文章总结： 文章讲述了作者使用逆向工程方法解决Golang程序CPU占用过高问题的过程。通过IDA、go_parser、perf和strace等工具，作者定位到问题出现在netlink.LinkByIndex函数的无限调用，原因是通道被关闭后select语句立即返回导致循环。文章展示了在无调试信息情况下如何通过逆向分析定位性能问题的实用技巧，提供了具体的工具使用方法和代码示例，对类似问题的解决有很好的参考价值。
综合评分： 91
文章分类： 逆向分析,二进制安全,安全工具,应用安全,其他

记录工作中解决bug用到的逆向知识

hexdeep

看雪学苑

2025年11月4日 17:59
上海

问题现象

在使用rk3588开发云手机过程中，有部分核心板随机出现hostserver进程占用cpu过高问题。

因为golang编译时候去除了调试信息，没有加上pprof，无法看到goroutine的工作状态，同时hostserver进程为服务进程。

kill&nbsp;-QUIT $(pidof host_server)

无法使用上面命令打印堆栈

同时环境不容易复现，无法通过反复修改代码来验证问题，只能在不破坏环境的情况下，尽可能多收集信息，然后定位问题。

分析过程

分析工具

◆ida7.5

◆https://github.com/0xjiayu/go_parser

◆strace

◆perf

环境配置

打开ida，导入goparser

太清晰了，简直就是明文[呲牙]，以后用golang写程序要上加壳了

perf record -F 99 -p $(pidof host_server) -g --&nbsp;sleep&nbsp;30

如果出现以上错误执行以下命令：

echo&nbsp;1 > /proc/sys/kernel/kptr_restrict

运行查看结果

perf report

Samples: 1K of event 'cycles:P', Event count (approx.): 24575912110
&nbsp; Children &nbsp; &nbsp; &nbsp;Self &nbsp;Command &nbsp; &nbsp; &nbsp;Shared Object &nbsp; &nbsp; &nbsp;Symbol
+ &nbsp; 50.49% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x0000000000086ba4
+ &nbsp; 42.66% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000004309f0
+ &nbsp; 42.25% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000003ab5ac
+ &nbsp; 42.07% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000003ab5f4
+ &nbsp; 41.87% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000003a5f2c
+ &nbsp; 37.75% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] el0t_64_sync
+ &nbsp; 37.75% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] el0t_64_sync_handler
+ &nbsp; 36.42% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x000000000008485c
+ &nbsp; 30.67% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] el0_svc
+ &nbsp; 27.78% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] do_el0_svc
+ &nbsp; 27.72% &nbsp; &nbsp; 1.95% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] el0_svc_common.constprop.0
+ &nbsp; 25.63% &nbsp; &nbsp; 0.06% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] invoke_syscall
+ &nbsp; 25.23% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000000190a0
+ &nbsp; 17.42% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000000ca99b
+ &nbsp; 15.47% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x000000000002d914
+ &nbsp; 15.28% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000003a63c8
+ &nbsp; 14.77% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x0000000000031884
+ &nbsp; 11.29% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000000548c4
+ &nbsp; 11.11% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000003a6248
+ &nbsp; 11.01% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x000000000002445c
+ &nbsp; 10.55% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000000847c4
+ &nbsp; &nbsp;9.54% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000003a765c
+ &nbsp; &nbsp;9.54% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x000000000007ce70
+ &nbsp; &nbsp;9.46% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x0000000000054dc0
+ &nbsp; &nbsp;8.59% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x0000000000024018
+ &nbsp; &nbsp;8.53% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000000243d3
+ &nbsp; &nbsp;8.50% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000003a62fc
+ &nbsp; &nbsp;8.23% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000000cb4fc
+ &nbsp; &nbsp;7.97% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x000000000002d8e8
+ &nbsp; &nbsp;7.70% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000000caa7c
+ &nbsp; &nbsp;7.52% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x0000000000087430
+ &nbsp; &nbsp;7.01% &nbsp; &nbsp; 0.18% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] el0_da
+ &nbsp; &nbsp;6.89% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x0000000000031ae4
+ &nbsp; &nbsp;6.73% &nbsp; &nbsp; 0.07% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] do_mem_abort
+ &nbsp; &nbsp;6.72% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000003a741c
+ &nbsp; &nbsp;6.72% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000000ee794
+ &nbsp; &nbsp;6.71% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x000000000002aff8
+ &nbsp; &nbsp;6.66% &nbsp; &nbsp; 0.10% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] do_translation_fault
+ &nbsp; &nbsp;6.50% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000000e54d4
+ &nbsp; &nbsp;6.50% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x00000000003a752c
+ &nbsp; &nbsp;6.46% &nbsp; &nbsp; 0.08% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] do_page_fault
+ &nbsp; &nbsp;6.44% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x0000000000163d94
+ &nbsp; &nbsp;6.44% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;host_server &nbsp; &nbsp; &nbsp; &nbsp;[.] 0x000000000016522c
+ &nbsp; &nbsp;6.07% &nbsp; &nbsp; 0.07% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] __arm64_sys_sendto
+ &nbsp; &nbsp;6.00% &nbsp; &nbsp; 0.00% &nbsp;host_server &nbsp;[kernel.kallsyms] &nbsp;[k] __sys_sendto

