contrast-agent 3.8.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.clang-format +5 -0
- data/.dockerignore +10 -0
- data/.gitignore +58 -0
- data/.gitmodules +6 -0
- data/.rspec +6 -0
- data/.simplecov +4 -0
- data/Gemfile +7 -0
- data/LICENSE.txt +12 -0
- data/Rakefile +15 -0
- data/exe/contrast_service +29 -0
- data/ext/build_funchook.rb +48 -0
- data/ext/cs__assess_active_record_named/cs__active_record_named.c +47 -0
- data/ext/cs__assess_active_record_named/cs__active_record_named.h +10 -0
- data/ext/cs__assess_active_record_named/extconf.rb +2 -0
- data/ext/cs__assess_array/cs__assess_array.c +38 -0
- data/ext/cs__assess_array/cs__assess_array.h +9 -0
- data/ext/cs__assess_array/extconf.rb +2 -0
- data/ext/cs__assess_basic_object/cs__assess_basic_object.c +50 -0
- data/ext/cs__assess_basic_object/cs__assess_basic_object.h +17 -0
- data/ext/cs__assess_basic_object/extconf.rb +2 -0
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +86 -0
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +34 -0
- data/ext/cs__assess_fiber_track/extconf.rb +2 -0
- data/ext/cs__assess_hash/cs__assess_hash.c +64 -0
- data/ext/cs__assess_hash/cs__assess_hash.h +24 -0
- data/ext/cs__assess_hash/extconf.rb +2 -0
- data/ext/cs__assess_kernel/cs__assess_kernel.c +36 -0
- data/ext/cs__assess_kernel/cs__assess_kernel.h +10 -0
- data/ext/cs__assess_kernel/extconf.rb +2 -0
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +47 -0
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +18 -0
- data/ext/cs__assess_marshal_module/extconf.rb +2 -0
- data/ext/cs__assess_module/cs__assess_module.c +78 -0
- data/ext/cs__assess_module/cs__assess_module.h +25 -0
- data/ext/cs__assess_module/extconf.rb +2 -0
- data/ext/cs__assess_regexp/cs__assess_regexp.c +48 -0
- data/ext/cs__assess_regexp/cs__assess_regexp.h +22 -0
- data/ext/cs__assess_regexp/extconf.rb +2 -0
- data/ext/cs__assess_regexp_track/cs__assess_regexp_track.c +63 -0
- data/ext/cs__assess_regexp_track/cs__assess_regexp_track.h +29 -0
- data/ext/cs__assess_regexp_track/extconf.rb +2 -0
- data/ext/cs__assess_string/cs__assess_string.c +38 -0
- data/ext/cs__assess_string/cs__assess_string.h +19 -0
- data/ext/cs__assess_string/extconf.rb +2 -0
- data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +31 -0
- data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h +13 -0
- data/ext/cs__assess_string_interpolation26/extconf.rb +2 -0
- data/ext/cs__common/cs__common.c +60 -0
- data/ext/cs__common/cs__common.h +28 -0
- data/ext/cs__common/extconf.rb +20 -0
- data/ext/cs__contrast_patch/cs__contrast_patch.c +445 -0
- data/ext/cs__contrast_patch/cs__contrast_patch.h +196 -0
- data/ext/cs__contrast_patch/extconf.rb +2 -0
- data/ext/cs__protect_kernel/cs__protect_kernel.c +37 -0
- data/ext/cs__protect_kernel/cs__protect_kernel.h +11 -0
- data/ext/cs__protect_kernel/extconf.rb +2 -0
- data/ext/cs__scope/cs__scope.c +96 -0
- data/ext/cs__scope/cs__scope.h +33 -0
- data/ext/cs__scope/extconf.rb +2 -0
- data/ext/extconf_common.rb +49 -0
- data/funchook/LICENSE +360 -0
- data/funchook/Makefile +29 -0
- data/funchook/Makefile.in +29 -0
- data/funchook/README.md +121 -0
- data/funchook/appveyor.yml +42 -0
- data/funchook/autogen.sh +3 -0
- data/funchook/autom4te.cache/output.0 +4976 -0
- data/funchook/autom4te.cache/requests +78 -0
- data/funchook/autom4te.cache/traces.0 +364 -0
- data/funchook/config.guess +1530 -0
- data/funchook/config.log +490 -0
- data/funchook/config.status +1016 -0
- data/funchook/config.sub +1773 -0
- data/funchook/configure +4976 -0
- data/funchook/configure.ac +59 -0
- data/funchook/distorm/COPYING +26 -0
- data/funchook/distorm/MANIFEST +25 -0
- data/funchook/distorm/MANIFEST.in +4 -0
- data/funchook/distorm/README.md +12 -0
- data/funchook/distorm/disOps/disOps.py +795 -0
- data/funchook/distorm/disOps/x86db.py +404 -0
- data/funchook/distorm/disOps/x86header.py +247 -0
- data/funchook/distorm/disOps/x86sets.py +1664 -0
- data/funchook/distorm/examples/cs/TestdiStorm/Program.cs +79 -0
- data/funchook/distorm/examples/cs/TestdiStorm/Properties/AssemblyInfo.cs +36 -0
- data/funchook/distorm/examples/cs/TestdiStorm/TestdiStorm.csproj +69 -0
- data/funchook/distorm/examples/cs/distorm-net.sln +26 -0
- data/funchook/distorm/examples/cs/distorm-net/CodeInfo.cs +23 -0
- data/funchook/distorm/examples/cs/distorm-net/DecodedInst.cs +15 -0
- data/funchook/distorm/examples/cs/distorm-net/DecodedResult.cs +14 -0
- data/funchook/distorm/examples/cs/distorm-net/DecomposedInst.cs +36 -0
- data/funchook/distorm/examples/cs/distorm-net/DecomposedResult.cs +14 -0
- data/funchook/distorm/examples/cs/distorm-net/Opcodes.cs +1268 -0
- data/funchook/distorm/examples/cs/distorm-net/Opcodes.tt +37 -0
- data/funchook/distorm/examples/cs/distorm-net/Operand.cs +25 -0
- data/funchook/distorm/examples/cs/distorm-net/Properties/AssemblyInfo.cs +36 -0
- data/funchook/distorm/examples/cs/distorm-net/diStorm3.cs +411 -0
- data/funchook/distorm/examples/cs/distorm-net/distorm-net.csproj +80 -0
- data/funchook/distorm/examples/cs/readme +3 -0
- data/funchook/distorm/examples/ddk/README +48 -0
- data/funchook/distorm/examples/ddk/distorm.ini +11 -0
- data/funchook/distorm/examples/ddk/dummy.c +15 -0
- data/funchook/distorm/examples/ddk/main.c +91 -0
- data/funchook/distorm/examples/ddk/makefile +1 -0
- data/funchook/distorm/examples/ddk/sources +10 -0
- data/funchook/distorm/examples/java/Makefile +23 -0
- data/funchook/distorm/examples/java/distorm/src/Main.java +43 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/CodeInfo.java +27 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedInst.java +32 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedResult.java +11 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedInst.java +89 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedResult.java +11 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/OpcodeEnum.java +131 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/Opcodes.java +1123 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/Operand.java +24 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/distorm3.java +41 -0
- data/funchook/distorm/examples/java/jdistorm.c +405 -0
- data/funchook/distorm/examples/java/jdistorm.h +40 -0
- data/funchook/distorm/examples/java/jdistorm.sln +20 -0
- data/funchook/distorm/examples/java/jdistorm.vcproj +208 -0
- data/funchook/distorm/examples/linux/Makefile +15 -0
- data/funchook/distorm/examples/linux/main.c +181 -0
- data/funchook/distorm/examples/tests/Makefile +15 -0
- data/funchook/distorm/examples/tests/main.cpp +42 -0
- data/funchook/distorm/examples/tests/main.py +66 -0
- data/funchook/distorm/examples/tests/test_distorm3.py +1672 -0
