1 #include "MallocObserver.h"
2 #include "Initializer.h"
3 #include "platform/MemoryEvent.h"
9 bool MallocObserver::handle_breakpoint(Misc::SmartPointer
<Breakpoint
> breakpoint
) {
10 Misc::SmartPointer
<ELF::Symbol
> malloc_symbol
= Initializer::get_instance()->get_program_manager()->get_libc_parser()->get_symbol("malloc");
11 Misc::SmartPointer
<Portal
> portal
= Initializer::get_instance()->get_program_manager()->get_ptrace_portal();
13 static Word last_size
= 0;
15 if(malloc_symbol
.is_valid() && breakpoint
->get_address() != (malloc_symbol
->get_address()
16 + Initializer::get_instance()->get_program_manager()->get_ptrace_portal()->get_libc_offset())) {
18 breakpoint_set_t::iterator i
= breakpoints
.find(breakpoint
->get_id());
19 if(i
== breakpoints
.end()) return false;
21 std::cout
<< "Return value from malloc() is:" << std::hex
<< portal
->get_register(ASM::Register::RAX
) << std::endl
;
22 breakpoint
->set_valid(false);
23 Initializer::get_instance()->get_event_queue()->push_event(new Platform::MemoryBlockAllocEvent(portal
->get_register(ASM::Register::RAX
), last_size
));
27 static int called_times
= 0;
28 /* NOTE: malloc() calls malloc() for some reason, so skip it. */
29 /* TODO: figure out why this happens, and find a workaround. */
30 if(called_times
++ % 2) return true;
31 std::cout
<< "MallocObserver::handle_breakpoint(): malloc breakpoint found . . ." << std::endl
;
32 Word rbp
= portal
->get_register(ASM::Register::RBP
);
33 std::cout
<< "\tRBP is: " << std::hex
<< rbp
<< std::endl
;
34 Word return_address
= portal
->read_memory(rbp
);
35 /* NOTE: rbp-40 is *AN EXTEREMELY BAD IDEA*! *don't* trust it . . . */
36 /* TODO: find where the return address is really being stored . . . */
37 return_address
= portal
->read_memory(rbp
-40);
38 std::cout
<< "\tReturn address: " << return_address
<< std::endl
;
39 breakpoints
.insert(portal
->place_breakpoint(return_address
));
40 std::cout
<< "\tMemory block size will be " << portal
->get_register(ASM::Register::RDI
) << std::endl
;
41 last_size
= portal
->get_register(ASM::Register::RDI
);
47 } // namespace Monitor
48 } // namespace Aesalon