SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

rename symbols to fit with rust 2024. (#104)

Browse Source 
reformat code with more typedefs.
This commit is contained in:
Romain Malmain 2025-03-04 14:45:11 +01:00 committed by GitHub
parent 59ce9daf54
commit a86bd6bbcb
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
14 changed files with 173 additions and 168 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
accel/tcg/translate-all.c
View File

@ -285,7 +285,7 @@ static int setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
//// --- Begin LibAFL code --- //// --- Begin LibAFL code ---
libafl_qemu_hook_block_run(pc); libafl_qemu_hook_block_pre_run(pc);
//// --- End LibAFL code --- //// --- End LibAFL code ---
@ -717,7 +717,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
//// --- Begin LibAFL code --- //// --- Begin LibAFL code ---
libafl_qemu_hook_block_post_gen(tb, pc); libafl_qemu_hook_block_post_run(tb, pc);
//// --- End LibAFL code --- //// --- End LibAFL code ---

1
include/libafl/hook.h
View File

@ -54,6 +54,5 @@
// TODO: cleanup this // TODO: cleanup this
extern tcg_target_ulong libafl_gen_cur_pc; extern tcg_target_ulong libafl_gen_cur_pc;
extern size_t libafl_qemu_hooks_num;
void libafl_tcg_gen_asan(TCGTemp* addr, size_t size); void libafl_tcg_gen_asan(TCGTemp* addr, size_t size);

14
include/libafl/hooks/tcg/backdoor.h
View File

@ -10,10 +10,10 @@
#include "libafl/exit.h" #include "libafl/exit.h"
#include "libafl/hook.h" #include "libafl/hook.h"
struct libafl_backdoor_hook { typedef void (*libafl_backdoor_exec_cb)(uint64_t data, CPUArchState* cpu,
// functions target_ulong pc);
void (*gen)(uint64_t data, CPUArchState* cpu, target_ulong pc);
struct libafl_backdoor_hook {
// data // data
uint64_t data; uint64_t data;
size_t num; size_t num;
@ -25,13 +25,7 @@ struct libafl_backdoor_hook {
struct libafl_backdoor_hook* next; struct libafl_backdoor_hook* next;
}; };
extern struct libafl_backdoor_hook* libafl_backdoor_hooks; size_t libafl_add_backdoor_hook(libafl_backdoor_exec_cb exec_cb, uint64_t data);
void libafl_gen_backdoor(target_ulong pc);
size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, CPUArchState* cpu,
target_ulong pc),
uint64_t data);
int libafl_qemu_remove_backdoor_hook(size_t num, int invalidate); int libafl_qemu_remove_backdoor_hook(size_t num, int invalidate);

31
include/libafl/hooks/tcg/block.h
View File

@ -10,12 +10,20 @@
#include "libafl/exit.h" #include "libafl/exit.h"
#include "libafl/hook.h" #include "libafl/hook.h"
typedef uint64_t (*libafl_block_pre_gen_cb)(uint64_t data, target_ulong pc);
typedef void (*libafl_block_post_gen_cb)(uint64_t data, target_ulong pc,
target_ulong block_length);
typedef void (*libafl_block_exec_cb)(uint64_t data, uint64_t id);
typedef size_t (*libafl_block_jit_cb)(uint64_t data, uint64_t id);
struct libafl_block_hook { struct libafl_block_hook {
// functions // functions
uint64_t (*gen)(uint64_t data, target_ulong pc); libafl_block_pre_gen_cb pre_gen_cb;
void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length); libafl_block_post_gen_cb post_gen_cb;
size_t (*jit)(uint64_t data, uint64_t id); // optional opt libafl_block_jit_cb jit_cb; // optional opt
// data // data
uint64_t data; uint64_t data;
@ -28,16 +36,15 @@ struct libafl_block_hook {
struct libafl_block_hook* next; struct libafl_block_hook* next;
}; };
void libafl_qemu_hook_block_post_gen(TranslationBlock* tb, vaddr pc); size_t libafl_add_block_hook(libafl_block_pre_gen_cb pre_gen_cb,
void libafl_qemu_hook_block_run(target_ulong pc); libafl_block_post_gen_cb post_gen_cb,
libafl_block_exec_cb exec_cb, uint64_t data);
bool libafl_qemu_block_hook_set_jit( bool libafl_qemu_block_hook_set_jit(
size_t num, size_t num,
size_t (*jit)(uint64_t, libafl_block_jit_cb jit_cb); // no param names to avoid to be marked as safe
uint64_t)); // no param names to avoid to be marked as safe
int libafl_qemu_remove_block_hook(size_t num, int invalidate); int libafl_qemu_remove_block_hook(size_t num, int invalidate);
size_t libafl_add_block_hook(uint64_t (*gen)(uint64_t data, target_ulong pc),
void (*post_gen)(uint64_t data, target_ulong pc, void libafl_qemu_hook_block_pre_run(target_ulong pc);
target_ulong block_length), void libafl_qemu_hook_block_post_run(TranslationBlock* tb, vaddr pc);
void (*exec)(uint64_t data, uint64_t id),
uint64_t data);

