SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

move instrumentation to hook file

Browse Source
This commit is contained in:
Alwin Berger 2024-06-18 15:57:11 +02:00
parent b67c9ae8ab
commit 34b08c8b88
3 changed files with 97 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
accel/tcg/translate-all.c
View File

@ -67,93 +67,7 @@
#include "tcg/insn-start-words.h"
//// --- Begin LibAFL code ---
#include "libafl/hook.h"
static TCGHelperInfo libafl_exec_jmp_hook_info = {
.func = NULL, .name = "libafl_exec_jmp_hook", \
.flags = dh_callflag(void), \
.typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \
};
struct libafl_jmp_hook {
uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
uint64_t data;
TCGHelperInfo helper_info;
struct libafl_jmp_hook* next;
};
struct libafl_jmp_hook* libafl_jmp_hooks;
void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data);
void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data)
{
struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
hook->gen = gen;
hook->exec = exec;
hook->data = data;
hook->next = libafl_jmp_hooks;
libafl_jmp_hooks = hook;
memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
hook->helper_info.func = exec;
}
void libafl_gen_jmp(target_ulong src, target_ulong dst);
void libafl_gen_jmp(target_ulong src, target_ulong dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, dst);
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
TCGv_i64 tmp2 = tcg_constant_i64(dst);
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
// Use an indirect jump target
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst);
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, 0); // target is not statically known, signal with 0
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
// TCGv_i32 tmp2 = dst;
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
//tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
//// --- End LibAFL code ---
TBContext tb_ctx;

21
include/libafl/hook.h
View File

@ -224,3 +224,24 @@ size_t libafl_add_new_thread_hook(bool (*callback)(uint64_t data, uint32_t tid),
int libafl_qemu_remove_new_thread_hook(size_t num);
void libafl_tcg_gen_asan(TCGTemp * addr, size_t size);
struct libafl_jmp_hook {
uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
uint64_t data;
size_t num;
TCGHelperInfo helper_info;
struct libafl_jmp_hook* next;
};
extern struct libafl_jmp_hook* libafl_jmp_hooks;
size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data);
void libafl_gen_jmp(target_ulong src, target_ulong dst);
// Use an indirect jump target
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst);
int libafl_qemu_remove_jmp_hook(size_t num, int invalidate);

75
libafl/hook.c
View File

@ -743,3 +743,78 @@ void libafl_tcg_gen_asan(TCGTemp * addr, size_t size)
tcg_gen_tl_ptr(test_ptr, test_addr);
tcg_gen_st8_tl(shadow_val, test_ptr, 0);
}
static TCGHelperInfo libafl_exec_jmp_hook_info = {
.func = NULL, .name = "libafl_exec_jmp_hook", \
.flags = dh_callflag(void), \
.typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \
};
struct libafl_jmp_hook* libafl_jmp_hooks;
size_t libafl_jmp_hooks_num = 0;
size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data)
{
struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
hook->gen = gen;
hook->exec = exec;
hook->num = libafl_edge_hooks_num++;
hook->data = data;
hook->next = libafl_jmp_hooks;
libafl_jmp_hooks = hook;
memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
hook->helper_info.func = exec;
return hook->num;
}
void libafl_gen_jmp(target_ulong src, target_ulong dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, dst);
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
TCGv_i64 tmp2 = tcg_constant_i64(dst);
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, 0); // target is not statically known, signal with 0
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
// TCGv_i32 tmp2 = dst;
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
//tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
GEN_REMOVE_HOOK(jmp)