[讀書筆記]Binary Hancks(2) livepatch在X86下的實踐

livepatch是個可以給運行時的進程打熱補丁的工具。它可以方便的修改運行進程中的變數，也可以方便的替換運行進程中的函數，使用新的庫函數來取代原來主進程中的函數!

 

1、livepatch源碼下載：
http://sourcehoge.net/Software/livepatch/

 

2、binutil下載(筆者使用的版本為2.15)：
http://ftp.gnu.org/gnu/binutils/

 

3、編譯binutil包：
2.15版本的binutil包有一個小BUG，編譯時間會報這個錯誤：
gcc -DHAVE_CONFIG_H -I. -Ihttp://www.cnblogs.com/binutils-2.15/gas -I. -D_GNU_SOURCE -I. -Ihttp://www.cnblogs.com/binutils-2.15/gas -I../bfd -Ihttp://www.cnblogs.com/binutils-2.15/gas/config -Ihttp://www.cnblogs.com/binutils-2.15/gas/../include -Ihttp://www.cnblogs.com/binutils-2.15/gas/.. -Ihttp://www.cnblogs.com/binutils-2.15/gas/../bfd -Ihttp://www.cnblogs.com/binutils-2.15/gas/../intl -I../intl -DLOCALEDIR="\"/home/public/study/binutils/target_x86/build/share/locale\""   -W -Wall -Wstrict-prototypes -Wmissing-prototypes -g -O2 -c http://www.cnblogs.com/binutils-2.15/gas/app.c
In file included from ./targ-cpu.h:1,
                 from http://www.cnblogs.com/binutils-2.15/gas/config/obj-elf.h:42,
                 from ./obj-format.h:1,
                 from http://www.cnblogs.com/binutils-2.15/gas/config/te-linux.h:4,
                 from ./targ-env.h:1,
                 from http://www.cnblogs.com/binutils-2.15/gas/as.h:626,
                 from http://www.cnblogs.com/binutils-2.15/gas/app.c:30:
http://www.cnblogs.com/binutils-2.15/gas/config/tc-i386.h:451: error: array type has incomplete element type
make[3]: *** [app.o] Error 1
make[3]: Leaving directory `/home/public/study/binutils/target_x86/gas'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/home/public/study/binutils/target_x86/gas'
make[1]: *** [all] Error 2
make[1]: Leaving directory `/home/public/study/binutils/target_x86/gas'
make: *** [all-gas] Error 2
jimmy@linux-jimmy:/home/public/study/binutils/target_x86>

修改方法：
(1)、把../binutils-2.15/gas/config/tc-i386.h檔案第451行：
extern const struct relax_type md_relax_table[];
修改為：
extern const struct relax_type * md_relax_table;

把../binutils-2.15/gas/config/tc-i386.c中對應的資料結構修改為：const struct relax_type md_relax_table_ex[];
添加：const struct relax_type * md_relax_table = md_relax_table_ex;

補丁： diff -Nur binutils-2.15 binutils-2.15.jimmy/
diff -Nur binutils-2.15/gas/config/tc-i386.c binutils-2.15.jimmy/gas/config/tc-i386.c
--- binutils-2.15/gas/config/tc-i386.c  2004-05-18 03:36:09.000000000 +0800
+++ binutils-2.15.jimmy/gas/config/tc-i386.c    2010-02-22 21:29:41.000000000 +0800
@@ -363,7 +363,7 @@
    prefix), and doesn't work, unless the destination is in the bottom
    64k of the code segment (The top 16 bits of eip are zeroed).  */

-const relax_typeS md_relax_table[] =
+const relax_typeS md_relax_table_ex[] =
 {
   /* The fields are:
      1) most positive reach of this state,
@@ -402,6 +402,8 @@
   {0, 0, 4, 0}
 };

+const relax_typeS * md_relax_table = md_relax_table_ex;
+
 static const arch_entry cpu_arch[] = {
   {"i8086",    Cpu086 },
   {"i186",     Cpu086|Cpu186 },
diff -Nur binutils-2.15/gas/config/tc-i386.h binutils-2.15.jimmy/gas/config/tc-i386.h
--- binutils-2.15/gas/config/tc-i386.h  2004-05-18 03:36:09.000000000 +0800
+++ binutils-2.15.jimmy/gas/config/tc-i386.h    2010-02-22 21:26:12.000000000 +0800
@@ -448,7 +448,7 @@

 #define md_operand(x)

-extern const struct relax_type md_relax_table[];
+extern const struct relax_type * md_relax_table;
 #define TC_GENERIC_RELAX_TABLE md_relax_table

 extern int optimize_align_code;

 

4、編譯livepatch包：
這裡要修改一下Makefile：
jimmy@linux-jimmy:/home/public/study/livepatch/source> cat Makefile
#
# Makefile for livepatch
# $Id: Makefile 330 2004-11-03 11:38:02Z ukai $
# Copyright (C) 2004 Fumitoshi UKAI <ukai@debian.or.jp>
# All rights reserved.
# This is free software with ABSOLUTELY NO WARRANTY.
#
# You can redistribute it and/or modify it under the terms of
# the GNU General Public License version 2.
#

BINUTILS_DIR=/home/public/study/binutils/target_x86/build

CFLAGS=-Wall -O2 -g -I$(BINUTILS_DIR)/include

all: livepatch

livepatch: livepatch.o
        $(CC) -o $@ $<  -L$(BINUTILS_DIR)/lib -lbfd -liberty -lopcodes

fixup: fixup.o
        $(CC) -o $@ $< -L$(BINUTILS_DIR)/lib -lbfd -liberty -lopcodes

bfd: bfd.o
        $(CC) -o $@ $< -L$(BIN_UTILS_DIR)/lib -lbfd -liberty -lopcodes

clean:
        -rm -f *.o
        -rm -f livepatch fixup bfd

# EOF

 

5、測試：
jimmy@linux-jimmy:/home/public/study/livepatch/test> ./test.sh
in main process test_func:0
in main process test_func_x:0
in main process test_func:1
in main process test_func_x:1
in main process test_func:2
in main process test_func_x:2
in main process test_func:3
in main process test_func_x:3
in main process test_func:4
in main process test_func_x:4
bfd_openr: No such file or directory
dl test @ 0xb7f0f000 [8220] libtest.so
jmp 0x804841f 0xb7f0f45c　　<- 打上補丁，主進程的調用函數調用到補丁變庫中!
in livepatch test_func:5
in main process test_func_x:-5  <- 補丁函數又回調到了主進程中的函數
in livepatch test_func:6
in main process test_func_x:-6
in livepatch test_func:7
in main process test_func_x:-7
in livepatch test_func:8
in main process test_func_x:-8
in livepatch test_func:9
in main process test_func_x:-9
in livepatch test_func:10
in main process test_func_x:-10
./test.sh: line 11:  8195 Killed                  ./test
jimmy@linux-jimmy:/home/public/study/livepatch/test>
 
6、完整源碼與測試包(不包括binutils)：

 http://files.cnblogs.com/WuCountry/livepatch.rar