- data/funchook/distorm/examples/tests/tests.sln +20 -0
- data/funchook/distorm/examples/tests/tests.vcxproj +82 -0
- data/funchook/distorm/examples/tests/tests.vcxproj.filters +22 -0
- data/funchook/distorm/examples/win32/disasm.sln +25 -0
- data/funchook/distorm/examples/win32/disasm.vcxproj +201 -0
- data/funchook/distorm/examples/win32/disasm.vcxproj.filters +14 -0
- data/funchook/distorm/examples/win32/main.cpp +163 -0
- data/funchook/distorm/include/distorm.h +482 -0
- data/funchook/distorm/include/mnemonics.h +301 -0
- data/funchook/distorm/make/linux/Makefile +28 -0
- data/funchook/distorm/make/mac/Makefile +24 -0
- data/funchook/distorm/make/win32/cdistorm.vcxproj +239 -0
- data/funchook/distorm/make/win32/cdistorm.vcxproj.filters +80 -0
- data/funchook/distorm/make/win32/distorm.sln +25 -0
- data/funchook/distorm/make/win32/resource.h +14 -0
- data/funchook/distorm/make/win32/resource.rc +99 -0
- data/funchook/distorm/python/distorm3/__init__.py +957 -0
- data/funchook/distorm/python/distorm3/sample.py +51 -0
- data/funchook/distorm/setup.cfg +10 -0
- data/funchook/distorm/setup.py +266 -0
- data/funchook/distorm/src/config.h +169 -0
- data/funchook/distorm/src/decoder.c +641 -0
- data/funchook/distorm/src/decoder.h +33 -0
- data/funchook/distorm/src/distorm.c +413 -0
- data/funchook/distorm/src/instructions.c +597 -0
- data/funchook/distorm/src/instructions.h +463 -0
- data/funchook/distorm/src/insts.c +7939 -0
- data/funchook/distorm/src/insts.h +64 -0
- data/funchook/distorm/src/mnemonics.c +284 -0
- data/funchook/distorm/src/operands.c +1290 -0
- data/funchook/distorm/src/operands.h +28 -0
- data/funchook/distorm/src/prefix.c +368 -0
- data/funchook/distorm/src/prefix.h +64 -0
- data/funchook/distorm/src/textdefs.c +172 -0
- data/funchook/distorm/src/textdefs.h +57 -0
- data/funchook/distorm/src/wstring.c +47 -0
- data/funchook/distorm/src/wstring.h +35 -0
- data/funchook/distorm/src/x86defs.h +82 -0
- data/funchook/include/funchook.h +123 -0
- data/funchook/install-sh +527 -0
- data/funchook/src/Makefile +70 -0
- data/funchook/src/Makefile.in +70 -0
- data/funchook/src/__strerror.h +109 -0
- data/funchook/src/config.h +101 -0
- data/funchook/src/config.h.in +100 -0
- data/funchook/src/decoder.o +0 -0
- data/funchook/src/distorm.o +0 -0
- data/funchook/src/funchook.c +440 -0
- data/funchook/src/funchook.o +0 -0
- data/funchook/src/funchook_internal.h +155 -0
- data/funchook/src/funchook_io.c +182 -0
- data/funchook/src/funchook_io.h +64 -0
- data/funchook/src/funchook_io.o +0 -0
- data/funchook/src/funchook_syscall.S +134 -0
- data/funchook/src/funchook_syscall.o +0 -0
- data/funchook/src/funchook_unix.c +480 -0
- data/funchook/src/funchook_unix.o +0 -0
- data/funchook/src/funchook_windows.c +397 -0
- data/funchook/src/funchook_x86.c +622 -0
- data/funchook/src/funchook_x86.o +0 -0
- data/funchook/src/instructions.o +0 -0
- data/funchook/src/insts.o +0 -0
- data/funchook/src/libfunchook.so +0 -0
- data/funchook/src/mnemonics.o +0 -0
- data/funchook/src/operands.o +0 -0
- data/funchook/src/os_func.c +115 -0
- data/funchook/src/os_func.h +75 -0
- data/funchook/src/os_func.o +0 -0
- data/funchook/src/os_func_unix.c +94 -0
- data/funchook/src/os_func_unix.o +0 -0
- data/funchook/src/os_func_windows.c +32 -0
- data/funchook/src/prefix.o +0 -0
- data/funchook/src/printf_base.c +1688 -0
- data/funchook/src/printf_base.h +46 -0
- data/funchook/src/printf_base.o +0 -0
- data/funchook/src/textdefs.o +0 -0
- data/funchook/src/wstring.o +0 -0
- data/funchook/test/Makefile +43 -0
- data/funchook/test/Makefile.in +43 -0
- data/funchook/test/funchook_test +0 -0
- data/funchook/test/libfunchook_test.c +25 -0
- data/funchook/test/libfunchook_test.so +0 -0
- data/funchook/test/libfunchook_test2.c +18 -0
- data/funchook/test/suffix.list +600 -0
- data/funchook/test/test_main.c +430 -0
- data/funchook/test/test_main.o +0 -0
- data/funchook/test/x86_64_test.S +10 -0
- data/funchook/test/x86_64_test.o +0 -0
- data/funchook/test/x86_test.S +339 -0
- data/funchook/win32/config.h +1 -0
- data/funchook/win32/funchook.sln +52 -0
- data/funchook/win32/funchook.vcxproj +188 -0
- data/funchook/win32/funchook.vcxproj.filters +84 -0
- data/funchook/win32/funchook_test.vcxproj +170 -0
- data/funchook/win32/funchook_test.vcxproj.filters +22 -0
- data/funchook/win32/funchook_test_dll.vcxproj +184 -0
- data/funchook/win32/funchook_test_dll.vcxproj.filters +30 -0
- data/funchook/win32/funchook_test_exe.def +3 -0
- data/lib/contrast-agent.rb +8 -0
- data/lib/contrast.rb +57 -0
- data/lib/contrast/agent.rb +80 -0
- data/lib/contrast/agent/assess.rb +45 -0
- data/lib/contrast/agent/assess/adjusted_span.rb +25 -0
- data/lib/contrast/agent/assess/class_reverter.rb +82 -0
- data/lib/contrast/agent/assess/contrast_event.rb +398 -0
- data/lib/contrast/agent/assess/frozen_properties.rb +41 -0
- data/lib/contrast/agent/assess/insulator.rb +53 -0
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +78 -0
- data/lib/contrast/agent/assess/policy/patcher.rb +85 -0
- data/lib/contrast/agent/assess/policy/policy.rb +116 -0
- data/lib/contrast/agent/assess/policy/policy_node.rb +289 -0
- data/lib/contrast/agent/assess/policy/policy_scanner.rb +44 -0
- data/lib/contrast/agent/assess/policy/preshift.rb +94 -0
- data/lib/contrast/agent/assess/policy/propagation_method.rb +260 -0
- data/lib/contrast/agent/assess/policy/propagation_node.rb +127 -0
- data/lib/contrast/agent/assess/policy/propagator.rb +35 -0
- data/lib/contrast/agent/assess/policy/propagator/append.rb +54 -0
- data/lib/contrast/agent/assess/policy/propagator/base.rb +37 -0
- data/lib/contrast/agent/assess/policy/propagator/center.rb +73 -0
- data/lib/contrast/agent/assess/policy/propagator/custom.rb +36 -0
- data/lib/contrast/agent/assess/policy/propagator/database_write.rb +62 -0
- data/lib/contrast/agent/assess/policy/propagator/insert.rb +55 -0
- data/lib/contrast/agent/assess/policy/propagator/keep.rb +26 -0
- data/lib/contrast/agent/assess/policy/propagator/next.rb +42 -0
- data/lib/contrast/agent/assess/policy/propagator/prepend.rb +50 -0
- data/lib/contrast/agent/assess/policy/propagator/remove.rb +76 -0
- data/lib/contrast/agent/assess/policy/propagator/replace.rb +27 -0
- data/lib/contrast/agent/assess/policy/propagator/reverse.rb +38 -0
- data/lib/contrast/agent/assess/policy/propagator/select.rb +86 -0
- data/lib/contrast/agent/assess/policy/propagator/splat.rb +60 -0
- data/lib/contrast/agent/assess/policy/propagator/split.rb +49 -0
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +169 -0
- data/lib/contrast/agent/assess/policy/propagator/trim.rb +81 -0
- data/lib/contrast/agent/assess/policy/rewriter_patch.rb +79 -0
- data/lib/contrast/agent/assess/policy/source_method.rb +209 -0
