View run scripts
cat run
Can be seen, the kernel used is: qemu-system-i386 -nographic -kernel $ LINUX / arch / i386 / boot / bzImage, a hard disk is used: -initrd rootfs / rootfs.img.gz
If you add when you start "-s" you can start debugging mode
Run run, enter the virtual machine
./run
(Exit qume virtual machine: reboot -f)
Check bin file, as shown below, you can see, it is valid only busybox binary executable file, the other is a symbolic link to the busybox.
busybox in the implementation of, knock any command, the result is the implementation of busybox.
Exit the virtual machine, turn it on again with debug mode
Build a terminal operation.
Create a symbolic link cur points in ubuntu kernel source code and view the kernel root directory. Do not put large files on a virtual machine, the speed will be affected.
Left to start the virtual machine, waiting for debugging. The right to open the gdb debugger, symbol read from the kernel source code inside.
Qume connected to the virtual machine with gdb.
target remote localhost:1234
The busybox executable file read in, followed by the start address.
Add breakpoints, which is the entrance to execute a command interpreter time.
ash_main
Coupled with the breakpoint ls command. As shown below
Execution right c, left starts running
Display process ID of the current process
display $lx_current().pid
View the current process which is triggered by the executable file.
Continue to see the number 964 and the process of execution of the command interpreter. Visible, during startup, ash_main performed twice, run two processes.
View strace ls executed by the system call, open a new terminal.
The above system call is performed under Ubuntu, then the virtual machine does, kernel version is not the same, so the system calls are not the same.
Set a breakpoint in a function of controlling the overall system call location. b entry_SYSENTER_32
When the system call function to achieve the jump to see which system calls, also set a breakpoint
Jump to the array system call function, contains the entry address system call function, so only need to go one step further, s, will enter into the corresponding implementation function, we can see that the first function is realized time
（退出调试，先kill，再quit）