Skip to content

Commit

Permalink
[FEATURE] Log indirect syscall even if the syscalls table is not fill…
Browse files Browse the repository at this point in the history
…ed. Enable it for Windows only
  • Loading branch information
hasherezade committed Dec 6, 2024
1 parent 591f5ea commit 42b6404
Showing 1 changed file with 9 additions and 4 deletions.
13 changes: 9 additions & 4 deletions TinyTracer.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -303,20 +303,25 @@ std::string resolve_func_name(const ADDRINT addrTo, const std::string& dll_name,
// it doesn't start at the beginning of the routine:
std::ostringstream sstr;
sstr << "[" << name << "+" << std::hex << diff << "]*";

if (ctx && m_Settings.syscallsTable.count()
#ifdef _WIN32
if (ctx
&& SyscallsTable::isSyscallFuncName(name)
&& SyscallsTable::isSyscallDll(util::getDllName(dll_name))
)
{
//possibly a proxy to the indirect syscall
g_IsIndirectSyscall = true;
const ADDRINT eax = (ADDRINT)PIN_GetContextReg(ctx, REG_GAX);
const std::string realName = m_Settings.syscallsTable.getName(eax);
sstr << " -> ";
if (realName.length()) {
sstr << " -> " << realName;
g_IsIndirectSyscall = true;
sstr << realName;
}
else {
sstr << "SYSCALL:0x" << eax;
}
}
#endif //_WIN32
return sstr.str();
}

Expand Down

0 comments on commit 42b6404

Please sign in to comment.