{"id":1704,"date":"2023-08-06T21:21:34","date_gmt":"2023-08-06T13:21:34","guid":{"rendered":"https:\/\/blog.dynox.cn\/?p=1704"},"modified":"2023-08-12T08:22:51","modified_gmt":"2023-08-12T00:22:51","slug":"linux%e5%8a%a8%e6%80%81%e7%b3%bb%e7%bb%9f%e8%bf%bd%e8%b8%aa%e6%8a%80%e6%9c%af%e6%bc%94%e5%8c%96","status":"publish","type":"post","link":"https:\/\/blog.dynox.cn\/?p=1704","title":{"rendered":"Linux\u7cfb\u7edf\u52a8\u6001\u8ffd\u8e2a\u6280\u672f\u6f14\u5316"},"content":{"rendered":"

\u524d\u8a00<\/h1>\n

\u5f00\u6e90\u4e16\u754c\u672c\u8eab\u5c31\u662f\u4e00\u4e2a\u5f00\u653e\u7684\u751f\u6001\uff0c\u65b0\u7684\u601d\u60f3\u548c\u5de5\u5177\u4e0d\u65ad\u88ab\u5f15\u5165\uff0c\u540c\u65f6\u8001\u7684\u6280\u672f\u53ca\u5de5\u5177\u4e5f\u5728\u4e0d\u65ad\u88ab\u6dd8\u6c70\uff0c\u6b63\u662f\u8fd9\u79cd\u65b0\u65e7\u66f4\u66ff\u4fc3\u6210\u4e86\u5f53\u524dLinux\u7684\u7f24\u7eb7\u4e16\u754c\u3002\u6574\u4e2a\u5f00\u6e90\u8fd0\u52a8\u53caLinux\u5185\u6838\u7684\u53d1\u5c55\u53f2\uff0c\u5c31\u662f\u4e00\u90e8\u5f15\u4eba\u5165\u80dc\u4e14\u8ba9\u4eba\u5fc3\u6000\u6f8e\u6e43\u7684\u52b1\u5fd7\u6545\u4e8b\u3002<\/p>\n

\u672c\u6587\u5c06\u805a\u7126Linux\u7cfb\u7edf\u52a8\u6001\u8ffd\u8e2a\u6280\u672f\u6846\u67b6\u7684\u6f14\u5316\u53ca\u5404\u79cd\u6846\u67b6\u7684\u66f4\u66ff<\/strong>\uff0c\u91cd\u70b9\u4ecb\u7ecd\u4f17\u591a\u8ffd\u8e2a\u672f\u6846\u67b6\u5e95\u5c42\u6240\u4f9d\u8d56\u7684\u5185\u6838\u5c42\u4e0a\u7684\u63a2\u6d4b\u6280\u672f\u53ca\u624b\u6bb5\uff0c\u5e76\u7ed3\u5408Elkeid HIDS\u9879\u76ee\uff0c\u5c55\u793a\u7cfb\u7edf\u5b89\u5168\u4ea7\u54c1\u5982\u4f55\u5229\u7528\u8fd9\u4e9b\u624b\u6bb5\u8fbe\u6210\u9488\u5bf9\u653b\u51fb\u884c\u4e3a\u7684\u68c0\u6d4b\u4ee5\u53ca\u653b\u51fb\u8def\u5f84\u7684\u53ef\u89c6\u5316\u3002Elkeid<\/strong> \u662f\u706b\u5c71\u5f15\u64ce\u9762\u5411\u5ba2\u6237\u8f93\u51fa\u7684\u7ec8\u7aef\u5b89\u5168\u80fd\u529b\u6a21\u578b\u548c\u5e94\u5bf9\u4e3b\u673a<\/strong>\u3001\u5bb9\u5668\u4e0e\u5bb9\u5668\u96c6\u7fa4<\/strong>\u3001Serverless<\/strong> \u7b49\u591a\u79cd\u5de5\u4f5c\u8d1f\u8f7d\u5b89\u5168\u9700\u6c42\u7684\u5f00\u6e90\u89e3\u51b3\u65b9\u6848\u3002Elkeid\u6e90\u4e8e\u5b57\u8282\u8df3\u52a8\u5185\u90e8\u6700\u4f73\u5b9e\u8df5\uff0c\u5176\u51fa\u53d1\u70b9\u5c31\u662f\u5b57\u8282\u81ea\u8eab\u968f\u7740\u4e1a\u52a1\u5feb\u901f\u53d1\u5c55\u6240\u9762\u4e34\u7684\u591a\u4e91\u3001\u4e91\u539f\u751f\u3001\u591a\u79cd\u5de5\u4f5c\u8d1f\u8f7d\u5171\u5b58\u60c5\u51b5\u4e0b\u7684\u5b89\u5168\u9700\u6c42\u3002<\/p>\n

1 Linux\u8ffd\u8e2a\u6280\u672f\u6f14\u5316<\/h1>\n

Linux\u7cfb\u7edf\u63d0\u4f9b\u4e86\u591a\u79cd\u52a8\u6001\u8ffd\u8e2a\u6280\u672f\u6846\u67b6\uff0c\u5982\u6700\u5e38\u7528\u7684\u6709perf\u3001SystemTap\uff0c\u4ee5\u53ca\u7531\u5927\u795eBrendan Gregg\u4e3b\u5bfc\u5f00\u53d1\u7684BCC\uff08BPF Compiler Collection\uff09\u5de5\u5177\u96c6\u7b49\u3002\u4e0d\u4ec5\u4ec5\u662f\u6280\u672f\u6846\u67b6\u79cd\u7c7b\u4e0a\u7684\u7e41\u6742\uff0c\u6846\u67b6\u540d\u79f0\u5c31\u53ef\u80fd\u662f\u6709\u7740\u591a\u91cd\u610f\u4e49\u7684\u590d\u5408\u6982\u5ff5\uff0c\u5982\u679c\u518d\u8003\u8651\u5230\u4e0d\u540c\u7684\u53d1\u884c\u7248\u4e0a\u7684\u652f\u6301\u53ca\u9884\u88c5\uff0c\u66f4\u8ba9\u4eba\u65e0\u6240\u9002\u4ece\uff0c\u5373\u4f7f\u662f\u8fd0\u7ef4\u4eba\u5458\u3001\u9760\u6027\u5de5\u7a0b\u5e08\u3001\u6216\u8005\u5f00\u53d1\u8005\u4e2d\u7684\u8001\u624b\u5728\u9762\u5bf9\u5b9e\u9645\u95ee\u9898\u65f6\u4e5f\u8981\u601d\u8651\u4e00\u756a\u624d\u80fd\u51b3\u5b9a\u5230\u5e95\u7528\u54ea\u4e2a\u5de5\u5177\u94fe\u65b9\u80fd\u6700\u9ad8\u6548\u5730\u5b9a\u4f4d\u5e76\u89e3\u51b3\u95ee\u9898\u3002<\/p>\n

1.1 Linux\u8ffd\u8e2a\u6280\u672f\u65f6\u95f4\u7ebf<\/h2>\n

\u6211\u4eec\u5148\u4ece\u65f6\u95f4\u7ebf\u4e0a\u6765\u7406\u89e3Linux\u8ffd\u8e2a\u6280\u672f\u7684\u6f14\u5316\uff1a\n\"Linux<\/p>\n

\u8fd9\u4e2a\u65f6\u95f4\u7ebf\u662f\u81ea2000\u5e74\u4ee5\u6765Linux\u5185\u6838\u8ffd\u8e2a\u6280\u672f\u7684\u6f14\u5316\u8fc7\u7a0b\uff0c\u6b63\u662fLinux\u5f00\u653e\u7684\u751f\u6001\u624d\u4fc3\u6210\u4e86\u591a\u79cd\u8ffd\u8e2a\u6846\u67b6\u4e0d\u65ad\u6d8c\u73b0\u548c\u66f4\u8fed\u7684\u5c40\u9762\uff0c\u5b8c\u7f8e\u8be0\u91ca\u4e86\u767e\u82b1\u9f50\u653e\u3001\u4f18\u80dc\u52a3\u6c70\u7684\u5f00\u6e90\u6cd5\u5219\u3002<\/p>\n

    \n
  1. 2000\u5e74\u521d\uff1a\u5728\u8fd9\u4e2a\u65f6\u671fLinux\u5185\u6838\u8fd8\u6ca1\u6709\u5b8c\u6574\u7684\u8ffd\u8e2a\u6846\u67b6\uff0c\u4f46\u7f51\u7edc\u53ca\u5b89\u5168\u4e0a\u7684\u9700\u6c42\u4e00\u76f4\u5728\u63a8\u52a8\u7740Linux\u5185\u6838\u7684\u8ffd\u8e2a\u53ca\u63a2\u6d4b\u80fd\u529b\u7684\u53d1\u5c55\uff0c\u5982NSA SELinux\u5b89\u5168\u6a21\u5757\u5f15\u5165\u4e86LSM Hooks\u56de\u8c03\u673a\u5236\u5e76\u6210\u4e3a\u540e\u7eed\u7684\u5b89\u5168\u6a21\u5757\u5982AppArmor\u6240\u4f9d\u8d56\u7684\u57fa\u7840\uff0c\u7f51\u7edc\u5c42\u5219\u662fnetfilter\u6846\u67b6\u7684\u5f15\u5165\u4ee5\u66ff\u4ee3\u65e7\u6709\u7684ipchains\u6846\u67b6\u3002<\/li>\n
  2. Linux Trace Toolkit\uff08LTT\uff09\uff1aLTT\u662f\u6700\u65e9\u7684\u7cfb\u7edf\u8ffd\u8e2a\u548c\u4e8b\u4ef6\u5206\u6790\u7684\u6846\u67b6\u4e4b\u4e00\uff0c\u63d0\u4f9b\u4e86Linux\u5185\u6838\u8ffd\u8e2a\u7684\u521d\u59cb\u57fa\u7840\u8bbe\u65bd\u3002LTT\u7684\u5f00\u53d1\u65e9\u57281998\u5e74\u5c31\u5df2\u542f\u52a8\uff0c\u4f46\u6700\u7ec8\u6ca1\u80fd\u5e76\u5165\u5185\u6838\u3002\u4e4b\u540e\u53c8\u8fce\u6765\u4e86LTTng\uff0c\u5373Linux Trace Toolkit Next Generation\uff0cLTTng\u63d0\u4f9b\u4e86\u66f4\u597d\u7684\u6269\u5c55\u6027\u3001\u6613\u7528\u6027\u4ee5\u53ca\u66f4\u597d\u7684\u6027\u80fd\u3002LTTng\u5176\u5b9e\u5e76\u4e0d\u662fLTT\u7684\u5ef6\u7eed\uff0c\u800c\u662f\u5bf9LTT\u6574\u4e2a\u6846\u67b6\u7684\u91cd\u5199\u5e76\u4e00\u76f4\u7ef4\u62a4\u81f3\u4eca\u3002<\/li>\n
  3. DTrace for Sun Solaris: \u4e8e2003\u5e74\u6b63\u5f0f\u53d1\u5e03\uff0c\u5176\u5f3a\u5927\u7684\u529f\u80fd\u53ca\u53ef\u5b9a\u5236\u6027\u89e6\u52a8\u4e86\u6574\u4e2aLinux\u5f00\u53d1\u8005\u5708\u5b50\uff0c\u6b64\u65f6Linux\u7684\u5185\u6838\u8ddf\u8e2a\u6846\u67b6\u7f3a\u5931\u7684\u95ee\u9898\u5f00\u59cb\u5f15\u8d77\u66f4\u5e7f\u6cdb\u7684\u5173\u6ce8\u3002<\/li>\n
  4. IBM\u7b49\u516c\u53f8\u5f00\u53d1\u4e86Dprobes for Linux\uff0cLinux\u53d1\u884c\u7248SLES\u6700\u65e9\u5f15\u5165\u6b64\u6846\u67b6\uff0c\u76f4\u52302006\u5e74\u7531SystemTap\u66ff\u4ee3\u3002Dprobes\u6700\u7ec8\u6ca1\u80fd\u6574\u5408\u81f3Linux\u5185\u6838\u4e3b\u7ebf\uff0c\u4f46\u8fd8\u662f\u7ed9Linux\u5185\u6838\u5e26\u6765\u4e86Kprobes\u6280\u672f\u6846\u67b6\u3002<\/li>\n
  5. Redhat\u516c\u53f8\u4e8e2005\u5e74\u5f15\u5165\u4e86SystemTap\u6846\u67b6\uff0cSystemTap\u662fRedhat\u7684Dtrace for Linux\u89e3\u51b3\u65b9\u6848\uff0cSystemTap\u63d0\u4f9b\u7ed9\u5f00\u53d1\u8005\u66f4\u5f3a\u5927\u4e14\u7075\u6d3b\u7684\u63a5\u53e3\uff0c\u5141\u8bb8\u5f00\u53d1\u8005\u7f16\u5199\u81ea\u5b9a\u4e49\u811a\u672c\u6765\u8ffd\u8e2a\u7279\u5b9a\u4e8b\u4ef6\u548c\u5206\u6790\u7cfb\u7edf\u6267\u884c\u3002<\/li>\n
  6. Ftrace\uff1a2008\u5e74\u5de6\u53f3Ftrace\u4f5c\u4e3a\u4e00\u4e2a\u51fd\u6570\u8ffd\u8e2a\u5668\u5f00\u59cb\u5d2d\u9732\u5934\u89d2\uff0c\u5e76\u6700\u7ec8\u6210\u4e3aLinux\u5185\u6838\u4e8b\u5b9e\u4e0a\u7684\u57fa\u51c6\u8ffd\u8e2a\u6846\u67b6\u3002Ftrace\u5141\u8bb8\u8bb0\u5f55\u51fd\u6570\u8c03\u7528\u53ca\u8fd4\u56de\u65f6\u7684\u5806\u6808\u548c\u65f6\u95f4\u6233\u7b49\u4fe1\u606f\uff0c\u4e3a\u5f00\u53d1\u8005\u63d0\u4f9b\u4e86\u5185\u6838\u6267\u884c\u6d41\u7684\u6d1e\u5bdf\u80fd\u529b\u3002<\/li>\n
  7. Perf\uff1a\u5168\u79f0\u4e3aPerformance Counters for Linux\uff0c\u53c8\u88ab\u79f0\u4f5c\u662fPerf events \u6216 Perf tools\uff0c2009\u5e74\u4f5c\u4e3a\u6027\u80fd\u5206\u6790\u5de5\u5177\u88ab\u5f15\u5165\uff0cPerf\u4f7f\u7528\u4e86\u786c\u4ef6\u6027\u80fd\u8ba1\u6570\u5668\uff0c\u53ef\u63d0\u4f9b\u6027\u80fd\u5206\u6790\u3001\u6307\u4ee4\u7ea7\u8ffd\u8e2a\u548c\u7edf\u8ba1\u62bd\u6837\u7b49\u529f\u80fd\uff0c\u6700\u7ec8\u6210\u4e3aLinux\u7cfb\u7edf\u4e8b\u5b9e\u4e0a\u7684\u6027\u80fd\u5206\u6790\u57fa\u51c6\u5de5\u5177\u3002<\/li>\n
  8. eBPF\u548cBCC\uff1a\u8fd1\u5e74\u6765eBPF\uff08\u6269\u5c55Berkeley\u5305\u8fc7\u6ee4\u5668\uff09\u7684\u5f15\u5165\u4ee5\u53caBPF\u7f16\u8bd1\u5668\u96c6\u5408\uff08BCC\uff09\u7684\u51fa\u73b0\u5f7b\u5e95\u6539\u53d8\u4e86Linux\u5185\u6838\u8ffd\u8e2a\u3002eBPF\u5141\u8bb8\u5728\u5185\u6838\u4e2d\u8fdb\u884c\u52a8\u6001\u8ffd\u8e2a\u548c\u6267\u884c\u81ea\u5b9a\u4e49\u7a0b\u5e8f\uff0c\u800cBCC\u63d0\u4f9b\u4e86\u4e00\u7cfb\u5217\u7528\u4e8e\u7f16\u5199\u548c\u8fd0\u884ceBPF\u7a0b\u5e8f\u7684\u5de5\u5177\u548c\u5e93\u3002<\/li>\n<\/ol>\n

    Linux\u5185\u6838\u8ffd\u8e2a\u4ece\u6709\u9650\u4e14\u5206\u6563\u7684\u5de5\u5177\u53ca\u65b9\u6cd5\u6700\u7ec8\u53d1\u5c55\u51fa\u4e86\u5168\u9762\u4e14\u591a\u529f\u80fd\u7684\u8ffd\u8e2a\u57fa\u7840\u8bbe\u65bd\uff0c\u5982Ftrace\u3001Perf\u3001SystemTap\u3001LTTng\u3001eBPF\u548cBCC\u7b49\uff0c\u6b63\u662f\u8fd9\u4e9b\u6846\u67b6\u7684\u5f15\u5165\u4e3a\u5f00\u53d1\u8005\u5e26\u6765\u8ffd\u8e2a\u548c\u5206\u6790Linux\u5185\u6838\u884c\u4e3a\u548c\u6027\u80fd\u7684\u4fbf\u5229\u3002<\/p>\n

    \u5f00\u6e90\u4e16\u754c\u672c\u8eab\u5c31\u662f\u4e00\u4e2a\u5f00\u653e\u7684\u751f\u6001\uff0c\u4e0d\u65ad\u6709\u65b0\u7684\u601d\u60f3\u548c\u5de5\u5177\u88ab\u5f15\u5165\uff0c\u540c\u65f6\u4e5f\u4e0d\u65ad\u6709\u8001\u7684\u6280\u672f\u53ca\u8001\u7684\u5de5\u5177\u88ab\u6dd8\u6c70\uff0c\u6b63\u662f\u8fd9\u79cd\u66f4\u66ff\u4fc3\u6210\u4e86\u5f53\u524dLinux\u7684\u7f24\u7eb7\u4e16\u754c\u3002\u6574\u4e2a\u5f00\u6e90\u8fd0\u52a8\u53caLinux\u5185\u6838\u7684\u53d1\u5c55\u53f2\u5c31\u662f\u4e00\u90e8\u5f15\u4eba\u5165\u80dc\u4e14\u8ba9\u4eba\u5fc3\u6000\u6f8e\u6e43\u7684\u6545\u4e8b\uff0c\u6709\u5174\u8da3\u7684\u8bfb\u8005\u53ef\u5ef6\u4f38\u9605\u8bfb\u53c2\u8003\u8d44\u6599[OS01: Rebel Code: Linux And The Open Source Revolution]\u3002<\/p>\n

    1.2 \u8ffd\u8e2a\u6280\u672f\u57fa\u7840\u6982\u5ff5<\/h2>\n

    \u5728\u5f00\u59cb\u4e4b\u524d\u6211\u4eec\u5148\u6f84\u6e05\u51e0\u4e2a\u5e38\u7528\u6982\u5ff5\uff0c\u8fd9\u4e2a\u6982\u5ff5\u5f88\u5bb9\u6613\u88ab\u6df7\u6dc6\u5728\u4e00\u8d77\uff1a<\/p>\n

    Probing (\u63a2\u6d4b)\uff1a<\/strong><\/p>\n

    \u53ef\u4ee5\u5c06\u63a2\u6d4b\u7406\u89e3\u4e3a\u5728\u6307\u5b9a\u70b9\u7684\u8fdb\u884c\u76d1\u63a7\u6216\u6d4b\u91cf\uff0c\u5176\u6838\u5fc3\u5728\u4e8e\u63d2\u6869\u673a\u5236(instrumentation)\uff0c\u53ef\u4ee5\u63d0\u4f9b\u5728\u6307\u4ee4\u6d41\u7279\u5b9a\u4f4d\u7f6e\u6dfb\u52a0\u548c\u6267\u884c\u9644\u52a0\u903b\u8f91\u4ee5\u91c7\u96c6\u76f8\u5173\u6570\u636e\u7684\u80fd\u529b\u3002Kprobes\u53cauprobes\uff0c\u4ee5\u53caftrace (Function hooks) \u90fd\u6709\u7740\u5404\u81ea\u7684\u63a2\u6d4b\u673a\u5236\u3002<\/p>\n

    Tracing (\u8ddf\u8e2a)\uff1a<\/strong><\/p>\n

    \u8ddf\u8e2a\u6240\u5f3a\u8c03\u7684\u4e8b\u4ef6\u6355\u83b7\u53ca\u6570\u636e\u6536\u96c6\u80fd\u529b\uff0c\u5176\u76ee\u7684\u662f\u4e3a\u4e86\u66f4\u597d\u5730\u7406\u89e3\u8f6f\u4ef6\u7cfb\u7edf\u7684\u5185\u90e8\u52a8\u4f5c\u3002\u5982\u679c\u5c06\u63a2\u6d4b\u5047\u8bbe\u6210\u4e3a\u5404\u4e2a\u5206\u652f\u8def\u5f84\u4e0a\u7684\u8def\u6807\u7684\u8bdd\uff0c\u8ddf\u8e2a\u5c31\u662f\u901a\u8fc7\u8fd9\u4e9b\u8def\u6807\u6240\u4e32\u8d77\u6765\u7684\u8fd0\u884c\u8f68\u8ff9\u3002<\/p>\n

    Profiling (\u6027\u80fd\u5206\u6790)\uff1a<\/strong><\/p>\n

    \u6027\u80fd\u5206\u6790\u4e5f\u662f\u57fa\u4e8e\u6570\u636e\u91c7\u6837\u7684\uff0c\u4f46\u5176\u7684\u662f\u4e3a\u4e86\u8bc4\u4f30\u548c\u6d4b\u91cf\u5e94\u7528\u7a0b\u5e8f\u6216\u7cfb\u7edf\u6027\u80fd\u6307\u6807\uff0c\u5982\u6267\u884c\u65f6\u95f4\u3001CPU\/\u5185\u5b58\u7b49\u76f8\u5173\u8d44\u6e90\u7684\u5360\u7528\u7b49\u3002\u5982\u901a\u8fc7\u5206\u6790\u6027\u80fd\u5206\u6790\u5668\u6240\u8f93\u51fa\u7684\u89c2\u6d4b\u4e8b\u4ef6\u7684\u7edf\u8ba1\u56fe\u8868\uff0c\u6211\u4eec\u53ef\u4ee5\u66f4\u65b9\u4fbf\u5730\u53d1\u73b0\u6267\u884c\u65f6\u95f4\u6700\u957f\u7684\u51fd\u6570\u7b49\u7b49\u3002<\/p>\n

    Linux\u7cfb\u7edf\u52a8\u6001\u8ffd\u8e2a\u6846\u67b6\u5176\u5b9e\u90fd\u5305\u542b\u4e86\u4ee5\u4e0a\u4e09\u5404\u80fd\u529b\uff0c\u53ea\u4e0d\u8fc7\u503e\u5411\u6027\u6709\u6240\u4e0d\u540c\uff0c\u5982perf\u5f3a\u4e8e\u6027\u80fd\u5206\u6790\u53ca\u70ed\u70b9\u5b9a\u4f4d\uff0c\u800ctrace-cmd\/ftrace\u5219\u66f4\u591a\u88ab\u7528\u4e8e\u4e8b\u4ef6\u8ddf\u8e2a\u53ca\u6267\u884c\u63a2\u67e5\u3002<\/p>\n

    2 \u5206\u5c42\u67b6\u6784<\/h1>\n

    \"Linux<\/p>\n

    Linux\u7cfb\u7edf\u4e0a\u7684\u6240\u6709\u8ffd\u8e2a\u6280\u672f\u6846\u67b6\u603b\u7684\u6765\u8bf4\u5747\u53ef\u4ee5\u62c6\u5206\u6210\u4e09\u5c42\uff1a<\/p>\n

    1\uff09\u6700\u4e0a\u5c42\u7684\u4ea4\u4e92\u5de5\u5177\u5c42(Front-End)\uff1a\u672c\u5c42\u5c31\u662f\u6211\u4eec\u901a\u5e38\u6240\u8bf4\u7684Linux\u7cfb\u7edf\u8ffd\u8e2a\u6280\u672f\u8fd9\u4e00\u6982\u5ff5\uff0c\u6240\u4ee3\u8868\u7684\u662f\u52a8\u6001\u8ffd\u8e2a\u6280\u672f\u7684\u7528\u6237\u5c42\u5de5\u5177\u5305\uff0c\u5373\u76f4\u63a5\u4e0e\u7528\u6237\u4ea4\u4e92\u7684\u8ffd\u8e2a\u5de5\u5177\u53ca\u8ffd\u8e2a\u6280\u672f\u7684\u5c55\u73b0\u5c42\uff0c\u5982Perf\u5de5\u5177\u3001BCC\u5de5\u5177\u5305\u3001SystemTap\u6216tracecmd\u7b49\uff1b\u4e0d\u540c\u7684\u5de5\u5177\u4f1a\u6709\u4e0d\u540c\u7684\u547d\u4ee4\u884c\u7ea6\u5b9a\u53ca\u8f93\u51fa\u683c\u5f0f(\u4e0d\u540c\u7684\u6570\u636e\u6574\u5408\u53ca\u5c55\u793a\u65b9\u5f0f)\u3001\u4e0e\u7528\u6237\u7684\u4ea4\u4e92\u65b9\u5f0f\u7b49<\/p>\n

    2\uff09\u6700\u4e0b\u5c42\u7684\u5185\u6838\u63d2\u6869(Kernel Instrument Hooking)\uff1a\u672c\u5c42\u53ef\u4ee5\u7406\u89e3\u4e3aLinux\u5185\u6838\u6240\u63d0\u4f9b\u7684\u76d1\u63a7\u53ca\u8ddf\u8e2a\u80fd\u529b\uff0c\u5373\u52a8\u6001\u8ffd\u8e2a\u6280\u672f\u7684\u57fa\u7840\u67b6\u6784(Infrastructure)\uff0c\u662f\u6240\u6709\u52a8\u6001\u8ffd\u8e2a\u6280\u672f\u6846\u67b6\u7684\u516c\u5171\u57fa\u7840\u3002\u6b64\u90e8\u5206\u6240\u9650\u5b9a\u7684\u662f\u6570\u636e\u7684\u91c7\u96c6\u529b\uff08\u5ea6\u5ea6\/\u79cd\u7c7b\u3001\u7c92\u5ea6\uff09<\/p>\n

    3\uff09\u4e2d\u95f4\u6846\u67b6\u5c42(Frameworks)\uff1a\u672c\u5c42\u53ef\u7406\u89e3\u4e3a\u63a5\u53e3\u5c42\uff0c\u5373\u5185\u6838\u600e\u6837\u4f7f\u7528\u548c\u5c01\u88c5\u76d1\u63a7\u53ca\u8ddf\u8e2a\u80fd\u529b\u5e76\u4e14\u4ee5\u4ec0\u4e48\u6837\u7684\u63a5\u53e3\u63d0\u4f9b\u7ed9\u5e94\u7528\u5c42\uff0c\u4e3b\u8981\u4f5c\u7528\u5c31\u662f\u627f\u4e0a\u542f\u4e0b\uff0c\u6bd4\u5982ftrace\u6846\u67b6\u90e8\u5206\u5b9e\u73b0\u4e86ringbuffer\u6765\u7f13\u5b58\u4e8b\u4ef6\u65e5\u5fd7\u5e76\u4ee5tracefs\u5f62\u5f0f\u5c06ftrace\u7684\u76d1\u63a7\u80fd\u529b\u76f4\u63a5\u66b4\u9732\u7ed9\u7528\u6237\u7a0b\u5e8f\u3002\u6211\u4eec\u4e0b\u9762\u5728\u8be6\u7ec6\u5404\u79cd\u8ddf\u8e2a\u6846\u67b6\u65f6\u4e0d\u5c31\u4e2d\u95f4\u5c42\u505a\u5355\u72ec\u8bf4\u660e\uff0c\u800c\u662f\u653e\u5728\u4ea4\u4e92\u5de5\u5177\u53ca\u5185\u6838\u63d2\u6869\u90e8\u5206\u4e2d\u4e00\u8d77\u4ecb\u7ecd\u3002<\/p>\n

    3 \u524d\u7aef\u4ea4\u4e92\u5de5\u5177<\/h1>\n

    \u4ea4\u4e92\u5de5\u5177\u5c31\u662f\u6211\u4eec\u6240\u5e73\u65f6\u76f4\u63a5\u4f7f\u7528\u7684\u5de5\u5177\u94fe\uff0c\u4e0b\u9762\u6211\u4eec\u5c31\u5206\u522b\u4ecb\u7ecd\u5e38\u7528\u7684\u8ffd\u8e2a\u53ca\u6027\u80fd\u5de5\u5177\uff0c\u8bfb\u8005\u5982\u679c\u76f8\u4e86\u89e3\u5404\u79cd\u5de5\u5177\u7684\u8be6\u7ec6\u7528\u6cd5\u53ef\u53c2\u9605\u76f8\u5173\u7684\u53c2\u8003\u8d44\u6599\u3002<\/p>\n

    3.1 perf<\/strong><\/h2>\n

    Perf\u5de5\u5177\u6b63\u5982\u5176\u540d\u79f0\u6240\u793a\uff0c\u5176\u4e3b\u8981\u7528\u4e8e\u6027\u80fd\u5206\u6790\u7684\u573a\u666f\uff0c\u901a\u8fc7\u76d1\u63a7\u70b9\u6570\u636e\u91c7\u6837\u7684\u6536\u96c6\u3001\u5904\u7406\u53ca\u5c55\u793a\u4ee5\u5b9a\u4f4d\u70ed\u70b9(On-CPU)\u6216\u51b7\u70b9(Off-CPU)\uff0c\u6240\u4ee5\u53c8\u88ab\u79f0\u4f5c\u662fPerformance Counters for Linux (PCL)\u3002<\/p>\n

    Perf\u63d0\u4f9b\u4e86\u5168\u6808\u91c7\u6837\u548c\u5206\u6790\u80fd\u529b\uff0c\u65e0\u8bba\u7528\u6237\u8fdb\u7a0b\u8fd8\u662f\u64cd\u4f5c\u7cfb\u7edf\u5185\u6838\u5747\u53ef\u4ee5\u91c7\u96c6\u5206\u6790\uff0c\u6b64\u5916\u4ea6\u80fd\u91c7\u96c6\u5206\u6790\u5982CPU\u786c\u4ef6\u4e8b\u4ef6\uff0c\u6b64\u90e8\u5206\u4e3b\u8981\u5229\u7528\u4e86CPU\u7684performance monitoring unit (PMU) \u90e8\u4ef6\u6765\u91c7\u96c6\u5982cache\u7f13\u5b58\u7684\u547d\u4e2d\u7387\/\u6709\u6548\u6027\u6216CPU\u5fae\u67b6\u6784\u5c42\u9762\u4e0a\u6d41\u6c34\u7ebf\u7684\u5229\u7528\u7387\u7b49CPU\u786c\u4ef6\u7edf\u8ba1\u6570\u636e\u3002Perf\u5e38\u88ab\u79f0\u4f5c\u662fLinux\u7cfb\u7edf\u4e0a\u7684\u745e\u58eb\u519b\u5200\uff0c\u53ef\u88ab\u7528\u6765\u8fdb\u884c\u5355\u4e00\u5e94\u7528\u5c42\u7a0b\u5e8f\u6216\u64cd\u4f5c\u7cfb\u7edf\u5185\u6838\u7684\u74f6\u9888\u5206\u6790\u4e0e\u5b9a\u4f4d\u3002Perf\u5206\u6790\u57fa\u4e8e\u9ad8\u9891\u91c7\u6837\u6570\u636e\uff0c\u56e0\u9762\u4f1a\u6240\u5f15\u5165\u4e0d\u5c0f\u7684\u5916\u90e8\u5e72\u6270(\u7cfb\u7edf\u5ef6\u65f6\u3001I\/O\u53caCPU\u5360\u7528)\u3002<\/p>\n

    \u4e0b\u9762\u7684\u7684\u4f8b\u5b50\u662f32\u4f4d\u53ca64\u4f4dMurMur Hash\u7b97\u6cd5\u7684\u6027\u80fd\u6458\u8981\u7684\u5bf9\u6bd4\u6d4b\u8bd5\uff1a<\/p>\n

    root@devz1:\/bd# perf stat .\/MurMur32 testfile\n\n Performance counter stats for &#039;.\/MurMur32 testfile&#039;:\n\n          6,201.00 msec task-clock                       #    1.000 CPUs utilized             \n                54      context-switches                 #    8.708 \/sec                      \n                 0      cpu-migrations                   #    0.000 \/sec                      \n           159,353      page-faults                      #   25.698 K\/sec                     \n    17,940,754,358      cycles                           #    2.893 GHz                       \n    17,780,030,362      instructions                     #    0.99  insn per cycle            \n     2,291,592,868      branches                         #  369.552 M\/sec                     \n        17,469,263      branch-misses                    #    0.76% of all branches           \n\n       6.202178179 seconds time elapsed\n\n       5.853408000 seconds user\n       0.348083000 seconds sys\n\nroot@devz1:\/bd# perf stat .\/MurMur64 testfile\n\n Performance counter stats for &#039;.\/MurMur64 testfile&#039;:\n\n          6,195.04 msec task-clock                       #    1.000 CPUs utilized             \n                39      context-switches                 #    6.295 \/sec                      \n                 3      cpu-migrations                   #    0.484 \/sec                      \n           159,350      page-faults                      #   25.722 K\/sec                     \n    17,923,596,344      cycles                           #    2.893 GHz                       \n    18,414,732,121      instructions                     #    1.03  insn per cycle            \n     2,291,526,783      branches                         #  369.897 M\/sec                     \n        17,442,514      branch-misses                    #    0.76% of all branches           \n\n       6.195976210 seconds time elapsed\n\n       5.843555000 seconds user\n       0.351973000 seconds sys<\/code><\/pre>\n
    \u4e0b\u9762\u7684\u4f8b\u5b50\u662f\u7528Perf\u6765\u7edf\u8ba1\u6307\u5b9a\u76d1\u63a7\u70b9mprotect\u7cfb\u7edf\u8c03\u7528\u572810\u79d2\u5185\u7684\u8c03\u7528\u6b21\u6570\uff0c\u5171\u6d4b\u91cf\u4e865\u6b21\uff1a<\/p>\n
    root@devz1:\/bd# perf stat -a -I 10000 -e &#039;syscalls:*_mprotect&#039;\n#           time             counts unit events\n    10.001203375            2945573      syscalls:sys_enter_mprotect                                   \n    10.001203375            2945678      syscalls:sys_exit_mprotect                                   \n    10.001203375                  0      syscalls:sys_enter_pkey_mprotect                                   \n    10.001203375                  0      syscalls:sys_exit_pkey_mprotect                                   \n    20.003415918            2885202      syscalls:sys_enter_mprotect                                   \n    20.003415918            2885113      syscalls:sys_exit_mprotect                                   \n    20.003415918                  0      syscalls:sys_enter_pkey_mprotect                                   \n    20.003415918                  0      syscalls:sys_exit_pkey_mprotect                                   \n    30.004569553            2900982      syscalls:sys_enter_mprotect                                   \n    30.004569553            2900982      syscalls:sys_exit_mprotect                                   \n    30.004569553                  0      syscalls:sys_enter_pkey_mprotect                                   \n    30.004569553                  0      syscalls:sys_exit_pkey_mprotect                                   \n    40.005761270            3057035      syscalls:sys_enter_mprotect                                   \n    40.005761270            3057036      syscalls:sys_exit_mprotect                                   \n    40.005761270                  0      syscalls:sys_enter_pkey_mprotect                                   \n    40.005761270                  0      syscalls:sys_exit_pkey_mprotect                                   \n    50.006815036            3051245      syscalls:sys_enter_mprotect                                   \n    50.006815036            3051246      syscalls:sys_exit_mprotect                                   \n    50.006815036                  0      syscalls:sys_enter_pkey_mprotect                                   \n    50.006815036                  0      syscalls:sys_exit_pkey_mprotect                                   <\/code><\/pre>\n
    \u7528perf\u751f\u6210\u7cfb\u7edf\u7684\u6574\u4f53\u6027\u80fd\u5206\u6790\u62a5\u544a\uff1a<\/p>\n
    root@devz1:\/bd# perf record -a -g --call-graph dwarf -s\nroot@devz1:\/bd# perf report -s symbol<\/code><\/pre>\n
    \"Linux<\/p>\n
    root@devz1:\/bd# perf report -T<\/code><\/pre>\n
    \"Linux<\/p>\n
    Perf\u6700\u5f3a\u5927\u7684\u4e00\u9879\u53ef\u89c6\u5316\u80fd\u529b\u662f\u4ee5\u706b\u7130\u56fe\u5f62\u5f0f\u66f4\u76f4\u89c2\u5730\u5c55\u793a\u7ed3\u679c\uff0c\u5982\u56fe\u6240\u793a\uff1a<\/p>\n
    \"img\"<\/p>\n
    Perf\u5de5\u5177\u652f\u6301\u6240\u67092.6.31\u4ee5\u6765\u7684\u5185\u6838\u7248\u672c\uff0c\u652f\u6301\u6240\u6709\u7684\u5e38\u89c1\u53d1\u884c\u7248\u3002\u5728\u4f7f\u7528\u65f6\u9700\u8981\u6ce8\u610f\u4e0e\u5185\u6838\u7248\u672c\u7684\u5339\u914d\u95ee\u9898\uff0c\u6700\u597d\u4f7f\u7528\u5185\u6838\u81ea\u5e26\u7684\u7248\u672c\uff1b\u53e6\u5916Perf\u5728\u5904\u7406\u53ca\u5c55\u793a\u6570\u636e\u65f6(\u5982\u51fd\u6570\u540d\u7684\u63d0\u53d6\u7b49)\u9700\u8981\u76f8\u5bf9\u5e94\u8c03\u8bd5\u7b26\u53f7\u6587\u4ef6\u3002<\/p>\n
    3.2 BCC & bpftrace<\/strong><\/h2>\n
    BCC ( Bpf Compiler Collectons) \u65e2\u662feBPF\u7a0b\u5e8f\u7684\u7f16\u5199\/\u7f16\u8bd1\u6846\u67b6\uff0c\u53c8\u662f\u4e0a\u767e\u4e2a\u6d4b\u8bd5\u3001\u8ddf\u8e2a\u5de5\u5177\u7684\u5408\u96c6\uff0c\u6db5\u76d6\u4e86Linux\u5185\u6838\u5404\u4e2a\u5b50\u7cfb\u7edf\u3002<\/p>\n
    \"bcc<\/p>\n
    BCC\u662f\u9ad8\u5ea6\u53ef\u5b9a\u5236\u7684\uff0c\u652f\u6301\u4ee5Python\u6216LUA\u8bed\u8a00\u811a\u672c\u5e76\u52a8\u6001\u751f\u6210eBPF\u63d2\u6869\u7a0b\u5e8f\uff0c\u53ef\u5145\u5206\u5229\u7528eBPF\u7684\u4f18\u52bf\u901a\u8fc7\u9488\u5bf9\u6027\u7684\u63d2\u6869\u4ee5\u6700\u5c0f\u7684CPU\u4ee3\u4ef7\u6765\u83b7\u5f97\u66f4\u7cbe\u51c6\u7684\u76d1\u63a7\u6570\u636e\u3002\u76f8\u8f83\u4e8ePerf\u5de5\u5177\uff0c\u4e3b\u8981\u5dee\u8ddd\u5728\u4e8e\u901a\u7528\u6027\uff0c\u5bf9\u5185\u6838\u7248\u672c\u7684\u8981\u6c42\u8f83\u9ad8\uff0c\u867d\u7136eBPF\u6240\u8981\u6c42\u7684\u6700\u4f4e\u5185\u6838\u7248\u672c\u662f3.15\uff0c\u4f46\u5927\u90e8BCC\u5de5\u5177\u5219\u9700\u89814.1\u53ca\u4e4b\u540e\u7684\u5185\u6838\u3002<\/p>\n
    \u53ef\u53c2\u9605Brendan Gregg\u6240\u8457\u7684\u300aSystems Performance: Enterprise and the Cloud, 2e\u300b\u6216\u300aBPF Performance Tools \u300b\u6765\u4e86\u89e3\u6027\u80fd\u5206\u6790\u7684\u4e00\u822c\u601d\u8def\u53caBCC\u4f17\u591a\u5de5\u5177\u7684\u7528\u6cd5\u3002<\/p>\n
    \u4e0eBCC\u5de5\u5177\u76f8\u7c7b\u4f3c\u7684\u662fbpftrace\u5de5\u5177\uff0c\u5e95\u5c42\u540c\u6837\u91c7\u7528\u4e86eBPF\uff0c\u4e0d\u540c\u4e4b\u5904\u5728\u4e8ebpftrace\u5b9e\u73b0\u4e86\u901a\u8fc7\u7b80\u5355\u547d\u4ee4\u811a\u672c\u5b9e\u73b0\u4e86\u5f3a\u5927\u7684eBPF\u7684\u5904\u7406\u80fd\u529b\uff0c\u5728\u4e0d\u5c11\u7a0b\u5ea6\u4e0a\u53ef\u66ff\u4ee3BCC\u5de5\u5177\u94fe\uff0c\u53ef\u8c13\u662f\u8c03\u8bd5\u53ca\u8ddf\u8e2a\u5de5\u5177\u4e2d\u7684\u4e07\u80fd\u519b\u5200\u3002<\/p>\n
    3.3 Ftrace<\/strong><\/h2>\n
    \"Linux<\/p>\n
    Ftrace\u662f\u4e8b\u5b9e\u4e0a\u7684Linux\u9ed8\u8ba4\u5185\u6838\u8ddf\u8e2a\u6846\u67b6\uff0c\u5168\u79f0\u662ffunction tracer\uff0c\u5b9e\u9645\u4e0a\u5305\u542b\u4e86\u591a\u4e2a\u4e0d\u540c\u8ddf\u8e2a\u7a0b\u5e8f\u7684\u6846\u67b6\uff0c\u53ef\u4ee5\u5b9e\u73b0\u5bf9\u5185\u6838\u51fd\u6570\u6574\u4e2a\u8c03\u7528\u6808\u7684\u8ddf\u8e2a\u53ca\u6267\u884c\u6d41\u7684\u65f6\u5e8f\u5206\u6790\u3002Ftrace\u8ddf\u8e2a\u6846\u67b6\u65e2\u53ef\u4ee5\u7528\u524d\u7aef\u5de5\u5177\u5982Trace-cmd\u6216Trace Compass\u6765\u6536\u96c6\u5904\u7406\u8ddf\u8e2a\u4e8b\u4ef6\uff0c\u4f46\u4e5f\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528tracefs\u63a5\u53e3\u6765\u8fdb\u884c\u4ea4\u4e92 (\u6ce8: 4.1\u4e4b\u524d\u7684\u5185\u6838\u4f7f\u7528debugfs)\uff0c\u540e\u8005\u4f7f\u5f97ftrace\u53ef\u4ee5\u5f88\u65b9\u4fbf\u5730\u5e94\u7528\u5728\u7c7b\u4f3c\u5d4c\u5165\u5f0f\u7cfb\u7edf\u8fd9\u79cd\u53d7\u9650\u573a\u666f\u4e2d\u3002<\/p>\n
    root@devz1:\/bd\/elkeid\/driver\/LKM# trace-cmd record -p function_graph -o prctl.cond.dat \/bd\/prctl.cond 1000\n  plugin 'function_graph'\nCPU 0: 142884 events lost\nCPU 1: 145553 events lost\nCPU 2: 146946 events lost\nCPU 3: 153171 events lost\nCPU 4: 158666 events lost\nCPU 5: 146837 events lost\nCPU 6: 149830 events lost\nCPU 7: 148248 events lost\nCPU 8: 146777 events lost\nCPU 9: 142771 events lost\nCPU 10: 153487 events lost\nCPU 11: 109054 events lost\nCPU 12: 88133 events lost\nCPU 13: 160568 events lost\nCPU 14: 146435 events lost\nCPU 15: 166039 events lost\nCPU0 data recorded at offset=0x1ca000\n    677910 bytes in size (2805760 uncompressed)\nCPU1 data recorded at offset=0x270000\n    662282 bytes in size (2760704 uncompressed)\nCPU2 data recorded at offset=0x312000\n    671880 bytes in size (2826240 uncompressed)\nCPU3 data recorded at offset=0x3b7000\n    666420 bytes in size (2760704 uncompressed)\nCPU4 data recorded at offset=0x45a000\n    660560 bytes in size (2760704 uncompressed)\nCPU5 data recorded at offset=0x4fc000\n    668253 bytes in size (2760704 uncompressed)\nCPU6 data recorded at offset=0x5a0000\n    597882 bytes in size (2473984 uncompressed)\nCPU7 data recorded at offset=0x632000\n    579340 bytes in size (2387968 uncompressed)\nCPU8 data recorded at offset=0x6c0000\n    669085 bytes in size (2760704 uncompressed)\nCPU9 data recorded at offset=0x764000\n    671154 bytes in size (2781184 uncompressed)\nCPU10 data recorded at offset=0x808000\n    461914 bytes in size (2236416 uncompressed)\nCPU11 data recorded at offset=0x879000\n    685712 bytes in size (2818048 uncompressed)\nCPU12 data recorded at offset=0x921000\n    678074 bytes in size (2756608 uncompressed)\nCPU13 data recorded at offset=0x9c7000\n    505564 bytes in size (2105344 uncompressed)\nCPU14 data recorded at offset=0xa43000\n    664372 bytes in size (2785280 uncompressed)\nCPU15 data recorded at offset=0xae6000\n    474461 bytes in size (1974272 uncompressed)\n\nroot@devz1:\/bd\/elkeid\/driver\/LKM# trace-cmd report -i prctl.cond.dat | head -n60\ncpus=16\n       prctl-999-17870 [010] 106972.553766: funcgraph_entry:        0.663 us   |  mutex_unlock();\n       prctl-999-17870 [010] 106972.553767: funcgraph_entry:        0.171 us   |  preempt_count_add();\n       prctl-999-17870 [010] 106972.553767: funcgraph_entry:        0.128 us   |  preempt_count_sub();\n       prctl-999-17870 [010] 106972.553768: funcgraph_entry:                   |  __f_unlock_pos() {\n       prctl-999-17870 [010] 106972.553768: funcgraph_entry:        0.133 us   |    mutex_unlock();\n       prctl-999-17870 [010] 106972.553768: funcgraph_exit:         0.375 us   |  }\n       prctl-999-17870 [010] 106972.553768: funcgraph_entry:        0.132 us   |  syscall_exit_to_user_mode_prepare();\n       prctl-999-17870 [010] 106972.553768: funcgraph_entry:                   |  exit_to_user_mode_prepare() {\n       prctl-999-17870 [010] 106972.553769: funcgraph_entry:        0.145 us   |    fpregs_assert_state_consistent();\n       prctl-999-17870 [010] 106972.553769: funcgraph_exit:         0.429 us   |  }\n       prctl-999-17870 [010] 106972.553770: funcgraph_entry:                   |  __x64_sys_execve() {\n       prctl-999-17870 [010] 106972.553770: funcgraph_entry:                   |    kprobe_ftrace_handler() {\n       prctl-999-17870 [010] 106972.553771: funcgraph_entry:        0.347 us   |      get_kprobe();\n       prctl-999-17870 [010] 106972.553771: funcgraph_entry:                   |      pre_handler_kretprobe() {\n       prctl-999-17870 [010] 106972.553772: funcgraph_entry:                   |        execve_entry_handler() {\n       prctl-999-17870 [010] 106972.553772: funcgraph_entry:                   |          get_execve_data() {\n       prctl-999-17870 [010] 106972.553772: funcgraph_entry:                   |            count() {\n       prctl-999-17870 [010] 106972.553772: funcgraph_entry:        0.172 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553773: funcgraph_entry:        0.157 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553773: funcgraph_entry:        0.161 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553773: funcgraph_entry:        0.155 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553774: funcgraph_entry:        0.155 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553774: funcgraph_entry:        0.154 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553774: funcgraph_entry:        0.152 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553774: funcgraph_entry:        0.156 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553775: funcgraph_entry:        0.154 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553775: funcgraph_entry:        0.154 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553775: funcgraph_entry:        0.156 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553775: funcgraph_entry:        0.151 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553776: funcgraph_entry:        0.155 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553776: funcgraph_entry:        0.154 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553776: funcgraph_entry:        0.152 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553777: funcgraph_entry:        0.155 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553777: funcgraph_entry:        0.153 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553777: funcgraph_entry:        0.151 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553777: funcgraph_entry:        0.168 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553778: funcgraph_entry:        0.154 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553778: funcgraph_entry:        0.153 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553778: funcgraph_entry:        0.153 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553778: funcgraph_entry:        0.152 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553779: funcgraph_entry:        0.149 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553779: funcgraph_entry:        0.155 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553779: funcgraph_entry:        0.149 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553779: funcgraph_entry:        0.158 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553780: funcgraph_exit:         7.694 us   |            }\n       prctl-999-17870 [010] 106972.553780: funcgraph_entry:                   |            count() {\n       prctl-999-17870 [010] 106972.553780: funcgraph_entry:        0.154 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553780: funcgraph_entry:        0.154 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553781: funcgraph_entry:        0.152 us   |              get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553781: funcgraph_exit:         0.960 us   |            }\n       prctl-999-17870 [010] 106972.553781: funcgraph_entry:                   |            __kmalloc() {\n       prctl-999-17870 [010] 106972.553781: funcgraph_entry:        0.150 us   |              kmalloc_slab();\n       prctl-999-17870 [010] 106972.553781: funcgraph_entry:                   |              __kmem_cache_alloc_node() {\n       prctl-999-17870 [010] 106972.553781: funcgraph_entry:        0.131 us   |                should_failslab();\n       prctl-999-17870 [010] 106972.553782: funcgraph_exit:         0.588 us   |              }\n       prctl-999-17870 [010] 106972.553782: funcgraph_exit:         1.140 us   |            }\n       prctl-999-17870 [010] 106972.553782: funcgraph_entry:        0.154 us   |            get_user_arg_ptr();\n       prctl-999-17870 [010] 106972.553783: funcgraph_entry:                   |            __check_object_size() {\n       prctl-999-17870 [010] 106972.553783: funcgraph_entry:        0.127 us   |              check_stack_object();<\/code><\/pre>\n