现在我们已经知道消耗cpu的代码地址，0x0000000000086ba4 0x00000000004309f0 0x00000000003ab5ac

0x0000000000086ba4 代码：

.text:0000000000086BA0 ; =============== S U B R O U T I N E =======================================
.text:0000000000086BA0
.text:0000000000086BA0 ; Attributes: noreturn
.text:0000000000086BA0
.text:0000000000086BA0 runtime_goexit &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; DATA XREF: runtime_oneNewExtraM+38↑o
.text:0000000000086BA0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; runtime_newproc1+E0↑o
.text:0000000000086BA0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X0, X0
.text:0000000000086BA4
.text:0000000000086BA4 loc_86BA4
.text:0000000000086BA4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BL &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;runtime_goexit1_0

0x00000000004309f0 代码：

.text:00000000004309D4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SUB &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X29, SP,&nbsp;#0x18
.text:00000000004309D8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BL &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;sub_87260
.text:00000000004309DC
.text:00000000004309DC loc_4309DC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; DATA XREF: host_server_netlink__Netlink_Init_func1+10C↑o
.text:00000000004309DC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SUB &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X29, SP,&nbsp;#8
.text:00000000004309E0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LDR &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X1, [SP,#0x250+var_150]
.text:00000000004309E4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADRP &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;X27,&nbsp;#off_AD3828@PAGE
.text:00000000004309E8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LDR &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X0, [X27,#off_AD3828@PAGEOFF]
.text:00000000004309EC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BL &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;github_com_vishvananda_netlink__Handle_LinkByIndex
.text:00000000004309F0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CBNZ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;X2, loc_4309FC
.text:00000000004309F4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X4, XZR

0x00000000003ab5ac 代码：

.text:00000000003AB59C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; STR &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X2, [X25,#8]
.text:00000000003AB5A0
.text:00000000003AB5A0 loc_3AB5A0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; CODE XREF: github_com_vishvananda_netlink__Handle_LinkByIndex+29C↑j
.text:00000000003AB5A0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; STR &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X0, [X1,#8]
.text:00000000003AB5A4 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X0, X5
.text:00000000003AB5A8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; BL &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;github_com_vishvananda_netlink_execGetLink
.text:00000000003AB5AC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LDP &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X29, X30, [SP,#0x120+var_128]
.text:00000000003AB5B0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ADD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SP, SP,&nbsp;#0x120

从以上片段可以得出以下结论

◆0x0000000000086ba4

runtime_goexit1 是 Go runtime 在销毁 goroutine 时的内部函数，说明有大量的goroutine创建和销毁

◆0x00000000004309f0

问题应该出在github_com_vishvananda_netlink__Handle_LinkByIndex这个函数

验证

找到我们自己的代码

case&nbsp;addrUpdate := <-addrCh:
link, err = netlink.LinkByIndex(addrUpdate.LinkIndex)

