Re: How to change a string type argument of a system call?

[Neo Liu <diabloneo at gmail dot com>]

I'm sorry for making a mistake when sending this email. This one contains
attachements.

On Sun, Apr 4, 2010 at 9:54 AM, Neo Liu <diabloneo@gmail.com> wrote:
> I write a script to monitor the open syscall of a target process. In the probe
> handler, I want to replace the $filename argument of the sys_open, so I can
> make the sys_open open another file. In order to achieve this purpose, I use
> __get_free_page() to allocate a new memory page (the page is in kernel spaces,
> the address is higher than 0xC0000000), put a new filename in this
> memory page, and let $filename parameter points to this new page. So, the
> $filename contains a new filename string. However, the open syscall returns
> failure. Is this because the open syscall can't access an address in the kernel
> spaces?
>
> The three attachments are my example codes and stap output.
> I use the following command line:
> $gcc -o fopen fopen.c
> $sudo stap -g open.stp -c ./fopen
>
> On Thu, Apr 1, 2010 at 9:26 PM, Frank Ch. Eigler <fche@redhat.com> wrote:
>> Neo Liu <diabloneo@gmail.com> writes:
>>
>>> How can I use systemtap to change a string type parameter in a
>>> syscall probe? For example, I use "probe syscall.open", I want to
>>> change the "filename" parameter to make the "open" syscall open a
>>> different file. How can I do that?
>>
>> We don't currently have helper functions for this: kernel_string() and
>> user_string() just read. ÂSomeone could write embedded-c routines to
>> do kernel_set_string() etc., but if we put them into the standard
>> tapset we need to make such functions only available in guru mode.
>> (That would probably need the invention of a /* guru */ marker.)
>>
>> - FChE
>>
>

#include <stdio.h>
#include <errno.h>
#include <string.h>

int
main(void)
{
  FILE *fp = NULL;

  if ((fp = fopen("temp.txt", "w")) == NULL) {
    printf("%d %s\n", errno, strerror(errno));
    printf("open file unsucessfully!\n");
    return -1;
  } else {
    fprintf(fp, "hello, world!\n");
    fclose(fp);
  }

  return 0;
}

Attachment: open.stp
Description: Binary data

Attachment: open.stp.out
Description: Binary data