C 指针转换

Question

I am trying to print the first byte if a function in the Kernel. The function I want to print is 'filldir'. I found it in the kernel using /proc/kallsyms

it's code is (address is ffffffff812e6020 ) -

    ffffffff812e6020:       e8 0b b9 91 00          callq  0xffffffff81c01930
    ffffffff812e6025:       55                      push   %rbp
    ffffffff812e6026:       48 89 e5                mov    %rsp,%rbp
    ffffffff812e6029:       41 57                   push   %r15

I found the same address (I think so) using this code in my kernel module -

    typedef unsigned long psize;
    (psize *) filldir;

    filldir= (void *)kallsyms_lookup_name("filldir");
    printk("rooty: sys_call_table found at %p\n", filldir);

and got - 000000001663973a , I don't know why there is a difference, I tried casting it to long and unsigned long but the result is same.

so my first question is, why there is a difference ? I am pretty sure that it's the same address that is just printed in different way ... how can I get the right value ?

My second question , I am trying to print the first byte of the function ( e8 ), but I have no idea how to do that.

i tried these options -

    printk("%x", *filldir);
    printk("%x", *(unsigned char*)filldir); 
    printk("%x", (unsigned char*)filldir[0]); 

but none of them worked, never got e8 .

How can I print the first byte of a function when I have the pointer to the function?

Answer 1

Regarding to your first question (why the difference), %p format specifier is hashed before being printed to prevent address leaking. Right format is %px [1]. Casting the parameters outside of the format string is not going to affect that.

Regarding the second one, the second option should be the valid one. The other ones could work in some environments but is not defined what they should do.

You can try in userland:

#include <stdio.h>

int square(int num) {
    return num * num;
}

int main() {
    printf("%x\n", *(unsigned char *)square);
    return 0;
}

[1] https://www.kernel.org/doc/html/latest/core-api/printk-formats.html