0

I looking in ida on arm linux binary . I can see there that there is ioctl call

ioctl(fd,req,num).

fd is fd to /dev/module. ,req is some 4bytes and num is some number.

How can I understand what this ioctl call do?

What req number mean?

Where can I find the handle of this ioctl?

Improve this question
1
  • You should study a bit that syscall, in general ioctl is for access drivers, and is very dependent of the driver, in your case /dev/module, do a man ioctl and you will understand better how works, there is plenty of information about it, just google it
    – camp0
    Commented Jun 14, 2019 at 20:04

1 Answer 1

Reset to default
1

You need to find the driver (either a separate binary or built-in into the kernel) which publishes this dev file entry, the code to handle the ioctl request will be in it.

Here’s an article with an example of ioctl handler:

https://opensourceforu.com/2011/08/io-control-in-linux/

String search for the file name may be the quickest way to do find the required binary/code area.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.