-
Notifications
You must be signed in to change notification settings - Fork 2
/
prototype.py
208 lines (170 loc) · 5.45 KB
/
prototype.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
"""
Copyright notice
================
Copyright (C) 2010
Lorenzo Martignoni <[email protected]>
Roberto Paleari <[email protected]>
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free Software
Foundation, either version 3 of the License, or (at your option) any later
version.
ProcessTap is distributed in the hope that it will be useful, but WITHOUT ANY
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with
this program. If not, see <http://www.gnu.org/licenses/>.
"""
import os, sys
import tempfile
import pickle
import warnings
import struct
warnings.filterwarnings('ignore', category=DeprecationWarning)
import xmlrpclib
from cparser import type as ctype
__includepath = []
__prototypes = {}
__parser_proxy = None
__ptr_size = 4
class InvalidArgument(Exception):
def __init__(self, s):
Exception.__init__(self, s)
class MissingPrototype(Exception):
def __init__(self, s):
Exception.__init__(self, s)
def parse_header(h):
ff = __parser_proxy.parse(h, [], __includepath, __ptr_size)
ff = pickle.loads(ff)
print "[*] Parsing '%s' (%d functions)" % (h, len(ff))
for f, p in ff.iteritems():
__prototypes[f] = p
def set_prototype(p):
tmp = tempfile.NamedTemporaryFile()
tmp.write(p)
tmp.flush()
ff = __parser_proxy.parse(tmp.name, [], __includepath, __ptr_size)
ff = pickle.loads(ff)
print "[*] Parsing '%s' (%d functions)" % (p, len(ff))
for f, p in ff.iteritems():
__prototypes[f] = p
def get_prototype(f):
if f in __prototypes:
return __prototypes[f]
else:
return None
# XXX: unused??
def prototype(f, s = None):
if f in __prototypes:
return __prototypes(f)
else:
return None
# XXX: unused??
def argument(func, arg):
if func in __prototypes:
func = __prototypes[func]
for a in func.getArguments():
if a.getName() == a:
return a
return None
def __cast(ctx, fmt, buf, size = None):
assert len(fmt) == 1
if fmt == "P":
# P can be used only in native mode (use I/L instead according to pointer size)
if ctx.PTR_SIZE == 4:
fmt = "I"
elif ctx.PTR_SIZE == 8:
fmt = "Q"
else:
assert 0
if ctx.isLittleEndian():
fmt = "<" + fmt
else:
fmt = ">" + fmt
if size:
return struct.unpack(fmt, buf[:size])[0]
else:
return struct.unpack(fmt, buf)[0]
def __peek(ctx, fmt, base, size):
if base == None or size == 0:
return None
else:
return __cast(ctx, fmt, ctx.mem[base, base+size])
def __peek_argument(ctx, arg, value):
# print "__peek_argument", arg, repr(value)
if arg.isInt():
if arg.getSize() == 1:
fmt = "b"
elif arg.getSize() == 2:
fmt = "h"
elif arg.getSize() == 4:
fmt = "i"
elif arg.getSize() == 8:
fmt = "l"
else:
assert 0
if not arg.isSigned():
fmt = fmt.upper()
return __cast(ctx, fmt, value, arg.getSize())
elif arg.isChar():
fmt = "c"
if not arg.isSigned():
fmt = "B"
return __cast(ctx, fmt, value, 1)
elif arg.isPtr():
arg_ = arg.getMember()
ptr = __cast(ctx, "P", value)
if ptr:
if arg_.isVoid() or arg.isFuncPtr():
return ptr
elif arg.isString():
r = ""
s = __peek(ctx, "c", ptr, 1)
while s and ord(s) != 0:
r += s
s = __peek(ctx, "c", ptr + len(r), 1)
return r
else:
ptr_ = ctx.mem[ptr, ptr+ctx.PTR_SIZE]
return __peek_argument(ctx, arg_, ptr_)
else:
return None
elif arg.isFloat():
return float(0)
elif arg.isStruct():
pass
elif arg.isUnion():
pass
elif arg.isArray():
arg_ = arg.getMember()
len_ = arg.getLength()
r = []
ptr = __cast(ctx, "P", value)
for i in range(len_):
r += [__peek_argument(ctx, arg_, ptr + i*arg_.getSize())]
return r
elif arg.isVoid():
return None
elif arg.isFunction():
assert 0
return None
def peek_argument(ctx, f, arg):
if f in __prototypes:
proto = __prototypes[f]
i = 0
if arg != -1:
for a in proto.getArguments():
if (isinstance(arg, str) and a.getName() == arg) or (isinstance(arg, int) and arg == i):
return __peek_argument(ctx, a, ctx.abi.argument(i))
i += 1
else:
return __peek_argument(ctx, proto.getReturnType(), ctx.abi.returnval())
return InvalidArgument("Invalid argument '%s' for '%s'" % (str(arg), f))
else:
return MissingPrototype("Missing prototype for '%s'" % (f))
def poke_argument(ctx, func, arg, value):
assert 0
def init(path = ["/usr/include"], ptrsize = 4):
global __includepath, __parser_proxy, __ptr_size
__parser_proxy = xmlrpclib.ServerProxy("http://localhost:45352/", allow_none = True)
__includepath = path
__ptr_size = ptrsize