应该是上面这行代码导致的

用strace工具再次验证下

strace -p $(pidof host_server) -f

满屏的输出

[pid 20362] <... epoll_ctl resumed>) &nbsp; &nbsp;=&nbsp;0
[pid &nbsp; 575] <... epoll_pwait resumed>[],&nbsp;128,&nbsp;0, NULL,&nbsp;0) =&nbsp;0
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] close(3) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;0
[pid &nbsp; 575] epoll_pwait(4, &nbsp;<unfinished ...>
[pid 20362] socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) =&nbsp;3
[pid 20362] fcntl(3, F_GETFL) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;0x2&nbsp;(flags O_RDWR)
[pid 20362] fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) =&nbsp;0
[pid 20362] fcntl(3, F_GETFL <unfinished ...>
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] <... fcntl resumed>) &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;0x802&nbsp;(flags O_RDWR|O_NONBLOCK)
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] epoll_ctl(4, EPOLL_CTL_ADD,&nbsp;3, {events=EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, data=0x7f6eb111fec2ad}) =&nbsp;0
[pid 20362] bind(3, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000},&nbsp;12&nbsp;<unfinished ...>
[pid &nbsp; 575] <... epoll_pwait resumed>[{events=EPOLLOUT, data=0x7f6eb111fec2ad}],&nbsp;128,&nbsp;780, NULL,&nbsp;0) =&nbsp;1
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] <... bind resumed>) &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;0
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] sendto(3, [{nlmsg_len=40, nlmsg_type=RTM_GETLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=3681469127, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [{nla_len=8, nla_type=IFLA_EXT_MASK}, RTEXT_FILTER_VF]],&nbsp;40,&nbsp;0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000},&nbsp;12&nbsp;<unfinished ...>
[pid &nbsp; 575] epoll_pwait(4, &nbsp;<unfinished ...>
[pid 20362] <... sendto resumed>) &nbsp; &nbsp; &nbsp; =&nbsp;40
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] getsockname(3, &nbsp;<unfinished ...>
[pid &nbsp; 575] <... epoll_pwait resumed>[{events=EPOLLIN|EPOLLOUT, data=0x7f6eb111fec2ad}],&nbsp;128,&nbsp;0, NULL,&nbsp;0) =&nbsp;1
[pid 20362] <... getsockname resumed>{sa_family=AF_NETLINK, nl_pid=-1395142807, nl_groups=00000000}, [112&nbsp;=>&nbsp;12]) =&nbsp;0
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid &nbsp; 575] epoll_pwait(4, &nbsp;<unfinished ...>
[pid 20362] recvfrom(3, [{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=3681469127, nlmsg_pid=-1395142807}, {error=-EINVAL, msg=[{nlmsg_len=40, nlmsg_type=RTM_GETLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=3681469127, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [{nla_len=8, nla_type=IFLA_EXT_MASK}, RTEXT_FILTER_VF]]}],&nbsp;65536,&nbsp;0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [112&nbsp;=>&nbsp;12]) =&nbsp;60
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] epoll_ctl(4, EPOLL_CTL_DEL,&nbsp;3,&nbsp;0x40002a4850&nbsp;<unfinished ...>
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] <... epoll_ctl resumed>) &nbsp; &nbsp;=&nbsp;0
[pid 20362] close(3) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;0
[pid 20362] socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE <unfinished ...>
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] <... socket resumed>) &nbsp; &nbsp; &nbsp; =&nbsp;3
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] fcntl(3, F_GETFL) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;0x2&nbsp;(flags O_RDWR)
[pid 20362] fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) =&nbsp;0
[pid 20362] fcntl(3, F_GETFL <unfinished ...>
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] <... fcntl resumed>) &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;0x802&nbsp;(flags O_RDWR|O_NONBLOCK)
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] epoll_ctl(4, EPOLL_CTL_ADD,&nbsp;3, {events=EPOLLIN|EPOLLOUT|EPOLLRDHUP|EPOLLET, data=0x7f6eb111fec2ae}) =&nbsp;0
[pid &nbsp; 575] <... epoll_pwait resumed>[{events=EPOLLOUT, data=0x7f6eb111fec2ae}],&nbsp;128,&nbsp;779, NULL,&nbsp;0) =&nbsp;1
[pid 20362] bind(3, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000},&nbsp;12&nbsp;<unfinished ...>
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] <... bind resumed>) &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;0
[pid &nbsp; 575] epoll_pwait(4, &nbsp;<unfinished ...>
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] sendto(3, [{nlmsg_len=40, nlmsg_type=RTM_GETLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=3681469128, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [{nla_len=8, nla_type=IFLA_EXT_MASK}, RTEXT_FILTER_VF]],&nbsp;40,&nbsp;0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000},&nbsp;12&nbsp;<unfinished ...>
[pid &nbsp; 575] <... epoll_pwait resumed>[],&nbsp;128,&nbsp;0, NULL,&nbsp;0) =&nbsp;0
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] <... sendto resumed>) &nbsp; &nbsp; &nbsp; =&nbsp;40
[pid &nbsp; 575] epoll_pwait(4, &nbsp;<unfinished ...>
[pid 20362] getsockname(3, &nbsp;<unfinished ...>
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] <... getsockname resumed>{sa_family=AF_NETLINK, nl_pid=-65674427, nl_groups=00000000}, [112&nbsp;=>&nbsp;12]) =&nbsp;0
[pid &nbsp; 575] <... epoll_pwait resumed>[{events=EPOLLIN|EPOLLOUT, data=0x7f6eb111fec2ae}],&nbsp;128,&nbsp;778, NULL,&nbsp;0) =&nbsp;1
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] recvfrom(3, &nbsp;<unfinished ...>
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] <... recvfrom resumed>[{nlmsg_len=60, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=3681469128, nlmsg_pid=-65674427}, {error=-EINVAL, msg=[{nlmsg_len=40, nlmsg_type=RTM_GETLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=3681469128, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [{nla_len=8, nla_type=IFLA_EXT_MASK}, RTEXT_FILTER_VF]]}],&nbsp;65536,&nbsp;0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, [112&nbsp;=>&nbsp;12]) =&nbsp;60
[pid &nbsp; 575] epoll_pwait(4, &nbsp;<unfinished ...>
[pid 20362] epoll_ctl(4, EPOLL_CTL_DEL,&nbsp;3,&nbsp;0x40002a4850&nbsp;<unfinished ...>
[pid &nbsp; 572] <... nanosleep resumed>NULL) =&nbsp;0
[pid 20362] <... epoll_ctl resumed>) &nbsp; &nbsp;=&nbsp;0
[pid &nbsp; 575] <... epoll_pwait resumed>[],&nbsp;128,&nbsp;0, NULL,&nbsp;0) =&nbsp;0
[pid 20362] close(3&nbsp;<unfinished ...>
[pid &nbsp; 572] nanosleep({tv_sec=0, tv_nsec=20000}, &nbsp;<unfinished ...>
[pid 20362] <... close resumed>) &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;0
[pid &nbsp; 575] epoll_pwait(4, &nbsp;<unfinished ...>
[pid 20362] socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) =&nbsp;3

