Arion 1.0.2-alpha
A high-performance C++ framework for emulating executable binaries.
 
Loading...
Searching...
No Matches
code_trace_analysis.hpp
Go to the documentation of this file.
1#ifndef ARION_CODE_TRACE_ANALYSIS_HPP
2#define ARION_CODE_TRACE_ANALYSIS_HPP
3
6#include <fstream>
7#include <map>
8#include <string>
9
10namespace arion
11{
12
15{
17 uint16_t mod_id;
19 std::string name;
21 std::string hash;
26
39 TRACE_MODULE(uint16_t mod_id, std::string name, std::string hash, ADDR start, ADDR end)
46 : mod_id(mod->mod_id), name(mod->name), hash(mod->hash), start(mod->start), end(mod->end) {};
47};
48
51{
52 private:
54 std::string trace_path;
56 std::ifstream trace_f;
58 size_t trace_f_sz;
60 float version;
64 size_t total_hits;
66 std::vector<REG> ctxt_regs;
76 off_t hit_i;
78 std::map<uint16_t, std::unique_ptr<TRACE_MODULE>> modules;
99
100 public:
110 std::unique_ptr<CODE_HIT> curr_hit();
115 std::unique_ptr<CODE_HIT> next_hit();
121 std::unique_ptr<CODE_HIT> next_mod_hit(uint16_t mod_id);
127 std::unique_ptr<CODE_HIT> reach_addr(ADDR addr);
134 std::unique_ptr<CODE_HIT> reach_off(uint16_t mod_id, uint32_t off);
144 void set_hit_index(off_t hit_i);
159 std::unique_ptr<TRACE_MODULE> get_module(uint16_t mod_id);
165 std::unique_ptr<TRACE_MODULE> find_module_from_name(std::string name);
171 std::unique_ptr<TRACE_MODULE> find_module_from_hash(std::string hash);
178 bool has_reg(REG reg);
179};
180
183{
185 off_t hit_i;
187 std::string mod_name;
189 uint32_t off;
191 uint16_t sz;
194 std::unique_ptr<std::map<REG, RVAL>> regs;
195
209 ANALYSIS_HIT(off_t hit_i, std::string mod_name, uint32_t off, uint16_t sz, std::map<REG, RVAL> *regs)
210 : hit_i(hit_i), mod_name(mod_name), off(off), sz(sz), regs(std::make_unique<std::map<REG, RVAL>>(*regs)) {};
211};
212
214using ANALYZER_HIT_CALLBACK = std::function<bool(std::unique_ptr<ANALYSIS_HIT> hit)>;
215
218{
219 private:
222
223 public:
228 ARION_EXPORT CodeTraceAnalyzer(std::string trace_path);
241 void ARION_EXPORT reach_offset(std::string name, uint32_t off);
247 void ARION_EXPORT loop_on_every_hit(ANALYZER_HIT_CALLBACK callback, bool reset_cursor = true);
254 void ARION_EXPORT loop_on_every_mod_hit(ANALYZER_HIT_CALLBACK callback, std::string name, bool reset_cursor = true);
261 void ARION_EXPORT search_hit_address(ANALYZER_HIT_CALLBACK callback, ADDR addr, bool reset_cursor = true);
270 bool reset_cursor = true);
278 void ARION_EXPORT search_hit_offset(ANALYZER_HIT_CALLBACK callback, std::string name, uint32_t off,
279 bool reset_cursor = true);
288 void ARION_EXPORT search_hit_offset_range(ANALYZER_HIT_CALLBACK callback, std::string name, ADDR start_off,
289 ADDR end_off, bool reset_cursor = true);
290
299 template <typename T> void ARION_EXPORT search_reg_val(ANALYZER_HIT_CALLBACK callback, REG reg, T val)
300 {
301 if (this->reader.get_mode() != TRACE_MODE::CTXT)
303 if (!this->reader.has_reg(reg))
305
306 this->reader.reset_hit_cursor();
307 std::unique_ptr<CODE_HIT> hit;
308 while ((hit = this->reader.next_hit()))
309 {
310 RVAL hit_val = hit->regs->at(reg);
311 bool is_equal = false;
312 if constexpr (std::is_same_v<T, RVAL8>)
313 if (hit_val.r8 != val)
314 continue;
315 if constexpr (std::is_same_v<T, RVAL16>)
316 if (hit_val.r16 != val)
317 continue;
318 if constexpr (std::is_same_v<T, RVAL32>)
319 if (hit_val.r32 != val)
320 continue;
321 if constexpr (std::is_same_v<T, RVAL64>)
322 if (hit_val.r64 != val)
323 continue;
324 if constexpr (std::is_same_v<T, RVAL128>)
325 if (hit_val.r128 != val)
326 continue;
327 if constexpr (std::is_same_v<T, RVAL256>)
328 if (hit_val.r256 != val)
329 continue;
330 if constexpr (std::is_same_v<T, RVAL512>)
331 if (hit_val.r512 != val)
332 continue;
333 std::unique_ptr<TRACE_MODULE> mod = this->reader.get_module(hit->mod_id);
334 if (!callback(std::make_unique<ANALYSIS_HIT>(mod->name, hit->off, hit->sz, hit->regs.get())))
335 return;
336 }
337 }
338};
339
342 std::function<bool(std::unique_ptr<ANALYSIS_HIT> hit1, std::unique_ptr<ANALYSIS_HIT> hit2)>;
343
346{
347 private:
352
353 public:
359 ARION_EXPORT CodeTraceComparator(std::string trace_path1, std::string trace_path2);
370 void ARION_EXPORT merge_at_offset(std::string name, uint32_t off);
377 void ARION_EXPORT search_uneq_hit_offset(COMPARATOR_HIT_CALLBACK callback, bool reset_cursors = true);
386 bool reset_cursors = true);
394 void ARION_EXPORT search_uneq_reg(COMPARATOR_HIT_CALLBACK callback, bool reset_cursors = true);
395};
396
397}; // namespace arion
398
399#endif // ARION_CODE_TRACE_ANALYSIS_HPP
This class is used to analyze data held in a trace file with various methods.
