NAME
FreeBSD::amd64::Ptrace - Ptrace for FreeBSD-amd64
VERSION
$Id: Ptrace.pm,v 0.1 2015/01/14 10:07:56 dankogai Exp dankogai $
SYNOPSIS
# t/pstrace.pl - simple strace in perl
use strict;
use warnings;
use FreeBSD::amd64::Ptrace;
use FreeBSD::amd64::Ptrace::Syscall;
sub getsyscallname {
my $pid = shift;
my $cid = pt_getcall($pid);
my $name = $SYS{$cid};
$name = $SYS{ pt_getregs($pid)->rdi } while $name =~ /syscall/;
return $name;
}
die "$0 prog args ..." unless @ARGV;
my $pid = fork();
die "fork failed:$!" if !defined($pid);
if ( $pid == 0 ) { # son
pt_trace_me;
exec @ARGV;
}
else { # mom
wait; # for exec;
my $count = 0;
while ( pt_syscall($pid) == 0 ) {
last if wait == -1;
my $name = getsyscallname($pid) || 'unknown';
pt_to_scx($pid);
wait;
my $retval = pt_getcall($pid);
print "$name() = $retval\n";
$count++;
}
warn "$count system calls issued\n";
}
EXPORT
ptrace
, pt_trace_me
, pt_attach
, pt_detach
, pt_syscall
, pt_follow_fork
, pt_to_sce
, pt_to_scx
pt_getcall
,pt_setcall
. pt_getregs
, pt_setregs
pt_read
, pt_write
, pt_peekstr
, pt_pokestr
pt_kill
and PT_* constants.
for %SYS
, use <FreeBSD::amd64::Ptrace::Syscall>.
FUNCTIONS
- ptrace($request, $pid, $addr, $data)
-
A thin wrapper to "2" in ptrace.
#include <sys/types.h> #include <sys/ptrace.h> int ptrace(int request, pid_t pid, caddr_t addr, int data);
All arguments are integer from perl.
- pt_trace_me()
-
Shortand for
ptrace(PT_TRACE_ME, 0, 0, 0)
. - pt_attach($pid)
-
Shortand for
ptrace(PT_ATTACH, pid, 0, 0)
. - pt_detach($pid)
-
Shortand for
ptrace(PT_DETACH, pid, 0, 0)
. - pt_to_sce($pid)
-
Shortand for
ptrace(PT_TO_SCE, pid, 0, 0)
.Looks like SCE stands for "System Call Entry".
- pt_to_scx($pid)
-
Shortand for
ptrace(PT_TO_SCX, pid, 0, 0)
.Looks like SCE stands for "System Call eXit".
- pt_syscall($pid)
-
Shortand for
ptrace(PT_SYSCALL, pid, 1, 0)
. Unlike Linux the 3rd argument must be 1 or it loops infinitely.Note PT_SYSCALL is invoked both on entry to and return from the system call. See "SYNOPSIS" to see how to switch between them.
- pt_follow_fork($pid, $data)
-
Shorthand for
ptrace(PT_FOLLOW_SYSCALL, pid, 1, data
. - pt_getcall($pid)
-
Returns the value of RAX register which holds the system call NUMBER on entry and the return value on return.
To get the name of system call you can import
FreeBSD::amd64::Ptrace::Syscall
and use%SYS
.my $call = pt_getcall(pid); my $name = %SYS{$call};
- pt_setcall($pid, $value)
-
Sets the value of RAX register to $value. Returns status.
CAVEAT: does not seem to work immidiately after pt_to_sce. In other words, you cannot alter system call that way!
- pt_kill($pid)
-
Shortand for
ptrace(PT_KILL, $pid, 0, 0
;ptrace
,pt_trace_me
,pt_attach
,pt_detach
,pt_syscall
pt_getcall
pt_kill
and PT_* constants.CAVEAT: You CANNOT prevent the system call from being invoked with this. pt_to_sce does stop BEFORE the invocation. But the signal is sent AFTER tha system call so the process stops AFTER the invocation. There seems no way to block the call.
while ( pt_to_sce($pid) == 0 ) { last if wait == -1; my $call = pt_getcall($pid); my $name = $SYS{$call} || 'unknown'; last if $name eq 'exit'; # Needed for perl 5.18 and up next if !$banned{ $name }; pt_kill($pid); # happens AFTER the system call. die "SYS_$SYS{$call}\n"; } alarm 0;
As for
fork
, pt_kill only kills the parent. Strangely replacing pt_kill withptrace(PT_CONTINUE, $pid, 0, 9)
kills the child as well in which case core is dumped. - pt_getregs($pid)
-
Gets the register values. Returns FreeBSD::amd64::Struct::Regs object That object allows OO access to te register. Here is an example.
my $regs = pt_getregs($pid); warn $regs->rax;
- pt_setregs($pid, $reg)
-
Sets the register value to $reg where $reg is a FreeBSD::amd64::Struct::Regs object. The code below alters the value of the RAX register.
my $regs = pt_getregs($pid); $regs->rax(0); $status = pt_setregs($pid, $regs); # -1 on error
- pt_read($pid, $addr)
-
Does ptrace(PT_READ_D, $pid, $addr, 0). The code below reads the value of the first argument of the stack.
my $regs = pt_getregs($pid); my $st0 = pt_read($pid, $regs->eap + 4); my $st1 = pt_read($pid, $regs->eap + 8); # ....
- pt_write($pid, $addr, $data)
-
Writes one 32 bit value in $data to $addr
my $regs = pt_getregs($pid); # place null pointer to the first argument. my $status = pt_read($pid, $regs->eap + 4, 0);
- pt_peekstr($pid, $addr)
-
Treats $addr as a string pointer and reads its content. Be careful when you use this.
my $regs = pt_getregs($pid); my $str = pt_peekstr($pid, $regs->eap + 4);
- pt_pokestr($pid, $addr, $string)
-
Writes $string to the string pointer $addr. If the $string is longer than the original string, the string is truncated before copied.
my $regs = pt_getregs($pid); # place null pointer to the first argument. my $status = pt_read($pid, $regs->eap + 4, 0);
AUTHOR
Dan Kogai, <dankogai at dan.co.jp>
BUGS
Please report any bugs or feature requests to bug-freebsd-amd64-ptrace at rt.cpan.org
, or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html?Queue=FreeBSD-amd64-Ptrace. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.
SUPPORT
You can find documentation for this module with the perldoc command.
perldoc FreeBSD::amd64::Ptrace
You can also look for information at:
RT: CPAN's request tracker
http://rt.cpan.org/NoAuth/Bugs.html?Dist=FreeBSD-amd64-Ptrace
AnnoCPAN: Annotated CPAN documentation
CPAN Ratings
Search CPAN
ACKNOWLEDGEMENTS
COPYRIGHT & LICENSE
Copyright 2015 Dan Kogai, all rights reserved.
This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.