sdb/disasm-tool.c at main · jay16213/sdb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
#include "inc/disasm-tool.h"

#define PEEKSIZE 8

struct disassembler_t {
    csh      handle;  // capstone handle
    tracee_t *tracee;
};

disassembler_t* disasm_init(tracee_t *tracee)
{
    disassembler_t *disassembler = (disassembler_t*) malloc(sizeof(disassembler_t));

    if (cs_open(CS_ARCH_X86, CS_MODE_64, &disassembler->handle) != CS_ERR_OK)
        cs_errno(disassembler->handle);

    disassembler->tracee = tracee;

    return disassembler;
}

void disasm_finalize(disassembler_t* disassembler)
{
    cs_close(&disassembler->handle);
    free(disassembler);
}

void disasm_at_break(disassembler_t* disassembler, int hit_id)
{
    tracee_t *tracee = disassembler->tracee;
    breakpoint_t *bp = tracee->breakpoints;
    int count;
    uint64_t has_read = 0;
    uint64_t code = 0;
    uint64_t addr = bp[hit_id].address + tracee->baseaddr;
    unsigned char *cptr = (unsigned char *)&code;
    cs_insn *insn;

    // get current code
    if ((code = ptrace(PTRACE_PEEKTEXT, tracee->pid, addr, 0)) < 0)
    {
        perror("get current code error");
        return;
    }

    code = (code & BYTE_MASK) | bp[hit_id].origin_code;

    if ((count = cs_disasm(disassembler->handle, cptr, sizeof(uint64_t), addr, 1, &insn)) > 0)
    {
        int i;
        for (i = 0; i < count; i++)
        {
            has_read += insn[i].size;
            print_instruction(&insn[i]);
        }

        cs_free(insn, count);
    }
    else
        SDB_ERROR("disasm error\n");

    return;
}

uint64_t disasm(disassembler_t* disassembler, uint8_t *code, uint64_t code_size, uint64_t addr, int disasm_size)
{
    int count;
    uint64_t has_read = 0;
    cs_insn *insn;

    if ((count = cs_disasm(disassembler->handle, code, code_size, addr, disasm_size, &insn)) > 0)
    {
        int i;
        for (i = 0; i < count; i++)
        {
            has_read += insn[i].size;
            print_instruction(&insn[i]);
        }

        cs_free(insn, count);
    }
    else
    {
        SDB_ERROR("disasm error\n");
    }

    return addr + has_read;
}

uint64_t disasm_in_running(disassembler_t* disassembler, uint64_t addr)
{
    int count;
    uint64_t has_read = 0;
    char buf[80] = {0};
    // uint64_t addr = baseaddr + offset;
    uint64_t ptr = addr;
    cs_insn *insn;

    for (ptr = addr; ptr < addr + sizeof(buf); ptr += PEEKSIZE)
    {
        long long peek;
        errno = 0;
        peek = ptrace(PTRACE_PEEKTEXT, disassembler->tracee->pid, ptr, NULL);
        if (errno != 0)
            break;
        memcpy(&buf[ptr - addr], &peek, PEEKSIZE);
    }

    if (ptr == addr)
        return addr;

    if ((count = cs_disasm(disassembler->handle, (unsigned char *)buf, addr - ptr, addr, 10, &insn)) > 0)
    {
        int i;
        for (i = 0; i < count; i++)
        {
            has_read += insn[i].size;
            print_instruction(&insn[i]);
        }

        cs_free(insn, count);
    }
    else
        SDB_ERROR("disasm error\n");

    return addr + has_read;
}