    \u53e6\u5916\u503c\u5f97\u4e00\u63d0\u7684\u662f\uff0cKernelShark\u662fPerf\u7684\u6570\u636e\u5c55\u793a\u7684GUI\u7248\u672c\uff0c\u80fd\u4ee5\u56fe\u5f62\u7684\u65b9\u5f0f\u591a\u6837\u5c55\u793a\u6570\u636e\uff1a\n\"Linux<\/p>\n
    3.4 SystemTap<\/strong><\/h2>\n
    \"img\"<\/p>\n
    SystemTap\u662fRedhat\u7684DTrace\u65b9\u6848\uff0c\u662fRHEL\u3001Fedora\u7b49\u7ea2\u5e3d\u7cfb\u53d1\u884c\u822c\u7684\u9ed8\u8ba4\u8ffd\u8e2a\u6280\u672f\u6846\u67b6\u30022003\u5e74Solaris DTrace\u6a2a\u7a7a\u51fa\u4e16\uff0c\u5e2d\u5377\u6574\u4e2aLinux\u5f00\u53d1\u4e16\u754c\uff0c\u5f15\u8d77\u4e86\u5e7f\u6cdb\u4e14\u6301\u4e45\u7684\u5173\u6ce8\uff0c\u5f7c\u65f6Linux\u7684\u5185\u6838\u8ddf\u8e2a\u80fd\u529b\u8fd8\u6ca1\u6709\u5efa\u7acb\u8d77\u5b8c\u6574\u7684\u751f\u6001\uff0c\u800cRedHat\u7684\u7b54\u6848\u5c31\u662fSystemTap\uff0c\u5e76\u7ef4\u62a4\u81f3\u4eca\uff0c\u867d\u7136\u6ca1\u6709\u96c6\u6210\u81f3\u5185\u6838\uff0c\u4f46\u5bf9\u4e3b\u6d41\u53d1\u884c\u7248\u7684\u652f\u6301\u4e00\u76f4\u90fd\u6709\u5f88\u597d\u7684\u8d2f\u5f7b\uff0c\u5982Debian\u3001SLES\u7b49\u3002<\/p>\n
    SystemTap\u5b9e\u73b0\u4e86\u81ea\u5df1\u7684\u811a\u672c\u8bed\u8a00\uff0c\u4ee5\u5bf9\u5e94DTrace\u7684D\u8bed\u8a00\uff0cSystemTap\u5bf9LKM\u7684\u7f16\u7a0b\u6846\u67b6\u8fdb\u884c\u4e86\u4e8c\u6b21\u5c01\u88c5\uff0c\u5b9e\u73b0\u4e86\u811a\u672c\u81f3C\u4ee3\u7801\u7684\u5373\u65f6\u8f6c\u6362\uff0c\u6700\u7ec8\u901a\u8fc7\u52a8\u6001\u7f16\u8bd1\u5e76\u52a0\u8f7d\u5185\u6838\u6a21\u5757(LKM\u5b9e\u73b0\u4e86\u9488\u5bf9\u76f8\u5e94\u5173\u6ce8\u70b9\u7684\u76d1\u63a7\u80fd\u529b\u3002\u6240\u4ee5SystemTap\u9700\u8981\u989d\u5916\u7684\u4f9d\u8d56\uff1a\u5982\u5185\u6838\u5934\u6587\u4ef6\u3001\u7f16\u8bd1\u94fe\u652f\u6301\u4ee5\u53ca\u8c03\u8bd5\u7b26\u53f7\u4fe1\u606f\u7b49\u3002<\/p>\n
    \u4e0b\u9762\u7684\u4f8b\u5b50\u662f\u4f7f\u7528SystemTap\u76d1\u63a7libc malloc\u51fd\u6570\u7684\u8c03\u7528 \uff1a<\/p>\n
    [root@CentOS8 ~]# cat malloc.stp \nprobe process(&quot;\/lib64\/libc.so.6&quot;).function(&quot;malloc&quot;) {\n    printf(&quot;malloc called: process: %s\\n&quot;, execname());\n    print_ubacktrace();\n}\n[root@C82 ~]# stap malloc.stp \nmalloc called: process: in:imjournal\n 0x7fd360fc0a90 : __libc_malloc+0x0\/0x300 [\/usr\/lib64\/libc-2.28.so]\nmalloc called: process: tuned\n 0x7efd845f1a90 : __libc_malloc+0x0\/0x300 [\/usr\/lib64\/libc-2.28.so]\nmalloc called: process: tuned\n  ...<\/code><\/pre>\n
    SystemTap\u4f1a\u81ea\u52a8\u52a0\u8f7d\u4e00\u4e2a\u4e34\u65f6\u6a21\u5757\uff0c\u53ef\u901a\u8fc7lsmod\u6765\u67e5\u8be2\uff1a<\/p>\n
    [root@C82 matt]# lsmod | grep stap\nstap_038834a35c414369cc17bce6916b3411_1641   757760  0\n\n[root@C82 ~]# ls -l \/tmp\ntotal 8\ndrwx------. 2 root root 4096 Jul 20 17:45 stap7X8kn4\n...\n[root@C82 ~]# ls \/tmp\/stap7X8kn4\/\nstap_038834a35c414369cc17bce6916b3411_1641.ko  stap_038834a35c414369cc17bce6916b3411_1641_src.c<\/code><\/pre>\n
    3.5 LTTng<\/strong><\/h2>\n
    \"img\"<\/p>\n
    Linux Trace Toolkit Next Generation (LTTng)\u4e8e2005\u5e74\u53d1\u5e03\uff0c\u53ea\u770b\u540d\u79f0\u7684\u8bdd\u5f88\u5bb9\u6613\u88ab\u4eba\u7406\u89e3\u4e3aLTT (Linux Trace Toolkit) \u7684\u5347\u7ea7\u7248\u672c\uff0c\u4f46\u5b9e\u9645\u4e0a\u662fMathieu Desnoyers\u5bf9LTT\u7684\u5b8c\u5168\u91cd\u5199\u3002LTTng\u867d\u7136\u6ca1\u80fd\u6574\u5408\u8fdbLinux\u5185\u6838\u4e3b\u5e72\u7248\u672c\uff0c\u4f46Linux tracepoints\u7684\u5f00\u53d1\u53ca\u6027\u80fd\u4f18\u5316\u5747\u6709Mathieu\u53caLTTng\u9879\u76ee\u7684\u529f\u52b3\uff0c\u800ctracepoints\u5219\u662fperf\u53caftrace\u6846\u67b6\u7684\u91cd\u8981\u652f\u6491\uff0c\u662fLinux\u8ddf\u8e2a\u6846\u67b6\u7684\u8d77\u6b65\u3002<\/p>\n
    LTTng\u9879\u76ee\u4e00\u76f4\u5728\u7ef4\u62a4\u72b6\u6001\uff0c\u5e76\u4e14\u589e\u52a0\u4e86\u5bf9USDT\u7684\u652f\u6301\u4ee5\u6536\u96c6\u7528\u6237\u6001\u8fdb\u7a0b\u81ea\u5b9a\u4e49\u76d1\u63a7\u70b9\u6570\u636e\u3002\u5728\u7ed3\u679c\u5206\u6790\u53ca\u5c55\u793a\u4e0a\u53ef\u7528TraceCompass\u5de5\u5177\u8fdb\u884c\u8f85\u52a9\u3002<\/p>\n
    3.6 Sysdig<\/strong><\/h2>\n
    Sysdig\u662f\u4e00\u79cdLinux\u73af\u5883\u7684\u53ef\u89c6\u5316\u5de5\u5177\uff0c\u529f\u80fd\u4e0a\u53ef\u4ee5\u7406\u89e3\u4e3astrace + tcpdump + htop + iftop + lsof\u7b49\u5de5\u5177\u7684\u96c6\u5408\u3002Sysdig\u53d1\u5e03\u4e4b\u521d\u4e3b\u8981\u662f\u7528\u4e8e\u63d0\u5347Linux\u7cfb\u7edf\u53ef\u89c2\u5bdf\u6027\uff0c\u540e\u7eed\u53c8\u52a0\u5165\u4e86\u9488\u5bf9\u5bb9\u5668\u672c\u5730\u76d1\u63a7\u4ee5\u4fa7\u91cd\u4e91\u73af\u5883\u4e0b\u7684\u884c\u4e3a\u76d1\u63a7\uff0cSysdig\u652f\u6301lua\u811a\u672c\u3002<\/p>\n
    \"img\"<\/p>\n
    3.7 Oracle DTrace<\/strong><\/h2>\n
    Oracle Linux Dtrace\u662f Solaris DTrace\u7684\u79fb\u690d\u7248\u672c\uff0c\u7531Oracle\u53d1\u8d77\u5e76\u7ef4\u62a4\uff0c\u4e3b\u8981\u7528\u5728Oracle Linux\u53d1\u884c\u7248\u4e0a\u3002\u4e0eSystemTap\u4e00\u6837\uff0cDTrace\u4e5f\u662f\u4ee5\u5185\u6838\u6a21\u5757\u4e3a\u8f7d\u4f53\u6765\u63d0\u4f9b\u5185\u6838\u8fd0\u884c\u65f6\u6001\u7684\u63a2\u6d4b\u80fd\u529b\u3002\u4e0eOracle DTrace\u7c7b\u4f3c\u7684\u9879\u76eedtrace4linux\uff0c\u5219\u662f\u7531 Paul D. Fox\u4e2a\u4eba\u6240\u5f00\u53d1\u548c\u7ef4\u62a4\u7684\u79fb\u690d\u7248\u672c\uff0c\u53ef\u53c2\u89c1[DT04: dtrace4linux @ github]\uff0c\u4e24\u4e2a\u9879\u76ee\u5176\u5b9e\u662f\u5404\u81ea\u72ec\u7acb\u7684\u3002DTrace\u6e90\u751f\u4e8eSolairs (\u7531Sun Microsystems inc\u5f00\u53d1\uff0c\u540eSun\u516c\u53f8\u88abOracle\u6536\u8d2d)\uff0cSun\u516c\u53f8\u66fe\u4ee5CDDL\u534f\u8bae\u5f00\u6e90\u6574\u4e2aSolaris\u64cd\u4f5c\u7cfb\u7edf\uff0c\u4f46Linux\u5185\u6838\u662f\u57fa\u4e8eGPLv2\u7684\uff0c\u4e5f\u6b63\u56e0\u4e3a\u4e24\u79cd\u534f\u8bae\u7684\u5dee\u5f02\u4f7f\u5f97\u6e90\u751f\u4e8eSolaris OS\u7684\u5f88\u591a\u8bf1\u4eba\u7684\u529f\u80fd\u5982DTrace\u3001ZFS\u7b49\u4e0d\u80fd\u76f4\u63a5\u5e76\u5165Linux\u5185\u6838\uff0c\u8fd9\u4e5f\u662fDTrace for Linux\u4ec5\u652f\u6301Oracle Linux\u7cfb\u7edf\u7684\u4e3b\u8981\u539f\u56e0\uff0c\u76f8\u5bf9\u4e8e\u65e5\u65b0\u6708\u5f02\u7684Linux\u5185\u6838\u6765\u8bf4DTrace\u79fb\u690d\u5f00\u53d1\u7684\u8282\u594f\u8981\u6162\u5f88\u591a\u3002<\/p>\n
    DTrace\u7684\u5f3a\u5927\u4e4b\u5904\u662fD\u8bed\u8a00\u7684\u811a\u672c\u652f\u6301\u80fd\u529b\uff0c\u7528\u6237\u53ef\u4ee5\u81ea\u5b9a\u4e49D\u8bed\u8a00\u7a0b\u5e8f\u6765\u8fbe\u6210\u5bf9\u7cfb\u7edf\u8f6f\u786c\u4ef6\u8fd0\u884c\u65f6\u6001\u7684\u63a2\u6d4b\u3002\u4ee5\u3010LT04: Linux Performance Analysis Tools\u3011\u5176\u4e2d\u7684\u4e00\u4e2a\u4f8b\u5b50\u6765\u4ecb\u7ecdDtrace\u7684\u4f7f\u7528\uff0c\u6b64\u4f8b\u5b50\u7edf\u8ba1\u4e86sshd\u8fdb\u7a0b\u7684\u6240\u6709tcp_sendmsg()\u8c03\u7528\u7684size\u53c2\u6570\u5e76\u4ee5\u5206\u5e03\u76f4\u65b9\u56fe\u5f62\u5f0f\u5c55\u793a\u7ed9\u7528\u6237\uff1a<\/p>\n
    # dtrace -n 'fbt::tcp_sendmsg:entry \/execname == \"sshd\"\/ {\n    @[\"bytes\"] = quantize(arg3); }'\ndtrace: description 'fbt::tcp_sendmsg:entry ' matched 1 probe\n^C\n bytes\n            value ------------- Distribution ------------- count\n               16 |                                        0\n               32 |@@@@@@@@@@@@@@@@                        1869\n               64 |@@@@@@@@@@@@@                           1490\n              128 |@@@                                     355\n              256 |@@@@                                    461\n              512 |@@@                                     373\n             1024 |@                                       95\n             2048 |                                        4\n             4096 |                                        1\n             8192 |                                        0 <\/code><\/pre>\n
    3.8 Linux Audit<\/h2>\n
    \"Audit<\/p>\n
    Linux Audit\u662f\u4e00\u4e2a\u7528\u4e8e\u76d1\u63a7\u548c\u8bb0\u5f55Linux\u7cfb\u7edf\u76f8\u5173\u6d3b\u52a8\u7684\u5b89\u5168\u6846\u67b6\uff0c\u53ef\u4ee5\u8ffd\u8e2a\u7cfb\u7edf\u4e2d\u7684\u5b89\u5168\u76f8\u5173\u4e8b\u4ef6\uff0c\u5982\u7528\u6237\u767b\u5f55\u3001\u6587\u4ef6\u8bbf\u95ee\u3001\u7cfb\u7edf\u8c03\u7528\u7b49\u7b49\u3002Audit\u63d0\u4f9b\u4e86\u5f3a\u5927\u4e14\u7075\u6d3b\u7684\u5b89\u5168\u5ba1\u8ba1\u673a\u5236\uff0c\u51e0\u4e4e\u65e0\u6240\u4e0d\u80fd\uff0c\u65e0\u8bba\u662f\u76d1\u63a7\u7cfb\u7edf\u6d3b\u52a8\uff0c\u8fd8\u662f\u5408\u89c4\u786e\u4fdd\uff0c\u6216\u8005\u5a01\u80c1\u53d1\u73b0\u7b49\u573a\u666f\u5747\u9002\u7528\uff0c\u5e76\u4e14\u80fd\u6839\u636e\u7cfb\u7edf\u7684\u5b89\u5168\u9700\u6c42\u548c\u653f\u7b56\u8981\u6c42\u8fdb\u884c\u7075\u6d3b\u914d\u7f6e\u3002<\/p>\n
    Audit\u662f\u4e00\u4e2a\u5b8c\u6574\u7684\u5ba1\u8ba1\u7cfb\u7edf\u89e3\u51b3\u65b9\u6848\uff0c\u81ea\u8eab\u5f62\u6210\u4e86\u4e00\u4e2a\u5b8c\u6574\u7684\u95ed\u73af\u751f\u6001\uff0c\u6545\u53ef\u5b9a\u5236\u6027\u4e0a\u7f3a\u4e4f\u7075\u6d3b\u6027\uff0c\u53e6\u5916\u6240\u88ab\u8bdf\u75c5\u6bd4\u8f83\u591a\u7684\u5219\u662f\u6027\u80fd\u95ee\u9898\uff0c\u5c31\u56e0\u4e3a\u5176\u76d1\u63a7\u63a7\u5236\u7684\u7c92\u5ea6\u95ee\u9898\u3002<\/p>\n
    Linux\u5185\u6838\u76d1\u63a7\u70b9\u7531Audit\u5b50\u7cfb\u7edf\u6765\u5b9e\u73b0\uff0c\u5747\u4e3a\u663e\u5f0f\u7684\u9759\u6001\u8c03\u7528\uff0c\u81ea2.6\u5185\u6838\u4ee5\u6765\u5c31\u5df2\u7ecf\u5b58\u5728\uff0c\u6240\u4ee5\u6bcf\u4e2a\u76d1\u63a7\u70b9\u7684\u529f\u80fd\u4ea6\u662f\u9759\u6001\u7684\uff0c\u5e76\u4e14\u4e3a\u4e86\u6027\u80fd\u53ca\u7a33\u5b9a\u6027\u7b49\u56e0\u7d20\uff0c\u6bcf\u6761\u65e5\u5fd7\u7684\u8f93\u51fa\u57fa\u672c\u9650\u5b9a\u4e8e\u76f8\u5173\u64cd\u4f5c\u51fd\u6570\u7684\u8c03\u7528\u53c2\u6570\uff0c\u6ca1\u6709\u53ef\u6269\u5c55\u6216\u81ea\u5b9a\u4e49\u7684\u7a7a\u95f4\u3002\u5e94\u7528\u5c42\u670d\u52a1\u8fdb\u7a0bAuditd\u4e0e\u5185\u6838kaudit\u901a\u8fc7netlink\u673a\u5236\u901a\u4fe1\uff0c\u6240\u6709\u7684\u5185\u6838\u65e5\u5fd7\u53ea\u80fd\u7531Auditd\u6765\u6d88\u8d39\u3002\u76ee\u524d\u4e5f\u6709\u65b0\u7684\u5f00\u6e90\u5e94\u7528\u5c42\u6846\u67b6\u66ff\u4ee3\u5982go-audit\u3002<\/p>\n
    4 \u63d2\u6869\u673a\u5236<\/h1>\n
    \u7a0b\u5e8f\u6216\u64cd\u4f5c\u7cfb\u7edf\u672c\u8eab\u5bf9\u7528\u6237\u6765\u8bf4\u5c31\u662f\u4e00\u4e2a\u4e8c\u8fdb\u5236\u7684\u9ed1\u7bb1\uff0c\u5f53\u8bc4\u4f30\u5176\u5185\u90e8\u8fd0\u4f5c\u903b\u8f91\u662f\u5426\u4e0e\u8bbe\u8ba1\u76f8\u7b26\u3001\u4ee5\u53ca\u8c03\u7814\u9519\u8bef\u6765\u6e90\u6216\u6027\u80fd\u70ed\u70b9\u65f6\uff0c\u6211\u4eec\u5c31\u4e0d\u5f97\u4e0d\u5229\u7528\u63d2\u6869\u6280\u672f\u6765\u8fdb\u884c\u63a2\u6d4b\u5176\u5185\u90e8\u7684\u6267\u884c\u6d41\u7a0b\u53ca\u72b6\u6001\u6570\u636e\u3002\u8fd9\u91cc\u6240\u8bf4\u7684\u63d2\u6869\u5176\u5b9e\u5c31\u662f\u5e38\u8bf4\u7684instrumenting \u53ca hooking\u4e24\u4e2a\u6982\u5ff5\uff0c\u4e8c\u8005\u7684\u542b\u4e49\u57fa\u672c\u4e00\u81f4\uff0c\u53ea\u4e0d\u8fc7\u524d\u8005\u66f4\u4fa7\u91cd\u4e8e\u6570\u636e\u6536\u96c6\u800c\u4e0d\u6539\u53d8\u5176\u884c\u4e3a\u5e8f\u5217\uff0c\u800c\u540e\u8005\u66f4\u4fa7\u91cd\u4e8e\u6539\u53d8\u6216\u66ff\u4ee3\u539f\u6267\u884c\u6d41\u7a0b\u3002<\/p>\n
    \u6700\u5e38\u7528\u7684\u63d2\u6869\u673a\u5236\u662fInline hooking\uff0c\u76ee\u524d\u4f9d\u7136\u88ab\u5e7f\u6cdb\u4f7f\u7528\uff0c\u6b64\u6280\u672f\u901a\u8fc7\u52a8\u6001\u4fee\u6539\u4ee3\u7801\u6307\u4ee4\u4ee5\u6267\u884c\u76d1\u63a7\u4ee3\u7801\u7136\u540e\u518d\u8fd4\u56de\u539f\u6267\u884c\u6d41\u7a0b\u3002Linux\u5185\u6838\u672c\u8eab\u63d0\u4f9b\u4e86kprobe\u3001uprobe\u53caftarce\u7b49\u63d2\u6869\u6280\u672f\u6846\u67b6\uff0c\u5176\u5b9e\u4e5f\u662f\u5bf9inline hooking\u7684\u5c01\u88c5\u5e76\u63d0\u4f9b\u4e86\u4e00\u81f4\u6027\u7684\u5185\u6838\u652f\u6301\u51fd\u6570\uff0c\u7528\u4ee5\u63a9\u76d6\u5bf9\u4e0d\u540c\u6307\u4ee4\u67b6\u6784\u53ca\u4e0d\u540c\u5185\u6838\u7248\u672c\u7684\u5904\u7406\u3002<\/p>\n
    4.1 \u63d2\u6869\u673a\u5236\u6c47\u603b<\/h2>\n
    \"Linux<\/p>\n
    \u63d2\u6869\u673a\u5236\u53ef\u5206\u7c7b\u7684\u7ef4\u5ea6\u6709\u5f88\u591a\uff0c\u4ece\u4f7f\u7528\u8303\u56f4\u4e0a\u53ef\u5206\u5185\u6838\u6001\u53ca\u7528\u6237\u6001\uff0c\u4ece\u5b9e\u73b0\u673a\u5236\u4e0a\u53ef\u5206\u987e\u9759\u6001\u53ca\u52a8\u6001\u63d2\u6869\u673a\u5236\uff0c\u603b\u7684\u6765\u8bf4\u53ef\u5f52\u7eb3\u4e3a\u4ee5\u4e0b\u51e0\u7c7b\uff1a<\/p>\n
    4.1.1\u901a\u7528\u63d2\u6869\u673a\u5236<\/h3>\n
      \n
