Attachment 166037 Details for Bug 201207 – DTrace script for ptrace calls

DTrace script for ptrace calls

ptrace_allcalls.d (text/x-dsrc), 4.48 KB, created by Eric Badger on 2016-01-24 05:08:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eric Badger

Created: 2016-01-24 05:08:32 UTC

Size: 4.48 KB

patch

obsolete

>enum ptrace_arg {
>	PT_TRACE_ME=0,
>	PT_READ_I=1,
>	PT_READ_D=2,
>	PT_WRITE_I=4,
>	PT_WRITE_D=5,
>	PT_CONTINUE=7,
>	PT_KILL=8,
>	PT_STEP=9,
>	PT_ATTACH=10,
>	PT_DETACH=11,
>	PT_IO=12,
>	PT_LWPINFO=13,
>	PT_GETNUMLWPS=14,
>	PT_GETLWPLIST=15,
>	PT_CLEARSTEP=16,
>	PT_SETSTEP=17,
>	PT_SUSPEND=18,
>	PT_RESUME=19,
>	PT_TO_SCE=20,
>	PT_TO_SCX=21,
>	PT_SYSCALL=22,
>	PT_FOLLOW_FORK=23,
>	PT_GETREGS=33,
>	PT_SETREGS=34,
>	PT_GETFPREGS=35,
>	PT_SETFPREGS=36,
>	PT_GETDBREGS=37,
>	PT_SETDBREGS=38,
>	PT_VM_TIMESTAMP=40,
>	PT_VM_ENTRY=41,
>	PT_FIRSTMACH=64
>};
>
>enum ptrace_pt_io_type {
>    PIOD_READ_D     = 1,
>    PIOD_WRITE_D    = 2,
>    PIOD_READ_I     = 3,
>    PIOD_WRITE_I    = 4
>};
>
>enum ptrace_lwpinfo_pl_event {
>    PL_EVENT_NONE = 0,
>    PL_EVENT_SIGNAL = 1
>};
>
>dtrace:::BEGIN
>{
>    ptrace_lwpinfo_pl_events[PL_EVENT_NONE] = "PL_EVENT_NONE";
>    ptrace_lwpinfo_pl_events[PL_EVENT_SIGNAL] = "PL_EVENT_SIGNAL";
>
>    ptrace_pt_io_types[PIOD_READ_D] = "PIOD_READ_D";
>    ptrace_pt_io_types[PIOD_WRITE_D] = "PIOD_WRITE_D";
>    ptrace_pt_io_types[PIOD_READ_I] = "PIOD_READ_I";
>    ptrace_pt_io_types[PIOD_WRITE_I] = "PIOD_WRITE_I";
>
>    ptrace_args[PT_TRACE_ME] = "PT_TRACE_ME";
>    ptrace_args[PT_READ_I] = "PT_READ_I";
>    ptrace_args[PT_READ_D] = "PT_READ_D";
>    ptrace_args[PT_WRITE_I] = "PT_WRITE_I";
>    ptrace_args[PT_WRITE_D] = "PT_WRITE_D";
>    ptrace_args[PT_CONTINUE] = "PT_CONTINUE";
>    ptrace_args[PT_KILL] = "PT_KILL";
>    ptrace_args[PT_STEP] = "PT_STEP";
>    ptrace_args[PT_ATTACH] = "PT_ATTACH";
>    ptrace_args[PT_DETACH] = "PT_DETACH";
>    ptrace_args[PT_IO] = "PT_IO";
>    ptrace_args[PT_LWPINFO] = "PT_LWPINFO";
>    ptrace_args[PT_GETNUMLWPS] = "PT_GETNUMLWPS";
>    ptrace_args[PT_GETLWPLIST] = "PT_GETLWPLIST";
>    ptrace_args[PT_CLEARSTEP] = "PT_CLEARSTEP";
>    ptrace_args[PT_SETSTEP] = "PT_SETSTEP";
>    ptrace_args[PT_SUSPEND] = "PT_SUSPEND";
>    ptrace_args[PT_RESUME] = "PT_RESUME";
>    ptrace_args[PT_TO_SCE] = "PT_TO_SCE";
>    ptrace_args[PT_TO_SCX] = "PT_TO_SCX";
>    ptrace_args[PT_SYSCALL] = "PT_SYSCALL";
>    ptrace_args[PT_FOLLOW_FORK] = "PT_FOLLOW_FORK";
>    ptrace_args[PT_GETREGS] = "PT_GETREGS";
>    ptrace_args[PT_SETREGS] = "PT_SETREGS";
>    ptrace_args[PT_GETFPREGS] = "PT_GETFPREGS";
