-
Notifications
You must be signed in to change notification settings - Fork 141
/
TraceLog.h
61 lines (50 loc) · 1.9 KB
/
TraceLog.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
#pragma once
#include "pin.H"
#include <iostream>
#include <fstream>
class TraceLog
{
public:
static const char DELIMITER = ';';
TraceLog()
{
}
~TraceLog()
{
if (m_traceFile.is_open()) {
m_traceFile.close();
}
}
void init(std::string fileName, bool is_short)
{
if (fileName.empty()) fileName = "output.txt";
m_logFileName = fileName;
m_shortLog = is_short;
createFile();
}
void logCall(const ADDRINT prevModuleBase, const ADDRINT prevAddr, bool isRVA, const std::string &module, const std::string &func = "");
void logCall(const ADDRINT prevBase, const ADDRINT prevAddr, const ADDRINT calledPageBase, const ADDRINT callAddr);
void logCallRet(const ADDRINT prevBase, const ADDRINT prevAddr, const ADDRINT retPageBase, const ADDRINT retAddr, const std::string &module, const std::string &func);
void logSectionChange(const ADDRINT addr, std::string §ionName);
void logNewSectionCalled(const ADDRINT addFrom, const std::string &prevSection, const std::string &currSection);
void logIndirectCall(const ADDRINT prevModuleBase, const ADDRINT prevAddr, bool isRVA, const ADDRINT calledBase, const ADDRINT callRVA);
void logInstruction(const ADDRINT base, const ADDRINT rva, const std::string& mnem, const ADDRINT param);
void logInstruction(const ADDRINT base, const ADDRINT rva, const std::string& mnem);
void logSyscall(const ADDRINT base, const ADDRINT rva, const ADDRINT param, const std::string &funcName);
void logLine(const std::string &str);
protected:
bool createFile()
{
if (m_traceFile.is_open()) {
return true;
}
m_traceFile.open(m_logFileName.c_str());
if (m_traceFile.is_open()) {
return true;
}
return false;
}
std::string m_logFileName;
std::ofstream m_traceFile;
bool m_shortLog;
};