Skip to content

Instantly share code, notes, and snippets.

@jperkin
Created February 27, 2024 17:28
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jperkin/c6c19ded5daaecd9c53656a37ff06d56 to your computer and use it in GitHub Desktop.
Save jperkin/c6c19ded5daaecd9c53656a37ff06d56 to your computer and use it in GitHub Desktop.
userland dtrace from shared library

Userland arguments work for functions from the main object, but not those in shared libraries.

An example from the main smbd program is ok:

$ dtrace -lvn 'pid$target:smbd:samba_cmdline_init:entry' -p 76224 
   ID   PROVIDER            MODULE                          FUNCTION NAME
96158   pid76224              smbd                samba_cmdline_init entry

        Probe Description Attributes
                Identifier Names: Private
                Data Semantics:   Private
                Dependency Class: Unknown

        Argument Attributes
                Identifier Names: Private
                Data Semantics:   Private
                Dependency Class: Unknown

        Argument Types
                args[0]: userland TALLOC_CTX *
                args[1]: userland enum samba_cmdline_config_type
                args[2]: userland _Bool

But any from libsmbd-base-samba4.so (or indeed any of the Samba shared libraries) are all listed as "unknown":

$ dtrace -lvn 'pid$target::readlink_talloc:entry' -p 76224 
   ID   PROVIDER            MODULE                          FUNCTION NAME
97390   pid76224 libsmbd-base-samba4.so                   readlink_talloc entry

        Probe Description Attributes
                Identifier Names: Private
                Data Semantics:   Private
                Dependency Class: Unknown

        Argument Attributes
                Identifier Names: Private
                Data Semantics:   Private
                Dependency Class: Unknown

        Argument Types
                args[0]: (unknown)
                args[1]: (unknown)
                args[2]: (unknown)
                args[3]: (unknown)

As far as I can see they are built in the same way, and CTF is generated correctly for them. For example ctfdump -c:

$ ctfdump -c /opt/local/sbin/smbd | grep samba_cmdline_init
extern _Bool samba_cmdline_init(TALLOC_CTX *, enum samba_cmdline_config_type, _Bool);

$ ctfdump -c /opt/local/lib/samba/private/libsmbd-base-samba4.so | grep readlink_talloc
extern NTSTATUS readlink_talloc(TALLOC_CTX *, struct files_struct *, struct smb_filename *, char **);
@jperkin
Copy link
Author

jperkin commented Feb 27, 2024

libdtrace DEBUG: discovering probe pid76224:libsmbd-base-samba4.so:readlink_talloc:entry id=97390
libdtrace DEBUG: grabbed pid 76224 (cached)
libdtrace DEBUG: loaded 158 ctf modules for pid 76224
libdtrace DEBUG: grabbed pid 76224 (cached)
libdtrace DEBUG: Trying to find userland type: libsmbd
libdtrace DEBUG: failed to resolve input type userland pid76224`libsmbd-base-samba4.so`TALLOC_CTX * for pid76224:libsmbd-base-samba4.so:readlink_talloc:entry arg #1: syntax error near "pid76224`libsmbd"
libdtrace DEBUG: failed to resolve output type  for pid76224:libsmbd-base-samba4.so:readlink_talloc:entry arg #1: empty D program translation unit
libdtrace DEBUG: Trying to find userland type: libsmbd
libdtrace DEBUG: failed to resolve input type userland struct pid76224`libsmbd-base-samba4.so`files_struct * for pid76224:libsmbd-base-samba4.so:readlink_talloc:entry arg #2: syntax error near "-"
libdtrace DEBUG: failed to resolve output type  for pid76224:libsmbd-base-samba4.so:readlink_talloc:entry arg #2: empty D program translation unit
libdtrace DEBUG: Trying to find userland type: libsmbd
libdtrace DEBUG: failed to resolve input type userland struct pid76224`libsmbd-base-samba4.so`smb_filename * for pid76224:libsmbd-base-samba4.so:readlink_talloc:entry arg #3: syntax error near "-"
libdtrace DEBUG: failed to resolve output type  for pid76224:libsmbd-base-samba4.so:readlink_talloc:entry arg #3: empty D program translation unit
libdtrace DEBUG: Trying to find userland type: libsmbd
libdtrace DEBUG: failed to resolve input type userland pid76224`libsmbd-base-samba4.so`char ** for pid76224:libsmbd-base-samba4.so:readlink_talloc:entry arg #4: syntax error near "pid76224`libsmbd"
libdtrace DEBUG: failed to resolve output type  for pid76224:libsmbd-base-samba4.so:readlink_talloc:entry arg #4: empty D program translation unit
libdtrace DEBUG: set context to pid76224::readlink_talloc:entry [0] prp=16119d0 attr=[p/p/u] argc=4
libdtrace DEBUG: set label to <action list>
libdtrace DEBUG: set label to <NULL>
libdtrace DEBUG: releasing pid 76224

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment