tracechild.cc revision 4843
12100SN/A/* 22100SN/A * Copyright (c) 2007 The Regents of The University of Michigan 35268Sksewell@umich.edu * All rights reserved. 45268Sksewell@umich.edu * 55268Sksewell@umich.edu * Redistribution and use in source and binary forms, with or without 65268Sksewell@umich.edu * modification, are permitted provided that the following conditions are 75268Sksewell@umich.edu * met: redistributions of source code must retain the above copyright 85268Sksewell@umich.edu * notice, this list of conditions and the following disclaimer; 95268Sksewell@umich.edu * redistributions in binary form must reproduce the above copyright 105268Sksewell@umich.edu * notice, this list of conditions and the following disclaimer in the 115268Sksewell@umich.edu * documentation and/or other materials provided with the distribution; 125268Sksewell@umich.edu * neither the name of the copyright holders nor the names of its 135268Sksewell@umich.edu * contributors may be used to endorse or promote products derived from 145268Sksewell@umich.edu * this software without specific prior written permission. 155268Sksewell@umich.edu * 165268Sksewell@umich.edu * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 175268Sksewell@umich.edu * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 185268Sksewell@umich.edu * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 195268Sksewell@umich.edu * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 205268Sksewell@umich.edu * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 215268Sksewell@umich.edu * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 225268Sksewell@umich.edu * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 235268Sksewell@umich.edu * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 245268Sksewell@umich.edu * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 255268Sksewell@umich.edu * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 265268Sksewell@umich.edu * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 275268Sksewell@umich.edu * 285268Sksewell@umich.edu * Authors: Gabe Black 295268Sksewell@umich.edu */ 305268Sksewell@umich.edu 315268Sksewell@umich.edu#include <iostream> 322706Sksewell@umich.edu#include <iomanip> 332100SN/A#include <errno.h> 342124SN/A#include <sys/ptrace.h> 352124SN/A#include <stdint.h> 362124SN/A 372124SN/A#include "tracechild_amd64.hh" 382124SN/A 392124SN/Ausing namespace std; 402124SN/A 412124SN/Achar * AMD64TraceChild::regNames[numregs] = { 422124SN/A //GPRs 432124SN/A "rax", "rbx", "rcx", "rdx", 442124SN/A //Index registers 452124SN/A "rsi", "rdi", 462124SN/A //Base pointer and stack pointer 472124SN/A "rbp", "rsp", 482124SN/A //New 64 bit mode registers 492124SN/A "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", 503953Sstever@eecs.umich.edu //Segmentation registers 513953Sstever@eecs.umich.edu "cs", "ds", "es", "fs", "gs", "ss", "fs_base", "gs_base", 523953Sstever@eecs.umich.edu //PC 533953Sstever@eecs.umich.edu "rip", 543953Sstever@eecs.umich.edu //Flags 553953Sstever@eecs.umich.edu "eflags"}; 563953Sstever@eecs.umich.edu 573953Sstever@eecs.umich.edubool AMD64TraceChild::sendState(int socket) 583953Sstever@eecs.umich.edu{ 593953Sstever@eecs.umich.edu uint64_t regVal = 0; 603953Sstever@eecs.umich.edu for(int x = 0; x <= R15; x++) 613953Sstever@eecs.umich.edu { 622124SN/A regVal = getRegVal(x); 632124SN/A if(write(socket, ®Val, sizeof(regVal)) == -1) 645736Snate@binkert.org { 655736Snate@binkert.org cerr << "Write failed! " << strerror(errno) << endl; 662124SN/A tracing = false; 672124SN/A return false; 682124SN/A } 692124SN/A } 702935Sksewell@umich.edu regVal = getRegVal(RIP); 714056Sstever@eecs.umich.edu if(write(socket, ®Val, sizeof(regVal)) == -1) 724056Sstever@eecs.umich.edu { 732935Sksewell@umich.edu