SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

move instrumentation to hook file

Browse Source
This commit is contained in:
Alwin Berger 2024-06-18 15:57:11 +02:00
parent acc2e70812
commit 7f3f2188bd
3 changed files with 287 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
accel/tcg/translate-all.c
View File

@ -156,6 +156,7 @@ void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
} }
} }
#include "libafl/hook.h"
//// --- End LibAFL code --- //// --- End LibAFL code ---
TBContext tb_ctx; TBContext tb_ctx;

211
include/libafl/hook.h
View File

@ -56,3 +56,214 @@
extern tcg_target_ulong libafl_gen_cur_pc; extern tcg_target_ulong libafl_gen_cur_pc;
void libafl_tcg_gen_asan(TCGTemp* addr, size_t size); void libafl_tcg_gen_asan(TCGTemp* addr, size_t size);
size_t libafl_qemu_set_hook(target_ulong pc, void (*callback)(uint64_t data, target_ulong pc),
uint64_t data, int invalidate);
size_t libafl_qemu_remove_hooks_at(target_ulong addr, int invalidate);
int libafl_qemu_remove_hook(size_t num, int invalidate);
struct libafl_hook* libafl_search_hook(target_ulong addr);
struct libafl_backdoor_hook {
void (*exec)(uint64_t data, CPUArchState* cpu, target_ulong pc);
uint64_t data;
size_t num;
TCGHelperInfo helper_info;
struct libafl_backdoor_hook* next;
};
extern struct libafl_backdoor_hook* libafl_backdoor_hooks;
size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, CPUArchState* cpu, target_ulong pc),
uint64_t data);
int libafl_qemu_remove_backdoor_hook(size_t num, int invalidate);
struct libafl_edge_hook {
uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
// void (*exec)(uint64_t data, uint64_t id);
size_t (*jit)(uint64_t data, uint64_t id); // optional opt
uint64_t data;
size_t num;
uint64_t cur_id;
TCGHelperInfo helper_info;
struct libafl_edge_hook* next;
};
extern struct libafl_edge_hook* libafl_edge_hooks;
size_t libafl_add_edge_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, uint64_t id),
uint64_t data);
int libafl_qemu_remove_edge_hook(size_t num, int invalidate);
bool libafl_qemu_edge_hook_set_jit(size_t num, size_t (*jit)(uint64_t, uint64_t)); // no param names to avoid to be marked as safe
struct libafl_block_hook {
uint64_t (*gen)(uint64_t data, target_ulong pc);
void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length);
// void (*exec)(uint64_t data, uint64_t id);
size_t (*jit)(uint64_t data, uint64_t id); // optional opt
uint64_t data;
size_t num;
TCGHelperInfo helper_info;
struct libafl_block_hook* next;
};
extern struct libafl_block_hook* libafl_block_hooks;
size_t libafl_add_block_hook(uint64_t (*gen)(uint64_t data, target_ulong pc),
void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length),
void (*exec)(uint64_t data, uint64_t id), uint64_t data);
int libafl_qemu_remove_block_hook(size_t num, int invalidate);
bool libafl_qemu_block_hook_set_jit(size_t num, size_t (*jit)(uint64_t, uint64_t)); // no param names to avoid to be marked as safe
struct libafl_rw_hook {
uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi);
/*void (*exec1)(uint64_t data, uint64_t id, target_ulong addr);
void (*exec2)(uint64_t data, uint64_t id, target_ulong addr);
void (*exec4)(uint64_t data, uint64_t id, target_ulong addr);
void (*exec8)(uint64_t data, uint64_t id, target_ulong addr);
void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size);*/
uint64_t data;
size_t num;
TCGHelperInfo helper_info1;
TCGHelperInfo helper_info2;
TCGHelperInfo helper_info4;
TCGHelperInfo helper_info8;
TCGHelperInfo helper_infoN;
struct libafl_rw_hook* next;
};
// alias
#define libafl_read_hook libafl_rw_hook
#define libafl_write_hook libafl_rw_hook
extern struct libafl_rw_hook* libafl_read_hooks;
extern struct libafl_rw_hook* libafl_write_hooks;
size_t libafl_add_read_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp *addr, MemOpIdx oi),
void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
uint64_t data);
size_t libafl_add_write_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp *addr, MemOpIdx oi),
void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
uint64_t data);
int libafl_qemu_remove_read_hook(size_t num, int invalidate);
int libafl_qemu_remove_write_hook(size_t num, int invalidate);
void libafl_gen_read(TCGTemp *addr, MemOpIdx oi);
void libafl_gen_write(TCGTemp *addr, MemOpIdx oi);
struct libafl_cmp_hook {
uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size);
/*void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1);
void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1);
void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1);
void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1);*/
uint64_t data;
size_t num;
TCGHelperInfo helper_info1;
TCGHelperInfo helper_info2;
TCGHelperInfo helper_info4;
TCGHelperInfo helper_info8;
struct libafl_cmp_hook* next;
};
extern struct libafl_cmp_hook* libafl_cmp_hooks;
size_t libafl_add_cmp_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size),
void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1),
void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1),
void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1),
void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1),
uint64_t data);
int libafl_qemu_remove_cmp_hook(size_t num, int invalidate);
struct syshook_ret {
target_ulong retval;
bool skip_syscall;
};
struct libafl_pre_syscall_hook {
struct syshook_ret (*callback)(uint64_t data, int sys_num, target_ulong arg0,
target_ulong arg1, target_ulong arg2,
target_ulong arg3, target_ulong arg4,
target_ulong arg5, target_ulong arg6,
target_ulong arg7);
uint64_t data;
size_t num;
struct libafl_pre_syscall_hook* next;
};
struct libafl_post_syscall_hook {
target_ulong (*callback)(uint64_t data, target_ulong ret, int sys_num,
target_ulong arg0, target_ulong arg1,
target_ulong arg2, target_ulong arg3,
target_ulong arg4, target_ulong arg5,
target_ulong arg6, target_ulong arg7);
uint64_t data;
size_t num;
struct libafl_post_syscall_hook* next;
};
extern struct libafl_pre_syscall_hook* libafl_pre_syscall_hooks;
extern struct libafl_post_syscall_hook* libafl_post_syscall_hooks;
size_t libafl_add_pre_syscall_hook(struct syshook_ret (*callback)(
uint64_t data, int sys_num, target_ulong arg0,
target_ulong arg1, target_ulong arg2,
target_ulong arg3, target_ulong arg4,
target_ulong arg5, target_ulong arg6,
target_ulong arg7),
uint64_t data);
size_t libafl_add_post_syscall_hook(target_ulong (*callback)(
uint64_t data, target_ulong ret, int sys_num,
target_ulong arg0, target_ulong arg1,
target_ulong arg2, target_ulong arg3,
target_ulong arg4, target_ulong arg5,
target_ulong arg6, target_ulong arg7),
uint64_t data);
int libafl_qemu_remove_pre_syscall_hook(size_t num);
int libafl_qemu_remove_post_syscall_hook(size_t num);
struct libafl_new_thread_hook {
bool (*callback)(uint64_t data, uint32_t tid);
uint64_t data;
size_t num;
struct libafl_new_thread_hook* next;
};
extern struct libafl_new_thread_hook* libafl_new_thread_hooks;
size_t libafl_add_new_thread_hook(bool (*callback)(uint64_t data, uint32_t tid),
uint64_t data);
int libafl_qemu_remove_new_thread_hook(size_t num);
void libafl_tcg_gen_asan(TCGTemp * addr, size_t size);
struct libafl_jmp_hook {
uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
uint64_t data;
size_t num;
TCGHelperInfo helper_info;
struct libafl_jmp_hook* next;
};
extern struct libafl_jmp_hook* libafl_jmp_hooks;
size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data);
void libafl_gen_jmp(target_ulong src, target_ulong dst);
// Use an indirect jump target
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst);
int libafl_qemu_remove_jmp_hook(size_t num, int invalidate);

