1 /* 2 * Copryight 1997 Sean Eric Fagan 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 3. All advertising materials mentioning features or use of this software 13 * must display the following acknowledgement: 14 * This product includes software developed by Sean Eric Fagan 15 * 4. Neither the name of the author may be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #ifndef lint 33 static const char rcsid[] = 34 "$FreeBSD$"; 35 #endif /* not lint */ 36 37 /* 38 * This file has routines used to print out system calls and their 39 * arguments. 40 */ 41 42 #include <sys/types.h> 43 #include <sys/socket.h> 44 #include <sys/un.h> 45 #include <netinet/in.h> 46 #include <arpa/inet.h> 47 48 #include <err.h> 49 #include <signal.h> 50 #include <stdio.h> 51 #include <stdlib.h> 52 #include <string.h> 53 #include <unistd.h> 54 55 #include "syscall.h" 56 57 /* 58 * This should probably be in its own file. 59 */ 60 61 struct syscall syscalls[] = { 62 { "readlink", 1, 3, 63 { { String, 0 } , { String | OUT, 1 }, { Int, 2 }}}, 64 { "lseek", 2, 3, 65 { { Int, 0 }, {Quad, 2 }, { Int, 4 }}}, 66 { "mmap", 2, 6, 67 { { Hex, 0 }, {Int, 1}, {Hex, 2}, {Hex, 3}, {Int, 4}, {Quad, 6}}}, 68 { "open", 1, 3, 69 { { String | IN, 0} , { Int, 1}, {Octal, 2}}}, 70 { "linux_open", 1, 3, 71 { { String, 0 }, { Int, 1}, { Octal, 2 }}}, 72 { "close", 1, 1, { { Int, 0 } } }, 73 { "fstat", 1, 2, 74 { { Int, 0}, {Ptr | OUT , 1 }}}, 75 { "stat", 1, 2, 76 { { String | IN, 0 }, { Ptr | OUT, 1 }}}, 77 { "lstat", 1, 2, 78 { { String | IN, 0 }, { Ptr | OUT, 1 }}}, 79 { "linux_newstat", 1, 2, 80 { { String | IN, 0 }, { Ptr | OUT, 1 }}}, 81 { "linux_newfstat", 1, 2, 82 { { Int, 0 }, { Ptr | OUT, 1 }}}, 83 { "write", 1, 3, 84 { { Int, 0}, { Ptr | IN, 1 }, { Int, 2 }}}, 85 { "ioctl", 1, 3, 86 { { Int, 0}, { Ioctl, 1 }, { Hex, 2 }}}, 87 { "break", 1, 1, { { Hex, 0 }}}, 88 { "exit", 0, 1, { { Hex, 0 }}}, 89 { "access", 1, 2, { { String | IN, 0 }, { Int, 1 }}}, 90 { "sigaction", 1, 3, 91 { { Signal, 0 }, { Ptr | IN, 1 }, { Ptr | OUT, 2 }}}, 92 { "accept", 1, 3, 93 { { Hex, 0 }, { Sockaddr | OUT, 1 }, { Ptr | OUT, 2 } } }, 94 { "bind", 1, 3, 95 { { Hex, 0 }, { Sockaddr | IN, 1 }, { Int, 2 } } }, 96 { "connect", 1, 3, 97 { { Hex, 0 }, { Sockaddr | IN, 1 }, { Int, 2 } } }, 98 { "getpeername", 1, 3, 99 { { Hex, 0 }, { Sockaddr | OUT, 1 }, { Ptr | OUT, 2 } } }, 100 { "getsockname", 1, 3, 101 { { Hex, 0 }, { Sockaddr | OUT, 1 }, { Ptr | OUT, 2 } } }, 102 { 0, 0, 0, { { 0, 0 }}}, 103 }; 104 105 char * ioctlname __P((int)); 106 107 /* 108 * If/when the list gets big, it might be desirable to do it 109 * as a hash table or binary search. 110 */ 111 112 struct syscall * 113 get_syscall(const char *name) { 114 struct syscall *sc = syscalls; 115 116 while (sc->name) { 117 if (!strcmp(name, sc->name)) 118 return sc; 119 sc++; 120 } 121 return NULL; 122 } 123 124 /* 125 * get_struct 126 * 127 * Copy a fixed amount of bytes from the process. 