ragweed 0.1.7.3 → 0.2.0.pre1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (34) hide show
  1. data/README.rdoc +33 -8
  2. data/Rakefile +80 -23
  3. data/VERSION +1 -0
  4. data/examples/hittracertux.rb +2 -6
  5. data/examples/hook_notepad.rb +1 -1
  6. data/examples/tux-example.rb +3 -2
  7. data/lib/.DS_Store +0 -0
  8. data/lib/ragweed/debugger32.rb +188 -145
  9. data/lib/ragweed/debuggerosx.rb +13 -13
  10. data/lib/ragweed/debuggertux.rb +267 -140
  11. data/lib/ragweed/rasm.rb +1 -1
  12. data/lib/ragweed/wrap32/debugging.rb +184 -64
  13. data/lib/ragweed/wrap32/hooks.rb +27 -11
  14. data/lib/ragweed/wrap32/process.rb +114 -7
  15. data/lib/ragweed/wrap32/process_token.rb +23 -7
  16. data/lib/ragweed/wrap32/thread_context.rb +100 -166
  17. data/lib/ragweed/wrap32/wrap32.rb +127 -72
  18. data/lib/ragweed/wrap32.rb +1 -1
  19. data/lib/ragweed/wraposx/constants.rb +1 -9
  20. data/lib/ragweed/wraposx/region_info.rb +209 -188
  21. data/lib/ragweed/wraposx/structs.rb +102 -0
  22. data/lib/ragweed/wraposx/thread_context.rb +636 -159
  23. data/lib/ragweed/wraposx/thread_info.rb +40 -107
  24. data/lib/ragweed/wraposx/thread_info.rb.old +121 -0
  25. data/lib/ragweed/wraposx/wraposx.rb +154 -231
  26. data/lib/ragweed/wraposx.rb +2 -1
  27. data/lib/ragweed/wraptux/constants.rb +46 -22
  28. data/lib/ragweed/wraptux/struct_helpers.rb +25 -0
  29. data/lib/ragweed/wraptux/threads.rb +0 -0
  30. data/lib/ragweed/wraptux/wraptux.rb +58 -62
  31. data/lib/ragweed/wraptux.rb +3 -4
  32. data/lib/ragweed.rb +36 -8
  33. data/ragweed.gemspec +85 -15
  34. metadata +50 -18
data/lib/ragweed/wraposx/thread_context.rb CHANGED
@@ -1,203 +1,680 @@
1
+ # 127 ((x == x86_THREAD_STATE32) || \
2
+ # 128 (x == x86_FLOAT_STATE32) || \
3
+ # 129 (x == x86_EXCEPTION_STATE32) || \
4
+ # 130 (x == x86_DEBUG_STATE32) || \
5
+ # 131 (x == x86_THREAD_STATE64) || \
6
+ # 132 (x == x86_FLOAT_STATE64) || \
7
+ # 133 (x == x86_EXCEPTION_STATE64) || \
8
+ # 134 (x == x86_DEBUG_STATE64) || \
9
+ # 135 (x == x86_THREAD_STATE) || \
10
+ # 136 (x == x86_FLOAT_STATE) || \
11
+ # 137 (x == x86_EXCEPTION_STATE) || \
12
+ # 138 (x == x86_DEBUG_STATE) || \
13
+
1
14
  module Ragweed; end
2
- module Ragweed::Wraposx
3
- module EFlags
4
- CARRY = 0x1
5
- X0 = 0x2
6
- PARITY = 0x4
7
- X1 = 0x8
8
- ADJUST = 0x10
9
- X2 = 0x20
10
- ZERO = 0x40
11
- SIGN = 0x80
12
- TRAP = 0x100
13
- INTERRUPT = 0x200
14
- DIRECTION = 0x400
15
- OVERFLOW = 0x800
16
- IOPL1 = 0x1000
17
- IOPL2 = 0x2000
18
- NESTEDTASK = 0x4000
19
- X3 = 0x8000
20
- RESUME = 0x10000
21
- V86MODE = 0x20000
22
- ALIGNCHECK = 0x40000
23
- VINT = 0x80000
24
- VINTPENDING = 0x100000
25
- CPUID = 0x200000
15
+ module Ragweed::Wraposx::ThreadContext
16
+
17
+ X86_THREAD_STATE32 = 1
18
+ X86_FLOAT_STATE32 = 2
19
+ X86_EXCEPTION_STATE32 = 3
20
+ X86_DEBUG_STATE32 = 10
21
+ X86_THREAD_STATE64 = 4
22
+ X86_FLOAT_STATE64 = 5
23
+ X86_EXCEPTION_STATE64 = 6
24
+ X86_DEBUG_STATE64 = 11
25
+ # factory requests (return 32 or 64 bit structure)
26
+ X86_THREAD_STATE = 7
27
+ X86_FLOAT_STATE = 8
28
+ X86_EXCEPTION_STATE = 9
29
+ X86_DEBUG_STATE = 12
30
+ THREAD_STATE_NONE = 13
31
+
32
+ # depricated request names
33
+ I386_THREAD_STATE = X86_THREAD_STATE32
34
+ I386_FLOAT_STATE = X86_FLOAT_STATE32
35
+ I386_EXCEPTION_STATE = X86_EXCEPTION_STATE32
36
+
37
+ # struct x86_state_hdr {
38
+ # int flavor;
39
+ # int count;
40
+ # };
41
+ class X86StateHdr < FFI::Struct
42
+ include Ragweed::FFIStructInclude
43
+ layout :flavor, :int,
44
+ :count, :int
26
45
  end
27
- end
28
46
 
29
- class Ragweed::Wraposx::ThreadContext
30
- include Ragweed
31
- (FIELDS = [ [:eax, "I"],
32
- [:ebx, "I"],
33
- [:ecx, "I"],
34
- [:edx, "I"],
35
- [:edi, "I"],
36
- [:esi, "I"],
37
- [:ebp, "I"],
38
- [:esp, "I"],
39
- [:ss, "I"],
40
- [:eflags, "I"],
41
- [:eip, "I"],
42
- [:cs, "I"],
43
- [:ds, "I"],
44
- [:es, "I"],
45
- [:fs, "I"],
46
- [:gs, "I"]]).each {|x| attr_accessor x[0]}
47
- FIELDTYPES = FIELDS.map {|x| x[1]}.join("")
48
-
49
- def initialize(str=nil)
50
- refresh(str) if str
51
- end
52
-
53
- #(re)loads the data fields from str
54
- def refresh(str)
55
- if str
56
