首页
课程
问答
CTF
社区
招聘
峰会
发现
排行榜
知识库
工具下载
看雪20年
看雪商城
证书查询
登录
注册
首页
社区
课程
招聘
发现
问答
CTF
排行榜
知识库
工具下载
峰会
看雪商城
证书查询
社区
Android安全
发新帖
7
11
[原创]新人贴，记录工作中解决bug用到的逆向知识
发表于: 2025-10-8 16:11
11246
[原创]新人贴，记录工作中解决bug用到的逆向知识
hexdeep
2025-10-8 16:11
11246
[toc] # 问题现象 在使用rk3588开发云手机过程中，有部分核心板随机出现hostserver进程占用cpu过高问题  因为golang编译时候去除了调试信息，没有加上pprof，无法看到goroutine的工作状态，同时hostserver进程为服务进程 ``` kill -QUIT $(pidof host_server) ``` 无法使用上面命令打印堆栈 同时环境不容易复现，无法通过反复修改代码来验证问题，只能在不破坏环境的情况下，尽可能多收集信息，然后定位问题。 # 分析过程 ## 分析工具 - ida7.5 - <a href="elink@6d9K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1j5H3P5r3A6A6j5i4W2#2i4K6u0r3k6$3!0Q4y4h3k6H3j5i4u0K6k6i4t1`."><mark class="encrypted">16bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1j5H3P5r3A6A6j5i4W2#2i4K6u0r3k6$3!0Q4y4h3k6H3j5i4u0K6k6i4t1`.</mark></a> - strace - perf ## 环境配置 打开ida，导入goparser    太清晰了，简直就是明文[呲牙]，以后用golang写程序要上加壳了  ``` perf record -F 99 -p $(pidof host_server) -g -- sleep 30 ``` 如果出现以上错误执行以下命令： ``` echo 1 > /proc/sys/kernel/kptr_restrict ``` 运行查看结果 ``` perf report ``` ``` Samples: 1K of event 'cycles:P', Event count (approx.): 24575912110 Children Self Command Shared Object Symbol + 50.49% 0.00% host_server host_server [.] 0x0000000000086ba4 + 42.66% 0.00% host_server host_server [.] 0x00000000004309f0 + 42.25% 0.00% host_server host_server [.] 0x00000000003ab5ac + 42.07% 0.00% host_server host_server [.] 0x00000000003ab5f4 + 41.87% 0.00% host_server host_server [.] 0x00000000003a5f2c + 37.75% 0.00% host_server [kernel.kallsyms] [k] el0t_64_sync + 37.75% 0.00% host_server [kernel.kallsyms] [k] el0t_64_sync_handler + 36.42% 0.00% host_server host_server [.] 0x000000000008485c + 30.67% 0.00% host_server [kernel.kallsyms] [k] el0_svc + 27.78% 0.00% host_server [kernel.kallsyms] [k] do_el0_svc + 27.72% 1.95% host_server [kernel.kallsyms] [k] el0_svc_common.constprop.0 + 25.63% 0.06% host_server [kernel.kallsyms] [k] invoke_syscall + 25.23% 0.00% host_server host_server [.] 0x00000000000190a0 + 17.42% 0.00% host_server host_server [.] 0x00000000000ca99b + 15.47% 0.00% host_server host_server [.] 0x000000000002d914 + 15.28% 0.00% host_server host_server [.] 0x00000000003a63c8 + 14.77% 0.00% host_server host_server [.] 0x0000000000031884 + 11.29% 0.00% host_server host_server [.] 0x00000000000548c4 + 11.11% 0.00% host_server host_server [.] 0x00000000003a6248 + 11.01% 0.00% host_server host_server [.] 0x000000000002445c + 10.55% 0.00% host_server host_server [.] 0x00000000000847c4 + 9.54% 0.00% host_server host_server [.] 0x00000000003a765c + 9.54% 0.00% host_server host_server [.] 0x000000000007ce70 + 9.46% 0.00% host_server host_server [.] 0x0000000000054dc0 + 8.59% 0.00% host_server host_server [.] 0x0000000000024018 + 8.53% 0.00% host_server host_server [.] 0x00000000000243d3 + 8.50% 0.00% host_server host_server [.] 0x00000000003a62fc + 8.23% 0.00% host_server host_server [.] 0x00000000000cb4fc + 7.97% 0.00% host_server host_server [.] 0x000000000002d8e8 + 7.70% 0.00% host_server host_server [.] 0x00000000000caa7c + 7.52% 0.00% host_server host_server [.] 0x0000000000087430 + 7.01% 0.18% host_server [kernel.kallsyms] [k] el0_da + 6.89% 0.00% host_server host_server [.] 