-byte-aligned goes bang
sudo ./src/bpftrace -v -e 'struct F {char s[5];} u:./tests/testprogs/string_args:print { $a = ((struct F*)arg0)->s; }' -c ./tests/testprogs/string_args
0: (bf) r6 = r1
1: (79) r3 = *(u64 *)(r6 +112)
2: (bf) r1 = r10
3: (07) r1 += -29
4: (b7) r2 = 5
5: (85) call bpf_probe_read#4
last_idx 5 first_idx 0
regs=4 stack=0 before 4: (b7) r2 = 5
6: (b7) r7 = 0
7: (63) *(u32 *)(r10 -24) = r7
last_idx 7 first_idx 0
regs=80 stack=0 before 6: (b7) r7 = 0
8: (18) r1 = 0xffff89e8598f9a00
10: (bf) r2 = r10
11: (07) r2 += -24
12: (85) call bpf_map_lookup_elem#1
13: (55) if r0 != 0x0 goto pc+17
R0=inv0 R6=ctx(id=0,off=0,imm=0) R7=invP0 R10=fp0 fp-24=????mmmm fp-32=mmmmm???
14: (b7) r1 = 30006
15: (7b) *(u64 *)(r10 -24) = r1
16: (b7) r1 = 1
17: (73) *(u8 *)(r10 -4) = r1
18: (7b) *(u64 *)(r10 -16) = r7
19: (63) *(u32 *)(r10 -8) = r7
20: (18) r2 = 0xffff89e8598f9200
22: (bf) r4 = r10
23: (07) r4 += -24
24: (bf) r1 = r6
25: (18) r3 = 0xffffffff
27: (b7) r5 = 21
28: (85) call bpf_perf_event_output#25
last_idx 28 first_idx 13
regs=20 stack=0 before 27: (b7) r5 = 21
29: (b7) r0 = 0
30: (95) exit
from 13 to 31: R0=map_value(id=0,off=0,ks=4,vs=5,imm=0) R6=ctx(id=0,off=0,imm=0) R7=invP0 R10=fp0 fp-24=????mmmm fp-32=mmmmm???
31: (71) r1 = *(u8 *)(r10 -25)
32: (73) *(u8 *)(r0 +4) = r1
R0=map_value(id=0,off=0,ks=4,vs=5,imm=0) R1_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff)) R6=ctx(id=0,off=0,imm=0) R7=invP0 R10=fp0 fp-24=????mmmm fp-32=mmmmm???
33: (61) r1 = *(u32 *)(r10 -29)
misaligned stack access off (0x0; 0x0)+0+-29 size 4
processed 31 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 1
Error loading program: uprobe:./tests/testprogs/string_args:print
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment