3 Copyright (c) 1998-2001 Klaus P. Gerlicher
22 15-Nov-2000: general cleanup of source files
26 This file may be distributed under the terms of the GNU Public License.
30 ////////////////////////////////////////////////////
36 char syscallTemp
[1024];
38 typedef struct _FRAME_SYSCALL
45 BOOLEAN bReportProcessEvents
= TRUE
;
47 ULONG OldSyscallHandler
=0;
51 PDEBUG_MODULE pModJustFreed
=NULL
;
52 void (*old_cleanup_module
)(void)=NULL
;
54 void other_module_cleanup_module(void)
56 DPRINT((0,"other_module_cleanup_module()\n"));
58 if(old_cleanup_module
)
60 DPRINT((0,"other_module_cleanup_module(): calling %x\n",(ULONG
)old_cleanup_module
));
66 DPRINT((0,"other_module_cleanup_module(): calling RevirtualizeBreakpointsForModule(%x)\n",(ULONG
)pModJustFreed
));
67 RevirtualizeBreakpointsForModule(pModJustFreed
);
71 void CSyscallHandler(FRAME_SYSCALL
* ptr
,ULONG ulSysCall
,ULONG ebx
)
73 // DPRINT((0,"CSyscallHandler(): %.4X:%.8X (syscall = %u)\n",ptr->cs,ptr->eip,ulSysCall));
78 DPRINT((0,"CSysCallHandler(): 1\n"));
79 if(bReportProcessEvents)
81 PICE_sprintf(syscallTemp,"pICE: process destroyed \"%s\" PID=%.4X\n",current->comm,current->pid);
82 AddToRingBuffer(syscallTemp);
85 case 11: // sys_execve
86 DPRINT((0,"CSysCallHandler(): 11\n"));
87 if(bReportProcessEvents)
89 if(PICE_strlen((char*)ebx))
90 PICE_sprintf(syscallTemp,"pICE: process created \"%s\" PID=%.4X (parent \"%s\")\n",(char *)ebx,current->pid,current->comm);
92 PICE_sprintf(syscallTemp,"pICE: process created PID=%.4X (parent \"%s\")\n",current->pid,current->comm);
93 AddToRingBuffer(syscallTemp);
96 case 128: // sys_init_module
97 DPRINT((0,"CSysCallHandler(): 128\n"));
98 if(PICE_strlen((char *)ebx))
102 struct module* pMod = *pmodule_list;
105 if(PICE_strcmpi((char*)ebx,(LPSTR)pMod->name)==0)
108 PICE_sprintf(syscallTemp,"pICE: module \"%s\" loaded (%x-%x init @ %x)\n",(char*)ebx,pMod,(ULONG)pMod+pMod->size,pMod->init);
109 if((ulInitAddress=FindFunctionInModuleByName("init_module",pMod)))
111 DPRINT((0,"setting DR1=%.8x\n",ulInitAddress));
113 SetHardwareBreakPoint(ulInitAddress,1);
116 }while((pMod = pMod->next));
120 PICE_sprintf(syscallTemp,"pICE: module loaded \"%s\"\n",(char *)ebx);
124 PICE_sprintf(syscallTemp,"pICE: module loaded\n");
125 AddToRingBuffer(syscallTemp);
127 case 129: // sys_delete_module
128 DPRINT((0,"CSysCallHandler(): 129\n"));
129 if(PICE_strlen((char *)ebx))
131 if(IsModuleLoaded((LPSTR)ebx)!=NULL && PICE_strcmpi((char*)ebx,"pice")!=0 )
133 PICE_sprintf(syscallTemp,"pICE: module freed \"%s\"\n",(char *)ebx);
134 Print(OUTPUT_WINDOW,syscallTemp);
135 if((pModJustFreed = FindModuleByName((char*)ebx)) )
137 if(pModJustFreed->cleanup)
139 old_cleanup_module = pModJustFreed->cleanup;
140 pModJustFreed->cleanup = other_module_cleanup_module;
144 RevirtualizeBreakpointsForModule(pModJustFreed);
151 PICE_sprintf(syscallTemp,"pICE: module freed\n");
152 AddToRingBuffer(syscallTemp);
160 NewSyscallHandler:\n\t \
161 // save used regs\n\t \
168 // push the syscall number\n\t \
173 lea 48(%esp),%eax\n\t \
176 // setup default data selectors\n\t \
180 call _CSyscallHandler\n\t \
182 // remove pushed params\n\t \
185 // restore used regs\n\t \
190 // chain to old handler\n\t \
192 jmp *_OldSyscallHandler");
194 void InstallSyscallHook(void)
196 ULONG LocalSyscallHandler
;
201 if(!OldSyscallHandler)
203 __asm__("mov $NewSyscallHandler,%0"
204 :"=r" (LocalSyscallHandler)
207 OldSyscallHandler=SetGlobalInt(0x2e,(ULONG)LocalSyscallHandler);
209 ScanExports("free_module",(PULONG)&ulFreeModule);
211 DPRINT((0,"InstallSyscallHook(): free_module @ %x\n",ulFreeModule));
218 void DeInstallSyscallHook(void)
223 if(OldSyscallHandler)
225 SetGlobalInt(0x2e,(ULONG)OldSyscallHandler);
226 (ULONG)OldSyscallHandler=0;