- str.unpack(FIELDTYPES).each_with_index do |val, i|
57
- instance_variable_set "@#{ FIELDS[i][0] }".intern, val
58
- end
47
+ # _STRUCT_X86_THREAD_STATE32
48
+ # {
49
+ # unsigned int eax;
50
+ # unsigned int ebx;
51
+ # unsigned int ecx;
52
+ # unsigned int edx;
53
+ # unsigned int edi;
54
+ # unsigned int esi;
55
+ # unsigned int ebp;
56
+ # unsigned int esp;
57
+ # unsigned int ss;
58
+ # unsigned int eflags;
59
+ # unsigned int eip;
60
+ # unsigned int cs;
61
+ # unsigned int ds;
62
+ # unsigned int es;
63
+ # unsigned int fs;
64
+ # unsigned int gs;
65
+ # };
66
+ class State32 < FFI::Struct
67
+ include Ragweed::FFIStructInclude
68
+ FLAVOR = 1
69
+ layout :eax, :uint,
70
+ :ebx, :uint,
71
+ :ecx, :uint,
72
+ :edx, :uint,
73
+ :edi, :uint,
74
+ :esi, :uint,
75
+ :ebp, :uint,
76
+ :esp, :uint,
77
+ :ss, :uint,
78
+ :eflags, :uint,
79
+ :eip, :uint,
80
+ :cs, :uint,
81
+ :ds, :uint,
82
+ :es, :uint,
83
+ :fs, :uint,
84
+ :gs, :uint
85
+
86
+ module Flags
87
+ CARRY = 0x1
88
+ X0 = 0x2
89
+ PARITY = 0x4
90
+ X1 = 0x8
91
+ ADJUST = 0x10
92
+ X2 = 0x20
93
+ ZERO = 0x40
94
+ SIGN = 0x80
95
+ TRAP = 0x100
96
+ INTERRUPT = 0x200
97
+ DIRECTION = 0x400
98
+ OVERFLOW = 0x800
99
+ IOPL1 = 0x1000
100
+ IOPL2 = 0x2000
101
+ NESTEDTASK = 0x4000
102
+ X3 = 0x8000
103
+ RESUME = 0x10000
104
+ V86MODE = 0x20000
105
+ ALIGNCHECK = 0x40000
106
+ VINT = 0x80000
107
+ VINTPENDING = 0x100000
108
+ CPUID = 0x200000
109
+ end
110
+
111
+ def dump(&block)
112
+ maybe_hex = lambda {|a| begin; "\n" + (" " * 9) + block.call(a, 16).hexdump(true)[10..-2]; rescue; ""; end }
113
+ maybe_dis = lambda {|a| begin; "\n" + block.call(a, 16).distorm.map {|i| " " + i.mnem}.join("\n"); rescue; ""; end }
114
+
115
+ string =<<EOM
116
+ -----------------------------------------------------------------------
117
+ CONTEXT:
118
+ EIP: #{self.eip.to_s(16).rjust(8, "0")} #{maybe_dis.call(self.eip)}
119
+
120
+ EAX: #{self.eax.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.eax)}
121
+ EBX: #{self.ebx.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.ebx)}
122
+ ECX: #{self.ecx.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.ecx)}
123
+ EDX: #{self.edx.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.edx)}
124
+ EDI: #{self.edi.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.edi)}
125
+ ESI: #{self.esi.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.esi)}
126
+ EBP: #{self.ebp.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.ebp)}
127
+ ESP: #{self.esp.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.esp)}
128
+ EFL: #{self.eflags.to_s(2).rjust(32, "0")} #{Flags.flag_dump(self.eflags)}
129
+ EOM
130
+ end
131
+
132
+ # sets/clears the TRAP flag
133
+ def single_step(v=true)
134
+ if v
135
+ self.eflags |= Flags::TRAP
136
+ else
137
+ self.eflags &= ~(Flags::TRAP)
138
+ end
139
+ end
140
+ end
141
+
142
+ # _STRUCT_X86_THREAD_STATE64
143
+ # {
144
+ # __uint64_t rax;
145
+ # __uint64_t rbx;
146
+ # __uint64_t rcx;
147
+ # __uint64_t rdx;
148
+ # __uint64_t rdi;
149
+ # __uint64_t rsi;
150
+ # __uint64_t rbp;
151
+ # __uint64_t rsp;
152
+ # __uint64_t r8;
153
+ # __uint64_t r9;
154
+ # __uint64_t r10;
155
+ # __uint64_t r11;
156
+ # __uint64_t r12;
157
+ # __uint64_t r13;
158
+ # __uint64_t r14;
159
+ # __uint64_t r15;
160
+ # __uint64_t rip;
161
+ # __uint64_t rflags;
162
+ # __uint64_t cs;
163
+ # __uint64_t fs;
164
+ # __uint64_t gs;
165
+ # };
166
+ class State64 < FFI::Struct
167
+ include Ragweed::FFIStructInclude
168
+ FLAVOR = 4
169
+ layout :rax, :uint64,
170
+ :rbx, :uint64,
171
+ :rcx, :uint64,
172
+ :rdx, :uint64,
173
+ :rdi, :uint64,
174
+ :rsi, :uint64,
175
+ :rbp, :uint64,
176
+ :rsp, :uint64,
177
+ :r8, :uint64,
178
+ :r9, :uint64,
179
+ :r10, :uint64,
180
+ :r11, :uint64,
181
+ :r12, :uint64,
182
+ :r13, :uint64,
183
+ :r14, :uint64,
184
+ :r15, :uint64,
185
+ :rip, :uint64,
186
+ :rflags, :uint64,
187
+ :cs, :uint64,
188
+ :fs, :uint64,
189
+ :gs, :uint64,
190
+
191
+ module Flags
192
+ CARRY = 0x1
193
+ X0 = 0x2
194
+ PARITY = 0x4
195
+ X1 = 0x8
196
+ ADJUST = 0x10
197
+ X2 = 0x20
198
+ ZERO = 0x40
199
+ SIGN = 0x80
200
+ TRAP = 0x100
201
+ INTERRUPT = 0x200