    1. inline hook\u673a\u5236\uff1a\u5373\u76f4\u63a5\u4fee\u6539\u6307\u4ee4\u7684\u65b9\u5f0f<\/li>\n<\/ol>\n
      4.1.2 \u5185\u6838\u63d2\u6869\u673a\u5236<\/h3>\n
      \u9759\u6001\u63d2\u6869\u673a\u5236\uff1a<\/strong><\/p>\n
        \n
      1. Tracepoints\uff1a\u5185\u6838\u81ea\u5b9a\u4e49\u4e86\u8fd12000\u591a\u4e2a\u9759\u6001\u76d1\u63a7\u70b9\uff0c\u53ef\u76d1\u63a7\u5185\u6838\u53caintree\u6a21\u5757\u7684\u5185\u90e8\u8fd0\u4f5c<\/li>\n
      2. LSM HOOK\uff1a\u4e3b\u8981\u9002\u7528\u4e8e\u5b89\u5168\u6a21\u5757\uff0c\u5982SELinux\/AppArmor\u7b49\uff0c\u80fd\u591f\u4e2d\u65ad\u53ca\u963b\u6b62\u5f53\u524d\u64cd\u4f5c<\/li>\n
      3. Audit\uff1a\u7528\u4e8eLinux Audit\u7cfb\u7edf\uff0c\u5df2\u5185\u7f6e\u4e8e\u5185\u6838\uff0c\u53ef\u6839\u636e\u9700\u8981\u8f93\u51fa\u76f8\u5e94\u76d1\u63a7\u70b9\u529f\u5b50\u7cfb\u7edf\u7684\u65e5\u5fd7<\/li>\n
      4. NetFilter\uff1a\u76d1\u63a7\u7f51\u7edc\u6570\u636e\u5305\uff0c\u9632\u706b\u5899\u3001\u96a7\u9053\u3001VPN\u7b49\u5747\u53ef\u57fa\u4e8eNetfilter\u6846\u67b6\u6765\u5b9e\u73b0<\/li>\n<\/ol>\n
        \u52a8\u6001\u63d2\u6869\u673a\u5236\uff1a<\/strong><\/p>\n
          \n
        1. ftrace\uff1akernel function hook\u7684\u63d2\u6869\u673a\u5236<\/li>\n
        2. kprobes\/uprobes\uff1a\u5185\u6838\u7684\u52a8\u6001\u63d2\u6869\u6846\u67b6\uff0c\u57fa\u4e8eint 3 trap\u53caftace\u5b9e\u73b0<\/li>\n
        3. Linux\u5185\u6838\u901a\u77e5\u94fe\uff08CPU\u3001Mount, USB\u7b49\uff09\uff1aLinux\u5185\u6838\u5411\u6a21\u5757\u63d0\u4f9b\u7684\u4e8b\u4ef6\u901a\u77e5\u673a\u5236\uff0c\u6a21\u5757\u53ef\u4ee5\u6ce8\u518c\u56de\u8c03<\/li>\n<\/ol>\n
          \u81ea\u5b9a\u4e49\u5185\u6838\u63d2\u6869\u673a\u5236\uff1a<\/strong><\/p>\n
            \n
          1. Syscall table hook\uff1a\u76f4\u63a5\u4fee\u6539syscall table\u4ee5\u6307\u5411\u81ea\u5df1\u7684\u7a0b\u5e8f\u4ee3\u7801<\/li>\n
          2. DKOM (operations table hook)\uff1a\u5185\u6838\u662f\u4ee5\u6587\u4ef6\u6765\u7ba1\u7406\u6240\u6709\u8d44\u6e90\u7684\uff0c\u6bcf\u79cd\u8d44\u6e90\u5982\u6587\u4ef6\u5747\u6709\u76f8\u5e94\u7684\u56de\u8c03\u63a5\u53e3\uff0c\u5b9e\u9645\u4e0a\u53ef\u4ee5\u7406\u89e3\u4e3a\u4e00\u7ec4\u51fd\u6570\u6307\u9488\uff0c\u901a\u8fc7\u4fee\u6539\u8fd9\u4e9b\u6307\u9488\u7684\u6307\u5411\u4ece\u800c\u53ef\u4ee5\u52ab\u6301\u5bf9\u6b64\u7c7b\u578b\u6240\u6709\u6216\u5355\u4e2a\u5bf9\u8c61\u7684\u64cd\u4f5c<\/li>\n
          3. \u4e2d\u65ad\u5411\u91cfhook\uff1a\u4e2d\u65ad\u5411\u91cf\u8868\u7684\u5165\u53e3\uff0cCPU\u901a\u8fc7\u5bc4\u5b58\u5668\u4fdd\u5b58\u4e86\u4e0d\u540c\u4e2d\u65ad\u7684\u5165\u53e3\u5730\u5740\u4ee5\u5b9e\u73b0\u4e2d\u65ad\u5904\u7406\u7684\u786c\u4ef6\u52a0\u901f<\/li>\n
          4. \u786c\u4ef6\u8c03\u8bd5\u65ad\u70b9\uff1a\u8c03\u8bd5\u65ad\u70b9\u652f\u6301\u6307\u4ee4\u65ad\u70b9\u53ca\u5185\u5b58\u8bbf\u95ee\u65ad\u70b9\uff0c\u4f46\u662f\u4e0d\u540c\u7684\u67b6\u6784\u3001CPU\u7c7b\u578b\u6240\u63d0\u4f9b\u7684\u8c03\u8bd5\u5bc4\u5b58\u5668\u6570\u91cf\u4e0d\u540c\uff0c\u4e00\u822c\u90fd\u6bd4\u8f83\u5c11<\/li>\n
          5. \u9ad8\u7cbe\u5ea6\u8f6f\/\u786c\u4e2d\u65ad\uff1a\u4e2d\u65ad\u673a\u5236\u4e3b\u8981\u7528\u4e8e\u91c7\u6837\uff0c\u540c\u6837\u4e5f\u80fd\u7528\u4e8ehook\u7684\u573a\u666f\uff0c\u4f46\u5bf9\u6027\u80fd\u5f71\u54cd\u8f83\u5927\uff0c\u5e76\u4e14\u4e0d\u80fd\u786e\u4fdd\u4e2d\u65ad\u70b9\u7684\u6307\u4ee4\u4f4d\u7f6e<\/li>\n<\/ol>\n
            4.1.3 \u7528\u6237\u6001\u63d2\u6869\u673a\u5236<\/h3>\n
              \n
            1. USDT\uff1aUser Statically Defined Trace<\/strong>\uff0c\u5373\u7528\u6237\u5c42\u7684Tracepoint\uff0c\u9700\u8981\u7a0b\u5e8f\u5728\u7f16\u5199\u65f6\u663e\u793a\u5b9a\u4e49\u7684\u76d1\u63a7\u70b9\uff0c\u5982libc\u3001mysql\u7b49\u5e94\u7528\u5747\u6709\u652f\u6301<\/li>\n
            2. uprobes: \u7528\u6237\u6001\u7684\u52a8\u6001\u8ddf\u8e2a\u673a\u5236\uff0c\u5176\u5b9e\u73b0\u53ca\u56de\u8c03\u5904\u7406\u5747\u662f\u5728\u5185\u6838\u4e2d\u5904\u7406\u7684\u3002\u539f\u7406\u4e0a\u5176\u5b9e\u662f\u7528breakpoint\u6539\u5199\u7528\u6237\u6001\u6307\u4ee4\u7684\u65b9\u5f0f\u89e6\u53d1\u5f02\u5e38\u5e76\u8df3\u8f6c\u81f3\u5185\u6838\u6001\u7684\u5904\u7406\u7a0b\u5e8f\u3002\u81ea3.5\u5e76\u5165\u7684\u5185\u6838\uff0c\u4f463.14\u4e4b\u540e\u624d\u63d0\u4f9b\u4e86\u8f83\u597d\u7684\u53ef\u7528\u6027\uff0ctracefs\u53caperf\u7b49\u6846\u67b6\u5747\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528uprobes<\/li>\n
            3. LD_PRELOAD: \u5229\u7528Linux .so\u5171\u4eab\u5e93\u7684\u641c\u7d22\u8def\u5f84\u4f7f\u5f97\u52a0\u8f7d\u5668\u4f18\u5148\u7ed1\u5b9a\u6307\u5b9a\u5171\u4eab\u5e93\u7684\u5bfc\u51fa\u51fd\u6570\uff0c\u4ece\u800c\u8df3\u8fc7\u9ed8\u8ba4\u5171\u4eab\u5e93\u7684\u7ed1\u5b9a\uff0c\u53ef\u5b9e\u73b0\u51fd\u6570\u7ea7\u7684hook<\/li>\n
            4. GOT\/PLT\u8868hook\uff1a\u5229\u7528ELF\/COFF\u6587\u4ef6\u7684\u5bfc\u5165\u53ca\u5bfc\u51fa\u8868\u6765\u8fdb\u884c\u51fd\u6570\u7ea7\u7684hook<\/li>\n<\/ol>\n
              4.2 \u901a\u7528inline hooking<\/h2>\n
              Inline-hooking\u662f\u6700\u5e38\u7528\u7684\u4e00\u79cd\u63d2\u6869\u6280\u672f\uff0c\u65e0\u8bba\u662f\u5b89\u5168\u8f6f\u4ef6\u8fd8\u662f\u6076\u610f\u8f6f\u4ef6\u90fd\u6709\u5e7f\u6cdb\u4f7f\u7528\uff0c\u7279\u522b\u662fWindows\u5e73\u53f0\uff0cinline hooking\u7684\u4f7f\u7528\u975e\u5e38\u9891\u7e41\uff0c\u51e0\u4e4e\u6240\u6709\u7684\u5b89\u5168\u8f6f\u4ef6\u5747\u4f9d\u8d56\u4e8e\u6b64\u6280\u672f\u6765\u76d1\u63a7\u5e94\u7528\u5c42\u7684\u6076\u610f\u884c\u4e3a\u3002<\/p>\n
              Inline-hooking\u6280\u672f\u7b80\u5355\u6765\u5c31\u662f\u76f4\u63a5\u4fee\u6539\u4ee3\u7801\u6307\u4ee4\u6539\u53d8\u539f\u6307\u4ee4\u7684\u6267\u884c\u6d41\u7a0b\u8f6c\u800c\u6267\u884c\u6211\u4eec\u7684\u76d1\u63a7\u4ee3\u7801\uff0c\u7b49\u76d1\u63a7\u4ee3\u7801\u6267\u884c\u5b8c\u6210\u540e\u518d\u8fd4\u56de\u81f3\u539f\u8def\u5f84\u7ee7\u7eed\u6267\u884c\uff0c\u6700\u5e38\u7528\u7684\u65b9\u6cd5\u5c31\u662f\u5c06\u51fd\u6570\u5165\u53e3\u5904\u7684\u6307\u4ee4\u4fee\u6539\u6210\u8df3\u8f6c (JMP )\u6307\u4ee4\u3002<\/p>\n
              \"Linux<\/p>\n
              \u5f88\u591arootkit\u7a0b\u5e8f\u5982reptile\u4e3a\u4e86\u8fbe\u6210\u66f4\u597d\u7684\u85cf\u533f\u6548\u679c\u5c31\u4f7f\u7528\u4e86inline hooking\uff0csyscall table hook\u65b9\u5f0f\u4f7f\u7528\u9891\u7387\u5f88\u9ad8\uff0c\u5f88\u591a\u5b89\u5168\u8f6f\u4ef6\u5747\u6709\u9488\u5bf9syscall table\u7684\u5ba1\u8ba1\u548c\u6821\u9a8c\u3002\u4e0b\u9762\u4ee5reptile\u4e3a\u4f8b\u6765\u8bf4\u660e\uff0c<\/p>\n
              vfs_read\u5185\u6838\u51fd\u6570\u88ab\u52ab\u6301\u524d\u7684\u4ee3\u7801\uff1a<\/p>\n
              pwndbg> x\/100i 0xffffffff9980b900\n   0xffffffff9980b900:  nop    DWORD PTR [rax+rax*1+0x0\n   0xffffffff9980b905:  push   r14\n   0xffffffff9980b907:  push   r13\n   0xffffffff9980b909:  push   r12\n   0xffffffff9980b90b:  push   rbp\n   0xffffffff9980b90c:  push   rbx\n   0xffffffff9980b90d:  mov    eax,DWORD PTR [rdi+0x44]\n   0xffffffff9980b910:  test   al,0x1\n   0xffffffff9980b912:  je     0xffffffff9980ba1b\n   ...\n<\/code><\/pre>\n
              \u52a0\u8f7dreptile\u4e4b\u540e\uff0cvfs_read\u88ab\u7be1\u6539\u4e86\uff0c\u76f4\u63a5\u8df3\u8f6c\u81f3\u57300xffffffffc03013f0\uff1a<\/p>\n
              pwndbg> x\/100i 0xffffffff9980b900\n   0xffffffff9980b900:  jmp    0xffffffffc03013f0\n   0xffffffff9980b905:  push   r14\n   0xffffffff9980b907:  push   r13\n   0xffffffff9980b909:  push   r12\n   0xffffffff9980b90b:  push   rbp\n   0xffffffff9980b90c:  push   rbx\n   0xffffffff9980b90d:  mov    eax,DWORD PTR [rdi+0x44]\n   0xffffffff9980b910:  test   al,0x1\n   0xffffffff9980b912:  je     0xffffffff9980ba1b\n   ...   <\/code><\/pre>\n
              \u6cbf\u6b64\u88ab\u4fee\u6539\u540e\u7684\u4ee3\u7801\u6d41\u7a0b\uff0c\u53ef\u6700\u7ec8\u627e\u5230\u5b58\u653e\u539fvfs_read\u51fd\u6570\u6307\u4ee4\u7684\u8df3\u677f\uff0c\u53730xffffffffc03013d0\uff1a<\/p>\n
              pwndbg> x\/100i  0xffffffffc03013f0\n   0xffffffffc03013f0:  lock inc DWORD PTR [rip+0xffffffffffffffc9]        # 0xffffffffc03013c0\n   0xffffffffc03013f7:  sub    rsp,0x40\n   0xffffffffc03013fb:  mov    rax,QWORD PTR [rsp+0x48]\n   0xffffffffc0301400:  mov    QWORD PTR [rsp],rax\n   0xffffffffc0301404:  mov    rax,QWORD PTR [rsp+0x50]\n   0xffffffffc0301409:  mov    QWORD PTR [rsp+0x8],rax\n   0xffffffffc030140e:  mov    rax,QWORD PTR [rsp+0x58]\n   0xffffffffc0301413:  mov    QWORD PTR [rsp+0x10],rax\n   0xffffffffc0301418:  mov    rax,QWORD PTR [rsp+0x60]\n   0xffffffffc030141d:  mov    QWORD PTR [rsp+0x18],rax\n   0xffffffffc0301422:  mov    rax,QWORD PTR [rsp+0x68]\n   0xffffffffc0301427:  mov    QWORD PTR [rsp+0x20],rax\n   0xffffffffc030142c:  mov    rax,QWORD PTR [rsp+0x70]\n   0xffffffffc0301431:  mov    QWORD PTR [rsp+0x28],rax\n   0xffffffffc0301436:  mov    rax,QWORD PTR [rsp+0x78]\n   0xffffffffc030143b:  mov    QWORD PTR [rsp+0x30],rax\n   0xffffffffc0301440:  mov    rax,QWORD PTR [rsp+0x80]\n   0xffffffffc0301448:  mov    QWORD PTR [rsp+0x38],rax\n   0xffffffffc030144d:  movabs rax,0xffffffffc0694830\n   0xffffffffc0301457:  call   rax\n   0xffffffffc0301459:  add    rsp,0x40\n   0xffffffffc030145d:  lock dec DWORD PTR [rip+0xffffffffffffff5c]        # 0xffffffffc03013c0\n   0xffffffffc0301464:  ret\n\npwndbg> x\/100i 0xffffffffc0694830\n   0xffffffffc0694830:  push   rbp\n   0xffffffffc0694831:  mov    DWORD PTR [rip+0x2f4d],0x1        # 0xffffffffc0697788\n   0xffffffffc069483b:  mov    rbp,rsi\n   0xffffffffc069483e:  push   rbx\n   0xffffffffc069483f:  mov    rax,QWORD PTR [rip+0x28ca]        # 0xffffffffc0697110\n   0xffffffffc0694846:  call   0xffffffff99c20750\n   0xffffffffc069484b:  mov    rbx,rax\n   0xffffffffc069484e:  mov    eax,DWORD PTR [rip+0x2f30]        # 0xffffffffc0697784\n   0xffffffffc0694854:  test   eax,eax\n   0xffffffffc0694856:  jne    0xffffffffc0694868\n   0xffffffffc0694858:  mov    rax,rbx\n   0xffffffffc069485b:  mov    DWORD PTR [rip+0x2f23],0x0        # 0xffffffffc0697788\n   0xffffffffc0694865:  pop    rbx\n   0xffffffffc0694866:  pop    rbp\n   0xffffffffc0694867:  ret\n   ...\n\npwndbg> x \/10i  0xffffffff99c20750  \n   0xffffffff99c20750:  jmp    rax\n\npwndbg> x\/60i  0xffffffffc03013d0\n   0xffffffffc03013d0:  nop    DWORD PTR [rax+rax*1+0x0]\n   0xffffffffc03013d5:  jmp    0xffffffff9980b905<\/code><\/pre>\n
              \u901a\u5e38\u7684\u70ed\u8865\u4e01\u6280\u672f\u4e5f\u4f7f\u7528inline hook\uff0c\u4e0d\u8fc7\u70ed\u8865\u4e01\u7684\u4f7f\u7528\u76f8\u5bf9\u66f4\u7b80\u5355\u4e00\u4e9b\uff0c\u56e0\u4e3a\u8981\u4fee\u6539\u7684\u6307\u4ee4\u4f4d\u7f6e\u662f\u7cbe\u5fc3\u9009\u62e9\u7684\uff0c\u5e76\u4e14\u53ea\u6709\u5b8c\u6574\u6027\u6838\u9a8c\u901a\u8fc7\u7684\u60c5\u51b5\u4e0b\u624d\u4f1a\u8fdb\u884c\u70ed\u8865\u64cd\u4f5c\uff0c\u800c\u4e00\u4e2a\u901a\u7528\u7684inline hooking\u5f15\u64ce\u5219\u9700\u8981\u5904\u7406\u66f4\u591a\u7684\u95ee\u9898\u3002<\/p>\n
                \n
              1. \u5185\u5b58\u4e0d\u53ef\u5199\u7684\u95ee\u9898\uff1a\u6b64\u90e8\u5206\u9700\u8981\u4fee\u6539\u9875\u9762\u5c5e\u6027\u6216\u901a\u8fc7\u9875\u9762\u91cd\u65b0\u6620\u5c04\u6765\u8fbe\u6210\uff0cX86\u4f53\u7cfbCPU\u63d0\u4f9b\u4e86WP\u4f4d\u53ef\u4ee5\u5f3a\u5236\u6539\u5199\u5185\u5b58\uff0c\u4f46\u6b64\u65b9\u5f0f\u4e0b\u7684\u4fee\u6539\u4e0d\u4f1a\u89e6\u53d1COW (copy-on-write)\uff0c\u9488\u5bf9\u7528\u6237\u5c42\u7684\u5171\u4eab\u4ee3\u7801\uff08\u5982libc\u5171\u4eab\u5e93\uff09\u7684\u6539\u5199\u8981\u7279\u522b\u6ce8\u610f<\/li>\n
              2. \u8df3\u677f\u6307\u4ee4\u751f\u6210\u7684\u95ee\u9898\uff1a\u4ee5X86\u6307\u4ee4\u4f53\u7cfb\u4e3a\u4f8b\uff0cJMP\u8df3\u8f6c\u6307\u4ee4\u7684\u603b\u957f\u5ea6\u4e3a5\u4e2a\u5b57\u8282\uff0c\u53731\u4e2a\u5b57\u8282\u7684\u64cd\u4f5c\u6570 (0xE9) \u53ca 4\u4e2a\u5b57\u8282\u7684\u76f8\u5bf9\u5730\u5740\u7684\u504f\u79fb\u3002\u5bf9\u539f\u59cb\u51fd\u6570\u7684\u5165\u53e3\u5199\u5165\u4e00\u4e2a\u8df3\u8f6c\u6307\u4ee4\u4f1a\u8986\u76d6\u81f3\u5c115\u4e2a\u5b57\u8282\uff0c\u800c\u8fd95\u4e2a\u5b57\u8282\u53ef\u80fd\u662f\u591a\u6253\u6307\u4ee4\uff0c\u5176\u4e2d\u4e5f\u53ef\u80fd\u6709\u77ed\u8df3\u8f6c\u6307\u4ee4\uff0c\u6240\u4ee5\u4e00\u822chook\u6846\u67b6\u90fd\u9700\u8981\u96c6\u6210\u4e00\u4e2a\u53cd\u6c47\u7f16\u5f15\u64ce\uff0c\u5e76\u4e14\u4e0d\u540c\u7684CPU\u6846\u67b6\u9700\u8981\u4f7f\u7528\u4e0d\u540c\u6307\u4ee4\u96c6\u7684\u6c47\u7f16\u5f15\u64ce\uff0c\u50cfARM\u53caRISC-V\u4e00\u7c7bRISC\u4f53\u7cfb\u76f8\u5bf9\u66f4\u7b80\u5355\u4e00\u4e9b\u3002\u8df3\u677f\u6307\u4ee4\u751f\u6210\u7684\u53e6\u4e00\u4e2a\u95ee\u9898\u662f\u4f4d\u7f6e\u9009\u62e9\uff0c\u5982X86\u6307\u4ee4JMP\u7684\u64cd\u4f5c\u6570\u53734\u4e2a\u5b57\u8282\u7684\u76f8\u5bf9\u5730\u5740\u504f\u79fb\u662f\u4e2a\u6709\u7b26\u53f7\u6570\uff0c\u5373\u53ea\u80fd\u8df3\u8f6c\u76f8\u5bf9\u5f53\u524d\u4f4d\u7f6e\u4e0a\u4e0b\u54042G\u7684\u7a7a\u95f4\uff0c\u5982\u679c\u8d85\u51fa\u8fd9\u4e2a\u8303\u56f4\u7684\u8bdd\u5c31\u9700\u8981\u589e\u52a0\u4e2d\u95f4\u8df3\u677f\u6216\u6539\u6210\u7edd\u5bf9\u5730\u5740\u8df3\u8f6c\uff0c X86_64\u7edd\u5bf9\u8df3\u8f6c\u6307\u4ee4\u603b\u957f\u5ea6\u4e3a12-14\u5b57\u8282\u3002<\/li>\n
              3. \u6307\u4ee4\u6495\u88c2\u95ee\u9898\uff1a\u5f53\u6539\u5199\u591a\u6761\u6307\u4ee4\u65f6\u5c31\u4f1a\u9047\u5230\u6b63\u597d\u6709CPU\u6267\u884c\u4e2d\u95f4\u6307\u4ee4\u7684\u60c5\u51b5\uff0c\u7279\u522b\u662f\u591aCPU\u73af\u5883\u4e2d\u6b63\u597d\u7ebf\u7a0b\u6267\u884c\u5728\u8fd9\u51e0\u6761\u6307\u4ee4\u4e2d\u95f4\u7684\u53ef\u80fd\u6027\u5927\u5927\u589e\u52a0\uff0c\u4e00\u65e6\u9047\u5230\u6b64\u60c5\u51b5\u5c06\u6700\u7ec8\u5bfc\u81f4\u7a0b\u5e8f\u6216\u7cfb\u7edf\u5d29\u6e83\u3002\u9488\u5bf9\u8fd0\u884c\u65f6\u6001\u7684\u64cd\u4f5c\u7cfb\u7edf\u5185\u6838\u6216\u5e94\u7528\u7a0b\u5e8f\u53ef\u901a\u8fc7\u6682\u505c\u5176\u5b83CPU\u6216\u5f53\u524d\u8fdb\u7a0b\u7684\u5176\u5b83\u7ebf\u7a0b\u4ee5\u964d\u4f4e\u6307\u4ee4\u6495\u88c2\u53d1\u751f\u7684\u6982\u7387\uff0c\u4f46\u5e76\u4e0d\u80fd\u4ece\u6839\u672c\u4e0a\u675c\u7edd\u3002\u5f53\u7136\u5982\u679c\u662f\u5728\u5e94\u7528\u7a0b\u5e8f\u5728\u52a0\u8f7d\u6267\u884c\u7684\u521d\u59cb\u5316\u9636\u6bb5\u7684\u8bdd\uff0c\u53ef\u6709\u6548\u907f\u514d\u3002\u9488\u5bf9\u6b64\u60c5\u51b5\u4e0b\u7684\u5e94\u5bf9\u5c31\u662f\u53ea\u6539\u5199\u4e00\u6761\u6307\u4ee4\uff0c\u56e0\u4e3a\u6307\u4ee4\u7684\u6267\u884c\u5bf9CPU\u6765\u8bf4\u662f\u539f\u5b50\u6027\u7684\uff0c\u4e0d\u7ba1CPU\u7684\u5fae\u67b6\u6784\u6216\u6d41\u6c34\u7ebf\u6709\u591a\u590d\u6742\uff0c\u6307\u4ee4\u6267\u884c\u7684\u539f\u5b50\u6027\u662fCPU\u5fc5\u987b\u4fdd\u8bc1\u7684\u3002\u9488\u5bf9X86\u6307\u4ee4\u6765\u8bf4\u5c06\u5165\u53e3\u4ee3\u7801\u7684\u7b2c\u4e00\u4e2a\u5b57\u8282\u4fee\u6539\u4e3a0xCC\uff0c\u5373 int 3 trap\u6307\u4ee4\uff0c\u7136\u540e\u901a\u8fc7\u6355\u83b7\u53ca\u5e76\u4fee\u590d\u7ee7\u7eed\u6267\u884c\u4f4d\u7f6e\u7684\u65b9\u5f0f\u6765\u8fbe\u6210\u6539\u53d8\u539f\u6267\u884c\u6d41\u7a0b\u7684\u76ee\u7684\uff0c\u8fd9\u4e5f\u662fLinux uprobe\u6240\u4f7f\u7528\u7684\u6280\u672f\u65b9\u6848\uff0c\u6b64\u65b9\u6848\u7684\u4e0d\u4fbf\u4e4b\u5904\u5c31\u662f\u9700\u8981\u5185\u6838\u7684\u534f\u52a9\uff0c\u5373int3 trap\u5f02\u5e38\u5904\u7406\u51fd\u6570\u8981\u6b63\u786e\u8bc6\u522b\u6b64uprobe\u76d1\u63a7\u70b9\u3002kprobe\u7684\u6700\u65e9\u5b9e\u73b0\u4e5f\u662f\u57fa\u4e8eint3 trap\u7684\uff0c\u540e\u6765\u7684\u7248\u672c\u5219\u57fa\u4e8eftrace\uff0cftrace\u5219\u662f\u9700\u8981\u7f16\u8bd1\u5668\u7684\u652f\u6301\u624d\u884c\uff0c\u540e\u9762\u518d\u4ecb\u7ecdftace\u673a\u5236\u65f6\u518d\u505a\u8be6\u8ff0\u3002<\/li>\n<\/ol>\n
