ran

2024-06-22 10:58| 来源: 网络整理| 查看: 265

中文|English

原理介绍两个核心点如何获取原函数的地址(addr_pri.h、addr_any.h) 如何用桩函数替换原函数(stub.h) 一些说明 stub.h(适合 windows, linux) 基于C++98开发; 使用 inline hook 技术; 主要解决函数替换问题 (相关参考:stub) addr_pri.h(适合 windows, linux) 基于C++11开发; 主要解决对象的私有方法地址获取问题 (相关参考:access_private) src_linux/addr_any.h(仅适合 linux) 基于C++98开发; 使用 elfio 库查询ELF格式文件的符号表获取函数的地址 (也可以使用 bfd 库); 主要解决静态函数地址获取问题，前提编译时得包含调试信息 (相关参考:ELFIO、bfd) src_win/addr_any.h(仅适合 windows) 基于C++98开发; 使用 dbghelp 库查询PDB文件的符号表获取函数的地址; 主要解决静态函数地址获取问题，前提编译时得包含调试信息 (相关参考:symbol-files、dbghelpexamples、pelib) 使用时linux和windows还是有差别的, 主要涉及桩函数的写法, 还有原函数地址获取的方法不同; 获取虚函数的地址方法就不同，主要是C++ABI不兼容, 编译器支持不同(相关参考: cxx-abi) 支持的操作系统 : windows,linux 支持的硬件平台 : x86,x86-64,arm64,arm32 支持的编译器 : msvc,gcc,clang 未来计划支持 macOS GOT/PLT Hook 、 Trap Hook 对比 Inline Hook GOT/PLT Hook Trap Hook Inline Hook 实现原理修改延时绑定表 SIGTRAP断点信号运行时指令替换粒度方法级指令级指令级作用域窄广广性能高低高难度中中极高

Inline hook

GOT/PLT hook

Trap hook

陷阱就是用户态的异常，比如除灵零操作和访问无效内存等，还有系统调用也是。

ptrace

Backtrace

Signal

Windows SEH

Linux EH

Linux SEH

VEH and INT3 for windows

Signal、Backtrace and INT3 for linux

X86/X64 跳转指令

Aarch32/Aarch64 跳转指令

单元测试相关说明不能打桩不能对 exit 函数打桩,编译器做优化了不能对纯虚函数打桩, 纯虚函数没有地址不能对 lambda 函数打桩, lambda 函数获取不到地址不能对静态函数打桩, 静态函数地址不可见.(但可以尝试使用 addr_any.h 接口获取地址) 测试替身(来自网络) Dummy objects are passed around but never actually used. Usually they are just used to fill parameter lists. Fake objects actually have working implementations, but usually take some shortcut which makes them not suitable for production (an InMemoryTestDatabase is a good example). Spy are stubs that also record some information based on how they were called. One form of this might be an email service that records how many messages it was sent. Mock are pre-programmed with expectations which form a specification of the calls they are expected to receive. They can throw an exception if they receive a call they don't expect and are checked during verification to ensure they got all the calls they were expecting. Stub provide canned answers to calls made during the test, usually not responding at all to anything outside what's programmed in for the test. 单元测试框架 gtest、gmock https://github.com/google/googletest cppunit https://github.com/epronk/cppunit catch2 https://github.com/catchorg/Catch2 Boost.Test https://github.com/boostorg/test cpputest https://github.com/cpputest/cpputest doctest https://github.com/onqtam/doctest kmtest https://github.com/SergiusTheBest/kmtest trompeloeil https://github.com/rollbear/trompeloeil 用例自动生成工具 RamFuzz api-sanity-checker deepstate Wings C++test 单元测试编译选项, linux g++可用的 -fno-access-control -fno-inline -Wno-pmf-conversions -Wl,--allow-multiple-definition -no-pie -fno-stack-protector -fprofile-arcs -ftest-coverage 代码覆盖率, linux g++使用方法 lcov -d build/ -z lcov -d build/ -b ../../src1 --no-external -rc lcov_branch_coverage=1 -t ut -c -o ut_1.info lcov -d build/ -b ../../src2 --no-external -rc lcov_branch_coverage=1 -t ut -c -o ut_2.info lcov -a ut_1.info -a ut_2.info -o ut.info genhtml -o report/ --prefix=`pwd` --branch-coverage --function-coverage ut.info 接口介绍 stub.h Stub stub stub.set(addr, addr_stub) stub.reset(addr) addr_pri.h Declaration: ACCESS_PRIVATE_FIELD(ClassName, TypeName, FieldName) ACCESS_PRIVATE_FUN(ClassName, TypeName, FunName) ACCESS_PRIVATE_STATIC_FIELD(ClassName, TypeName, FieldName) ACCESS_PRIVATE_STATIC_FUN(ClassName, TypeName, FunName) Use: access_private_field::ClassNameFieldName(object); access_private_static_field::ClassName::ClassNameFieldName(); call_private_fun::ClassNameFunName(object,parameters...); call_private_static_fun::ClassName::ClassNameFunName(parameters...); get_private_fun::ClassNameFunName(); get_private_static_fun::ClassName::ClassNameFunName(); addr_any.h(linux) AddrAny any //for exe AddrAny any(libname) //for lib int get_local_func_addr_symtab(std::string func_name_regex_str, std::map& result) int get_global_func_addr_symtab(std::string func_name_regex_str, std::map& result) int get_weak_func_addr_symtab(std::string func_name_regex_str, std::map& result) int get_global_func_addr_dynsym( std::string func_name_regex_str, std::map& result) int get_weak_func_addr_dynsym(std::string func_name_regex_str, std::map& result) addr_any.h(windows) AddrAny any //for all int get_func_addr(std::string func_name, std::map& result) addr_any.h(darwin) not implement 接口使用示例常规函数 //for linux and windows #include #include "stub.h" using namespace std; int foo(int a) { cout

【本文地址】

ran

ran

今日新闻

推荐新闻