⬢ DragonFlyBSD Kernel Audit
DF-3439 / kfdump.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
/*
 * kfdump.c - dump ipfw3 filter_funcs row 0 via libkvm (/dev/kmem)
 * usage: kfdump [row]
 */
#include <sys/param.h>
#include <sys/types.h>
#include <fcntl.h>
#include <kvm.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define MAX_MODULE 10
#define MAX_OPCODE_PER_MODULE 100

int
main(int argc, char **argv)
{
	kvm_t *kd;
	struct nlist nl[8];
	unsigned long (*fa)[MAX_OPCODE_PER_MODULE];
	long addr;
	int row = (argc > 1) ? atoi(argv[1]) : 0;
	int i;
	static unsigned long buf[MAX_MODULE * MAX_OPCODE_PER_MODULE];

	memset(nl, 0, sizeof(nl));
	nl[0].n_name = "filter_funcs";
	nl[1].n_name = "check_proto";
	nl[2].n_name = "check_deny";
	nl[3].n_name = "check_accept";
	nl[4].n_name = "check_skipto";

	kd = kvm_openfiles(NULL, NULL, NULL, O_RDONLY, NULL);
	if (kd == NULL) {
		fprintf(stderr, "kvm_openfiles: %s\n", kvm_geterr(kd));
		return 1;
	}
	if (kvm_nlist(kd, nl) < 0 || nl[0].n_value == 0) {
		fprintf(stderr, "nlist: %s\n", kvm_geterr(kd));
		return 1;
	}
	printf("filter_funcs @ 0x%lx\n", (unsigned long)nl[0].n_value);
	for (i = 1; i <= 4; i++)
		if (nl[i].n_value)
			printf("%-14s @ 0x%lx\n", nl[i].n_name,
			    (unsigned long)nl[i].n_value);

	addr = nl[0].n_value;
	if (kvm_read(kd, addr, buf, sizeof(buf)) != sizeof(buf)) {
		fprintf(stderr, "kvm_read: %s\n", kvm_geterr(kd));
		return 1;
	}
	fa = (unsigned long (*)[MAX_OPCODE_PER_MODULE])buf;
	printf("row %d:\n", row);
	for (i = 0; i < MAX_OPCODE_PER_MODULE; i++) {
		if (fa[row][i] == 0)
			continue;
		printf("  [%d] = 0x%lx\n", i, (unsigned long)fa[row][i]);
	}
	return 0;
}