128 */ 129 130 int 131 get_struct(int procfd, void *offset, void *buf, int len) { 132 char *pos; 133 FILE *p; 134 int c, fd; 135 136 if ((fd = dup(procfd)) == -1) 137 err(1, "dup"); 138 if ((p = fdopen(fd, "r")) == NULL) 139 err(1, "fdopen"); 140 fseek(p, (long)offset, SEEK_SET); 141 for (pos = (char *)buf; len--; pos++) { 142 if ((c = fgetc(p)) == EOF) 143 return -1; 144 *pos = c; 145 } 146 fclose(p); 147 return 0; 148 } 149 150 /* 151 * get_string 152 * Copy a string from the process. Note that it is 153 * expected to be a C string, but if max is set, it will 154 * only get that much. 155 */ 156 157 char * 158 get_string(int procfd, void *offset, int max) { 159 char *buf; 160 int size, len, c, fd; 161 FILE *p; 162 163 if ((fd = dup(procfd)) == -1) 164 err(1, "dup"); 165 if ((p = fdopen(fd, "r")) == NULL) 166 err(1, "fdopen"); 167 buf = malloc( size = (max ? max : 64 ) ); 168 len = 0; 169 buf[0] = 0; 170 fseek(p, (long)offset, SEEK_SET); 171 while ((c = fgetc(p)) != EOF) { 172 buf[len++] = c; 173 if (c == 0 || len == max) { 174 buf[len] = 0; 175 break; 176 } 177 if (len == size) { 178 char *tmp; 179 tmp = realloc(buf, size+64); 180 if (tmp == NULL) { 181 buf[len] = 0; 182 fclose(p); 183 return buf; 184 } 185 size += 64; 186 buf = tmp; 187 } 188 } 189 fclose(p); 190 return buf; 191 } 192 193 194 /* 195 * Gag. This is really unportable. Multiplication is more portable. 196 * But slower, from the code I saw. 197 */ 198 199 static long long 200 make_quad(unsigned long p1, unsigned long p2) { 201 union { 202 long long ll; 203 unsigned long l[2]; 204 } t; 205 t.l[0] = p1; 206 t.l[1] = p2; 207 return t.ll; 208 } 209 210 211 /* 212 * print_arg 213 * Converts a syscall argument into a string. Said string is 214 * allocated via malloc(), so needs to be free()'d. The file 215 * descriptor is for the process' memory (via /proc), and is used 216 * to get any data (where the argument is a pointer). sc is 217 * a pointer to the syscall description (see above); args is 218 * an array of all of the system call arguments. 219 */ 220 221 char * 222 print_arg(int fd, struct syscall_args *sc, unsigned long *args) { 223 char *tmp = NULL; 224 switch (sc->type & ARG_MASK) { 225 case Hex: 226 tmp = malloc(12); 227 sprintf(tmp, "0x%lx", args[sc->offset]); 228 break; 229 case Octal: 230 tmp = malloc(13); 231 sprintf(tmp, "0%lo", args[sc->offset]); 232 break; 233 case Int: 234 tmp = malloc(12); 235 sprintf(tmp, "%ld", args[sc->offset]); 236 break; 237 case String: 238 { 239 char *tmp2; 240 tmp2 = get_string(fd, (void*)args[sc->offset], 0); 241 tmp = malloc(strlen(tmp2) + 3); 242 sprintf(tmp, "\"%s\"", tmp2); 243 free(tmp2); 244 } 245 break; 246 case Quad: 247 { 248 unsigned long long t; 249 unsigned long l1, l2; 250 l1 = args[sc->offset]; 251 l2 = args[sc->offset+1]; 252 t = make_quad(l1, l2); 253 tmp = malloc(24); 254 sprintf(tmp, "0x%qx", t); 255 break; 256 } 257 case Ptr: 258 tmp = malloc(12); 259 sprintf(tmp, "0x%lx", args[sc->offset]); 260 break; 261 case Ioctl: 262 { 263 char *temp = ioctlname(args[sc->offset]); 264 if (temp) 265 tmp = strdup(temp); 266 else { 267 tmp = malloc(12); 268 sprintf(tmp, "0x%lx", args[sc->offset]); 269 } 270 } 271 break; 272 case Signal: 273 { 274 long sig; 275 276 sig = args[sc->offset]; 277 tmp = malloc(12); 278 if (sig > 0 && sig < NSIG) { 279 int i; 280 sprintf(tmp, "sig%s", sys_signame[sig]); 281 for (i = 0; tmp[i] != '\0'; ++i) 282 tmp[i] = toupper(tmp[i]); 283 } else { 284 sprintf(tmp, "%ld", sig); 285 } 286 } 287 break; 288 case Sockaddr: 289 { 290 struct sockaddr *sa; 291 char addr[64]; 292 u_char sa_len; 293 char *p, *q; 294 int i, len; 295 296 /* yuck: get sa_len */ 297 get_struct(fd, (void *)args[sc->offset], (void *)&sa_len, sizeof sa_len); 298 sa = malloc(sa_len); 299 get_struct(fd, (void *)args[sc->offset], (void *)sa, sa_len); 300 301 tmp = malloc(100); 302 if (sa->sa_family == AF_INET) { 303 struct sockaddr_in *sin = (struct sockaddr_in *)sa; 304 inet_ntop(AF_INET, &sin->sin_addr, addr, sizeof addr); 305 sprintf(tmp, "{ AF_INET %s:%d }", addr, htons(sin->sin_port)); 306 } else if (sa->sa_family == AF_INET6) { 307 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa; 308 inet_ntop(AF_INET6, &sin6->sin6_addr, addr, sizeof addr); 309 sprintf(tmp, "{ AF_INET6 [%s]:%d }", addr, htons(sin6->sin6_port)); 310 } else if (sa->sa_family == AF_UNIX) { 311 struct sockaddr_un *sun = (struct sockaddr_un *)sa; 312 sprintf(tmp, "{ AF_UNIX \"%s\" }", sun->sun_path); 313 } else { 314 p = tmp; 315 p += sprintf(p, "{ sa_len = %d, sa_family = %d, sa_data = {", 316 sa->sa_len, sa->sa_family); 317 for (q = sa->sa_data; q < ((char *)sa) + sa_len; q++) 318 p += sprintf(p, " 0x%02x,", *q); 319 p--; 320 p += sprintf(p, "} }"); 321 } 322 free(sa); 323 } 324 break; 325 } 326 return tmp; 327 } 328 329 /* 330 * print_syscall 331 * Print (to outfile) the system call and its arguments. Note that 332 * nargs is the number of arguments (not the number of words; this is 333 * potentially confusing, I know). 334 */ 335 336 void 337 print_syscall(FILE *outfile, const char *name, int nargs, char **s_args) { 338 int i; 339 int len = 0; 340 len += fprintf(outfile, "%s(", name); 341 for (i = 0; i < nargs; i++) { 342 if (s_args[i]) 343 len += fprintf(outfile, "%s", s_args[i]); 344 else 345 len += fprintf(outfile, "<missing argument>"); 346 len += fprintf(outfile, "%s", i < (nargs - 1) ? "," : ""); 347 } 348 len += fprintf(outfile, ")"); 349 for (i = 0; i < 6 - (len / 8); i++) 350 fprintf(outfile, "\t"); 351 } 352 353 void 354 print_syscall_ret(FILE *outfile, const char *name, int nargs, char **s_args, int errorp, int retval) { 355 print_syscall(outfile, name, nargs, s_args); 356 if (errorp) { 357 fprintf(outfile, " ERR#%d '%s'\n", retval, strerror(retval)); 358 } else { 359 fprintf(outfile, " = %d (0x%x)\n", retval, retval); 360 } 361 } 362