ptrace.hxx

Go to the documentation of this file.

#pragma once
 
// C++
#include <optional>
#include <stdint.h>
 
// Linux
#include <elf.h>
#include <linux/audit.h>
#include <sys/ptrace.h>
#include <linux/ptrace.h> // ptrace_syscall_info is only found in here?
 
// cosmos
#include <cosmos/BitMask.hxx>
#include <cosmos/dso_export.h>
#include <cosmos/memory.hxx>
#include <cosmos/proc/types.hxx>
 
namespace cosmos::ptrace {
 
enum class Opt : intptr_t { /* is a void* in ptrace(2), so we need pointer width */
        EXITKILL       = PTRACE_O_EXITKILL,
        TRACECLONE     = PTRACE_O_TRACECLONE,
        TRACEEXEC      = PTRACE_O_TRACEEXEC,
        TRACEEXIT      = PTRACE_O_TRACEEXIT,
        TRACEFORK      = PTRACE_O_TRACEFORK,
        TRACEVFORK     = PTRACE_O_TRACEVFORK,
        TRACEVFORKDONE = PTRACE_O_TRACEVFORKDONE,
        TRACESYSGOOD   = PTRACE_O_TRACESYSGOOD,
        TRACESECCOMP   = PTRACE_O_TRACESECCOMP,
        SUSPENDSECCOMP = PTRACE_O_SUSPEND_SECCOMP,
};
 
using Opts = BitMask<Opt>;
 
enum class Event {
        VFORK      = PTRACE_EVENT_VFORK,
        FORK       = PTRACE_EVENT_FORK,
        CLONE      = PTRACE_EVENT_CLONE,
        VFORK_DONE = PTRACE_EVENT_VFORK_DONE,
        EXEC       = PTRACE_EVENT_EXEC,
        EXIT       = PTRACE_EVENT_EXIT,
        STOP       = PTRACE_EVENT_STOP,
        SECCOMP    = PTRACE_EVENT_SECCOMP
};
 
enum class RegisterType {
        GENERAL_PURPOSE = NT_PRSTATUS,
        FLOATING_POINT  = NT_FPREGSET
};
 
 
enum class Request {
        TRACEME            = PTRACE_TRACEME,
        PEEKDATA           = PTRACE_PEEKDATA,
        PEEKTEXT           = PTRACE_PEEKTEXT,
        PEEKUSER           = PTRACE_PEEKUSER,
        POKEDATA           = PTRACE_POKEDATA,
        POKEUSER           = PTRACE_POKEUSER,
        GETREGS            = PTRACE_GETREGS,
        GETFPREGS          = PTRACE_GETFPREGS,
        GETREGSET          = PTRACE_GETREGSET,
        SETREGS            = PTRACE_SETREGS,
        SETFPREGS          = PTRACE_SETFPREGS,
        SETREGSET          = PTRACE_SETREGSET,
        GETSIGINFO         = PTRACE_GETSIGINFO,
        SETSIGINFO         = PTRACE_SETSIGINFO,
        PEEKSIGINFO        = PTRACE_PEEKSIGINFO,
        GETSIGMASK         = PTRACE_GETSIGMASK,
        SETSIGMASK         = PTRACE_SETSIGMASK,
        SETOPTIONS         = PTRACE_SETOPTIONS,
        GETEVENTMSG        = PTRACE_GETEVENTMSG,
        CONT               = PTRACE_CONT,
        SYSCALL            = PTRACE_SYSCALL,
        SINGLESTEP         = PTRACE_SINGLESTEP,
        // When in syscall-enter-stop, change the number of the system call to execute (only supported on arm)
        // (it seems this has been removed from system headers by now)
#ifdef PTRACE_SET_SYSCALL
        SET_SYSCALL        = PTRACE_SET_SYSCALL,
#endif
#ifdef PTRACE_SYSEMU
        SYSEMU             = PTRACE_SYSEMU,
        SYSEMU_SINGLESTEP  = PTRACE_SYSEMU_SINGLESTEP,
#endif
        LISTEN             = PTRACE_LISTEN,
        KILL               = PTRACE_KILL,
        INTERRUPT          = PTRACE_INTERRUPT,
        ATTACH             = PTRACE_ATTACH,
        SEIZE              = PTRACE_SEIZE,
        SECCOMP_GET_FILTER = PTRACE_SECCOMP_GET_FILTER,
        DETACH             = PTRACE_DETACH,
        GET_THREAD_AREA    = PTRACE_GET_THREAD_AREA,
#if PTRACE_SET_THREAD_AREA
        SET_THREAD_AREA    = PTRACE_SET_THREAD_AREA,
#endif
        GET_SYSCALL_INFO   = PTRACE_GET_SYSCALL_INFO,
};
 
 
enum class Arch : uint32_t {
        X86_64 = AUDIT_ARCH_X86_64,
        I386   = AUDIT_ARCH_I386
};
 
struct SyscallInfo {
public: // types
 
        enum class Type : uint8_t {
                ENTRY   = PTRACE_SYSCALL_INFO_ENTRY,   
                EXIT    = PTRACE_SYSCALL_INFO_EXIT,    
                SECCOMP = PTRACE_SYSCALL_INFO_SECCOMP, 
                NONE    = PTRACE_SYSCALL_INFO_NONE     
        };
 
        using EntryInfo = decltype(ptrace_syscall_info::entry);
        using ExitInfo = decltype(ptrace_syscall_info::exit);
        using SeccompInfo = decltype(ptrace_syscall_info::seccomp);
 
public: // functions
 
        Type type() const {
                return Type{m_info.op};
        }
 
        Arch arch() const {
                return Arch{m_info.arch};
        }
 
        uint64_t instructionPtr() const {
                return m_info.instruction_pointer;
        }
 
        uint64_t stackPtr() const {
                return m_info.stack_pointer;
        }
 
        std::optional<EntryInfo> entryInfo() const {
                return type() == Type::ENTRY ? std::make_optional(m_info.entry) : std::nullopt;
        }
 
        std::optional<ExitInfo> exitInfo() const {
                return type() == Type::EXIT ? std::make_optional(m_info.exit) : std::nullopt;
        }
 
        std::optional<SeccompInfo> seccompInfo() const {
                return type() == Type::SECCOMP ? std::make_optional(m_info.seccomp) : std::nullopt;
        }
 
        auto raw() { return &m_info; }
        auto raw() const { return &m_info; }
 
protected: // data
        struct ptrace_syscall_info m_info;
};
 
class PeekSigInfo {
public: // types
 
        enum class Flag : uint32_t {
                PEEK_SHARED = PTRACE_PEEKSIGINFO_SHARED, 
        };
 
        using Flags = BitMask<Flag>;
 
public: // functions
 
 
        PeekSigInfo() {
                clear();
                setFlags(Flags{Flag::PEEK_SHARED});
        }
 
        void clear() {
                zero_object(m_args);
        }
 
        void setFlags(Flags flags) {
                m_args.flags = flags.raw();
        }
 
        void setOffset(uint64_t off) {
                m_args.off = off;
        }
 
        void setAmount(int32_t nr) {
                m_args.nr = nr;
        }
 
        auto raw() const {
                return &m_args;
        }
 
protected: // data
 
        struct ptrace_peeksiginfo_args m_args;
};
 
 
std::optional<long> COSMOS_API trace(const ptrace::Request req, const ProcessID pid,
                void *addr = nullptr, void *data = nullptr);
 
 
void COSMOS_API traceme();
 
} // end ns