tracechild.cc revision 4955
1/* 2 * Copyright (c) 2007 The Regents of The University of Michigan 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions are 7 * met: redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer; 9 * redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution; 12 * neither the name of the copyright holders nor the names of its 13 * contributors may be used to endorse or promote products derived from 14 * this software without specific prior written permission. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 17 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 18 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 19 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 20 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 21 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 22 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 26 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 * 28 * Authors: Gabe Black 29 */ 30 31#include <iostream> 32#include <iomanip> 33#include <errno.h> 34#include <sys/ptrace.h> 35#include <stdint.h> 36 37#include "tracechild_amd64.hh" 38 39using namespace std; 40 41char * AMD64TraceChild::regNames[numregs] = { 42 //GPRs 43 "rax", "rbx", "rcx", "rdx", 44 //Index registers 45 "rsi", "rdi", 46 //Base pointer and stack pointer 47 "rbp", "rsp", 48 //New 64 bit mode registers 49 "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", 50 //Segmentation registers 51 "cs", "ds", "es", "fs", "gs", "ss", "fs_base", "gs_base", 52 //PC 53 "rip", 54 //Flags 55 "eflags"}; 56 57bool AMD64TraceChild::sendState(int socket) 58{ 59 uint64_t regVal = 0; 60 for(int x = 0; x <= R15; x++) 61 { 62 regVal = getRegVal(x); 63 if(write(socket, ®Val, sizeof(regVal)) == -1) 64 { 65 cerr << "Write failed! " << strerror(errno) << endl; 66 tracing = false; 67 return false; 68 } 69 } 70 regVal = getRegVal(RIP); 71 if(write(socket, ®Val, sizeof(regVal)) == -1) 72 { 73 cerr << "Write failed! " << strerror(errno) << endl; 74 tracing = false; 75 return false; 76 } 77 return true; 78} 79 80int64_t AMD64TraceChild::getRegs(user_regs_struct & myregs, int num) 81{ 82 assert(num < numregs && num >= 0); 83 switch(num) 84 { 85 //GPRs 86 case RAX: return myregs.rax; 87 case RBX: return myregs.rbx; 88 case RCX: return myregs.rcx; 89 case RDX: return myregs.rdx; 90 //Index registers 91 case RSI: return myregs.rsi; 92 case RDI: return myregs.rdi; 93 //Base pointer and stack pointer 94 case RBP: return myregs.rbp; 95 case RSP: return myregs.rsp; 96 //New 64 bit mode registers 97 case R8: return myregs.r8; 98 case R9: return myregs.r9; 99 case R10: return myregs.r10; 100 case R11: return myregs.r11; 101 case R12: return myregs.r12; 102 case R13: return myregs.r13; 103 case R14: return myregs.r14; 104 case R15: return myregs.r15; 105 //Segmentation registers 106 case CS: return myregs.cs; 107 case DS: return myregs.ds; 108 case ES: return myregs.es; 109 case FS: return myregs.fs; 110 case GS: return myregs.gs; 111 case SS: return myregs.ss; 112 case FS_BASE: return myregs.fs_base; 113 case GS_BASE: return myregs.gs_base; 114 //PC 115 case RIP: return myregs.rip; 116 //Flags 117 case EFLAGS: return myregs.eflags; 118 default: 119 assert(0); 120 return 0; 121 } 122} 123 124bool AMD64TraceChild::update(int pid) 125{ 126 oldregs = regs; 127 if(ptrace(PTRACE_GETREGS, pid, 0, ®s) != 0) 128 { 129 cerr << "update: " << strerror(errno) << endl; 130 return false; 131 } 132 for(unsigned int x = 0; x < numregs; x++) 133 regDiffSinceUpdate[x] = (getRegVal(x) != getOldRegVal(x)); 134 return true; 135} 136 137AMD64TraceChild::AMD64TraceChild() 138{ 139 for(unsigned int x = 0; x < numregs; x++) 140 regDiffSinceUpdate[x] = false; 141} 142 143int64_t AMD64TraceChild::getRegVal(int num) 144{ 145 return getRegs(regs, num); 146} 147 148int64_t AMD64TraceChild::getOldRegVal(int num) 149{ 150 return getRegs(oldregs, num); 151} 152 153char * AMD64TraceChild::printReg(int num) 154{ 155 sprintf(printBuffer, "0x%08X", getRegVal(num)); 156 return printBuffer; 157} 158 159ostream & AMD64TraceChild::outputStartState(ostream & os) 160{ 161 uint64_t sp = getSP(); 162 uint64_t pc = getPC(); 163 uint64_t highestInfo = 0; 164 char obuf[1024]; 165 sprintf(obuf, "Initial stack pointer = 0x%016llx\n", sp); 166 os << obuf; 167 sprintf(obuf, "Initial program counter = 