Skip to content

Commit

Permalink
[FEATURE] Reverted: INI option regulating whether or not the child pr…
Browse files Browse the repository at this point in the history
…ocess will be followed
  • Loading branch information
hasherezade committed Dec 16, 2024
1 parent 9056452 commit d3426ba
Show file tree
Hide file tree
Showing 4 changed files with 17 additions and 1 deletion.
6 changes: 6 additions & 0 deletions Settings.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
#define DELIM '='

#define KEY_FOLLOW_SHELLCODES "FOLLOW_SHELLCODES"
#define KEY_FOLLOW_CHILDPROCESSES "FOLLOW_CHILDPROCESSES"
#define KEY_LOG_RTDSC "TRACE_RDTSC"
#define KEY_LOG_INT "TRACE_INT"
#define KEY_LOG_SYSCALL "TRACE_SYSCALL"
Expand Down Expand Up @@ -131,6 +132,10 @@ bool fillSettings(Settings &s, const std::string &line)
s.followShellcode = ConvertShcOption(val);
isFilled = true;
}
if (util::iequals(valName, KEY_FOLLOW_CHILDPROCESSES)) {
s.followChildprocesses = loadBoolean(valStr);
isFilled = true;
}
if (util::iequals(valName, KEY_LOG_RTDSC)) {
s.traceRDTSC = loadBoolean(valStr);
isFilled = true;
Expand Down Expand Up @@ -250,6 +255,7 @@ bool Settings::saveINI(const std::string &filename)
return false;
}
myfile << KEY_FOLLOW_SHELLCODES << DELIM << this->followShellcode << "\r\n";
myfile << KEY_FOLLOW_CHILDPROCESSES << DELIM << this->followChildprocesses << "\r\n";
myfile << KEY_LOG_RTDSC << DELIM << booleanToStr(this->traceRDTSC) << "\r\n";
myfile << KEY_LOG_INT << DELIM << booleanToStr(this->traceINT) << "\r\n";
myfile << KEY_LOG_SYSCALL << DELIM << booleanToStr(this->traceSYSCALL) << "\r\n";
Expand Down
2 changes: 2 additions & 0 deletions Settings.h
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ class Settings {

Settings()
: followShellcode(SHELLC_FOLLOW_FIRST),
followChildprocesses(false),
traceRDTSC(false),
traceINT(false),
traceSYSCALL(true),
Expand All @@ -128,6 +129,7 @@ class Settings {

t_shellc_options followShellcode;

bool followChildprocesses; // Follow Child Processes
bool traceRDTSC; // Trace RDTSC
bool traceINT; // trace INT
bool traceSYSCALL; // Trace syscall instructions (i.e., syscall, int 2Eh, sysenter)
Expand Down
9 changes: 8 additions & 1 deletion TinyTracer.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -1317,6 +1317,10 @@ static void OnCtxChange(THREADID threadIndex,

BOOL FollowChild(CHILD_PROCESS childProcess, VOID * userData)
{
if (!m_Settings.followChildprocesses) {
std::cerr << "Following child process is disabled\n";
return FALSE;
}
OS_PROCESS_ID childPid = CHILD_PROCESS_GetId(childProcess);
std::cerr << "Following Subprocess: " << childPid << std::endl;

Expand Down Expand Up @@ -1452,7 +1456,10 @@ int main(int argc, char *argv[])
}

// init output file:
std::string filename = addPidToFilename(KnobOutputFile.Value(), PIN_GetPid());
std::string filename = KnobOutputFile.Value();
if (m_Settings.followChildprocesses) {
filename = addPidToFilename(filename, PIN_GetPid());
}
traceLog.init(filename, m_Settings.shortLogging);

// Register function to be called for every loaded module
Expand Down
1 change: 1 addition & 0 deletions install32_64/TinyTracer.ini
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ FOLLOW_SHELLCODES=1
; 1 : follow only the first shellcode called from the main module
; 2 : follow also the shellcodes called recursively from the the original shellcode
; 3 : follow any shellcodes
FOLLOW_CHILDPROCESSES=False
TRACE_RDTSC=False
TRACE_INT=False
TRACE_SYSCALL=True
Expand Down

0 comments on commit d3426ba

Please sign in to comment.