ReactOS  0.4.14-dev-49-gfb4591c
syscall.c File Reference
#include "remods.h"
#include "precomp.h"
Include dependency graph for syscall.c:

Go to the source code of this file.

Classes

struct  _FRAME_SYSCALL
 

Typedefs

typedef struct _FRAME_SYSCALL FRAME_SYSCALL
 

Functions

void other_module_cleanup_module (void)
 
void CSyscallHandler (FRAME_SYSCALL *ptr, ULONG ulSysCall, ULONG ebx)
 
 __asm__ ("\n\t \ NewSyscallHandler:\n\t \ // save used regs\n\t \ pushfl\n\t \ cli\n\t \ cld\n\t \ pushal\n\t \ pushl %ds\n\t \ \n\t \ // push the syscall number\n\t \ pushl %ebx\n\t \ pushl %eax\n\t \ \n\t \ // frame ptr\n\t \ lea 48(%esp),%eax\n\t \ pushl %eax\n\t \ \n\t \ // setup default data selectors\n\t \ movw %ss,%ax\n\t \ movw %ax,%ds\n\t \ \n\t \ call _CSyscallHandler\n\t \ \n\t \ // remove pushed params\n\t \ add $12,%esp\n\t \ \n\t \ // restore used regs\n\t \ popl %ds\n\t \ popal\n\t \ popfl\n\t \ \n\t \ // chain to old handler\n\t \ .byte 0x2e\n\t \ jmp *_OldSyscallHandler")
 
void InstallSyscallHook (void)
 
void DeInstallSyscallHook (void)
 

Variables

char syscallTemp [1024]
 
BOOLEAN bReportProcessEvents = TRUE
 
ULONG OldSyscallHandler =0
 
ULONG ulFreeModule =0
 
PDEBUG_MODULE pModJustFreed =NULL
 
void(* old_cleanup_module )(void) =NULL
 

Typedef Documentation

◆ FRAME_SYSCALL

Function Documentation

◆ __asm__()

__asm__ ( "\n\t \NewSyscallHandler:\n\t \ // save used regs\n\t \ pushfl\n\t \ cli\n\t \ cld\n\t \ pushal\n\t \ pushl %ds\n\t \\n\t \ // push the syscall number\n\t \ pushl %ebx\n\t \ pushl %eax\n\t \\n\t \ // frame ptr\n\t \ lea   48%esp,
%eax\n\t \ pushl %eax\n\t \\n\t \//setup default data selectors\n\t \ movw %  ss,
%ax\n\t \ movw %  ax,
%ds\n\t \\n\t \ call _CSyscallHandler\n\t \\n\t \//remove pushed params\n\t \ add  $12,
%esp\n\t \\n\t \//restore used regs\n\t \ popl %ds\n\t \ popal\n\t \ popfl\n\t \\n\t \//chain to old handler\n\t \ .byte 0x2e\n\t \ jmp *_OldSyscallHandler"   
)

◆ CSyscallHandler()

void CSyscallHandler ( FRAME_SYSCALL ptr,
ULONG  ulSysCall,
ULONG  ebx 
)

Definition at line 71 of file syscall.c.

72 {
73 // DPRINT((0,"CSyscallHandler(): %.4X:%.8X (syscall = %u)\n",ptr->cs,ptr->eip,ulSysCall));
74 /*
75  switch(ulSysCall)
76  {
77  case 1: // sys_exit
78  DPRINT((0,"CSysCallHandler(): 1\n"));
79  if(bReportProcessEvents)
80  {
81  PICE_sprintf(syscallTemp,"pICE: process destroyed \"%s\" PID=%.4X\n",current->comm,current->pid);
82  AddToRingBuffer(syscallTemp);
83  }
84  break;
85  case 11: // sys_execve
86  DPRINT((0,"CSysCallHandler(): 11\n"));
87  if(bReportProcessEvents)
88  {
89  if(PICE_strlen((char*)ebx))
90  PICE_sprintf(syscallTemp,"pICE: process created \"%s\" PID=%.4X (parent \"%s\")\n",(char *)ebx,current->pid,current->comm);
91  else
92  PICE_sprintf(syscallTemp,"pICE: process created PID=%.4X (parent \"%s\")\n",current->pid,current->comm);
93  AddToRingBuffer(syscallTemp);
94  }
95  break;
96  case 128: // sys_init_module
97  DPRINT((0,"CSysCallHandler(): 128\n"));
98  if(PICE_strlen((char *)ebx))
99  {
100  if(pmodule_list)
101  {
102  struct module* pMod = *pmodule_list;
103  do
104  {
105  if(PICE_strcmpi((char*)ebx,(LPSTR)pMod->name)==0)
106  {
107  ULONG ulInitAddress;
108  PICE_sprintf(syscallTemp,"pICE: module \"%s\" loaded (%x-%x init @ %x)\n",(char*)ebx,pMod,(ULONG)pMod+pMod->size,pMod->init);
109  if((ulInitAddress=FindFunctionInModuleByName("init_module",pMod)))
110  {
111  DPRINT((0,"setting DR1=%.8x\n",ulInitAddress));
112 
113  SetHardwareBreakPoint(ulInitAddress,1);
114  }
115  }
116  }while((pMod = pMod->next));
117  }
118  else
119  {
120  PICE_sprintf(syscallTemp,"pICE: module loaded \"%s\"\n",(char *)ebx);
121  }
122  }
123  else
124  PICE_sprintf(syscallTemp,"pICE: module loaded\n");
125  AddToRingBuffer(syscallTemp);
126  break;
127  case 129: // sys_delete_module
128  DPRINT((0,"CSysCallHandler(): 129\n"));
129  if(PICE_strlen((char *)ebx))
130  {
131  if(IsModuleLoaded((LPSTR)ebx)!=NULL && PICE_strcmpi((char*)ebx,"pice")!=0 )
132  {
133  PICE_sprintf(syscallTemp,"pICE: module freed \"%s\"\n",(char *)ebx);
134  Print(OUTPUT_WINDOW,syscallTemp);
135  if((pModJustFreed = FindModuleByName((char*)ebx)) )
136  {
137  if(pModJustFreed->cleanup)
138  {
139  old_cleanup_module = pModJustFreed->cleanup;
140  pModJustFreed->cleanup = other_module_cleanup_module;
141  }
142  else
143  {
144  RevirtualizeBreakpointsForModule(pModJustFreed);
145  }
146  }
147  }
148  }
149  else
150  {
151  PICE_sprintf(syscallTemp,"pICE: module freed\n");
152  AddToRingBuffer(syscallTemp);
153  }
154  break;
155  }
156  */
157 }

