linux-rootkit

commit 63199e950d54fcb1d9b926e4f7debb53c33c8892
parent 517260ac7ea13694b2709d93abadd13471751841
Author: Tizian Leonhardt <tizianleonhardt@web.de>
Date:   Wed,  3 Feb 2021 18:32:59 +0100

Load dict and retrieve type

Diffstat:
M
project/extract_sizeret.py
 | 
31
++++++++++++++++++++++++++++++-

1 file changed, 30 insertions(+), 1 deletion(-)
diff --git a/project/extract_sizeret.py b/project/extract_sizeret.py
@@ -2,6 +2,7 @@
 
 import gdb
 import re
+import json
 
 # allocator mapped to register containing size argument
 break_arg = {
@@ -15,6 +16,8 @@ exits = set()
 
 prev_entry = None
 
+types = {}
+
 class EntryExitBreakpoint(gdb.Breakpoint):
     def __init__(self, b):
         gdb.Breakpoint.__init__(self, b)
@@ -29,8 +32,9 @@ class EntryExitBreakpoint(gdb.Breakpoint):
             return False
 
         self.extract(f)
+        self.type_lookup(f)
 
-        return True
+        return False
 
     def extract(self, frame):
         global break_arg
@@ -47,13 +51,38 @@ class EntryExitBreakpoint(gdb.Breakpoint):
             print(f"{prev_entry}, ret={hex(int(str(gdb.parse_and_eval('$rax')), 10) & (2 ** 64 - 1))}", flush=True)
             prev_entry = None
 
+    def type_lookup(self, frame):
+        global types
+
+        f_iter = frame.older()
+        
+        while f_iter is not None and f_iter.is_valid() :
+            sym = f_iter.find_sal()
+            symtab = sym.symtab
+
+            if symtab is None:
+                break
+
+            key = f"{symtab.filename}:{sym.line}"
+
+            if key in types:
+                print(types[key])
+
+            f_iter = f_iter.older()
+
 class Stage3():
     breakpoints = []
 
+    dictfile = ".dict"
+
     def __init__(self):
         global break_arg
         global entries
         global exits
+        global types
+
+        with open(self.dictfile, 'r') as dct:
+            types = json.load(dct)
 
         for b in break_arg.keys():
             # set breakpoint at function entry, to extract size