                Inline hooking\u8fd9\u79cd\u6280\u672f\u7684\u660e\u663e\u9650\u5236\u662f\u9488\u5bf9\u540c\u4e00\u4e2a\u51fd\u6570\u7684\u591a\u6b21hook\u95ee\u9898\uff0c\u4e3b\u8981\u7684\u56f0\u6270\u5728\u4e8e\u5378\u8f7d\u65f6\u7684\u8df3\u677f\u65e0\u6cd5\u5b89\u5168\u6e05\u7406\u7684\u95ee\u9898\uff0c\u6700\u7ec8\u7ed3\u679c\u5c06\u5bfc\u81f4\u8df3\u677f\u6570\u91cf\u7684\u7d2f\u52a0\u3002\u6b64\u5916inline hooking\u7684\u63d2\u6869\u884c\u4e3a\u6539\u53d8\u4e86\u6307\u4ee4\u5e8f\u5217\uff0c\u76f8\u5173\u7684\u5b89\u5168\u5ba1\u8ba1\u8f6f\u4ef6\u6216\u8005\u53ef\u4fe1\u8ba1\u7b97\u7cfb\u7edf\u5728\u8fdb\u884c\u5b8c\u6574\u6027\u6821\u9a8c\u65f6\u5c06\u4f1a\u53d1\u73b0\u8fd9\u79cd\u4e0d\u4e00\u81f4\u6027\u3002\u53e6\u5916\u5728\u4f7f\u80fdIntel CPU shadow stack\u5b89\u5168\u6280\u672f\u7684\u7cfb\u7edf\u4e0a\u4e5f\u4f1a\u6709\u517c\u5bb9\u6027\u95ee\u9898\u3002<\/p>\n
                Linux\u7cfb\u7edf\u4e0b\u5f88\u5c11\u6709\u8f83\u6210\u719f\u7684inline hook\u6846\u67b6\uff0c\u4f46Windows\u7cfb\u7edf\u4e0a\u6709\u7740\u4f17\u591a\u6210\u719f\u6846\u67b6\uff0c\u5982detours\uff0cEasyHook\u3001mhook\u7b49\u3002<\/p>\n
                4.3 Tracepoints<\/h2>\n
                Linux\u5185\u6838\u9884\u7f6e\u4e86\u8fd12000\u4e2atracepoints\uff0c\u4f7f\u7528tracepoints\u6765\u76d1\u63a7\u975e\u5e38\u5bb9\u6613\uff0c\u5e76\u4e14\u652f\u6301\u76d1\u63a7\u70b9\u7684\u6279\u91cf\u5904\u7406\uff0c\u5e76\u4e14\u6bcf\u4e00\u4e2atracepoint\u90fd\u6709\u81ea\u5df1\u72ec\u7acb\u7684\u5f00\u5173\uff0c\u4ee5\u6700\u5c0f\u5316\u5728\u76d1\u63a7\u70b9\u672a\u4f7f\u7528\u7684\u60c5\u51b5\u4e0b\u7684\u6027\u80fd\u6d88\u8017\uff0c\u5176\u4e2d\u5185\u6838\u4f7f\u7528\u4e86jump label\u3001static call\u7b49\u6280\u672f\uff0c\u6709\u5174\u8da3\u7684\u4e0d\u59a8\u8fdb\u4e00\u6b65\u5ef6\u4f38\u9605\u8bfb\u76f8\u5173\u8d44\u6599\u3002<\/p>\n
                Tracepoints\u76d1\u63a7\u70b9\u4e0d\u4ec5\u8986\u76d6\u4e86\u7528\u6237\u8fdb\u7a0b\u6240\u6709\u7684\u7cfb\u7edf\u8c03\u7528\uff0c\u4e5f\u56ca\u62ec\u4e86\u5185\u6838\u5404\u4e2a\u5173\u952e\u5b50\u7cfb\u7edf\u5185\u90e8\u7684\u6574\u4e2a\u6267\u884c\u8fc7\u7a0b\u3002\u603b\u4f53\u4e0aLinux\u5185\u6838\u7684tracepoints\u53ef\u4ee5\u5206\u4e3a\u4ee5\u4e0b\u51e0\u7c7b\uff1a<\/p>\n
                  \n
                1. \u8fdb\u7a0b\u548c\u7ebf\u7a0b\u8ddf\u8e2a\u70b9\uff1a\u8fd9\u4e9btracepoints\u4e0e\u8fdb\u7a0b\u548c\u7ebf\u7a0b\u7684\u521b\u5efa\u3001\u8c03\u5ea6\u3001\u7ed3\u675f\u7b49\u64cd\u4f5c\u6709\u5173\u3002\u901a\u8fc7\u8ddf\u8e2a\u8fd9\u4e9btracepoints\uff0c\u53ef\u4ee5\u4e86\u89e3\u8fdb\u7a0b\u548c\u7ebf\u7a0b\u7684\u6267\u884c\u60c5\u51b5\uff0c\u5e2e\u52a9\u6211\u4eec\u5206\u6790\u548c\u4f18\u5316\u591a\u4efb\u52a1\u7cfb\u7edf\u7684\u6027\u80fd\u548c\u884c\u4e3a\u3002<\/li>\n
                2. \u5185\u6838\u4e8b\u4ef6\u548c\u64cd\u4f5c\u8ddf\u8e2a\u70b9\uff1a\u8fd9\u4e9btracepoints\u4e0e\u5185\u6838\u5185\u90e8\u7684\u4e8b\u4ef6\u548c\u64cd\u4f5c\u6709\u5173\uff0c\u5982\u5185\u5b58\u5206\u914d\u3001\u9501\u64cd\u4f5c\u3001\u8c03\u5ea6\u5668\u64cd\u4f5c\u7b49\u3002\u901a\u8fc7\u8ddf\u8e2a\u8fd9\u4e9btracepoints\uff0c\u53ef\u4ee5\u6df1\u5165\u4e86\u89e3\u5185\u6838\u7684\u5185\u90e8\u5de5\u4f5c\u673a\u5236\u548c\u6027\u80fd\u7279\u5f81\u3002<\/li>\n
                3. \u5b89\u5168\u548c\u9519\u8bef\u8ddf\u8e2a\u70b9\uff1a\u8fd9\u4e9btracepoints\u7528\u4e8e\u8ddf\u8e2a\u5b89\u5168\u76f8\u5173\u7684\u4e8b\u4ef6\u548c\u9519\u8bef\u6761\u4ef6\u3002\u4f8b\u5982\uff0c\u53ef\u4ee5\u8ddf\u8e2a\u7cfb\u7edf\u8c03\u7528\u7684\u5b89\u5168\u6027\u68c0\u67e5\u3001\u6587\u4ef6\u8bbf\u95ee\u6743\u9650\u9519\u8bef\u7b49\u3002\u5b89\u5168\u548c\u9519\u8bef\u8ddf\u8e2a\u70b9\u53ef\u4ee5\u5e2e\u52a9\u6211\u4eec\u76d1\u89c6\u548c\u8c03\u8bd5\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u548c\u9519\u8bef\u5904\u7406\u3002<\/li>\n
                4. \u5185\u6838\u5b50\u7cfb\u7edf\u8ddf\u8e2a\u70b9\uff1a\u8fd9\u4e9btracepoints\u4e0e\u5185\u6838\u7684\u4e0d\u540c\u5b50\u7cfb\u7edf\u76f8\u5173\uff0c\u4f8b\u5982\u6587\u4ef6\u7cfb\u7edf\u3001\u7f51\u7edc\u3001\u5185\u5b58\u7ba1\u7406\u7b49\u3002\u5b83\u4eec\u63d0\u4f9b\u4e86\u4e00\u79cd\u8ddf\u8e2a\u548c\u8c03\u8bd5\u5185\u6838\u5b50\u7cfb\u7edf\u884c\u4e3a\u7684\u65b9\u5f0f\uff0c\u53ef\u4ee5\u7528\u4e8e\u76d1\u89c6\u548c\u5206\u6790\u7279\u5b9a\u5b50\u7cfb\u7edf\u7684\u6027\u80fd\u548c\u884c\u4e3a\u3002<\/li>\n
                5. \u786c\u4ef6\u4e8b\u4ef6\u8ddf\u8e2a\u70b9\uff1a\u8fd9\u4e9btracepoints\u4e0e\u786c\u4ef6\u76f8\u5173\u7684\u4e8b\u4ef6\u548c\u64cd\u4f5c\u6709\u5173\u3002\u4f8b\u5982\uff0c\u53ef\u4ee5\u8ddf\u8e2aCPU\u7684\u4e2d\u65ad\u3001\u7f13\u5b58\u4e8b\u4ef6\u3001DMA\u64cd\u4f5c\u7b49\u3002\u786c\u4ef6\u4e8b\u4ef6\u8ddf\u8e2a\u70b9\u53ef\u4ee5\u5e2e\u52a9\u6211\u4eec\u6df1\u5165\u4e86\u89e3\u786c\u4ef6\u7684\u884c\u4e3a\u548c\u6027\u80fd\u74f6\u9888\u3002<\/li>\n<\/ol>\n
                  Tracepoints\u8986\u76d6\u4e86\u6240\u6709syscall\u7684\u8c03\u7528\u3001\u4efb\u52a1\u8c03\u5ea6\u4e0e\u5207\u6362\u3001\u786c\u4ef6\u7b49\uff0c\u51e0\u4e4e\u6db5\u76d6\u4e86\u6240\u6709\u7684\u7cfb\u7edf\u4e8b\u4ef6\uff0c\u5f53\u7136\u4e0d\u540c\u7684\u5185\u6838\u7248\u672c\u4f1a\u6709\u5dee\u5f02\uff0c\u9488\u5bf9\u5185\u6838v6.1\u7684\u7edf\u8ba1\u4fe1\u606f\u5982\u4e0b\uff0c\u57fa\u4e8eperf list\u7684\u8f93\u51fa\uff08\u7b49\u540c\u4e8e \/sys\/kernel\/debug\/tracing\/events\uff09\uff1a<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
                  \u9879\u76ee<\/th>\n\u6570\u91cf<\/th>\n<\/tr>\n<\/thead>\n
                  syscall raw (sys_enter\/sys_exit)<\/strong><\/td>\n2<\/td>\n<\/tr>\n
                  syscalls\uff08sys_enter_xxx\/sys_exit_xxx\uff09<\/strong><\/td>\n690<\/td>\n<\/tr>\n
                  sched\u53catask\u76f8\u5173\u4e8b\u4ef6: \u8c03\u5ea6\u5c42\u76d1\u63a7\u70b9<\/strong><\/td>\n29<\/td>\n<\/tr>\n
                  cgroup\u4e8b\u4ef6<\/strong><\/td>\n13<\/td>\n<\/tr>\n
                  module\u4e8b\u4ef6\uff1a\u6d89\u53ca\u6a21\u5757\u7684\u52a0\u8f7d\u3001\u5378\u8f7d\u3001\u5f15\u7528\u7b49<\/strong><\/td>\n5<\/td>\n<\/tr>\n
                  net\u4e8b\u4ef6\uff1a\u534f\u8bae\u53ca\u5c01\u5305\u76f8\u5173\u4e8b\u4ef6<\/strong><\/td>\n16<\/td>\n<\/tr>\n
                  kvm\u4e8b\u4ef6<\/strong><\/td>\n91<\/td>\n<\/tr>\n
                  \u6240\u6709tracepoints<\/strong><\/td>\n1944<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                  Tracepoint\u7684\u652f\u6301\u9ed8\u8ba4\u662f\u6253\u5f00\u7684\uff0c\u76f8\u5173\u5185\u6838\u9009\u9879\u4e3aCONFIG_TRACEPOINTS\u53caCONFIG_HAVE_SYSCALL_TRACEPOINTS\uff0c\u5f53\u7136\u4e0d\u6392\u9664\u7b2c\u4e09\u65b9\u81ea\u5b9a\u4e49\u5185\u6838\u5173\u95edtracepoints\u7684\u60c5\u51b5\u3002<\/p>\n
                  \u53e6\u5916\u8fd8\u9700\u8981\u6ce8\u610f\u7684\u662ftracepoints\u5728\u4e0d\u540c\u7684\u5185\u6838\u7248\u672c\u4e0a\u6709\u8f83\u5927\u5dee\u5f02\uff0c\u4f7f\u7528\u65f6\u9700\u8981\u505a\u8fdb\u4e00\u6b65\u7504\u522b\uff0c\u7279\u522b\u662f\u8001\u7248\u672c\u5185\u6838\u7684\u7cfb\u7edf\uff0c\u5982CentOS 6\u7cfb\u7edf\u7b49\u3002\u53e6\u5916\u8fd8\u6709\u4e9b\u4e2a\u522b\u6027\u7684\u7f3a\u9677\u95ee\u9898\uff0c\u5982sched:process_exec\u8fd9\u4e2a\u76d1\u63a7\u70b9\u7684\u652f\u6301\u662f\u4ebaLinux 3.4\u624d\u5f00\u59cb\u6709\u7684\uff1bARM64\u67b6\u6784\u4e0asyscall execve\u53caexecveat\u7684\u5904\u7406\u4e0a\u4e5f\u6709\u95ee\u9898\uff0c\u5728\u65b0\u8fdb\u7a0b\u52a0\u8f7d\u6210\u529f\u7684\u60c5\u51b5\u4e0b\u6ca1\u6709syscall exit\u56de\u8c03\uff0c\u6b64\u95ee\u9898\u57285.20\u53ca\u4e4b\u540e\u7684\u5185\u6838\u7248\u672c\u624d\u5f97\u5230\u4fee\u590d\u3002<\/p>\n
                  \u7528\u6237\u5728\u81ea\u5df1\u7684\u6a21\u5757\u4e2d\u4e5f\u53ef\u4ee5\u663e\u793a\u5730\u5b9a\u4e49\u81ea\u5df1\u7684Tracepoint\uff0c\u8fd9\u6837\u5c31\u53ef\u4ee5\u76f4\u63a5\u5229\u7528Trace-cmd\u6216perf\u5de5\u5177\u6765\u76f4\u63a5\u8ddf\u8e2a\u4e0e\u5206\u6790\u81ea\u5df1\u7684\u6a21\u5757\u3002<\/p>\n
                  4.4 Ftrace<\/h2>\n
                  \u5728Section 3.3\u4e2d\u6211\u4eec\u4ecb\u7ecd\u4e86Ftrace\u662fLinux\u5185\u6838\u52a8\u6001\u8ddf\u8e2a\u6280\u672f\u7684\u57fa\u51c6\u6846\u67b6\uff0c\u5728\u8fd9\u91cc\u6211\u4eec\u91cd\u70b9\u4ecb\u7ecdFtrace\u7684\u52a8\u6001\u63d2\u6869\u673a\u5236\u3002Ftrace\u5b9e\u73b0\u4e86\u5185\u6838\u201d\u4efb\u610f\u51fd\u6570\u70b9\u201c\u63d2\u6869\u7684\u80fd\u529b\uff0c\u5e76\u4e14\u53ef\u4ee5\u8f93\u51fa\u8c03\u7528\u53c2\u6570\u3001\u5185\u90e8\u53d8\u91cf\uff0c\u751a\u81f3\u6539\u53d8\u51fd\u6570\u6267\u884c\u6d41\u7a0b\u3001\u8fd4\u56de\u503c\u7b49\u3002<\/p>\n
                  Ftrace\u7684\u201d\u4efb\u610f\u51fd\u6570\u70b9\u201c\u63d2\u6869\u80fd\u529b\u5b9e\u9645\u4e0a\u662f\u7531\u5728\u5185\u6838\u7f16\u8bd1\u9636\u6bb5\u7531gcc\u7f16\u8bd1\u5668\u5b8c\u6210\u7684\uff0c\u5728\u5f00\u542fCONFIG_FTRACE\u7684\u60c5\u51b5\u4e0b\uff0c\u4f1a\u6253\u5f00\u5185\u6838\u7f16\u8bd1\u5f00\u5173 -pg\uff0c\u6b64\u53c2\u6570\u4f1a\u5728\u51fd\u6570\u5934\u6dfb\u52a0\u4e00\u4e2a\u8df3\u677f\u51fd\u6570\u7684\u8c03\u7528 \uff1acall _mcount\u6216fentry\u8c03\u7528\u6307\u4ee4\u3002\u5373\u4f7fmcount\u51fd\u6570\u5b9a\u4e49\u4e3a\u7a7a\uff0c\u6b64\u4e3e\u4f1a\u5e26\u6765\u53ef\u8fbe13%\u7684\u6027\u80fd\u635f\u5931\u3002<\/p>\n
                  \u4e3a\u4e86\u89e3\u51b3\u6027\u80fd\u635f\u5931\u7684\u95ee\u9898\uff0c\u5185\u6838\u5f15\u5165\u4e86CONFIG_DYNAMIC_FTRACE\u9009\u9879\uff0c\u6b64\u9009\u9879\u4f1a\u5728\u5185\u6838\u542f\u52a8\u65f6\u5c06\u6240\u6709\u7684\u8df3\u677f\u51fd\u6570\u7684\u8c03\u7528\u6307\u4ee4\u6539\u5199\u6210no\u6307\u4ee4 (nop DWORD PTR [rax+rax*1+0x0])\u3002\u5f53\u6ce8\u518c\u65b0\u7684ftrace\u76d1\u63a7\u70b9\u65f6\uff0cftrace\u6846\u67b6\u4f1a\u52a8\u6001\u4fee\u6539\u76f8\u5e94\u51fd\u6570\u7684\u8df3\u677f\u8c03\u7528\u6307\u4ee4\uff0c\u4ee5\u4e0b\u9762\u7684\u4f8b\u5b50\u6765\u8bf4\u660e\uff1a<\/p>\n
                  do_init_module\u51fd\u6570\u5728vmlinux\u5185\u6838\u955c\u50cf\u6587\u4ef6\u4e2d\u7684\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n
                  pwndbg> disass do_init_module\nDump of assembler code for function do_init_module:\nAddress range 0xffffffff81151a50 to 0xffffffff81151c5d:\n   0xffffffff81151a50 <+0>: call   0xffffffff81079320 <__fentry__>\n   0xffffffff81151a55 <+5>: push   rbp\n   0xffffffff81151a56 <+6>: mov    edx,0x10\n   0xffffffff81151a5b <+11>:    mov    esi,0xcc0\n   0xffffffff81151a60 <+16>:    mov    rbp,rsp\n   0xffffffff81151a63 <+19>:    push   r14\n   0xffffffff81151a65 <+21>:    push   r13\n   0xffffffff81151a67 <+23>:    push   r12\n   0xffffffff81151a69 <+25>:    mov    r12,rdi\n   0xffffffff81151a6c <+28>:    mov    rdi,QWORD PTR [rip+0x156480d] # <kmalloc_caches+32>\n   0xffffffff81151a73 <+35>:    call   0xffffffff812cbc10 <kmalloc_trace>\n   0xffffffff81151a78 <+40>:    test   rax,rax\n   0xffffffff81151a7b <+43>:    je     0xffffffff81151c55 <do_init_module+517>\n   0xffffffff81151a81 <+49>:    mov    r13,rax\n   ...<\/code><\/pre>\n
                  \u6211\u4eec\u53ef\u4ee5\u770b\u5230call   0xffffffff81079320 <__fentry__>\u8fd9\u6761\u6307\u4ee4\u5b9e\u9645\u4e0a\u975e\u7531\u6e90\u4ee3\u7801\u751f\u6210\uff0c\u800c\u662fgcc\u5728\u7f16\u8bd1\u65f6\u81ea\u52a8\u6dfb\u52a0\u7684\u3002\u5728\u7cfb\u7edf\u542f\u52a8\u4e4b\u540e\uff0c\u6211\u4eec\u7528\u8c03\u8bd5\u5668\u6765\u89c2\u5bdf\u8fd0\u884c\u65f6\u6001\u7684\u5185\u6838\u4ee3\u7801\uff0c\u53ef\u4ee5\u770b\u51fa\u7b2c\u4e00\u6761\u6307\u4ee4\u5df2\u88ab\u4fee\u6539\uff1a<\/p>\n
                  pwndbg> disass do_init_module\n   0xffffffff81151a50 <+0>: nop    DWORD PTR [rax+rax*1+0x0]\n   0xffffffff81151a55 <+5>: push   rbp\n   0xffffffff81151a56 <+6>: mov    edx,0x10\n   0xffffffff81151a5b <+11>:    mov    esi,0xcc0\n   0xffffffff81151a60 <+16>:    mov    rbp,rsp\n   0xffffffff81151a63 <+19>:    push   r14\n   0xffffffff81151a65 <+21>:    push   r13\n   0xffffffff81151a67 <+23>:    push   r12\n   0xffffffff81151a69 <+25>:    mov    r12,rdi\n   0xffffffff81151a6c <+28>:    mov    rdi,QWORD PTR [rip+0x156480d] # <kmalloc_caches+32>\n   0xffffffff81151a73 <+35>:    call   0xffffffff812cbc10 <kmalloc_trace>\n   0xffffffff81151a78 <+40>:    test   rax,rax\n   0xffffffff81151a7b <+43>:    je     0xffffffff81151c55 <do_init_module+517>\n   0xffffffff81151a81 <+49>:    mov    r13,rax\n   ...<\/code><\/pre>\n
                  \u7136\u540e\u6211\u4eec\u6ce8\u518c\u4e00\u4e2ado_init_mdoule\u7684kprobe hook\uff0c\u518d\u6765\u89c2\u5bdf\u5b58\u5728ftrace hook\u7684\u60c5\u51b5\u4e0bdo_init_module\u7684\u5165\u53e3\u6307\u4ee4\uff1a<\/p>\n
                  pwndbg> disass do_init_module\n   0xffffffff81151a50 <+0>: call   0xffffffffc0206000\n   0xffffffff81151a55 <+5>: push   rbp\n   0xffffffff81151a56 <+6>: mov    edx,0x10\n   0xffffffff81151a5b <+11>:    mov    esi,0xcc0\n   0xffffffff81151a60 <+16>:    mov    rbp,rsp\n   0xffffffff81151a63 <+19>:    push   r14\n   0xffffffff81151a65 <+21>:    push   r13\n   0xffffffff81151a67 <+23>:    push   r12\n   0xffffffff81151a69 <+25>:    mov    r12,rdi\n   0xffffffff81151a6c <+28>:    mov    rdi,QWORD PTR [rip+0x156480d] # <kmalloc_caches+32>\n   0xffffffff81151a73 <+35>:    call   0xffffffff812cbc10 <kmalloc_trace>\n   0xffffffff81151a78 <+40>:    test   rax,rax\n   0xffffffff81151a7b <+43>:    je     0xffffffff81151c55 <do_init_module+517>\n   0xffffffff81151a81 <+49>:    mov    r13,rax\n   ...<\/code><\/pre>\n
