SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Snapshot QEMU mmap_next_start (#558)

Browse Source
This commit is contained in:
Andrea Fioraldi 2022-03-01 16:04:20 +01:00 committed by GitHub
parent f4c4d9044f
commit 8cb41366ac
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 29 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libafl_qemu/src/emu.rs
View File

@ -215,6 +215,7 @@ extern "C" {
static exec_path: *const u8; static exec_path: *const u8;
static guest_base: usize; static guest_base: usize;
static mut mmap_next_start: GuestAddr;
static mut libafl_exec_edge_hook: unsafe extern "C" fn(u64); static mut libafl_exec_edge_hook: unsafe extern "C" fn(u64);
static mut libafl_gen_edge_hook: unsafe extern "C" fn(u64, u64) -> u64; static mut libafl_gen_edge_hook: unsafe extern "C" fn(u64, u64) -> u64;
@ -477,6 +478,15 @@ impl Emulator {
unsafe { libafl_set_brk(brk.into()) }; unsafe { libafl_set_brk(brk.into()) };
} }
#[must_use]
pub fn get_mmap_start(&self) -> GuestAddr {
unsafe { mmap_next_start }
}
pub fn set_mmap_start(&self, start: GuestAddr) {
unsafe { mmap_next_start = start };
}
fn mmap( fn mmap(
&self, &self,
addr: GuestAddr, addr: GuestAddr,

22
libafl_qemu/src/snapshot.rs
View File

@ -12,8 +12,8 @@ use crate::{
emu::{Emulator, MmapPerms}, emu::{Emulator, MmapPerms},
helper::{QemuHelper, QemuHelperTuple}, helper::{QemuHelper, QemuHelperTuple},
hooks::QemuHooks, hooks::QemuHooks,
GuestAddr, SYS_getrandom, SYS_mmap, SYS_mprotect, SYS_mremap, SYS_newfstatat, SYS_read, GuestAddr, SYS_fstat, SYS_fstatfs, SYS_futex, SYS_getrandom, SYS_mmap, SYS_mprotect,
SYS_readlinkat, SYS_mremap, SYS_newfstatat, SYS_pread64, SYS_read, SYS_readlinkat, SYS_statfs,
}; };
pub const SNAPSHOT_PAGE_SIZE: usize = 4096; pub const SNAPSHOT_PAGE_SIZE: usize = 4096;
@ -48,6 +48,7 @@ pub struct QemuSnapshotHelper {
pub new_maps: Mutex<IntervalTree<GuestAddr, Option<MmapPerms>>>, pub new_maps: Mutex<IntervalTree<GuestAddr, Option<MmapPerms>>>,
pub pages: HashMap<GuestAddr, SnapshotPageInfo>, pub pages: HashMap<GuestAddr, SnapshotPageInfo>,
pub brk: GuestAddr, pub brk: GuestAddr,
pub mmap_start: GuestAddr,
pub empty: bool, pub empty: bool,
} }
@ -59,6 +60,7 @@ impl QemuSnapshotHelper {
new_maps: Mutex::new(IntervalTree::new()), new_maps: Mutex::new(IntervalTree::new()),
pages: HashMap::default(), pages: HashMap::default(),
brk: 0, brk: 0,
mmap_start: 0,
empty: true, empty: true,
} }
} }
@ -66,6 +68,7 @@ impl QemuSnapshotHelper {
#[allow(clippy::uninit_assumed_init)] #[allow(clippy::uninit_assumed_init)]
pub fn snapshot(&mut self, emulator: &Emulator) { pub fn snapshot(&mut self, emulator: &Emulator) {
self.brk = emulator.get_brk(); self.brk = emulator.get_brk();
self.mmap_start = emulator.get_mmap_start();
self.pages.clear(); self.pages.clear();
for map in emulator.mappings() { for map in emulator.mappings() {
let mut addr = map.start(); let mut addr = map.start();
@ -132,6 +135,7 @@ impl QemuSnapshotHelper {
} }
emulator.set_brk(self.brk); emulator.set_brk(self.brk);
emulator.set_mmap_start(self.mmap_start);
} }
pub fn add_mapped(&mut self, start: GuestAddr, mut size: usize, perms: Option<MmapPerms>) { pub fn add_mapped(&mut self, start: GuestAddr, mut size: usize, perms: Option<MmapPerms>) {
@ -315,7 +319,7 @@ where
{ {
// NOT A COMPLETE LIST OF MEMORY EFFECTS // NOT A COMPLETE LIST OF MEMORY EFFECTS
match i64::from(sys_num) { match i64::from(sys_num) {
SYS_read => { SYS_read | SYS_pread64 => {
let h = helpers let h = helpers
.match_first_type_mut::<QemuSnapshotHelper>() .match_first_type_mut::<QemuSnapshotHelper>()
.unwrap(); .unwrap();
@ -327,6 +331,12 @@ where
.unwrap(); .unwrap();
h.access(a2 as GuestAddr, a3 as usize); h.access(a2 as GuestAddr, a3 as usize);
} }
SYS_futex => {
let h = helpers
.match_first_type_mut::<QemuSnapshotHelper>()
.unwrap();
h.access(a0 as GuestAddr, a3 as usize);
}
SYS_newfstatat => { SYS_newfstatat => {
if a2 != 0 { if a2 != 0 {
let h = helpers let h = helpers
@ -335,6 +345,12 @@ where
h.access(a2 as GuestAddr, 4096); // stat is not greater than a page h.access(a2 as GuestAddr, 4096); // stat is not greater than a page
} }
} }
SYS_statfs | SYS_fstatfs | SYS_fstat => {
let h = helpers
.match_first_type_mut::<QemuSnapshotHelper>()
.unwrap();
h.access(a1 as GuestAddr, 4096); // stat is not greater than a page
}
SYS_getrandom => { SYS_getrandom => {
let h = helpers let h = helpers
.match_first_type_mut::<QemuSnapshotHelper>() .match_first_type_mut::<QemuSnapshotHelper>()