/*!
* @brief Redirects execution on a debugged process.
* @param pid Process identifier of the debugged process.
* @param regs Pointer to the \c user_regs_struct of the debugged process.
* @param addr Address where execution should be redirected.
* @returns Indication of success or failure.
* @retval 0 indicates success.
*/
LONG
call(LONG pid, struct user_regs_struct *regs, unsigned long addr) {
unsigned long *alloc_code = (unsigned long *)call_stub;
unsigned long *addr_ptr = (unsigned long *)(call_stub + ENTRY_POINT_POS);
PULONG addr_options_ptr = (PULONG)(call_stub + OPTIONS_POS);
ULONG code_size = CALL_STUB_SIZE;
LONG result = 0;
if (regs == NULL) {
return ERROR_INVALID_PARAMETER;
}
// Fix call stub with entry point
addr_ptr[0] = addr;
if (debugging_enabled == 1) {
addr_options_ptr[0] = 5; // Enable Debugging
} else {
addr_options_ptr[0] = 4; // Enable PASSFD (socket sharing)
}
result = execute_stub(pid, regs->eip, alloc_code, code_size);
if (result != 0)
return result;
if (wait_trap(pid) == FALSE)
return ECANCELED; // We don't know what failed in the remote process
return 0;
}
/*!
* @brief Allocates memory on a debugged process.
* @param pid Process identifier of the debugged process.
* @param regs Pointer to the \c user_regs_struct of the debugged process.
* @param addr Address to allocate.
* @param length Size to allocate.
* @returns Indication of success or failure.
* @retval 0 indicates success.
*/
LONG
allocate(LONG pid, struct user_regs_struct *regs, unsigned long addr, size_t length)
{
unsigned long *alloc_code = (unsigned long *)mmap_stub;
unsigned long *addr_ptr = (unsigned long *)(mmap_stub + MMAP_ADDR_POS);
size_t *length_ptr = (size_t *)(mmap_stub + MMAP_LENGTH_POS);
ULONG code_size = MMAP_STUB_SIZE;
LONG result = 0;
if (regs == NULL) {
return ERROR_INVALID_PARAMETER;
}
// Fix mmap stub with allocation data
addr_ptr[0] = addr;
length_ptr[0] = length;
result = execute_stub(pid, regs->eip, alloc_code, code_size);
if (result != 0)
return result;
if (wait_trap(pid) == FALSE)
return ECANCELED; // We don't know what failed in the remote process
result = getregs(pid, regs);
if (result != 0)
return result;
return 0;
}
static void test_sys32_regs(void (*do_syscall)(struct syscall_args32 *))
{
struct syscall_args32 args = {
.nr = 224, /* gettid */
.arg0 = 10, .arg1 = 11, .arg2 = 12,
.arg3 = 13, .arg4 = 14, .arg5 = 15,
};
do_syscall(&args);
if (args.nr != getpid() ||
args.arg0 != 10 || args.arg1 != 11 || args.arg2 != 12 ||
args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
printf("[FAIL]\tgetpid() failed to preseve regs\n");
nerrs++;
} else {
printf("[OK]\tgetpid() preserves regs\n");
}
sethandler(SIGUSR1, empty_handler, 0);
args.nr = 37; /* kill */
args.arg0 = getpid();
args.arg1 = SIGUSR1;
do_syscall(&args);
if (args.nr != 0 ||
args.arg0 != getpid() || args.arg1 != SIGUSR1 || args.arg2 != 12 ||
args.arg3 != 13 || args.arg4 != 14 || args.arg5 != 15) {
printf("[FAIL]\tkill(getpid(), SIGUSR1) failed to preseve regs\n");
nerrs++;
} else {
printf("[OK]\tkill(getpid(), SIGUSR1) preserves regs\n");
}
clearhandler(SIGUSR1);
}
static void test_ptrace_syscall_restart(void)
{
printf("[RUN]\tptrace-induced syscall restart\n");
pid_t chld = fork();
if (chld < 0)
err(1, "fork");
if (chld == 0) {
if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
err(1, "PTRACE_TRACEME");
printf("\tChild will make one syscall\n");
raise(SIGSTOP);
syscall(SYS_gettid, 10, 11, 12, 13, 14, 15);
_exit(0);
}
int status;
/* Wait for SIGSTOP. */
if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
err(1, "waitpid");
struct user_regs_struct regs;
printf("[RUN]\tSYSEMU\n");
if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
err(1, "PTRACE_SYSCALL");
wait_trap(chld);
if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
err(1, "PTRACE_GETREGS");
if (regs.user_syscall_nr != SYS_gettid ||
regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
regs.user_arg4 != 14 || regs.user_arg5 != 15) {
printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
nerrs++;
} else {
printf("[OK]\tInitial nr and args are correct\n");
}
printf("[RUN]\tRestart the syscall (ip = 0x%lx)\n",
(unsigned long)regs.user_ip);
/*
* This does exactly what it appears to do if syscall is int80 or
* SYSCALL64. For SYSCALL32 or SYSENTER, though, this is highly
* magical. It needs to work so that ptrace and syscall restart
* work as expected.
