2.22 在GDB里如何查看GS:0x10的内容

https://scz.617.cn/unix/201205081619.txt

Q:

逻辑地址

段选择子(16-bits):段内偏移(32-bits)

也叫远指针。程序中寻址时只能使用逻辑地址。没有办法禁用段机制，但有办法
禁用分页机制。

线性地址

逻辑地址经GDT、LDT转换后得到线性地址。

我想在GDB里查看逻辑地址"GS:0x10"的内容。

A:

在GDB里没有通用办法查看逻辑地址的内容，也没有通用办法进行逻辑地址到线性地址的转换。

就这个具体的"GS:0x10"而言，有变通办法达到原始目的。

检查glibc-2.11.2的源码:

nptl/sysdeps/i386/tls.h

从TLS_INIT_TP()宏的实现可以看出，GS的段基址对应系统调用set_thread_area()的形参u_info->base_addr:

int set_thread_area ( struct user_desc *u_info );

struct user_desc { unsigned int entry_number; unsigned long int base_addr; unsigned int limit; unsigned int seg_32bit:1; unsigned int contents:2; unsigned int read_exec_only:1; unsigned int limit_in_pages:1; unsigned int seg_not_present:1; unsigned int useable:1; unsigned int empty:25; };

GS用于访问GLIBC TLS (thread-local storage)，GS段的起始地址对应tcbhead_t结构:

/ * nptl/sysdeps/i386/tls.h / typedef struct { / * Pointer to the TCB. Not necessarily the thread descriptor used by * libpthread. / void tcb; dtv_t dtv; / * Pointer to the thread descriptor. * * 指向所属结构的起始地址 / void self; int multiple_threads; / * GS:0x10 */ uintptr_t sysinfo; uintptr_t stack_guard; uintptr_t pointer_guard; int gscope_flag;

ifndef __ASSUME_PRIVATE_FUTEX

int         private_futex;

else

int         __unused1;

endif

/*
 * Reservation of some values for the TM ABI.
 */
void       *__private_tm[5];

} tcbhead_t;

$ gdb /usr/bin/col (gdb) catch syscall set_thread_area Catchpoint 1 (syscall 'set_thread_area' [243]) (gdb) r Starting program: /usr/bin/col

Catchpoint 1 (call to syscall 'set_thread_area'), 0xb7fe6cff in ?? () from /lib/ld-linux.so.2 (gdb) x/i $eip-2 0xb7fe6cfd: int $0x80 (gdb) i r ebx ebx 0xbffffaa0 -1073743200 (gdb) x/1wx $ebx+4 0xbffffaa4: 0xb7e8a8d0 (gdb) x/1wx (unsigned int )($ebx+4)+0x10 0xb7e8a8e0: 0xb7fe4400 (gdb) x/17i (unsigned int )((unsigned int )($ebx+4)+0x10) 0xb7fe4400: push %ecx 0xb7fe4401: push %edx 0xb7fe4402: push %ebp 0xb7fe4403: mov %esp,%ebp 0xb7fe4405: sysenter 0xb7fe4407: nop 0xb7fe4408: nop 0xb7fe4409: nop 0xb7fe440a: nop 0xb7fe440b: nop 0xb7fe440c: nop 0xb7fe440d: nop 0xb7fe440e: jmp 0xb7fe4403 0xb7fe4410: pop %ebp 0xb7fe4411: pop %edx 0xb7fe4412: pop %ecx 0xb7fe4413: ret (gdb)

拦截系统调用set_thread_area()，检查形参，获得GS段的线性地址(base_addr)，将 base_addr(0xb7e8a8d0)加0x10，得到GS:0x10对应的线性地址(0xb7e8a8e0)，检查该地址内容为0xb7fe4400。

顺便说一句，0xb7fe4400即__kernel_vsyscall()。在没有ASLR机制的年代，后者对应0xffffe400。