- data/lib/contrast/agent/assess/policy/source_node.rb +62 -0
- data/lib/contrast/agent/assess/policy/trigger_method.rb +209 -0
- data/lib/contrast/agent/assess/policy/trigger_node.rb +198 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +77 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +31 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +40 -0
- data/lib/contrast/agent/assess/properties.rb +392 -0
- data/lib/contrast/agent/assess/rule.rb +18 -0
- data/lib/contrast/agent/assess/rule/base.rb +72 -0
- data/lib/contrast/agent/assess/rule/csrf.rb +66 -0
- data/lib/contrast/agent/assess/rule/csrf/csrf_action.rb +28 -0
- data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb +69 -0
- data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb +132 -0
- data/lib/contrast/agent/assess/rule/provider.rb +21 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +62 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +73 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +121 -0
- data/lib/contrast/agent/assess/rule/redos.rb +68 -0
- data/lib/contrast/agent/assess/rule/response_scanning_rule.rb +47 -0
- data/lib/contrast/agent/assess/rule/response_watcher.rb +36 -0
- data/lib/contrast/agent/assess/rule/watcher.rb +36 -0
- data/lib/contrast/agent/assess/tag.rb +151 -0
- data/lib/contrast/agent/at_exit_hook.rb +33 -0
- data/lib/contrast/agent/class_reopener.rb +195 -0
- data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +26 -0
- data/lib/contrast/agent/deadzone/policy/policy.rb +57 -0
- data/lib/contrast/agent/disable_reaction.rb +24 -0
- data/lib/contrast/agent/exclusion_matcher.rb +190 -0
- data/lib/contrast/agent/feature_state.rb +379 -0
- data/lib/contrast/agent/inventory/policy/policy.rb +32 -0
- data/lib/contrast/agent/inventory/policy/trigger_node.rb +22 -0
- data/lib/contrast/agent/logger_manager.rb +116 -0
- data/lib/contrast/agent/middleware.rb +352 -0
- data/lib/contrast/agent/module_data.rb +16 -0
- data/lib/contrast/agent/patching/policy/after_load_patch.rb +37 -0
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +58 -0
- data/lib/contrast/agent/patching/policy/method_policy.rb +94 -0
- data/lib/contrast/agent/patching/policy/module_policy.rb +116 -0
- data/lib/contrast/agent/patching/policy/patch.rb +312 -0
- data/lib/contrast/agent/patching/policy/patch_status.rb +192 -0
- data/lib/contrast/agent/patching/policy/patcher.rb +310 -0
- data/lib/contrast/agent/patching/policy/policy.rb +138 -0
- data/lib/contrast/agent/patching/policy/policy_node.rb +80 -0
- data/lib/contrast/agent/patching/policy/policy_unpatcher.rb +28 -0
- data/lib/contrast/agent/patching/policy/trigger_node.rb +81 -0
- data/lib/contrast/agent/protect/policy/policy.rb +37 -0
- data/lib/contrast/agent/protect/policy/trigger_node.rb +23 -0
- data/lib/contrast/agent/protect/rule.rb +58 -0
- data/lib/contrast/agent/protect/rule/base.rb +300 -0
- data/lib/contrast/agent/protect/rule/base_service.rb +88 -0
- data/lib/contrast/agent/protect/rule/cmd_injection.rb +156 -0
- data/lib/contrast/agent/protect/rule/csrf.rb +118 -0
- data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb +103 -0
- data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb +85 -0
- data/lib/contrast/agent/protect/rule/default_scanner.rb +300 -0
- data/lib/contrast/agent/protect/rule/deserialization.rb +193 -0
- data/lib/contrast/agent/protect/rule/http_method_tampering.rb +80 -0
- data/lib/contrast/agent/protect/rule/no_sqli.rb +101 -0
- data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +40 -0
- data/lib/contrast/agent/protect/rule/path_traversal.rb +143 -0
- data/lib/contrast/agent/protect/rule/sqli.rb +101 -0
- data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +16 -0
- data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +38 -0
- data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +22 -0
- data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +19 -0
- data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +20 -0
- data/lib/contrast/agent/protect/rule/xss.rb +24 -0
- data/lib/contrast/agent/protect/rule/xxe.rb +120 -0
- data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +82 -0
- data/lib/contrast/agent/railtie.rb +30 -0
- data/lib/contrast/agent/reaction_processor.rb +47 -0
- data/lib/contrast/agent/request.rb +493 -0
- data/lib/contrast/agent/request_context.rb +225 -0
- data/lib/contrast/agent/require_state.rb +61 -0
- data/lib/contrast/agent/response.rb +215 -0
- data/lib/contrast/agent/rewriter.rb +244 -0
- data/lib/contrast/agent/scope.rb +28 -0
- data/lib/contrast/agent/service_heartbeat.rb +37 -0
- data/lib/contrast/agent/settings_state.rb +148 -0
- data/lib/contrast/agent/socket_client.rb +125 -0
- data/lib/contrast/agent/thread.rb +26 -0
- data/lib/contrast/agent/tracepoint_hook.rb +51 -0
- data/lib/contrast/agent/version.rb +8 -0
- data/lib/contrast/api.rb +17 -0
- data/lib/contrast/api/.gitkeep +0 -0
- data/lib/contrast/api/connection_status.rb +49 -0
- data/lib/contrast/api/socket.rb +43 -0
- data/lib/contrast/api/speedracer.rb +206 -0
- data/lib/contrast/api/tcp_socket.rb +31 -0
- data/lib/contrast/api/unix_socket.rb +25 -0
- data/lib/contrast/common_agent_configuration.rb +86 -0
- data/lib/contrast/components/agent.rb +85 -0
- data/lib/contrast/components/app_context.rb +188 -0
- data/lib/contrast/components/assess.rb +67 -0
- data/lib/contrast/components/config.rb +135 -0
- data/lib/contrast/components/contrast_service.rb +113 -0
- data/lib/contrast/components/heap_dump.rb +34 -0
- data/lib/contrast/components/interface.rb +178 -0
- data/lib/contrast/components/inventory.rb +23 -0
- data/lib/contrast/components/logger.rb +92 -0
- data/lib/contrast/components/protect.rb +38 -0
- data/lib/contrast/components/sampling.rb +41 -0
- data/lib/contrast/components/scope.rb +106 -0
- data/lib/contrast/components/settings.rb +140 -0
- data/lib/contrast/config.rb +33 -0
- data/lib/contrast/config/agent_configuration.rb +24 -0
- data/lib/contrast/config/application_configuration.rb +27 -0
- data/lib/contrast/config/assess_configuration.rb +22 -0
- data/lib/contrast/config/assess_rules_configuration.rb +18 -0
- data/lib/contrast/config/base_configuration.rb +105 -0
- data/lib/contrast/config/default_value.rb +16 -0
- data/lib/contrast/config/exception_configuration.rb +21 -0
- data/lib/contrast/config/heap_dump_configuration.rb +23 -0
- data/lib/contrast/config/inventory_configuration.rb +20 -0
- data/lib/contrast/config/logger_configuration.rb +20 -0
- data/lib/contrast/config/protect_configuration.rb +20 -0
- data/lib/contrast/config/protect_rule_configuration.rb +37 -0
- data/lib/contrast/config/protect_rules_configuration.rb +30 -0
- data/lib/contrast/config/root_configuration.rb +26 -0
- data/lib/contrast/config/ruby_configuration.rb +39 -0
- data/lib/contrast/config/sampling_configuration.rb +22 -0
- data/lib/contrast/config/server_configuration.rb +23 -0
- data/lib/contrast/config/service_configuration.rb +22 -0
- data/lib/contrast/configuration.rb +214 -0
- data/lib/contrast/core_extensions/assess.rb +51 -0
- data/lib/contrast/core_extensions/assess/array.rb +58 -0
- data/lib/contrast/core_extensions/assess/assess_extension.rb +145 -0
- data/lib/contrast/core_extensions/assess/basic_object.rb +15 -0
- data/lib/contrast/core_extensions/assess/erb.rb +42 -0
- data/lib/contrast/core_extensions/assess/exec_trigger.rb +48 -0
- data/lib/contrast/core_extensions/assess/fiber.rb +125 -0
- data/lib/contrast/core_extensions/assess/hash.rb +22 -0
- data/lib/contrast/core_extensions/assess/kernel.rb +95 -0
- data/lib/contrast/core_extensions/assess/module.rb +14 -0
- data/lib/contrast/core_extensions/assess/regexp.rb +206 -0
- data/lib/contrast/core_extensions/assess/string.rb +75 -0
- data/lib/contrast/core_extensions/assess/tilt_template_trigger.rb +73 -0
- data/lib/contrast/core_extensions/delegator.rb +14 -0
- data/lib/contrast/core_extensions/eval_trigger.rb +52 -0
- data/lib/contrast/core_extensions/inventory.rb +22 -0
- data/lib/contrast/core_extensions/inventory/datastores.rb +37 -0
- data/lib/contrast/core_extensions/module.rb +42 -0
- data/lib/contrast/core_extensions/object.rb +27 -0
- data/lib/contrast/core_extensions/protect.rb +20 -0
- data/lib/contrast/core_extensions/protect/applies_command_injection_rule.rb +70 -0
- data/lib/contrast/core_extensions/protect/applies_deserialization_rule.rb +58 -0
- data/lib/contrast/core_extensions/protect/applies_no_sqli_rule.rb +81 -0
- data/lib/contrast/core_extensions/protect/applies_path_traversal_rule.rb +119 -0
- data/lib/contrast/core_extensions/protect/applies_sqli_rule.rb +63 -0
- data/lib/contrast/core_extensions/protect/applies_xxe_rule.rb +141 -0
- data/lib/contrast/core_extensions/protect/kernel.rb +30 -0
- data/lib/contrast/core_extensions/protect/psych.rb +7 -0
- data/lib/contrast/core_extensions/thread.rb +31 -0
- data/lib/contrast/internal_exception.rb +8 -0
- data/lib/contrast/rails_extensions/assess/action_controller_inheritance.rb +48 -0
- data/lib/contrast/rails_extensions/assess/active_record.rb +32 -0
- data/lib/contrast/rails_extensions/assess/active_record_named.rb +61 -0
- data/lib/contrast/rails_extensions/assess/configuration.rb +26 -0
- data/lib/contrast/rails_extensions/buffer.rb +30 -0
- data/lib/contrast/rails_extensions/rack.rb +45 -0
- data/lib/contrast/security_exception.rb +14 -0
- data/lib/contrast/sinatra_extensions/assess/cookie.rb +26 -0
- data/lib/contrast/sinatra_extensions/inventory/sinatra_base.rb +59 -0
- data/lib/contrast/tasks/service.rb +95 -0
- data/lib/contrast/utils/assess/sampling_util.rb +96 -0
- data/lib/contrast/utils/assess/tracking_util.rb +39 -0
- data/lib/contrast/utils/boolean_util.rb +33 -0
- data/lib/contrast/utils/cache.rb +69 -0
- data/lib/contrast/utils/class_util.rb +58 -0
- data/lib/contrast/utils/comment_range.rb +19 -0
- data/lib/contrast/utils/data_store_util.rb +23 -0
- data/lib/contrast/utils/duck_utils.rb +58 -0
- data/lib/contrast/utils/env_configuration_item.rb +52 -0
- data/lib/contrast/utils/environment_util.rb +152 -0
- data/lib/contrast/utils/freeze_util.rb +36 -0
- data/lib/contrast/utils/gemfile_reader.rb +191 -0
- data/lib/contrast/utils/hash_digest.rb +148 -0
- data/lib/contrast/utils/heap_dump_util.rb +113 -0
- data/lib/contrast/utils/invalid_configuration_util.rb +88 -0
- data/lib/contrast/utils/inventory_util.rb +126 -0
- data/lib/contrast/utils/io_util.rb +61 -0
- data/lib/contrast/utils/object_share.rb +117 -0
- data/lib/contrast/utils/operating_environment.rb +38 -0
- data/lib/contrast/utils/os.rb +49 -0
- data/lib/contrast/utils/path_util.rb +151 -0
- data/lib/contrast/utils/performs_logging.rb +152 -0
- data/lib/contrast/utils/preflight_util.rb +13 -0
- data/lib/contrast/utils/prevent_serialization.rb +52 -0
- data/lib/contrast/utils/rack_assess_session_cookie.rb +104 -0
- data/lib/contrast/utils/rails_assess_configuration.rb +95 -0
- data/lib/contrast/utils/random_util.rb +22 -0
- data/lib/contrast/utils/resource_loader.rb +23 -0
- data/lib/contrast/utils/ruby_ast_rewriter.rb +74 -0
- data/lib/contrast/utils/scope_util.rb +99 -0
- data/lib/contrast/utils/service_response_util.rb +116 -0
- data/lib/contrast/utils/service_sender_util.rb +98 -0
- data/lib/contrast/utils/sha256_builder.rb +69 -0
- data/lib/contrast/utils/sinatra_helper.rb +49 -0
- data/lib/contrast/utils/stack_trace_utils.rb +209 -0
- data/lib/contrast/utils/string_utils.rb +72 -0
- data/lib/contrast/utils/tag_util.rb +139 -0
- data/lib/contrast/utils/thread_tracker.rb +54 -0
- data/lib/contrast/utils/timer.rb +78 -0
- data/resources/assess/policy.json +1673 -0
- data/resources/csrf/inject.js +44 -0
- data/resources/deadzone/policy.json +55 -0
- data/resources/factory-bot-spec/spec_helper.rb +30 -0
- data/resources/inventory/policy.json +110 -0
- data/resources/protect/policy.json +417 -0
- data/resources/rubocops/kernel/catch_cop.rb +37 -0
- data/resources/rubocops/kernel/require_cop.rb +37 -0
- data/resources/rubocops/kernel/require_relative_cop.rb +33 -0
- data/resources/rubocops/module/autoload_cop.rb +37 -0
- data/resources/rubocops/module/const_defined_cop.rb +37 -0
- data/resources/rubocops/module/const_get_cop.rb +37 -0
- data/resources/rubocops/module/const_set_cop.rb +37 -0
- data/resources/rubocops/module/constants_cop.rb +37 -0
- data/resources/rubocops/module/name_cop.rb +37 -0
- data/resources/rubocops/object/class_cop.rb +37 -0
- data/resources/rubocops/object/freeze_cop.rb +37 -0
- data/resources/rubocops/object/frozen_cop.rb +37 -0
- data/resources/rubocops/object/is_a_cop.rb +37 -0
- data/resources/rubocops/object/method_cop.rb +37 -0
- data/resources/rubocops/object/respond_to_cop.rb +37 -0
- data/resources/rubocops/object/singleton_class_cop.rb +37 -0
- data/resources/rubocops/regexp/spelling_cop.rb +44 -0
- data/resources/rubocops/thread/new_cop.rb +39 -0
- data/resources/ruby-spec/ancestors_spec.rb +70 -0
- data/resources/ruby-spec/modulo_spec.rb +831 -0
- data/resources/ruby-spec/parameters_spec.rb +261 -0
- data/resources/ruby-spec/ruby_spec_spec_helper.rb +35 -0
- data/resources/test_marker.txt +1 -0
- data/ruby-agent.gemspec +129 -0
- data/service_executables/.gitkeep +0 -0
- data/service_executables/VERSION +1 -0
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +945 -0
Binary file
|
Binary file
|
@@ -0,0 +1,440 @@
|
|
1
|
+
/* -*- indent-tabs-mode: nil -*-
|
2
|
+
*
|
3
|
+
* This file is part of Funchook.
