1. 查看哪些进程使用了特定的动态库so
# lsof /lib/arm-linux-gnueabi/libselinux.so.1
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 sysadmin mem REG 1,0 141608 811 /lib/arm-linux-gnueabi/libselinux.so.1
dbus-daem 3262 messagebus mem REG 1,0 141608 811 /lib/arm-linux-gnueabi/libselinux.so.1
lsof 9552 sysadmin mem REG 1,0 141608 811 /lib/arm-linux-gnueabi/libselinux.so.1
lsof 9555 sysadmin mem REG 1,0 141608 811 /lib/arm-linux-gnueabi/libselinux.so.1
login 28610 sysadmin mem REG 1,0 141608 811 /lib/arm-linux-gnueabi/libselinux.so.1
2. 查看elf文件link了哪些动态库so
方法一:
# ./tools/arm-soft-linux-gnueabi/bin/arm-soft-linux-gnueabi-ldd --root ./tools/arm-soft-linux-gnueabi/lib ./reboot
libc.so.6 => /lib/libc.so.6 (0x8badf00d)
ld-linux.so.3 => /lib/ld-linux.so.3 (0x8badf00d)
方法二：
# ./tools/arm-soft-linux-gnueabi/bin/arm-soft-linux-gnueabi-readelf -a ./reboot | grep NEEDED
0x00000001 (NEEDED) Shared library: [libc.so.6]
0x00000001 (NEEDED) Shared library: [ld-linux.so.3]
3. 将动态库so加载到的内存中的内容dump出来
使用lsof找到一个使用该so的进程，比如Pid为1.
然后‘cat /proc/1/maps_file | grep xxx.so’得到映射的虚地址空间，
最后，gdb attach 该进程，使用dump memory将so对应的地址dump出来。
4. dump 内存
方式一：
dd if=/dev/mem of=/tmp/mem_dump.bin count=1 bs=4M
方式二：
使用gdb, attach 某个进程。
(gdb) help dump
Dump target code/data to a local file.
List of dump subcommands:
dump binary -- Write target code/data to a raw binary file
dump ihex -- Write target code/data to an intel hex file
dump memory -- Write contents of memory to a raw binary file
dump srec -- Write target code/data to an srec file
dump tekhex -- Write target code/data to a tekhex file
dump value -- Write the value of an expression to a raw binary file
dump verilog -- Write target code/data to a verilog hex file
比如要dump 0x7f25c2a4e000-0x7f25c2a59000 这一块内存:
dump memory /tmp/sshd.dump 0x7f25c2a4e000 0x7f25c2a5900
方式三：
嵌入式系统可使用devmem特定的物理内存
/ # devmem 0x6ec2000
0x73A1E008
/proc/1 # devmem --help
BusyBox v1.21.1 (2023-02-03 07:55:47 UTC) multi-call binary.
Usage: devmem ADDRESS [WIDTH [VALUE]]
Read/write from physical address
ADDRESS Address to act upon
WIDTH Width (8/16/...)
VALUE Data to be written
本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系:hwhale#tublm.com(使用前将#替换为@)