0x0000000000031ae4 + 6.73% 0.07% host_server [kernel.kallsyms] [k] do_mem_abort + 6.72% 0.00% host_server host_server [.] 0x00000000003a741c + 6.72% 0.00% host_server host_server [.] 0x00000000000ee794 + 6.71% 0.00% host_server host_server [.] 0x000000000002aff8 + 6.66% 0.10% host_server [kernel.kallsyms] [k] do_translation_fault + 6.50% 0.00% host_server host_server [.] 0x00000000000e54d4 + 6.50% 0.00% host_server host_server [.] 0x00000000003a752c + 6.46% 0.08% host_server [kernel.kallsyms] [k] do_page_fault + 6.44% 0.00% host_server host_server [.] 0x0000000000163d94 + 6.44% 0.00% host_server host_server [.] 0x000000000016522c + 6.07% 0.07% host_server [kernel.kallsyms] [k] __arm64_sys_sendto + 6.00% 0.00% host_server [kernel.kallsyms] [k] __sys_sendto ``` 现在我们已经知道消耗cpu的代码地址，0x0000000000086ba4 0x00000000004309f0 0x00000000003ab5ac 0x0000000000086ba4 代码： ``` .text:0000000000086BA0 ; =============== S U B R O U T I N E ======================================= .text:0000000000086BA0 .text:0000000000086BA0 ; Attributes: noreturn .text:0000000000086BA0 .text:0000000000086BA0 runtime_goexit ; DATA XREF: runtime_oneNewExtraM+38↑o .text:0000000000086BA0 ; runtime_newproc1+E0↑o .text:0000000000086BA0 MOV X0, X0 .text:0000000000086BA4 .text:0000000000086BA4 loc_86BA4 .text:0000000000086BA4 BL runtime_goexit1_0 ``` 0x00000000004309f0 代码： ``` .text:00000000004309D4 SUB X29, SP, #0x18 .text:00000000004309D8 BL sub_87260 .text:00000000004309DC .text:00000000004309DC loc_4309DC ; DATA XREF: host_server_netlink__Netlink_Init_func1+10C↑o .text:00000000004309DC SUB X29, SP, #8 .text:00000000004309E0 LDR X1, [SP,#0x250+var_150] .text:00000000004309E4 ADRP X27, #off_AD3828@PAGE .text:00000000004309E8 LDR X0, [X27,#off_AD3828@PAGEOFF] .text:00000000004309EC BL github_com_vishvananda_netlink__Handle_LinkByIndex .text:00000000004309F0 CBNZ X2, loc_4309FC .text:00000000004309F4 MOV X4, XZR ``` 0x00000000003ab5ac 代码： ``` .text:00000000003AB59C STR X2, [X25,#8] .text:00000000003AB5A0 .text:00000000003AB5A0 loc_3AB5A0 ; CODE XREF: github_com_vishvananda_netlink__Handle_LinkByIndex+29C↑j .text:00000000003AB5A0 STR X0, [X1,#8] .text:00000000003AB5A4 MOV X0, X5 .text:00000000003AB5A8 BL github_com_vishvananda_netlink_execGetLink .text:00000000003AB5AC LDP X29, X30, [SP,#0x120+var_128] .text:00000000003AB5B0 ADD SP, SP, #0x120 ``` 从以上片段可以得出以下结论 - 0x0000000000086ba4 runtime_goexit1 是 Go runtime 在销毁 goroutine 时的内部函数，说明有大量的goroutine创建和销毁 - 0x00000000004309f0 问题应该出在github_com_vishvananda_netlink__Handle_LinkByIndex这个函数 ## 验证 找到我们自己的代码  ``` case addrUpdate := <-addrCh: link, err = netlink.LinkByIndex(addrUpdate.LinkIndex) ``` 应该是上面这行代码导致的 用strace工具再次验证下 ``` strace -p $(pidof host_server) -f ``` 满屏的输出 ``` [pid 20362] <... epoll_ctl resumed>) = 0 [pid 575] <... epoll_pwait resumed>[], 128, 0, NULL, 0) = 0 [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] close(3) = 0 [pid 575] epoll_pwait(4, <unfinished ...> [pid 20362] socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) = 3 [pid 20362] fcntl(3, F_GETFL) = 0x2 (flags O_RDWR) [pid 20362] fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 [pid 20362] fcntl(3, F_GETFL <unfinished ...