基本可以肯定是上面这行代码导致的

case addrUpdate := <-addrCh:
link, err = netlink.LinkByIndex(addrUpdate.LinkIndex)

结论

addrCh应该在什么场景下被close了，golang select 一个close的channel会导致立即返回，导致netlink.LinkByIndex(addrUpdate.LinkIndex)被无限调用，知道原因就好办了。

看雪ID：hexdeep

https://bbs.kanxue.com/user-home-974190.htm

*本文为看雪论坛优秀文章，由 hexdeep 原创，转载请注明来自看雪社区

往期推荐

V8 Bytecode反汇编/反编译不完全指南

静态程序分析之数据流分析(Foundations + LiveVar Analysis Code)续

tt x-gorgon分析

基于Minifilter实现目录保护软件，自定义保护目录，用户可选择是否允许文件行为

一道简单的RE迷宫题

球分享

球点赞

球在看

点击阅读原文查看更多

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：看雪学苑 hexdeep《记录工作中解决bug用到的逆向知识》

Tags: 二进制安全其他安全工具应用安全逆向分析

你可能错过

小赚3万元，中秋假期，帮老舅私有化部署工业园区楼宇智能化方案，智能安防、能源管理、楼宇自动化、智能办公、数据驾驶舱大屏

(10分) CVE-2026-102240：Netcore AP未认证命令注入，一条GET拿root

电子取证大事记（2026年9月21日 — 9月27日）

国家标准化指导性技术文件《基于用户体验的互联网政务应用服务能力评价》制定启动会在京召开