rallhook 0.7.5 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/AUTHORS +2 -0
- data/CHANGELOG +2 -0
- data/README +0 -2
- data/Rakefile +1 -1
- data/TODO +0 -1
- data/ext/rallhook_base/deps/distorm/config.h +170 -0
- data/ext/rallhook_base/deps/distorm/distorm.h +401 -0
- data/ext/rallhook_base/deps/distorm/mnemonics.c +258 -0
- data/ext/rallhook_base/deps/distorm/mnemonics.h +200 -0
- data/ext/rallhook_base/deps/distorm/src/decoder.c +548 -0
- data/ext/rallhook_base/deps/distorm/src/decoder.h +18 -0
- data/ext/rallhook_base/deps/distorm/src/distorm.c +375 -0
- data/ext/rallhook_base/deps/distorm/src/instructions.c +490 -0
- data/ext/rallhook_base/deps/distorm/src/instructions.h +445 -0
- data/ext/rallhook_base/deps/distorm/src/insts.c +4851 -0
- data/ext/rallhook_base/deps/distorm/src/insts.h +36 -0
- data/ext/rallhook_base/deps/distorm/src/operands.c +1270 -0
- data/ext/rallhook_base/deps/distorm/src/operands.h +38 -0
- data/ext/rallhook_base/deps/distorm/src/prefix.c +380 -0
- data/ext/rallhook_base/deps/distorm/src/prefix.h +76 -0
- data/ext/rallhook_base/deps/distorm/src/pydistorm.h +62 -0
- data/ext/rallhook_base/deps/distorm/src/textdefs.c +180 -0
- data/ext/rallhook_base/deps/distorm/src/textdefs.h +68 -0
- data/ext/rallhook_base/deps/distorm/src/wstring.c +55 -0
- data/ext/rallhook_base/deps/distorm/src/wstring.h +43 -0
- data/ext/rallhook_base/deps/distorm/src/x86defs.c +41 -0
- data/ext/rallhook_base/deps/distorm/src/x86defs.h +105 -0
- data/ext/rallhook_base/extconf.rb +15 -20
- data/ext/rallhook_base/rallhook.c +20 -8
- metadata +27 -5
@@ -0,0 +1,105 @@
|
|
1
|
+
/*
|
2
|
+
x86defs.h
|
3
|
+
|
4
|
+
diStorm3 - Powerful disassembler for X86/AMD64
|
5
|
+
http://ragestorm.net/distorm/
|
6
|
+
distorm at gmail dot com
|
7
|
+
Copyright (C) 2010 Gil Dabah
|
8
|
+
|
9
|
+
This program is free software: you can redistribute it and/or modify
|
10
|
+
it under the terms of the GNU General Public License as published by
|
11
|
+
the Free Software Foundation, either version 3 of the License, or
|
12
|
+
(at your option) any later version.
|
13
|
+
|
14
|
+
This program is distributed in the hope that it will be useful,
|
15
|
+
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
16
|
+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
17
|
+
GNU General Public License for more details.
|
18
|
+
|
19
|
+
You should have received a copy of the GNU General Public License
|
20
|
+
along with this program. If not, see <http://www.gnu.org/licenses/>
|
21
|
+
*/
|
22
|
+
|
23
|
+
|
24
|
+
#ifndef X86DEFS_H
|
25
|
+
#define X86DEFS_H
|
26
|
+
|
27
|
+
#include "../config.h"
|
28
|
+
|
29
|
+
#include "instructions.h"
|
30
|
+
|
31
|
+
#define SEG_REGS_MAX (6)
|
32
|
+
#define CREGS_MAX (9)
|
33
|
+
#define DREGS_MAX (8)
|
34
|
+
|
35
|
+
/* Maximum instruction size, including prefixes */
|
36
|
+
#define INST_MAXIMUM_SIZE (15)
|
37
|
+
|
38
|
+
/* Maximum range of imm8 (comparison type) of special SSE instructions. */
|
39
|
+
#define INST_CMP_MAX_RANGE (8)
|
40
|
+
|
41
|
+
/* Wait instruction byte code. */
|
42
|
+
#define INST_WAIT_INDEX (0x9b)
|
43
|
+
|
44
|
+
/* Lea instruction byte code. */
|
45
|
+
#define INST_LEA_INDEX (0x8d)
|
46
|
+
|
47
|
+
/*
|
48
|
+
* Minimal MODR/M value of divided instructions.
|
49
|
+
* It's 0xc0, two MSBs set, which indicates a general purpose register is used too.