                  0xffffffffc0206000\u5c31\u662fkprobe\u7684\u8df3\u677f\u4ee3\u7801\uff0c\u5176\u4e3b\u8981\u4f5c\u7528\u5c31\u662f\u8c03\u7528kprobe_ftrace_handler\u4ee5\u5904\u7406kprobe\u56de\u8c03\u6216\u8fdb\u884ckretprobe\u56de\u8c03\u7684\u5806\u6808hook\uff0c\u5f53\u7136\u8fd8\u9700\u8981\u8fdb\u884c\u73b0\u573a (\u5bc4\u5b58\u5668\u7b49context\u76f8\u5173\u53d8\u91cf) \u7684\u4fdd\u5b58\u4e0e\u6062\u590d\uff1a<\/p>\n
                  pwndbg> x\/100i 0xffffffffc0206000\n   0xffffffffc0206000:  pushf\n   0xffffffffc0206001:  push   rbp\n   0xffffffffc0206002:  push   QWORD PTR [rsp+0x18]\n   0xffffffffc0206006:  push   rbp\n   0xffffffffc0206007:  mov    rbp,rsp\n   0xffffffffc020600a:  push   QWORD PTR [rsp+0x20]\n   0xffffffffc020600e:  push   rbp\n   0xffffffffc020600f:  mov    rbp,rsp\n   0xffffffffc0206012:  sub    rsp,0xa8\n   0xffffffffc0206019:  mov    QWORD PTR [rsp+0x50],rax\n   0xffffffffc020601e:  mov    QWORD PTR [rsp+0x58],rcx\n   ......\n   0xffffffffc02060cd:  mov    QWORD PTR [rsp+0x98],rcx\n   0xffffffffc02060d5:  lea    rbp,[rsp+0x1]\n   0xffffffffc02060da:  lea    rcx,[rsp]\n   0xffffffffc02060de:  call   0xffffffff8107e500 <kprobe_ftrace_handler>\n   0xffffffffc02060e3:  mov    rax,QWORD PTR [rsp+0x90]\n   ......\n   0xffffffffc020615a:  add    rsp,0xd0\n   0xffffffffc0206161:  popf\n   0xffffffffc0206162:  ret<\/code><\/pre>\n
                  Ftrace\u652f\u6301\u540c\u4e00\u4e2a\u76d1\u63a7\u70b9\u7684\u591a\u6b21hook\uff0c\u5982\u4e0d\u540c\u7684\u6a21\u5757\u540c\u65f6\u76d1\u63a7\u4e86\u540c\u4e00\u4e2a\u5185\u6838\u51fd\u6570\uff0cftrace hook\u6846\u67b6\u5df2\u7ecf\u5c01\u88c5\u4e86\u76f8\u5173\u7684\u5904\u7406\u3002\u53e6\u5916Dynamic Ftrace\u5728\u4fee\u6539\u8df3\u677f\u8c03\u7528\u6307\u4ee4\u65f6\u4e5f\u8003\u8651\u5230\u4e86\u6307\u4ee4\u6495\u88c2\u95ee\u9898\uff0c\u53ef\u53c2\u89c1\u6587\u6863\u3010FT01 \u3011 \u4ee5\u4e86\u89e3\u8be6\u60c5\u3002<\/p>\n
                  4.5 Kprobes<\/h2>\n
                  Krobes\uff08Kernel Probes\uff09\u5141\u8bb8\u5728\u5185\u6838\u8fd0\u884c\u65f6\uff08\u5373\u4e0d\u9700\u8981\u91cd\u65b0\u7f16\u8bd1\u5185\u6838\u6216\u6a21\u5757\uff09\u52a8\u6001\u5730\u63d2\u5165\u65ad\u70b9\u548c\u63a2\u6d4b\u70b9\u3002\u6700\u65b0\u7684Kprobes\u662f\u57fa\u4e8eftrace\u7684\uff0c\u4e4b\u524d\u7684\u7248\u672c\u662f\u5229\u7528\u4e86int 3 trap\u6307\u4ee4\u6765\u8fbe\u6210\u7684\u5bf9\u76ee\u6807\u51fd\u6570\u7684\u76d1\u63a7\u3002Kprobes\u5171\u67093\u79cd\u7c7b\u578b\uff0c\u5305\u62ecKprobe\u3001Jprobe\u548cKretprobe:<\/p>\n
                    \n
                  1. Kprobe\uff1aKprobe\u662f\u4e00\u79cd\u57fa\u672c\u7684\u63a2\u6d4b\u70b9\uff0c\u7528\u4e8e\u5728\u5185\u6838\u51fd\u6570\u7684\u4efb\u610f\u6307\u4ee4\u4f4d\u7f6e\u63d2\u5165\u65ad\u70b9\u3002\u5f53\u65ad\u70b9\u88ab\u89e6\u53d1\u65f6\uff0cKprobe\u4f1a\u6267\u884c\u4e00\u4e2a\u9884\u5148\u6ce8\u518c\u7684\u5904\u7406\u7a0b\u5e8f\uff08handler\uff09\u3002\u5904\u7406\u7a0b\u5e8f\u53ef\u4ee5\u8bbf\u95ee\u548c\u4fee\u6539\u5bc4\u5b58\u5668\u3001\u5185\u5b58\u548c\u5806\u6808\u7b49\u6570\u636e\uff0c\u4ee5\u5b9e\u73b0\u5bf9\u5185\u6838\u64cd\u4f5c\u7684\u76d1\u63a7\u548c\u4fee\u6539\u3002<\/li>\n
                  2. Kretprobe\uff1aKretprobe\u672c\u8eab\u5c31\u662f\u67b6\u6784\u5728Kprobe\u4e4b\u4e0a\u7684\uff0cKretprobe\u9700\u8981\u5728Kprobe\u89e6\u53d1\u65f6\u901a\u8fc7\u989d\u5916\u7684\u5806\u6808hook\u4ee5\u4f7f\u80fd\u5b8c\u6210\u56de\u8c03\u5728\u5728\u51fd\u6570\u8fd4\u56de\u65f6\u88ab\u89e6\u53d1\u3002Kretprobe\u53ef\u4ee5\u5728\u51fd\u6570\u8fd4\u56de\u65f6\u83b7\u53d6\u8fd4\u56de\u503c\u548c\u5806\u6808\u4fe1\u606f\uff0c\u4ee5\u5b9e\u73b0\u5bf9\u5185\u6838\u51fd\u6570\u6267\u884c\u7ed3\u679c\u7684\u76d1\u63a7\u548c\u5206\u6790\u3002AMD64\u67b6\u6784\u4e0a\u9488\u5bf9\u5c3e\u8c03\u7528\u505a\u4e86\u6027\u80fd\u4e0a\u7684\u4f18\u5316\uff0c\u5373\u901a\u8fc7JMP\u8df3\u8f6c\u7684\u65b9\u5f0f\u4ee5\u51cf\u5c11\u51fd\u6570\u8c03\u7528\u7684\u5c42\u6570\uff0c\u540c\u65f6\u9050\u514d\u4e86\u51fd\u6570\u8c03\u7528\u7684\u989d\u5916\u538b\u6808\u53ca\u8fd4\u56de\u65f6\u7684\u53d6\u6808\u52a8\u4f5c\uff0c\u6b64\u4e3e\u4f1a\u5f71\u54cdkretprobe hook\u7684\u4f7f\u7528\u3002<\/li>\n
                  3. Jprobe\uff0c\u53ef\u4ee5\u5f53\u4f5c\u662f\u7279\u6b8a\u7684Kprobe\u3002Kprobe\u901a\u8fc7\u4fee\u6539\u51fd\u6570\u5165\u53e3\u6307\u4ee4\u76d1\u63a7\u51fd\u6570\u8c03\u7528\u7684\u5165\u53e3\uff0c\u800cJprobe\u5141\u8bb8\u5728\u51fd\u6570\u4e2d\u95f4\u76f4\u63a5\u4e2d\u65ad\u5e76\u67e5\u770b\u53c2\u6570\u53ca\u5c40\u90e8\u53d8\u91cf\uff0c\u8fd9\u4f7f\u5f97Jprobe\u66f4\u9002\u5408\u7528\u4e8e\u5206\u6790\u548c\u8c03\u8bd5\u5185\u6838\u51fd\u6570\u7684\u884c\u4e3a\uff0c\u4f46\u540c\u65f6\u4e5f\u4f1a\u5e26\u6765\u4e0d\u53ef\u63a7\u95ee\u9898\uff0c\u76f4\u63a5\u5bfc\u81f4Jprobe\u88ab\u4ece\u4e3b\u7ebf\u5185\u6838\u4e2d\u79fb\u9664\uff0c\u5177\u4f53\u53ef\u53c2\u89c1\uff1ahttps:\/\/lwn.net\/Articles\/735667\/<\/a>  & https:\/\/lkml.org\/lkml\/2017\/10\/2\/386<\/a>\u3002<\/li>\n<\/ol>\n
                    Kprobes\u53ef\u4ee5\u7406\u89e3\u6210\u5bf9Ftrace\u7684\u5c01\u88c5\uff0c\u589e\u52a0\u4e86\u51fd\u6570\u53c2\u6570\u7684\u5904\u7406\uff0c\u540c\u65f6\u589e\u52a0\u4e86\u51fd\u6570\u8fd4\u56de\u56de\u8c03\u7684\u529f\u80fd\uff0c\u5373Kretprobe\uff0c\u4f46Kretprobe\u5728\u53ef\u6269\u5c55\u6027\u4e0a\u6709\u8f83\u5927\u6027\u80fd\u95ee\u9898\uff0c\u6240\u4ee5\u5728\u6027\u80fd\u654f\u611f\u6216\u9ad8\u9891\u6b21\u8c03\u7528\u7684\u70ed\u70b9\u51fd\u6570\u4e0a\u5c3d\u91cf\u907f\u514d\u6216\u8005\u8fdb\u884c\u52a8\u6001\u7684\u5f00\u542f\u53ca\u5173\u95ed\uff0c\u5f53\u7136\u5f00\u542f\u53ca\u5173\u95ed\u7684\u7684\u52a8\u4f5c\u540c\u6837\u4e5f\u4f1a\u5f15\u5165\u65b0\u7684\u95ee\u9898\uff0c\u5982\u4e3a\u4e86\u5904\u7406\u6307\u4ee4\u6495\u88c2\u95ee\u9898\u9700\u8981\u6682\u505c\u5176\u5b83CPU\u7684\u6267\u884c\u7b49\u3002<\/p>\n
                    4.6 LSM hook<\/h2>\n
                    Linux Security Module\uff08LSM\uff09Hooking\u673a\u5236\u662fLinux\u5185\u6838\u4e2d\u7684\u4e00\u4e2a\u5b89\u5168\u6846\u67b6\uff0c\u5141\u8bb8\u591a\u4e2a\u5b89\u5168\u6a21\u5757\uff08\u5982SELinux\u3001AppArmor\u3001Landlock\u7b49\uff09\u5728\u5185\u6838\u4e2d\u63d2\u5165\u94a9\u5b50\uff08Hooks\uff09\uff0c\u4ee5\u5b9e\u65bd\u7279\u5b9a\u7684\u5b89\u5168\u7b56\u7565\u548c\u8bbf\u95ee\u63a7\u5236\u3002LSM Hooking\u673a\u5236\u7684\u8bbe\u8ba1\u76ee\u7684\u662f\u63d0\u4f9b\u4e00\u79cd\u6a21\u5757\u5316\u3001\u53ef\u6269\u5c55\u7684\u5b89\u5168\u89e3\u51b3\u65b9\u6848\uff0c\u4f7f\u5f97\u5185\u6838\u53ef\u4ee5\u7075\u6d3b\u5730\u652f\u6301\u4e0d\u540c\u7684\u5b89\u5168\u6a21\u578b\u548c\u9700\u6c42\u3002<\/p>\n
                    \u6bcf\u4e2aLSM\u7ec4\u4ef6\u53ef\u6839\u636e\u81ea\u5df1\u7684\u9700\u6c42\u586b\u5145security_operations<\/code>\u7684\u56de\u8c03\u7ed3\u6784\uff0c\u8fd9\u4e9b\u51fd\u6570\u6307\u9488\u4ee3\u8868\u4e86\u5404\u79cd\u5185\u6838\u64cd\u4f5c\uff08\u5982\u6587\u4ef6\u8bbf\u95ee\u3001\u8fdb\u7a0b\u521b\u5efa\u7b49\uff09\u7684\u5b89\u5168\u94a9\u5b50\u3002\u901a\u8fc7\u5728\u8fd9\u4e9b\u94a9\u5b50\u51fd\u6570\u4e2d\u63d2\u5165\u7279\u5b9a\u7684\u5b89\u5168\u6a21\u5757\uff0cLSM\u53ef\u4ee5\u5bf9\u5185\u6838\u64cd\u4f5c\u5b9e\u65bd\u8bbf\u95ee\u63a7\u5236\u548c\u5ba1\u8ba1\u7b49\u529f\u80fd<\/p>\n
                    LSM hook\u6700\u65e9\u7531SELinux\u4f7f\u7528\u5e76\u5f15\u5165\u5185\u6838\uff0c\u672c\u5c31\u662f\u4e3a\u5b89\u5168\u800c\u751f\u7684\uff0c\u5b89\u5168\u8f6f\u4ef6\u6240\u4e3b\u8981\u5173\u6ce8\u7684\u8fdb\u7a0b\u3001\u7a0b\u5e8f\/\u52a8\u6001\u5e93\/\u6a21\u5757\u52a0\u8f7d\u3001\u5185\u5b58\u53ca\u6587\u4ef6\u7b49\u9ad8\u5371\u64cd\u4f5c\u4e0eLinux LSM\u7684\u76d1\u63a7\u70b9\u4ea6\u57fa\u672c\u7b26\u5408\uff0cLSM hook\u672c\u8eab\u4e5f\u63d0\u4f9b\u4e86\u64cd\u4f5c\u963b\u6b62\u529f\u80fd\uff0c\u662f\u5b89\u5168\u7ec4\u4ef6\u53caHIPS (Host-based Intrusion Prevention System) \u4ea7\u54c1\u7684\u6700\u4f73\u9009\u62e9\u3002<\/p>\n
                    \u6700\u65b0\u76846.4\u5185\u6838\u5171\u63d0\u4f9b\u4e86\u591a\u8fbe247\u4e2a\u76d1\u63a7\u56de\u8c03\uff0c\u4e4b\u524d\u7684\u5185\u6838\u7248\u672c\u4f1a\u5c11\u4e00\u4e9b\uff0c\u59825.4.2\u5185\u6838\u6240\u652f\u6301\u7684\u56de\u8c03\u6570\u91cf\u4e3a216\uff0c\u4e8c\u8005\u6570\u91cf\u4e0a\u76f8\u5dee31\uff0c\u6240\u4ee5\u5728\u4f7f\u7528\u4e2d\u8981\u6ce8\u610f\u4e0d\u540c\u5185\u6838\u7248\u672c\u4e0a\u6240\u652f\u6301\u7684\u56de\u8c03\u79cd\u7c7b\u4e0a\u7684\u5dee\u5f02\uff1a<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
                    \u7c7b\u522b<\/strong><\/th>\n\u94a9\u5b50\u51fd\u6570\u4e2a\u6570<\/strong><\/th>\n\u529f\u80fd<\/strong><\/th>\n<\/tr>\n<\/thead>\n
                    ptrace<\/td>\n2<\/td>\nptrace\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    \u80fd\u529b\u673a\u5236<\/td>\n3<\/td>\nCapabilities\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    \u78c1\u76d8\u914d\u989d<\/td>\n2<\/td>\n\u914d\u76d8\u914d\u989d\u7ba1\u7406\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    \u8d85\u7ea7\u5757<\/td>\n15<\/td>\nmount\/umount\/\u6587\u4ef6\u7cfb\u7edf\/\u8d85\u7ea7\u5757\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    dentry<\/td>\n2<\/td>\ndentry\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    \u6587\u4ef6\u8def\u5f84<\/td>\n12<\/td>\n\u6587\u4ef6\u540d\/\u8def\u5f84\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    inode<\/td>\n37<\/td>\ninode\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    file<\/td>\n12<\/td>\nfile\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    \u7a0b\u5e8f\u52a0\u8f7d<\/td>\n5<\/td>\n\u8fd0\u884c\u7a0b\u5e8f\u65f6\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    \u8fdb\u7a0b<\/td>\n20<\/td>\n\u7ebf\u7a0b\/\u8fdb\u7a0b\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    IPC<\/td>\n15<\/td>\nIPC\u6d88\u606f\/\u5171\u4eab\u5185\u5b58\/\u4fe1\u53f7\u91cf\u7b49\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    \u7f51\u7edc<\/td>\n38<\/td>\n\u7f51\u7edc\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5: socket\/tun\/sctp\u7b49\u64cd\u4f5c<\/td>\n<\/tr>\n
                    XFRM<\/td>\n11<\/td>\nIPSec\/XFRM\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    \u5bc6\u94a5<\/td>\n4<\/td>\n\u5bc6\u94a5\u7ba1\u7406\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    \u5ba1\u8ba1<\/td>\n4<\/td>\n\u5185\u6838\u5ba1\u8ba1\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    Binder<\/td>\n4<\/td>\nAndroid IPC\u5b50\u7cfb\u7edf\u76f8\u5173\u64cd\u4f5c\u7684\u6743\u9650\u68c0\u67e5<\/td>\n<\/tr>\n
                    Perf<\/td>\n5<\/td>\nperf\u5de5\u5177\u76f8\u5173\u64cd\u4f5c<\/td>\n<\/tr>\n
                    iouring<\/td>\n3<\/td>\ni\/o uring\u76f8\u5173<\/td>\n<\/tr>\n
                    eBPF<\/td>\n7<\/td>\neBPF\u7cfb\u7edf\u8c03\u7528\u53ca\u76f8\u5173\u64cd\u4f5c<\/td>\n<\/tr>\n
                    ...<\/td>\n<\/td>\n<\/td>\n<\/tr>\n
                    \u603b\u8ba1<\/strong><\/td>\n247<\/strong><\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                    LSM\u867d\u7136\u5168\u79f0\u662fLinux Secuirty Module\uff0c\u4f46\u5176\u5e76\u4e0d\u662f\u771f\u6b63\u7684Linux\u5185\u6838\u6a21\u5757(LKM)\uff0c\u800c\u662f\u5fc5\u987b\u7f16\u8bd1\u5728\u5185\u6838\u955c\u50cf\u4e2d\uff0c\u5373in-tree\u6a21\u5f0f\u3002\u4e0e\u5176\u5b83\u7684\u529f\u80fd\u7c7b\u4f3c\uff0c\u4e0d\u540c\u7684\u5185\u6838\u7248\u672c\u95f4\u5dee\u5f02\u4e5f\u6bd4\u8f83\u5927\uff0c\u5176\u4e2d3\u4e2a\u5f71\u54cd\u8f83\u5927\u7684\u7248\u672c\u6539\u53d8\uff1a\n1\uff09 < 4.2.0\n\u53ea\u5141\u8bb8\u4e00\u4e2a\u6a21\u5757\u6ce8\u518c\uff0csecurity_ops \u6307\u9488\u6307\u5411\u6b64\u6a21\u5757\u7684 security_operations\n2\uff09>= 4.2.0\n\u5141\u8bb8\u591a\u4e2a\u6a21\u5757\u6ce8\u518c\uff0c\u901a\u8fc7\u53cc\u5411\u94fe\u8868\uff08security_hook_heads\uff09\u7ba1\u7406\uff08struct list_head\uff09\n3) >= 4.17.0\n\u5141\u8bb8\u591a\u4e2a\u6a21\u5757\u6ce8\u518c\uff0c\u901a\u8fc7\u5355\u94fe\u8868\uff08security_hook_heads\uff09\u7ba1\u7406 \uff08struct hlist_head\uff09<\/p>\n
                    LSM hooks\u867d\u7136\u662fHIPS\u4ea7\u54c1\u5728\u76d1\u63a7\u673a\u5236\u4e0a\u7684\u6700\u4f73\u9009\u62e9\uff0c\u4f46\u5bf9\u4e8eLinux\u6a21\u5757\u6765\u8bf4\u5374\u975e\u5e38\u4e0d\u597d\u5373\uff0c\u6bd4\u5982\u81ea4.12.0\u5f00\u59cb\uff0csecurity_hook_heads\u5217\u8868\u5728\u5185\u6838\u521d\u59cb\u5316\u4e4b\u540e\u5c06\u4e0d\u53ef\u5199\uff0c\u5f53\u7136\u6709\u5176\u5b83\u65b9\u5f0f\u53ef\u8fbe\u6210\u6539\u5199\u76ee\u7684\uff0c\u4e0d\u8fc7\u66f4\u5927\u7684\u969c\u788d\u8fd8\u5728\u4e8esecurity_hook_heads\u4e0d\u518d\u5bfc\u51fa\uff0c\u8fd9\u6837\u7684\u8bdd\u53ea\u80fd\u901a\u8fc7\u5206\u6790\u51fd\u6570\u6307\u4ee4\u6765\u5b9a\u4f4d\u6b64\u94fe\u8868\u5934\uff0c\u4ee5security_inode_create\u4e3a\u4f8b\uff1a<\/p>\n
                    pwndbg> disass security_inode_create\nDump of assembler code for function security_inode_create:\n   0xffffffff8152d3b0 <+0>: nop    DWORD PTR [rax+rax*1+0x0]\n   0xffffffff8152d3b5 <+5>: test   BYTE PTR [rdi+0xd],0x2\n   0xffffffff8152d3b9 <+9>: jne    0xffffffff8152d407 <security_inode_create+87>\n   0xffffffff8152d3bb <+11>:    push   rbp\n   0xffffffff8152d3bc <+12>:    mov    rbp,rsp\n   0xffffffff8152d3bf <+15>:    push   r14\n   0xffffffff8152d3c1 <+17>:    mov    r14,QWORD PTR [rip+0x1189610]        # 0xffffffff826b69d8 <security_hook_heads+440>\n   0xffffffff8152d3c8 <+24>:    push   r13\n   0xffffffff8152d3ca <+26>:    push   r12\n   0xffffffff8152d3cc <+28>:    push   rbx\n   0xffffffff8152d3cd <+29>:    test   r14,r14\n   0xffffffff8152d3d0 <+32>:    je     0xffffffff8152d3f8 <security_inode_create+72>\n   0xffffffff8152d3d2 <+34>:    mov    r12,rdi\n   0xffffffff8152d3d5 <+37>:    mov    r13,rsi\n   0xffffffff8152d3d8 <+40>:    movzx  ebx,dx\n   0xffffffff8152d3db <+43>:    mov    rax,QWORD PTR [r14+0x18]\n   0xffffffff8152d3df <+47>:    mov    edx,ebx\n   0xffffffff8152d3e1 <+49>:    mov    rsi,r13\n   0xffffffff8152d3e4 <+52>:    mov    rdi,r12\n   0xffffffff8152d3e7 <+55>:    call   rax\n   0xffffffff8152d3e9 <+57>:    nop    DWORD PTR [rax]\n   0xffffffff8152d3ec <+60>:    test   eax,eax\n   0xffffffff8152d3ee <+62>:    jne    0xffffffff8152d3fa <security_inode_create+74>\n   0xffffffff8152d3f0 <+64>:    mov    r14,QWORD PTR [r14]\n   0xffffffff8152d3f3 <+67>:    test   r14,r14\n   0xffffffff8152d3f6 <+70>:    jne    0xffffffff8152d3db <security_inode_create+43>\n   0xffffffff8152d3f8 <+72>:    xor    eax,eax\n   0xffffffff8152d3fa <+74>:    pop    rbx\n   0xffffffff8152d3fb <+75>:    pop    r12\n   0xffffffff8152d3fd <+77>:    pop    r13\n   0xffffffff8152d3ff <+79>:    pop    r14\n   0xffffffff8152d401 <+81>:    pop    rbp\n   0xffffffff8152d402 <+82>:    ret\n   0xffffffff8152d403 <+83>:    int3\n   0xffffffff8152d404 <+84>:    int3\n   0xffffffff8152d405 <+85>:    int3\n   0xffffffff8152d406 <+86>:    int3\n   0xffffffff8152d407 <+87>:    xor    eax,eax\n   0xffffffff8152d409 <+89>:    ret\n   0xffffffff8152d40a <+90>:    int3\n   0xffffffff8152d40b <+91>:    int3\n   0xffffffff8152d40c <+92>:    int3\n   0xffffffff8152d40d <+93>:    int3\nEnd of assembler dump.\npwndbg> <\/code><\/pre>\n
