SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fixed invalid addresses in read hooks (#70)

Browse Source 
* fix read hooks returning potentially wrong address
This commit is contained in:
saibotk 2024-05-03 11:27:56 +02:00 committed by GitHub
parent 538e6b02c3
commit 3ebc96e013
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 37 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
tcg/tcg-op-ldst.c
View File

@ -33,6 +33,25 @@
//// --- Begin LibAFL code --- //// --- Begin LibAFL code ---
/* Copied over from the plugin_maybe_preserve_addr function
* The variable needs to be free'd after use
*
* Only required for loads, where value might overlap addr.
*/
static TCGv_i64 libafl_gen_preserve_addr(TCGTemp *addr)
{
/* Save a copy of the vaddr for use after a load. */
TCGv_i64 temp = tcg_temp_ebb_new_i64();
if (tcg_ctx->addr_type == TCG_TYPE_I32) {
tcg_gen_extu_i32_i64(temp, temp_tcgv_i32(addr));
} else {
tcg_gen_mov_i64(temp, temp_tcgv_i64(addr));
}
return temp;
}
void libafl_gen_read(TCGTemp *addr, MemOpIdx oi); void libafl_gen_read(TCGTemp *addr, MemOpIdx oi);
void libafl_gen_write(TCGTemp *addr, MemOpIdx oi); void libafl_gen_write(TCGTemp *addr, MemOpIdx oi);
@ -208,12 +227,20 @@ static void tcg_gen_qemu_ld_i32_int(TCGv_i32 val, TCGTemp *addr,
} else { } else {
opc = INDEX_op_qemu_ld_a64_i32; opc = INDEX_op_qemu_ld_a64_i32;
} }
//// --- Begin LibAFL code ---
TCGv_i64 libafl_addr = libafl_gen_preserve_addr(addr);
//// --- End LibAFL code ---
gen_ldst(opc, tcgv_i32_temp(val), NULL, addr, oi); gen_ldst(opc, tcgv_i32_temp(val), NULL, addr, oi);
plugin_gen_mem_callbacks(copy_addr, addr, orig_oi, QEMU_PLUGIN_MEM_R); plugin_gen_mem_callbacks(copy_addr, addr, orig_oi, QEMU_PLUGIN_MEM_R);
//// --- Begin LibAFL code --- //// --- Begin LibAFL code ---
libafl_gen_read(addr, oi); libafl_gen_read(tcgv_i64_temp(libafl_addr), orig_oi);
tcg_temp_free_i64(libafl_addr);
//// --- End LibAFL code --- //// --- End LibAFL code ---
@ -341,12 +368,20 @@ static void tcg_gen_qemu_ld_i64_int(TCGv_i64 val, TCGTemp *addr,
} else { } else {
opc = INDEX_op_qemu_ld_a64_i64; opc = INDEX_op_qemu_ld_a64_i64;
} }
//// --- Begin LibAFL code ---
TCGv_i64 libafl_addr = libafl_gen_preserve_addr(addr);
//// --- End LibAFL code ---
gen_ldst_i64(opc, val, addr, oi); gen_ldst_i64(opc, val, addr, oi);
plugin_gen_mem_callbacks(copy_addr, addr, orig_oi, QEMU_PLUGIN_MEM_R); plugin_gen_mem_callbacks(copy_addr, addr, orig_oi, QEMU_PLUGIN_MEM_R);
//// --- Begin LibAFL code --- //// --- Begin LibAFL code ---
libafl_gen_read(addr, oi); libafl_gen_read(tcgv_i64_temp(libafl_addr), orig_oi);
tcg_temp_free_i64(libafl_addr);
//// --- End LibAFL code --- //// --- End LibAFL code ---