// File: overfl0[P]iojack/iojack.cpp
// Function: main
int main(int argc, char *argv[])
{
    pthread_t pollStdinThread;
    setSignalHandlers();
    initSyscallHooks();

    int firstPid = getArgs(argc, argv);

    printf("Attaching to pid: %d\n", firstPid);
    if(ptrace(PTRACE_ATTACH, firstPid, NULL, NULL) == -1)
    {
        if(errno == EPERM)
        {
            pexit("Could not attach to process due to lack of permissions\n"
                  "If you're on ubuntu, you may try the following as root:\n"
                  "echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope\n");
        }
        else
            perrorexit("PTRACE_ATTACH");
    }

    int status;
    // Should be checked
    firstPid = wait(&status);
    if(WIFEXITED(status))
    {
        printf("Process %d exited\n", firstPid);
        return 0;
    }

    if(ptrace(PTRACE_SETOPTIONS, firstPid, NULL,
        PTRACE_O_TRACEFORK | PTRACE_O_TRACEVFORK | PTRACE_O_TRACECLONE | PTRACE_O_TRACEEXEC
        /*| PTRACE_O_TRACESYSGOOD ? */) == -1)
        perrorexit("PTRACE_SETOPTIONS");

    int retval = pthread_create(&pollStdinThread, NULL, stdinPoll, (void*)&inputBuffer);
    if(retval)
        perrorexit("Reading input thread");

    processes[firstPid] = new processInfo(firstPid);
    processes[firstPid]->guessFds();

    // We are interested only in syscalls
    processes[firstPid]->stopAtSyscall();

    unsigned char applicationSequences[] = {0x1b, 0x5b, 0x3f, 0x31, 0x68};
    if(!globalSettings.sendANSI)
        printf("%s", applicationSequences);

    //=========================================================================
    while(!processes.empty())
    {
        // Wait for a syscall to be called
        int pidReceived = wait(&status);
        if(pidReceived == -1)
        {
            perror("wait");
            continue;
        }

        // pidReceived != -1, so get full info about this process
        processes_t::iterator it = processes.find(pidReceived);
        if(it == processes.end())
        {
            // On purpose. This may be a bug that should not get unnoticed!
            //pexit("Unexpected pid %d received by wait call\n", pidReceived);

            // Too bad that this may happen on clone() and fork() calls :(
            // Ugly workaround
            // FIXME TODO FIXME TODO This is WAY too ugly to be kept unchanged
            processes[pidReceived] = new processInfo(pidReceived);
            it = processes.find(pidReceived);
            it->second->sigstopNewChild = 1;
        }
        processInfo * pi = it->second;

        if(WIFEXITED(status) || WIFSIGNALED(status))
        {
            dprintf("Process %d exited\n", pidReceived);
            processes.erase(pidReceived);

            continue;
        }

        if(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP)
        {
            dprintf("[%d] ******WIFSTOPPED!******\n", pi->pid);
            if(pi->sigstopToDetach)
            {
                // That's our chance! :)
                printf("Pid %d stopped while we wanted to quit. Trying to detach now...\n", pi->pid);
                pi->detachProcess();
                processes.erase(pidReceived);
                continue;
            }

            if(pi->sigstopToRestartSyscall)
            {
                dprintf("Restarting tracing of pid %d\n", pi->pid);
                pi->sigstopToRestartSyscall = 0;

                pi->stopAtSyscall();
                continue;
            }

            if(pi->sigstopNewChild)
            {
                pi->sigstopNewChild = 0;
                dprintf("[%d] The new child has stopped.\n", pi->pid);

                if(ptrace(PTRACE_SETOPTIONS, pi->pid, NULL,
                   PTRACE_O_TRACEFORK | PTRACE_O_TRACEVFORK | PTRACE_O_TRACECLONE | PTRACE_O_TRACEEXEC
                   /*| PTRACE_O_TRACESYSGOOD ? */) == -1)
                    perrorexit("PTRACE_SETOPTIONS");

                pi->stopAtSyscall();
                continue;
            }
        }

        // If it's not our signal, forward it to the program and continue the loop
        if(WIFSTOPPED(status) && WSTOPSIG(status) != SIGTRAP)
        {
            dprintf("Pid %d stopped with signal: %d\n", pi->pid, WSTOPSIG(status));

