Dr. Memory
drsyscall.h File Reference

Header for Dr. Syscall: System Call Monitoring Extension. More...

Data Structures

struct  _drsys_sysnum_t
 
struct  _drsys_arg_t
 
struct  _drsys_options_t
 

Macros

#define DRMGR_PRIORITY_NAME_DRSYS   "drsyscall"
 
#define DRMGR_PRIORITY_NAME_DRSYS_LAST   "drsyscall_last"
 

Typedefs

typedef struct _drsys_syscall_t drsys_syscall_t
 
typedef struct _drsys_sysnum_t drsys_sysnum_t
 
typedef struct _drsys_arg_t drsys_arg_t
 
typedef struct _drsys_options_t drsys_options_t
 
typedef bool(* drsys_iter_cb_t) (drsys_arg_t *arg, void *user_data)
 

Enumerations

enum  {
  DRMGR_PRIORITY_PRESYS_DRSYS = -100,
  DRMGR_PRIORITY_POSTSYS_DRSYS = -100,
  DRMGR_PRIORITY_POSTSYS_DRSYS_LAST = 10000,
  DRMGR_PRIORITY_MODLOAD_DRSYS = -100
}
 
enum  drsys_param_mode_t {
  DRSYS_PARAM_IN = 0x01,
  DRSYS_PARAM_OUT = 0x02,
  DRSYS_PARAM_BOUNDS = 0x04,
  DRSYS_PARAM_RETVAL = 0x08,
  DRSYS_PARAM_INLINED = 0x10
}
 
enum  drsys_param_type_t {
  DRSYS_TYPE_INVALID,
  DRSYS_TYPE_UNKNOWN,
  DRSYS_TYPE_VOID,
  DRSYS_TYPE_BOOL,
  DRSYS_TYPE_INT,
  DRSYS_TYPE_SIGNED_INT,
  DRSYS_TYPE_UNSIGNED_INT,
  DRSYS_TYPE_HANDLE,
  DRSYS_TYPE_NTSTATUS,
  DRSYS_TYPE_ATOM,
  DRSYS_TYPE_POINTER,
  DRSYS_TYPE_STRUCT,
  DRSYS_TYPE_CSTRING,
  DRSYS_TYPE_CWSTRING,
  DRSYS_TYPE_CARRAY,
  DRSYS_TYPE_CWARRAY,
  DRSYS_TYPE_CSTRARRAY,
  DRSYS_TYPE_UNICODE_STRING,
  DRSYS_TYPE_LARGE_STRING,
  DRSYS_TYPE_OBJECT_ATTRIBUTES,
  DRSYS_TYPE_SECURITY_DESCRIPTOR,
  DRSYS_TYPE_SECURITY_QOS,
  DRSYS_TYPE_PORT_MESSAGE,
  DRSYS_TYPE_CONTEXT,
  DRSYS_TYPE_EXCEPTION_RECORD,
  DRSYS_TYPE_DEVMODEW,
  DRSYS_TYPE_WNDCLASSEXW,
  DRSYS_TYPE_CLSMENUNAME,
  DRSYS_TYPE_MENUITEMINFOW,
  DRSYS_TYPE_ALPC_PORT_ATTRIBUTES,
  DRSYS_TYPE_ALPC_SECURITY_ATTRIBUTES,
  DRSYS_TYPE_LOGFONTW,
  DRSYS_TYPE_NONCLIENTMETRICSW,
  DRSYS_TYPE_ICONMETRICSW,
  DRSYS_TYPE_SERIALKEYSW,
  DRSYS_TYPE_SOCKADDR,
  DRSYS_TYPE_MSGHDR,
  DRSYS_TYPE_MSGBUF,
  DRSYS_TYPE_LARGE_INTEGER,
  DRSYS_TYPE_ULARGE_INTEGER,
  DRSYS_TYPE_IO_STATUS_BLOCK,
  DRSYS_TYPE_FUNCTION,
  DRSYS_TYPE_BITMAPINFO,
  DRSYS_TYPE_ALPC_CONTEXT_ATTRIBUTES,
  DRSYS_TYPE_ALPC_MESSAGE_ATTRIBUTES
}
 
