Method and device for acquiring data structure offset in Linux kernel

Abstract

The invention discloses a method and a device for acquiring data structure offset in a Linux kernel. The method comprises the following steps: for N given Linux source code versions containing a target Linux kernel file, carrying out static source code analysis on all functions of each version, and obtaining all functions which contain references of a specified domain f of a specified structure S and are not explicitly declared as inline functions; calculating the characteristics of each function about the specified structural body S and the specified domain f, and generating a function list; then solving an intersection of the N function lists according to the function declaration, and generating a cross-version general function list; then taking partial features of the stability function with the lowest complexity as reference vectors; analyzing a target kernel file by using the reference vector to obtain all domain references for the initial structure S in an assembly code of a function corresponding to the reference vector; and obtaining a corresponding domain reference determination offset according to features in the reference vector.

Description

technical field [0001] The present invention relates to data structure offset acquisition technology, specifically by counting the general reference function of the specified field of the specified structure in the multi-version Linux source code, and then extracting the characteristics of the specified field of the specified structure in the function, thereby obtaining a A feature for obtaining the offset value of the field in the binary file of the Linux kernel, thereby realizing the acquisition of the offset of the specified field of the specified structure of the binary file of the Linux operating system kernel. Background technique [0002] Both memory forensics and virtual machine introspection technologies often require the use of memory analysis methods to obtain the addresses and values ​​of some data structures in the memory, which involves the relationship of some data structures in the kernel. These relationships are based on "structure-domain" embodied in form. ...

AI Technical Summary

Problems solved by technology

[0004] (1) The offset caused by data structure adjustment in different Linux versions is different;

[0005] (2) Different data members brought by different config files in the same Linux version, resulting in different offsets;

[0006] (3) Different compilation features of different versions of the compilation toolchain lead to different offsets caused by data structure rearrangement or memory alignment

However, this method requires the driver compilation environment in the target operating system and is executed with root privileges. For target operating systems that lack such conditions, such as some virtual network devices that limit shell functions and lack source code support, this method cannot be applied , the method of reverse analysis, which is highly dependent on manual work, is often applied, and the limitations are obvious

Images