SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor hooks

Browse Source
This commit is contained in:
Alwin Berger 2024-12-18 16:36:59 +01:00
parent ee6f85de22
commit 21370f3356
10 changed files with 133 additions and 503 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
accel/tcg/translate-all.c
View File

@ -70,92 +70,8 @@
#include "libafl/hooks/tcg/block.h"
#include "libafl/hooks/tcg/edge.h"
#include "libafl/hooks/tcg/jmp.h"
static TCGHelperInfo libafl_exec_jmp_hook_info = {
.func = NULL, .name = "libafl_exec_jmp_hook", \
.flags = dh_callflag(void), \
.typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \
};
struct libafl_jmp_hook {
uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
uint64_t data;
TCGHelperInfo helper_info;
struct libafl_jmp_hook* next;
};
struct libafl_jmp_hook* libafl_jmp_hooks;
void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data);
void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data)
{
struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
hook->gen = gen;
hook->exec = exec;
hook->data = data;
hook->next = libafl_jmp_hooks;
libafl_jmp_hooks = hook;
memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
hook->helper_info.func = exec;
}
void libafl_gen_jmp(target_ulong src, target_ulong dst);
void libafl_gen_jmp(target_ulong src, target_ulong dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, dst);
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
TCGv_i64 tmp2 = tcg_constant_i64(dst);
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
// Use an indirect jump target
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst);
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, 0); // target is not statically known, signal with 0
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
// TCGv_i32 tmp2 = dst;
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
//tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
#include "libafl/hook.h"
//// --- End LibAFL code ---
TBContext tb_ctx;

122
cpu-target.c
View File

@ -53,128 +53,6 @@
#include "libafl/syx-snapshot/device-save.h"
#endif
void libafl_flush_jit(void);
extern int libafl_restoring_devices;
/*
void* libafl_qemu_g2h(CPUState *cpu, target_ulong x);
target_ulong libafl_qemu_h2g(CPUState *cpu, void* x);
void* libafl_qemu_g2h(CPUState *cpu, target_ulong x)
{
return g2h(cpu, x);
}
target_ulong libafl_qemu_h2g(CPUState *cpu, void* x)
{
return h2g(cpu, x);
}
*/
target_ulong libafl_page_from_addr(target_ulong addr) {
return addr & TARGET_PAGE_MASK;
}
CPUState* libafl_qemu_get_cpu(int cpu_index)
{
CPUState *cpu;
CPU_FOREACH(cpu) {
if (cpu->cpu_index == cpu_index)
return cpu;
}
return NULL;
}
int libafl_qemu_num_cpus(void)
{
CPUState *cpu;
int num = 0;
CPU_FOREACH(cpu) {
num++;
}
return num;
}
CPUState* libafl_qemu_current_cpu(void)
{
#ifndef CONFIG_USER_ONLY
if (current_cpu == NULL) {
return libafl_last_exit_cpu();
}
#endif
return current_cpu;
}
int libafl_qemu_cpu_index(CPUState* cpu)
{
if (cpu) return cpu->cpu_index;
return -1;
}
int libafl_qemu_write_reg(CPUState* cpu, int reg, uint8_t* val)
{
return gdb_write_register(cpu, val, reg);
}
int libafl_qemu_read_reg(CPUState* cpu, int reg, uint8_t* val)
{
int len;
if (libafl_qemu_mem_buf == NULL) {
libafl_qemu_mem_buf = g_byte_array_sized_new(64);
}
g_byte_array_set_size(libafl_qemu_mem_buf, 0);
len = gdb_read_register(cpu, libafl_qemu_mem_buf, reg);
if (len > 0) {
memcpy(val, libafl_qemu_mem_buf->data, len);
}
return len;
}
int libafl_qemu_num_regs(CPUState* cpu)
{
CPUClass *cc = CPU_GET_CLASS(cpu);
return cc->gdb_num_core_regs;
}
#ifdef TARGET_ARM
// use-case: get the user-stack pointer and return addr from at an isr-return
#include "target/arm/cpu.h"
#include "target/arm/internals.h"
int libafl_qemu_read_user_sp_unchecked(CPUState* cpu);
int libafl_qemu_read_user_sp_unchecked(CPUState* cpu) {
CPUARMState *env = cpu_env(cpu);
return env->v7m.other_sp;
}
#endif
#ifndef CONFIG_USER_ONLY
hwaddr libafl_qemu_current_paging_id(CPUState* cpu)
{
CPUClass* cc = CPU_GET_CLASS(cpu);
if (cc->sysemu_ops && cc->sysemu_ops->get_paging_id) {
return cc->sysemu_ops->get_paging_id(cpu);
} else {
return 0;
}
}
#endif
void libafl_flush_jit(void)
{
CPUState *cpu;
CPU_FOREACH(cpu) {
tb_flush(cpu);
}
}
//// --- End LibAFL code ---
#ifndef CONFIG_USER_ONLY