|
4
|
+
* https://github.com/kubo/funchook
|
5
|
+
*
|
6
|
+
* Funchook is free software: you can redistribute it and/or modify it
|
7
|
+
* under the terms of the GNU General Public License as published by the
|
8
|
+
* Free Software Foundation, either version 2 of the License, or (at your
|
9
|
+
* option) any later version.
|
10
|
+
*
|
11
|
+
* As a special exception, the copyright holders of this library give you
|
12
|
+
* permission to link this library with independent modules to produce an
|
13
|
+
* executable, regardless of the license terms of these independent
|
14
|
+
* modules, and to copy and distribute the resulting executable under
|
15
|
+
* terms of your choice, provided that you also meet, for each linked
|
16
|
+
* independent module, the terms and conditions of the license of that
|
17
|
+
* module. An independent module is a module which is not derived from or
|
18
|
+
* based on this library. If you modify this library, you may extend this
|
19
|
+
* exception to your version of the library, but you are not obliged to
|
20
|
+
* do so. If you do not wish to do so, delete this exception statement
|
21
|
+
* from your version.
|
22
|
+
*
|
23
|
+
* Funchook is distributed in the hope that it will be useful, but WITHOUT
|
24
|
+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
25
|
+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
26
|
+
* for more details.
|
27
|
+
*
|
28
|
+
* You should have received a copy of the GNU General Public License
|
29
|
+
* along with Funchook. If not, see <http://www.gnu.org/licenses/>.
|
30
|
+
*/
|
31
|
+
#include "config.h"
|
32
|
+
#include <stdio.h>
|
33
|
+
#include <stdarg.h>
|
34
|
+
#include <stddef.h>
|
35
|
+
#include <stdlib.h>
|
36
|
+
#include <stdint.h>
|
37
|
+
#include <string.h>
|
38
|
+
#include <limits.h>
|
39
|
+
#ifdef WIN32
|
40
|
+
#include <windows.h>
|
41
|
+
#ifndef PATH_MAX
|
42
|
+
#define PATH_MAX MAX_PATH
|
43
|
+
#endif
|
44
|
+
#endif
|
45
|
+
#include "funchook.h"
|
46
|
+
#include "funchook_io.h"
|
47
|
+
#include "funchook_internal.h"
|
48
|
+
|
49
|
+
#define FUNCHOOK_MAX_ERROR_MESSAGE_LEN 200
|
50
|
+
|
51
|
+
typedef struct funchook_entry {
|
52
|
+
void *target_func;
|
53
|
+
void *hook_func;
|
54
|
+
uint8_t trampoline[TRAMPOLINE_SIZE];
|
55
|
+
uint8_t old_code[JUMP32_SIZE];
|
56
|
+
uint8_t new_code[JUMP32_SIZE];
|
57
|
+
#ifdef CPU_X86_64
|
58
|
+
uint8_t transit[JUMP64_SIZE];
|
59
|
+
#endif
|
60
|
+
} funchook_entry_t;
|
61
|
+
|
62
|
+
struct funchook_page {
|
63
|
+
struct funchook_page *next;
|
64
|
+
uint16_t used;
|
65
|
+
funchook_entry_t entries[1];
|
66
|
+
};
|
67
|
+
|
68
|
+
struct funchook {
|
69
|
+
int installed;
|
70
|
+
funchook_page_t *page_list;
|
71
|
+
char error_message[FUNCHOOK_MAX_ERROR_MESSAGE_LEN];
|
72
|
+
funchook_io_t io;
|
73
|
+
};
|
74
|
+
|
75
|
+
char funchook_debug_file[PATH_MAX];
|
76
|
+
|
77
|
+
const size_t funchook_size = sizeof(funchook_t);
|
78
|
+
|
79
|
+
static size_t num_entries_in_page;
|
80
|
+
|
81
|
+
static void funchook_logv(funchook_t *funchook, int set_error, const char *fmt, va_list ap);
|
82
|
+
static void funchook_log_end(funchook_t *funchook, const char *fmt, ...);
|
83
|
+
static funchook_t *funchook_create_internal(void);
|
84
|
+
static int funchook_prepare_internal(funchook_t *funchook, void **target_func, void *hook_func);
|
85
|
+
static int funchook_install_internal(funchook_t *funchook, int flags);
|
86
|
+
static int funchook_uninstall_internal(funchook_t *funchook, int flags);
|
87
|
+
static int funchook_destroy_internal(funchook_t *funchook);
|
88
|
+
static int get_page(funchook_t *funchook, funchook_page_t **page_out, uint8_t *addr, rip_displacement_t *disp);
|
89
|
+
|
90
|
+
#ifdef CPU_X86_64
|
91
|
+
|
92
|
+
int funchook_page_avail(funchook_t *funchook, funchook_page_t *page, int idx, uint8_t *addr, rip_displacement_t *disp)
|
93
|
+
{
|
94
|
+
funchook_entry_t *entry = &page->entries[idx];
|
95
|
+
const uint8_t *src;
|
96
|
+
const uint8_t *dst;
|
97
|
+
|
98
|
+
if (!funchook_jump32_avail(addr, entry->trampoline)) {
|
99
|
+
funchook_log(funchook, " could not jump function %p to trampoline %p\n", addr, entry->trampoline);
|
100
|
+
return 0;
|
101
|
+
}
|
102
|
+
src = entry->trampoline + disp[0].src_addr_offset;
|
103
|
+
dst = disp[0].dst_addr;
|
104
|
+
if (!funchook_within_32bit_relative(src, dst)) {
|
105
|
+
funchook_log(funchook, " could not jump trampoline %p to function %p\n",
|
106
|
+
src, dst);
|
107
|
+
return 0;
|
108
|
+
}
|
109
|
+
src = entry->trampoline + disp[1].src_addr_offset;
|
110
|
+
dst = disp[1].dst_addr;
|
111
|
+
if (dst != 0 && !funchook_within_32bit_relative(src, dst)) {
|
112
|
+
funchook_log(funchook, " could not make 32-bit relative address from %p to %p\n",
|
113
|
+
src, dst);
|
114
|
+
return 0;
|
115
|
+
}
|
116
|
+
return 1;
|
117
|
+
}
|
118
|
+
|
119
|
+
#endif
|
120
|
+
|
121
|
+
funchook_t *funchook_create(void)
|
122
|
+
{
|
123
|
+
funchook_t *funchook = NULL;
|
124
|
+
|
125
|
+
funchook_log(funchook, "Enter funchook_create()\n");
|
126
|
+
funchook = funchook_create_internal();
|
127
|
+
funchook_log_end(funchook, "Leave funchook_create() => %p\n", funchook);
|
128
|
+
return funchook;
|
129
|
+
}
|
130
|
+
|
131
|
+
int funchook_prepare(funchook_t *funchook, void **target_func, void *hook_func)
|
132
|
+
{
|
133
|
+
int rv;
|
134
|
+
void *orig_func;
|
135
|
+
|
136
|
+
funchook_log(funchook, "Enter funchook_prepare(%p, %p, %p)\n", funchook, target_func, hook_func);
|
137
|
+
orig_func = *target_func;
|
138
|
+
rv = funchook_prepare_internal(funchook, target_func, hook_func);
|
139
|
+
funchook_log_end(funchook, "Leave funchook_prepare(..., [%p->%p],...) => %d\n", orig_func, *target_func, rv);
|
140
|
+
return rv;
|
141
|
+
}
|
142
|
+
|
143
|
+
int funchook_install(funchook_t *funchook, int flags)
|
144
|
+
{
|
145
|
+
int rv;
|
146
|
+
|
147
|
+
funchook_log(funchook, "Enter funchook_install(%p, 0x%x)\n", funchook, flags);
|
148
|
+
rv = funchook_install_internal(funchook, flags);
|
149
|
+
funchook_log_end(funchook, "Leave funchook_install() => %d\n", rv);
|
150
|
+
return rv;
|
151
|
+
}
|
152
|
+
|
153
|
+
int funchook_uninstall(funchook_t *funchook, int flags)
|
154
|
+
{
|
155
|
+
int rv;
|
156
|
+
|
157
|
+
funchook_log(funchook, "Enter funchook_uninstall(%p, 0x%x)\n", funchook, flags);
|
158
|
+
rv = funchook_uninstall_internal(funchook, flags);
|
159
|
+
funchook_log_end(NULL, "Leave funchook_uninstall() => %d\n", rv);
|
160
|
+
return rv;
|
161
|
+
}
|
162
|
+
|
163
|
+
int funchook_destroy(funchook_t *funchook)
|
164
|
+
{
|
165
|
+
int rv;
|
166
|
+
|
167
|
+
funchook_log(funchook, "Enter funchook_destroy(%p)\n", funchook);
|
168
|
+
rv = funchook_destroy_internal(funchook);
|
169
|
+
funchook_log_end(rv == 0 ? NULL : funchook, "Leave funchook_destroy() => %d\n", rv);
|
170
|
+
return rv;
|
171
|
+
}
|
172
|
+
|
173
|
+
const char *funchook_error_message(const funchook_t *funchook)
|
174
|
+
{
|
175
|
+
return funchook->error_message;
|
176
|
+
}
|
177
|
+
|
178
|
+
int funchook_set_debug_file(const char *name)
|
179
|
+
{
|
180
|
+
if (name != NULL) {
|
181
|
+
strlcpy(funchook_debug_file, name, sizeof(funchook_debug_file));
|
182
|
+
} else {
|
183
|
+
funchook_debug_file[0] = '\0';
|
184
|
+
}
|
185
|
+
return 0;
|
186
|
+
}
|
187
|
+
|
188
|
+
void funchook_log(funchook_t *funchook, const char *fmt, ...)
|
189
|
+
{
|
190
|
+
va_list ap;
|
191
|
+
va_start(ap, fmt);
|
192
|
+
funchook_logv(funchook, 0, fmt, ap);
|
193
|
+
va_end(ap);
|
194
|
+
}
|
195
|
+
|
196
|
+
void funchook_set_error_message(funchook_t *funchook, const char *fmt, ...)
|
197
|
+
{
|
198
|
+
va_list ap;
|
199
|
+
|
200
|
+
va_start(ap, fmt);
|
201
|
+
funchook_vsnprintf(funchook->error_message, FUNCHOOK_MAX_ERROR_MESSAGE_LEN, fmt, ap);
|
202
|
+
va_end(ap);
|
203
|
+
va_start(ap, fmt);
|
204
|
+
funchook_logv(funchook, 1, fmt, ap);
|
205
|
+
va_end(ap);
|
206
|
+
}
|
207
|
+
|
208
|
+
static void funchook_logv(funchook_t *funchook, int set_error, const char *fmt, va_list ap)
|
209
|
+
{
|
210
|
+
funchook_io_t iobuf;
|
211
|
+
funchook_io_t *io = &iobuf;
|
212
|
+
|
213
|
+
if (*funchook_debug_file == '\0') {
|
214
|
+
return;
|
215
|
+
}
|
216
|
+
if (funchook == NULL) {
|
217
|
+
funchook_io_open(&iobuf, funchook_debug_file, FUNCHOOK_IO_APPEND);
|
218
|
+
} else if (funchook->io.file == INVALID_FILE_HANDLE) {
|
219
|
+
funchook_io_open(&funchook->io, funchook_debug_file, FUNCHOOK_IO_APPEND);
|
220
|
+
io = &funchook->io;
|
221
|
+
} else {
|
222
|
+
io = &funchook->io;
|
223
|
+
}
|
224
|
+
if (io->file == INVALID_FILE_HANDLE) {
|
225
|
+
return;
|
226
|
+
}
|
227
|
+
if (set_error) {
|
228
|
+
funchook_io_puts(" ", io);
|
229
|
+
}
|
230
|
+
funchook_io_vprintf(io, fmt, ap);
|
231
|
+
if (set_error) {
|
232
|
+
funchook_io_putc('\n', io);
|
233
|
+
}
|
234
|
+
if (funchook == NULL) {
|
235
|
+
funchook_io_close(io);
|
236
|
+
} else {
|
237
|
+
funchook_io_flush(io);
|
238
|
+
}
|
239
|
+
}
|
240
|
+
|
241
|
+
static void funchook_log_end(funchook_t *funchook, const char *fmt, ...)
|
242
|
+
{
|
243
|
+
va_list ap;
|
244
|
+
va_start(ap, fmt);
|
245
|
+
funchook_logv(funchook, 0, fmt, ap);
|
246
|
+
va_end(ap);
|
247
|
+
if (funchook != NULL && funchook->io.file != INVALID_FILE_HANDLE) {
|
248
|
+
funchook_io_close(&funchook->io);
|
249
|
+
}
|
250
|
+
}
|
251
|
+
|
252
|
+
static funchook_t *funchook_create_internal(void)
|
253
|
+
{
|
254
|
+
funchook_t *funchook = funchook_alloc();
|
255
|
+
if (funchook == NULL) {
|
256
|
+
return NULL;
|
257
|
+
}
|
258
|
+
funchook->io.file = INVALID_FILE_HANDLE;
|
259
|
+
if (num_entries_in_page == 0) {
|
260
|
+
num_entries_in_page = (page_size - offsetof(funchook_page_t, entries)) / sizeof(funchook_entry_t);
|
261
|
+
funchook_log(funchook,
|
262
|
+
#ifdef WIN32
|
263
|
+
" allocation_unit=%"SIZE_T_FMT"u\n"
|
264
|
+
#endif
|
265
|
+
" page_size=%"SIZE_T_FMT"u\n"
|
266
|
+
" num_entries_in_page=%"SIZE_T_FMT"u\n",
|
267
|
+
#ifdef WIN32
|
268
|
+
allocation_unit,
|
269
|
+
#endif
|
270
|
+
page_size, num_entries_in_page);
|
271
|
+
}
|
272
|
+
return funchook;
|
273
|
+
}
|
274
|
+
|
275
|
+
static int funchook_prepare_internal(funchook_t *funchook, void **target_func, void *hook_func)
|
276
|
+
{
|
277
|
+
void *func = *target_func;
|
278
|
+
uint8_t trampoline[TRAMPOLINE_SIZE];
|
279
|
+
rip_displacement_t disp[2] = {{0,},{0,}};
|
280
|
+
funchook_page_t *page = NULL;
|
281
|
+
funchook_entry_t *entry;
|
282
|
+
uint8_t *src_addr;
|
283
|
+
uint32_t *offset_addr;
|
284
|
+
int rv;
|
285
|
+
|
286
|
+
if (funchook->installed) {
|
287
|
+
funchook_set_error_message(funchook, "Could not modify already-installed funchook handle.");
|
288
|
+
return FUNCHOOK_ERROR_ALREADY_INSTALLED;
|
289
|
+
}
|
290
|
+
func = funchook_resolve_func(funchook, func);
|
291
|
+
rv = funchook_make_trampoline(funchook, disp, func, trampoline);
|
292
|
+
if (rv != 0) {
|
293
|
+
funchook_log(funchook, " failed to make trampoline\n");
|
294
|
+
return rv;
|
295
|
+
}
|
296
|
+
rv = get_page(funchook, &page, func, disp);
|
297
|
+
if (rv != 0) {
|
298
|
+
funchook_log(funchook, " failed to get page\n");
|
299
|
+
return rv;
|
300
|
+
}
|
301
|
+
entry = &page->entries[page->used];
|
302
|
+
/* fill members */
|
303
|
+
entry->target_func = func;
|
304
|
+
entry->hook_func = hook_func;
|
305
|
+
memcpy(entry->trampoline, trampoline, TRAMPOLINE_SIZE);
|
306
|
+
memcpy(entry->old_code, func, JUMP32_SIZE);
|
307
|
+
#ifdef CPU_X86_64
|
308
|
+
if (funchook_jump32_avail(func, hook_func)) {
|
309
|
+
funchook_write_jump32(funchook, func, hook_func, entry->new_code);
|
310
|
+
entry->transit[0] = 0;
|
311
|
+
} else {
|
312
|
+
funchook_write_jump32(funchook, func, entry->transit, entry->new_code);
|
313
|
+
funchook_write_jump64(funchook, entry->transit, hook_func);
|
314
|
+
}
|
315
|
+
#else
|
316
|
+
funchook_write_jump32(funchook, func, hook_func, entry->new_code);
|
317
|
+
#endif
|
318
|
+
/* fix rip-relative offsets */
|
319
|
+
src_addr = entry->trampoline + disp[0].src_addr_offset;
|
320
|
+
offset_addr = (uint32_t*)(entry->trampoline + disp[0].pos_offset);
|
321
|
+
*offset_addr = (uint32_t)(disp[0].dst_addr - src_addr);
|
322
|
+
if (disp[1].dst_addr != 0) {
|
323
|
+
src_addr = entry->trampoline + disp[1].src_addr_offset;
|
324
|
+
offset_addr = (uint32_t*)(entry->trampoline + disp[1].pos_offset);
