https://github.com/elfmaster/ftrace

POSIX Function tracing
https://github.com/elfmaster/ftrace

Last synced: about 1 month ago
JSON representation

POSIX Function tracing

• Host: GitHub
• URL: https://github.com/elfmaster/ftrace
• Owner: elfmaster
• Created: 2013-11-04T21:24:36.000Z (about 11 years ago)
• Default Branch: master
• Last Pushed: 2017-08-17T04:28:27.000Z (over 7 years ago)
• Last Synced: 2024-08-03T14:09:50.932Z (4 months ago)
• Language: C
• Size: 121 KB
• Stars: 325
• Watchers: 15
• Forks: 102
• Open Issues: 6
• Metadata Files:
  • Readme: README

Awesome Lists containing this project

• awesome-hacking-lists - elfmaster/ftrace - POSIX Function tracing (C)

README

        
Ftrace V0.2 elfmaster [at] zoho.com

DESCRIPTION:

ftrace is a reverse engineering tool designed to help map out the execution flow

of ELF executables (32bit and 64bit). Instead of printing system calls or library

function calls, it prints out the local function calls as they are happening,

and attempts to retrieve the function arguments and determine whether they are

immediate or pointer type. As of version 0.2, function arguments are only shown

for 64bit executables. This program is useful when wanting to see the function flow of

a given executable during runtime without having to set incremental breakpoints

and backtraces in a debugger like gdb. Ftrace relies on symbols for seeing a functions

actual name, but the -S option will show function calls for functions without

symbols as well, displaying them as sub_. As of v0.2, complete control flow

-C feature was added which gives control flow information beyond just call instructions,

moving into other branch instructions. Only branch  instructions are currently

supported, but will be adding disassembly of branch * soon.

COMPILE:

gcc ftrace.c -o ftrace

USAGE:

ftrace [-p ] [-Stsve]  

ARCHITECTURE: 

For 32bit executables set FTRACE_ARCH=32, it defaults to 64.

OPTIONS: 

[-v] Verbose output, print symbol table info etc.

[-p] This option is used to attach to an existing process ID.

[-s] This option will show strings as they are passed through functions (As best it knows how)

[-e] This will show certain ELF info such as symbols, and lists the shared library deps.

[-t] Type detection will guess what pointer type a function argument is, if it is a pointer.

It will detect pointers that are within the range of the text segment, data segment, heap and the stack.

[-S] Show function calls that don't have a matching symbol (For stripped binaries)

[-C] Complete control flow analysis (branch instructions other than call)

EXAMPLE:

elfmaster@Ox31337:~/code/ftrace/ftrace$ ./ftrace -Cs test

[+] Function tracing begins here:

PLT_call@0x400520:__libc_start_main()

(CONTROL FLOW CHANGE [jmp]): Jump from .plt 0x40052b into .plt 0x4004d0

LOCAL_call@0x4004b0:_init()

(CONTROL FLOW CHANGE [jz]): Jump from .init 0x4004be into .init 0x4004c5

(RETURN VALUE) LOCAL_call@0x4004b0: _init() = 0

(CONTROL FLOW CHANGE [jz]): Jump from .text 0x400608 into .text 0x400625

LOCAL_call@0x400692:b(0x1,0x2,0x3)

PLT_call@0x400510:printf("%d, %d, %d\n")

(CONTROL FLOW CHANGE [jmp]): Jump from .plt 0x40051b into .plt 0x4004d0

1, 2, 3

(RETURN VALUE) PLT_call@0x400510: printf("%d, %d, %d\n") = 8

(RETURN VALUE) LOCAL_call@0x400692: b(0x1,0x2,0x3) = a

LOCAL_call@0x400646:func1("Hello",0xa)

PLT_call@0x4004e0:strcpy()

(CONTROL FLOW CHANGE [jmp]): Jump from .plt 0x4004eb into .plt 0x4004d0

(RETURN VALUE) PLT_call@0x4004e0: strcpy() = 7fffae340330

(CONTROL FLOW CHANGE [jz]): Jump from .text 0x400689 into .text 0x400690

(RETURN VALUE) LOCAL_call@0x400646: func1("Hello",0xa) = ff

LOCAL_call@0x40062c:func2(0x4007e4)

PLT_call@0x4004f0:puts()

(CONTROL FLOW CHANGE [jmp]): Jump from .plt 0x4004fb into .plt 0x4004d0

stack string

(RETURN VALUE) PLT_call@0x4004f0: puts() = d

(RETURN VALUE) LOCAL_call@0x40062c: func2(0x4007e4) = d

(CONTROL FLOW CHANGE [jz]): Jump from .text 0x400735 into .text 0x40073c

LOCAL_call@0x400570:deregister_tm_clones()

(RETURN VALUE) LOCAL_call@0x400570: deregister_tm_clones() = 7

 

BUGS:

* Semi Rare EIO ptrace error (In progress to fix)

* Memory leak with -s (In progress to fix)

FUTURE:

* Add support for function arguments on 32bit

* Add support for following fork'd children of target process

* Extend heuristics of 64bit procedure prologue calling convention for function args.

* Add dwarf2 support for .debug section to get function prototype info

* Port to FreeBSD

* Add support for indirect calls, jmps.