logo

mstrace

Small Linux strace(1) implementationgit clone https://anongit.hacktivis.me/git/mstrace.git/

print_syscall.c (3216B)

    

  1. // SPDX-FileCopyrightText: 2024 Haelwenn (lanodan) Monnier <contact+mstrace@hacktivis.me>
  2. // SPDX-License-Identifier: MPL-2.0
  4. #define _DEFAULT_SOURCE
  6. #include "strsyscall.h"
  8. #include <assert.h>
  9. #include <inttypes.h>     // PRIu64
  10. #include <limits.h>       // PATH_MAX
  11. #include <linux/ptrace.h> // __u64
  12. #include <stdio.h>        // fprintf
  13. #include <string.h>       // memcpy
  14. #include <sys/ptrace.h>   // ptrace()
  15. #include <sys/syscall.h>  // SYS_*
  16. #include <time.h>         // struct timespec
  17. #include <unistd.h>       // pid_t
  19. extern pid_t child;
  21. union u8_timespec
  22. {
  23. 	struct timespec ts;
  24. 	uint8_t buf[sizeof(struct timespec)];
  25. };
  27. static char *
  28. read_str(intptr_t addr, size_t len)
  29. {
  30. 	static char str_buf[sizeof(unsigned long) * 128] = "";
  31. 	if(len == 0 || len > sizeof(unsigned long) * 128) len = sizeof(unsigned long) * 128;
  33. 	size_t i = 0;
  34. 	while(i < len)
  35. 	{
  36. 		unsigned long tmp = ptrace(PTRACE_PEEKDATA, child, addr + i);
  38. 		memcpy(str_buf + i, &tmp, sizeof(tmp));
  39. 		i += sizeof(tmp);
  41. 		if(memchr(&tmp, 0, sizeof(tmp)) != NULL) break;
  43. 		if(i > len)
  44. 		{
  45. 			str_buf[len - 1] = '\0';
  46. 			break;
  47. 		}
  48. 	}
  50. 	return str_buf;
  51. }
  53. static struct timespec *
  54. read_timespec(intptr_t addr)
  55. {
  56. 	static union u8_timespec local;
  58. 	for(size_t i = 0; i < sizeof(struct timespec);)
  59. 	{
  60. 		unsigned long tmp = ptrace(PTRACE_PEEKDATA, child, addr + i);
  62. 		memcpy(local.buf + i, &tmp, sizeof(tmp));
  63. 		i += sizeof(tmp);
  64. 	}
  66. 	return &(local.ts);
  67. }
  69. #define Pri_str "\"%s\""
  70. #define Pri_i "%" PRIi64
  71. #define Pri_u "%" PRIu64
  72. #define Pri_o "0o%" PRIo64
  73. #define Pri_x "0x%" PRIx64
  75. void
  76. print_syscall_entry(__u64 nr, __u64 args[6])
  77. {
  78. 	switch(nr)
  79. 	{
  80. 	case SYS_execve:
  81. 		fprintf(stderr, "<%s("Pri_str ", " Pri_x ", " Pri_x ")\n", str_syscalls[nr], read_str(args[0], PATH_MAX), (int64_t)args[1], (int64_t)args[2]);
  82. 		return;
  83. 	case SYS_nanosleep:
  84. 	{
  85. 		struct timespec *rqtp = read_timespec(args[0]);
  86. 		struct timespec *rmtp = read_timespec(args[1]);
  88. 		fprintf(stderr,
  89. 		        "<%s({tv_sec = " Pri_i ", tv_nsec = " Pri_i "}, {tv_sec = " Pri_i ", tv_nsec = " Pri_i
  90. 		        "})\n",
  91. 		        str_syscalls[nr],
  92. 		        rqtp->tv_sec,
  93. 		        rqtp->tv_nsec,
  94. 		        rmtp->tv_sec,
  95. 		        rmtp->tv_nsec);
  96. 		return;
  97. 	}
  98. 	}
  99. }
  101. void
  102. print_syscall_exit(__u64 nr, __u64 args[6])
  103. {
  104. 	switch(nr)
  105. 	{
  106. #include "syscalls_cases.h"
  107. 	case SYS_nanosleep:
  108. 	{
  109. 		struct timespec *rqtp = read_timespec(args[0]);
  110. 		struct timespec *rmtp = read_timespec(args[1]);
  112. 		fprintf(stderr,
  113. 		        ">%s({tv_sec = " Pri_i ", tv_nsec = " Pri_i "}, {tv_sec = " Pri_i ", tv_nsec = " Pri_i
  114. 		        "})",
  115. 		        str_syscalls[nr],
  116. 		        rqtp->tv_sec,
  117. 		        rqtp->tv_nsec,
  118. 		        rmtp->tv_sec,
  119. 		        rmtp->tv_nsec);
  120. 		break;
  121. 	}
  122. 	// fallback
  123. 	default:
  124. 		assert(nr < SYSCALLS_MAX);
  125. 		if(str_syscalls[nr] != NULL)
  126. 		{
  127. 			fprintf(stderr, ">%s(", str_syscalls[nr]);
  128. 		}
  129. 		else
  130. 		{
  131. 			fprintf(stderr, ">syscall(%" PRIu64 ", ", (uint64_t)nr);
  132. 		}
  134. 		fprintf(stderr,
  135. 		        "0x%" PRIx64 ", 0x%" PRIx64 ", 0x%" PRIx64 ", 0x%" PRIx64 ", 0x%" PRIx64 ", 0x%" PRIx64
  136. 		        ")",
  137. 		        (uint64_t)args[0],
  138. 		        (uint64_t)args[1],
  139. 		        (uint64_t)args[2],
  140. 		        (uint64_t)args[3],
  141. 		        (uint64_t)args[4],
  142. 		        (uint64_t)args[5]);
  143. 	}
  144. }