202
+ DIRECTION = 0x400
203
+ OVERFLOW = 0x800
204
+ IOPL1 = 0x1000
205
+ IOPL2 = 0x2000
206
+ NESTEDTASK = 0x4000
207
+ X3 = 0x8000
208
+ RESUME = 0x10000
209
+ V86MODE = 0x20000
210
+ ALIGNCHECK = 0x40000
211
+ VINT = 0x80000
212
+ VINTPENDING = 0x100000
213
+ CPUID = 0x200000
214
+ end
215
+
216
+ def dump(&block)
217
+ maybe_hex = lambda {|a| begin; "\n" + (" " * 9) + block.call(a, 16).hexdump(true)[10..-2]; rescue; ""; end }
218
+ maybe_dis = lambda {|a| begin; "\n" + block.call(a, 16).distorm.map {|i| " " + i.mnem}.join("\n"); rescue; ""; end }
219
+
220
+ string =<<EOM
221
+ -----------------------------------------------------------------------
222
+ CONTEXT:
223
+ RIP: #{self.rip.to_s(16).rjust(16, "0")} #{maybe_dis.call(self.eip)}
224
+
225
+ RAX: #{self.rax.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.eax)}
226
+ RBX: #{self.rbx.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.ebx)}
227
+ RCX: #{self.rcx.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.ecx)}
228
+ RDX: #{self.rdx.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.edx)}
229
+ RDI: #{self.rdi.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.edi)}
230
+ RSI: #{self.rsi.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.esi)}
231
+ RBP: #{self.rbp.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.ebp)}
232
+ RSP: #{self.rsp.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.esp)}
233
+ RFL: #{(self.rflags & 0xffffffff).to_s(2).rjust(32, "0")} #{Flags.flag_dump(self.rflags & 0xffffffff)}
234
+ EOM
235
+ end
236
+
237
+ # sets/clears the TRAP flag
238
+ def single_step(v=true)
239
+ if v
240
+ @rflags |= Flags::TRAP
241
+ else
242
+ @rflags &= ~(Flags::TRAP)
243
+ end
59
244
  end
60
245
  end
61
246
 
62
- def to_s
63
- FIELDS.map {|f| send(f[0])}.pack(FIELDTYPES)
247
+ class UnionThreadState < FFI::Union
248
+ include Ragweed::FFIStructInclude
249
+ layout :ts32, Ragweed::Wraposx::ThreadContext::State32,
250
+ :ts64, Ragweed::Wraposx::ThreadContext::State64
64
251
  end
65
252
 
66
- def self.get(h)
67
- Wraposx::thread_suspend(h)
68
- r = self.new(Wraposx::thread_get_state_raw(h))
69
- Wraposx::thread_resume(h)
70
- return r
253
+ class State < FFI::Struct
254
+ include Ragweed::FFIStructInclude
255
+ FLAVOR = 7
256
+ layout :tsh, Ragweed::Wraposx::ThreadContext::X86StateHdr,
257
+ :uts, Ragweed::Wraposx::ThreadContext::UnionThreadState
71
258
  end
72
259
 
73
- def get(h)
74
- Wraposx::thread_suspend(h)
75
- r = refresh(Wraposx::thread_get_state_raw(h))
76
- Wraposx::thread_resume(h)
77
- return r
260
+ # _STRUCT_X86_DEBUG_STATE32
261
+ # {
262
+ # unsigned int dr0;
263
+ # unsigned int dr1;
264
+ # unsigned int dr2;
265
+ # unsigned int dr3;
266
+ # unsigned int dr4;
267
+ # unsigned int dr5;
268
+ # unsigned int dr6;
269
+ # unsigned int dr7;
270
+ # };
271
+ class Debug32 < FFI::Struct
272
+ include Ragweed::FFIStructInclude
273
+ FLAVOR = 10
274
+ layout :dr0, :uint,
275
+ :dr1, :uint,
276
+ :dr2, :uint,
277
+ :dr3, :uint,
278
+ :dr4, :uint,
279
+ :dr5, :uint,
280
+ :dr6, :uint,
281
+ :dr7, :uint
282
+
283
+ def dump(&block)
284
+ maybe_hex = lambda {|a| begin; "\n" + (" " * 9) + block.call(a, 16).hexdump(true)[10..-2]; rescue; ""; end }
285
+ maybe_dis = lambda {|a| begin; "\n" + block.call(a, 16).distorm.map {|i| " " + i.mnem}.join("\n"); rescue; ""; end }
286
+
287
+ string =<<EOM
288
+ -----------------------------------------------------------------------
289
+ CONTEXT:
290
+ DR0: #{self.dr0.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.dr0)}
291
+ DR1: #{self.dr1.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.dr1)}
292
+ DR2: #{self.dr2.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.dr2)}
293
+ DR3: #{self.dr3.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.dr3)}
294
+ DR4: #{self.dr4.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.dr4)}
295
+ DR5: #{self.dr5.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.dr5)}
296
+ DR6: #{self.dr6.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.dr6)}
297
+ DR7: #{self.dr7.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.dr7)}
298
+ EOM
299
+ end
78
300
  end
