egolboy / ftrace Goto Github PK
View Code? Open in Web Editor NEWThis project forked from enzolovesbacon/ftrace
ftrace
This project forked from enzolovesbacon/ftrace
ftrace
Ftrace V0.2 [[email protected]] DESCRIPTION: ftrace is a reverse engineering tool designed to help map out the execution flow of ELF executables (32bit and 64bit). Instead of printing system calls or library function calls, it prints out the local function calls as they are happening, and attempts to retrieve the function arguments and determine whether they are immediate or pointer type. As of version 0.2, function arguments are only shown for 64bit executables. This program is useful when wanting to see the function flow of a given executable during runtime without having to set incremental breakpoints and backtraces in a debugger like gdb. Ftrace relies on symbols for seeing a functions actual name, but the -S option will show function calls for functions without symbols as well, displaying them as sub_<addr>. As of v0.2, complete control flow -C feature was added which gives control flow information beyond just call instructions, moving into other branch instructions. Only branch <imm> instructions are currently supported, but will be adding disassembly of branch *<reg> soon. COMPILE: gcc ftrace.c -o ftrace USAGE: ftrace [-p <pid>] [-Stsve] <prog> <args> ARCHITECTURE: For 32bit executables set FTRACE_ARCH=32, it defaults to 64. OPTIONS: [-v] Verbose output, print symbol table info etc. [-p] This option is used to attach to an existing process ID. [-s] This option will show strings as they are passed through functions (As best it knows how) [-e] This will show certain ELF info such as symbols, and lists the shared library deps. [-t] Type detection will guess what pointer type a function argument is, if it is a pointer. It will detect pointers that are within the range of the text segment, data segment, heap and the stack. [-S] Show function calls that don't have a matching symbol (For stripped binaries) [-C] Complete control flow analysis (branch instructions other than call) EXAMPLE: elfmaster@Ox31337:~/code/ftrace/ftrace$ ./ftrace -Cs test [+] Function tracing begins here: PLT_call@0x400520:__libc_start_main() (CONTROL FLOW CHANGE [jmp]): Jump from .plt 0x40052b into .plt 0x4004d0 LOCAL_call@0x4004b0:_init() (CONTROL FLOW CHANGE [jz]): Jump from .init 0x4004be into .init 0x4004c5 (RETURN VALUE) LOCAL_call@0x4004b0: _init() = 0 (CONTROL FLOW CHANGE [jz]): Jump from .text 0x400608 into .text 0x400625 LOCAL_call@0x400692:b(0x1,0x2,0x3) PLT_call@0x400510:printf("%d, %d, %d\n") (CONTROL FLOW CHANGE [jmp]): Jump from .plt 0x40051b into .plt 0x4004d0 1, 2, 3 (RETURN VALUE) PLT_call@0x400510: printf("%d, %d, %d\n") = 8 (RETURN VALUE) LOCAL_call@0x400692: b(0x1,0x2,0x3) = a LOCAL_call@0x400646:func1("Hello",0xa) PLT_call@0x4004e0:strcpy() (CONTROL FLOW CHANGE [jmp]): Jump from .plt 0x4004eb into .plt 0x4004d0 (RETURN VALUE) PLT_call@0x4004e0: strcpy() = 7fffae340330 (CONTROL FLOW CHANGE [jz]): Jump from .text 0x400689 into .text 0x400690 (RETURN VALUE) LOCAL_call@0x400646: func1("Hello",0xa) = ff LOCAL_call@0x40062c:func2(0x4007e4) PLT_call@0x4004f0:puts() (CONTROL FLOW CHANGE [jmp]): Jump from .plt 0x4004fb into .plt 0x4004d0 stack string (RETURN VALUE) PLT_call@0x4004f0: puts() = d (RETURN VALUE) LOCAL_call@0x40062c: func2(0x4007e4) = d (CONTROL FLOW CHANGE [jz]): Jump from .text 0x400735 into .text 0x40073c LOCAL_call@0x400570:deregister_tm_clones() (RETURN VALUE) LOCAL_call@0x400570: deregister_tm_clones() = 7 BUGS: * Semi Rare EIO ptrace error (In progress to fix) * Memory leak with -s (In progress to fix) FUTURE: * Add support for function arguments on 32bit * Add support for following fork'd children of target process * Extend heuristics of 64bit procedure prologue calling convention for function args. * Add dwarf2 support for .debug section to get function prototype info * Port to FreeBSD * Add support for indirect calls, jmps.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.