Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

arm (M1?) support #385

Open
remram44 opened this issue Oct 3, 2022 · 0 comments
Open

arm (M1?) support #385

remram44 opened this issue Oct 3, 2022 · 0 comments
Labels
A-help wanted Attention: More help is needed here, as I am out of my depth C-tracer (C) Component: The C part of the tracer codebase (_pytracer extension) T-enhancement Type: En enhancement to existing code, or a new feature

Comments

@remram44
Copy link
Member

remram44 commented Oct 3, 2022

A bit hard to test without access to an M1 myself, but maybe other ARM platforms can be tried through qemu?

This would also need some support in the unpackers, reproducing cross-architecture probably doesn't work now.

Relevant part in tracer, currently supporting x86 and x86_64, which has to be extended:

#if defined(I386)
if(!process->in_syscall)
process->current_syscall = regs.orig_eax;
if(process->in_syscall)
get_i386_reg(&process->retvalue, regs.eax);
else
{
get_i386_reg(&process->params[0], regs.ebx);
get_i386_reg(&process->params[1], regs.ecx);
get_i386_reg(&process->params[2], regs.edx);
get_i386_reg(&process->params[3], regs.esi);
get_i386_reg(&process->params[4], regs.edi);
get_i386_reg(&process->params[5], regs.ebp);
}
process->mode = MODE_I386;
#elif defined(X86_64)
/* On x86_64, process might be 32 or 64 bits */
/* If len is known (not 0) and not that of x86_64 registers,
* or if len is not known (0) and CS is 0x23 (not as reliable) */
if( (len != 0 && len != sizeof(regs))
|| (len == 0 && regs.cs == 0x23) )
{
/* 32 bit mode */
struct i386_regs *x86regs = (struct i386_regs*)&regs;
if(!process->in_syscall)
process->current_syscall = x86regs->orig_eax;
if(process->in_syscall)
get_i386_reg(&process->retvalue, x86regs->eax);
else
{
get_i386_reg(&process->params[0], x86regs->ebx);
get_i386_reg(&process->params[1], x86regs->ecx);
get_i386_reg(&process->params[2], x86regs->edx);
get_i386_reg(&process->params[3], x86regs->esi);
get_i386_reg(&process->params[4], x86regs->edi);
get_i386_reg(&process->params[5], x86regs->ebp);
}
process->mode = MODE_I386;
}
else
{
/* 64 bit mode */
if(!process->in_syscall)
process->current_syscall = regs.orig_rax;
if(process->in_syscall)
get_x86_64_reg(&process->retvalue, regs.rax);
else
{
get_x86_64_reg(&process->params[0], regs.rdi);
get_x86_64_reg(&process->params[1], regs.rsi);
get_x86_64_reg(&process->params[2], regs.rdx);
get_x86_64_reg(&process->params[3], regs.r10);
get_x86_64_reg(&process->params[4], regs.r8);
get_x86_64_reg(&process->params[5], regs.r9);
}
/* Might still be either native x64 or Linux's x32 layer */
process->mode = MODE_X86_64;
}
#endif

@remram44 remram44 added T-enhancement Type: En enhancement to existing code, or a new feature A-help wanted Attention: More help is needed here, as I am out of my depth C-tracer (C) Component: The C part of the tracer codebase (_pytracer extension) labels Oct 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-help wanted Attention: More help is needed here, as I am out of my depth C-tracer (C) Component: The C part of the tracer codebase (_pytracer extension) T-enhancement Type: En enhancement to existing code, or a new feature
Projects
None yet
Development

No branches or pull requests

1 participant