Stackdb
Stackdb is a stackable, multi-target and -level source debugger and memory forensics library.
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Pages
analysis.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2012, 2013 The University of Utah
3  *
4  * This program is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU General Public License as
6  * published by the Free Software Foundation; either version 2 of
7  * the License, or (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, write to the Free Software
16  * Foundation, 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
17  */
18 
19 #ifndef __ANALYSIS_H__
20 #define __ANALYSIS_H__
21 
22 #include "alist.h"
23 #include "target_api.h"
24 
25 /*
26  * There isn't really an analysis API defined yet. At the moment, it's
27  * just enough to provide basic i/o and data APIs to the analysis XML
28  * SOAP server.
29  *
30  * Eventually, regular user programs/libs should just use the analysis
31  * API to report results, connect analyses together, or use pipes/stages
32  * to organize logic/data flow inside an analysis. An analysis is just
33  * a container that wraps some logic, provides it useful constructs
34  * (pipes/stages), and handles connecting analyses to each other and
35  * recording results in traces if desired.
36  */
37 
38 struct analysis;
39 struct analysis_desc;
40 struct analysis_spec;
41 struct analysis_datum;
44 struct analysis_param;
45 struct analysis_name_value;
46 
47 /*
48  * NB: make sure these align with TSTATUS_* !
49  */
50 typedef enum {
57 
58 #define ASTATUS_MAX ASTATUS_DONE
59 
60 extern char *ASTATUS_STRINGS[];
61 #define ASTATUS(n) (((n) <= ASTATUS_MAX) ? ASTATUS_STRINGS[(n)] : NULL)
62 
63 extern char *ANALYSIS_TMPDIR;
64 
65 void analysis_init(void);
66 void analysis_fini(void);
67 
68 /*
69  * Set the search path.
70  */
71 void analysis_set_path(const char **path);
72 void analysis_set_path_string(const char *path);
73 void analysis_set_annotation_path(const char **path);
75 void analysis_set_schema_path(const char **path);
76 void analysis_set_schema_path_string(const char *path);
77 
78 /*
79  * Get the search path.
80  */
81 char **analysis_get_path(void);
82 
83 /*
84  * Returns a full path to an analysis named @name.
85  */
86 char *analysis_find(const char *name);
87 
88 /*
89  * List analysis names as a struct array_list.
90  */
91 struct array_list *analysis_list_names(void);
92 
93 /*
94  * List analysis pathnames as a struct array_list.
95  */
97 
98 /*
99  * Load analysis metadata for a specific analysis (by dirname -- must
100  * be a dir on ANALYSIS_PATH -- set that via analysis_set_path).
101  */
102 struct analysis_desc *analysis_load(const char *name);
103 
104 /*
105  * Load analysis metadata for a specific analysis by full dirpath --
106  * must have either description.{xml,txt} in it.
107  */
108 struct analysis_desc *analysis_load_pathname(const char *path);
109 
110 /*
111  * Load analysis metadata from all analyses; returns an array_list of
112  * struct analysis_desc values.
113  */
114 struct array_list *analysis_load_all(void);
115 
116 /*
117  * Populates an evloop with any select()able file descriptors that this
118  * analysis (and any of its targets) needs monitored, and with their
119  * evloop callback functions. Since analyses might have multiple
120  * targets, etc, this is necessary.
121  *
122  * If a file descriptor closes or exhibits error conditions, the
123  * analysis's evloop callback function *must* remove the descriptor from
124  * the @evloop -- there is no mechanism for the evloop to clean up
125  * garbage.
126  */
128 
129 /*
130  * Removes the selectable file descriptors for @analysis from @analysis->evloop.
131  */
133 
134 /*
135  * Returns 1 if @evloop is already attached to @analysis; 0 if not.
136  */
138  struct evloop *evloop);
139 
140 /*
141  * Creates an analysis instance. Right now, this is just a data structure.
142  */
143 struct analysis *analysis_create(int id,struct analysis_spec *spec,
144  struct analysis_desc *desc,
145  int target_id,struct target *target);
146 
148 
150 
151 void analysis_free(struct analysis *analysis);
152 
153 void analysis_datum_free(struct analysis_datum *datum);
156 
157 /*
158  * Frees a struct analysis_desc.
159  */
161 
162 /*
163  * Frees a struct analysis_spec.
164  */
166 
167 /*
168  * Frees a struct analysis_param.
169  */
170 void analysis_param_free(struct analysis_param *param);
171 
172 /*
173  * Creates a simple analysis_datum.
174  */
176  int id,char *name,int type,
177  char *value,char *msg,
178  int no_copy);
179 /*
180  * Adds a simple, untyped string/string key/value pair to a datum.
181  */
183  char *name,char *value,
184  int no_copy);
185 /*
186  * Adds a typed key/value pair to a datum. Will change...
187  */
189  char *name,void *value,int len,int datatype_id,
190  int no_copy);
191 /*
192  * Reports to stdout as text; the analysis controller as XML; or both.
193  */
194 int analysis_datum_report(struct analysis *analysis,struct analysis_datum *datum);
195 
196 /*
197  * Creates a new analysis and writes it into the filesystem. Will change...
