problems about compiling tracecap source code

[courage]

first of all, thanks for pay attention to my problem.

I want to do achieve some functions based on the tracecap, so
I have downloaded the source codes of tracecap from the site
http://bitblaze.cs.berkeley.edu/release/index.html , before I'v been
working on my own functions, I have to compile the tracecap plugin
successfully first.

But my problem is the make procedure doesn't turn up any
error ,so I can get the tracecap.so ,but when I use command
load_plugin , it always failed with the hint "undefined symbol :
skip_taint_info", maybe it's because of the MakeFile, the Makefile I
use is based on the original Makefile from tracecap source code with
some little change.



The following is the procedure I compiled the tracecap ,I wish you can
point out my problem.

I downloaded the bitblaze-additional-2010-06.tar.gz from the
website above, after I unziped it , I copyed the folder named
tracecap(the path is /bitblaze/temu/tracecap) to the folder that I
have installed temu successfully (the path is ~/BitBlaze/temu-1.0/
test_plugin).

I downloaded the llconf-0.4.6 and installed it under the
acquiescent directory (/usr/local/lib and the header files path is /
usr/local/include/llconf). Although I have also downloaded the
sleuthkit, but I didn't use it. So, the Makefile I use is as
following:

------------------------------------------------------------------------------------------------------------
include ../../config-host.mak

DEFINES=-I. -I.. -I../.. -I$(SRC_PATH) -I$(SRC_PATH)/shared -I$
(SRC_PATH)/slirp -I$(SRC_PATH)/shared/hooks -I$(SRC_PATH)/i386-softmmu
-I$(SRC_PATH)/target-i386 -I$(SRC_PATH)/fpu
DEFINES+=-D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_GNU_SOURCE
DEFINES+=-I/usr/local/include/llconf
#DEFINES+=-I$(SRC_PATH)/shared/sleuthkit/src/fstools -I$(SRC_PATH)/
shared/sleuthkit/src/auxtools -I$(SRC_PATH)/shared/sleuthkit/src/
imgtools -DLINUX2 -DTRACE_ENABLED

CC=gcc
CPP=g++
CFLAGS=-Wall -O2 -g -fPIC -MMD
# CFLAGS=-Wall -g -fPIC
LDFLAGS=-g -Wl -shared
#LIBS=-L$(SRC_PATH)/shared/sleuthkit/lib -lfstools -limgtools -
lauxtools
#LIBS+=-L$(SRC_PATH)/shared/sleuthkit/src/afflib/lib/ -lafflib -L$
(SRC_PATH)/shared/sleuthkit/src/libewf -lewf
LIBS=-L/usr/local/lib -lllconf
LIBS+=-lcrypto

ifeq ($(ARCH), x86_64)
LIBS+=-L$(SRC_PATH)/shared/xed2/xed2-intel64/lib -lxed
DEFINES+= -I$(SRC_PATH)/shared/xed2/xed2-intel64/include
endif
ifeq ($(ARCH), i386)
LIBS+=-L$(SRC_PATH)/shared/xed2/xed2-ia32/lib -lxed
DEFINES+= -I$(SRC_PATH)/shared/xed2/xed2-ia32/include
endif

OBJS=state.o commands.o trace.o operandinfo.o conditions.o network.o
errdet.o conf.o ext_hooks.o hook_helpers.o readwrite.o tracecap.o
OBJS+=../../shared/procmod.o ../../shared/read_linux.o
OBJS+=../../shared/reduce_taint.o ../../shared/hookapi.o
OBJS+=../../shared/hooks/function_map.o
OBJS+=../../shared/hooks/hook_plugin_loader.o

all: test_tracecap.so ini/main.ini

#sleuthkit:
# $(MAKE) -C $(SRC_PATH)/shared/sleuthkit

hooks:
$(MAKE) -C $(SRC_PATH)/shared/hooks/hook_plugins protos_hooks

ini/main.ini: ini/main.ini.in
@perl -pe 's[SRC_PATH][$(SRC_PATH)]g' $< >$@

%.o: %.c
$(CC) $(CFLAGS) $(DEFINES) -c -o $@ $<

%.o: %.cpp
$(CPP) $(CFLAGS) $(DEFINES) -c -o $@ $<

test_tracecap.so: $(OBJS)
$(CPP) $(LDFLAGS) $^ -o $@ $(LIBS)
# ar cru libtracecap.a $@

#tracecap-static.so: $(OBJS)
# $(CPP) -static-libgcc -Wl,-static $(LDFLAGS) $^ -o $@ $(LIBS)

clean:
rm -f *.o *.a *~ $(PLUGIN) ../../shared/*.o ../../shared/hooks/*.o
*.d ../../*.d ../../shared/*d ../../shared/*/*.d ini/main.ini

# Include automatically generated dependency files
-include $(wildcard *.d ../../*.d ../../shared/*d ../../shared/*/*.d)

----------------------------------------------------------------------------------------------------------------
I hope my description is enough for you to help me find out the
problem.
Thank you~

[Stephen McCamant]

>>>>> "C" == courage <yyq19...@gmail.com> writes:

C> first of all, thanks for pay attention to my problem.

C> I want to do achieve some functions based on the tracecap,
C> so I have downloaded the source codes of tracecap from the site
C> http://bitblaze.cs.berkeley.edu/release/index.html , before I'v
C> been working on my own functions, I have to compile the tracecap
C> plugin successfully first.

C> But my problem is the make procedure doesn't turn up any
C> error ,so I can get the tracecap.so ,but when I use command
C> load_plugin , it always failed with the hint "undefined symbol :
C> skip_taint_info", maybe it's because of the MakeFile, the Makefile
C> I use is based on the original Makefile from tracecap source code
C> with some little change.

I think the problem is that you commented out the -DTRACE_ENABLED
option in the Makefile.

Because it's a dynamically loaded library some of whose symbols will
come from TEMU, linking problems in tracecap.so aren't reported until
load-time, as you observe. But it sounds like the root of the problem
is coming from the compilation and linking stages.

The symbol "skip_taint_info" is supposed to be defined as a variable
in the file tracecap.c. The declaration appears on line 37 in the
copy of tracecap.c distributed in the additional source code
release. You should be able to see the definition in the .o file, as
well as in the final .so:

% nm tracecap.o | fgrep skip_taint_info
0000000000000104 B skip_taint_info
% nm tracecap.so | fgrep skip_taint_info
00000000004411c4 B skip_taint_info

The definition is guarded by an "#if TRACE_ENABLED" condition, which
is supposed to be defined by that compiler command-line option.

Hope this helps,

-- Stephen

[courage]

thank you very much.

As you said ,the problem is that I commented out the -DTRACE_ENABLED  option in the Makefile.

Because of this option is added to the "DEFINES" right after sleuthkit-related files, so I haved thought it's related to the DISK-related operations.

Now , the file "tracecap.so" can be loaded successfully in my environment.

thanks very much, thank you.

best wishes~~~

在 2013年3月21日星期四UTC+8上午11时25分16秒，courage写道：