            pi->stopAtSyscall(WSTOPSIG(status));
            continue;
        }

        // Check if we have got a new child
        // FIXME: Find a macro that returns the event
        int event = status >> 16;
        if(event == PTRACE_EVENT_FORK || event == PTRACE_EVENT_VFORK || event == PTRACE_EVENT_CLONE)
        {
            unsigned long newPid;
            if(ptrace(PTRACE_GETEVENTMSG, pi->pid, 0, &newPid) == -1)
                perrorexit("PTRACE_GETEVENTMSG");
            printf("[%d] A new process forked/vforked/cloned: %lu\n", pi->pid, newPid);

            processInfo *newPi = new processInfo(newPid);
            newPi->sigstopNewChild = 1;
            // Copy file descriptors from the parent
            //FIXME: Race condition with pi->pid calling close() before we get here
            newPi->stdin = pi->stdin;
            newPi->stdout = pi->stdout;
            newPi->stderr = pi->stderr;
            processes[newPid] = newPi;

            pi->stopAtSyscall();

            continue;
        }
        if(event == PTRACE_EVENT_EXEC)
        {
            // TODO: We probably need to close some fds here (FD_CLOEXEC)
            dprintf("###################################################################\n");
            dprintf("Wykryto exec!\n");
            dprintf("###################################################################\n");
            pi->stopAtSyscall();

            continue;
        }

        //=Handle syscalls and registers=======================================
        struct user_regs_struct regs;
        if(ptrace((__ptrace_request)PTRACE_GETREGS, pi->pid, 0, &regs) == -1)
            perrorexit("PTRACE_GETREGS");

        int saveRegs = 0;
        processSyscall(pi, &regs, &saveRegs);
        if(saveRegs)
        {
            if(ptrace((__ptrace_request)PTRACE_SETREGS, pi->pid, 0, &regs) == -1)
                perrorexit("PTRACE_SETREGS");
        }
        //=====================================================================

        if(wantToExit && pi->inSyscall == 0 && pi->fakingSyscall != -1)
        {
            pi->detachProcess();
            processes.erase(pi->pid);
            continue;
        }

        // We are interested only in syscalls
        pi->stopAtSyscall();
    }

    wantToExit = 1;
    pthread_join(pollStdinThread, NULL);