                    \u4ece0xffffffff8152d3c1\u5904\u7684\u6307\u4ee4\u5373\u53ef\u7b97\u51fainode_create\u7684\u94fe\u8868\u5934\u4e3a0xffffffff826b69d8\u3002\u9057\u61be\u7684\u662f\u4e0d\u540c\u7684\u5185\u6838\u7248\u672c\u3001\u53ca\u4e0d\u540c\u7684\u4f53\u7cfb\u67b6\u6784\u5747\u4f1a\u751f\u6210\u4e0d\u540c\u7684\u6307\u4ee4\u7ec4\u5408\uff0c\u6240\u8981\u9762\u4e34\u7684\u60c5\u51b5\u6bd4\u6b64\u793a\u4f8b\u8981\u590d\u6742\u7684\u591a\u3002<\/p>\n
                    \u503c\u5f97\u5e86\u5e78\u7684\u662f5.7\u4e4b\u540e\u7684\u5185\u6838 eBPF\u6846\u67b6\u5df2\u652f\u6301LSM Hooks\uff0c\u6211\u4eec\u53ef\u4ee5\u7f16\u5199eBPF\u7a0b\u5e8f\u6765\u76f4\u63a5\u6302\u63a5LSM Hooks\uff0c\u4ee5file_mprotect\u4e3a\u4f8b\uff1a<\/p>\n
                    SEC(\"lsm\/file_mprotect\")\nint BPF_PROG(mprotect_audit, struct vm_area_struct *vma,\n             unsigned long reqprot, unsigned long prot, int ret)\n{\n        \/* ret is the return value from the previous BPF program\n         * or 0 if it's the first hook.\n         *\/\n        if (ret != 0)\n                return ret;\n\n        int is_heap;\n\n        is_heap = (vma->vm_start >= vma->vm_mm->start_brk &&\n                   vma->vm_end <= vma->vm_mm->brk);\n\n        \/* Return an -EPERM or write information to the perf events buffer\n         * for auditing\n         *\/\n        if (is_heap)\n                return -EPERM;\n}<\/code><\/pre>\n
                    \u8981\u6ce8\u610f\u7684\u4e00\u70b9\u662f\u867d\u71365.7\u53ca\u4e4b\u5185\u7684\u5185\u6838\u5df2\u7ecf\u652f\u6301LSM Hooks\uff0c\u4f46\u4e0d\u4e00\u5b9a\u4f1a\u6253\u5f00\u76f8\u5e94\u7684\u914d\u7f6e\u9009\u9879\uff1aCONFIG_BPF_LSM\uff0c\u4f7f\u7528\u524d\u5fc5\u987b\u786e\u8ba4\u3002<\/p>\n
                    4.7 eBPF<\/h2>\n
                    \"Linux<\/p>\n
                    eBPF\uff08Extended Berkeley Packet Filter\uff0c\u6269\u5c55\u7684\u4f2f\u514b\u5229\u6570\u636e\u5305\u8fc7\u6ee4\u5668\uff09\u662fLinux\u5185\u6838\u4e2d\u7684\u4e00\u79cd\u9ad8\u6548\u3001\u7075\u6d3b\u7684\u7a0b\u5e8f\u6267\u884c\u6846\u67b6\u3002\u5b83\u5141\u8bb8\u5728\u5185\u6838\u7a7a\u95f4\u8fd0\u884c\u4e00\u4e9b\u5c0f\u578b\u3001\u53d7\u9650\u5236\u7684\u7a0b\u5e8f\uff0c\u4ece\u800c\u5728\u4e0d\u4fee\u6539\u5185\u6838\u4ee3\u7801\u7684\u60c5\u51b5\u4e0b\u5b9e\u73b0\u5bf9\u5185\u6838\u884c\u4e3a\u7684\u89c2\u5bdf\u3001\u4fee\u6539\u548c\u6269\u5c55\u3002eBPF\u6700\u521d\u662f\u4e3a\u4e86\u5b9e\u73b0\u9ad8\u6548\u7684\u7f51\u7edc\u6570\u636e\u5305\u8fc7\u6ee4\u800c\u8bbe\u8ba1\u7684\uff0c\u540e\u6765\u6269\u5c55\u4e3a\u4e00\u79cd\u901a\u7528\u7684\u5185\u6838\u6267\u884c\u5f15\u64ce\uff0c\u5e7f\u6cdb\u5e94\u7528\u4e8e\u6027\u80fd\u5206\u6790\u3001\u5b89\u5168\u76d1\u63a7\u3001\u7f51\u7edc\u5904\u7406\u7b49\u9886\u57df\u3002<\/p>\n
                    eBPF\u53ef\u4ee5\u8ba4\u4e3a\u662f\u5185\u6838\u6a21\u5757\u5373LKM\u7684\u66ff\u4ee3\uff0c\u53ef\u4ee5\u5b9e\u73b0\u51e0\u4e4e\u5168\u90e8\u7684LKM\u6a21\u5757\u7684\u529f\u80fd\u3002eBPF\u6709\u4ee5\u4e0b\u4e3b\u8981\u7279\u6027\uff1a<\/p>\n
                      \n
                    1. \u5b89\u5168\u6027\uff1aeBPF\u7a0b\u5e8f\u5728\u52a0\u8f7d\u5230\u5185\u6838\u4e4b\u524d\u9700\u8981\u7ecf\u8fc7\u9a8c\u8bc1\u5668\uff08Verifier\uff09\u7684\u68c0\u67e5\uff0c\u786e\u4fdd\u7a0b\u5e8f\u72b6\u6001\u7684\u6709\u9650\u6027\uff0c\u5373\u6ca1\u6709\u4e0d\u53ef\u63a7\u5faa\u73af\u4e14\u4e0d\u4f1a\u8bbf\u95ee\u975e\u6cd5\u7684\u5185\u5b58\u533a\u57df\uff0c\u6240\u4ee5eBPF\u5728\u5185\u6838\u7a7a\u95f4\u4e2d\u6267\u884c\u65f6\u8d85\u7ea7\u5b89\u5168\uff0c\u6c38\u4e0d\u5d29\u6e83<\/li>\n
                    2. \u9ad8\u6027\u80fd\uff1aeBPF\u7a0b\u5e8f\u7531\u4e00\u7ec4\u7b80\u5355\u7684RISC\u6307\u4ee4\u7ec4\u6210\uff0c\u53ef\u4ee5\u5728\u5185\u6838\u4e2d\u4ee5JIT (\u5373\u65f6\u7f16\u8bd1) \u7684\u65b9\u5f0f\u6267\u884c\uff0c\u63a5\u8fd1\u4e8e\u539f\u751f\u4ee3\u7801\u7684\u6027\u80fd\uff0c\u4f46\u56e0\u4e3a\u591a\u4e86\u66f4\u591a\u8fb9\u754c\u68c0\u67e5\u4e0e\u6307\u4ee4\u6821\u9a8c\u6240\u4ee5\u603b\u4f53\u4e0a\u8981\u6bd4LKM\u7684\u6027\u80fd\u5dee\u4e00\u4e9b<\/li>\n
                    3. \u53ef\u7f16\u7a0b\u6027\uff1aeBPF\u7a0b\u5e8f\u53ef\u4ee5\u4f7f\u7528C\u8bed\u8a00\u7f16\u5199\uff0c\u5e76\u901a\u8fc7LLVM\u7f16\u8bd1\u5668\u751f\u6210eBPF\u5b57\u8282\u7801\uff0c\u5e76\u4e14\u73b0\u5728\u6709\u4e86\u652f\u6301Go\u3001Python\u7b49\u80fd\u7528\u8bed\u8a00\u7684\u6846\u67b6<\/li>\n
                    4. \u53ef\u6269\u5c55\u6027\uff1aeBPF\u7a0b\u5e8f\u53ef\u4ee5\u8bbf\u95ee\u5185\u6838\u4e2d\u7684\u8f85\u52a9\u51fd\u6570 (helpers)\u6765\u4e0e\u5185\u6838\u4ea4\u4e92\uff0c\u901a\u8fc7\u5185\u5b58\u6620\u5c04 (maps)\u53ef\u4ee5\u5b9e\u73b0\u5e94\u7528\u5c42\u4e0e\u5185\u6838\u5c42\u4e4b\u95f4\u7684\u901a\u4fe1\u4ea4\u4e92\u548c\u9ad8\u6548\u7684\u6570\u636e\u5171\u4eab<\/li>\n<\/ol>\n
                      eBPF\u6700\u5927\u7684\u597d\u5904\u5c31\u662f\u5b89\u5168\u6027\uff0c\u5373\u4f7f\u51fa\u9519\u4e5f\u4e0d\u4f1a\u5bfc\u81f4\u7cfb\u7edf\u5d29\u6e83\u3002\u53e6\u5916\uff0c\u5b83\u89e3\u51b3\u4e86LKM\u591a\u5185\u6838\u7248\u672c\u9002\u914d\u7684\u95ee\u9898\uff0ceBPF\u7a0b\u5e8f\u5728BTF\u7684\u52a0\u6301\u4e0b\u53ef\u4ee5\u540c\u4e00\u4e2a\u4e8c\u8fdb\u5236\u6587\u4ef6\u8fd0\u884c\u5728\u591a\u4e2a\u5185\u6838\u4e4b\u4e0a\u3002\u4e0d\u8fc7\u5b9e\u9645\u4f7f\u7528\u4e2d\uff0ceBPF\u8fd8\u662f\u65e0\u6cd5\u5168\u91cf\u66ff\u4ee3LKM\uff0c\u5176\u9650\u5236\u76f8\u5f53\u591a\uff0c\u4e3b\u8981\u662f\u5bf9\u5185\u6838\u7248\u672c\u7684\u4f9d\u8d56\uff0c\u6bd5\u7adfeBPF\u5b50\u7cfb\u7edf\u8fd8\u5728\u5f00\u53d1\u4e2d\u3002eBPF\u6846\u67b6\u4e3b\u8981\u6709\u4ee5\u4e0b\u9650\u5236\uff1a<\/p>\n
                        \n
                      1. \u529f\u80fd\u9650\u5236\uff1a\u4e3a\u4e86\u786e\u4fdd\u5185\u6838\u7684\u5b89\u5168\u548c\u7a33\u5b9a\u6027\uff0ceBPF\u7a0b\u5e8f\u7684\u72b6\u6001\u5fc5\u987b\u662f\u6709\u9650\u7684\uff0c\u65e9\u671f\u7248\u672c\u4e0d\u652f\u6301\u5faa\u73af\uff0c\u5728\u7f16\u8bd1\u65f6\u5fc5\u987b\u5c06\u5faa\u73af\u505a\u5c55\u5f00\u5904\u7406\uff0c\u800c5.3\u4e4b\u540e\u624d\u80fd\u652f\u6301Bounded loop\uff0c\u5373\u5e38\u91cf\u6b21\u6570\u7684\u5faa\u73af\u3002eBPF\u7a0b\u5e8f\u4e0d\u80fd\u76f4\u63a5\u8bbf\u95ee\u5185\u6838\u5185\u5b58\u6216\u6267\u884c\u4efb\u610f\u5185\u6838\u51fd\u6570\uff0c\u53ea\u80fd\u8c03\u7528eBPF\u7684\u5185\u6838\u8f85\u52a9\u51fd\u6570(helpers)\uff0c\u6545\u5176\u5728\u529f\u80fd\u4e0a\u5927\u5927\u53d7\u9650\uff1b\u53e6\u5916\u4e3a\u4e86\u5b89\u5168\u8003\u8651\u4e0d\u80fd\u8fdb\u884c\u6307\u9488\u8fd0\u7b97<\/li>\n
                      2. \u6307\u4ee4\u9650\u5236\uff1aeBPF\u7a0b\u5e8f\u7531\u4e00\u7ec4\u9650\u5b9a\u768464\u4f4dRISC\u6307\u4ee4\u7ec4\u6210\uff0c\u8fd9\u4e9b\u6307\u4ee4\u4e0d\u652f\u6301\u6d6e\u70b9\u6570\u3001\u5411\u91cf\u64cd\u4f5c\u6216\u9ad8\u7ea7\u63a7\u5236\u7ed3\u6784 (\u5982\u5f02\u5e38\u5904\u7406)\uff1beBPF\u6307\u4ee4\u662f\u65e0\u67b6\u6784\u7684\uff0c\u6545\u4e0d\u80fd\u8bbf\u95ee\u786c\u4ef6\u5bc4\u5b58\u5668\u6216\u7aef\u53e3\u3002\u4ece\u6307\u4ee4\u4f53\u7cfb\u4e0a\u6765\u8bf4\u5176\u5904\u7406\u80fd\u529b\u8fdc\u4e0d\u5982x86\u6216ARM\u7b49\u7cfb\u7edf\uff1b5.2\u4e4b\u524d\u7684\u5185\u6838\u6240\u652f\u6301\u7684\u6700\u5927\u6307\u4ee4\u6570\u4e3a4K\uff0c\u4e4b\u540e\u7684\u5185\u6838\u6700\u5927\u652f\u63011M\u6307\u4ee4\u6570<\/li>\n
                      3. \u5185\u5b58\u9650\u5236\uff1aeBPF\u7a0b\u5e8f\u53ef\u4ee5\u4f7f\u7528\u6709\u9650\u7684\u5806\u6808\u7a7a\u95f4\u548c\u9884\u5206\u914d\u7684\u5185\u5b58\u6620\u5c04(maps)\uff0c\u4f46\u4e0d\u80fd\u4f7f\u7528\u5176\u4ed6\u5185\u5b58\u8d44\u6e90 (\u5982\u5185\u6838\u5806\u6216\u5168\u5c40\u53d8\u91cf); \u51fd\u6570\u5806\u6808\u53ea\u6709512\u5b57\u8282\uff0c\u51fd\u6570\u8c03\u7528\u5c42\u7ea7\u4ea6\u4e0d\u80fd\u591a\u4e8e9\u5c42\uff0c\u53c2\u6570\u4e0d\u80fd\u591a\u4e8e5\u4e2a<\/li>\n
                      4. \u7cfb\u7edf\u9650\u5236\uff1a\u5c3d\u7ba1eBPF\u6846\u67b6\u5728\u8f83\u65b0\u7684Linux\u53d1\u884c\u7248\u4e2d\u5f97\u5230\u4e86\u652f\u6301\uff0c\u4f46\u5728\u8f83\u65e7\u7684\u5185\u6838\u7248\u672c\u6216\u7279\u5b9a\u7684\u7cfb\u7edf\u914d\u7f6e\u4e0b\u4f9d\u7136\u65e0\u6cd5\u4f7f\u7528\u6216\u529f\u80fd\u53d7\u9650\uff1b\u5176\u5bf9\u5185\u6838\u7248\u672c\u4f9d\u8d56\u6027\u8f83\u9ad8\uff0ceBPF\u7684\u529f\u80fd\u53ca\u7279\u6027\u53ef\u80fd\u56e0Linux\u5185\u6838\u7248\u672c\u7684\u4e0d\u540c\u800c\u6709\u8f83\u5927\u7684\u5dee\u5f02<\/li>\n
                      5. \u6027\u80fd\u5f00\u9500\uff1aeBPF\u867d\u7136\u662f\u4e3a\u9ad8\u6548\u573a\u666f\u670d\u52a1\u573a\u666f\u8bbe\u8ba1\u7684\uff0c\u4f46\u4e3a\u4e86\u4fdd\u8bc1\u5b89\u5168\u6027\u5f15\u5165\u4e86\u8f83\u591a\u9650\u5236\u53ca\u68c0\u67e5\uff0c\u8fd9\u4e9b\u989d\u5916\u7684\u52a8\u4f5c\u5747\u4f1a\u5f15\u5165\u6027\u80fd\u5f00\u9500\uff0c\u6240\u4ee5\u5c31\u6027\u80fd\u6307\u6807\u800c\u8a00\u6bd4LKM\u8981\u5dee<\/li>\n
                      6. eBPF\u7a0b\u5e8f\u5fc5\u987b\u9075\u5faaGPL\u534f\u8bae<\/li>\n<\/ol>\n
                        \u76ee\u524d\u5df2\u6709\u4f17\u591a\u7684\u5b89\u5168\u5b89\u5168\u4ea7\u54c1\u53ca\u6570\u636e\u53ef\u89c6\u5316\u5e73\u53f0\u6b63\u5728\u4f7f\u7528eBPF\u6846\u67b6\u4ee5\u91c7\u96c6\u5185\u6838\u53ca\u7f51\u7edc\u4e8b\u4ef6\uff0c\u5982Cilium\u3001Sysdig\u3001Tracee\u3001KubuArmor\u7b49\u3002<\/p>\n
                        4.8 Netfilter & XDR<\/h2>\n
                        Netfilter\u6846\u67b6\u81eaLinux 2.4.x\u65f6\u4fbf\u5e76\u5165\u4e86\u5185\u6838\uff0c\u662fLinux\u7f51\u7edc\u529f\u80fd\u53ca\u9632\u706b\u5899\u7684\u5b9e\u73b0\u57fa\u7840\uff0c\u63d0\u4f9b\u4e86\u7f51\u7edc\u6570\u636e\u5305\u8fc7\u6ee4\u7684\u5f3a\u5927\u80fd\u529b\u3002\u5e94\u7528\u5c42\u7684\u4ea4\u4e92\u7531iptables\u6216nftables\u5b8c\u6210\u3002netfilter\u9879\u76ee\u63d0\u4f9b\u6570\u636e\u5305\u8fc7\u6ee4\u3001\u7f51\u7edc\u5730\u5740\uff08\u548c\u7aef\u53e3\uff09\u8f6c\u6362\uff08NAT\/NAPT\uff09\u3001\u6570\u636e\u5305\u65e5\u5fd7\u8bb0\u5f55\u3001\u7528\u6237\u7a7a\u95f4\u6570\u636e\u5305\u6392\u961f\u548c\u5176\u4ed6\u6570\u636e\u5305\u64cd\u4f5c\u529f\u80fd\u3002<\/p>\n
                        \"image-20230719162002490\"<\/p>\n
                        Netfilter\u5b9e\u73b0\u4e86\u5305\u8fc7\u6ee4\u53ca\u9632\u706b\u5899\u529f\u80fd\uff0c\u53ef\u901a\u8fc7iptables\u6216nftables\u5b9a\u4e49\u53ca\u4e0b\u53d1\u89c4\u5219\u3002\u53e6\u5916Netfilter\u5141\u8bb8\u5185\u6838\u6a21\u5757\u5728Linux\u7f51\u7edc\u5806\u6808\u7684\u4e0d\u540c\u4f4d\u7f6e\u6ce8\u518c\u56de\u8c03\u51fd\u6570\uff0c\u5f53\u6570\u636e\u5305\u5230\u8fbeLinux\u7f51\u7edc\u6808\u4e2d\u9884\u5b9a\u4f4d\u7f6e\u65f6\u4fbf\u4f1a\u89e6\u53d1\u8fd9\u4e9b\u56de\u8c03\u4ee5\u901a\u77e5\u5185\u6838\u6a21\u5757\u8fdb\u884c\u4e0b\u4e00\u6b65\u7684\u5904\u7406\u3002<\/p>\n
                        XDP\u5168\u79f0\u662feXpress Data Path (\u5feb\u901f\u6570\u636e\u8def\u5f84)\uff0c\u57fa\u4e8eeBPF\u6307\u4ee4\u7684\u6d41\u7a0b\u5904\u7406\u7a0b\u5e8f\uff0c\u5176\u5feb\u901f\u7684\u539f\u56e0\u5728\u4e8e\u80fd\u591f\u5728\u7f51\u7edc\u6570\u636e\u5305\u5230\u8fbe\u7f51\u5361\u9a71\u52a8\u65f6\u5bf9\u5176\u8fdb\u884c\u5904\u7406\uff0c\u5177\u6709\u4f20\u7edf\u6846\u67b6\u6240\u4e0d\u5177\u5907\u7684\u5904\u7406\u65f6\u673a\u4e0a\u7684\u4f18\u52bf\u53ca\u66f4\u5f3a\u7684\u4e0a\u4e0b\u6587\u8bc6\u522b\u80fd\u529b\uff0c\u6545\u6700\u7ec8\u53ef\u4ee5\u8fbe\u6210\u8f83\u9ad8\u7684\u6570\u636e\u9762\u5904\u7406\u6027\u80fd\u3002\u4f20\u7edf\u7684Linux\u5185\u6838\u7f51\u7edc\u534f\u8bae\u6808\u66f4\u5f3a\u8c03\u548c\u6ce8\u91cd\u901a\u7528\u6027\uff0c\u6240\u4ee5\u6846\u67b6\u672c\u8eab\u5c31\u56fa\u6709\u6027\u80fd\u74f6\u9888\u95ee\u9898\uff0c\u7279\u522b\u968f\u7740\u5982100G\u9ad8\u901f\u7f51\u7edc\u7684\u51fa\u73b0\uff0c\u8fd9\u79cd\u6027\u80fd\u74f6\u9888\u5c31\u53d8\u5f97\u66f4\u52a0\u7a81\u51fa\u4e86\uff0c\u800c\u57fa\u4e8eeBPF\u7684XDP\u7a0b\u5e8f\u5219\u6ca1\u6709\u8fd9\u4e9b\u9650\u5236\uff0c\u6240\u4ee5XDP\u80fd\u591f\u63d0\u9ad8\u7f51\u7edc\u6570\u636e\u5305\u7684\u5904\u7406\u901f\u5ea6\uff0c\u540c\u65f6\u51cf\u5c11\u5185\u6838\u534f\u8bae\u6808\u7684\u5f00\u9500\uff0c\u5e76\u6700\u7ec8\u80fd\u591f\u63d0\u5347\u7cfb\u7edf\u6574\u4f53\u6027\u80fd\u3002<\/p>\n
                        XDP \u6280\u672f\u53ef\u4ee5\u7528\u4e8e\u5404\u79cd\u7f51\u7edc\u5e94\u7528\u7684\u5b9e\u73b0\uff0c\u5982\u5165\u4fb5\u68c0\u6d4b\u3001\u6d41\u91cf\u76d1\u63a7\u3001\u7f51\u7edc\u52a0\u901f\u7b49\u5404\u4e2a\u65b9\u9762\u3002<\/p>\n
                        \"img\"<\/p>\n
                        5 \u5b89\u5168\u9886\u57df\u5b9e\u8df5 - Elkeid<\/h1>\n
                        5.1<\/strong> Elkeid\u9879\u76ee\u7b80\u4ecb<\/h2>\n
                        Elkeid<\/strong> \u662f\u4e00\u6b3e\u53ef\u4ee5\u6ee1\u8db3\u4e3b\u673a\u3001\u5bb9\u5668\u4e0e\u5bb9\u5668\u96c6\u7fa4\uff0cServerless<\/strong> \u7b49\u591a\u79cd\u5de5\u4f5c\u8d1f\u8f7d\u5b89\u5168\u9700\u6c42\u7684\u5f00\u6e90\u89e3\u51b3\u65b9\u6848\uff0c\u6e90\u4e8e\u5b57\u8282\u8df3\u52a8\u5185\u90e8\u6700\u4f73\u5b9e\u8df5\u3002\u968f\u7740\u4f01\u4e1a\u7684\u4e1a\u52a1\u53d1\u5c55\uff0c\u591a\u4e91\u3001\u4e91\u539f\u751f\u3001\u591a\u79cd\u5de5\u4f5c\u8d1f\u8f7d\u5171\u5b58\u7684\u60c5\u51b5\u6108\u53d1\u51f8\u663e\uff0c\u6545Elkeid\u9879\u76ee\u5c31\u662f\u6211\u4eec\u63a8\u51fa\u7684\u7528\u4ee5\u6ee1\u8db3\u4e0d\u540c\u5de5\u4f5c\u8d1f\u8f7d\u4e0b\u5b89\u5168\u9700\u6c42\u7684\u5b8c\u6574\u89e3\u51b3\u65b9\u6848\u3002<\/p>\n
                        \"Elkeid@Bytedance\"<\/p>\n
                        Elkeid \u5177\u5907\u4ee5\u4e0b\u4e3b\u8981\u80fd\u529b\uff1a<\/p>\n