diff --git a/src/common/buffer.h b/src/common/buffer.h index 85d4c8e..5747b9a 100644 --- a/src/common/buffer.h +++ b/src/common/buffer.h @@ -179,7 +179,7 @@ static __always_inline int save_str_to_buf(event_data_t *event, void *ptr, u8 in // Read into buffer int sz = bpf_probe_read_str(&(event->args[event->buf_off + 1 + sizeof(int)]), MAX_STRING_SIZE, ptr); - if (sz > 0) { + if (sz >= 0) { barrier(); // Satisfy verifier for probe read if (event->buf_off > ARGS_BUF_SIZE - (MAX_STRING_SIZE + 1 + sizeof(int))) diff --git a/src/common/consts.h b/src/common/consts.h index b6d21cf..7548c1d 100644 --- a/src/common/consts.h +++ b/src/common/consts.h @@ -7,6 +7,7 @@ #define MAX_PATH_COMPONENTS 48 #define MAX_LOOP_COUNT 32 #define MAX_STRCMP_LEN 256 +#define STRARR_MAGIC_LEN 0xffff0000 #if defined(__MODULE_STACK) #define MAX_OP_COUNT 64 diff --git a/src/utils.h b/src/utils.h index 169e6c6..3014ce3 100644 --- a/src/utils.h +++ b/src/utils.h @@ -258,7 +258,10 @@ static __noinline u32 read_args(program_data_t* p, point_args_t* point_args, op_ ptr = ptr & 0xffffffffffff; int status = save_str_to_buf(p->event, (void*) ptr, op_ctx->save_index); if (status == 0) { - save_bytes_to_buf(p->event, 0, 0, op_ctx->save_index); + // save_str_to_buf 中应当将 bpf_probe_read_str 返回 0 时视为字符串为空 + // 地址异常时 bpf_probe_read_str 返回为负数 此时将认为字符串数组读取结束 + // 这里需要为字符串数组的读取设定一个标志 和空字符串的情况区分开 + save_bytes_to_buf(p->event, 0, STRARR_MAGIC_LEN, op_ctx->save_index); // 为读取字符串数组设计的 op_ctx->loop_count = op_ctx->break_count; } diff --git a/user/argtype/argtype_complex.go b/user/argtype/argtype_complex.go index 6c3b686..851ef4c 100644 --- a/user/argtype/argtype_complex.go +++ b/user/argtype/argtype_complex.go @@ -94,6 +94,9 @@ func parse_STRING_ARRAY(ctx IArgType, ptr uint64, buf *bytes.Buffer, parse_more if err := binary.Read(buf, binary.LittleEndian, &arg_str); err != nil { panic(err) } + if arg_str.Len == STRARR_MAGIC_LEN { + break + } payload := make([]byte, arg_str.Len) if err := binary.Read(buf, binary.LittleEndian, &payload); err != nil { panic(err) diff --git a/user/common/const.go b/user/common/const.go index 77f183e..ecb4eca 100644 --- a/user/common/const.go +++ b/user/common/const.go @@ -9,6 +9,7 @@ const SYSCALL_MAX_OP_COUNT = 256 const STACK_MAX_OP_COUNT = 64 const MAX_STRCMP_LEN = 256 const MAX_BUF_READ_SIZE = 4096 +const STRARR_MAGIC_LEN = 0xffff0000 const ( REG_ARM_R0 uint32 = iota