Old ptbox files

Makefile

CXX=g++
CXXFLAGS=-g -fPIC -Wall -O3 -march=native -I/usr/include/python$(PYVER) -D_FILE_OFFSET_BITS=64
LIBS=-lrt
SOURCES=ptbox.cpp ptdebug.cpp ptdebug32.cpp ptdebug64.cpp ptproc.cpp
OBJECTS=$(SOURCES:.cpp=.o)
EXECUTABLE=ptbox

all: $(SOURCES) $(EXECUTABLE) _cptbox.so

$(EXECUTABLE): $(OBJECTS)
	$(CXX) $(CXXFLAGS) -o $@ $(OBJECTS) $(LIBS)

strip: $(EXECUTABLE) _cptbox.so
	strip -s $(EXECUTABLE) _cptbox.so

ptbox.o: ptbox.cpp ptbox.h
ptdebug32.o: ptdebug32.cpp ptbox.h
ptdebug64.o: ptdebug64.cpp ptbox.h
ptdebug.o: ptdebug.cpp ptbox.h
ptproc.o: ptproc.cpp ptbox.h

.cpp.o:
	$(CXX) $(CXXFLAGS) -c -o $@ $<

_cptbox.so: _cptbox.o $(OBJECTS)
	$(CXX) -shared $(CXXFLAGS) -o $@ $(OBJECTS) _cptbox.o $(LIBS) -lpython$(PYVER)

_cptbox.cpp: _cptbox.pyx
	cython --cplus _cptbox.pyx

clean:
	-rm -f $(OBJECTS) _cptbox.so $(EXECUTABLE) _cptbox.cpp _cptbox.o

ptbox.cpp

#define _BSD_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <signal.h>
#include <sys/ptrace.h>
#include <sys/resource.h>
#include "ptbox.h"

int child(void *context) {
    char *envp[] = { NULL };
    ptrace(PTRACE_TRACEME, 0, NULL, NULL);
    kill(getpid(), SIGSTOP);
    execle("/bin/ls", "ls", (char *) NULL, envp);
    return 3306;
}

void pt_syscall_return(void *context, int syscall) {
    pt_debugger* debugger = (pt_debugger*) context;
    printf("Returning from: %d: 0x%016lx\n", syscall, debugger->result());
}

int pt_syscall_handler(void *context, int syscall) {
    pt_debugger* debugger = (pt_debugger*) context;
    if (syscall == 5) {
        char *file = debugger->readstr((unsigned long) debugger->arg0(), 4096);
        printf("Opening: %s\n", file);
        debugger->freestr(file);
    }
    debugger->on_return(pt_syscall_return, context);
    return true;
}

int main() {
    pt_debugger32 *debugger = new pt_debugger32();
    pt_process *process = pt_alloc_process(debugger);

    for (unsigned i = 0; i < MAX_SYSCALL; ++i)
        process->set_handler(i, PTBOX_HANDLER_ALLOW);
    process->set_handler(5, PTBOX_HANDLER_CALLBACK);
    process->set_callback(pt_syscall_handler, debugger);

    process->spawn(child, NULL);
    printf("Return: %d", process->monitor());
    delete process;
    delete debugger;
    return 0;
}

ptdebug32.cpp

#define _BSD_SOURCE
#include <sys/ptrace.h>
#include "ptbox.h"

#define EBX 0
#define ECX 1
#define EDX 2
#define ESI 3
#define EDI 4
#define EBP 5
#define EAX 6
#define DS 7
#define ES 8
#define FS 9
#define GS 10
#define ORIG_EAX 11
#define EIP 12
#define CS 13
#define EFL 14
#define UESP 15
#define SS 16

long pt_debugger32::peek_reg(int reg) {
    return ptrace(PTRACE_PEEKUSER, process->getpid(), 4 * reg, 0);
}

void pt_debugger32::poke_reg(int reg, long data) {
    ptrace(PTRACE_POKEUSER, process->getpid(), 4 * reg, data);
}

int pt_debugger32::syscall() {
    return (int) peek_reg(ORIG_EAX);
}

void pt_debugger32::syscall(int id) {
    poke_reg(ORIG_EAX, id);
}

long pt_debugger32::result() {
    return peek_reg(EAX);
}

void pt_debugger32::result(long value) {
    poke_reg(EAX, value);
}

#define make_arg(id, reg) \
    long pt_debugger32::arg##id() { \
        return peek_reg(reg); \
    } \
    \
    void pt_debugger32::arg##id(long data) {\
        poke_reg(reg, data); \
    }

make_arg(0, EBX);
make_arg(1, ECX);
make_arg(2, EDX);
make_arg(3, ESI);
make_arg(4, EDI);

#undef make_arg

long pt_debugger32::arg5() {
    return 0;
}

void pt_debugger32::arg5(long data) {}

bool pt_debugger32::is_exit(int syscall) {
    return syscall == 252 || syscall == 1;
}

int pt_debugger32::getpid_syscall() {
    return 20;
}

ptdebug64.cpp

#define _BSD_SOURCE

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ptrace.h>
#include "ptbox.h"

#define R15 0
#define R14 1
#define R13 2
#define R12 3
#define RBP 4
#define RBX 5
#define R11 6
#define R10 7
#define R9 8
#define R8 9
#define RAX 10
#define RCX 11
#define RDX 12
#define RSI 13
#define RDI 14
#define ORIG_RAX 15
#define RIP 16
#define CS 17
#define EFLAGS 18
#define RSP 19
#define SS 20
#define FS_BASE 21
#define GS_BASE 22
#define DS 23
#define ES 24
#define FS 25
#define GS 26

long pt_debugger64::peek_reg(int reg) {
    return ptrace(PTRACE_PEEKUSER, process->getpid(), 8 * reg, NULL);
}

void pt_debugger64::poke_reg(int reg, long data) {
    ptrace(PTRACE_POKEUSER, process->getpid(), 8 * reg, data);
}

int pt_debugger64::syscall() {
    return (int) peek_reg(ORIG_RAX);
}

void pt_debugger64::syscall(int id) {
    poke_reg(ORIG_RAX, id);
}

long pt_debugger64::result() {
    return peek_reg(RAX);
}

void pt_debugger64::result(long value) {
    poke_reg(RAX, value);
}

#define make_arg(id, reg) \
    long pt_debugger64::arg##id() { \
        return peek_reg(reg); \
    } \
    \
    void pt_debugger64::arg##id(long data) {\
        poke_reg(reg, data); \
    }

make_arg(0, RDI);
make_arg(1, RSI);
make_arg(2, RDX);
make_arg(3, R10);
make_arg(4, R8);
make_arg(5, R9);

#undef make_arg

bool pt_debugger64::is_exit(int syscall) {
    return syscall == 231 || syscall == 60;
}

int pt_debugger64::getpid_syscall() {
    return 39;
}