16
hw/timer/armv7m_systick.c
View File

@ -316,23 +316,19 @@ type_init(armv7m_systick_register_types)
#pragma GCC diagnostic ignored "-Wint-to-pointer-cast"
#include "qemu/seqlock.h"
#include "sysemu/cpu-timers-internal.h"
#define NUM_INTERRUPT_SOURCES 6
#define MAX_NUM_INTERRUPT 128
extern void libafl_send_irq(int irqn);
volatile uint32_t libafl_interrupt_offsets[NUM_INTERRUPT_SOURCES][MAX_NUM_INTERRUPT];
volatile uint64_t libafl_num_interrupts[NUM_INTERRUPT_SOURCES] = {0};
static ptimer_state* libafl_interrupt_timers[NUM_INTERRUPT_SOURCES][MAX_NUM_INTERRUPT] = {0};
#include "libafl/interrupt_injection.h"
volatile uint32_t libafl_interrupt_offsets[LIBAFL_MAX_INTERRUPT_SOURCES][LIBAFL_MAX_INTERRUPTS];
volatile uint64_t libafl_num_interrupts[LIBAFL_MAX_INTERRUPT_SOURCES] = {0};
static ptimer_state* libafl_interrupt_timers[LIBAFL_MAX_INTERRUPT_SOURCES][LIBAFL_MAX_INTERRUPTS] = {0};
/* This can be moved to a helper function later */
static void libafl_timed_int_hook(void*);
static void libafl_timed_int_hook(void* arg)
{
libafl_send_irq((int)arg);
}
void libafl_start_int_timer( void );
void libafl_start_int_timer( void ) {
for (int source=0; source<NUM_INTERRUPT_SOURCES; source++) {
for (int source=0; source<LIBAFL_MAX_INTERRUPT_SOURCES; source++) {
if (libafl_num_interrupts[source] == 0) {continue;}
for (int i=0; i<libafl_num_interrupts[source] && i<MAX_NUM_INTERRUPT; i++) {
for (int i=0; i<libafl_num_interrupts[source] && i<LIBAFL_MAX_INTERRUPTS; i++) {
if (libafl_interrupt_offsets[source][i] == 0) {continue;}
if (!libafl_interrupt_timers[source][i]) {
libafl_interrupt_timers[source][i] = ptimer_init(&libafl_timed_int_hook, (void*)source, 0);

4
include/libafl/cpu.h
View File

@ -29,3 +29,7 @@ int libafl_qemu_main(void);
int libafl_qemu_run(void);
void libafl_set_qemu_env(CPUArchState* env);
#endif
#ifdef TARGET_ARM
int libafl_qemu_read_user_sp_unchecked(CPUState* cpu);
#endif