26
include/libafl/hooks/tcg/cmp.h
View File

@ -10,9 +10,20 @@
#include "libafl/exit.h" #include "libafl/exit.h"
#include "libafl/hook.h" #include "libafl/hook.h"
typedef uint64_t (*libafl_cmp_gen_cb)(uint64_t data, target_ulong pc,
size_t size);
typedef void (*libafl_cmp_exec1_cb)(uint64_t data, uint64_t id, uint8_t v0,
uint8_t v1);
typedef void (*libafl_cmp_exec2_cb)(uint64_t data, uint64_t id, uint16_t v0,
uint16_t v1);
typedef void (*libafl_cmp_exec4_cb)(uint64_t data, uint64_t id, uint32_t v0,
uint32_t v1);
typedef void (*libafl_cmp_exec8_cb)(uint64_t data, uint64_t id, uint64_t v0,
uint64_t v1);
struct libafl_cmp_hook { struct libafl_cmp_hook {
// functions // functions
uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size); libafl_cmp_gen_cb gen_cb;
// data // data
uint64_t data; uint64_t data;
@ -29,11 +40,10 @@ struct libafl_cmp_hook {
}; };
void libafl_gen_cmp(target_ulong pc, TCGv op0, TCGv op1, MemOp ot); void libafl_gen_cmp(target_ulong pc, TCGv op0, TCGv op1, MemOp ot);
size_t libafl_add_cmp_hook( size_t libafl_add_cmp_hook(libafl_cmp_gen_cb gen_cb,
uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size), libafl_cmp_exec1_cb exec1_cb,
void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1), libafl_cmp_exec2_cb exec2_cb,
void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1), libafl_cmp_exec4_cb exec4_cb,
void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1), libafl_cmp_exec8_cb exec8_cb, uint64_t data);
void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1),
uint64_t data);
int libafl_qemu_remove_cmp_hook(size_t num, int invalidate); int libafl_qemu_remove_cmp_hook(size_t num, int invalidate);

18
include/libafl/hooks/tcg/edge.h
View File

@ -9,10 +9,15 @@
#include "libafl/exit.h" #include "libafl/exit.h"
#include "libafl/hook.h" #include "libafl/hook.h"
typedef uint64_t (*libafl_edge_gen_cb)(uint64_t data, target_ulong src,
target_ulong dst);
typedef void (*libafl_edge_exec_cb)(uint64_t data, uint64_t id);
typedef size_t (*libafl_edge_jit_cb)(uint64_t data, uint64_t id);
struct libafl_edge_hook { struct libafl_edge_hook {
// functions // functions
uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst); libafl_edge_gen_cb gen_cb;
size_t (*jit)(uint64_t data, uint64_t id); // optional opt libafl_edge_jit_cb jit_cb; // optional opt
// data // data
uint64_t data; uint64_t data;
@ -31,15 +36,12 @@ TranslationBlock* libafl_gen_edge(CPUState* cpu, target_ulong src_block,
target_ulong cs_base, uint32_t flags, target_ulong cs_base, uint32_t flags,
int cflags); int cflags);
size_t libafl_add_edge_hook(uint64_t (*gen)(uint64_t data, target_ulong src, size_t libafl_add_edge_hook(libafl_edge_gen_cb gen_cb,
target_ulong dst), libafl_edge_exec_cb exec_cb, uint64_t data);
void (*exec)(uint64_t data, uint64_t id),
uint64_t data);
bool libafl_qemu_edge_hook_set_jit( bool libafl_qemu_edge_hook_set_jit(
size_t num, size_t num,
size_t (*jit)(uint64_t, libafl_edge_jit_cb jit_cb); // no param names to avoid to be marked as safe
uint64_t)); // no param names to avoid to be marked as safe
int libafl_qemu_remove_edge_hook(size_t num, int invalidate); int libafl_qemu_remove_edge_hook(size_t num, int invalidate);

