1 : // Copyright 2012 Google Inc. All Rights Reserved.
2 : //
3 : // Licensed under the Apache License, Version 2.0 (the "License");
4 : // you may not use this file except in compliance with the License.
5 : // You may obtain a copy of the License at
6 : //
7 : // http://www.apache.org/licenses/LICENSE-2.0
8 : //
9 : // Unless required by applicable law or agreed to in writing, software
10 : // distributed under the License is distributed on an "AS IS" BASIS,
11 : // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 : // See the License for the specific language governing permissions and
13 : // limitations under the License.
14 : //
15 : // This defines the playback class. The class encapsulates the workflow
16 : // associated with parsing a trace file with respect to an original module.
17 : // It takes care of validating that all data sources match (trace files,
18 : // instrumented module, original module), decomposing the original module,
19 : // and provides functionality for mapping trace events back to
20 : // addresses/blocks in the original module.
21 : //
22 : // Playback playback(module_path, instrumented_path, trace_files);
23 : // playback.Init(pe_file, image, parser)
24 : // playback.ConsumeCallTraceEvents()
25 :
26 : #ifndef SYZYGY_PLAYBACK_PLAYBACK_H_
27 : #define SYZYGY_PLAYBACK_PLAYBACK_H_
28 :
29 : #include <windows.h>
30 :
31 : #include "base/win/event_trace_consumer.h"
32 : #include "syzygy/block_graph/block_graph.h"
33 : #include "syzygy/pdb/omap.h"
34 : #include "syzygy/pe/decomposer.h"
35 : #include "syzygy/pe/image_layout.h"
36 : #include "syzygy/trace/parse/parser.h"
37 :
38 : namespace playback {
39 :
40 : class Playback {
41 : public:
42 : typedef block_graph::BlockGraph BlockGraph;
43 : typedef pe::ImageLayout ImageLayout;
44 : typedef pe::PEFile PEFile;
45 : typedef std::vector<base::FilePath> TraceFileList;
46 : typedef trace::parser::ModuleInformation ModuleInformation;
47 : typedef trace::parser::Parser Parser;
48 :
49 : // Construct a new Playback instance.
50 : // @param module_path The path of the module dll.
51 : // @param instrumented_path The path of the instrumented dll.
52 : // @param trace_files A list of the trace files to analyze.
53 : Playback(const base::FilePath& module_path,
54 : const base::FilePath& instrumented_path,
55 : const TraceFileList& trace_files);
56 :
57 : ~Playback();
58 :
59 : // Initializes the playback class and decomposes the given image.
60 : // This function is virtual to aid testing of classes that may own Playback.
61 : // @param pe_file The PE file to be initialized.
62 : // @param image The image that will receive the decomposed module.
63 : // @param parser The parser to be used.
64 : // @returns true on success, false on failure.
65 : virtual bool Init(PEFile* pe_file, ImageLayout* image, Parser* parser);
66 :
67 : // @returns true if the given ModuleInformation matches the instrumented
68 : // module signature, false otherwise.
69 : bool MatchesInstrumentedModuleSignature(
70 : const ModuleInformation& module_info) const;
71 :
72 : // Gets a code block from our image from its function address and process id.
73 : // @param process_id The process id of the module where the function resides.
74 : // @param function The relative address of the function we are searching.
75 : // @param error Will be set to true if an error occurs.
76 : // @returns The code block @p function and @p process_id refer to, or NULL if
77 : // no such block can be found (this can occur if events for multiple
78 : // instrumented modules occur in the same trace file, and we are
79 : // processing an event from a module that is not our module of interest.)
80 : // If an error occurs this will also return NULL.
81 : const BlockGraph::Block* FindFunctionBlock(DWORD process_id,
82 : FuncAddr function,
83 : bool* error);
84 :
85 : // @name Accessors
86 : // @{
87 E : const PEFile* pe_file() const { return pe_file_; }
88 E : const ImageLayout* image() const { return image_; }
89 E : const TraceFileList& trace_files() const { return trace_files_; }
90 E : const std::vector<OMAP>& omap_to() const { return omap_to_; }
91 E : const std::vector<OMAP>& omap_from() const { return omap_from_; }
92 E : const PEFile::Signature& instr_signature() const { return instr_signature_; }
93 : // @}
94 :
95 : protected:
96 : typedef pe::Decomposer Decomposer;
97 : typedef TraceFileList::iterator TraceFileIter;
98 : typedef uint64 AbsoluteAddress64;
99 : typedef uint64 Size64;
100 :
101 : // Loads information from the instrumented and original modules.
102 : bool LoadModuleInformation();
103 : // Initializes the parser.
104 : bool InitializeParser();
105 : // Loads OMAP information for the instrumented module.
106 : bool LoadInstrumentedOmap();
107 : // Decomposes the original image.
108 : bool DecomposeImage();
109 :
110 : // Parses the instrumented DLL headers, validating that it was produced
111 : // by a compatible version of the toolchain, and extracting signature
112 : // information and metadata.
113 : // @returns true on success, false otherwise.
114 : bool ValidateInstrumentedModuleAndParseSignature(
115 : PEFile::Signature* orig_signature);
116 :
117 : // The paths of the test module, instrumented module, and trace files.
118 : base::FilePath module_path_;
119 : base::FilePath instrumented_path_;
120 : TraceFileList trace_files_;
121 :
122 : // This is a copy of the parser used to decompose the image, which needs
123 : // to be initialized with a ParseEventHandler before being used.
124 : Parser* parser_;
125 :
126 : // A pointer to the PE file info for the module we're analyzing. This
127 : // is actually a pointer to a part of the output structure, but several
128 : // internals make use of it during processing.
129 : PEFile* pe_file_;
130 :
131 : // The decomposed image of the module we're analyzing. This is actually
132 : // a pointer to an image in the output structure, but several internals
133 : // make use of it during processing.
134 : ImageLayout* image_;
135 :
136 : // The OMAP info from the instrumented module's PDB. Used for mapping
137 : // addresses back and forth between the instrumented DLL and the original DLL.
138 : std::vector<OMAP> omap_to_;
139 : std::vector<OMAP> omap_from_;
140 :
141 : // Signature of the instrumented DLL. Used for filtering call-trace events.
142 : PEFile::Signature instr_signature_;
143 : };
144 :
145 : } // namespace playback
146 :
147 : #endif // SYZYGY_PLAYBACK_PLAYBACK_H_
|