75
libafl/hook.c
View File

@ -64,3 +64,78 @@ void libafl_tcg_gen_asan(TCGTemp* addr, size_t size)
tcg_gen_tl_ptr(test_ptr, test_addr); tcg_gen_tl_ptr(test_ptr, test_addr);
tcg_gen_st8_tl(shadow_val, test_ptr, 0); tcg_gen_st8_tl(shadow_val, test_ptr, 0);
} }
static TCGHelperInfo libafl_exec_jmp_hook_info = {
.func = NULL, .name = "libafl_exec_jmp_hook", \
.flags = dh_callflag(void), \
.typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \
};
struct libafl_jmp_hook* libafl_jmp_hooks;
size_t libafl_jmp_hooks_num = 0;
size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data)
{
struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
hook->gen = gen;
hook->exec = exec;
hook->num = libafl_edge_hooks_num++;
hook->data = data;
hook->next = libafl_jmp_hooks;
libafl_jmp_hooks = hook;
memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
hook->helper_info.func = exec;
return hook->num;
}
void libafl_gen_jmp(target_ulong src, target_ulong dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, dst);
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
TCGv_i64 tmp2 = tcg_constant_i64(dst);
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
{
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
while (hook) {
uint64_t cur_id = 0;
if (hook->gen)
cur_id = hook->gen(hook->data, src, 0); // target is not statically known, signal with 0
if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(src);
// TCGv_i32 tmp2 = dst;
TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1);
//tcg_temp_free_i64(tmp2);
tcg_temp_free_i64(tmp3);
}
hook = hook->next;
}
}
GEN_REMOVE_HOOK(jmp)