// File: overfl0[P]iojack/iojack.cpp
// Function: processSyscall(processInfo*, user_regs_struct*, int*)
void processSyscall(processInfo *pi, user_regs_struct *regs, int *saveRegs)
{
    // regs->ORIG_RAX - Syscall number
    //printf("__RAX: %ld (orig: %ld)\n", regs->RAX, regs->ORIG_RAX);
    // We're either in a syscall or not
    if(!pi->inSyscall)
    {
        // I read somewhere that rax should == -38 now but I should confirm that
        // Tip: everything seems to suggest that it's the value of -ENOSYS
        // ("this system call doesn't exist")
        dprintf("[%d] Entering syscall: %s (%ld), rax = %ld\n",
                pi->pid, syscallToStr(regs->ORIG_RAX), regs->ORIG_RAX, regs->RAX);
        //dprintf("RIP: %lx\n", regs->rip);
        //tmpDump(pi, regs);
        pi->orig_regs = *regs; // Backup everything
        hookPtr fun = getPreHook(regs->ORIG_RAX);
        if(fun)
        {
            // Run a hooked function
            int fakeSyscall = 0;
            fun(pi, *regs, *saveRegs, fakeSyscall);

            if(fakeSyscall)
            {
                pi->fakingSyscall = regs->ORIG_RAX;

                // This syscall can't exist :)
                regs->ORIG_RAX = (unsigned int)-1;
                regs->RAX = -1;

                *saveRegs = 1;
            }
        }

        pi->inSyscall = 1;
    }
    else // Exiting a syscall
    {
        dprintf("[%d] Exiting syscall:  %s (%ld)   with code %ld\n", pi->pid, syscallToStr(regs->ORIG_RAX), regs->ORIG_RAX, regs->RAX);
        //dprintf("RIP: %lx\n", regs->rip);

        int unused;
        if(pi->fakingSyscall != -1)
        {
            if(regs->ORIG_RAX != (unsigned int)-1)
                printf("[%d] OMG! :O, regs->ORIG_RAX == %ld\n", pi->pid, regs->ORIG_RAX);

            // Second ptrace trap. We just finished running our
            // nonexisting syscall. Now is the moment to inject the
            // "correct" return values, etc...
            hookPtr fun = getFakedHook(pi->fakingSyscall);
            if(fun)
                fun(pi, *regs, *saveRegs, unused);
            else
            {
                // Should not happen!
                printf("[%d] Can't find function handling fake %s! (%d).\n", pi->pid, syscallToStr(pi->fakingSyscall), pi->fakingSyscall);
                exit(1);
            }

            regs->ORIG_RAX = pi->fakingSyscall;
            pi->fakingSyscall = -1;
        }

        hookPtr postFun = getPostHook(pi->orig_regs.ORIG_RAX);
        if(postFun)
            postFun(pi, *regs, *saveRegs, unused);

        pi->inSyscall = 0;
    }
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x40, %rsp
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq %rdx, -0x18(%rbp)
movq -0x8(%rbp), %rax
cmpl $0x0, 0x4(%rax)
jne 0x2b7b
movq -0x10(%rbp), %rsi
movq -0x8(%rbp), %rdi
addq $0x18, %rdi
movl $0xd8, %edx
callq 0x2130
movq -0x10(%rbp), %rax
movq 0x78(%rax), %rax
movl %eax, %edi
callq 0xb290
movq %rax, -0x20(%rbp)
cmpq $0x0, -0x20(%rbp)
je 0x2b6b
movl $0x0, -0x24(%rbp)
movq -0x20(%rbp), %rax
movq -0x8(%rbp), %rdi
movq -0x10(%rbp), %rsi
movq -0x18(%rbp), %rdx
leaq -0x24(%rbp), %rcx
callq *%rax
cmpl $0x0, -0x24(%rbp)
je 0x2b69
movq -0x10(%rbp), %rax
movq 0x78(%rax), %rax
movl %eax, %ecx
movq -0x8(%rbp), %rax
movl %ecx, 0x8(%rax)
movq -0x10(%rbp), %rax
movl $0xffffffff, %ecx       # imm = 0xFFFFFFFF
movq %rcx, 0x78(%rax)
movq -0x10(%rbp), %rax
movq $-0x1, 0x50(%rax)
movq -0x18(%rbp), %rax
movl $0x1, (%rax)
jmp 0x2b6b
movq -0x8(%rbp), %rax
movl $0x1, 0x4(%rax)
jmp 0x2c76
movq -0x8(%rbp), %rax
cmpl $-0x1, 0x8(%rax)
je 0x2c38
movq -0x10(%rbp), %rax
movl $0xffffffff, %ecx       # imm = 0xFFFFFFFF
cmpq %rcx, 0x78(%rax)
je 0x2bb4
movq -0x8(%rbp), %rax
movl (%rax), %esi
movq -0x10(%rbp), %rax
movq 0x78(%rax), %rdx
leaq 0xb544(%rip), %rdi      # 0xe0f1
movb $0x0, %al
callq 0x2040
movq -0x8(%rbp), %rax
movl 0x8(%rax), %edi
callq 0xb2b0
movq %rax, -0x30(%rbp)
cmpq $0x0, -0x30(%rbp)
je 0x2be3
movq -0x30(%rbp), %rax
movq -0x8(%rbp), %rdi
movq -0x10(%rbp), %rsi
movq -0x18(%rbp), %rdx
leaq -0x28(%rbp), %rcx
callq *%rax
jmp 0x2c1d
movq -0x8(%rbp), %rax
movl (%rax), %eax
movl %eax, -0x3c(%rbp)
movq -0x8(%rbp), %rax
movl 0x8(%rax), %edi
callq 0x62b0
movl -0x3c(%rbp), %esi
movq %rax, %rdx
movq -0x8(%rbp), %rax
movl 0x8(%rax), %ecx
leaq 0xb50a(%rip), %rdi      # 0xe116
movb $0x0, %al
callq 0x2040
movl $0x1, %edi
callq 0x21f0
movq -0x8(%rbp), %rax
movslq 0x8(%rax), %rcx
movq -0x10(%rbp), %rax
movq %rcx, 0x78(%rax)
movq -0x8(%rbp), %rax
movl $0xffffffff, 0x8(%rax)  # imm = 0xFFFFFFFF
movq -0x8(%rbp), %rax
movq 0x90(%rax), %rax
movl %eax, %edi
callq 0xb2d0
movq %rax, -0x38(%rbp)
cmpq $0x0, -0x38(%rbp)
je 0x2c6b
movq -0x38(%rbp), %rax
movq -0x8(%rbp), %rdi
movq -0x10(%rbp), %rsi
movq -0x18(%rbp), %rdx
leaq -0x28(%rbp), %rcx
callq *%rax
movq -0x8(%rbp), %rax
movl $0x0, 0x4(%rax)
addq $0x40, %rsp
popq %rbp
retq
nopl (%rax)