syscalls.cpp

#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wmaybe-uninitialized"
#include "pin.H"
#pragma GCC diagnostic pop

#include "syscalls.h"
#include <unordered_map>
#include <iostream>
#include "bashformats.h"
#include "outfile.h"
#include "images.h"

// HACK for differing namespaces on Windows
#if _WIN32
#define unordered_set tr1::unordered_set
#define unordered_map tr1::unordered_map
#endif


// Number of the most recently entered system call.
static UINT64 _syscallNumber;

// Buffer for string parameters.
static char _stringParamBuffer[256];

// Types of syscall parameter formatting.
enum struct SyscallParam
{
	Ignore,
	Address,
	String,
};

// Stores info about a known syscall.
struct SyscallInfo
{
	std::string Name;
	SyscallParam ParamFormats[6];

	SyscallInfo(std::string name,
		SyscallParam param1 = SyscallParam::Ignore,
		SyscallParam param2 = SyscallParam::Ignore,
		SyscallParam param3 = SyscallParam::Ignore,
		SyscallParam param4 = SyscallParam::Ignore,
		SyscallParam param5 = SyscallParam::Ignore,
		SyscallParam param6 = SyscallParam::Ignore)
		: Name(name)
	{
		ParamFormats[0] = param1;
		ParamFormats[1] = param2;
		ParamFormats[2] = param3;
		ParamFormats[3] = param4;
		ParamFormats[4] = param5;
		ParamFormats[5] = param6;
	}

	SyscallInfo()
		: SyscallInfo("")
	{}
};

// Known syscalls.
std::unordered_map<UINT64, SyscallInfo> _syscallInfo;

// Initializes the list of known syscalls.
void InitSyscalls()
{
	_syscallInfo[0] = SyscallInfo("read", SyscallParam::Address, SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[1] = SyscallInfo("write", SyscallParam::Address, SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[2] = SyscallInfo("open", SyscallParam::String, SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[3] = SyscallInfo("close", SyscallParam::Address);
	_syscallInfo[9] = SyscallInfo("mmap", SyscallParam::Address, SyscallParam::Address, SyscallParam::Address, SyscallParam::Address, SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[10] = SyscallInfo("mprotect", SyscallParam::Address, SyscallParam::Address, SyscallParam::Address); 
	_syscallInfo[11] = SyscallInfo("munmap", SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[12] = SyscallInfo("brk", SyscallParam::Address);
	_syscallInfo[15] = SyscallInfo("rt_sigreturn");
	_syscallInfo[17] = SyscallInfo("pread64", SyscallParam::Address, SyscallParam::Address, SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[21] = SyscallInfo("access", SyscallParam::String, SyscallParam::Address);
	_syscallInfo[25] = SyscallInfo("mremap", SyscallParam::Address, SyscallParam::Address, SyscallParam::Address, SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[97] = SyscallInfo("getrlimit", SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[158] = SyscallInfo("arch_prctl", SyscallParam::Address, SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[218] = SyscallInfo("set_tid_address", SyscallParam::Address);
	_syscallInfo[231] = SyscallInfo("exit_group", SyscallParam::Address);
	_syscallInfo[257] = SyscallInfo("openat", SyscallParam::Address, SyscallParam::String, SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[262] = SyscallInfo("newfstatat", SyscallParam::Address, SyscallParam::String, SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[273] = SyscallInfo("set_robust_list", SyscallParam::Address, SyscallParam::Address);
	_syscallInfo[302] = SyscallInfo("prlimit64", SyscallParam::Address, SyscallParam::Address, SyscallParam::Address, SyscallParam::Address);
}

// Prints an address parameter.
static void PrintAddressParameter(ADDRINT address)
{
	// Print
	std::cerr
		<< _colorDefault << " "
		<< _colorRed << std::hex << address;
	outputFile
		<< " "
		<< std::hex << address;
}

// Print a string parameter.
static void PrintStringParameter(ADDRINT address)
{
	// Read string
	size_t num = PIN_SafeCopy(_stringParamBuffer, reinterpret_cast<void*>(address), sizeof(_stringParamBuffer) - 1);
	_stringParamBuffer[sizeof(_stringParamBuffer) - 1] = '\0';

	if (num == 0)
		std::strcpy(_stringParamBuffer, "<STRING COPY ERROR>");

	// Print
	std::cerr
		<< _colorDefault << " "
		<< _colorYellow << _stringParamBuffer;
	outputFile
		<< " "
		<< std::hex << address;
}

void HandleSyscallEntry(THREADID tid, CONTEXT* context, SYSCALL_STANDARD std, VOID* v)
{
	// Record system call number
	_syscallNumber = PIN_GetSyscallNumber(context, std);

	// Current instruction pointer
	ADDRINT rip = PIN_GetContextReg(context, LEVEL_BASE::REG_RIP);
	ImageData* image = GetImageContainingAddress(rip);
	UINT64 offset = image->GetOffset(rip);

	// Print syscall info depending on number of parameters
	auto syscallInfoIt = _syscallInfo.find(_syscallNumber);
	if (syscallInfoIt != _syscallInfo.end())
	{
		auto syscallInfo = syscallInfoIt->second;

		// Known syscall
		std::cerr
			<< _colorCyan << "syscall "
			<< _colorDefault << std::dec << image->Id << " "
			<< _colorDefault << std::hex << offset << " "
			<< _colorGreen << syscallInfo.Name;
		outputFile
			<< "S "
			<< std::dec << image->Id << " "
			<< std::hex << offset << " "
			<< syscallInfo.Name;

		for (int i = 0; i < 6; ++i)
		{
			if (syscallInfo.ParamFormats[i] == SyscallParam::Address)
				PrintAddressParameter(PIN_GetSyscallArgument(context, std, i));
			else if (syscallInfo.ParamFormats[i] == SyscallParam::String)
				PrintStringParameter(PIN_GetSyscallArgument(context, std, i));
		}

		std::cerr << _colorDefault;
	}
	else
	{
		// Unknown syscall
		std::cerr
			<< _colorCyan << "syscall "
			<< _colorDefault << std::dec << image->Id << " "
			<< _colorDefault << std::hex << offset << " "
			<< _colorGreen << "0x" << std::hex << _syscallNumber;
		outputFile
			<< "S "
			<< std::dec << image->Id << " "
			<< std::hex << offset << " "
			<< "0x" << std::hex << _syscallNumber;

		for (int i = 0; i < 6; ++i)
			PrintAddressParameter(PIN_GetSyscallArgument(context, std, i));

		std::cerr << _colorDefault;
	}

	// Some syscalls don't return
	if (_syscallNumber == 15 || _syscallNumber == 231)
	{
		outputFile << std::endl;
		std::cerr << std::endl;
	}
}

VOID HandleSyscallExit(THREADID tid, CONTEXT* context, SYSCALL_STANDARD std, VOID* v)
{
	// Print return value of last system call
	std::cerr
		<< "  ->  "
		<< _colorRed << std::hex << PIN_GetSyscallReturn(context, std)
		<< _colorDefault
		<< std::endl;

	outputFile
		<< " -> "
		<< std::hex << PIN_GetSyscallReturn(context, std)
		<< std::endl;
}