198  */
199 struct analysis *analysis_create_from_memory(char *name,char *driver_bytes,
200  char *input_bytes,
201  struct array_list *file_names,
202  struct array_list *file_bytes);
203 
204 /*
205  * Analysis instances serve multiple purposes. First, they are used
206  * internally by analysis programs/libraries so that the analysis API
207  * can be used by them to report analysis data, annotate traces,
208  * coordinate/control, etc.
209  *
210  * Second, they are used by whatever is launching the analysis for
211  * bookkeeping/monitoring.
212  */
213 struct analysis {
214  int id;
215 
216  char *tmpdir;
217 
220 
222 
223  /*
224  * The target ID that this analysis is analyzing.
225  *
226  * XXX: in future, support multiple targets if desireable.
227  */
229 
230  /*
231  * These are only valid in the process that instantiated the target,
232  * obviously.
233  */
234  struct target *target;
235  struct target *overlay_target;
236 
237  /*
238  * This might be valid even if @target is not; can be convenient to
239  * keep around.
240  */
242  struct target_spec *overlay_target_spec;
243 
244  char *stdout_buf;
247 
250 };
251 
252 /*
253  * A description of an analysis.
254  */
256  char *name;
257  char *description;
258  char *author;
260 
261  char *binary;
262 
263  uint32_t requires_write:1,
270 
271  /*
272  * Hash of name/long_name to struct analysis_param. Params always
273  * have short names, so the struct param *s in the _long hashtables
274  * are just dups of the ones in the non-long hashtables. Just that
275  * way for easier lookup.
276  */
277  GHashTable *in_params;
278  GHashTable *in_params_long;
279  GHashTable *out_params;
280  GHashTable *out_params_long;
281 
282  time_t mtime;
283 };
284 
285 /*
286  * A configuration of an analysis_desc; will result in an analysis.
287  */
289  char *name;
290 
292 
293  char *stdin_bytes;
295 
296  uint32_t log_stdout:1,
297  log_stderr:1,
301  kill_on_close:1;
302 
303  /*
304  * If kill_on_close, call kill() during close() with this signal.
305  */
307 
308  /* array_list of struct analysis_name_value */
310 
311  char *infile;
312  char *outfile;
313  char *errfile;
314 };
315 
317  uint8_t is_command_line:1,
319  char *name;
320  char *long_name;
321  char *description;
323 };
324 
326  char *name;
327  char *value;
328 };
329 
331  uint32_t is_simple:1,
332  is_typed:1,
333  is_custom:1,
334 
335  is_event:1,
336  is_marker:1,
337  is_discovery:1,
338  is_result:1;
339 
340  int id;
341  char *name;
342  int type;
343 
344  unsigned long tsc;
345  unsigned long time;
346  unsigned long counter;
347 
348  char *value;
349  char *msg;
350 
351  union {
352  /* Valid for is_simple/is_typed */
354  /* Valid for is_custom */
355  char *custom;
356  };
357 };
358 
360  char *name;
361  void *value;
362 };
363 
366  char *name;
367  void *value;
368 };
369 
370 #endif /* __ANALYSIS_H__ */
uint32_t is_event
Definition: analysis.h:331
uint32_t is_typed
Definition: analysis.h:331
void analysis_desc_free(struct analysis_desc *desc)
Definition: analysis.c:594
char * errfile
Definition: analysis.h:313
struct target_spec * target_spec
Definition: analysis.h:241
void analysis_set_path(const char **path)
Definition: analysis.c:714
uint32_t log_stderr
Definition: analysis.h:296
struct array_list * analysis_load_all(void)
Definition: analysis.c:331
void analysis_param_free(struct analysis_param *param)
Definition: analysis.c:650
char * binary
Definition: analysis.h:261
char * name
Definition: analysis.h:341
int stdout_buf_len
Definition: analysis.h:246
GHashTable * in_params_long
Definition: analysis.h:278
uint32_t reports_intermediate_results
Definition: analysis.h:263
void analysis_set_annotation_path_string(const char *path)
Definition: analysis.c:760
char ** analysis_get_path(void)
Definition: analysis.c:663
void analysis_fini(void)
Definition: analysis.c:81
struct array_list * results
Definition: analysis.h:248
uint32_t reports_final_results
Definition: analysis.h:263
analysis_status_t
Definition: analysis.h:50
void analysis_datum_simple_value_free(struct analysis_datum_simple_value *v)
Definition: analysis.c:505
struct target_spec * overlay_target_spec
Definition: analysis.h:242
char * name
Definition: analysis.h:256
unsigned long tsc
Definition: analysis.h:344
char * path
void analysis_set_status(struct analysis *analysis, analysis_status_t status)
Definition: analysis.c:521
int analysis_detach_evloop(struct analysis *analysis)
Definition: analysis.c:381
void analysis_datum_free(struct analysis_datum *datum)
Definition: analysis.c:479
unsigned long counter
Definition: analysis.h:346
int analysis_id
Definition: analysis.h:291
void analysis_init(void)
Definition: analysis.c:67
char * tmpdir
Definition: analysis.h:216
