Tracee.hxx

#pragma once
 
// C++
#include <array>
#include <iosfwd>
 
// Linux
#include <unistd.h>
 
// cosmos
#include <cosmos/BitMask.hxx>
#include <cosmos/proc/process.hxx>
#include <cosmos/proc/ptrace.hxx>
#include <cosmos/proc/signal.hxx>
#include <cosmos/proc/Tracee.hxx>
 
// clues
#include <clues/ProcessData.hxx>
#include <clues/RegisterSet.hxx>
#include <clues/SystemCallInfo.hxx>
#include <clues/SystemCallDB.hxx>
#include <clues/types.hxx>
 
namespace cosmos {
        class ApiError;
}
 
namespace clues {
 
class SystemCall;
class EventConsumer;
class Engine;


class CLUES_API Tracee {
        friend class Engine;
        friend class SystemCall;
public: // types


        enum class State {
                UNKNOWN, 
                RUNNING, 
                SYSCALL_ENTER_STOP, 
                SYSCALL_EXIT_STOP, 
                SIGNAL_DELIVERY_STOP, 
                GROUP_STOP, 
                EVENT_STOP, 
                DEAD, 
                DETACHED, 
        };

        enum class Flag {
                WAIT_FOR_ATTACH_STOP = 1 << 0, 
                DETACH_AT_NEXT_STOP  = 1 << 1, 
                INJECTED_SIGSTOP     = 1 << 2, 
                INJECTED_SIGCONT     = 1 << 3, 
                SYSCALL_ENTERED      = 1 << 4, 
                WAIT_FOR_EXITED      = 1 << 5, 
                ATTACH_THREADS_PENDING = 1 << 6, 
                SEEN_SIGRETURN       = 1 << 7, 
        };
 
        using Flags = cosmos::BitMask<Flag>;
 
public: // functions
 
        virtual ~Tracee();
 
        const std::string& executable() const {
                return m_process_data->executable;
        }
 
        const cosmos::StringVector& cmdLine() const {
                return m_process_data->cmdline;
        }

        const FDInfoMap& fdInfoMap() const {
                return m_process_data->fd_info_map;
        }
 
        cosmos::ProcessID pid() const {
                return m_ptrace.pid();
        }
 
        bool alive() const {
                return pid() != cosmos::ProcessID::INVALID;
        }
 
        size_t maxBufferPrefetch() const {
                return m_max_buffer_prefetch;
        }


        void setMaxBufferPrefetch(const size_t bytes) {
                m_max_buffer_prefetch = bytes;
        }


        size_t syscallCtr() const {
                return m_syscall_ctr;
        }

        std::optional<cosmos::Signal> stopSignal() const {
                return m_stop_signal;
        }
 
        static const char* getStateLabel(const State state);
 
        State state() const {
                return m_state;
        }
 
        State prevState() const {
                return m_prev_state;
        }
 
        bool isEnterStop() const {
                return state() == State::SYSCALL_ENTER_STOP;
        }
 
        bool isExitStop() const {
                return state() == State::SYSCALL_EXIT_STOP;
        }
 
        Flags flags() const {
                return m_flags;
        }


        std::optional<cosmos::ChildState> exitData() const {
                return m_exit_data;
        }


        virtual void attach(const FollowChildren follow_children,
                        const AttachThreads attach_threads = AttachThreads{false});


        bool detach();


        long getData(const ForeignPtr addr) const;


        void readString(const ForeignPtr addr, std::string &out) const;

        void readBlob(const ForeignPtr addr, char *buffer, const size_t bytes) const;


        template <typename T, bool CHECK_TRIVIAL=true>
        bool readStruct(const ForeignPtr addr, T &out) const {
                // the address of the struct in the tracee's address space
                if (addr == ForeignPtr::NO_POINTER)
                        // null address specification
                        return false;
 
                if constexpr (CHECK_TRIVIAL) {
                        static_assert(std::is_trivial_v<T> == true);
                }
 
                readBlob(addr, reinterpret_cast<char*>(&out), sizeof(T));
                return true;
        }

        template <typename VECTOR>
        void readVector(const ForeignPtr pointer, VECTOR &out) const;


