teambi0s / secretary Goto Github PK

Basic ptrace patcher

• Find out all the ptrace calls in a binary (with TRACE_ME)
• Write a simple test program
• Find ideal ways to patch the binary
• Write a wrapper to execute and check again
• Patch the binary (See if it's possible to permanently patch with PIN)

This tool must be able to

• Dump switch cases
• Figure out how many times each switch case is hit when run with a given input

Function call tracer

• Iterate through the entire program and get details on all the function calls
• Get function arguments for each call
• Sort whether each call is a library call or a user defined call
• Store addresses of each function call
• Store statistics of each function call (ie how many times is it called)
• Sort function calls - by callee functions
• Mark out common arguments for multiple functions - (It can help us figure out some pattern)

Basic syscall tracer module for our project.

• Hook syscalls and log them
• Store the address of the syscall
• Get the arguments (hopefully by getting an sense of the no of arguments for each syscall)
• Find the address of the function if available
• Sort syscalls - by the calling function