1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/resource.h>
#include <sys/wait.h>
#include <errno.h>
#include <stdio.h>
#include "i386.h"
#include "ltrace.h"
void insert_breakpoint(int pid, unsigned long addr, unsigned char * value)
{
int a;
a = ptrace(PTRACE_PEEKTEXT, pid, addr, 0);
value[0] = a & 0xFF;
a &= 0xFFFFFF00;
a |= 0xCC;
ptrace(PTRACE_POKETEXT, pid, addr, a);
}
void delete_breakpoint(int pid, unsigned long addr, unsigned char * value)
{
int a;
a = ptrace(PTRACE_PEEKTEXT, pid, addr, 0);
a &= 0xFFFFFF00;
a |= value[0];
ptrace(PTRACE_POKETEXT, pid, addr, a);
}
unsigned long get_eip(int pid)
{
unsigned long eip;
eip = ptrace(PTRACE_PEEKUSER, pid, 4*EIP, 0);
return eip-1; /* Length of breakpoint (0xCC) is 1 byte */
}
unsigned long get_esp(int pid)
{
unsigned long esp;
esp = ptrace(PTRACE_PEEKUSER, pid, 4*UESP, 0);
return esp;
}
unsigned long get_orig_eax(int pid)
{
return ptrace(PTRACE_PEEKUSER, pid, 4*ORIG_EAX);
}
unsigned long get_return(int pid, unsigned long esp)
{
return ptrace(PTRACE_PEEKTEXT, pid, esp, 0);
}
unsigned long get_arg(int pid, unsigned long esp, int arg_num)
{
return ptrace(PTRACE_PEEKTEXT, pid, esp+4*arg_num);
}
int is_there_a_breakpoint(int pid, unsigned long eip)
{
int a;
a = ptrace(PTRACE_PEEKTEXT, pid, eip, 0);
if ((a & 0xFF) == 0xCC) {
return 1;
} else {
return 0;
}
}
void continue_process(int pid, int signal)
{
ptrace(PTRACE_SYSCALL, pid, 1, signal);
}
void continue_after_breakpoint(int pid, unsigned long eip, unsigned char * value, int delete_it)
{
delete_breakpoint(pid, eip, value);
ptrace(PTRACE_POKEUSER, pid, 4*EIP, eip);
if (delete_it) {
continue_process(pid, 0);
} else {
int status;
ptrace(PTRACE_SINGLESTEP, pid, 0, 0);
pid = wait4(pid, &status, 0, NULL);
if (pid==-1) {
perror("wait4");
exit(1);
}
insert_breakpoint(pid, eip, value);
continue_process(pid, 0);
}
}
void trace_me(void)
{
if (ptrace(PTRACE_TRACEME, 0, 1, 0)<0) {
perror("PTRACE_TRACEME");
exit(1);
}
}
void untrace_pid(int pid)
{
if (ptrace(PTRACE_DETACH, pid, 0, 0)<0) {
perror("PTRACE_DETACH");
exit(1);
}
}
/*
* Return values:
* PROC_BREAKPOINT - Breakpoint
* PROC_SYSCALL - Syscall entry
* PROC_SYSRET - Syscall return
*/
int type_of_stop(struct process * proc, int *what)
{
*what = get_orig_eax(proc->pid);
if (*what!=-1) {
if (proc->syscall_number != *what) {
proc->syscall_number = *what;
return PROC_SYSCALL;
} else {
proc->syscall_number = -1;
return PROC_SYSRET;
}
}
return PROC_BREAKPOINT;
}
|