    return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x180, %rsp            # imm = 0x180
movl $0x0, -0x4(%rbp)
movl %edi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
callq 0x2810
callq 0xc0d0
movl -0x8(%rbp), %edi
movq -0x10(%rbp), %rsi
callq 0x25a0
movl %eax, -0x1c(%rbp)
movl -0x1c(%rbp), %esi
leaq 0xb4e1(%rip), %rdi      # 0xe19d
movb $0x0, %al
callq 0x2040
movl -0x1c(%rbp), %esi
movl $0x10, %edi
xorl %eax, %eax
movl %eax, %ecx
movq %rcx, %rdx
movb $0x0, %al
callq 0x2150
cmpq $-0x1, %rax
jne 0x2d1b
callq 0x2030
cmpl $0x1, (%rax)
jne 0x2d03
jmp 0x2ceb
leaq 0xb4c1(%rip), %rdi      # 0xe1b3
movb $0x0, %al
callq 0x2040
movl $0x1, %edi
callq 0x21f0
jmp 0x2d05
leaq 0xb54c(%rip), %rdi      # 0xe258
callq 0x2140
movl $0x1, %edi
callq 0x21f0
leaq -0x20(%rbp), %rdi
callq 0x2200
movl %eax, -0x1c(%rbp)
movl -0x20(%rbp), %eax
andl $0x7f, %eax
cmpl $0x0, %eax
jne 0x2d4f
movl -0x1c(%rbp), %esi
leaq 0xb52a(%rip), %rdi      # 0xe266
movb $0x0, %al
callq 0x2040
movl $0x0, -0x4(%rbp)
jmp 0x3352
movl -0x1c(%rbp), %esi
movl $0x4200, %edi           # imm = 0x4200
xorl %eax, %eax
movl %eax, %edx
movl $0x1e, %ecx
movb $0x0, %al
callq 0x2150
cmpq $-0x1, %rax
jne 0x2d85
jmp 0x2d6f
leaq 0xb503(%rip), %rdi      # 0xe279
callq 0x2140
movl $0x1, %edi
callq 0x21f0
leaq -0x18(%rbp), %rdi
xorl %eax, %eax
movl %eax, %esi
leaq -0x524(%rip), %rdx      # 0x2870
leaq 0x134dd(%rip), %rcx     # 0x16278
callq 0x2310
movl %eax, -0x24(%rbp)
cmpl $0x0, -0x24(%rbp)
je 0x2dc1
jmp 0x2dab
leaq 0xb4d9(%rip), %rdi      # 0xe28b
callq 0x2140
movl $0x1, %edi
callq 0x21f0
movl $0x180, %edi            # imm = 0x180
callq 0x2180
movq %rax, %rdi
movq %rdi, %rax
movq %rax, -0x168(%rbp)
movl -0x1c(%rbp), %esi
callq 0x34c0
jmp 0x2de2
leaq 0x133d7(%rip), %rdi     # 0x161c0
leaq -0x1c(%rbp), %rsi
callq 0x3550
movq -0x168(%rbp), %rcx
movq %rcx, (%rax)
leaq 0x133bd(%rip), %rdi     # 0x161c0
leaq -0x1c(%rbp), %rsi
callq 0x3550
movq (%rax), %rdi
callq 0x9ed0
leaq 0x133a5(%rip), %rdi     # 0x161c0
leaq -0x1c(%rbp), %rsi
callq 0x3550
movq (%rax), %rdi
xorl %esi, %esi
callq 0x9e70
movl 0xb510(%rip), %eax      # 0xe344
movl %eax, -0x39(%rbp)
movb 0xb50b(%rip), %al       # 0xe348
movb %al, -0x35(%rbp)
cmpb $0x0, 0x13371(%rip)     # 0x161b8
jne 0x2e7f
leaq -0x39(%rbp), %rsi
leaq 0xc791(%rip), %rdi      # 0xf5e5
movb $0x0, %al
callq 0x2040
jmp 0x2e7f
movq -0x168(%rbp), %rdi
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x30(%rbp)
movl %eax, -0x34(%rbp)
movl $0x180, %esi            # imm = 0x180
callq 0x2190
jmp 0x335e
jmp 0x2e81
leaq 0x13338(%rip), %rdi     # 0x161c0
callq 0x3630
xorb $-0x1, %al
testb $0x1, %al
jne 0x2e98
jmp 0x3334
leaq -0x20(%rbp), %rdi
callq 0x2200
movl %eax, -0x40(%rbp)
cmpl $-0x1, -0x40(%rbp)
jne 0x2eb8
leaq 0xc199(%rip), %rdi      # 0xf04a
callq 0x2140
jmp 0x2e81
leaq 0x13301(%rip), %rdi     # 0x161c0
