0

I looking in ida on arm linux binary . I can see there that there is ioctl call

ioctl(fd,req,num).

fd is fd to /dev/module. ,req is some 4bytes and num is some number.

How can I understand what this ioctl call do?

What req number mean?

Where can I find the handle of this ioctl?

  • You should study a bit that syscall, in general ioctl is for access drivers, and is very dependent of the driver, in your case /dev/module, do a man ioctl and you will understand better how works, there is plenty of information about it, just google it – camp0 Jun 14 at 20:04
1

You need to find the driver (either a separate binary or built-in into the kernel) which publishes this dev file entry, the code to handle the ioctl request will be in it.

Here’s an article with an example of ioctl handler:

https://opensourceforu.com/2011/08/io-control-in-linux/

String search for the file name may be the quickest way to do find the required binary/code area.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.