Skip to content

Instantly share code, notes, and snippets.

@gs0510
Created March 26, 2019 18:51
Show Gist options
  • Save gs0510/74429234b85acfbc6810e099a3ff9dc6 to your computer and use it in GitHub Desktop.
Save gs0510/74429234b85acfbc6810e099a3ff9dc6 to your computer and use it in GitHub Desktop.
//Hashmap to store the count call, can compare to strace for numbers!
let mut map = HashMap::new();
//allow the child to be traced
let output = cmd.before_exec(traceme);
let mut child = cmd.spawn().expect("child process failed");
let pid = nix::unistd::Pid::from_raw(child.id() as libc::pid_t);
//allow parent to be stopped everytime there is a SIGTRAP sent because a syscall happened.
ptrace::setoptions(
pid,
Options::PTRACE_O_TRACESYSGOOD | Options::PTRACE_O_TRACEEXEC,
)
.unwrap();
waitpid(pid, None);
/// Whether we are exiting (rather than entering) a syscall.
/// ptrace is stopped both times when exiting and entering a syscall, we only
/// need to stop once.
let mut exit = true;
loop {
//get the registers from the address where ptrace is stopped.
let regs = match get_regs(pid) {
Ok(x) => x,
Err(err) => {
eprintln!("End of ptrace {:?}", err);
break;
}
};
if exit {
/// syscall number is stored inside orig_rax register. Transalte from number
/// to syscall name using an array that stores all syscalls.
let mut syscallName = system_call_names::SYSTEM_CALL_NAMES[(regs.orig_rax) as usize];
//Insert into hashmap to print all syscalls later.
match map.get(&syscallName) {
Some(&number) => map.insert(syscallName, number + 1),
_ => map.insert(syscallName, 1),
};
}
unsafe {
///Stop everytime a SIGTRAP is sent because of a syscall
ptrace(
Request::PTRACE_SYSCALL,
pid,
ptr::null_mut(),
ptr::null_mut(),
);
}
waitpid(pid, None);
exit = !exit;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment