Skip to content

Commit

Permalink
[BUGFIX] Fixed logging indirect syscalls (log if the same function wa…
Browse files Browse the repository at this point in the history
…s used as a proxy)
  • Loading branch information
hasherezade committed Dec 6, 2024
1 parent 073923c commit eaa48e2
Showing 1 changed file with 6 additions and 4 deletions.
10 changes: 6 additions & 4 deletions TinyTracer.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -301,14 +301,16 @@ std::string resolve_func_name(const ADDRINT addrTo, const std::string& dll_name,
// it doesn't start at the beginning of the routine:
std::ostringstream sstr;
sstr << "[" << name << "+" << std::hex << diff << "]*";

if (ctx && m_Settings.syscallsTable.count()
&& SyscallsTable::isSyscallFuncName(name) && SyscallsTable::isSyscallDll(util::getDllName(dll_name)))

if (ctx && m_Settings.syscallsTable.count()
&& SyscallsTable::isSyscallFuncName(name)
&& SyscallsTable::isSyscallDll(util::getDllName(dll_name))
)
{
//possibly a proxy to the indirect syscall
const ADDRINT eax = (ADDRINT)PIN_GetContextReg(ctx, REG_GAX);
const std::string realName = m_Settings.syscallsTable.getName(eax);
if (realName.length() && SyscallsTable::convertNameToNt(name) != realName) {
if (realName.length()) {
sstr << " -> " << realName;
g_IsIndirectSyscall = true;
}
Expand Down

0 comments on commit eaa48e2

Please sign in to comment.