[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Mar 2013 01:31:22 +0400
From: "Dmitry V. Levin" <ldv@...linux.org>
To: owl-dev@...ts.openwall.com
Subject: Re: strace
On Thu, Mar 14, 2013 at 09:52:40PM +0100, Pavel Kankovsky wrote:
> On Thu, 14 Mar 2013, Dmitry V. Levin wrote:
>
> >restart_syscall is syscall number 0. Could the difference between older
> >and newer asm/ptrace.h versions be so fatal?
>
> Regrettably, I have not paid much attention the development Owl recently,
> therefore I do not know what are those older and newer versions but
> some reshuffling of pt_regs happened between 2.6.18 and 2.6.32.
>
> 2.6.18:
>
> struct pt_regs {
> long ebx;
> long ecx;
> long edx;
> long esi;
> long edi;
> long ebp;
> long eax;
> int xds;
> int xes;
> long orig_eax;
> long eip;
> int xcs;
> long eflags;
> long esp;
> int xss;
> };
>
> 2.6.32:
>
> struct pt_regs {
> long ebx;
> long ecx;
> long edx;
> long esi;
> long edi;
> long ebp;
> long eax;
> int xds;
> int xes;
> int xfs;
> int xgs;
> long orig_eax;
> long eip;
> int xcs;
> long eflags;
> long esp;
> int xss;
> };
>
> orig_eax (syscall number) has shifted.
That's surely the reason.
> But why would it matter?
The change of orig_eax offset means that there was a change in the ptrace
ABI between 2.6.18 and 2.6.32, and all its users (e.g. strace and gdb)
should be rebuilt.
> strace uses user_regs_struct from user.h that
> did not change and any changes in pt_regs layout should have been hidden
> by the kernel.
strace used to fetch registers on x86 with PTRACE_PEEKUSER,
that was slow but no pt_regs was necessary.
strace started to use "struct pt_regs" from asm/ptrace.h with commit
v4.6-124-geb0e3e8 that introduced PTRACE_GETREGS on x86.
Recently (commit v4.7-82-g2550d48) strace was changed on x86* to stop
including asm/ptrace.h and use "struct user_regs_struct" instead.
> PS: De ja vu? <http://www.openwall.com/lists/owl-dev/2012/07/19/1> :)
Yes, exactly the same issue, thanks.
--
ldv
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