|
50
|
+
*/
|
51
|
+
#define INST_DIVIDED_MODRM (0xc0)
|
52
|
+
|
53
|
+
/* This is the escape byte value used for 3DNow! instructions. */
|
54
|
+
#define _3DNOW_ESCAPE_BYTE (0x0f)
|
55
|
+
|
56
|
+
#define PREFIX_LOCK (0xf0)
|
57
|
+
#define PREFIX_REPNZ (0xf2)
|
58
|
+
#define PREFIX_REP (0xf3)
|
59
|
+
#define PREFIX_CS (0x2e)
|
60
|
+
#define PREFIX_SS (0x36)
|
61
|
+
#define PREFIX_DS (0x3e)
|
62
|
+
#define PREFIX_ES (0x26)
|
63
|
+
#define PREFIX_FS (0x64)
|
64
|
+
#define PREFIX_GS (0x65)
|
65
|
+
#define PREFIX_OP_SIZE (0x66)
|
66
|
+
#define PREFIX_ADDR_SIZE (0x67)
|
67
|
+
#define PREFIX_VEX2b (0xc5)
|
68
|
+
#define PREFIX_VEX3b (0xc4)
|
69
|
+
|
70
|
+
/* REX prefix value range, 64 bits mode decoding only. */
|
71
|
+
#define PREFIX_REX_LOW (0x40)
|
72
|
+
#define PREFIX_REX_HI (0x4f)
|
73
|
+
/* In order to use the extended GPR's we have to add 8 to the Modr/M info values. */
|
74
|
+
#define EX_GPR_BASE (8)
|
75
|
+
|
76
|
+
/* Mask for REX and VEX features: */
|
77
|
+
/* Base */
|
78
|
+
#define PREFIX_EX_B (1)
|
79
|
+
/* Index */
|
80
|
+
#define PREFIX_EX_X (2)
|
81
|
+
/* Register */
|
82
|
+
#define PREFIX_EX_R (4)
|
83
|
+
/* Operand Width */
|
84
|
+
#define PREFIX_EX_W (8)
|
85
|
+
/* Vector Lengh */
|
86
|
+
#define PREFIX_EX_L (0x10)
|
87
|
+
|
88
|
+
/*
|
89
|
+
* The inst_lookup will return on of these two instructions according to the specified decoding mode.
|
90
|
+
* ARPL or MOVSXD on 64 bits is one byte instruction at index 0x63.
|
91
|
+
*/
|
92
|
+
#define INST_ARPL_INDEX (0x63)
|
93
|
+
extern _InstInfo II_arpl;
|
94
|
+
extern _InstInfoEx II_movsxd;
|
95
|
+
|
96
|
+
/*
|
97
|
+
* The NOP instruction can be prefixed by REX in 64bits, therefore we have to decide in runtime whether it's an XCHG or NOP instruction.
|
98
|
+
* If 0x90 is prefixed by a useable REX it will become XCHG, otherwise it will become a NOP.
|
99
|
+
* Also note that if it's prefixed by 0xf3, it becomes a Pause.
|
100
|
+
*/
|
101
|
+
#define INST_NOP_INDEX (0x90)
|
102
|
+
extern _InstInfo II_nop;
|
103
|
+
extern _InstInfo II_pause;
|
104
|
+
|
105
|
+
#endif /* X86DEFS_H */
|
@@ -5,26 +5,6 @@ CONFIG['CC'] = 'gcc'
|
|
5
5
|
ruby_version = Config::CONFIG["ruby_version"]
|
6
6
|
ruby_version = ruby_version.split(".")[0..1].join(".")
|
7
7
|
|
8
|
-
def distorm
|
9
|
-
|
10
|
-
distorm_names = {
|
11
|
-
"/usr/lib/libdistorm3.so" => "distorm3",
|
12
|
-
"/usr/local/lib/libdistorm3.so" => "distorm3",
|
13
|
-
"/usr/lib/libdistorm64.so" => "distorm64",
|
14
|
-
"/usr/local/lib/libdistorm64.so" => "distorm64"
|
15
|
-
}
|
16
|
-
|
17
|
-
distorm_names.each do |k,v|
|
18
|
-
if File.exists? k then
|
19
|
-
return v
|
20
|
-
end
|
21
|
-
end
|
22
|
-
|
23
|
-
raise "Distorm library not found in the system"
|
24
|
-
end
|
25
|
-
|
26
|
-
$LIBS = $LIBS + " -l#{distorm()}"
|
27
|
-
|
28
8
|
if ruby_version == "1.8"
|
29
9
|
$CFLAGS = $CFLAGS + " -DRUBY1_8"
|
30
10
|
elsif ruby_version == "1.9"
|
@@ -34,6 +14,21 @@ else
|
|
34
14
|
print "try passing the rubyversion by argument (1.8 or 1.9)\n"
|
35
15
|
end
|
36
16
|
|
17
|
+
$CFLAGS = $CFLAGS + " -o $@"
|
18
|
+
|
19
|
+
srcdir = '.'