> [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] <... fcntl resumed>) = 0x802 (flags O_RDWR|O_NONBLOCK) [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] epoll_ctl(4, EPOLL_CTL_ADD, 3, {events=EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, data=0x7f6eb111fec2ad}) = 0 [pid 20362] bind(3, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...> [pid 575] <... epoll_pwait resumed>[{events=EPOLLOUT, data=0x7f6eb111fec2ad}], 128, 780, NULL, 0) = 1 [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] <... bind resumed>) = 0 [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] sendto(3, [{nlmsg_len=40, nlmsg_type=RTM_GETLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=3681469127, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [{nla_len=8, nla_type=IFLA_EXT_MASK}, RTEXT_FILTER_VF]], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...> [pid 575] epoll_pwait(4, <unfinished ...> [pid 20362] <... sendto resumed>) = 40 [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] getsockname(3, <unfinished ...> [pid 575] <... epoll_pwait resumed>[{events=EPOLLIN|EPOLLOUT, data=0x7f6eb111fec2ad}], 128, 0, NULL, 0) = 1 [pid 20362] <... getsockname resumed>{sa_family=AF_NETLINK, nl_pid=-1395142807, nl_groups=00000000}, [112 => 12]) = 0 [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 575] epoll_pwait(4, <unfinished ...> [pid 20362] recvfrom(3, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=3681469127, nlmsg_pid=-1395142807}, {error=-EINVAL, msg=[{nlmsg_len=40, nlmsg_type=RTM_GETLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=3681469127, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [{nla_len=8, nla_type=IFLA_EXT_MASK}, RTEXT_FILTER_VF]]}], 65536, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [112 => 12]) = 60 [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] epoll_ctl(4, EPOLL_CTL_DEL, 3, 0x40002a4850 <unfinished ...> [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] <... epoll_ctl resumed>) = 0 [pid 20362] close(3) = 0 [pid 20362] socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE <unfinished ...> [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] <... socket resumed>) = 3 [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] fcntl(3, F_GETFL) = 0x2 (flags O_RDWR) [pid 20362] fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 [pid 20362] fcntl(3, F_GETFL <unfinished ...> [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] <... fcntl resumed>) = 0x802 (flags O_RDWR|O_NONBLOCK) [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] epoll_ctl(4, EPOLL_CTL_ADD, 3, {events=EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, data=0x7f6eb111fec2ae}) = 0 [pid 575] <... epoll_pwait resumed>[{events=EPOLLOUT, data=0x7f6eb111fec2ae}], 128, 779, NULL, 0) = 1 [pid 20362] bind(3, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...> [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] <... bind resumed>) = 0 [pid 575] epoll_pwait(4, <unfinished ...> [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] sendto(3, [{nlmsg_len=40, nlmsg_type=RTM_GETLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=3681469128, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [{nla_len=8, nla_type=IFLA_EXT_MASK}, RTEXT_FILTER_VF]], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12 <unfinished ...