|
325
|
+
*offset_addr = (uint32_t)(disp[1].dst_addr - src_addr);
|
326
|
+
}
|
327
|
+
funchook_log_trampoline(funchook, entry->trampoline);
|
328
|
+
|
329
|
+
page->used++;
|
330
|
+
*target_func = (void*)entry->trampoline;
|
331
|
+
return 0;
|
332
|
+
}
|
333
|
+
|
334
|
+
static int funchook_install_internal(funchook_t *funchook, int flags)
|
335
|
+
{
|
336
|
+
funchook_page_t *page;
|
337
|
+
|
338
|
+
if (funchook->installed) {
|
339
|
+
return FUNCHOOK_ERROR_ALREADY_INSTALLED;
|
340
|
+
}
|
341
|
+
|
342
|
+
for (page = funchook->page_list; page != NULL; page = page->next) {
|
343
|
+
int rv = funchook_page_protect(funchook, page);
|
344
|
+
int i;
|
345
|
+
|
346
|
+
if (rv != 0) {
|
347
|
+
return rv;
|
348
|
+
}
|
349
|
+
|
350
|
+
for (i = 0; i < page->used; i++) {
|
351
|
+
funchook_entry_t *entry = &page->entries[i];
|
352
|
+
mem_state_t mstate;
|
353
|
+
int rv = funchook_unprotect_begin(funchook, &mstate, entry->target_func, JUMP32_SIZE);
|
354
|
+
|
355
|
+
if (rv != 0) {
|
356
|
+
return rv;
|
357
|
+
}
|
358
|
+
memcpy(entry->target_func, entry->new_code, JUMP32_SIZE);
|
359
|
+
rv = funchook_unprotect_end(funchook, &mstate);
|
360
|
+
if (rv != 0) {
|
361
|
+
return rv;
|
362
|
+
}
|
363
|
+
}
|
364
|
+
}
|
365
|
+
funchook->installed = 1;
|
366
|
+
return 0;
|
367
|
+
}
|
368
|
+
|
369
|
+
static int funchook_uninstall_internal(funchook_t *funchook, int flags)
|
370
|
+
{
|
371
|
+
funchook_page_t *page;
|
372
|
+
|
373
|
+
if (!funchook->installed) {
|
374
|
+
return FUNCHOOK_ERROR_NOT_INSTALLED;
|
375
|
+
}
|
376
|
+
|
377
|
+
for (page = funchook->page_list; page != NULL; page = page->next) {
|
378
|
+
int i;
|
379
|
+
|
380
|
+
for (i = 0; i < page->used; i++) {
|
381
|
+
funchook_entry_t *entry = &page->entries[i];
|
382
|
+
mem_state_t mstate;
|
383
|
+
int rv = funchook_unprotect_begin(funchook, &mstate, entry->target_func, JUMP32_SIZE);
|
384
|
+
|
385
|
+
if (rv != 0) {
|
386
|
+
return rv;
|
387
|
+
}
|
388
|
+
memcpy(entry->target_func, entry->old_code, JUMP32_SIZE);
|
389
|
+
rv = funchook_unprotect_end(funchook, &mstate);
|
390
|
+
if (rv != 0) {
|
391
|
+
return rv;
|
392
|
+
}
|
393
|
+
}
|
394
|
+
funchook_page_unprotect(funchook, page);
|
395
|
+
}
|
396
|
+
funchook->installed = 0;
|
397
|
+
return 0;
|
398
|
+
}
|
399
|
+
|
400
|
+
static int funchook_destroy_internal(funchook_t *funchook)
|
401
|
+
{
|
402
|
+
funchook_page_t *page, *page_next;
|
403
|
+
|
404
|
+
if (funchook == NULL) {
|
405
|
+
return -1;
|
406
|
+
}
|
407
|
+
if (funchook->installed) {
|
408
|
+
return FUNCHOOK_ERROR_ALREADY_INSTALLED;
|
409
|
+
}
|
410
|
+
for (page = funchook->page_list; page != NULL; page = page_next) {
|
411
|
+
page_next = page->next;
|
412
|
+
funchook_page_free(funchook, page);
|
413
|
+
}
|
414
|
+
funchook_io_close(&funchook->io);
|
415
|
+
funchook_free(funchook);
|
416
|
+
return 0;
|
417
|
+
}
|
418
|
+
|
419
|
+
static int get_page(funchook_t *funchook, funchook_page_t **page_out, uint8_t *addr, rip_displacement_t *disp)
|
420
|
+
{
|
421
|
+
funchook_page_t *page;
|
422
|
+
int rv;
|
423
|
+
|
424
|
+
for (page = funchook->page_list; page != NULL; page = page->next) {
|
425
|
+
if (page->used < num_entries_in_page && funchook_page_avail(funchook, page, page->used, addr, disp)) {
|
426
|
+
/* Reuse allocated page. */
|
427
|
+
*page_out = page;
|
428
|
+
return 0;
|
429
|
+
}
|
430
|
+
}
|
431
|
+
rv = funchook_page_alloc(funchook, &page, addr, disp);
|
432
|
+
if (rv != 0) {
|
433
|
+
return rv;
|
434
|
+
}
|
435
|
+
page->used = 0;
|
436
|
+
page->next = funchook->page_list;
|
437
|
+
funchook->page_list = page;
|
438
|
+
*page_out = page;
|
439
|
+
return 0;
|
440
|
+
}
|
Binary file
|
@@ -0,0 +1,155 @@
|
|
1
|
+
/* -*- indent-tabs-mode: nil -*-
|
2
|
+
*
|
3
|
+
* This file is part of Funchook.
|
4
|
+
* https://github.com/kubo/funchook
|
5
|
+
*
|
6
|
+
* Funchook is free software: you can redistribute it and/or modify it
|
7
|
+
* under the terms of the GNU General Public License as published by the
|
8
|
+
* Free Software Foundation, either version 2 of the License, or (at your
|
9
|
+
* option) any later version.
|
10
|
+
*
|
11
|
+
* As a special exception, the copyright holders of this library give you
|
12
|
+
* permission to link this library with independent modules to produce an
|
13
|
+
* executable, regardless of the license terms of these independent
|
14
|
+
* modules, and to copy and distribute the resulting executable under
|
15
|
+
* terms of your choice, provided that you also meet, for each linked
|
16
|
+
* independent module, the terms and conditions of the license of that
|
17
|
+
* module. An independent module is a module which is not derived from or
|
18
|
+
* based on this library. If you modify this library, you may extend this
|
19
|
+
* exception to your version of the library, but you are not obliged to
|
20
|
+
* do so. If you do not wish to do so, delete this exception statement
|
21
|
+
* from your version.
