Skip to content

arm (M1?) support #385

@remram44

Description

@remram44

A bit hard to test without access to an M1 myself, but maybe other ARM platforms can be tried through qemu?

This would also need some support in the unpackers, reproducing cross-architecture probably doesn't work now.

Relevant part in tracer, currently supporting x86 and x86_64, which has to be extended:

#if defined(I386)
if(!process->in_syscall)
process->current_syscall = regs.orig_eax;
if(process->in_syscall)
get_i386_reg(&process->retvalue, regs.eax);
else
{
get_i386_reg(&process->params[0], regs.ebx);
get_i386_reg(&process->params[1], regs.ecx);
get_i386_reg(&process->params[2], regs.edx);
get_i386_reg(&process->params[3], regs.esi);
get_i386_reg(&process->params[4], regs.edi);
get_i386_reg(&process->params[5], regs.ebp);
}
process->mode = MODE_I386;
#elif defined(X86_64)
/* On x86_64, process might be 32 or 64 bits */
/* If len is known (not 0) and not that of x86_64 registers,
* or if len is not known (0) and CS is 0x23 (not as reliable) */
if( (len != 0 && len != sizeof(regs))
|| (len == 0 && regs.cs == 0x23) )
{
/* 32 bit mode */
struct i386_regs *x86regs = (struct i386_regs*)&regs;
if(!process->in_syscall)
process->current_syscall = x86regs->orig_eax;
if(process->in_syscall)
get_i386_reg(&process->retvalue, x86regs->eax);
else
{
get_i386_reg(&process->params[0], x86regs->ebx);
get_i386_reg(&process->params[1], x86regs->ecx);
get_i386_reg(&process->params[2], x86regs->edx);
get_i386_reg(&process->params[3], x86regs->esi);
get_i386_reg(&process->params[4], x86regs->edi);
get_i386_reg(&process->params[5], x86regs->ebp);
}
process->mode = MODE_I386;
}
else
{
/* 64 bit mode */
if(!process->in_syscall)
process->current_syscall = regs.orig_rax;
if(process->in_syscall)
get_x86_64_reg(&process->retvalue, regs.rax);
else
{
get_x86_64_reg(&process->params[0], regs.rdi);
get_x86_64_reg(&process->params[1], regs.rsi);
get_x86_64_reg(&process->params[2], regs.rdx);
get_x86_64_reg(&process->params[3], regs.r10);
get_x86_64_reg(&process->params[4], regs.r8);
get_x86_64_reg(&process->params[5], regs.r9);
}
/* Might still be either native x64 or Linux's x32 layer */
process->mode = MODE_X86_64;
}
#endif

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-help wantedAttention: More help is needed here, as I am out of my depthC-tracer (C)Component: The C part of the tracer codebase (_pytracer extension)T-enhancementType: En enhancement to existing code, or a new feature

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions