dtrace - How to change returned value of function -
there function in program, returns 1. prefer return 0.
from deduce: can add offset program counter, uregs[r_pc]+arg0, find address of return value.
i have allocated 32-bit "0", , try write 2 bytes of address return value lives (our function expects return bool16, need 2 bytes of 0):
sudo dtrace -p "$(getpid)" -w -n ' int *zero; begin { zero=alloca(4); *zero=0; } pid$target::textouta:return { copyout(zero, uregs[r_pc]+arg0, 2); }' of course get:
dtrace: error on enabled probe id 2 (id 320426: pid60498:gdi32.dll.so:textouta:return): invalid address (0x41f21c) in action #1 @ dif offset 60
uregs[r_pc] presumably userspace address. copyout() wants kernel address.
how translate userspace address uregs[r_pc] kernel-space? know copyin() can read data stored @ user-space address, kernel-space. doesn't give kernel address of memory.
alternatively: there other way change return value using dtrace?
dtrace not right tool this. should instead use debugger dbx, mdb or gdb.
in meantime, i'll try clarify of concepts you've mentioned.
to begin, may see in source code simple function there single return. quite possible compiled result, i.e. function's machine-specific implementation, contains single point of exit. typically, however, implementation contain more 1 exit point , may useful developer know specific 1 function returned. information, described offset start of function, given return probe's arg0. d script, then, attempting update part of program or library itself; although addition of arg0 makes destination address random, result still within text section, read-only.
secondly, in common case, function's implementation returns value storing in specific register; e.g. %rax on amd64. overriding return value neccessitate overriding register value. impossible because dtrace's access user-land registers read-only.
it possible function implemented in such way that, returns, recovers return value specific memory location before writing appropriate register. if case 1 could, indeed, modify value in memory (given location) before accessed. however, going work subset of cases: return value might equally contained in register or else expressed constant in program text itself. in case, far more trouble it's worth given existence of more appropriate debugging tools.
Comments
Post a Comment