*/
regs.user_ax = regs.user_syscall_nr;
regs.user_ip -= 2;
if (ptrace(PTRACE_SETREGS, chld, 0, ®s) != 0)
err(1, "PTRACE_SETREGS");
if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
err(1, "PTRACE_SYSCALL");
wait_trap(chld);
if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
err(1, "PTRACE_GETREGS");
if (regs.user_syscall_nr != SYS_gettid ||
regs.user_arg0 != 10 || regs.user_arg1 != 11 ||
regs.user_arg2 != 12 || regs.user_arg3 != 13 ||
regs.user_arg4 != 14 || regs.user_arg5 != 15) {
printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
nerrs++;
} else {
printf("[OK]\tRestarted nr and args are correct\n");
}
printf("[RUN]\tChange nr and args and restart the syscall (ip = 0x%lx)\n",
(unsigned long)regs.user_ip);
regs.user_ax = SYS_getpid;
regs.user_arg0 = 20;
regs.user_arg1 = 21;
regs.user_arg2 = 22;
regs.user_arg3 = 23;
regs.user_arg4 = 24;
regs.user_arg5 = 25;
regs.user_ip -= 2;
if (ptrace(PTRACE_SETREGS, chld, 0, ®s) != 0)
err(1, "PTRACE_SETREGS");
if (ptrace(PTRACE_SYSEMU, chld, 0, 0) != 0)
err(1, "PTRACE_SYSCALL");
wait_trap(chld);
if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
err(1, "PTRACE_GETREGS");
if (regs.user_syscall_nr != SYS_getpid ||
regs.user_arg0 != 20 || regs.user_arg1 != 21 || regs.user_arg2 != 22 ||
regs.user_arg3 != 23 || regs.user_arg4 != 24 || regs.user_arg5 != 25) {
printf("[FAIL]\tRestart nr or args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
nerrs++;
} else {
printf("[OK]\tReplacement nr and args are correct\n");
}
if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
err(1, "PTRACE_CONT");
if (waitpid(chld, &status, 0) != chld)
err(1, "waitpid");
if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
printf("[FAIL]\tChild failed\n");
nerrs++;
} else {
printf("[OK]\tChild exited cleanly\n");
}
}
static void test_restart_under_ptrace(void)
{
printf("[RUN]\tkernel syscall restart under ptrace\n");
pid_t chld = fork();
if (chld < 0)
err(1, "fork");
if (chld == 0) {
if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0)
err(1, "PTRACE_TRACEME");
printf("\tChild will take a nap until signaled\n");
setsigign(SIGUSR1, SA_RESTART);
raise(SIGSTOP);
syscall(SYS_pause, 0, 0, 0, 0, 0, 0);
_exit(0);
}
int status;
/* Wait for SIGSTOP. */
if (waitpid(chld, &status, 0) != chld || !WIFSTOPPED(status))
err(1, "waitpid");
struct user_regs_struct regs;
printf("[RUN]\tSYSCALL\n");
if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
err(1, "PTRACE_SYSCALL");
wait_trap(chld);
/* We should be stopped at pause(2) entry. */
if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
err(1, "PTRACE_GETREGS");
if (regs.user_syscall_nr != SYS_pause ||
regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
regs.user_arg4 != 0 || regs.user_arg5 != 0) {
printf("[FAIL]\tInitial args are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
nerrs++;
} else {
printf("[OK]\tInitial nr and args are correct\n");
}
/* Interrupt it. */
kill(chld, SIGUSR1);
/* Advance. We should be stopped at exit. */
printf("[RUN]\tSYSCALL\n");
if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
err(1, "PTRACE_SYSCALL");
wait_trap(chld);
if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
err(1, "PTRACE_GETREGS");
if (regs.user_syscall_nr != SYS_pause ||
regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
regs.user_arg4 != 0 || regs.user_arg5 != 0) {
printf("[FAIL]\tArgs after SIGUSR1 are wrong (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
nerrs++;
} else {
printf("[OK]\tArgs after SIGUSR1 are correct (ax = %ld)\n",
(long)regs.user_ax);
}
/* Poke the regs back in. This must not break anything. */
if (ptrace(PTRACE_SETREGS, chld, 0, ®s) != 0)
err(1, "PTRACE_SETREGS");
/* Catch the (ignored) SIGUSR1. */
if (ptrace(PTRACE_CONT, chld, 0, 0) != 0)
err(1, "PTRACE_CONT");
if (waitpid(chld, &status, 0) != chld)
err(1, "waitpid");
if (!WIFSTOPPED(status)) {
printf("[FAIL]\tChild was stopped for SIGUSR1 (status = 0x%x)\n", status);
nerrs++;
} else {
printf("[OK]\tChild got SIGUSR1\n");
}
/* The next event should be pause(2) again. */
printf("[RUN]\tStep again\n");
if (ptrace(PTRACE_SYSCALL, chld, 0, 0) != 0)
err(1, "PTRACE_SYSCALL");
wait_trap(chld);
/* We should be stopped at pause(2) entry. */
if (ptrace(PTRACE_GETREGS, chld, 0, ®s) != 0)
err(1, "PTRACE_GETREGS");
if (regs.user_syscall_nr != SYS_pause ||
regs.user_arg0 != 0 || regs.user_arg1 != 0 ||
regs.user_arg2 != 0 || regs.user_arg3 != 0 ||
regs.user_arg4 != 0 || regs.user_arg5 != 0) {
printf("[FAIL]\tpause did not restart (nr=%lu, args=%lu %lu %lu %lu %lu %lu)\n", (unsigned long)regs.user_syscall_nr, (unsigned long)regs.user_arg0, (unsigned long)regs.user_arg1, (unsigned long)regs.user_arg2, (unsigned long)regs.user_arg3, (unsigned long)regs.user_arg4, (unsigned long)regs.user_arg5);
nerrs++;
} else {
printf("[OK]\tpause(2) restarted correctly\n");
}
/* Kill it. */
kill(chld, SIGKILL);
if (waitpid(chld, &status, 0) != chld)
err(1, "waitpid");
}