示例#1
0
文件: event.C 项目: aiaxun/patharmor
long EventPostSyscall::getReturnValue() const
{
    MachRegisterVal syscallReturnValue;
    Process::const_ptr proc = getProcess();
    Thread::const_ptr thrd = getThread();
    thrd->getRegister(MachRegister::getSyscallReturnValueReg(proc->getArchitecture()), syscallReturnValue);
    return syscallReturnValue;
}
示例#2
0
文件: event.C 项目: aiaxun/patharmor
long EventSyscall::getSyscallNumber() const
{
    MachRegisterVal syscallNumber;
    Process::const_ptr proc = getProcess();
    Thread::const_ptr thrd = getThread();
    thrd->getRegister(MachRegister::getSyscallNumberReg(proc->getArchitecture()), syscallNumber);
    return syscallNumber;
}
示例#3
0
文件: event.C 项目: aiaxun/patharmor
Address EventSyscall::getAddress() const
{
    MachRegisterVal pc;
    Process::const_ptr proc = getProcess();
    Thread::const_ptr thrd = getThread();
    thrd->getRegister(MachRegister::getPC(proc->getArchitecture()), pc);
    return pc;
}
示例#4
0
MachSyscall makeFromEvent(const EventSyscall * ev)
{
    Process::const_ptr proc = ev->getProcess();
    Architecture arch = proc->getArchitecture();
    OSType os = proc->getOS();
    Platform plat(arch,os);
    MachSyscall::SyscallIDPlatform syscallNumber = ev->getSyscallNumber();
#if !defined(os_windows)
    MachSyscall::SyscallName syscallName = MachSyscall::nameLookup(plat, syscallNumber);
#else
    MachSyscall::SyscallName syscallName = "Unknown";
#endif
    return MachSyscall(plat, syscallNumber, syscallName);
}
示例#5
0
DysectAPI::DysectErrorCode TargetVar::getValue(ConditionResult& result, Value& c, Process::const_ptr process, Dyninst::THR_ID tid) {

  ProcDebug *processState = NULL;
  vector<THR_ID> threads;
  int ret;

  Walker* proc = (Walker*)process->getData();
  if(!proc) {
    return DYSECTWARN(Error, "Walker not found for process: %d", process->getPid());
  }

  DataLocation* dataLoc;


  if(!DataLocation::findVariable(process, proc, name, dataLoc)) {
    // Variable not found
    return DYSECTWARN(Error, "Variable '%s' not found", name.c_str());
  }

  Value nc;
  DysectAPI::DysectErrorCode code = dataLoc->getValue(nc);

  if (nc.getType() == Value::longType)
    DYSECTVERBOSE(true, "Read long value for %s: %ld", name.c_str(), nc.getValue<long>());
  else if (nc.getType() == Value::intType)
    DYSECTVERBOSE(true, "Read int value for %s: %d", name.c_str(), nc.getValue<int>());
  else if (nc.getType() == Value::floatType)
    DYSECTVERBOSE(true, "Read float value for %s: %f", name.c_str(), nc.getValue<float>());
  else if (nc.getType() == Value::doubleType)
    DYSECTVERBOSE(true, "Read double value for %s: %f", name.c_str(), nc.getValue<double>());
  else if (nc.getType() == Value::pointerType)
    DYSECTVERBOSE(true, "Read pointer value for %s: %lx", name.c_str(), nc.getValue<long>());

  if(code != OK)
    return code;

  c.copy(nc);
  result = Resolved;

  return DysectAPI::OK;
}
示例#6
0
Process::cb_ret_t Backend::handleProcessExit(ProcControlAPI::Event::const_ptr ev) {
  Process::const_ptr curProcess = ev->getProcess();
  Thread::const_ptr curThread = ev->getThread();

  Err::verbose(true, "Process %d stopped", curProcess->getPid());
  set<Event*>& events = Async::getExitSubscribers();

  Err::verbose(true, "%d events subscribed", events.size());

  set<Event*>::iterator eventIter = events.begin();
  for(;eventIter != events.end(); eventIter++) {
    Event* event = *eventIter;
    if(event) { //&& event->isEnabled(curProcess)) {
      Err::verbose(true, "Enabled");
      handleEvent(curProcess, curThread, event);
    } else {
      Err::verbose(true, "Not enabled");
    }
  }
  
  Backend::enqueueDetach(curProcess);

  return Process::cbProcStop;
}