cerr << "Write failed! " << strerror(errno) << endl; 742935Sksewell@umich.edu tracing = false; 752124SN/A return false; 762124SN/A } 772124SN/A return true; 782124SN/A} 795222Sksewell@umich.edu 805222Sksewell@umich.eduint64_t AMD64TraceChild::getRegs(user_regs_struct & myregs, int num) 815222Sksewell@umich.edu{ 825222Sksewell@umich.edu assert(num < numregs && num >= 0); 835222Sksewell@umich.edu switch(num) 845222Sksewell@umich.edu { 852124SN/A //GPRs 862124SN/A case RAX: return myregs.rax; 873953Sstever@eecs.umich.edu case RBX: return myregs.rbx; 883953Sstever@eecs.umich.edu case RCX: return myregs.rcx; 893953Sstever@eecs.umich.edu case RDX: return myregs.rdx; 903953Sstever@eecs.umich.edu //Index registers 912124SN/A case RSI: return myregs.rsi; 925222Sksewell@umich.edu case RDI: return myregs.rdi; 932124SN/A //Base pointer and stack pointer 942124SN/A case RBP: return myregs.rbp; 953953Sstever@eecs.umich.edu case RSP: return myregs.rsp; 965222Sksewell@umich.edu //New 64 bit mode registers 975222Sksewell@umich.edu case R8: return myregs.r8; 982100SN/A case R9: return myregs.r9; 993953Sstever@eecs.umich.edu case R10: return myregs.r10; 1002686Sksewell@umich.edu case R11: return myregs.r11; 1012686Sksewell@umich.edu case R12: return myregs.r12; 1022686Sksewell@umich.edu case R13: return myregs.r13; 1032124SN/A case R14: return myregs.r14; 1042686Sksewell@umich.edu case R15: return myregs.r15; 1052686Sksewell@umich.edu //Segmentation registers 1062686Sksewell@umich.edu case CS: return myregs.cs; 1072686Sksewell@umich.edu case DS: return myregs.ds; 1084661Sksewell@umich.edu case ES: return myregs.es; 1092686Sksewell@umich.edu case FS: return myregs.fs; 1102686Sksewell@umich.edu case GS: return myregs.gs; 1112686Sksewell@umich.edu case SS: return myregs.ss; 1122686Sksewell@umich.edu case FS_BASE: return myregs.fs_base; 1132686Sksewell@umich.edu case GS_BASE: return myregs.gs_base; 1142686Sksewell@umich.edu //PC 1152686Sksewell@umich.edu case RIP: return myregs.rip; 1162686Sksewell@umich.edu //Flags 1172686Sksewell@umich.edu case EFLAGS: return myregs.eflags; 1182686Sksewell@umich.edu default: 1192686Sksewell@umich.edu assert(0); 1202686Sksewell@umich.edu return 0; 1212686Sksewell@umich.edu } 1222686Sksewell@umich.edu} 1232686Sksewell@umich.edu 1242686Sksewell@umich.edubool AMD64TraceChild::update(int pid) 125{ 126 oldregs = regs; 127 if(ptrace(PTRACE_GETREGS, pid, 0, ®s) != 0) 128 { 129 cerr << "update: " << strerror(errno) << endl; 130 return false; 131 } 132 for(unsigned int x = 0; x < numregs; x++) 133 regDiffSinceUpdate[x] = (getRegVal(x) != getOldRegVal(x)); 134 return true; 135} 136 137AMD64TraceChild::AMD64TraceChild() 138{ 139 for(unsigned int x = 0; x < numregs; x++) 140 regDiffSinceUpdate[x] = false; 141} 142 143int64_t AMD64TraceChild::getRegVal(int num) 144{ 145 return getRegs(regs, num); 146} 147 148int64_t AMD64TraceChild::getOldRegVal(int num) 149{ 150 return getRegs(oldregs, num); 151} 152 153char * AMD64TraceChild::printReg(int num) 154{ 155 sprintf(printBuffer, "0x%08X", getRegVal(num)); 156 return printBuffer; 157} 158 159ostream & AMD64TraceChild::outputStartState(ostream & os) 160{ 161 uint64_t sp = getSP(); 162 uint64_t pc = getPC(); 163 uint64_t highestInfo = 0; 164 char obuf[1024]; 165 sprintf(obuf, "Initial stack pointer = 0x%016llx\n", sp); 166 os << obuf; 167 sprintf(obuf, "Initial program counter = 0x%016llx\n", pc); 168 os << obuf; 169 170 //Output the argument count 171 uint64_t cargc = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 172 sprintf(obuf, "0x%016llx: Argc = 0x%016llx\n", sp, cargc); 173 os << obuf; 174 sp += 8; 175 176 //Output argv pointers 177 int argCount = 0; 178 uint64_t cargv; 179 do 180 { 181 cargv = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 182 