rallhook 0.7.5 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,105 @@
1
+ /*
2
+ x86defs.h
3
+
4
+ diStorm3 - Powerful disassembler for X86/AMD64
5
+ http://ragestorm.net/distorm/
6
+ distorm at gmail dot com
7
+ Copyright (C) 2010 Gil Dabah
8
+
9
+ This program is free software: you can redistribute it and/or modify
10
+ it under the terms of the GNU General Public License as published by
11
+ the Free Software Foundation, either version 3 of the License, or
12
+ (at your option) any later version.
13
+
14
+ This program is distributed in the hope that it will be useful,
15
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
16
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17
+ GNU General Public License for more details.
18
+
19
+ You should have received a copy of the GNU General Public License
20
+ along with this program. If not, see <http://www.gnu.org/licenses/>
21
+ */
22
+
23
+
24
+ #ifndef X86DEFS_H
25
+ #define X86DEFS_H
26
+
27
+ #include "../config.h"
28
+
29
+ #include "instructions.h"
30
+
31
+ #define SEG_REGS_MAX (6)
32
+ #define CREGS_MAX (9)
33
+ #define DREGS_MAX (8)
34
+
35
+ /* Maximum instruction size, including prefixes */
36
+ #define INST_MAXIMUM_SIZE (15)
37
+
38
+ /* Maximum range of imm8 (comparison type) of special SSE instructions. */
39
+ #define INST_CMP_MAX_RANGE (8)
40
+
41
+ /* Wait instruction byte code. */
42
+ #define INST_WAIT_INDEX (0x9b)
43
+
44
+ /* Lea instruction byte code. */
45
+ #define INST_LEA_INDEX (0x8d)
46
+
47
+ /*
48
+ * Minimal MODR/M value of divided instructions.
49
+ * It's 0xc0, two MSBs set, which indicates a general purpose register is used too.
50
+ */
51
+ #define INST_DIVIDED_MODRM (0xc0)
52
+
53
+ /* This is the escape byte value used for 3DNow! instructions. */
54
+ #define _3DNOW_ESCAPE_BYTE (0x0f)
55
+
56
+ #define PREFIX_LOCK (0xf0)
57
+ #define PREFIX_REPNZ (0xf2)
58
+ #define PREFIX_REP (0xf3)
59
+ #define PREFIX_CS (0x2e)
60
+ #define PREFIX_SS (0x36)
61
+ #define PREFIX_DS (0x3e)
62
+ #define PREFIX_ES (0x26)
63
+ #define PREFIX_FS (0x64)
64
+ #define PREFIX_GS (0x65)
65
+ #define PREFIX_OP_SIZE (0x66)
66
+ #define PREFIX_ADDR_SIZE (0x67)
67
+ #define PREFIX_VEX2b (0xc5)
68
+ #define PREFIX_VEX3b (0xc4)
69
+
70
+ /* REX prefix value range, 64 bits mode decoding only. */
71
+ #define PREFIX_REX_LOW (0x40)
72
+ #define PREFIX_REX_HI (0x4f)
73
+ /* In order to use the extended GPR's we have to add 8 to the Modr/M info values. */
74
+ #define EX_GPR_BASE (8)
75
+
76
+ /* Mask for REX and VEX features: */
77
+ /* Base */
78
+ #define PREFIX_EX_B (1)
79
+ /* Index */
80
+ #define PREFIX_EX_X (2)
81
+ /* Register */
82
+ #define PREFIX_EX_R (4)
83
+ /* Operand Width */
84
+ #define PREFIX_EX_W (8)
85
+ /* Vector Lengh */
86
+ #define PREFIX_EX_L (0x10)
87
+
88
+ /*
89
+ * The inst_lookup will return on of these two instructions according to the specified decoding mode.
90
+ * ARPL or MOVSXD on 64 bits is one byte instruction at index 0x63.
91
+ */
92
+ #define INST_ARPL_INDEX (0x63)
93
+ extern _InstInfo II_arpl;
94
+ extern _InstInfoEx II_movsxd;
95
+
96
+ /*
97
+ * The NOP instruction can be prefixed by REX in 64bits, therefore we have to decide in runtime whether it's an XCHG or NOP instruction.
98
+ * If 0x90 is prefixed by a useable REX it will become XCHG, otherwise it will become a NOP.
99
+ * Also note that if it's prefixed by 0xf3, it becomes a Pause.
100
+ */
101
+ #define INST_NOP_INDEX (0x90)
102
+ extern _InstInfo II_nop;
103
+ extern _InstInfo II_pause;
104
+
105
+ #endif /* X86DEFS_H */
@@ -5,26 +5,6 @@ CONFIG['CC'] = 'gcc'
5
5
  ruby_version = Config::CONFIG["ruby_version"]
6
6
  ruby_version = ruby_version.split(".")[0..1].join(".")
7
7
 
