mirror of
https://github.com/cirosantilli/linux-kernel-module-cheat.git
synced 2026-01-23 10:15:57 +01:00
Use busybox devmem
This commit is contained in:
@@ -1,106 +0,0 @@
|
||||
/*
|
||||
Adapted from: http://free-electrons.com/pub/mirror/devmem2.c
|
||||
|
||||
Forked because of the unpredictable access widths:
|
||||
https://bugs.busybox.net/show_bug.cgi?id=10171
|
||||
*/
|
||||
|
||||
#include <ctype.h>
|
||||
#include <errno.h>
|
||||
#include <fcntl.h>
|
||||
#include <signal.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/mman.h>
|
||||
#include <sys/types.h>
|
||||
#include <termios.h>
|
||||
#include <unistd.h>
|
||||
|
||||
#define FATAL do { fprintf(stderr, "Error at line %d, file %s (%d) [%s]\n", \
|
||||
__LINE__, __FILE__, errno, strerror(errno)); exit(1); } while(0)
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
int access_type = 'w';
|
||||
unsigned long map_size, map_mask;
|
||||
off_t target;
|
||||
uintmax_t read_result, writeval;
|
||||
int fd;
|
||||
void *map_base, *virt_addr;
|
||||
|
||||
map_size = sysconf(_SC_PAGE_SIZE);
|
||||
map_mask = map_size - 1;
|
||||
if(argc < 2) {
|
||||
fprintf(stderr, "\nUsage:\t%s { address } [ type [ data ] ]\n"
|
||||
"\taddress : memory address to act upon\n"
|
||||
"\ttype : access operation type : [b]yte, [h]alfword, [w]ord\n"
|
||||
"\tdata : data to be written\n\n",
|
||||
argv[0]);
|
||||
exit(1);
|
||||
}
|
||||
target = strtoul(argv[1], 0, 0);
|
||||
|
||||
if(argc > 2)
|
||||
access_type = tolower(argv[2][0]);
|
||||
|
||||
|
||||
if((fd = open("/dev/mem", O_RDWR | O_SYNC)) == -1) FATAL;
|
||||
printf("/dev/mem opened.\n");
|
||||
fflush(stdout);
|
||||
|
||||
/* Map one page */
|
||||
map_base = mmap(0, map_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, target & ~map_mask);
|
||||
if(map_base == (void *) -1) FATAL;
|
||||
printf("Memory mapped at address %p.\n", map_base);
|
||||
fflush(stdout);
|
||||
|
||||
virt_addr = map_base + (target & map_mask);
|
||||
switch(access_type) {
|
||||
case 'b':
|
||||
read_result = *((uint8_t *) virt_addr);
|
||||
break;
|
||||
case 'h':
|
||||
read_result = *((uint16_t *) virt_addr);
|
||||
break;
|
||||
case 'w':
|
||||
read_result = *((uint32_t *) virt_addr);
|
||||
break;
|
||||
case 'q':
|
||||
read_result = *((uint64_t *) virt_addr);
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "Illegal data type '%c'.\n", access_type);
|
||||
exit(2);
|
||||
}
|
||||
printf("Value at address 0x%jX (%p): 0x%jX\n", (uintmax_t)target, virt_addr, (uintmax_t)read_result);
|
||||
fflush(stdout);
|
||||
|
||||
if(argc > 3) {
|
||||
writeval = strtoul(argv[3], 0, 0);
|
||||
switch(access_type) {
|
||||
case 'b':
|
||||
*((uint8_t *) virt_addr) = writeval;
|
||||
read_result = *((uint8_t *) virt_addr);
|
||||
break;
|
||||
case 'h':
|
||||
*((uint16_t *) virt_addr) = writeval;
|
||||
read_result = *((uint16_t *) virt_addr);
|
||||
break;
|
||||
case 'w':
|
||||
*((uint32_t *) virt_addr) = writeval;
|
||||
read_result = *((uint32_t *) virt_addr);
|
||||
break;
|
||||
case 'q':
|
||||
*((uint64_t *) virt_addr) = writeval;
|
||||
read_result = *((uint64_t *) virt_addr);
|
||||
break;
|
||||
}
|
||||
printf("Written 0x%jX; readback 0x%jX\n", (uintmax_t)writeval, (uintmax_t)read_result);
|
||||
fflush(stdout);
|
||||
}
|
||||
|
||||
if(munmap(map_base, map_size) == -1) FATAL;
|
||||
close(fd);
|
||||
return 0;
|
||||
}
|
||||
@@ -48,7 +48,7 @@ see: https://stackoverflow.com/questions/11891979/how-to-access-mmaped-dev-mem-w
|
||||
|
||||
Then:
|
||||
|
||||
devmem2 0x7c7b800
|
||||
devmem 0x7c7b800
|
||||
|
||||
Possible output:
|
||||
|
||||
@@ -60,7 +60,7 @@ to our physical address and given to the process that mapped /dev/mem.
|
||||
|
||||
And finally, let's change the value!
|
||||
|
||||
devmem2 0x7c7b800 w 0x9abcdef0
|
||||
devmem 0x7c7b800 w 0x9abcdef0
|
||||
|
||||
After one second, we see on the screen:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user