-
Notifications
You must be signed in to change notification settings - Fork 29
/
Copy pathtraceclient.h
89 lines (72 loc) · 2.57 KB
/
traceclient.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
#pragma once
#include <cstdint>
#include <string>
#include <SimuTrace.h>
namespace traceclient {
typedef SimuTrace::DataWrite64 trace_entry;
typedef struct _instruction {
uint64_t rip;
uint8_t bytes[15];
char module[50];
uint32_t offset;
uint32_t cr3;
} instruction_entry;
SimuTrace::SessionId init_session(std::string storage_name, bool create);
SimuTrace::StreamHandle create_stream(SimuTrace::SessionId session,
std::string stream_name);
SimuTrace::StreamHandle create_instruction_stream(SimuTrace::SessionId session);
SimuTrace::StreamHandle read_stream(SimuTrace::SessionId session,
std::string stream_name);
inline trace_entry *next_entry(SimuTrace::StreamHandle &handle) {
return reinterpret_cast<trace_entry *>(
SimuTrace::StGetNextEntryFast(&handle));
}
inline instruction_entry *next_instr_entry(SimuTrace::StreamHandle &handle) {
return reinterpret_cast<instruction_entry *>(
SimuTrace::StGetNextEntryFast(&handle));
}
inline void submit(SimuTrace::StreamHandle &handle) {
SimuTrace::StSubmitEntryFast(handle);
}
inline void close_stream(SimuTrace::StreamHandle handle) {
SimuTrace::StStreamClose(handle);
}
inline void close_session(SimuTrace::SessionId session) {
SimuTrace::StSessionClose(session);
}
template <typename Lambda>
void iter_entry(SimuTrace::StreamHandle &handle, Lambda &&func) {
void *entry = SimuTrace::StGetNextEntryFast(&handle);
while (entry != nullptr) {
std::forward<Lambda>(func)(entry);
entry = SimuTrace::StGetNextEntryFast(&handle);
}
}
template <typename Lambda>
void *find_entry(SimuTrace::StreamHandle &handle, Lambda &&func) {
void *entry = SimuTrace::StGetNextEntryFast(&handle);
while (entry != nullptr) {
if (std::forward<Lambda>(func)(entry)) {
return entry;
}
entry = SimuTrace::StGetNextEntryFast(&handle);
}
return nullptr;
}
template <typename Lambda>
void iter_stream(SimuTrace::SessionId session, Lambda &&func) {
using namespace SimuTrace;
StreamId ids[1000];
int count = StStreamEnumerate(session, sizeof(ids), ids);
for (int i = 0; i < count; i++) {
StreamQueryInformation info;
StStreamQuery(session, ids[i], &info);
if (!strncmp(info.descriptor.name, "process", strlen("process"))) {
auto handle =
StStreamOpen(session, ids[i], QueryIndexType::QIndex, 0,
StreamAccessFlags::SafSequentialScan, nullptr);
func(handle);
}
}
}
}