|
20
|
+
|
21
|
+
$objs = []
|
22
|
+
srcs = Dir[File.join(srcdir, "*.{#{SRC_EXT.join(%q{,})}}")]
|
23
|
+
srcs += Dir[File.join(srcdir, "deps/distorm/*.c")]
|
24
|
+
srcs += Dir[File.join(srcdir, "deps/distorm/src/*.c")]
|
25
|
+
|
26
|
+
for f in srcs
|
27
|
+
obj = f[2..-1].gsub(/\.c$/, ".o")
|
28
|
+
$objs.push(obj) unless $objs.index(obj)
|
29
|
+
end
|
30
|
+
|
37
31
|
create_makefile('rallhook_base')
|
38
32
|
|
39
33
|
|
34
|
+
|
@@ -38,6 +38,7 @@ ID id_method_added;
|
|
38
38
|
ID id_hook_enabled;
|
39
39
|
ID id_hook_enable_left;
|
40
40
|
ID id_hook_proc;
|
41
|
+
ID __tinfo;
|
41
42
|
|
42
43
|
ID id_return_value_var, id_klass_var, id_recv_var, id_method_var, id_unhook_var;
|
43
44
|
|
@@ -78,7 +79,7 @@ void tinfo_mark(AttachedThreadInfo* tinfo) {
|
|
78
79
|
}
|
79
80
|
|
80
81
|
AttachedThreadInfo* tinfo_from_thread(VALUE thread) {
|
81
|
-
VALUE tmp = rb_ivar_get( thread,
|
82
|
+
VALUE tmp = rb_ivar_get( thread, __tinfo );
|
82
83
|
|
83
84
|
if (tmp == Qnil) {
|
84
85
|
AttachedThreadInfo* tinfo = malloc(sizeof(AttachedThreadInfo));
|
@@ -88,7 +89,7 @@ AttachedThreadInfo* tinfo_from_thread(VALUE thread) {
|
|
88
89
|
|
89
90
|
VALUE tinfo_obj = Data_Make_Struct(rb_cObject, AttachedThreadInfo, tinfo_mark, free, tinfo);
|
90
91
|
|
91
|
-
rb_ivar_set( thread,
|
92
|
+
rb_ivar_set( thread, __tinfo, tinfo_obj);
|
92
93
|
|
93
94
|
return tinfo;
|
94
95
|
} else {
|
@@ -215,12 +216,6 @@ void rallhook_redirect_handler ( VALUE* klass, VALUE* recv, ID* mid ) {
|
|
215
216
|
}
|
216
217
|
}
|
217
218
|
|
218
|
-
// methods over class hook are illegal, may change the state of hook
|
219
|
-
if (*recv == rb_cHook ) {
|
220
|
-
rb_raise(rb_eSecurityError, "Illegal method call: Hook.%s", rb_id2name(*mid) );
|
221
|
-
}
|
222
|
-
|
223
|
-
|
224
219
|
}
|
225
220
|
|
226
221
|
/*
|
@@ -245,6 +240,8 @@ VALUE hook(VALUE self, VALUE hook_proc) {
|
|
245
240
|
|
246
241
|
enable_redirect(tinfo_from_thread(rb_thread_current()));
|
247
242
|
|
243
|
+
hook_rb_add_method();
|
244
|
+
|
248
245
|
if (rb_block_given_p() ) {
|
249
246
|
return rb_ensure(rb_yield, Qnil, unhook, self);
|
250
247
|
}
|
@@ -313,6 +310,19 @@ VALUE rb_thread_acquire_attributes( VALUE thread ) {
|
|
313
310
|
return Qnil;
|
314
311
|
}
|
315
312
|
|
313
|
+
#include "signal.h"
|
314
|
+
|
315
|
+
void disable_sigsegv_handler() {
|
316
|
+
|
317
|
+
struct sigaction sigDisable;
|
318
|
+
|
319
|
+
sigDisable.sa_handler = SIG_IGN;
|
320
|
+
sigDisable.sa_restorer = NULL;
|
321
|
+
|
322
|
+
sigaction (SIGSEGV, &sigDisable, NULL);
|
323
|
+
|
324
|
+
}
|
325
|
+
|
316
326
|
|
317
327
|
extern void Init_rallhook_base() {
|
318
328
|
|
@@ -403,7 +413,9 @@ Example:
|
|
403
413
|
id_hook_enabled = rb_intern("__hook_enabled");
|
404
414
|
id_hook_enable_left = rb_intern("__hook_enable_left");
|
405
415
|
id_hook_proc = rb_intern("__hook_proc");
|
416
|
+
__tinfo = rb_intern("__tinfo");
|
406
417
|
|
407
418
|
rb_define_method(rb_cThread, "acquire_attributes", rb_thread_acquire_attributes,0);
|
408
419
|
|
420
|
+
disable_sigsegv_handler();
|
409
421
|
}
|
metadata
CHANGED
@@ -1,13 +1,13 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rallhook
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
hash:
|
4
|
+
hash: 63
|
5
5
|
prerelease: false
|
6
6
|
segments:
|
7
7
|
- 0
|
8
|
-
-
|
9
|
-
-
|
10
|
-
version: 0.
