dump vdso

read_vdso.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/auxv.h>
#include <unistd.h>

static void *find_vdso_start_address(void)
{
	return (void *) getauxval(AT_SYSINFO_EHDR);
}

static long get_page_size(void)
{
	return sysconf(_SC_PAGESIZE);
}

static void write_buf(char *buf, size_t size)
{
	FILE *fp;

	fp = fopen("vdso_dump.so", "wb");
	if (!fp) {
		perror("fopen");
		exit(-1);
	}

	fwrite(buf, size, 1, fp);

	fclose(fp);
}

int main(int argc, char **argv)
{
	int npages = 2;
	char *buf;

	if (argc == 2)
		npages = atoi(argv[1]);

	printf("[*]read %d pages\n", npages);

	long buf_size = get_page_size() * npages;
	buf = malloc(buf_size);
	memset(buf, 0x0, buf_size);

	void *vdso = find_vdso_start_address();

	printf("[*]vdso start address is %p\n", vdso);

	memcpy(buf, vdso, buf_size);

	printf("[*]write data\n");
	write_buf(buf, buf_size);

	free(buf);

	printf("[*]Done.\n");
	return 0;
}