79
301
 
80
- def set(h)
81
- Wraposx::thread_suspend(h)
82
- r = Wraposx::thread_set_state_raw(h, self.to_s)
83
- Wraposx::thread_resume(h)
84
- return
302
+ # _STRUCT_X86_DEBUG_STATE64
303
+ # {
304
+ # __uint64_t dr0;
305
+ # __uint64_t dr1;
306
+ # __uint64_t dr2;
307
+ # __uint64_t dr3;
308
+ # __uint64_t dr4;
309
+ # __uint64_t dr5;
310
+ # __uint64_t dr6;
311
+ # __uint64_t dr7;
312
+ # };
313
+ class Debug64 < FFI::Struct
314
+ include Ragweed::FFIStructInclude
315
+ FLAVOR = 11
316
+ layout :dr0, :uint64,
317
+ :dr1, :uint64,
318
+ :dr2, :uint64,
319
+ :dr3, :uint64,
320
+ :dr4, :uint64,
321
+ :dr5, :uint64,
322
+ :dr6, :uint64,
323
+ :dr7, :uint64
324
+
325
+ def dump(&block)
326
+ maybe_hex = lambda {|a| begin; "\n" + (" " * 9) + block.call(a, 16).hexdump(true)[10..-2]; rescue; ""; end }
327
+ maybe_dis = lambda {|a| begin; "\n" + block.call(a, 16).distorm.map {|i| " " + i.mnem}.join("\n"); rescue; ""; end }
328
+
329
+ string =<<EOM
330
+ -----------------------------------------------------------------------
331
+ CONTEXT:
332
+ DR0: #{self.dr0.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.dr0)}
333
+ DR1: #{self.dr1.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.dr1)}
334
+ DR2: #{self.dr2.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.dr2)}
335
+ DR3: #{self.dr3.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.dr3)}
336
+ DR4: #{self.dr4.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.dr4)}
337
+ DR5: #{self.dr5.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.dr5)}
338
+ DR6: #{self.dr6.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.dr6)}
339
+ DR7: #{self.dr7.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.dr7)}
340
+ EOM
341
+ end
342
+ end
343
+
344
+ class UnionDebugState < FFI::Union
345
+ include Ragweed::FFIStructInclude
346
+ layout :ds32, Ragweed::Wraposx::ThreadContext::Debug32,
347
+ :ds64, Ragweed::Wraposx::ThreadContext::Debug64
348
+ end
349
+
350
+ class Debug < FFI::Struct
351
+ include Ragweed::FFIStructInclude
352
+ FLAVOR = 12
353
+ layout :dsh, Ragweed::Wraposx::ThreadContext::X86StateHdr,
354
+ :uds, Ragweed::Wraposx::ThreadContext::UnionDebugState
355
+ end
356
+
357
+ # _STRUCT_X86_EXCEPTION_STATE32
358
+ # {
359
+ # unsigned int trapno;
360
+ # unsigned int err;
361
+ # unsigned int faultvaddr;
362
+ # };
363
+ class Exception32 < FFI::Struct
364
+ include Ragweed::FFIStructInclude
365
+ FLAVOR = 3
366
+ layout :trapno, :uint,
367
+ :err, :uint,
368
+ :faltvaddr, :uint
369
+
370
+ def dump(&block)
371
+ maybe_hex = lambda {|a| begin; "\n" + (" " * 9) + block.call(a, 16).hexdump(true)[10..-2]; rescue; ""; end }
372
+ maybe_dis = lambda {|a| begin; "\n" + block.call(a, 16).distorm.map {|i| " " + i.mnem}.join("\n"); rescue; ""; end }
373
+
374
+ string =<<EOM
375
+ -----------------------------------------------------------------------
376
+ CONTEXT:
377
+ trapno: #{self.trapno.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.trapno)}
378
+ err: #{self.err.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.err)}
379
+ faultvaddr: #{self.faultvaddr.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.faultvaddr)}
380
+ EOM
381
+ end
85
382
  end
86
383
 
87
- def inspect
88
- body = lambda do
89
- FIELDS.map do |f|
90
- "#{f[0]}=#{send(f[0]).to_s(16)}"
91
- end.join(", ")
384
+ # _STRUCT_X86_EXCEPTION_STATE64
385
+ # {
386
+ # unsigned int trapno;
387
+ # unsigned int err;
388
+ # __uint64_t faultvaddr;
389
+ # };
390
+ class Exception64 < FFI::Struct
391
+ include Ragweed::FFIStructInclude
392
+ FLAVOR = 6
393
+ layout :trapno, :uint,
394
+ :err, :uint,
395
+ :faltvaddr, :uint64
396
+
397
+ def dump(&block)
398
+ maybe_hex = lambda {|a| begin; "\n" + (" " * 9) + block.call(a, 16).hexdump(true)[10..-2]; rescue; ""; end }
399
+ maybe_dis = lambda {|a| begin; "\n" + block.call(a, 16).distorm.map {|i| " " + i.mnem}.join("\n"); rescue; ""; end }
400
+
401
+ string =<<EOM
402
+ -----------------------------------------------------------------------
403
+ CONTEXT:
404
+ trapno: #{self.trapno.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.trapno)}
405
