1. Step 1
Generate *.call files.
usage: gen_calls.pl <filename>
------------------------------------------
example
------------------------------------------
matter:~/tb/t2# ls -la the-binary
-rwxr-xr-x 1 root root 205108 May 24 08:01 the-binary
matter:~/tb/t2# gen_calls.pl the-binary
objdump: the-binary: no symbols
objdump: the-binary: no symbols
writing 0x8048090.call
writing 0x8048134.call
writing 0x8048ecc.call
writing 0x8048f94.call
writing 0x8049138.call
writing 0x8049174.call
writing 0x8049564.call
writing 0x80499f4.call
writing 0x8049d40.call
writing 0x804a194.call
writing 0x804a1e8.call
writing 0x804a2a8.call
writing 0x804a48c.call
writing 0x804a4f4.call
writing 0x804a580.call
writing 0x804a5cc.call
writing 0x804a9d8.call
...
2. Step 2
Generate Data File
usage: gen_data.sh <filename>
------------------------------------------
example
------------------------------------------
Output file is <filename>.data and it contains the constant string variables' value.
matter:~/tb/t2# sh gen_data.sh the-binary
<It takes some time>
matter:~/tb/t2# ls -la the-binary.data
-rw-r--r-- 1 root root 20830 May 24 17:19 the-binary.data
matter:~/tb/t2# more the-binary.data
...
0x80675d0: "è;\013þÿÂ"
0x80675d8: "[mingetty]"
0x80675dc: "getty]"
0x80675e0: "y]"
0x80675e2: ""
0x80675e3: "/"
0x80675e5: ""
0x80675e6: "/tmp/.hj237349"
0x80675f5: "/bin/csh -f -c \"%s\" 1> %s 2>&1"
0x8067614: "rb"
0x8067617: "TfOjG"
0x806761d: "ÿû\001"
0x8067621: "/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin/:."
0x8067651: "PATH"
...
3. Step 3
Generate *.html files.
usage: format_calls.pl -d the-binary.data *.call
------------------------------------------
example
------------------------------------------
Format *.call file to convert it to html file.
With -d option you can define the .data file.
matter:~/tb/t2# format_calls.pl -d the-binary.data *.call
Processing 0x8048090.call
Processing 0x8048134.call
Processing 0x8048ecc.call
Processing 0x8048f94.call
Processing 0x8049138.call
Processing 0x8049174.call
Processing 0x8049564.call
Processing 0x80499f4.call
Processing 0x8049d40.call
Processing 0x804a194.call
Processing 0x804a1e8.call
Processing 0x804a2a8.call
Processing 0x804a48c.call
Processing 0x804a4f4.call
Processing 0x804a580.call
Processing 0x804a5cc.call
Processing 0x804a9d8.call
...
4. Step 4
Setup for use with web server.
To use with web server and *.cgi files provided with the package, you must setup the data directory with proper permission.
Copy show_call.pl and process_sub_list.pl to web server's cgi directory. And give proper permission as a cgi.
In our example, we use ~/tb/t2 as the web directory and the *.html files are stored here. so the ~/tb/t2 directory must be readable to the web server. And because process_sub_list.pl provided with our package uses the data directory as storage base, web server must have writable access to the data directory.
------------------------------------------
example
------------------------------------------
matter:~/tb/t2# ps aux|grep apa
root 713 0.0 0.2 2520 524 ? S May20 0:36 /usr/sbin/apache
www-data 13844 0.0 0.4 2636 1208 ? S 07:12 0:00 /usr/sbin/apache
www-data 16436 0.0 0.4 2632 1200 ? S 09:49 0:00 /usr/sbin/apache
www-data 22056 0.0 0.4 2632 1200 ? S 16:19 0:00 /usr/sbin/apache
www-data 22063 0.0 0.4 2632 1200 ? S 16:25 0:00 /usr/sbin/apache
www-data 22387 0.0 0.4 2568 1120 ? S 16:47 0:00 /usr/sbin/apache
www-data 23103 0.0 0.4 2632 1188 ? S 17:54 0:00 /usr/sbin/apache
www-data 23124 0.0 0.3 2532 860 ? S 18:00 0:00 /usr/sbin/apache
root 23134 0.0 0.1 1108 408 ttypd S 18:01 0:00 grep apa
matter:~/tb/t2# chown www-data .
matter:~/tb/t2# chown 750 .
5. Step 5
Generate call tree.
usage: gen_call_tree.pl -m <max depth> <filename>
max depth: defines the depth of recursion
filename: call file name to start the generation of call tree.
------------------------------------------
example
------------------------------------------
matter:~/tb/t2# gen_call_tree.pl -m 3 0x8048090.call
loop found [0x80559a0]
loop found [0x80559a0]
matter:~/tb/t2# ls -la 0x8048090.tree.html
-rw-r--r-- 1 root root 377216 May 24 17:34 0x8048090.tree.html
You can view this call tree with your favorite web browser.
A line is consists of two part delimited by '/' character. The first one is the address of the place where call function happens and the second one is the call itself.
If you click the first part, you can view the part of the place where the calling of the call happens.
If you click the second part, you can view the call itself.
6. Step 6
Edit the pages.
1. Go to a call
With the call tree page, find an interesting call and go to the edit page.
This is the edit page for the link.
2. Edit a variable
Find some interesting variable and edit it.
Click the link of the interesting variable.
Edit page pops up.
You can input any string to the <value>.
Press OK for successful edit.
You can reload the call page to view the result.
3. Edit a variable with range.
Sometime you need to name a register, which has no fixed role through the code, but in some range the register can mean something. In that case, you can name the register for a range.
Click the link for the register.
Edit page pops up with from: to: value is assigned.
Two value is identical for default. The value is assigned with the value of address where you click the link for the register.
Change to: address to where you want to define the register and set value for the register.
Reload the page to view the result.
4. Comment a location
Find an interesting location. And you can add some comments to there.
Click the address link.
The edit page pops up.
You can add some comments on it and can make a name for the address.
Reload the call page to view the result.
5. Link to a call
You can click the call operand link to view the call function's code.
Click the link.
You can view the call page. The system call function of linux system(which uses int $0x80 is auto interpreted.)
6. Name a call
You can give a name to a call by assigning value to the first address of the call.
Click the first address of the call.
Give value and Comments and press OK.
Reload the call page to view the result.
Reload the caller of call page to view the result.
7. Call Stack
The push command is not shown directly to the call page. This is summarized below the call. The call and the arguments are in green box. You can view the push commands by clicking the "call" link.
With this functionality you can guess some call's function with ease. The constant string will be displayed automatically.
8. Reflect the changes to the call tree file
To reflect in change of call name, you must regenerate the call tree file with gen_call_tree.pl command. This is explained previously.