diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c index cdfca247f8..8a34749745 100644 --- a/accel/tcg/translate-all.c +++ b/accel/tcg/translate-all.c @@ -67,93 +67,7 @@ #include "tcg/insn-start-words.h" //// --- Begin LibAFL code --- - #include "libafl/hook.h" - -static TCGHelperInfo libafl_exec_jmp_hook_info = { - .func = NULL, .name = "libafl_exec_jmp_hook", \ - .flags = dh_callflag(void), \ - .typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \ -}; - -struct libafl_jmp_hook { - uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst); - void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id); - uint64_t data; - TCGHelperInfo helper_info; - struct libafl_jmp_hook* next; -}; - -struct libafl_jmp_hook* libafl_jmp_hooks; - -void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst), - void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id), - uint64_t data); -void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst), - void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id), - uint64_t data) -{ - struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1); - hook->gen = gen; - hook->exec = exec; - hook->data = data; - hook->next = libafl_jmp_hooks; - libafl_jmp_hooks = hook; - - memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo)); - hook->helper_info.func = exec; -} - -void libafl_gen_jmp(target_ulong src, target_ulong dst); -void libafl_gen_jmp(target_ulong src, target_ulong dst) -{ - - struct libafl_jmp_hook* hook = libafl_jmp_hooks; - while (hook) { - uint64_t cur_id = 0; - if (hook->gen) - cur_id = hook->gen(hook->data, src, dst); - if (cur_id != (uint64_t)-1 && hook->exec) { - TCGv_i64 tmp0 = tcg_constant_i64(hook->data); - TCGv_i64 tmp1 = tcg_constant_i64(src); - TCGv_i64 tmp2 = tcg_constant_i64(dst); - TCGv_i64 tmp3 = tcg_constant_i64(cur_id); - TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) }; - tcg_gen_callN(&hook->helper_info, NULL, tmp4); - tcg_temp_free_i64(tmp0); - tcg_temp_free_i64(tmp1); - tcg_temp_free_i64(tmp2); - tcg_temp_free_i64(tmp3); - } - hook = hook->next; - } -} - -// Use an indirect jump target -void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst); -void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst) -{ - struct libafl_jmp_hook* hook = libafl_jmp_hooks; - while (hook) { - uint64_t cur_id = 0; - if (hook->gen) - cur_id = hook->gen(hook->data, src, 0); // target is not statically known, signal with 0 - if (cur_id != (uint64_t)-1 && hook->exec) { - TCGv_i64 tmp0 = tcg_constant_i64(hook->data); - TCGv_i64 tmp1 = tcg_constant_i64(src); - // TCGv_i32 tmp2 = dst; - TCGv_i64 tmp3 = tcg_constant_i64(cur_id); - TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) }; - tcg_gen_callN(&hook->helper_info, NULL, tmp4); - tcg_temp_free_i64(tmp0); - tcg_temp_free_i64(tmp1); - //tcg_temp_free_i64(tmp2); - tcg_temp_free_i64(tmp3); - } - hook = hook->next; - } -} - //// --- End LibAFL code --- TBContext tb_ctx; diff --git a/include/libafl/hook.h b/include/libafl/hook.h index 453d85cc73..3d49592e89 100644 --- a/include/libafl/hook.h +++ b/include/libafl/hook.h @@ -223,4 +223,25 @@ size_t libafl_add_new_thread_hook(bool (*callback)(uint64_t data, uint32_t tid), uint64_t data); int libafl_qemu_remove_new_thread_hook(size_t num); -void libafl_tcg_gen_asan(TCGTemp * addr, size_t size); \ No newline at end of file +void libafl_tcg_gen_asan(TCGTemp * addr, size_t size); + +struct libafl_jmp_hook { + uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst); + void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id); + uint64_t data; + size_t num; + TCGHelperInfo helper_info; + struct libafl_jmp_hook* next; +}; + +extern struct libafl_jmp_hook* libafl_jmp_hooks; + +size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst), + void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id), + uint64_t data); + +void libafl_gen_jmp(target_ulong src, target_ulong dst); + +// Use an indirect jump target +void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst); +int libafl_qemu_remove_jmp_hook(size_t num, int invalidate); \ No newline at end of file diff --git a/libafl/hook.c b/libafl/hook.c index 5eba45ee04..d1e2a8eec7 100644 --- a/libafl/hook.c +++ b/libafl/hook.c @@ -743,3 +743,78 @@ void libafl_tcg_gen_asan(TCGTemp * addr, size_t size) tcg_gen_tl_ptr(test_ptr, test_addr); tcg_gen_st8_tl(shadow_val, test_ptr, 0); } + +static TCGHelperInfo libafl_exec_jmp_hook_info = { + .func = NULL, .name = "libafl_exec_jmp_hook", \ + .flags = dh_callflag(void), \ + .typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \ +}; + +struct libafl_jmp_hook* libafl_jmp_hooks; +size_t libafl_jmp_hooks_num = 0; + +size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst), + void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id), + uint64_t data) +{ + struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1); + hook->gen = gen; + hook->exec = exec; + hook->num = libafl_edge_hooks_num++; + hook->data = data; + hook->next = libafl_jmp_hooks; + libafl_jmp_hooks = hook; + + memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo)); + hook->helper_info.func = exec; + return hook->num; +} + +void libafl_gen_jmp(target_ulong src, target_ulong dst) +{ + + struct libafl_jmp_hook* hook = libafl_jmp_hooks; + while (hook) { + uint64_t cur_id = 0; + if (hook->gen) + cur_id = hook->gen(hook->data, src, dst); + if (cur_id != (uint64_t)-1 && hook->exec) { + TCGv_i64 tmp0 = tcg_constant_i64(hook->data); + TCGv_i64 tmp1 = tcg_constant_i64(src); + TCGv_i64 tmp2 = tcg_constant_i64(dst); + TCGv_i64 tmp3 = tcg_constant_i64(cur_id); + TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) }; + tcg_gen_callN(&hook->helper_info, NULL, tmp4); + tcg_temp_free_i64(tmp0); + tcg_temp_free_i64(tmp1); + tcg_temp_free_i64(tmp2); + tcg_temp_free_i64(tmp3); + } + hook = hook->next; + } +} + +void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst) +{ + struct libafl_jmp_hook* hook = libafl_jmp_hooks; + while (hook) { + uint64_t cur_id = 0; + if (hook->gen) + cur_id = hook->gen(hook->data, src, 0); // target is not statically known, signal with 0 + if (cur_id != (uint64_t)-1 && hook->exec) { + TCGv_i64 tmp0 = tcg_constant_i64(hook->data); + TCGv_i64 tmp1 = tcg_constant_i64(src); + // TCGv_i32 tmp2 = dst; + TCGv_i64 tmp3 = tcg_constant_i64(cur_id); + TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) }; + tcg_gen_callN(&hook->helper_info, NULL, tmp4); + tcg_temp_free_i64(tmp0); + tcg_temp_free_i64(tmp1); + //tcg_temp_free_i64(tmp2); + tcg_temp_free_i64(tmp3); + } + hook = hook->next; + } +} + +GEN_REMOVE_HOOK(jmp) \ No newline at end of file