#!/usr/bin/lunete -c
#
# lunete - the Ultimate Library-Calls Tracing System
# --------------------------------------------------
# (c) 1998 Michal Zalewski <lcamtuf@ids.pl>
#
# * Sample configuration file.
#
# The 'lunete' and related utilities are free software; you can
# redistribute it and/or modify it under the terms of the GNU Library
# General Public License as published by the Free Software Foundation;
# either version 2 of the License, or (at your option) any later version.

# -----------------------------------------------------------------------

# Verbose mode. If 'On', additional debugging output will be included.
# It could be altered with '-v' (on) and '-q' (off) command-line switches.

Verbose		On

# This is where tracing output should be written (by default to standard
# error stream). It's similar to command-line option '-o filename'.

# DebugFile	lunete.out

# This option enables auto-detection of libraries. It could be turned
# on (-a) or off (-A). If auto-detection is off, you have to specify
# libraries by-hand from command-line using -i option!

AutoDetect	On

# With this option, debugger will try to determine size of allocated
# memory passed as pointer to functions. Note: this function needs
# malloc/calloc/realloc/free/bzero/memset functions to be traced for
# full functionality (eg. in 'overflow' profile).

MallocSize	On

# Max. length of string to display - similar to -s option...

StringLen	40

# Max. length of string or struct array - similar to -t option...

ArrayLen	50

# Default tracing profile - (overriden with -p option)...

DefaultProf	default

# Libraries to trace. The format of following data is:
#
# TraceLibrary library_name[*]
# *	return_type	[+][@]function_name	[*]param1_type	...	| prof1 prof2
# *	...
# EndLibrary
#
# Where library_name is name of dynamically linked library, which should
# be traced. Libraries should be auto-detected, but you can include (-i)
# or exclude (-x) them from command-line. You could use wildcards here, eg:
# libc* or libncurses* (for autodetection).
#
# Keywords after '|' are used to describe tracing profiles in which this
# function should be traced. Warning: function with no assigned profile name
# will be simply NOT traced at all.
# 
# Currently supported return value/parameter types:
#
#	d	- signed decimal
#	u	- unsigned decimal
#	o	- octal
#	h	- hexadecimal
#	f	- float
#	s	- ASCIZ string
#	S#	- string, length specified by param # (0 = return value)
#	A	- NULL-terminated array of strings (for execvp etc)
#	c	- single char
#	p	- unspecified pointer (optionally with malloc_usable_size)
#	qxxx	- hexdump: xxx bytes of pointed memory
#	!text	- ignored (= replace with '<text>')
#	v	- void (return value only)
#	E	- integer with std error message support
#	Fxxx    - converted decimal (xxx = conversion table)
#	V#	- v*printf-alike format string (# - va_list argument)
#	Y#	- v*scanf-alike format string (# - va_list argument)
#	Mxxx	- printf-alike format string ('...' assumed, va_list handler)
#	Nxxx	- scanf-alike format string ('...' assumed, va_list handler)
#	Txxx	- pointer structural object 'xxx' (see below)
#	R#xxx	- pointer to multiple structural objects 'xxx'
#                 (# - parameter holding number of objects)
#	P#xxx	- pointer to array of pointers to structural object 'xxx'
#                 (# - param holding number of objects / N for null-terminated)
#
# Special parameter types for MallocSize feature:
#
#	+#	- decimal, treated as 'buffer size' parameter
#                 (# - 'pointer to buffer' argument)
#
# BIG FAT NOTICE: for functions with format string and '...' parameter,
# use Mxxx as format string type; for sprintf xxx=vsprintf, scanf - vscanf,
# etc. Omit '...', as it's assumed.
#
# BIG FAT NOTICE #2: very often, you don't have to intercept every
# variation of function - for example, vsprintf is always called from
# sprintf, execve is called from every exec* function... And so on.
#
# Currently supported built-in conversion tables for F directive
# (you can add your own in /usr/lib/lunete/convtables):
#
#	open	- open() flags
#	ioctl	- ioctl() requests
#	fcntl	- fcntl() requests
#
# If function name is prefixed with '+', it will be called before displaying
# parameters (useful eg. for read). Simple (non-structural) parameters can
# be prefixed with (almost) any amount of * (ptr).
# Functions prefixed with '@' are traced 'deeply' - trace includes functions
# called from this function.