sprintf(obuf, "0x%016llx: argv[%d] = 0x%016llx\n", 183 sp, argCount++, cargv); 184 if(cargv) 185 if(highestInfo < cargv) 186 highestInfo = cargv; 187 os << obuf; 188 sp += 8; 189 } while(cargv); 190 191 //Output the envp pointers 192 int envCount = 0; 193 uint64_t cenvp; 194 do 195 { 196 cenvp = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 197 sprintf(obuf, "0x%016llx: envp[%d] = 0x%016llx\n", 198 sp, envCount++, cenvp); 199 os << obuf; 200 sp += 8; 201 } while(cenvp); 202 uint64_t auxType, auxVal; 203 do 204 { 205 auxType = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 206 sp += 8; 207 auxVal = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 208 sp += 8; 209 sprintf(obuf, "0x%016llx: Auxiliary vector = {0x%016llx, 0x%016llx}\n", 210 sp - 16, auxType, auxVal); 211 os << obuf; 212 } while(auxType != 0 || auxVal != 0); 213 //Print out the argument strings, environment strings, and file name. 214 string current; 215 uint64_t buf; 216 uint64_t currentStart = sp; 217 bool clearedInitialPadding = false; 218 do 219 { 220 buf = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 221 char * cbuf = (char *)&buf; 222 for(int x = 0; x < sizeof(uint64_t); x++) 223 { 224 if(cbuf[x]) 225 current += cbuf[x]; 226 else 227 { 228 sprintf(obuf, "0x%016llx: \"%s\"\n", 229 currentStart, current.c_str()); 230 os << obuf; 231 current = ""; 232 currentStart = sp + x + 1; 233 } 234 } 235 sp += 8; 236 clearedInitialPadding = clearedInitialPadding || buf != 0; 237 } while(!clearedInitialPadding || buf != 0 || sp <= highestInfo); 238 return os; 239} 240 241uint64_t AMD64TraceChild::findSyscall() 242{ 243 uint64_t rip = getPC(); 244 bool foundOpcode = false; 245 bool twoByteOpcode = false; 246 for(;;) 247 { 248 uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, rip, 0); 249 for(int i = 0; i < sizeof(uint64_t); i++) 250 { 251 unsigned char byte = buf & 0xFF; 252 if(!foundOpcode) 253 { 254 if(!(byte == 0x66 || //operand override 255 byte == 0x67 || //address override 256 byte == 0x2E || //cs 257 byte == 0x3E || //ds 258 byte == 0x26 || //es 259 byte == 0x64 || //fs 260 byte == 0x65 || //gs 261 byte == 0x36 || //ss 262 byte == 0xF0 || //lock 263 byte == 0xF2 || //repe 264 byte == 0xF3 || //repne 265 (byte >= 0x40 && byte <= 0x4F) // REX 266 )) 267 { 268 foundOpcode = true; 269 } 270 } 271 if(foundOpcode) 272 { 273 if(twoByteOpcode) 274 { 275 //SYSCALL or SYSENTER 276 if(byte == 0x05 || byte == 0x34) 277 return rip + 1; 278 else 279 return 0; 280 } 281 if(!twoByteOpcode) 282 { 283 if(byte == 0xCC) // INT3 284 return rip + 1; 285 else if(byte == 0xCD) // INT with byte immediate 286 return rip + 2; 287 else if(byte == 0x0F) // two byte opcode prefix 288 twoByteOpcode = true; 289 else 290 return 0; 291 } 292 } 293 buf >>= 8; 294 rip++; 295 } 296 } 297} 298 299bool AMD64TraceChild::step() 300{ 301 uint64_t ripAfterSyscall = findSyscall(); 302 if(ripAfterSyscall) 303 { 304 //Get the original contents of memory 305 uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, ripAfterSyscall, 0); 306 //Patch the first two bytes of the memory immediately after this with 307 //jmp -2. Either single stepping will take over before this 308 //instruction, leaving the rip where it should be, or it will take 309 //over after this instruction, -still- leaving the rip where it should 310 //be. 311 uint64_t newBuf = (buf & ~0xFFFF) | 0xFEEB; 312 //Write the patched memory to the processes address space 313 ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, newBuf); 314 //Step and hit it 315 ptraceSingleStep(); 316 //Put things back to the way they started 317 ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, buf); 318 } 319 else 320 ptraceSingleStep(); 321} 322 323TraceChild * genTraceChild() 324{ 325 return new AMD64TraceChild; 326} 327