leaq -0x40(%rbp), %rsi
callq 0x3650
movq %rax, -0x48(%rbp)
leaq 0x132ed(%rip), %rdi     # 0x161c0
callq 0x3430
movq %rax, -0x50(%rbp)
leaq -0x48(%rbp), %rdi
leaq -0x50(%rbp), %rsi
callq 0x3680
testb $0x1, %al
jne 0x2ef2
jmp 0x2f81
movl $0x180, %edi            # imm = 0x180
callq 0x2180
movq %rax, %rdi
movq %rdi, %rax
movq %rax, -0x170(%rbp)
movl -0x40(%rbp), %esi
callq 0x34c0
jmp 0x2f13
leaq 0x132a6(%rip), %rdi     # 0x161c0
leaq -0x40(%rbp), %rsi
callq 0x3550
movq -0x170(%rbp), %rcx
movq %rcx, (%rax)
leaq 0x1328c(%rip), %rdi     # 0x161c0
leaq -0x40(%rbp), %rsi
callq 0x3650
movq %rax, -0x58(%rbp)
movq -0x58(%rbp), %rax
movq %rax, -0x48(%rbp)
leaq -0x48(%rbp), %rdi
callq 0x3460
movq 0x8(%rax), %rax
movl $0x1, 0x14(%rax)
jmp 0x2f81
movq -0x170(%rbp), %rdi
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x30(%rbp)
movl %eax, -0x34(%rbp)
movl $0x180, %esi            # imm = 0x180
callq 0x2190
jmp 0x335e
leaq -0x48(%rbp), %rdi
callq 0x3460
movq 0x8(%rax), %rax
movq %rax, -0x60(%rbp)
movl -0x20(%rbp), %eax
andl $0x7f, %eax
cmpl $0x0, %eax
je 0x2fb0
movl -0x20(%rbp), %eax
andl $0x7f, %eax
addl $0x1, %eax
movsbl %al, %eax
sarl %eax
cmpl $0x0, %eax
jle 0x2fc5
leaq 0x13209(%rip), %rdi     # 0x161c0
leaq -0x40(%rbp), %rsi
callq 0x36b0
jmp 0x2e81
movl -0x20(%rbp), %eax
andl $0xff, %eax
cmpl $0x7f, %eax
jne 0x30ab
movl -0x20(%rbp), %eax
andl $0xff00, %eax           # imm = 0xFF00
sarl $0x8, %eax
cmpl $0x13, %eax
jne 0x30ab
movq -0x60(%rbp), %rax
cmpl $0x0, 0xc(%rax)
je 0x3026
movq -0x60(%rbp), %rax
movl (%rax), %esi
leaq 0xb29f(%rip), %rdi      # 0xe2a0
movb $0x0, %al
callq 0x2040
movq -0x60(%rbp), %rdi
callq 0x9d30
leaq 0x131a8(%rip), %rdi     # 0x161c0
leaq -0x40(%rbp), %rsi
callq 0x36b0
jmp 0x2e81
movq -0x60(%rbp), %rax
cmpl $0x0, 0x10(%rax)
je 0x304b
movq -0x60(%rbp), %rax
movl $0x0, 0x10(%rax)
movq -0x60(%rbp), %rdi
xorl %esi, %esi
callq 0x9e70
jmp 0x2e81
movq -0x60(%rbp), %rax
cmpl $0x0, 0x14(%rax)
je 0x30a9
movq -0x60(%rbp), %rax
movl $0x0, 0x14(%rax)
movq -0x60(%rbp), %rax
movl (%rax), %esi
movl $0x4200, %edi           # imm = 0x4200
xorl %eax, %eax
movl %eax, %edx
movl $0x1e, %ecx
movb $0x0, %al
callq 0x2150
cmpq $-0x1, %rax
jne 0x3099
jmp 0x3083
leaq 0xb1ef(%rip), %rdi      # 0xe279
callq 0x2140
movl $0x1, %edi
callq 0x21f0
movq -0x60(%rbp), %rdi
xorl %esi, %esi
callq 0x9e70
jmp 0x2e81
jmp 0x30ab
movl -0x20(%rbp), %eax
andl $0xff, %eax
cmpl $0x7f, %eax
jne 0x30e2
movl -0x20(%rbp), %eax
andl $0xff00, %eax           # imm = 0xFF00
sarl $0x8, %eax
cmpl $0x5, %eax
je 0x30e2
movq -0x60(%rbp), %rdi
movl -0x20(%rbp), %esi
andl $0xff00, %esi           # imm = 0xFF00
sarl $0x8, %esi
callq 0x9e70
jmp 0x2e81
movl -0x20(%rbp), %eax
sarl $0x10, %eax
movl %eax, -0x64(%rbp)
cmpl $0x1, -0x64(%rbp)
je 0x3101
cmpl $0x2, -0x64(%rbp)
je 0x3101
cmpl $0x3, -0x64(%rbp)
jne 0x3235
