logo

mstrace

Small Linux strace(1) implementationgit clone https://anongit.hacktivis.me/git/mstrace.git/

print_syscall.c (3270B)

    

  1. // SPDX-FileCopyrightText: 2024 Haelwenn (lanodan) Monnier <contact+mstrace@hacktivis.me>
  2. // SPDX-License-Identifier: MPL-2.0
  4. #define _DEFAULT_SOURCE
  6. #include "mstrace.h"
  7. #include "strsyscall.h"
  9. #include <assert.h>
  10. #include <inttypes.h>     // PRIu64
  11. #include <limits.h>       // PATH_MAX
  12. #include <linux/ptrace.h> // __u64
  13. #include <stdio.h>        // fprintf
  14. #include <string.h>       // memcpy
  15. #include <sys/ptrace.h>   // ptrace()
  16. #include <sys/syscall.h>  // SYS_*
  17. #include <time.h>         // struct timespec
  18. #include <unistd.h>       // pid_t
  20. extern pid_t child;
  22. union u8_timespec
  23. {
  24. 	struct timespec ts;
  25. 	uint8_t buf[sizeof(struct timespec)];
  26. };
  28. static char *
  29. read_str(intptr_t addr, size_t len)
  30. {
  31. 	static char str_buf[sizeof(unsigned long) * 128] = "";
  32. 	if(len == 0 || len > sizeof(unsigned long) * 128) len = sizeof(unsigned long) * 128;
  34. 	size_t i = 0;
  35. 	while(i < len)
  36. 	{
  37. 		unsigned long tmp = ptrace(PTRACE_PEEKDATA, child, addr + i);
  39. 		memcpy(str_buf + i, &tmp, sizeof(tmp));
  40. 		i += sizeof(tmp);
  42. 		if(memchr(&tmp, 0, sizeof(tmp)) != NULL) break;
  44. 		if(i > len)
  45. 		{
  46. 			str_buf[len - 1] = '\0';
  47. 			break;
  48. 		}
  49. 	}
  51. 	return str_buf;
  52. }
  54. static struct timespec *
  55. read_timespec(intptr_t addr)
  56. {
  57. 	static union u8_timespec local;
  59. 	for(size_t i = 0; i < sizeof(struct timespec);)
  60. 	{
  61. 		unsigned long tmp = ptrace(PTRACE_PEEKDATA, child, addr + i);
  63. 		memcpy(local.buf + i, &tmp, sizeof(tmp));
  64. 		i += sizeof(tmp);
  65. 	}
  67. 	return &(local.ts);
  68. }
  70. #define Pri_str "\"%s\""
  71. #define Pri_i "%" PRIi64
  72. #define Pri_u "%" PRIu64
  73. #define Pri_o "0o%" PRIo64
  74. #define Pri_x "0x%" PRIx64
  76. void
  77. print_syscall_entry(__u64 nr, __u64 args[6])
  78. {
  79. 	switch(nr)
  80. 	{
  81. 	case SYS_execve:
  82. 		fprintf(out,
  83. 		        "<%s(" Pri_str ", " Pri_x ", " Pri_x ")\n",
  84. 		        str_syscalls[nr],
  85. 		        read_str(args[0], PATH_MAX),
  86. 		        (int64_t)args[1],
  87. 		        (int64_t)args[2]);
  88. 		return;
  89. 	case SYS_nanosleep:
  90. 	{
  91. 		struct timespec *rqtp = read_timespec(args[0]);
  92. 		struct timespec *rmtp = read_timespec(args[1]);
  94. 		fprintf(out,
  95. 		        "<%s({tv_sec = " Pri_i ", tv_nsec = " Pri_i "}, {tv_sec = " Pri_i ", tv_nsec = " Pri_i
  96. 		        "})\n",
  97. 		        str_syscalls[nr],
  98. 		        rqtp->tv_sec,
  99. 		        rqtp->tv_nsec,
  100. 		        rmtp->tv_sec,
  101. 		        rmtp->tv_nsec);
  102. 		return;
  103. 	}
  104. 	}
  105. }
  107. void
  108. print_syscall_exit(__u64 nr, __u64 args[6])
  109. {
  110. 	switch(nr)
  111. 	{
  112. #include "syscalls_cases.h"
  113. 	case SYS_nanosleep:
  114. 	{
  115. 		struct timespec *rqtp = read_timespec(args[0]);
  116. 		struct timespec *rmtp = read_timespec(args[1]);
  118. 		fprintf(out,
  119. 		        ">%s({tv_sec = " Pri_i ", tv_nsec = " Pri_i "}, {tv_sec = " Pri_i ", tv_nsec = " Pri_i
  120. 		        "})",
  121. 		        str_syscalls[nr],
  122. 		        rqtp->tv_sec,
  123. 		        rqtp->tv_nsec,
  124. 		        rmtp->tv_sec,
  125. 		        rmtp->tv_nsec);
  126. 		break;
  127. 	}
  128. 	// fallback
  129. 	default:
  130. 		assert(nr < SYSCALLS_MAX);
  131. 		if(str_syscalls[nr] != NULL)
  132. 		{
  133. 			fprintf(out, ">%s(", str_syscalls[nr]);
  134. 		}
  135. 		else
  136. 		{
  137. 			fprintf(out, ">syscall(%" PRIu64 ", ", (uint64_t)nr);
  138. 		}
  140. 		fprintf(out,
  141. 		        "0x%" PRIx64 ", 0x%" PRIx64 ", 0x%" PRIx64 ", 0x%" PRIx64 ", 0x%" PRIx64 ", 0x%" PRIx64
  142. 		        ")",
  143. 		        (uint64_t)args[0],
  144. 		        (uint64_t)args[1],
  145. 		        (uint64_t)args[2],
  146. 		        (uint64_t)args[3],
  147. 		        (uint64_t)args[4],
  148. 		        (uint64_t)args[5]);
  149. 	}
  150. }