+ err: #{self.err.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.err)}
406
+ faultvaddr: #{self.faultvaddr.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.faultvaddr)}
407
+ EOM
92
408
  end
93
- "#<ThreadContext #{body.call}>"
94
- end
95
-
96
- def dump(&block)
97
- maybe_hex = lambda {|a| begin; "\n" + (" " * 9) + block.call(a, 16).hexdump(true)[10..-2]; rescue; ""; end }
98
- maybe_dis = lambda {|a| begin; "\n" + block.call(a, 16).distorm.map {|i| " " + i.mnem}.join("\n"); rescue; ""; end }
99
-
100
- string =<<EOM
101
- -----------------------------------------------------------------------
102
- CONTEXT:
103
- EIP: #{self.eip.to_s(16).rjust(8, "0")} #{maybe_dis.call(self.eip)}
104
-
105
- EAX: #{self.eax.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.eax)}
106
- EBX: #{self.ebx.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.ebx)}
107
- ECX: #{self.ecx.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.ecx)}
108
- EDX: #{self.edx.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.edx)}
109
- EDI: #{self.edi.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.edi)}
110
- ESI: #{self.esi.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.esi)}
111
- EBP: #{self.ebp.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.ebp)}
112
- ESP: #{self.esp.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.esp)}
113
- EFL: #{self.eflags.to_s(2).rjust(32, "0")} #{Wraposx::EFlags.flag_dump(self.eflags)}
409
+ end
410
+
411
+ class UnionExceptionState < FFI::Union
412
+ include Ragweed::FFIStructInclude
413
+ layout :es32, Ragweed::Wraposx::ThreadContext::Exception32,
414
+ :es64, Ragweed::Wraposx::ThreadContext::Exception64
415
+ end
416
+
417
+ class Exception < FFI::Struct
418
+ include Ragweed::FFIStructInclude
419
+ FLAVOR = 9
420
+ layout :esh, Ragweed::Wraposx::ThreadContext::X86StateHdr,
421
+ :ues, Ragweed::Wraposx::ThreadContext::UnionExceptionState
422
+ end
423
+
424
+ # _STRUCT_X86_FLOAT_STATE32
425
+ # {
426
+ # int fpu_reserved[2];
427
+ # _STRUCT_FP_CONTROL fpu_fcw; /* x87 FPU control word */
428
+ # _STRUCT_FP_STATUS fpu_fsw; /* x87 FPU status word */
429
+ # __uint8_t fpu_ftw; /* x87 FPU tag word */
430
+ # __uint8_t fpu_rsrv1; /* reserved */
431
+ # __uint16_t fpu_fop; /* x87 FPU Opcode */
432
+ # __uint32_t fpu_ip; /* x87 FPU Instruction Pointer offset */
433
+ # __uint16_t fpu_cs; /* x87 FPU Instruction Pointer Selector */
434
+ # __uint16_t fpu_rsrv2; /* reserved */
435
+ # __uint32_t fpu_dp; /* x87 FPU Instruction Operand(Data) Pointer offset */
436
+ # __uint16_t fpu_ds; /* x87 FPU Instruction Operand(Data) Pointer Selector */
437
+ # __uint16_t fpu_rsrv3; /* reserved */
438
+ # __uint32_t fpu_mxcsr; /* MXCSR Register state */
439
+ # __uint32_t fpu_mxcsrmask; /* MXCSR mask */
440
+ # _STRUCT_MMST_REG fpu_stmm0; /* ST0/MM0 */
441
+ # _STRUCT_MMST_REG fpu_stmm1; /* ST1/MM1 */
442
+ # _STRUCT_MMST_REG fpu_stmm2; /* ST2/MM2 */
443
+ # _STRUCT_MMST_REG fpu_stmm3; /* ST3/MM3 */
444
+ # _STRUCT_MMST_REG fpu_stmm4; /* ST4/MM4 */
445
+ # _STRUCT_MMST_REG fpu_stmm5; /* ST5/MM5 */
446
+ # _STRUCT_MMST_REG fpu_stmm6; /* ST6/MM6 */
447
+ # _STRUCT_MMST_REG fpu_stmm7; /* ST7/MM7 */
448
+ # _STRUCT_XMM_REG fpu_xmm0; /* XMM 0 */
449
+ # _STRUCT_XMM_REG fpu_xmm1; /* XMM 1 */
450
+ # _STRUCT_XMM_REG fpu_xmm2; /* XMM 2 */
451
+ # _STRUCT_XMM_REG fpu_xmm3; /* XMM 3 */
452
+ # _STRUCT_XMM_REG fpu_xmm4; /* XMM 4 */
453
+ # _STRUCT_XMM_REG fpu_xmm5; /* XMM 5 */
454
+ # _STRUCT_XMM_REG fpu_xmm6; /* XMM 6 */
455
+ # _STRUCT_XMM_REG fpu_xmm7; /* XMM 7 */
456
+ # char fpu_rsrv4[14*16]; /* reserved */
457
+ # int fpu_reserved1;
458
+ # };
459
+ class Float32 < FFI::Struct
460
+ include Ragweed::FFIStructInclude
461
+ FLAVOR = 2
462
+ layout :fpu_reserved, [:int, 2],
463
+ :fpu_fcw, Ragweed::Wraposx::FpControl,
464
+ :fpu_fsw, Ragweed::Wraposx::FpStatus,
465
+ :fpu_ftw, :uint8,
466
+ :fpu_rsrv1, :uint8,
467
+ :fpu_fop, :uint16,
468
+ :fpu_ip, :uint32,
469
+ :fpu_cs, :uint16,
470
+ :fpu_rsrv2, :uint16,
471
+ :fpu_dp, :uint32,
472
+ :fpu_ds, :uint16,
473
+ :fpu_rsrv3, :uint16,
474
+ :fpu_mxcsr, :uint32,
475
+ :fpu_mxcsrmask, :uint32,
476
+ :fpu_stmm0, Ragweed::Wraposx::MmstReg,
