forked from Trietptm-on-Security/tracer
-
Notifications
You must be signed in to change notification settings - Fork 0
/
thread.c
executable file
·160 lines (131 loc) · 4.36 KB
/
thread.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
/*
* _______
* |__ __|
* | |_ __ __ _ ___ ___ _ __
* | | '__/ _` |/ __/ _ \ '__|
* | | | | (_| | (_| __/ |
* |_|_| \__,_|\___\___|_|
*
* Written by Dennis Yurichev <dennis(a)yurichev.com>, 2013
*
* This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License.
* To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/3.0/.
*
*/
#include "oassert.h"
#include "thread.h"
#include "dmalloc.h"
#include "rbtree.h"
#include "logging.h"
#include "process.h"
#include "x86.h"
#include "bolt_stuff.h"
bool thread_c_debug=false;
void thread_free (thread *t)
{
if (thread_c_debug)
L ("%s() begin\n", __func__);
for (unsigned b=0; b<4; b++)
{
BP_thread_specific_dynamic_info *bp=&t->BP_dynamic_info[b];
DFREE (bp->BPF_args);
if (bp->BPF_buffers_at_start)
{
for (unsigned i=0; i<bp->BPF_buffers_at_start_cnt; i++)
DFREE(bp->BPF_buffers_at_start[i]);
DFREE(bp->BPF_buffers_at_start);
};
};
DFREE (t);
};
thread *find_thread (DWORD PID, DWORD TID)
{
process *p=find_process(PID);
thread *t=(thread*)rbtree_lookup (p->threads, (void*)TID);
oassert (t!=NULL && "TID not found in threads table");
return t;
};
void add_thread (process *p, DWORD TID, HANDLE THDL, address start, address TIB)
{
thread *t=DCALLOC (thread, 1, "thread");
if (thread_c_debug)
L ("%s() begin\n", __func__);
t->TID=TID;
t->THDL=THDL;
t->TIB=TIB;
t->start=start;
oassert (rbtree_lookup(p->threads, (void*)TID)==NULL && "this TID is already in table");
rbtree_insert (p->threads, (void*)TID, t);
if (thread_c_debug)
L ("%s() end\n", __func__);
};
static void dump_stack_not_using_EBP (process *p, thread *t, CONTEXT *ctx, MemoryCache *mc)
{
HANDLE THDL=t->THDL;
address stack_top=TIB_get_stack_top (THDL, mc);
address stack_bottom=TIB_get_stack_bottom (THDL, mc);
//strbuf sb=STRBUF_INIT;
address SP_at_start=CONTEXT_get_SP(ctx);
L ("Call stack:\n");
if (thread_c_debug)
L ("SP_at_start=0x%x, stack_top=0x%x, stack_bottom=0x%x\n", SP_at_start, stack_top, stack_bottom);
for (address a=SP_at_start; a<stack_top; a=a+sizeof(REG))
{
REG r;
if (MC_ReadREG(mc, a, &r))
{
//L ("r=0x" PRI_REG_HEX "\n", r);
if (adr_in_executable_section(p, r))
{
strbuf sb=STRBUF_INIT;
process_get_sym (p, r, true, true, &sb);
L ("(SP+0x%x) return address=0x" PRI_ADR_HEX " (%s)\n", a-SP_at_start, r, sb.buf);
strbuf_deinit(&sb);
};
};
};
};
static void dump_stack_EBP_frame (process *p, thread *t, CONTEXT * ctx, MemoryCache *mem)
{
HANDLE THDL=t->THDL;
address stack_top=TIB_get_stack_top (THDL, mem);
address stack_bottom=TIB_get_stack_bottom (THDL, mem);
strbuf sb=STRBUF_INIT;
L ("Call stack:\n");
address next_BP=CONTEXT_get_BP (ctx);
if (TIB_is_ptr_in_stack_limits (THDL, next_BP, mem)==false)
{
L ("Current frame pointer %s (0x" PRI_ADR_HEX ") is not within current stack limits (top=0x" PRI_ADR_HEX ", bottom=0x" PRI_ADR_HEX ")\n",
BP_REGISTER_NAME,
CONTEXT_get_BP (ctx), stack_top, stack_bottom);
goto exit;
};
while (next_BP<=stack_top && next_BP>=stack_bottom)
{
REG tmp;
bool b=MC_ReadREG(mem, next_BP, &tmp);
oassert (b);
address ret_adr;
b=MC_ReadREG(mem, next_BP+sizeof(REG), &ret_adr);
oassert (b);
if (ret_adr==0)
break;
strbuf_reinit(&sb, 0);
process_get_sym (p, ret_adr, true, true, &sb);
L ("return address=0x" PRI_ADR_HEX " (%s)\n", ret_adr, sb.buf);
if (next_BP==tmp)
break;
next_BP=tmp;
};
exit:
strbuf_deinit (&sb);
};
void dump_stack (process *p, thread *t, CONTEXT * ctx, MemoryCache *mem)
{
#ifdef _WIN64
dump_stack_not_using_EBP (p, t, ctx, mem);
#else
dump_stack_EBP_frame (p, t, ctx, mem);
#endif
};
/* vim: set expandtab ts=4 sw=4 : */