api/samples/strace.c
/* takes in an Nt syscall wrapper entry point */
takes in an Nt syscall wrapper entry point
takes in an Nt syscall wrapper entry point
static int
decode_syscall_num(byte *entry)
{
    void *drcontext = dr_get_current_drcontext();
    int num = -1;
    byte *pc = entry;
    uint opc;
    instr_t instr;
    instr_init(drcontext, &instr);
    do {
        instr_reset(drcontext, &instr);
        pc = decode(drcontext, pc, &instr);
        DR_ASSERT(instr_valid(&instr));
        opc = instr_get_opcode(&instr);
        if (pc - entry > 20) {
            DR_ASSERT(false);
            instr_free(drcontext, &instr);
            return -1;
        }
        if (opc == OP_mov_imm && opnd_is_reg(instr_get_dst(&instr, 0)) &&
            opnd_get_reg(instr_get_dst(&instr, 0)) == REG_EAX) {
            DR_ASSERT(opnd_is_immed_int(instr_get_src(&instr, 0)));
            num = (int) opnd_get_immed_int(instr_get_src(&instr, 0));
            break;
        }
    } while (opc != OP_call_ind && opc != OP_int);
    instr_free(drcontext, &instr);
    DR_ASSERT(num > -1);
    return num;
}
static int decode_syscall_num ( byte * entry ) { void * drcontext = dr_get_current_drcontext ( ) ; int num = -1 ; byte * pc = entry ; uint opc ; instr_t instr ; instr_init ( drcontext , & instr ) ; do { instr_reset ( drcontext , & instr ) ; pc = decode ( drcontext , pc , & instr ) ; DR_ASSERT ( instr_valid ( & instr ) ) ; opc = instr_get_opcode ( & instr ) ; if ( pc - entry > 20 ) { DR_ASSERT ( false ) ; instr_free ( drcontext , & instr ) ; return -1 ; } if ( opc == OP_mov_imm && opnd_is_reg ( instr_get_dst ( & instr , 0 ) ) && opnd_get_reg ( instr_get_dst ( & instr , 0 ) ) == REG_EAX ) { DR_ASSERT ( opnd_is_immed_int ( instr_get_src ( & instr , 0 ) ) ) ; num = ( int ) opnd_get_immed_int ( instr_get_src ( & instr , 0 ) ) ; break ; } } while ( opc != OP_call_ind && opc != OP_int ) ; instr_free ( drcontext , & instr ) ; DR_ASSERT ( num > -1 ) ; return num ; }
takes in an Nt syscall wrapper entry point
takes in an Nt syscall wrapper entry point
/* safety check: should only get 11 or 12 bytes in */ /* Note that we'll failed if somebody has hooked the wrapper */ /* stop at call to vsyscall or at int itself */