本文来源自平安银河实验室
作者：朱文哲
>>>> 0x01 前言
>>>> 0x02 准备内核调试分析环境
我们考虑选用vmware自带的debugStub功能进行内核调试，首先需要手工编辑虚拟机的vmx文件并追加如下代码即可开启该功能：
# 启用64位的CPU调试功能，默认监听端口localhost:8864debugStub.listen.guest64="TRUE"# 如遇到断点原因不明的失效，可以试试追加下面的设置。debugStub.hideBreakpoints="FALSE"
具体的rpm包解压等命令如下：
# RPM解压命令rpm2cpio kernel-3.10.0-1160.62.1.el7.centos.plus.src.rpm | cpio -div# 解压源码tar -xvf linux-3.10.0-1160.62.1.el7.tar.xz# 复制当前内核编译参数cp -v /boot/config-$(uname -r) ./linux-3.10.0-1160.62.1.el7/.config# 此时还需要修改.config追加 CONFIG_DEBUG_INFO_BTF=y 参数，编译DEBUG符号信息
# 编译模块, 这个会很耗时且会占用大量的磁盘和内存make modules_installmake install# 检查系统上可用的内核awk -F' '$1=="menuentry " {print $2}' /etc/grub2.cfg# 设置开机从新编译的内核启动grub2-set-default 0
# 打开/etc/default/grub, 找到GRUB_CMDLINE_LINUX_DEFAULT这行配置然后在最后追加nokaslr# 完成修改后执行如下命令生效grub2-mkconfig -o /boot/grub2/grub.cfg
{// Use IntelliSense to learn about possible attributes.// Hover to view descriptions of existing attributes.// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387"version": "0.2.0","configurations": [{"name": "(gdb) linux","type": "cppdbg","request": "launch","program": "${workspaceRoot}/vmlinux","miDebuggerServerAddress": "localhost:8864","args": [],"stopAtEntry": true,"cwd": "${workspaceFolder}","environment": [],"externalConsole": false,"MIMode": "gdb","miDebuggerArgs": "-n","targetArchitecture": "x64","setupCommands": [{"text": "set arch i386:x86-64:intel","ignoreFailures": false},{"text": "dir .","ignoreFailures": false},{"text": "add-auto-load-safe-path ./","ignoreFailures": false},{"text": "-enable-pretty-printing","ignoreFailures": true}]}]}
>>>> 0x03 调试内核模块的方法
首先我们需要在编译内核模块时追加-g -DDEBUG CFLAGS使内核模块能够被调试。以Elkeid的LKM为例，可以追加debug选项。
debug:"|-----------------------------------|""| building HIDS kernel module Debug |""|-----------------------------------|"$(MAKE) -C $(KERNEL_DIR) M=$(MODULE_DIR) modules EXTRA_CFLAGS="-g -DDEBUG"ifneq ($(BATCH), true)$(MAKE) -C testendif
接下来我们需要创建对应的内核模块调试配置， 需要注意的是sourceFileMap字段需要把内核模块源码的路径进行关联映射，不然就无法进行源码级的调试。
{// Use IntelliSense to learn about possible attributes.// Hover to view descriptions of existing attributes.// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387"version": "0.2.0","configurations": [{"name": "(gdb) linux","type": "cppdbg","request": "launch","program": "${workspaceRoot}/vmlinux","miDebuggerServerAddress": "127.0.0.1:8864","args": [],"stopAtEntry": true,"cwd": "${workspaceFolder}","environment": [],"externalConsole": false,"MIMode": "gdb","miDebuggerArgs": "-n","targetArchitecture": "x64","sourceFileMap":{"/root/Elkeid/driver/LKM/": "${workspaceFolder}/LKM"},"setupCommands": [{"text": "set arch i386:x86-64:intel","ignoreFailures": false},{"text": "dir .","ignoreFailures": false},{"text": "add-auto-load-safe-path ./","ignoreFailures": false},{"text": "-enable-pretty-printing","ignoreFailures": true}]}]}
cat /sys/module/hids_driver/sections/.textcat /sys/module/hids_driver/sections/.datacat /sys/module/hids_driver/sections/.bss# 或者执行一下命令自动生成echo "-exec add-symbol-file LKM/hids_driver.ko `cat /sys/module/hids_driver/sections/.text`"
完成后我们就可以使用vs-code加载到内核上，并在debug console执行如下命令。
-exec add-symbol-file LKM/hids_driver.ko 0xffffffffc07db000
此时我们就可以使用vscode对内核模块进行源码调试了。
同样的我们也可以结合gdb命令进行信息查看部分信息。
-exec x/100bx 0xffff8801753b44e0-exec x/s 0xffff8801753b44e0 + 12
至此，我们就具备了使用vscode结合源码对内核模块进行调试分析的能力。
>>>> 0x04 使用VirtualBox进行内核调试的方法
首先关闭virtualbox虚拟机，并创建用于调试的串口pipe。
# 在宿主机上执行如下代码socat -d -d -d -d /tmp/debug-pipe PTY,link=/tmp/debug-pipe-pty
{// Use IntelliSense to learn about possible attributes.// Hover to view descriptions of existing attributes.// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387"version": "0.2.0","configurations": [{"name": "(gdb) linux","type": "cppdbg","request": "launch","program": "${workspaceRoot}/vmlinux","miDebuggerServerAddress": "/tmp/debug-pipe-pty","args": [],"stopAtEntry": true,"cwd": "${workspaceFolder}","environment": [],"externalConsole": false,"MIMode": "gdb","miDebuggerArgs": "-n","targetArchitecture": "x64","setupCommands": [{"text": "set arch i386:x86-64:intel","ignoreFailures": false},{"text": "dir .","ignoreFailures": false},{"text": "add-auto-load-safe-path ./","ignoreFailures": false},{"text": "-enable-pretty-printing","ignoreFailures": true}]}]}
echo g > /proc/sysrq-trigger
>>>> 0x05 引用
-
Debugging kernel and modules via gdb — The Linux Kernel documentation -
VMware上进行Linux Kernel调试 | BruceFan’s Blog
银河实验室
往期回顾
技术
技术
技术
技术
点赞、分享，感谢你的阅读▼
原文始发于微信公众号（平安集团安全应急响应中心）：使用VS-Code结合源码进行内核及内核模块远程调试的方法
