3

I want to kprobe the function that maps new files onto the memory, but i'm having difficulty finding the function that checks if the file descriptor is already loaded.

I tried hooking the mmap syscall but that's not really helping because I get already mapped files like libc.so.

I can't seem to figure out if it's filesystem related or memory related, I looked in both places and can't find where it happens.

lys
  • 53
  • 1
  • 6

1 Answers1

0

The inode is a kernel-private object. The kernel does not use libc.so. User level programs (which may use libc.so) cannot directly reference inodes; instead they have a process local identifier (a file descriptor) which the kernel knows how to translate to the appropriate structure.

So, you are looking in the wrong place.

mevets
  • 10,070
  • 1
  • 21
  • 33