211
include/libafl/hook.h
View File

@ -57,214 +57,3 @@ extern target_ulong libafl_gen_cur_pc;
extern size_t libafl_qemu_hooks_num;
void libafl_tcg_gen_asan(TCGTemp* addr, size_t size);
size_t libafl_qemu_set_hook(target_ulong pc, void (*callback)(uint64_t data, target_ulong pc),
uint64_t data, int invalidate);
size_t libafl_qemu_remove_hooks_at(target_ulong addr, int invalidate);
int libafl_qemu_remove_hook(size_t num, int invalidate);
struct libafl_hook* libafl_search_hook(target_ulong addr);
struct libafl_backdoor_hook {
void (*exec)(uint64_t data, CPUArchState* cpu, target_ulong pc);
uint64_t data;
size_t num;
TCGHelperInfo helper_info;
struct libafl_backdoor_hook* next;
};
extern struct libafl_backdoor_hook* libafl_backdoor_hooks;
size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, CPUArchState* cpu, target_ulong pc),
uint64_t data);
int libafl_qemu_remove_backdoor_hook(size_t num, int invalidate);
struct libafl_edge_hook {
uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
// void (*exec)(uint64_t data, uint64_t id);
size_t (*jit)(uint64_t data, uint64_t id); // optional opt
uint64_t data;
size_t num;
uint64_t cur_id;
TCGHelperInfo helper_info;
struct libafl_edge_hook* next;
};
extern struct libafl_edge_hook* libafl_edge_hooks;
size_t libafl_add_edge_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, uint64_t id),
uint64_t data);
int libafl_qemu_remove_edge_hook(size_t num, int invalidate);
bool libafl_qemu_edge_hook_set_jit(size_t num, size_t (*jit)(uint64_t, uint64_t)); // no param names to avoid to be marked as safe
struct libafl_block_hook {
uint64_t (*gen)(uint64_t data, target_ulong pc);
void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length);
// void (*exec)(uint64_t data, uint64_t id);
size_t (*jit)(uint64_t data, uint64_t id); // optional opt
uint64_t data;
size_t num;
TCGHelperInfo helper_info;
struct libafl_block_hook* next;
};
extern struct libafl_block_hook* libafl_block_hooks;
size_t libafl_add_block_hook(uint64_t (*gen)(uint64_t data, target_ulong pc),
void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length),
void (*exec)(uint64_t data, uint64_t id), uint64_t data);
int libafl_qemu_remove_block_hook(size_t num, int invalidate);
bool libafl_qemu_block_hook_set_jit(size_t num, size_t (*jit)(uint64_t, uint64_t)); // no param names to avoid to be marked as safe
struct libafl_rw_hook {
uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi);
/*void (*exec1)(uint64_t data, uint64_t id, target_ulong addr);
void (*exec2)(uint64_t data, uint64_t id, target_ulong addr);
void (*exec4)(uint64_t data, uint64_t id, target_ulong addr);
void (*exec8)(uint64_t data, uint64_t id, target_ulong addr);
void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size);*/
uint64_t data;
size_t num;
TCGHelperInfo helper_info1;
TCGHelperInfo helper_info2;
TCGHelperInfo helper_info4;
TCGHelperInfo helper_info8;
TCGHelperInfo helper_infoN;
struct libafl_rw_hook* next;
};
// alias
#define libafl_read_hook libafl_rw_hook
#define libafl_write_hook libafl_rw_hook
extern struct libafl_rw_hook* libafl_read_hooks;
extern struct libafl_rw_hook* libafl_write_hooks;
size_t libafl_add_read_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp *addr, MemOpIdx oi),
void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
uint64_t data);
size_t libafl_add_write_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp *addr, MemOpIdx oi),
void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
uint64_t data);
int libafl_qemu_remove_read_hook(size_t num, int invalidate);
int libafl_qemu_remove_write_hook(size_t num, int invalidate);
void libafl_gen_read(TCGTemp *addr, MemOpIdx oi);
void libafl_gen_write(TCGTemp *addr, MemOpIdx oi);
struct libafl_cmp_hook {
uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size);
/*void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1);
void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1);
void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1);
void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1);*/
uint64_t data;
size_t num;
TCGHelperInfo helper_info1;
TCGHelperInfo helper_info2;
TCGHelperInfo helper_info4;
TCGHelperInfo helper_info8;
struct libafl_cmp_hook* next;
};
extern struct libafl_cmp_hook* libafl_cmp_hooks;
size_t libafl_add_cmp_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size),
void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1),
void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1),
void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1),
void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1),
uint64_t data);
int libafl_qemu_remove_cmp_hook(size_t num, int invalidate);
struct syshook_ret {
target_ulong retval;
bool skip_syscall;
};
struct libafl_pre_syscall_hook {
struct syshook_ret (*callback)(uint64_t data, int sys_num, target_ulong arg0,
target_ulong arg1, target_ulong arg2,
target_ulong arg3, target_ulong arg4,
target_ulong arg5, target_ulong arg6,
target_ulong arg7);
uint64_t data;
size_t num;
struct libafl_pre_syscall_hook* next;
};
struct libafl_post_syscall_hook {
target_ulong (*callback)(uint64_t data, target_ulong ret, int sys_num,
target_ulong arg0, target_ulong arg1,
target_ulong arg2, target_ulong arg3,
target_ulong arg4, target_ulong arg5,
target_ulong arg6, target_ulong arg7);
uint64_t data;
size_t num;
struct libafl_post_syscall_hook* next;
};
extern struct libafl_pre_syscall_hook* libafl_pre_syscall_hooks;
extern struct libafl_post_syscall_hook* libafl_post_syscall_hooks;
size_t libafl_add_pre_syscall_hook(struct syshook_ret (*callback)(
uint64_t data, int sys_num, target_ulong arg0,
target_ulong arg1, target_ulong arg2,
target_ulong arg3, target_ulong arg4,
target_ulong arg5, target_ulong arg6,
target_ulong arg7),
uint64_t data);
size_t libafl_add_post_syscall_hook(target_ulong (*callback)(
uint64_t data, target_ulong ret, int sys_num,
target_ulong arg0, target_ulong arg1,
target_ulong arg2, target_ulong arg3,
target_ulong arg4, target_ulong arg5,
target_ulong arg6, target_ulong arg7),
uint64_t data);
int libafl_qemu_remove_pre_syscall_hook(size_t num);
int libafl_qemu_remove_post_syscall_hook(size_t num);
struct libafl_new_thread_hook {
bool (*callback)(uint64_t data, uint32_t tid);
uint64_t data;
size_t num;
struct libafl_new_thread_hook* next;
};
extern struct libafl_new_thread_hook* libafl_new_thread_hooks;
size_t libafl_add_new_thread_hook(bool (*callback)(uint64_t data, uint32_t tid),
uint64_t data);
int libafl_qemu_remove_new_thread_hook(size_t num);
void libafl_tcg_gen_asan(TCGTemp * addr, size_t size);
struct libafl_jmp_hook {
uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
uint64_t data;
size_t num;
TCGHelperInfo helper_info;
struct libafl_jmp_hook* next;
};
extern struct libafl_jmp_hook* libafl_jmp_hooks;
size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data);
void libafl_gen_jmp(target_ulong src, target_ulong dst);
// Use an indirect jump target
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst);
int libafl_qemu_remove_jmp_hook(size_t num, int invalidate);

