Skip to content

Instantly share code, notes, and snippets.

@semahawk
Created October 25, 2013 18:42
Show Gist options
  • Save semahawk/7159720 to your computer and use it in GitHub Desktop.
Save semahawk/7159720 to your computer and use it in GitHub Desktop.
/*
* kldmempeek.c
*
* Author: Szymon Urbaś <szymon.urbas@aol.com>
*
* Description: Take a hexdump-like peek at a module's bytes. It is very
* platform specific and _probably_ works _only_ under FreeBSD.
*
* License: the MIT (X11) License
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <ctype.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/linker.h>
#include <fcntl.h>
#include <errno.h>
#include <err.h>
int main(int argc, char *argv[])
{
struct kld_file_stat st;
int fd, openfd;
unsigned i, j;
unsigned char *p;
void *addr;
unsigned cols = 15;
if (argc < 2){
errx(1, "usage: kldmempeek <module> [cols]");
return 1;
}
if (argc > 2){
cols = atoi(argv[2]);
}
if ((fd = kldfind(argv[1])) < 0){
err(1, "can't find module %s", argv[1]);
return 1;
}
st.version = sizeof(struct kld_file_stat);
if (kldstat(fd, &st) == -1){
err(1, "kldstat");
return 1;
}
openfd = open(st.pathname, O_RDONLY);
printf("module %s:\n\n", st.pathname);
printf(" id: %d, fd: %d\n", st.id, fd);
printf(" refs: %d\n", st.refs);
printf(" size: %zu bytes (0x%zx)\n", st.size, st.size);
printf(" address: %p\n\n", st.address);
addr = mmap(NULL, st.size, PROT_READ, MAP_PRIVATE, openfd, 0);
if (addr == MAP_FAILED){
err(1, "mmap failed");
return 1;
}
p = addr;
for (i = 0; i < st.size; i += cols){
printf(" ");
for (j = 0; j < cols; j++){
printf("%.2x", *(p + j));
if (j % 4 == 3)
printf(" ");
else
printf(" ");
}
printf(" ");
for (j = 0; j < cols; j++){
if (isprint(*(p + j))){
printf("%c", *(p + j));
} else {
printf(".");
}
}
printf("\n");
p += cols;
}
munmap(addr, st.size);
close(fd);
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment