Exemplo n.º 1
0
Arquivo: type.cpp Projeto: Frky/scat
/*  Instrumentation of each instruction
 *  that uses a memory operand
 */
VOID Instruction(INS ins, VOID *v) {
    trace_enter();

    if (!INS_IsStackRead(ins)) {
        for (UINT32 memopIdx = 0; memopIdx < INS_MemoryOperandCount(ins); memopIdx++) {
            if (INS_MemoryOperandIsWritten(ins, memopIdx)) {
                INS_InsertCall(ins,
                                IPOINT_BEFORE,
                                (AFUNPTR) update_stack_heap_region,
                                IARG_CONST_CONTEXT,
                                IARG_MEMORYOP_EA, memopIdx,
                                IARG_END);

                UINT32 opIdx = INS_MemoryOperandIndexToOperandIndex(ins, memopIdx);
                REG base_reg = INS_OperandMemoryBaseReg(ins, opIdx);
                if (base_reg != REG_INVALID()) {
                    INS_InsertCall(ins,
                                    IPOINT_BEFORE,
                                    (AFUNPTR) check_parameter_out,
                                    IARG_REG_VALUE, base_reg,
                                    IARG_END);
                }
            }
        }
    }

    if (INS_IsCall(ins)) {
        if (INS_IsDirectCall(ins)) {
            ADDRINT addr = INS_DirectBranchOrCallTargetAddress(ins);
            FID fid = fn_lookup_by_address(addr);

            INS_InsertCall(ins,
                        IPOINT_BEFORE,
                        (AFUNPTR) fn_call,
                        IARG_CONST_CONTEXT,
                        IARG_UINT32, fid,
                        IARG_END);
        }
        else {
            INS_InsertCall(ins,
                        IPOINT_BEFORE,
                        (AFUNPTR) fn_indirect_call,
                        IARG_CONST_CONTEXT,
                        IARG_BRANCH_TARGET_ADDR,
                        IARG_END);
        }
    }

    if (INS_IsRet(ins)) {
        INS_InsertCall(ins,
                    IPOINT_BEFORE,
                    (AFUNPTR) fn_ret,
                    IARG_CONST_CONTEXT,
                    IARG_END);
    }

    trace_leave();
}
Exemplo n.º 2
0
VOID Instruction(INS ins, VOID *v) {
    if (!init)
        Commence();

    if (INS_IsCall(ins)) {
        if (INS_IsDirectCall(ins)) {
            ADDRINT addr = INS_DirectBranchOrCallTargetAddress(ins);
            FID fid = fn_lookup_by_address(addr);

            INS_InsertCall(ins, 
                        IPOINT_BEFORE, 
                        (AFUNPTR) fn_call, 
                        IARG_CONST_CONTEXT,
                        IARG_UINT32, fid, 
                        IARG_BOOL, false,
                        IARG_END);
        } 
        else {
            INS_InsertCall(ins,
                        IPOINT_BEFORE,
                        (AFUNPTR) fn_icall,
                        IARG_CONST_CONTEXT,
                        IARG_BRANCH_TARGET_ADDR,
                        IARG_BOOL, false,
                        IARG_END);
        }
    }

    if (INS_IsIndirectBranchOrCall(ins)) {
        if (!INS_IsCall(ins)) {
            INS_InsertCall(ins,
                    IPOINT_BEFORE,
                    (AFUNPTR) fn_icall,
                    IARG_CONST_CONTEXT,
                    IARG_BRANCH_TARGET_ADDR,
                    IARG_BOOL, true,
                    IARG_END);
        }
    }

    if (INS_IsRet(ins)) {
        INS_InsertCall(ins,
                    IPOINT_BEFORE,
                    (AFUNPTR) fn_ret,
                    IARG_CONST_CONTEXT,
                    IARG_END);
    }

    return;
}
Exemplo n.º 3
0
// Pin calls this function before a code sequence is executed for the first time
VOID TraceCalls(INS ins, VOID *v)
{
	// If we don't have a proper config, we cannot instrument anything
	if (config == NULL)
	{
		return;
	}

	ADDRINT addr = INS_Address(ins);
	IMG img = IMG_FindByAddress(addr);
	
	// We are interested only calls from the JITted code. That code is not part of any valid image
	if (IMG_Valid(img) && img != config->img)
	{
		return;
	}

	// We don't know the origins of the calls (only the targets) so we need to instrument every call
	if (INS_IsCall(ins))
	{
		bool ok = false;
		
		if (INS_RegRContain(ins, REG_EAX) || INS_RegRContain(ins, REG_EDX))
		{
			ok = true;
		}
		else if (INS_IsDirectCall(ins))
		{
			ADDRINT target_addr = INS_DirectBranchOrCallTargetAddress(ins);
			IMG target_img = IMG_FindByAddress(target_addr);
			if (!IMG_Valid(img) || img == config->img)
			{
				ok = true;
			}
		}

		if (ok)
		{
			// Select which call analysis function to use depending on whether we are in fast mode
			AFUNPTR analysisFunc = (AFUNPTR)MethodCallAnalysis;
			if (KnobFast.Value())
			{
				analysisFunc = (AFUNPTR)MethodCallAnalysisFast;
			}

			ADDRINT ret_addr = INS_NextAddress(ins);
			INS_InsertIfCall(ins, IPOINT_BEFORE, (AFUNPTR)ShouldCallBeAnalyzed, IARG_FUNCARG_CALLSITE_REFERENCE, 0, IARG_ADDRINT, ret_addr, IARG_BRANCH_TARGET_ADDR, IARG_END);
			INS_InsertThenCall(ins, IPOINT_BEFORE, analysisFunc, IARG_FUNCARG_CALLSITE_REFERENCE, 0, IARG_ADDRINT, ret_addr, IARG_BRANCH_TARGET_ADDR, IARG_END);

			returnAddressToInstument[ret_addr] = true;
			return;
		}
	}

	if (returnAddressToInstument.find(addr) != returnAddressToInstument.end())
	{
		// Select which call analysis function to use depending on whether we are in fast mode
		AFUNPTR analysisFuncIf = (AFUNPTR)ShouldReturnAddressBeAnalyzed;
		AFUNPTR analysisFuncThen = (AFUNPTR)ReturnValueAnalysis;
		if (KnobFast.Value())
		{
			analysisFuncIf = (AFUNPTR)ShouldReturnAddressBeAnalyzedFast;
			analysisFuncThen = (AFUNPTR)ReturnValueAnalysisFast;
		}

		INS_InsertIfCall(ins, IPOINT_BEFORE, analysisFuncIf, IARG_ADDRINT, addr, IARG_END);
		INS_InsertThenCall(ins, IPOINT_BEFORE, analysisFuncThen, IARG_ADDRINT, addr, IARG_REG_VALUE, REG_EAX, IARG_FUNCARG_CALLSITE_REFERENCE, 0, IARG_END);
		return;
	}
}