struct analysis * analysis_create_from_memory(char *name, char *driver_bytes, char *input_bytes, struct array_list *file_names, struct array_list *file_bytes)
char * default_value
Definition: analysis.h:322
char * author
Definition: analysis.h:258
int target_id
Definition: analysis.h:228
int stdin_bytes_len
Definition: analysis.h:294
int analysis_datum_add_typed_value(struct analysis_datum *datum, char *name, void *value, int len, int datatype_id, int no_copy)
Definition: analysis.c:456
Definition: evloop.h:66
void analysis_set_schema_path(const char **path)
Definition: analysis.c:770
struct analysis_desc * desc
Definition: analysis.h:219
char * outfile
Definition: analysis.h:312
uint32_t is_simple
Definition: analysis.h:331
struct target * target
Definition: analysis.h:234
char * ANALYSIS_TMPDIR
Definition: analysis.c:55
analysis_status_t status
Definition: analysis.h:221
struct analysis_datum * analysis_create_simple_datum(struct analysis *analysis, int id, char *name, int type, char *value, char *msg, int no_copy)
Definition: analysis.c:407
int id
Definition: analysis.h:214
struct analysis_spec * spec
Definition: analysis.h:218
uint32_t supports_external_control
Definition: analysis.h:263
char * infile
Definition: analysis.h:311
void analysis_datum_typed_value_free(struct analysis_datum_typed_value *v)
Definition: analysis.c:513
void analysis_set_schema_path_string(const char *path)
Definition: analysis.c:788
uint32_t autoparse_simple_data
Definition: analysis.h:296
int stdout_buf_alen
Definition: analysis.h:245
char * value
Definition: analysis.h:348
char * author_contact
Definition: analysis.h:259
struct analysis_desc * analysis_load(const char *name)
Definition: analysis.c:239
int analysis_datum_add_simple_value(struct analysis_datum *datum, char *name, char *value, int no_copy)
Definition: analysis.c:436
uint32_t is_marker
Definition: analysis.h:331
int len
Definition: dumptarget.c:52
int kill_on_close_sig
Definition: analysis.h:306
uint32_t is_result
Definition: analysis.h:331
char * long_name
Definition: analysis.h:320
void analysis_set_path_string(const char *path)
Definition: analysis.c:732
char * stdout_buf
Definition: analysis.h:244
uint32_t generates_annotations
Definition: analysis.h:263
uint32_t kill_on_close
Definition: analysis.h:296
time_t mtime
Definition: analysis.h:282
char * stdin_bytes
Definition: analysis.h:293
uint32_t supports_autoparse_simple_results
Definition: analysis.h:263
struct array_list * analysis_list_pathnames(void)
Definition: analysis.c:112
uint32_t is_custom
Definition: analysis.h:331
struct target * overlay_target
Definition: analysis.h:235
uint32_t requires_control
Definition: analysis.h:263
int analysis_datum_report(struct analysis *analysis, struct analysis_datum *datum)
uint8_t is_command_line_switched
Definition: analysis.h:317
char * name
Definition: analysis.h:319
struct analysis_desc * analysis_load_pathname(const char *path)
Definition: analysis.c:269
uint32_t requires_write
Definition: analysis.h:263
char * description
Definition: analysis.h:257
void analysis_set_annotation_path(const char **path)
Definition: analysis.c:742
GHashTable * out_params_long
Definition: analysis.h:280
struct analysis * analysis_create(int id, struct analysis_spec *spec, struct analysis_desc *desc, int target_id, struct target *target)
Definition: analysis.c:390
void analysis_spec_free(struct analysis_spec *spec)
Definition: analysis.c:630
char * ASTATUS_STRINGS[]
Definition: analysis.c:801
unsigned long time
Definition: analysis.h:345
struct array_list * values
Definition: analysis.h:353
uint8_t is_command_line
Definition: analysis.h:317
int target_id(struct target *target)
Definition: target_api.c:509
int result_idx
Definition: analysis.h:249
int analysis_attach_evloop(struct analysis *analysis, struct evloop *evloop)
Definition: analysis.c:377
GHashTable * in_params
Definition: analysis.h:277
char * custom
Definition: analysis.h:355
char * msg
Definition: analysis.h:349
uint32_t report_stderr_intermediate
Definition: analysis.h:296
int analysis_is_evloop_attached(struct analysis *analysis, struct evloop *evloop)
Definition: analysis.c:385
char * description
Definition: analysis.h:321
analysis_status_t analysis_close(struct analysis *analysis)
Definition: analysis.c:527
uint32_t report_stdout_intermediate
Definition: analysis.h:296
struct array_list * in_params
Definition: analysis.h:309
char * name
Definition: analysis.h:289
uint32_t is_discovery
Definition: analysis.h:331
char * analysis_find(const char *name)
Definition: analysis.c:150
uint32_t log_stdout
Definition: analysis.h:296
void analysis_free(struct analysis *analysis)
Definition: analysis.c:564
struct array_list * analysis_list_names(void)
Definition: analysis.c:90
GHashTable * out_params
Definition: analysis.h:279