8
- def distorm
9
-
10
- distorm_names = {
11
- "/usr/lib/libdistorm3.so" => "distorm3",
12
- "/usr/local/lib/libdistorm3.so" => "distorm3",
13
- "/usr/lib/libdistorm64.so" => "distorm64",
14
- "/usr/local/lib/libdistorm64.so" => "distorm64"
15
- }
16
-
17
- distorm_names.each do |k,v|
18
- if File.exists? k then
19
- return v
20
- end
21
- end
22
-
23
- raise "Distorm library not found in the system"
24
- end
25
-
26
- $LIBS = $LIBS + " -l#{distorm()}"
27
-
28
8
  if ruby_version == "1.8"
29
9
  $CFLAGS = $CFLAGS + " -DRUBY1_8"
30
10
  elsif ruby_version == "1.9"
@@ -34,6 +14,21 @@ else
34
14
  print "try passing the rubyversion by argument (1.8 or 1.9)\n"
35
15
  end
36
16
 
17
+ $CFLAGS = $CFLAGS + " -o $@"
18
+
19
+ srcdir = '.'
20
+
21
+ $objs = []
22
+ srcs = Dir[File.join(srcdir, "*.{#{SRC_EXT.join(%q{,})}}")]
23
+ srcs += Dir[File.join(srcdir, "deps/distorm/*.c")]
24
+ srcs += Dir[File.join(srcdir, "deps/distorm/src/*.c")]
25
+
26
+ for f in srcs
27
+ obj = f[2..-1].gsub(/\.c$/, ".o")
28
+ $objs.push(obj) unless $objs.index(obj)
29
+ end
30
+
37
31
  create_makefile('rallhook_base')
38
32
 
39
33
 
34
+
@@ -38,6 +38,7 @@ ID id_method_added;
38
38
  ID id_hook_enabled;
39
39
  ID id_hook_enable_left;
40
40
  ID id_hook_proc;
41
+ ID __tinfo;
41
42
 
42
43
  ID id_return_value_var, id_klass_var, id_recv_var, id_method_var, id_unhook_var;
43
44
 
@@ -78,7 +79,7 @@ void tinfo_mark(AttachedThreadInfo* tinfo) {
78
79
  }
79
80
 
80
81
  AttachedThreadInfo* tinfo_from_thread(VALUE thread) {
81
- VALUE tmp = rb_ivar_get( thread, rb_intern("__tinfo") );
82
+ VALUE tmp = rb_ivar_get( thread, __tinfo );
82
83
 
83
84
  if (tmp == Qnil) {
84
85
  AttachedThreadInfo* tinfo = malloc(sizeof(AttachedThreadInfo));
@@ -88,7 +89,7 @@ AttachedThreadInfo* tinfo_from_thread(VALUE thread) {
88
89
 
89
90
  VALUE tinfo_obj = Data_Make_Struct(rb_cObject, AttachedThreadInfo, tinfo_mark, free, tinfo);
90
91
 
91
- rb_ivar_set( thread, rb_intern("__tinfo"), tinfo_obj);
92
+ rb_ivar_set( thread, __tinfo, tinfo_obj);
92
93
 
93
94
  return tinfo;
94
95
  } else {
@@ -215,12 +216,6 @@ void rallhook_redirect_handler ( VALUE* klass, VALUE* recv, ID* mid ) {
215
216
  }
216
217
  }
217
218
 
218
- // methods over class hook are illegal, may change the state of hook
219
- if (*recv == rb_cHook ) {
220
- rb_raise(rb_eSecurityError, "Illegal method call: Hook.%s", rb_id2name(*mid) );
221
- }
222
-
223
-
224
219
  }
225
220
 
226
221
  /*
@@ -245,6 +240,8 @@ VALUE hook(VALUE self, VALUE hook_proc) {
245
240
 
246
241
  enable_redirect(tinfo_from_thread(rb_thread_current()));
247
242
 
243
+ hook_rb_add_method();
244
+
248
245
  if (rb_block_given_p() ) {
249
246
  return rb_ensure(rb_yield, Qnil, unhook, self);
250
247
  }
@@ -313,6 +310,19 @@ VALUE rb_thread_acquire_attributes( VALUE thread ) {
313
310
  return Qnil;
314
311
  }
315
312
 
