Fix the read data address one more time

This commit is contained in:
M. Mert Yildiran 2022-05-31 15:23:11 +03:00
parent 9314126fb6
commit e453947b12
No known key found for this signature in database
GPG Key ID: D42ADB236521BF7A
3 changed files with 11 additions and 2 deletions

View File

@ -81,8 +81,17 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) {
b->conn_addr = ctx->rsi; // go.itab.*net.TCPConn,net.Conn address
b->is_request = false;
// Address at ctx->rbx & 0xfffffff000 holds the data
__u32 status = bpf_probe_read_str(&b->data, sizeof(b->data), (void*)(ctx->rbx & 0xfffffff000));
void* stack_addr = (void*)ctx->rsp;
__u64 data_p;
// Address at ctx->rsp + 0xd8 holds the data
__u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8);
if (status < 0) {
bpf_printk("[golang_net_http_read_uprobe] error reading data pointer: %d", status);
bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP);
return 0;
}
status = bpf_probe_read_str(&b->data, sizeof(b->data), (void*)(data_p));
if (status < 0) {
bpf_printk("[golang_crypto_tls_read_uprobe] error reading data: %d", status);
bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP);

Binary file not shown.

Binary file not shown.