Definition code_trace_analysis.hpp:218
void search_hit_offset_range(ANALYZER_HIT_CALLBACK callback, std::string name, ADDR start_off, ADDR end_off, bool reset_cursor=true)
void search_reg_val(ANALYZER_HIT_CALLBACK callback, REG reg, T val)
Definition code_trace_analysis.hpp:299
void loop_on_every_hit(ANALYZER_HIT_CALLBACK callback, bool reset_cursor=true)
void search_hit_address_range(ANALYZER_HIT_CALLBACK callback, ADDR start_addr, ADDR end_addr, bool reset_cursor=true)
void reach_address(ADDR addr)
CodeTraceReader reader
The CodeTraceReader used to parse the trace file.
Definition code_trace_analysis.hpp:221
void loop_on_every_mod_hit(ANALYZER_HIT_CALLBACK callback, std::string name, bool reset_cursor=true)
void search_hit_offset(ANALYZER_HIT_CALLBACK callback, std::string name, uint32_t off, bool reset_cursor=true)
CodeTraceAnalyzer(std::string trace_path)
void search_hit_address(ANALYZER_HIT_CALLBACK callback, ADDR addr, bool reset_cursor=true)
void reach_offset(std::string name, uint32_t off)
This class is used to compare data held in two different trace files with various methods.
Definition code_trace_analysis.hpp:346
void search_uneq_hit_offset(COMPARATOR_HIT_CALLBACK callback, bool reset_cursors=true)
void merge_at_address(ADDR addr)
void search_uneq_reg(COMPARATOR_HIT_CALLBACK callback, bool reset_cursors=true)
CodeTraceReader reader1
The CodeTraceReader used to parse the first trace file.
Definition code_trace_analysis.hpp:349
CodeTraceReader reader2
The CodeTraceReader used to parse the second trace file.
Definition code_trace_analysis.hpp:351
CodeTraceComparator(std::string trace_path1, std::string trace_path2)
void search_uneq_hit_offset_mod(COMPARATOR_HIT_CALLBACK callback, std::string name, bool reset_cursors=true)
void merge_at_offset(std::string name, uint32_t off)
This class is used to read and parse an execution trace generated by an arion::CodeTracer instance.
Definition code_trace_analysis.hpp:51
std::map< uint16_t, std::unique_ptr< TRACE_MODULE > > modules
Map of modules in the trace file, given their id.
Definition code_trace_analysis.hpp:78
std::string trace_path
Path to the trace file.
Definition code_trace_analysis.hpp:54
std::unique_ptr< TRACE_MODULE > get_module(uint16_t mod_id)
std::unique_ptr< CODE_HIT > next_mod_hit(uint16_t mod_id)
off_t secs_table_off
Offset in bytes to the sections table of the trace file.
Definition code_trace_analysis.hpp:68
std::vector< REG > ctxt_regs
List of registers making up the context for TRACE_MODE::CTXT traces.
Definition code_trace_analysis.hpp:66
bool has_reg(REG reg)
std::unique_ptr< CODE_HIT > curr_hit()
std::unique_ptr< CODE_HIT > next_hit()
off_t regs_sec_off
Offset in bytes to the registers section of the trace file.
Definition code_trace_analysis.hpp:72
std::unique_ptr< TRACE_MODULE > find_module_from_name(std::string name)
std::ifstream trace_f
Stream instance for the trace file.