enum  drsys_syscall_type_t {
  DRSYS_SYSCALL_TYPE_KERNEL,
  DRSYS_SYSCALL_TYPE_USER,
  DRSYS_SYSCALL_TYPE_GRAPHICS
}
 
enum  drsys_gateway_t
 

Functions

DR_EXPORT drmf_status_t drsys_init (client_id_t client_id, drsys_options_t *options)
 
DR_EXPORT drmf_status_t drsys_exit (void)
 
DR_EXPORT drmf_status_t drsys_filter_syscall (drsys_sysnum_t sysnum)
 
DR_EXPORT drmf_status_t drsys_filter_all_syscalls (void)
 
DR_EXPORT drmf_status_t drsys_name_to_syscall (const char *name, OUT drsys_syscall_t **syscall)
 
DR_EXPORT drmf_status_t drsys_number_to_syscall (drsys_sysnum_t sysnum, OUT drsys_syscall_t **syscall)
 
DR_EXPORT drmf_status_t drsys_syscall_name (drsys_syscall_t *syscall, OUT const char **name)
 
DR_EXPORT drmf_status_t drsys_syscall_number (drsys_syscall_t *syscall, OUT drsys_sysnum_t *sysnum)
 
DR_EXPORT drmf_status_t drsys_syscall_type (drsys_syscall_t *syscall, OUT drsys_syscall_type_t *type)
 
DR_EXPORT drmf_status_t drsys_syscall_is_known (drsys_syscall_t *syscall, OUT bool *known)
 
DR_EXPORT drmf_status_t drsys_syscall_succeeded (drsys_syscall_t *syscall, reg_t result, OUT bool *success)
 
DR_EXPORT drmf_status_t drsys_syscall_return_type (drsys_syscall_t *syscall, OUT drsys_param_type_t *type)
 
DR_EXPORT drmf_status_t drsys_handle_is_current_process (HANDLE h, bool *current)
 
static bool drsys_sysnums_equal (drsys_sysnum_t *num1, drsys_sysnum_t *num2)
 
DR_EXPORT drmf_status_t drsys_syscall_gateway (drsys_gateway_t *method)
 
DR_EXPORT drmf_status_t drsys_cur_syscall (void *drcontext, OUT drsys_syscall_t **syscall)
 
DR_EXPORT drmf_status_t drsys_cur_syscall_result (void *drcontext, OUT bool *success, OUT uint64 *value, OUT uint *error_code)
 
DR_EXPORT drmf_status_t drsys_pre_syscall_arg (void *drcontext, uint argnum, OUT ptr_uint_t *value)
 
DR_EXPORT drmf_status_t drsys_pre_syscall_arg64 (void *drcontext, uint argnum, OUT uint64 *value)
 
DR_EXPORT drmf_status_t drsys_get_mcontext (void *drcontext, OUT dr_mcontext_t **mc)
 
DR_EXPORT drmf_status_t drsys_iterate_syscalls (bool(*cb)(drsys_sysnum_t sysnum, drsys_syscall_t *syscall, void *user_data), void *user_data)
 
DR_EXPORT drmf_status_t drsys_iterate_arg_types (drsys_syscall_t *syscall, drsys_iter_cb_t cb, void *user_data)
 
DR_EXPORT drmf_status_t drsys_iterate_args (void *drcontext, drsys_iter_cb_t cb, void *user_data)
 
DR_EXPORT drmf_status_t drsys_iterate_memargs (void *drcontext, drsys_iter_cb_t cb, void *user_data)
 

Detailed Description

Header for Dr. Syscall: System Call Monitoring Extension.