31
include/libafl/hooks/tcg/jmp.h Normal file
View File

@ -0,0 +1,31 @@
#pragma once
#include "qemu/osdep.h"
#include "qapi/error.h"
#include "exec/exec-all.h"
#include "exec/tb-flush.h"
#include "libafl/exit.h"
#include "libafl/hook.h"
struct libafl_jmp_hook {
uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
uint64_t data;
size_t num;
TCGHelperInfo helper_info;
struct libafl_jmp_hook* next;
};
extern struct libafl_jmp_hook* libafl_jmp_hooks;
size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data);
void libafl_gen_jmp(target_ulong src, target_ulong dst);
// Use an indirect jump target
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst);
int libafl_qemu_remove_jmp_hook(size_t num, int invalidate);

12
libafl/cpu.c
View File

@ -158,3 +158,15 @@ int libafl_qemu_run(void)
void libafl_set_qemu_env(CPUArchState* env) { libafl_qemu_env = env; }
#endif
#ifdef TARGET_ARM
// use-case: get the user-stack pointer and return addr from at an isr-return
#include "target/arm/cpu.h"
#include "target/arm/internals.h"
int libafl_qemu_read_user_sp_unchecked(CPUState* cpu) {
CPUARMState *env = cpu_env(cpu);
return env->v7m.other_sp;
}
#endif

75
libafl/hook.c
View File

@ -64,78 +64,3 @@ void libafl_tcg_gen_asan(TCGTemp* addr, size_t size)
tcg_gen_tl_ptr(test_ptr, test_addr);
tcg_gen_st8_tl(shadow_val, test_ptr, 0);
}
static TCGHelperInfo libafl_exec_jmp_hook_info = {
.func = NULL, .name = "libafl_exec_jmp_hook", \
.flags = dh_callflag(void), \
.typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \
};
struct libafl_jmp_hook* libafl_jmp_hooks;
size_t libafl_jmp_hooks_num = 0;
size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data)
{
struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
hook->gen = gen;
hook->exec = exec;
hook->num = libafl_edge_hooks_num++;
hook->data = data;
hook->next = libafl_jmp_hooks;
libafl_jmp_hooks = hook;
memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
hook->helper_info.func = exec;
return hook->num;
}
void libafl_gen_jmp(target_ulong src, target_ulong dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, dst);
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
TCGv_i64 tmp2 = tcg_constant_i64(dst);
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, 0); // target is not statically known, signal with 0
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
// TCGv_i32 tmp2 = dst;
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
//tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
GEN_REMOVE_HOOK(jmp)

78
libafl/hooks/tcg/jmp.c Normal file
View File

@ -0,0 +1,78 @@
#include "libafl/tcg.h"
#include "libafl/hooks/tcg/jmp.h"
static TCGHelperInfo libafl_exec_jmp_hook_info = {
.func = NULL,
.name = "libafl_exec_jmp_hook",
.flags = dh_callflag(void),
.typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4),
};
struct libafl_jmp_hook* libafl_jmp_hooks;
size_t libafl_jmp_hooks_num = 0;
size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data)
{
struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
hook->gen = gen;
hook->exec = exec;
hook->num = libafl_jmp_hooks_num++;
hook->data = data;
hook->next = libafl_jmp_hooks;
libafl_jmp_hooks = hook;
memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
hook->helper_info.func = exec;
return hook->num;
}
void libafl_gen_jmp(target_ulong src, target_ulong dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, dst);
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
TCGv_i64 tmp2 = tcg_constant_i64(dst);
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, 0); // target is not statically known, signal with 0
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
// TCGv_i32 tmp2 = dst;
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) };
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
//tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
GEN_REMOVE_HOOK(jmp)

1
libafl/meson.build
View File

@ -12,6 +12,7 @@ specific_ss.add(files(
'hooks/tcg/cmp.c',
'hooks/tcg/edge.c',
'hooks/tcg/instruction.c',
'hooks/tcg/jmp.c',
'hooks/tcg/read_write.c',
# General hooks