477
+ :fpu_stmm1, Ragweed::Wraposx::MmstReg,
478
+ :fpu_stmm2, Ragweed::Wraposx::MmstReg,
479
+ :fpu_stmm3, Ragweed::Wraposx::MmstReg,
480
+ :fpu_stmm4, Ragweed::Wraposx::MmstReg,
481
+ :fpu_stmm5, Ragweed::Wraposx::MmstReg,
482
+ :fpu_stmm6, Ragweed::Wraposx::MmstReg,
483
+ :fpu_stmm7, Ragweed::Wraposx::MmstReg,
484
+ :fpu_xmm0, Ragweed::Wraposx::XmmReg,
485
+ :fpu_xmm1, Ragweed::Wraposx::XmmReg,
486
+ :fpu_xmm2, Ragweed::Wraposx::XmmReg,
487
+ :fpu_xmm3, Ragweed::Wraposx::XmmReg,
488
+ :fpu_xmm4, Ragweed::Wraposx::XmmReg,
489
+ :fpu_xmm5, Ragweed::Wraposx::XmmReg,
490
+ :fpu_xmm6, Ragweed::Wraposx::XmmReg,
491
+ :fpu_xmm7, Ragweed::Wraposx::XmmReg,
492
+ :fpu_rsrv4, [:char, 14*16],
493
+ :fpu_reserved1, :int
494
+
495
+ def dump(&block)
496
+ maybe_hex = lambda {|a| begin; "\n" + (" " * 9) + block.call(a, 16).hexdump(true)[10..-2]; rescue; ""; end }
497
+ maybe_dis = lambda {|a| begin; "\n" + block.call(a, 16).distorm.map {|i| " " + i.mnem}.join("\n"); rescue; ""; end }
498
+
499
+ string =<<EOM
500
+ -----------------------------------------------------------------------
501
+ CONTEXT:
502
+ trapno: #{self.trapno.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.trapno)}
503
+ err: #{self.err.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.err)}
504
+ faultvaddr: #{self.faultvaddr.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.faultvaddr)}
114
505
  EOM
506
+ end
115
507
  end
116
508
 
117
- # sets/clears the TRAP flag
118
- def single_step(v=true)
119
- if v
120
- @eflags |= Wraposx::EFlags::TRAP
121
- else
122
- @eflags &= ~(Wraposx::EFlags::TRAP)
509
+ # _STRUCT_X86_FLOAT_STATE64
510
+ # {
511
+ # int fpu_reserved[2];
512
+ # _STRUCT_FP_CONTROL fpu_fcw; /* x87 FPU control word */
513
+ # _STRUCT_FP_STATUS fpu_fsw; /* x87 FPU status word */
514
+ # __uint8_t fpu_ftw; /* x87 FPU tag word */
515
+ # __uint8_t fpu_rsrv1; /* reserved */
516
+ # __uint16_t fpu_fop; /* x87 FPU Opcode */
517
+ # /* x87 FPU Instruction Pointer */
518
+ # __uint32_t fpu_ip; /* offset */
519
+ # __uint16_t fpu_cs; /* Selector */
520
+ # __uint16_t fpu_rsrv2; /* reserved */
521
+ # /* x87 FPU Instruction Operand(Data) Pointer */
522
+ # __uint32_t fpu_dp; /* offset */
523
+ # __uint16_t fpu_ds; /* Selector */
524
+ # __uint16_t fpu_rsrv3; /* reserved */
525
+ # __uint32_t fpu_mxcsr; /* MXCSR Register state */
526
+ # __uint32_t fpu_mxcsrmask; /* MXCSR mask */
527
+ # _STRUCT_MMST_REG fpu_stmm0; /* ST0/MM0 */
528
+ # _STRUCT_MMST_REG fpu_stmm1; /* ST1/MM1 */
529
+ # _STRUCT_MMST_REG fpu_stmm2; /* ST2/MM2 */
530
+ # _STRUCT_MMST_REG fpu_stmm3; /* ST3/MM3 */
531
+ # _STRUCT_MMST_REG fpu_stmm4; /* ST4/MM4 */
532
+ # _STRUCT_MMST_REG fpu_stmm5; /* ST5/MM5 */
533
+ # _STRUCT_MMST_REG fpu_stmm6; /* ST6/MM6 */
534
+ # _STRUCT_MMST_REG fpu_stmm7; /* ST7/MM7 */
535
+ # _STRUCT_XMM_REG fpu_xmm0; /* XMM 0 */
536
+ # _STRUCT_XMM_REG fpu_xmm1; /* XMM 1 */
537
+ # _STRUCT_XMM_REG fpu_xmm2; /* XMM 2 */
538
+ # _STRUCT_XMM_REG fpu_xmm3; /* XMM 3 */
539
+ # _STRUCT_XMM_REG fpu_xmm4; /* XMM 4 */
540
+ # _STRUCT_XMM_REG fpu_xmm5; /* XMM 5 */
541
+ # _STRUCT_XMM_REG fpu_xmm6; /* XMM 6 */
542
+ # _STRUCT_XMM_REG fpu_xmm7; /* XMM 7 */
543
+ # _STRUCT_XMM_REG fpu_xmm8; /* XMM 8 */
544
+ # _STRUCT_XMM_REG fpu_xmm9; /* XMM 9 */
545
+ # _STRUCT_XMM_REG fpu_xmm10; /* XMM 10 */
546
+ # _STRUCT_XMM_REG fpu_xmm11; /* XMM 11 */
547
+ # _STRUCT_XMM_REG fpu_xmm12; /* XMM 12 */
548
+ # _STRUCT_XMM_REG fpu_xmm13; /* XMM 13 */
549
+ # _STRUCT_XMM_REG fpu_xmm14; /* XMM 14 */
550
+ # _STRUCT_XMM_REG fpu_xmm15; /* XMM 15 */
551
+ # char fpu_rsrv4[6*16]; /* reserved */
552
+ # int fpu_reserved1;
553
+ # };
554
+ class Float64 < FFI::Struct
555
+ include Ragweed::FFIStructInclude
556
+ FLAVOR = 5
557
+ layout :fpu_reserved, [:int, 2],
558
+ :fpu_fcw, Ragweed::Wraposx::FpControl,
559
+ :fpu_fsw, Ragweed::Wraposx::FpStatus,
560
+ :fpu_ftw, :uint8,
561
+ :fpu_rsrv1, :uint8,
562
+ :fpu_fop, :uint16,
563
+ :fpu_ip, :uint32,
564
+ :fpu_cs, :uint16,
565
+ :fpu_rsrv2, :uint16,
566
+ :fpu_dp, :uint32,
567
+ :fpu_ds, :uint16,
568
+ :fpu_rsrv3, :uint16,
569
+ :fpu_mxcsr, :uint32,
570
+ :fpu_mxcsrmask, :uint32,
571