#	ret	name		arg1		arg2		arg3		arg4

TraceLibrary	libc.so*
*	d	getuid											| default full
*	d	geteuid											| default full
*	d	getegid											| default full
*	d	getgid											| default full
*	d	setuid		d											| default full
*	d	setgid		d									| default full
*	d	setegid		d									| default full
*	d	seteuid		d									| default full
*	d	setreuid	d		d										| default full
*	E	open		s		Fopen		o					| default full
*	p	fopen		s		s							| default full
*	E	fclose		p									| default full
*	v	perror		s									| default full
*	E	ioctl		d		Fioctl		h					| default full
*	d	printf		Mvprintf								| full
*	d	fprintf		Tfile		Mvfprintf						| full
*	d	sprintf		p		Mvsprintf						| full overflow
*	d	snprintf	p		+1		Mvsnprintf				| full overflow
*	d	vprintf		V2		!va_list						| default full
*	d	vfprintf	Tfile		V3		!va_list				| default full
*	d	vsprintf	p		V3		!va_list				| default full overflow
*	d	vsnprintf	p		+1		V4		!va_list		| default full overflow
*	E	execve		s		A		A					| default full
*	E	close		d									| default full
*	E	+read		d		S0		d					| default full overflow
*	E	+scanf		Nvscanf									| default full overflow
*	E	+sscanf		p		Nvsscanf						| default full overflow
*	E	+fscanf		Tfile		Nvfscanf						| default full overflow
*	E	+vscanf		Y2		!va_list						| default full overflow
*	E	+vsscanf	p		Y3		!va_list				| default full overflow
*	E	+vfscanf	Tfile		Y3		!va_list				| default full overflow
*	E	write		d		S3		d					| default full
*	E	puts		s									| default full
*	E	putc		c		Tfile							| default full
*	E	getc		Tfile									| default full
*	E	getchar											| default full
*	E	ungetc		c		Tfile							| default full
*	E	fputc		c		Tfile							| default full
*	E	putchar		c									| default full
*	E	fputs		s		Tfile							| default full
*	d	strlen		s									| full overflow
*	p	strcpy		p		s							| full overflow
*	p	strncpy		p		s		d					| default full overflow
*	s	+getenv		s									| default full overflow
*	E	access		s		Faccess							| default full
*	E	acct		s									| default full
*	E	adjtimex	p									| default full
*	d	alarm		d									| default full
*	E	brk		p									| default full
*	v	sbrk		d									| default full
*	E	chdir		s									| default full
*	E	fchdir		d									| default full
*	E	create_module	s		d							| default full
*	E	delete_module	s									| default full
*	E	chmod		s		o							| default full
*	E	fchmod		d		o							| default full
*	E	chown		s		d		d					| default full
*	E	fchown		d		d		d					| default full
*	E	chroot		s									| default full
*	E	clone		p		h							| default full
*	E	dup		d									| default full
*	E	dup2		d		d							| default full
*	v	exit		d									| default full
*	v	_exit		d									| default full
*	E	fcntl		d		Ffcntl		h					| default full
*	E	flock		d		Fflock							| default full
*	d	fork											| default full
*	E	fsync		d									| default full
*	E	fdatasync	d									| default full
*	E	ftruncate	d		d							| default full
*	d      +get_kernel_syms	R0kernel_sym								| default full
*	E	+getdomainname	s		d							| default full
*	E	setdomainname	s		d							| default full
*	E	getdtablesize										| default full
*	Tdirent	+readdir	p									| default full
*	p	opendir		s									| default full
*	E	@closedir	p									| default full
*	v	rewinddir	p									| default full
*	v	seekdir		p		d							| default full
*	d	telldir		p									| default full
*	d	@+scandir	s		P0dirent	p		p			| default full
*	v	bzero		p		+1							| full overflow
*	p	memset		p		c		+1					| full overflow
*	p	calloc		d		d							| full overflow
*	p	malloc		d									| full overflow
*	v	free		p									| full overflow
*	p	realloc		p		d							| full overflow
*	p	signal		Fsignal		p							| default full
*	s	gets		p									| default full overflow
*	s	fgets		p		+1		Tfile					| default full overflow
*	p	+mmap		p		+0	Fmmap.prot	Fmmap.flag	d	d	| default full overflow
*	E       munmap		p		d							| default full overflow
#*	d	strcmp		s		s							| full
*	d	strncmp		s		s		d					| full
*	d	mprotect	p		+1		Fmmap.prot				| default full overflow
*	d	personality	d									| default full
*	d	setenv		s		s		d					| default full overflow
*	d	putenv		s									| default full overflow
*	d	unsetenv	s									| default full overflow

# Often used, for some reason...

*	E	_IO_putc	c		Tfile							| full
*	c	_IO_getc	Tfile									| full

EndLibrary
	
TraceLibrary	libncurses*
*	!	noraw											| default full
EndLibrary

TraceLibrary	libm*
*	f	sin	f										| default full
*	f	cos	f										| default full
EndLibrary

# Definitions for structural objects. Format:
#
# DefineStruct struct_name {
#   ...c-alike fields...
# }
#
# In { ... } block, you can use any C tricks - in fact, this
# code is parsed as-is to c compiler ;> Also, you could
# use other, previously defined structs in this definition,
# available as lw_struct_XXX, where XXX is choosen struct_name.

DefineStruct file {
  int dummy[14];	// It's all we need to know ;>
  int fileno;
}

DefineStruct kernel_sym {
  unsigned long value;
  char name[60];
}

DefineStruct dirent {
  int ino,ofs;
  char dummy[3];
  char name[256];
}

# Display handlers for structural objects. Format:
#
# Handle{Struct|Multi} struct_name format_string, p.fields, ...
#
# Where struct_name is name declared in DefineStruct block,
# format_string is similar to printf format. Next parametrs
# are passed to format. Ptr to structure is available as 'p',
# so to read field 'field1', you have to use 'p->field1'.
# Any c-alike tricks are allowed (in fact, format string and
# parameters are passed as-is to C compiler) ;>
#
# HandleStruct is used for Txxx parameters. HandleMulti is
# used for R#xxx parameters.
#
# Please use XPND(str) to pass strings...
      
HandleStruct  file		"{fileno=%d}", p->fileno
HandleMulti   kernel_sym	"<name=%s addr=0x%x>", XPND(p->name), p->value
HandleStruct  dirent		"{name=%s inode=0x%x ofs=%u}", XPND(p->name), p->ino, p->ofs
HandlePointer dirent		"{name=%s inode=0x%x ofs=%u}", XPND(p->name), p->ino, p->ofs