>    ptrace_args[PT_SETFPREGS] = "PT_SETFPREGS";
>    ptrace_args[PT_GETDBREGS] = "PT_GETDBREGS";
>    ptrace_args[PT_SETDBREGS] = "PT_SETDBREGS";
>    ptrace_args[PT_VM_TIMESTAMP] = "PT_VM_TIMESTAMP";
>    ptrace_args[PT_VM_ENTRY] = "PT_VM_ENTRY";
>    ptrace_args[PT_FIRSTMACH] = "PT_FIRSTMACH";
>}
>
>syscall:freebsd:ptrace:entry
>{
>    printf("%s pid = %d", ptrace_args[args[0]], args[1]);
>}
>syscall:freebsd:ptrace:entry
>/args[0] == PT_IO/
>{
>    this->iostruct = (struct ptrace_io_desc*)(copyin((uintptr_t)args[2], sizeof(struct ptrace_io_desc)));
>    this->data = (unsigned char*)copyin((uintptr_t) this->iostruct->piod_addr, 1);
>    printf("\tpiod_op = %s piod_offs = 0x%p piod_addr = 0x%p piod_len = %d *piod_addr (first byte) = 0x%x",
>            ptrace_pt_io_types[this->iostruct->piod_op], this->iostruct->piod_offs,
>            this->iostruct->piod_addr, this->iostruct->piod_len, *this->data);
>    self->piod_addr = this->iostruct->piod_addr;
>}
>syscall:freebsd:ptrace:return
>/self->piod_addr/
>{
>    this->data = (unsigned char*)copyin((uintptr_t)self->piod_addr, 1);
>    printf("\t*piod_addr (first byte) = 0x%x", *this->data);
>    self->piod_addr = 0;
>}
>syscall:freebsd:ptrace:entry
>/args[0] == PT_SETREGS/
>{
>    this->regstruct = (struct reg*)(copyin((uintptr_t)args[2], sizeof(struct reg)));
>    printf("\trsp = 0x%p rbp = 0x%p rip = 0x%p",
>            this->regstruct->r_rsp, this->regstruct->r_rbp,
>            this->regstruct->r_rip);
>}
>syscall:freebsd:ptrace:entry
>/args[0] == PT_GETREGS/
>{
>    self->regsaddr = (struct reg*)args[2];
>}
>syscall:freebsd:ptrace:return
>/self->regsaddr/
>{
>    this->regstruct = (struct reg*)copyin((uintptr_t)self->regsaddr, sizeof(struct reg));
>    printf("\trsp = 0x%p rbp = 0x%p rip = 0x%p",
>            this->regstruct->r_rsp, this->regstruct->r_rbp,
>            this->regstruct->r_rip);
>    self->regsaddr = 0;
>}
>syscall:freebsd:ptrace:entry
>/args[0] == PT_LWPINFO/
>{
>    self->lwpinfo_addr = args[2];
>}
>syscall:freebsd:ptrace:return
>/self->lwpinfo_addr/
>{
>    this->lwpinfo = (struct ptrace_lwpinfo*)copyin((uintptr_t)self->lwpinfo_addr, sizeof(struct ptrace_lwpinfo));
>    printf("\tpl_lwpid = %d pl_event = %s pl_flags = 0x%x pl_siginfo.si_signo = %d",
>            this->lwpinfo->pl_lwpid, ptrace_lwpinfo_pl_events[this->lwpinfo->pl_event], this->lwpinfo->pl_flags,
>            this->lwpinfo->pl_siginfo.si_signo);
>    self->lwpinfo_addr = 0;
>}

Actions: View

Attachments on bug 201207: 158169 | 163019 | 165188 | 165447 | 165834 | 165924 | 165926 | 166037