+ :fpu_stmm0, Ragweed::Wraposx::MmstReg,
572
+ :fpu_stmm1, Ragweed::Wraposx::MmstReg,
573
+ :fpu_stmm2, Ragweed::Wraposx::MmstReg,
574
+ :fpu_stmm3, Ragweed::Wraposx::MmstReg,
575
+ :fpu_stmm4, Ragweed::Wraposx::MmstReg,
576
+ :fpu_stmm5, Ragweed::Wraposx::MmstReg,
577
+ :fpu_stmm6, Ragweed::Wraposx::MmstReg,
578
+ :fpu_stmm7, Ragweed::Wraposx::MmstReg,
579
+ :fpu_xmm0, Ragweed::Wraposx::XmmReg,
580
+ :fpu_xmm1, Ragweed::Wraposx::XmmReg,
581
+ :fpu_xmm2, Ragweed::Wraposx::XmmReg,
582
+ :fpu_xmm3, Ragweed::Wraposx::XmmReg,
583
+ :fpu_xmm4, Ragweed::Wraposx::XmmReg,
584
+ :fpu_xmm5, Ragweed::Wraposx::XmmReg,
585
+ :fpu_xmm6, Ragweed::Wraposx::XmmReg,
586
+ :fpu_xmm7, Ragweed::Wraposx::XmmReg,
587
+ :fpu_xmm8, Ragweed::Wraposx::XmmReg,
588
+ :fpu_xmm9, Ragweed::Wraposx::XmmReg,
589
+ :fpu_xmm10, Ragweed::Wraposx::XmmReg,
590
+ :fpu_xmm11, Ragweed::Wraposx::XmmReg,
591
+ :fpu_xmm12, Ragweed::Wraposx::XmmReg,
592
+ :fpu_xmm13, Ragweed::Wraposx::XmmReg,
593
+ :fpu_xmm14, Ragweed::Wraposx::XmmReg,
594
+ :fpu_xmm15, Ragweed::Wraposx::XmmReg,
595
+ :fpu_rsrv4, [:char, 6*16],
596
+ :fpu_reserved1, :int
597
+
598
+
599
+ def dump(&block)
600
+ maybe_hex = lambda {|a| begin; "\n" + (" " * 9) + block.call(a, 16).hexdump(true)[10..-2]; rescue; ""; end }
601
+ maybe_dis = lambda {|a| begin; "\n" + block.call(a, 16).distorm.map {|i| " " + i.mnem}.join("\n"); rescue; ""; end }
602
+
603
+ string =<<EOM
604
+ -----------------------------------------------------------------------
605
+ CONTEXT:
606
+ trapno: #{self.trapno.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.trapno)}
607
+ err: #{self.err.to_s(16).rjust(8, "0")} #{maybe_hex.call(self.err)}
608
+ faultvaddr: #{self.faultvaddr.to_s(16).rjust(16, "0")} #{maybe_hex.call(self.faultvaddr)}
609
+ EOM
123
610
  end
124
611
  end
612
+
613
+ class UnionFloatState < FFI::Union
614
+ include Ragweed::FFIStructInclude
615
+ layout :fs32, Ragweed::Wraposx::ThreadContext::Float32,
616
+ :fs64, Ragweed::Wraposx::ThreadContext::Float64
617
+ end
618
+
619
+ class Float < FFI::Struct
620
+ include Ragweed::FFIStructInclude
621
+ FLAVOR = 8
622
+ layout :fsh, Ragweed::Wraposx::ThreadContext::X86StateHdr,
623
+ :ufs, Ragweed::Wraposx::ThreadContext::UnionFloatState
624
+ end
625
+
626
+ FLAVORS = {
627
+ X86_THREAD_STATE32 => {:size => 64, :count =>16, :class => State32},
628
+ X86_FLOAT_STATE32 => {:size => 64, :count =>16, :class => Float32},
629
+ X86_EXCEPTION_STATE32 => {:size => 12, :count =>3, :class => Exception32},
630
+ X86_DEBUG_STATE32 => {:size => 64, :count =>8, :class => Debug32},
631
+ X86_THREAD_STATE64 => {:size => 168, :count =>42, :class => State64},
632
+ X86_FLOAT_STATE64 => {:size => 64, :count =>16, :class => Float64},
633
+ X86_EXCEPTION_STATE64 => {:size => 16, :count =>4, :class => Exception64},
634
+ X86_DEBUG_STATE64 => {:size => 128, :count =>16, :class => Debug64},
635
+ X86_THREAD_STATE => {:size => 176, :count =>44, :class => State},
636
+ X86_FLOAT_STATE => {:size => 64, :count =>16, :class => Float},
637
+ X86_EXCEPTION_STATE => {:size => 24, :count =>6, :class => Exception},
638
+ X86_DEBUG_STATE => {:size => 136, :count =>18, :class => Debug}
639
+ }
125
640
  end
126
641
 
127
642
  module Ragweed::Wraposx
128
643
 
129
- # FIXME - constants need to be in separate sub modules
130
- # TODO - move to class based implementation a la region_info
131
- # define i386_THREAD_STATE_COUNT ((mach_msg_type_number_t)( sizeof (i386_thread_state_t) / sizeof (int) ))
132
- # i386_thread_state_t is a struct w/ 16 uint
133
- I386_THREAD_STATE_COUNT = 16
134
- I386_THREAD_STATE = 1
135
- REGISTER_SYMS = [:eax,:ebx,:ecx,:edx,:edi,:esi,:ebp,:esp,:ss,:eflags,:eip,:cs,:ds,:es,:fs,:gs]
644
+ module Libc
645
+ extend FFI::Library
646
+ ffi_lib FFI::Library::LIBC
647
+ attach_function :thread_get_state, [:thread_act_t, :thread_state_flavor_t, :pointer, :mach_msg_type_number_t], :kern_return_t
648
+ attach_function :thread_set_state, [:thread_act_t, :thread_state_flavor_t, :pointer, :mach_msg_type_number_t], :kern_return_t
649
+ end
136
650
 
137
651
  class << self
138
-
139
- # Returns a Hash of the thread's registers given a thread id.