|
22
|
+
*
|
23
|
+
* Funchook is distributed in the hope that it will be useful, but WITHOUT
|
24
|
+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
25
|
+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
26
|
+
* for more details.
|
27
|
+
*
|
28
|
+
* You should have received a copy of the GNU General Public License
|
29
|
+
* along with Funchook. If not, see <http://www.gnu.org/licenses/>.
|
30
|
+
*/
|
31
|
+
#ifndef FUNCHOOK_INTERNAL_H
|
32
|
+
#define FUNCHOOK_INTERNAL_H 1
|
33
|
+
#include "funchook.h"
|
34
|
+
#include "os_func.h"
|
35
|
+
|
36
|
+
#ifndef MIN
|
37
|
+
#define MIN(a, b) (((a) < (b)) ? (a) : (b))
|
38
|
+
#endif
|
39
|
+
|
40
|
+
#ifndef MAX
|
41
|
+
#define MAX(a, b) (((a) > (b)) ? (a) : (b))
|
42
|
+
#endif
|
43
|
+
|
44
|
+
#ifdef WIN32
|
45
|
+
#ifdef _WIN64
|
46
|
+
#define SIZE_T_FMT "I64"
|
47
|
+
#define SIZE_T_WIDTH "16"
|
48
|
+
#else
|
49
|
+
#define SIZE_T_FMT ""
|
50
|
+
#define SIZE_T_WIDTH "8"
|
51
|
+
#endif /* _WIN64 */
|
52
|
+
#else /* WIN32 */
|
53
|
+
#if defined(__LP64__) || defined(_LP64)
|
54
|
+
#define SIZE_T_FMT "l"
|
55
|
+
#define SIZE_T_WIDTH "16"
|
56
|
+
#else
|
57
|
+
#ifdef __APPLE__
|
58
|
+
#define SIZE_T_FMT "z"
|
59
|
+
#else
|
60
|
+
#define SIZE_T_FMT ""
|
61
|
+
#endif
|
62
|
+
#define SIZE_T_WIDTH "8"
|
63
|
+
#endif /* defined(__LP64__) || defined(_LP64) */
|
64
|
+
#endif /* WIN32 */
|
65
|
+
|
66
|
+
#ifndef __GNUC__
|
67
|
+
#define __attribute__(arg)
|
68
|
+
#endif
|
69
|
+
|
70
|
+
#define ROUND_DOWN(num, unit) ((num) & ~((unit) - 1))
|
71
|
+
#define ROUND_UP(num, unit) (((num) + (unit) - 1) & ~((unit) - 1))
|
72
|
+
|
73
|
+
#if defined _M_AMD64 || defined __x86_64__
|
74
|
+
#define CPU_X86_64
|
75
|
+
#endif
|
76
|
+
|
77
|
+
#define MAX_INSN_LEN 16
|
78
|
+
#define MAX_INSN_CHECK_SIZE 256
|
79
|
+
|
80
|
+
#define JUMP32_SIZE 5
|
81
|
+
#ifdef CPU_X86_64
|
82
|
+
#define JUMP64_SIZE 14
|
83
|
+
#endif
|
84
|
+
|
85
|
+
#define TRAMPOLINE_SIZE (JUMP32_SIZE + (MAX_INSN_LEN - 1) + JUMP32_SIZE)
|
86
|
+
|
87
|
+
/* This must be same with sysconf(_SC_PAGE_SIZE) on Unix
|
88
|
+
* or the dwPageSize member of the SYSTEM_INFO structure on Windows.
|
89
|
+
*/
|
90
|
+
#undef PAGE_SIZE
|
91
|
+
#define PAGE_SIZE 0x1000 /* 4k */
|
92
|
+
|
93
|
+
/* This must be same with the dwAllocationGranularity
|
94
|
+
* member of the SYSTEM_INFO structure on Windows.
|
95
|
+
*/
|
96
|
+
#define ALLOCATION_UNIT 0x10000 /* 64k */
|
97
|
+
|
98
|
+
typedef struct {
|
99
|
+
void *addr;
|
100
|
+
size_t size;
|
101
|
+
#ifdef WIN32
|
102
|
+
DWORD protect;
|
103
|
+
#endif
|
104
|
+
} mem_state_t;
|
105
|
+
|
106
|
+
typedef struct {
|
107
|
+
const uint8_t *dst_addr;
|
108
|
+
intptr_t src_addr_offset;
|
109
|
+
intptr_t pos_offset;
|
110
|
+
} rip_displacement_t;
|
111
|
+
|
112
|
+
typedef struct funchook_page funchook_page_t;
|
113
|
+
|
114
|
+
/* Functions in funchook.c */
|
115
|
+
extern const size_t funchook_size;
|
116
|
+
extern char funchook_debug_file[];
|
117
|
+
#ifdef CPU_X86_64
|
118
|
+
int funchook_page_avail(funchook_t *funchook, funchook_page_t *page, int idx, uint8_t *addr, rip_displacement_t *disp);
|
119
|
+
#else
|
120
|
+
#define funchook_page_avail(funchook, page, idx, addr, disp) (1)
|
121
|
+
#endif
|
122
|
+
void funchook_log(funchook_t *funchook, const char *fmt, ...) __attribute__((__format__ (__printf__, 2, 3)));
|
123
|
+
void funchook_set_error_message(funchook_t *funchook, const char *fmt, ...) __attribute__((__format__ (__printf__, 2, 3)));
|
124
|
+
|
125
|
+
/* Functions in funchook_linux.c & funchook_windows.c */
|
126
|
+
extern const size_t page_size;
|
127
|
+
extern const size_t allocation_unit; /* windows only */
|
128
|
+
|
129
|
+
funchook_t *funchook_alloc(void);
|
130
|
+
int funchook_free(funchook_t *funchook);
|
131
|
+
|
132
|
+
int funchook_page_alloc(funchook_t *funchook, funchook_page_t **page_out, uint8_t *func, rip_displacement_t *disp);
|
133
|
+
int funchook_page_free(funchook_t *funchook, funchook_page_t *page);
|
134
|
+
int funchook_page_protect(funchook_t *funchook, funchook_page_t *page);
|
135
|
+
int funchook_page_unprotect(funchook_t *funchook, funchook_page_t *page);
|
136
|
+
|
137
|
+
int funchook_unprotect_begin(funchook_t *funchook, mem_state_t *mstate, void *addr, size_t len);
|
138
|
+
int funchook_unprotect_end(funchook_t *funchook, const mem_state_t *mstate);
|
139
|
+
|
140
|
+
void *funchook_resolve_func(funchook_t *funchook, void *func);
|
141
|
+
const char *funchook_strerror(int errnum, char *buf, size_t buflen);
|
142
|
+
|
143
|
+
/* Functions in funchook_x86.c */
|
144
|
+
|
145
|
+
int funchook_write_jump32(funchook_t *funchook, const uint8_t *src, const uint8_t *dst, uint8_t *out);
|
146
|
+
#ifdef CPU_X86_64
|
147
|
+
int funchook_write_jump64(funchook_t *funchook, uint8_t *src, const uint8_t *dst);
|
148
|
+
int funchook_within_32bit_relative(const uint8_t *src, const uint8_t *dst);
|
149
|
+
int funchook_jump32_avail(const uint8_t *src, const uint8_t *dst);
|
150
|
+
#endif
|
151
|
+
|
152
|
+
int funchook_make_trampoline(funchook_t *funchook, rip_displacement_t *disp, const uint8_t *func, uint8_t *trampoline);
|
153
|
+
void funchook_log_trampoline(funchook_t *funchook, const uint8_t *trampoline);
|
154
|
+
|
155
|
+
#endif
|