|
8
|
+
- 8
|
9
|
+
- 0
|
10
|
+
version: 0.8.0
|
11
11
|
platform: ruby
|
12
12
|
authors:
|
13
13
|
- Dario Seminara
|
@@ -15,7 +15,7 @@ autorequire:
|
|
15
15
|
bindir: bin
|
16
16
|
cert_chain: []
|
17
17
|
|
18
|
-
date: 2010-
|
18
|
+
date: 2010-09-03 00:00:00 -03:00
|
19
19
|
default_executable:
|
20
20
|
dependencies:
|
21
21
|
- !ruby/object:Gem::Dependency
|
@@ -71,6 +71,16 @@ files:
|
|
71
71
|
- ext/rallhook_base/ruby_symbols.c
|
72
72
|
- ext/rallhook_base/rb_call_fake.c
|
73
73
|
- ext/rallhook_base/ruby_redirect.c
|
74
|
+
- ext/rallhook_base/deps/distorm/src/decoder.c
|
75
|
+
- ext/rallhook_base/deps/distorm/src/prefix.c
|
76
|
+
- ext/rallhook_base/deps/distorm/src/distorm.c
|
77
|
+
- ext/rallhook_base/deps/distorm/src/textdefs.c
|
78
|
+
- ext/rallhook_base/deps/distorm/src/instructions.c
|
79
|
+
- ext/rallhook_base/deps/distorm/src/wstring.c
|
80
|
+
- ext/rallhook_base/deps/distorm/src/x86defs.c
|
81
|
+
- ext/rallhook_base/deps/distorm/src/operands.c
|
82
|
+
- ext/rallhook_base/deps/distorm/src/insts.c
|
83
|
+
- ext/rallhook_base/deps/distorm/mnemonics.c
|
74
84
|
- ext/rallhook_base/hook.c
|
75
85
|
- ext/rallhook_base/rallhook.c
|
76
86
|
- ext/rallhook_base/restrict_def.c
|
@@ -78,6 +88,18 @@ files:
|
|
78
88
|
- ext/rallhook_base/method_node.c
|
79
89
|
- ext/rallhook_base/hook.h
|
80
90
|
- ext/rallhook_base/ruby_version.h
|
91
|
+
- ext/rallhook_base/deps/distorm/src/operands.h
|
92
|
+
- ext/rallhook_base/deps/distorm/src/decoder.h
|
93
|
+
- ext/rallhook_base/deps/distorm/src/wstring.h
|
94
|
+
- ext/rallhook_base/deps/distorm/src/prefix.h
|
95
|
+
- ext/rallhook_base/deps/distorm/src/pydistorm.h
|
96
|
+
- ext/rallhook_base/deps/distorm/src/textdefs.h
|
97
|
+
- ext/rallhook_base/deps/distorm/src/instructions.h
|
98
|
+
- ext/rallhook_base/deps/distorm/src/insts.h
|
99
|
+
- ext/rallhook_base/deps/distorm/src/x86defs.h
|
100
|
+
- ext/rallhook_base/deps/distorm/config.h
|
101
|
+
- ext/rallhook_base/deps/distorm/mnemonics.h
|
102
|
+
- ext/rallhook_base/deps/distorm/distorm.h
|
81
103
|
- ext/rallhook_base/node_defs.h
|
82
104
|
- ext/rallhook_base/hook_rb_call.h
|
83
105
|
- ext/rallhook_base/ruby_symbols.h
|