◆ DeInstallSyscallHook()

void DeInstallSyscallHook ( void  )

Definition at line 218 of file syscall.c.

219 {
220  ENTER_FUNC();
221 /*ei
222  MaskIrqs();
223  if(OldSyscallHandler)
224  {
225  SetGlobalInt(0x2e,(ULONG)OldSyscallHandler);
226  (ULONG)OldSyscallHandler=0;
227  }
228  UnmaskIrqs();
229 */
230  LEAVE_FUNC();
231 }
#define LEAVE_FUNC()
Definition: debug.h:43
#define ENTER_FUNC()
Definition: debug.h:42

Referenced by CleanUpPICE().

◆ InstallSyscallHook()

void InstallSyscallHook ( void  )

Definition at line 194 of file syscall.c.

195 {
196  ULONG LocalSyscallHandler;
197 
198  ENTER_FUNC();
199 /*ei fix later
200  MaskIrqs();
201  if(!OldSyscallHandler)
202  {
203  __asm__("mov $NewSyscallHandler,%0"
204  :"=r" (LocalSyscallHandler)
205  :
206  :"eax");
207  OldSyscallHandler=SetGlobalInt(0x2e,(ULONG)LocalSyscallHandler);
208 
209  ScanExports("free_module",(PULONG)&ulFreeModule);
210 
211  DPRINT((0,"InstallSyscallHook(): free_module @ %x\n",ulFreeModule));
212  }
213  UnmaskIrqs();
214  */
215  LEAVE_FUNC();
216 }
#define LEAVE_FUNC()
Definition: debug.h:43
unsigned int ULONG
Definition: retypes.h:1
#define ENTER_FUNC()
Definition: debug.h:42

Referenced by InitPICE().

◆ other_module_cleanup_module()

void other_module_cleanup_module ( void  )

Definition at line 54 of file syscall.c.

55 {
56  DPRINT((0,"other_module_cleanup_module()\n"));
57 
59  {
60  DPRINT((0,"other_module_cleanup_module(): calling %x\n",(ULONG)old_cleanup_module));
62  }
63 
64  if(pModJustFreed)
65  {
66  DPRINT((0,"other_module_cleanup_module(): calling RevirtualizeBreakpointsForModule(%x)\n",(ULONG)pModJustFreed));
68  }
69 }
void(* old_cleanup_module)(void)
Definition: syscall.c:52
void DPRINT(...)
Definition: polytest.cpp:61
void RevirtualizeBreakpointsForModule(PDEBUG_MODULE pMod)
Definition: bp.c:592
PDEBUG_MODULE pModJustFreed
Definition: syscall.c:51
unsigned int ULONG
Definition: retypes.h:1

Variable Documentation

◆ bReportProcessEvents

BOOLEAN bReportProcessEvents = TRUE

Definition at line 45 of file syscall.c.

◆ old_cleanup_module

void(* old_cleanup_module) (void) =NULL

Definition at line 52 of file syscall.c.

Referenced by other_module_cleanup_module().

◆ OldSyscallHandler

ULONG OldSyscallHandler =0

Definition at line 47 of file syscall.c.

◆ pModJustFreed

PDEBUG_MODULE pModJustFreed =NULL

Definition at line 51 of file syscall.c.

Referenced by other_module_cleanup_module().

◆ syscallTemp

char syscallTemp[1024]

Definition at line 36 of file syscall.c.

◆ ulFreeModule

ULONG ulFreeModule =0

Definition at line 49 of file syscall.c.