        virtual bool isChildProcess() const {
                return false;
        }


        bool isThreadGroupLeader() const;


        bool isInitiallyAttachedThread() const {
                return m_initial_attacher != std::nullopt;
        }

        std::optional<SystemCallNr> currentSystemCallNr() const;
 
        const std::optional<SystemCallInfo>& currentSystemCallInfo() const {
                return m_syscall_info;
        }
 
        const Engine& engine() const {
                return m_engine;
        }
 
protected: // constants


        static constexpr std::array<cosmos::Signal, 4> STOPPING_SIGNALS = {
                cosmos::signal::STOP, cosmos::signal::TERM_STOP,
                cosmos::signal::TERM_INPUT, cosmos::signal::TERM_OUTPUT
        };
 
protected: // functions

        explicit Tracee(Engine &engine, EventConsumer &consumer,
                        TraceePtr sibling = nullptr);


        void processEvent(const cosmos::ChildState &data);
 
        void updateExecutable();
 
        void updateCmdLine();
 
        void updateExecInfo() {
                updateExecutable();
                updateCmdLine();
        }
 
        void syncFDsAfterExec();
 
        void changeState(const State new_state);

        void interrupt() {
                m_ptrace.interrupt();
        }

        void restart(const cosmos::Tracee::RestartMode mode = cosmos::Tracee::RestartMode::CONT,
                        const std::optional<cosmos::Signal> signal = {}) {
                m_ptrace.restart(mode, signal);
        }

        void setOptions(const cosmos::ptrace::Opts opts) {
                m_ptrace.setOptions(opts);
        }

        void seize(const cosmos::ptrace::Opts opts) {
                m_ptrace.seize(opts);
        }

        void setPID(const cosmos::ProcessID tracee);


        template <ABI abi>
        void getRegisters(RegisterSet<abi> &rs);
 
        void handleSystemCall();
 
        void handleSystemCallEntry();
 
        void handleSystemCallExit();
 
        void handleStateMismatch();
 
        void handleSignal(const cosmos::SigInfo &info);
 
        void handleEvent(const cosmos::ChildState &data,
                        const cosmos::ptrace::Event event,
                        const cosmos::Signal signal);
 
        void handleStopEvent(const cosmos::Signal signal);
 
        void handleExitEvent();
 
        void handleExecEvent(const cosmos::ProcessID main_pid);
 
        void handleNewChildEvent(const cosmos::ptrace::Event event);
 
        void handleAttached();
 
        void syncState(Tracee &other);

        void attachThreads();

        template <typename FILLER>
        void fillData(ForeignPtr addr, FILLER &filler) const;
 
        virtual void cleanupChild() {}

        void verifyArch();

        std::optional<SystemCallNr> getInitialSyscallNr(const ABI abi) const;
 
        void getInitialRegisters();
 
        void unshareProcessData();


        void doDetach();


        void handleError(const cosmos::ApiError &error);

        bool hasClonedThread() const;


        void trackFD(FDInfo &&info) const;

        void dropFD(const cosmos::FileNum fd) const;
 
protected: // data

        Engine &m_engine;
        EventConsumer &m_consumer;
        State m_state = State::UNKNOWN;
        State m_prev_state = State::UNKNOWN;
        Flags m_flags;
        cosmos::Tracee m_ptrace;
        cosmos::ptrace::Opts m_ptrace_opts;
        std::optional<SystemCallInfo> m_syscall_info;
        SystemCallDB m_syscall_db;
        SystemCall *m_current_syscall = nullptr;
        SystemCall *m_interrupted_syscall = nullptr;
        cosmos::Tracee::RestartMode m_restart_mode = cosmos::Tracee::RestartMode::CONT;
        std::optional<cosmos::Signal> m_inject_sig;
        std::optional<cosmos::ChildState> m_exit_data;
        std::optional<cosmos::ProcessID> m_initial_attacher;
        size_t m_syscall_ctr = 0;
        AnyRegisterSet m_initial_regset;
        std::optional<cosmos::Signal> m_stop_signal;
        ProcessDataPtr m_process_data;
        size_t m_max_buffer_prefetch = 128;
};
 
} // end ns
 
std::ostream& operator<<(std::ostream &o, const clues::Tracee::State &state);