> [pid 575] <... epoll_pwait resumed>[], 128, 0, NULL, 0) = 0 [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] <... sendto resumed>) = 40 [pid 575] epoll_pwait(4, <unfinished ...> [pid 20362] getsockname(3, <unfinished ...> [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] <... getsockname resumed>{sa_family=AF_NETLINK, nl_pid=-65674427, nl_groups=00000000}, [112 => 12]) = 0 [pid 575] <... epoll_pwait resumed>[{events=EPOLLIN|EPOLLOUT, data=0x7f6eb111fec2ae}], 128, 778, NULL, 0) = 1 [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] recvfrom(3, <unfinished ...> [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] <... recvfrom resumed>[{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=3681469128, nlmsg_pid=-65674427}, {error=-EINVAL, msg=[{nlmsg_len=40, nlmsg_type=RTM_GETLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=3681469128, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [{nla_len=8, nla_type=IFLA_EXT_MASK}, RTEXT_FILTER_VF]]}], 65536, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [112 => 12]) = 60 [pid 575] epoll_pwait(4, <unfinished ...> [pid 20362] epoll_ctl(4, EPOLL_CTL_DEL, 3, 0x40002a4850 <unfinished ...> [pid 572] <... nanosleep resumed>NULL) = 0 [pid 20362] <... epoll_ctl resumed>) = 0 [pid 575] <... epoll_pwait resumed>[], 128, 0, NULL, 0) = 0 [pid 20362] close(3 <unfinished ...> [pid 572] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...> [pid 20362] <... close resumed>) = 0 [pid 575] epoll_pwait(4, <unfinished ...> [pid 20362] socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) = 3 ``` 基本可以肯定是上面这行代码导致的 > case addrUpdate := <-addrCh: > link, err = netlink.LinkByIndex(addrUpdate.LinkIndex) # 结论 addrCh应该在什么场景下被close了，golang select 一个close的channel会导致立即返回，导致netlink.LinkByIndex(addrUpdate.LinkIndex)被无限调用，知道原因就好办了。
登录后可查看完整内容
传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！
#基础理论
#逆向分析
#程序开发
收藏
・
7
点赞
・
11
打赏
分享
分享到微信
分享到QQ
分享到微博
赞赏记录
参与人
雪币
留言
时间
mb_cdxbnqvh
感谢你的贡献，论坛因你而更加精彩！
2025-11-9 00:28
tech12_new
你的分享对大家帮助很大，非常感谢！
2025-10-16 16:33
mb_hadiqbct
你的分享对大家帮助很大，非常感谢！
2025-10-13 16:42
sinker_
你的分享对大家帮助很大，非常感谢！
2025-10-12 13:07
点中你的心
你的分享对大家帮助很大，非常感谢！
2025-10-10 11:55
路过1
非常支持你的观点！
2025-10-10 11:52
mb_shzsxtje
谢谢你的细致分析，受益匪浅！
2025-10-10 10:12
螺丝兔
为你点赞！
2025-10-10 10:09
Jackfuloo
为你点赞！
2025-10-9 17:40
我的小拇指啊
感谢你的积极参与，期待更多精彩内容！
2025-10-9 14:19
马来
你的分享对大家帮助很大，非常感谢！
2025-10-8 21:47
查看更多
赞赏
×
1 雪花
5 雪花
10 雪花
20 雪花
50 雪花
80 雪花
100 雪花
150 雪花
200 雪花
支付方式：
微信支付
赞赏留言：
快捷留言
感谢分享～
精品文章～
原创内容～
精彩转帖～
助人为乐～
感谢分享～
最新回复
(
3
)
qiluword
雪 币：
254
活跃值：
(654)
能力值：
( LV2，RANK：10 )
在线值：
发帖
52
回帖
227
粉丝
1
关注
私信
qiluword
2
楼
2025-10-10 09:36
0
IamHuskar
雪 币：
686
活跃值：
(7709)
能力值：
( LV13，RANK：240 )
在线值：
发帖
79
回帖
1686
粉丝
88
关注
私信
IamHuskar
4
3
楼
2025-10-14 11:06
0
mb_pgemecpo
雪 币：
1711
活跃值：
(1601)
能力值：
( LV2，RANK：10 )
在线值：
发帖
0
回帖
5
粉丝
0
关注
私信
mb_pgemecpo
4
楼
多少有点绕圈了 有源码还要动态调试
2025-10-16 20:50
0
游客
登录
|
注册
方可回帖
回帖
表情
雪币赚取及消费
高级回复
返回
hexdeep
2
发帖
1
回帖
10
RANK
关注
私信
他的文章
[原创]新人贴，记录工作中解决bug用到的逆向知识
11246
关于我们
联系我们
企业服务
看雪公众号
专注于PC、移动、智能设备安全研究及逆向工程的开发者社区
看原图
赞赏
×
雪币:
+
留言:
快捷留言
为你点赞！
返回
顶部
