OLD | NEW |
| (Empty) |
1 // Copyright (c) 2006, Google Inc. | |
2 // All rights reserved. | |
3 // | |
4 // Redistribution and use in source and binary forms, with or without | |
5 // modification, are permitted provided that the following conditions are | |
6 // met: | |
7 // | |
8 // * Redistributions of source code must retain the above copyright | |
9 // notice, this list of conditions and the following disclaimer. | |
10 // * Redistributions in binary form must reproduce the above | |
11 // copyright notice, this list of conditions and the following disclaimer | |
12 // in the documentation and/or other materials provided with the | |
13 // distribution. | |
14 // * Neither the name of Google Inc. nor the names of its | |
15 // contributors may be used to endorse or promote products derived from | |
16 // this software without specific prior written permission. | |
17 // | |
18 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | |
19 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | |
20 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR | |
21 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT | |
22 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |
23 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | |
24 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | |
25 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | |
26 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
27 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | |
28 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
29 | |
30 // process_state.h: A snapshot of a process, in a fully-digested state. | |
31 // | |
32 // Author: Mark Mentovai | |
33 | |
34 #ifndef GOOGLE_BREAKPAD_PROCESSOR_PROCESS_STATE_H__ | |
35 #define GOOGLE_BREAKPAD_PROCESSOR_PROCESS_STATE_H__ | |
36 | |
37 #include <string> | |
38 #include <vector> | |
39 #include "google_breakpad/common/breakpad_types.h" | |
40 #include "google_breakpad/processor/system_info.h" | |
41 #include "google_breakpad/processor/minidump.h" | |
42 | |
43 namespace google_breakpad { | |
44 | |
45 using std::string; | |
46 using std::vector; | |
47 | |
48 class CallStack; | |
49 class CodeModules; | |
50 | |
51 enum ExploitabilityRating { | |
52 EXPLOITABILITY_HIGH, // The crash likely represents | |
53 // a exploitable memory corruption | |
54 // vulnerability. | |
55 | |
56 EXPLOITABLITY_MEDIUM, // The crash appears to corrupt | |
57 // memory in a way which may be | |
58 // exploitable in some situations. | |
59 | |
60 EXPLOITABILITY_LOW, // The crash either does not corrupt | |
61 // memory directly or control over | |
62 // the effected data is limited. The | |
63 // issue may still be exploitable | |
64 // on certain platforms or situations. | |
65 | |
66 EXPLOITABILITY_INTERESTING, // The crash does not appear to be | |
67 // directly exploitable. However it | |
68 // represents a condition which should | |
69 // be furthur analyzed. | |
70 | |
71 EXPLOITABILITY_NONE, // The crash does not appear to repres
ent | |
72 // an exploitable condition. | |
73 | |
74 EXPLOITABILITY_NOT_ANALYZED, // The crash was not analyzed for | |
75 // exploitability because the engine | |
76 // was disabled. | |
77 | |
78 EXPLOITABILITY_ERR_NOENGINE, // The supplied minidump's platform do
es | |
79 // not have a exploitability engine | |
80 // associated with it. | |
81 | |
82 EXPLOITABILITY_ERR_PROCESSING // An error occured within the | |
83 // exploitability engine and no rating | |
84 // was calculated. | |
85 }; | |
86 | |
87 class ProcessState { | |
88 public: | |
89 ProcessState() : modules_(NULL) { Clear(); } | |
90 ~ProcessState(); | |
91 | |
92 // Resets the ProcessState to its default values | |
93 void Clear(); | |
94 | |
95 // Accessors. See the data declarations below. | |
96 u_int32_t time_date_stamp() const { return time_date_stamp_; } | |
97 bool crashed() const { return crashed_; } | |
98 string crash_reason() const { return crash_reason_; } | |
99 u_int64_t crash_address() const { return crash_address_; } | |
100 string assertion() const { return assertion_; } | |
101 int requesting_thread() const { return requesting_thread_; } | |
102 const vector<CallStack*>* threads() const { return &threads_; } | |
103 const vector<MinidumpMemoryRegion*>* thread_memory_regions() const { | |
104 return &thread_memory_regions_; | |
105 } | |
106 const SystemInfo* system_info() const { return &system_info_; } | |
107 const CodeModules* modules() const { return modules_; } | |
108 ExploitabilityRating exploitability() const { return exploitability_; } | |
109 | |
110 private: | |
111 // MinidumpProcessor is responsible for building ProcessState objects. | |
112 friend class MinidumpProcessor; | |
113 | |
114 // The time-date stamp of the minidump (time_t format) | |
115 u_int32_t time_date_stamp_; | |
116 | |
117 // True if the process crashed, false if the dump was produced outside | |
118 // of an exception handler. | |
119 bool crashed_; | |
120 | |
121 // If the process crashed, the type of crash. OS- and possibly CPU- | |
122 // specific. For example, "EXCEPTION_ACCESS_VIOLATION" (Windows), | |
123 // "EXC_BAD_ACCESS / KERN_INVALID_ADDRESS" (Mac OS X), "SIGSEGV" | |
124 // (other Unix). | |
125 string crash_reason_; | |
126 | |
127 // If the process crashed, and if crash_reason implicates memory, | |
128 // the memory address that caused the crash. For data access errors, | |
129 // this will be the data address that caused the fault. For code errors, | |
130 // this will be the address of the instruction that caused the fault. | |
131 u_int64_t crash_address_; | |
132 | |
133 // If there was an assertion that was hit, a textual representation | |
134 // of that assertion, possibly including the file and line at which | |
135 // it occurred. | |
136 string assertion_; | |
137 | |
138 // The index of the thread that requested a dump be written in the | |
139 // threads vector. If a dump was produced as a result of a crash, this | |
140 // will point to the thread that crashed. If the dump was produced as | |
141 // by user code without crashing, and the dump contains extended Breakpad | |
142 // information, this will point to the thread that requested the dump. | |
143 // If the dump was not produced as a result of an exception and no | |
144 // extended Breakpad information is present, this field will be set to -1, | |
145 // indicating that the dump thread is not available. | |
146 int requesting_thread_; | |
147 | |
148 // Stacks for each thread (except possibly the exception handler | |
149 // thread) at the time of the crash. | |
150 vector<CallStack*> threads_; | |
151 vector<MinidumpMemoryRegion*> thread_memory_regions_; | |
152 | |
153 // OS and CPU information. | |
154 SystemInfo system_info_; | |
155 | |
156 // The modules that were loaded into the process represented by the | |
157 // ProcessState. | |
158 const CodeModules *modules_; | |
159 | |
160 // The exploitability rating as determined by the exploitability | |
161 // engine. When the exploitability engine is not enabled this | |
162 // defaults to EXPLOITABILITY_NONE. | |
163 ExploitabilityRating exploitability_; | |
164 }; | |
165 | |
166 } // namespace google_breakpad | |
167 | |
168 #endif // GOOGLE_BREAKPAD_PROCESSOR_PROCESS_STATE_H__ | |
OLD | NEW |