есть у меня вопрос, который никак не пойму - нужна помощь!
вот есть символы (имена) ядра, в динамике:
[olej@notebook ~]$ cat /proc/kallsyms | head -n5
c0400000 T startup_32
c0400000 T _text
c0400079 t bad_subarch
c0400079 W xen_entry
c040007b t default_entry
[olej@notebook ~]$ cat /proc/kallsyms | wc -l
69698
как видно, их дофигища ... в других инсталляциях я получал и 80000 и т.п.
причём, это и имена ядра, и всех загруженных модулей:
[olej@notebook ~]$ cat /proc/kallsyms | tail -n3
f7e6b174 t cleanup_module [output]
f7e6b0bb T video_output_register [output]
f7e6b0a5 T video_output_unregister [output]
Поскольку формат модуля ядра - это объектный файл, то разъяснение к формату таблицы имён нам лучшим образом даст:
[olej@notebook ~]$ man nm
...
· The symbol type. At least the following types are used; others are, as well, depending on the object file format. [b]If lowercase, the
symbol is local; if uppercase, the symbol is global (external).[/b]
"A" The symbol’s value is absolute, and will not be changed by further linking.
"B"
"b" The symbol is in the uninitialized data section (known as BSS).
"C" The symbol is common. Common symbols are uninitialized data. When linking, multiple common symbols may appear with the same
name. If the symbol is defined anywhere, the common symbols are treated as undefined references.
"D"
"d" The symbol is in the initialized data section.
"G"
"g" The symbol is in an initialized data section for small objects. Some object file formats permit more efficient access to small
data objects, such as a global int variable as opposed to a large global array.
"i" The symbol is in a section specific to the implementation of DLLs.
"N" The symbol is a debugging symbol.
"p" The symbols is in a stack unwind section.
"R"
"r" The symbol is in a read only data section.
"S"
"s" The symbol is in an uninitialized data section for small objects.
"T"
"t" The symbol is in the text (code) section.
"U" The symbol is undefined.
"V"
"v" The symbol is a weak object. When a weak defined symbol is linked with a normal defined symbol, the normal defined symbol is
used with no error. When a weak undefined symbol is linked and the symbol is not defined, the value of the weak symbol becomes
zero with no error. On some systems, uppercase indicates that a default value has been specified.
"W"
"w" The symbol is a weak symbol that has not been specifically tagged as a weak object symbol. When a weak defined symbol is linked
with a normal defined symbol, the normal defined symbol is used with no error. When a weak undefined symbol is linked and the
symbol is not defined, the value of the symbol is determined in a system-specific manner without error. On some systems,
uppercase indicates that a default value has been specified.
...
- оно стоит того, чтобы цитировать полностью, а самое интересное - это выделил уже я. Итого, в качестве имён функций API, которые можно вызывать из кода модуля, нас должны интересовать: а). большими буквами (external) + б). в секции .text, т.е. - T.
Теперь меня интересуют обработчики sys_*() в таблице sys_call_table:
[olej@notebook ~]$ cat /proc/kallsyms | grep sys_call_table
c07ab3d8 R sys_call_table
[olej@notebook etc]$ cat /usr/include/asm/unistd_32.h | head -n20
#ifndef _ASM_X86_UNISTD_32_H
#define _ASM_X86_UNISTD_32_H
/*
* This file contains the system call numbers.
*/
#define __NR_restart_syscall 0
#define __NR_exit 1
#define __NR_fork 2
#define __NR_read 3
#define __NR_write 4
#define __NR_open 5
#define __NR_close 6
#define __NR_waitpid 7
#define __NR_creat 8
#define __NR_link 9
#define __NR_unlink 10
#define __NR_execve 11
#define __NR_chdir 12
...
Это было начало таблицы системных вызовов, и относительно них (только самый минимум но этого достаточно):
[olej@notebook ~]$ cat /proc/kallsyms | grep T | grep sys_open
c04deb28 T do_sys_open
c04dec0c T sys_openat
c04dec35 T sys_open
[olej@notebook ~]$ cat /proc/kallsyms | grep T | grep sys_close
c04dea99 T sys_close