Definition code_trace_analysis.hpp:56
size_t trace_f_sz
Size in bytes of the trace file.
Definition code_trace_analysis.hpp:58
off_t mod_sec_off
Offset in bytes to the modules section of the trace file.
Definition code_trace_analysis.hpp:70
size_t total_hits
Amount of hits (e.g : instructions, basic blocks...) in the trace file.
Definition code_trace_analysis.hpp:64
std::unique_ptr< TRACE_MODULE > find_module_from_hash(std::string hash)
off_t hit_i
Current hit index.
Definition code_trace_analysis.hpp:76
std::unique_ptr< CODE_HIT > reach_addr(ADDR addr)
TRACE_MODE mode
The TRACE_MODE used to generate the trace file.
Definition code_trace_analysis.hpp:62
std::unique_ptr< CODE_HIT > reach_off(uint16_t mod_id, uint32_t off)
void set_hit_index(off_t hit_i)
CodeTraceReader(std::string trace_path)
float version
Version of the trace file.
Definition code_trace_analysis.hpp:60
off_t data_sec_off
Offset in bytes to the data section of the trace file.
Definition code_trace_analysis.hpp:74
Thrown when attempting to access a register that is not part of the trace file.
Definition global_excepts.hpp:1003
Thrown when the requested feature can't be used with the specified trace mode.
Definition global_excepts.hpp:992
#define ARION_EXPORT
Defines which symbols should be exported from the library.
Definition global_defs.hpp:13
Definition arch_x86-64.hpp:11
uint64_t REG
Identifies a Unicorn register.
Definition global_defs.hpp:42
std::function< bool(std::unique_ptr< ANALYSIS_HIT > hit)> ANALYZER_HIT_CALLBACK
Callback called when a hit is being processed by a CodeTraceAnalyzer instance.
Definition code_trace_analysis.hpp:214
uint64_t ADDR
Identifies a memory address.
Definition global_defs.hpp:36
TRACE_MODE
These modes are used to configure the output file format.
Definition code_tracer.hpp:31
std::function< bool(std::unique_ptr< ANALYSIS_HIT > hit1, std::unique_ptr< ANALYSIS_HIT > hit2)> COMPARATOR_HIT_CALLBACK
Callback called when a hit is being processed by a CodeTraceComparator instance.
Definition code_trace_analysis.hpp:342
This structure holds data relative to a trace hit (e.g : instruction, basic block....
Definition code_trace_analysis.hpp:183
off_t hit_i
Index of the hit in the trace file.
Definition code_trace_analysis.hpp:185
uint16_t sz
Size of the hit in bytes.
Definition code_trace_analysis.hpp:191
std::unique_ptr< std::map< REG, RVAL > > regs
Definition code_trace_analysis.hpp:194
ANALYSIS_HIT(off_t hit_i, std::string mod_name, uint32_t off, uint16_t sz, std::map< REG, RVAL > *regs)
Definition code_trace_analysis.hpp:209
uint32_t off
Offset to the module start in bytes.
Definition code_trace_analysis.hpp:189
std::string mod_name
Name of the module where the hit occurred.
Definition code_trace_analysis.hpp:187
This structure holds data relative to a module being traced (e.g : a library) in virtual memory space...
Definition code_trace_analysis.hpp:15
ADDR end
End address of the module.
Definition code_trace_analysis.hpp:25
std::string hash
The MD5 checksum of the module.
Definition code_trace_analysis.hpp:21
uint16_t mod_id
The module id.
Definition code_trace_analysis.hpp:17
std::string name
A string describing the module.
Definition code_trace_analysis.hpp:19
TRACE_MODULE()
Definition code_trace_analysis.hpp:30
TRACE_MODULE(uint16_t mod_id, std::string name, std::string hash, ADDR start, ADDR end)
Definition code_trace_analysis.hpp:39
TRACE_MODULE(TRACE_MODULE *mod)
Definition code_trace_analysis.hpp:45
ADDR start
Start address of the module.
Definition code_trace_analysis.hpp:23
Identifies a size-agnostic register value.
Definition global_defs.hpp:64
RVAL8 r8
Used to store 8-bit register values.
Definition global_defs.hpp:66
RVAL64 r64
Used to store 64-bit register values.
Definition global_defs.hpp:72
RVAL512 r512
Used to store 512-bit register values.
Definition global_defs.hpp:78
RVAL256 r256
Used to store 256-bit register values.
Definition global_defs.hpp:76
RVAL16 r16
Used to store 16-bit register values.
Definition global_defs.hpp:68
RVAL128 r128
Used to store 128-bit register values.
Definition global_defs.hpp:74
RVAL32 r32
Used to store 32-bit register values.
Definition global_defs.hpp:70