[feat] support capture dash and zsh command #671
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@yuweizzz Could you review and test it? |
cfc4n
added
enhancement
cfc4n
requested changes
Nov 21, 2024
| @@ -0,0 +1,54 @@ | |||
| // Copyright 2022 CFC4N <cfc4n.cs@gmail.com>. All Rights Reserved. | |||
There was a problem hiding this comment.
Please disable compilation of the Android version, including other golang files involving dash/zsh.
//go:build !androidgki
// +build !androidgki|
|
||
| func init() { | ||
| dashCmd.PersistentFlags().StringVar(&dc.Dashpath, "dash", "", "$SHELL file path, eg: /bin/dash , will automatically find it from $ENV default.") | ||
| dashCmd.PersistentFlags().StringVar(&dc.Readline, "readlineso", "", "readline.so file path, will automatically find it from $BASH_PATH default.") |
There was a problem hiding this comment.
Is the readlineso flag required? And, is the from $BASH_PATH default description wrong?
|
|
||
| func init() { | ||
| zshCmd.PersistentFlags().StringVar(&zc.Zshpath, "zsh", "", "$SHELL file path, eg: /bin/zsh , will automatically find it from $ENV default.") | ||
| zshCmd.PersistentFlags().StringVar(&zc.Readline, "readlineso", "", "readline.so file path, will automatically find it from $BASH_PATH default.") |
kern/dash_kern.c
Outdated
There was a problem hiding this comment.
It seems that the kernel space code is not very different from bash_kern.c. Is it possible to reuse a copy of the bytecode? Is this possible by just setting different hook functions in the ebpf loader?
@ruitianzhong @sancppp What do you think?
| func calReadFuncAddressByObjdump(elfPath string) (uint64, error) { | ||
| //0000000000005800 <read@plt>: | ||
| cmd := fmt.Sprintf("%s -d /bin/dash | grep read@plt | head -n 1", elfPath) | ||
| out, err := exec.Command("/bin/sh", "-c", cmd).Output() |
There was a problem hiding this comment.
Executing external commands is not a good practice, can it be achieved using debug/elf?
via:
ecapture/user/config/config_gotls.go
Lines 124 to 187 in fcddaeb
|
|
||
| var readlineFuncName string // 将默认hook函数改为readline_internal_teardown说明：https://github.com/gojue/ecapture/pull/479 | ||
| readlineFuncName = b.conf.(*config.DashConfig).ReadlineFuncName | ||
| addr, err := b.calReadFuncAddress() |
There was a problem hiding this comment.
addr should be a configuration item, passed in by the config.DashConfig structure, that is to say, the function of finding the offset address should be placed in the config package.
|
different behavior with bash, a single enter will trigger new event: ditto: |
|
dash源码中，当前考虑通过probe libc库中read函数进行命令行读取， |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
support dash and zsh command capture via ebpf u[ret]probe