652
+ # Returns a thread's registers for given a thread id
140
653
  #
141
654
  # kern_return_t thread_get_state
142
655
  # (thread_act_t target_thread,
143
656
  # thread_state_flavor_t flavor,
144
657
  # thread_state_t old_state,
145
658
  # mach_msg_type_number_t old_state_count);
146
- def thread_get_state(thread)
147
- state_arr = ("\x00"*SIZEOFINT*I386_THREAD_STATE_COUNT).to_ptr
148
- count = ([I386_THREAD_STATE_COUNT].pack("I_")).to_ptr
149
- r = CALLS["libc!thread_get_state:IIPP=I"].call(thread, I386_THREAD_STATE, state_arr, count).first
659
+ def thread_get_state(thread,flavor)
660
+ state = FFI::MemoryPointer.new Ragweed::Wraposx::ThreadContext::FLAVOR[flavor][:class], 1
661
+ count = FFI::MemoryPointer.new(:int, 1).write_int Ragweed::Wraposx::ThreadContext::FLAVOR[flavor][:count]
662
+ r = Libc.thread_get_state(thread, flavor, state, count)
150
663
  raise KernelCallError.new(:thread_get_state, r) if r != 0
151
- r = state_arr.to_s(I386_THREAD_STATE_COUNT*SIZEOFINT).unpack("I_"*I386_THREAD_STATE_COUNT)
152
- regs = Hash.new
153
- I386_THREAD_STATE_COUNT.times do |i|
154
- regs[REGISTER_SYMS[i]] = r[i]
155
- end
156
- return regs
157
- end
158
-
159
- # Returns string representation of a thread's registers for unpacking given a thread id
160
- #
161
- # kern_return_t thread_get_state
162
- # (thread_act_t target_thread,
163
- # thread_state_flavor_t flavor,
164
- # thread_state_t old_state,
165
- # mach_msg_type_number_t old_state_count);
166
- def thread_get_state_raw(thread)
167
- state_arr = ("\x00"*SIZEOFINT*I386_THREAD_STATE_COUNT).to_ptr
168
- count = ([I386_THREAD_STATE_COUNT].pack("I_")).to_ptr
169
- r = CALLS["libc!thread_get_state:IIPP=I"].call(thread, I386_THREAD_STATE, state_arr, count).first
170
- raise KernelCallError.new(:thread_get_state, r) if r != 0
171
- return state_arr.to_s(I386_THREAD_STATE_COUNT*SIZEOFINT)
172
- end
173
-
174
- # Sets the register state of thread from a Hash containing it's values.
175
- #
176
- # kern_return_t thread_set_state
177
- # (thread_act_t target_thread,
178
- # thread_state_flavor_t flavor,
179
- # thread_state_t new_state,
180
- # target_thread new_state_count);
181
- def thread_set_state(thread, state)
182
- s = Array.new
183
- I386_THREAD_STATE_COUNT.times do |i|
184
- s << state[REGISTER_SYMS[i]]
185
- end
186
- s = s.pack("I_"*I386_THREAD_STATE_COUNT).to_ptr
187
- r = CALLS["libc!thread_set_state:IIPI=I"].call(thread, I386_THREAD_STATE, s, I386_THREAD_STATE_COUNT).first
188
- raise KernelCallError.new(:thread_set_state, r) if r!= 0
664
+ Ragweed::Wraposx::ThreadContext::FLAVOR[flavor][:class].new state
189
665
  end
190
666
 
191
- # Sets the register state of thread from a packed string containing it's values.
667
+ # Sets the register state of thread.
192
668
  #
193
669
  # kern_return_t thread_set_state
194
670
  # (thread_act_t target_thread,
195
671
  # thread_state_flavor_t flavor,
196
672
  # thread_state_t new_state,
197
- # target_thread new_state_count);
198
- def thread_set_state_raw(thread, state)
199
- r = CALLS["libc!thread_set_state:IIPI=I"].call(thread, I386_THREAD_STATE, state.to_ptr, I386_THREAD_STATE_COUNT).first
673
+ # mach_msg_number_t new_state_count);
674
+ def thread_set_state(thread, flavor, state)
675
+ r = Libc.thread_set_state(thread, flavor, state.to_ptr, ThreadContext::FLAVORS[flavor][:count])
200
676
  raise KernelCallError.new(:thread_set_state, r) if r!= 0
677
+ Ragweed::Wraposx::ThreadContext::FLAVOR[flavor][:class].new state
201
678
  end
202
679
  end
203
680
  end