movq -0x60(%rbp), %rax
movl (%rax), %esi
movl $0x4201, %edi           # imm = 0x4201
xorl %edx, %edx
leaq -0x70(%rbp), %rcx
movb $0x0, %al
callq 0x2150
cmpq $-0x1, %rax
jne 0x3137
jmp 0x3121
leaq 0xb1b9(%rip), %rdi      # 0xe2e1
callq 0x2140
movl $0x1, %edi
callq 0x21f0
movq -0x60(%rbp), %rax
movl (%rax), %esi
movq -0x70(%rbp), %rdx
leaq 0xb1ac(%rip), %rdi      # 0xe2f4
xorl %eax, %eax
callq 0x2040
movl $0x180, %edi            # imm = 0x180
callq 0x2180
movq %rax, %rdi
movq %rdi, %rax
movq %rax, -0x178(%rbp)
movl -0x70(%rbp), %esi
callq 0x34c0
jmp 0x3170
movq -0x178(%rbp), %rax
movq %rax, -0x78(%rbp)
movq -0x78(%rbp), %rax
movl $0x1, 0x14(%rax)
movq -0x60(%rbp), %rsi
addq $0xf0, %rsi
movq -0x78(%rbp), %rdi
addq $0xf0, %rdi
callq 0x36e0
movq -0x60(%rbp), %rsi
addq $0x120, %rsi            # imm = 0x120
movq -0x78(%rbp), %rdi
addq $0x120, %rdi            # imm = 0x120
callq 0x36e0
movq -0x60(%rbp), %rsi
addq $0x150, %rsi            # imm = 0x150
movq -0x78(%rbp), %rdi
addq $0x150, %rdi            # imm = 0x150
callq 0x36e0
movq -0x78(%rbp), %rax
movq %rax, -0x180(%rbp)
movq -0x70(%rbp), %rax
movl %eax, -0x7c(%rbp)
leaq 0x12fd0(%rip), %rdi     # 0x161c0
leaq -0x7c(%rbp), %rsi
callq 0x3710
movq -0x180(%rbp), %rcx
movq %rcx, (%rax)
movq -0x60(%rbp), %rdi
xorl %esi, %esi
callq 0x9e70
jmp 0x2e81
movq -0x178(%rbp), %rdi
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x30(%rbp)
movl %eax, -0x34(%rbp)
movl $0x180, %esi            # imm = 0x180
callq 0x2190
jmp 0x335e
cmpl $0x4, -0x64(%rbp)
jne 0x324b
movq -0x60(%rbp), %rdi
xorl %esi, %esi
callq 0x9e70
jmp 0x2e81
movq -0x60(%rbp), %rax
movl (%rax), %esi
movl $0xc, %edi
xorl %edx, %edx
leaq -0x158(%rbp), %rcx
movb $0x0, %al
callq 0x2150
cmpq $-0x1, %rax
jne 0x3284
jmp 0x326e
leaq 0xb0ae(%rip), %rdi      # 0xe323
callq 0x2140
movl $0x1, %edi
callq 0x21f0
movl $0x0, -0x15c(%rbp)
movq -0x60(%rbp), %rdi
leaq -0x158(%rbp), %rsi
leaq -0x15c(%rbp), %rdx
callq 0x2ac0
cmpl $0x0, -0x15c(%rbp)
je 0x32e9
movq -0x60(%rbp), %rax
movl (%rax), %esi
movl $0xd, %edi
xorl %edx, %edx
leaq -0x158(%rbp), %rcx
movb $0x0, %al
callq 0x2150
cmpq $-0x1, %rax
jne 0x32e7
jmp 0x32d1
leaq 0xb05a(%rip), %rdi      # 0xe332
callq 0x2140
movl $0x1, %edi
callq 0x21f0
jmp 0x32e9
cmpl $0x0, 0x12ecc(%rip)     # 0x161bc
je 0x3324
movq -0x60(%rbp), %rax
cmpl $0x0, 0x4(%rax)
jne 0x3324
movq -0x60(%rbp), %rax
cmpl $-0x1, 0x8(%rax)
je 0x3324
movq -0x60(%rbp), %rdi
callq 0x9d30
movq -0x60(%rbp), %rsi
leaq 0x12ea6(%rip), %rdi     # 0x161c0
callq 0x36b0
jmp 0x2e81
movq -0x60(%rbp), %rdi
xorl %esi, %esi
callq 0x9e70
jmp 0x2e81
movl $0x1, 0x12e7e(%rip)     # 0x161bc
movq -0x18(%rbp), %rdi
xorl %eax, %eax
movl %eax, %esi
callq 0x2170
movl $0x0, -0x4(%rbp)
movl -0x4(%rbp), %eax
addq $0x180, %rsp            # imm = 0x180
popq %rbp
retq
movq -0x30(%rbp), %rdi
callq 0x2300
nopw (%rax,%rax)