313
+ #include "signal.h"
314
+
315
+ void disable_sigsegv_handler() {
316
+
317
+ struct sigaction sigDisable;
318
+
319
+ sigDisable.sa_handler = SIG_IGN;
320
+ sigDisable.sa_restorer = NULL;
321
+
322
+ sigaction (SIGSEGV, &sigDisable, NULL);
323
+
324
+ }
325
+
316
326
 
317
327
  extern void Init_rallhook_base() {
318
328
 
@@ -403,7 +413,9 @@ Example:
403
413
  id_hook_enabled = rb_intern("__hook_enabled");
404
414
  id_hook_enable_left = rb_intern("__hook_enable_left");
405
415
  id_hook_proc = rb_intern("__hook_proc");
416
+ __tinfo = rb_intern("__tinfo");
406
417
 
407
418
  rb_define_method(rb_cThread, "acquire_attributes", rb_thread_acquire_attributes,0);
408
419
 
420
+ disable_sigsegv_handler();
409
421
  }
metadata CHANGED
@@ -1,13 +1,13 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: rallhook
3
3
  version: !ruby/object:Gem::Version
4
- hash: 9
4
+ hash: 63
5
5
  prerelease: false
6
6
  segments:
7
7
  - 0
8
- - 7
9
- - 5
10
- version: 0.7.5
8
+ - 8
9
+ - 0
10
+ version: 0.8.0
11
11
  platform: ruby
12
12
  authors:
13
13
  - Dario Seminara
@@ -15,7 +15,7 @@ autorequire:
15
15
  bindir: bin
16
16
  cert_chain: []
17
17
 
18
- date: 2010-08-07 00:00:00 -03:00
18
+ date: 2010-09-03 00:00:00 -03:00
19
19
  default_executable:
20
20
  dependencies:
21
21
  - !ruby/object:Gem::Dependency
@@ -71,6 +71,16 @@ files:
71
71
  - ext/rallhook_base/ruby_symbols.c
72
72
  - ext/rallhook_base/rb_call_fake.c
73
73
  - ext/rallhook_base/ruby_redirect.c
74
+ - ext/rallhook_base/deps/distorm/src/decoder.c
75
+ - ext/rallhook_base/deps/distorm/src/prefix.c
76
+ - ext/rallhook_base/deps/distorm/src/distorm.c
77
+ - ext/rallhook_base/deps/distorm/src/textdefs.c
78
+ - ext/rallhook_base/deps/distorm/src/instructions.c
79
+ - ext/rallhook_base/deps/distorm/src/wstring.c
80
+ - ext/rallhook_base/deps/distorm/src/x86defs.c
81
+ - ext/rallhook_base/deps/distorm/src/operands.c
82
+ - ext/rallhook_base/deps/distorm/src/insts.c
83
+ - ext/rallhook_base/deps/distorm/mnemonics.c
74
84
  - ext/rallhook_base/hook.c
75
85
  - ext/rallhook_base/rallhook.c
76
86
  - ext/rallhook_base/restrict_def.c
@@ -78,6 +88,18 @@ files:
78
88
  - ext/rallhook_base/method_node.c
79
89
  - ext/rallhook_base/hook.h
80
90
  - ext/rallhook_base/ruby_version.h
91
+ - ext/rallhook_base/deps/distorm/src/operands.h
92
+ - ext/rallhook_base/deps/distorm/src/decoder.h
93
+ - ext/rallhook_base/deps/distorm/src/wstring.h
94
+ - ext/rallhook_base/deps/distorm/src/prefix.h
95
+ - ext/rallhook_base/deps/distorm/src/pydistorm.h
96
+ - ext/rallhook_base/deps/distorm/src/textdefs.h
97
+ - ext/rallhook_base/deps/distorm/src/instructions.h
98
+ - ext/rallhook_base/deps/distorm/src/insts.h
99
+ - ext/rallhook_base/deps/distorm/src/x86defs.h
100
+ - ext/rallhook_base/deps/distorm/config.h
101
+ - ext/rallhook_base/deps/distorm/mnemonics.h
102
+ - ext/rallhook_base/deps/distorm/distorm.h
81
103
  - ext/rallhook_base/node_defs.h
82
104
  - ext/rallhook_base/hook_rb_call.h
83
105
  - ext/rallhook_base/ruby_symbols.h