0x%016llx\n", pc); 168 os << obuf; 169 170 //Output the argument count 171 uint64_t cargc = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 172 sprintf(obuf, "0x%016llx: Argc = 0x%016llx\n", sp, cargc); 173 os << obuf; 174 sp += 8; 175 176 //Output argv pointers 177 int argCount = 0; 178 uint64_t cargv; 179 do 180 { 181 cargv = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 182 sprintf(obuf, "0x%016llx: argv[%d] = 0x%016llx\n", 183 sp, argCount++, cargv); 184 if(cargv) 185 if(highestInfo < cargv) 186 highestInfo = cargv; 187 os << obuf; 188 sp += 8; 189 } while(cargv); 190 191 //Output the envp pointers 192 int envCount = 0; 193 uint64_t cenvp; 194 do 195 { 196 cenvp = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 197 sprintf(obuf, "0x%016llx: envp[%d] = 0x%016llx\n", 198 sp, envCount++, cenvp); 199 os << obuf; 200 sp += 8; 201 } while(cenvp); 202 uint64_t auxType, auxVal; 203 do 204 { 205 auxType = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 206 sp += 8; 207 auxVal = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 208 sp += 8; 209 sprintf(obuf, "0x%016llx: Auxiliary vector = {0x%016llx, 0x%016llx}\n", 210 sp - 16, auxType, auxVal); 211 os << obuf; 212 } while(auxType != 0 || auxVal != 0); 213 //Print out the argument strings, environment strings, and file name. 214 string current; 215 uint64_t buf; 216 uint64_t currentStart = sp; 217 bool clearedInitialPadding = false; 218 do 219 { 220 buf = ptrace(PTRACE_PEEKDATA, pid, sp, 0); 221 char * cbuf = (char *)&buf; 222 for(int x = 0; x < sizeof(uint64_t); x++) 223 { 224 if(cbuf[x]) 225 current += cbuf[x]; 226 else 227 { 228 sprintf(obuf, "0x%016llx: \"%s\"\n", 229 currentStart, current.c_str()); 230 os << obuf; 231 current = ""; 232 currentStart = sp + x + 1; 233 } 234 } 235 sp += 8; 236 clearedInitialPadding = clearedInitialPadding || buf != 0; 237 } while(!clearedInitialPadding || buf != 0 || sp <= highestInfo); 238 return os; 239} 240 241uint64_t AMD64TraceChild::findSyscall() 242{ 243 uint64_t rip = getPC(); 244 bool foundOpcode = false; 245 bool twoByteOpcode = false; 246 for(;;) 247 { 248 uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, rip, 0); 249 for(int i = 0; i < sizeof(uint64_t); i++) 250 { 251 unsigned char byte = buf & 0xFF; 252 if(!foundOpcode) 253 { 254 if(!(byte == 0x66 || //operand override 255 byte == 0x67 || //address override 256 byte == 0x2E || //cs 257 byte == 0x3E || //ds 258 byte == 0x26 || //es 259 byte == 0x64 || //fs 260 byte == 0x65 || //gs 261 byte == 0x36 || //ss 262 byte == 0xF0 || //lock 263 byte == 0xF2 || //repe 264 byte == 0xF3 || //repne 265 (byte >= 0x40 && byte <= 0x4F) // REX 266 )) 267 { 268 foundOpcode = true; 269 } 270 } 271 if(foundOpcode) 272 { 273 if(twoByteOpcode) 274 { 275 //SYSCALL or SYSENTER 276 if(byte == 0x05 || byte == 0x34) 277 return rip + 1; 278 else 279 return 0; 280 } 281 if(!twoByteOpcode) 282 { 283 if(byte == 0xCC) // INT3 284 return rip + 1; 285 else if(byte == 0xCD) // INT with byte immediate 286 return rip + 2; 287 else if(byte == 0x0F) // two byte opcode prefix 288 twoByteOpcode = true; 289 else 290 return 0; 291 } 292 } 293 buf >>= 8; 294 rip++; 295 } 296 } 297} 298 299bool AMD64TraceChild::step() 300{ 301 uint64_t ripAfterSyscall = findSyscall(); 302 if(ripAfterSyscall) 303 { 304 //Get the original contents of memory 305 uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, ripAfterSyscall, 0); 306 //Patch the first two bytes of the memory immediately after this with 307 //jmp -2. Either single stepping will take over before this 308 //instruction, leaving the rip where it should be, or it will take 309 //over after this instruction, -still- leaving the rip where it should 310 //be. 311 uint64_t newBuf = (buf & ~0xFFFF) | 0xFEEB; 312 //Write the patched memory to the processes address space 313 ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, newBuf); 314 //Step and hit it 315 ptraceSingleStep(); 316 //Put things back to the way they started 317 ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, buf); 318 } 319 else 320 { 321 //Get all the way past repe and repne string instructions in one shot. 322 uint64_t newPC, origPC = getPC(); 323 do 324 { 325 ptraceSingleStep(); 326 newPC = getPC(); 327 } while(newPC == origPC); 328 } 329} 330 331TraceChild * genTraceChild() 332{ 333 return new AMD64TraceChild; 334} 335