bpftrace用户空间地址解析

root@VM-20-5-ubuntu:~/bpftrace-developing# bpftrace -e 'uprobe:/bin/bash:readline { printf("PS1: %s\n", str(*uaddr("ps1_prompt"))); }'
Attaching 1 probe...
PS1: 

上述命令，不支持Address space layout randomization (ASLR)的命令。

如果命令是ASLR的，可以使用以下命令查看，

root@VM-20-5-ubuntu:~/bpftrace-developing# bpftrace  --include linux/sched.h -e 'uprobe:/bin/bash:readline { printf("PS1: %s\n", str(*(curtask->mm->mmap->vm_start + uaddr("ps1_prompt")))); }'
Attaching 1 probe...
PS1: \[\e]0;\u@\h: \w\a\]${debian_chroot:+($debian_chroot)}\u@\h:\w\

参考资料

https://github.com/iovisor/bpftrace/blob/master/docs/reference_guide.md#9-uaddr-address-resolution-user-levelhttps://github.com/iovisor/bpftrace/blob/master/docs/reference_guide.md#9-uaddr-address-resolution-user-level

uaddr(), usym(), ustack to support PIE ASLR · Issue #75 · iovisor/bpftrace · GitHubUbuntu 18.04 Bionic (and other OSes) have switched to randomizing the address space layout, which breaks simple approaches for symbol resolution. From https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes#Security_Improvements: In Ubuntu 18....https://github.com/iovisor/bpftrace/issues/75#issuecomment-555386648