21
include/libafl/hooks/tcg/read_write.h
View File

@ -21,7 +21,7 @@ typedef void (*libafl_rw_execN_cb)(uint64_t data, uint64_t id, target_ulong pc,
struct libafl_rw_hook { struct libafl_rw_hook {
// functions // functions
libafl_rw_gen_cb gen; libafl_rw_gen_cb gen_cb;
// data // data
uint64_t data; uint64_t data;
@ -41,15 +41,18 @@ struct libafl_rw_hook {
void libafl_gen_read(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi); void libafl_gen_read(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
void libafl_gen_write(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi); void libafl_gen_write(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi);
size_t libafl_add_read_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1, size_t libafl_add_read_hook(libafl_rw_gen_cb gen_cb, libafl_rw_exec_cb exec1_cb,
libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4, libafl_rw_exec_cb exec2_cb,
libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN, libafl_rw_exec_cb exec4_cb,
uint64_t data); libafl_rw_exec_cb exec8_cb,
libafl_rw_execN_cb execN_cb, uint64_t data);
size_t libafl_add_write_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1, size_t libafl_add_write_hook(libafl_rw_gen_cb gen_cb,
libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4, libafl_rw_exec_cb exec1_cb,
libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN, libafl_rw_exec_cb exec2_cb,
uint64_t data); libafl_rw_exec_cb exec4_cb,
libafl_rw_exec_cb exec8_cb,
libafl_rw_execN_cb execN_cb, uint64_t data);
int libafl_qemu_remove_read_hook(size_t num, int invalidate); int libafl_qemu_remove_read_hook(size_t num, int invalidate);
int libafl_qemu_remove_write_hook(size_t num, int invalidate); int libafl_qemu_remove_write_hook(size_t num, int invalidate);

10
libafl/hooks/tcg/backdoor.c
View File

@ -1,8 +1,8 @@
#include "libafl/tcg.h" #include "libafl/tcg.h"
#include "libafl/hooks/tcg/backdoor.h" #include "libafl/hooks/tcg/backdoor.h"
struct libafl_backdoor_hook* libafl_backdoor_hooks; static struct libafl_backdoor_hook* libafl_backdoor_hooks;
size_t libafl_backdoor_hooks_num = 0; static size_t libafl_backdoor_hooks_num = 0;
static TCGHelperInfo libafl_exec_backdoor_hook_info = { static TCGHelperInfo libafl_exec_backdoor_hook_info = {
.func = NULL, .func = NULL,
@ -13,9 +13,7 @@ static TCGHelperInfo libafl_exec_backdoor_hook_info = {
GEN_REMOVE_HOOK(backdoor) GEN_REMOVE_HOOK(backdoor)
size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, CPUArchState* cpu, size_t libafl_add_backdoor_hook(libafl_backdoor_exec_cb exec_cb, uint64_t data)
target_ulong pc),
uint64_t data)
{ {
struct libafl_backdoor_hook* hook = struct libafl_backdoor_hook* hook =
calloc(sizeof(struct libafl_backdoor_hook), 1); calloc(sizeof(struct libafl_backdoor_hook), 1);
@ -27,7 +25,7 @@ size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, CPUArchState* cpu,
memcpy(&hook->helper_info, &libafl_exec_backdoor_hook_info, memcpy(&hook->helper_info, &libafl_exec_backdoor_hook_info,
sizeof(TCGHelperInfo)); sizeof(TCGHelperInfo));
hook->helper_info.func = exec; hook->helper_info.func = exec_cb;
return hook->num; return hook->num;
} }

46
libafl/hooks/tcg/block.c
View File

@ -1,8 +1,8 @@
#include "libafl/tcg.h" #include "libafl/tcg.h"
#include "libafl/hooks/tcg/block.h" #include "libafl/hooks/tcg/block.h"
struct libafl_block_hook* libafl_block_hooks; static struct libafl_block_hook* libafl_block_hooks;
size_t libafl_block_hooks_num = 0; static size_t libafl_block_hooks_num = 0;
static TCGHelperInfo libafl_exec_block_hook_info = { static TCGHelperInfo libafl_exec_block_hook_info = {
.func = NULL, .func = NULL,
@ -13,68 +13,64 @@ static TCGHelperInfo libafl_exec_block_hook_info = {
GEN_REMOVE_HOOK(block) GEN_REMOVE_HOOK(block)
size_t libafl_add_block_hook(uint64_t (*gen)(uint64_t data, target_ulong pc), size_t libafl_add_block_hook(libafl_block_pre_gen_cb pre_gen_cb,
void (*post_gen)(uint64_t data, target_ulong pc, libafl_block_post_gen_cb post_gen_cb,
target_ulong block_length), libafl_block_exec_cb exec_cb, uint64_t data)
void (*exec)(uint64_t data, uint64_t id),
uint64_t data)
{ {
CPUState* cpu; CPUState* cpu;
CPU_FOREACH(cpu) { tb_flush(cpu); } CPU_FOREACH(cpu) { tb_flush(cpu); }
struct libafl_block_hook* hook = struct libafl_block_hook* hook =
calloc(sizeof(struct libafl_block_hook), 1); calloc(sizeof(struct libafl_block_hook), 1);
hook->gen = gen; hook->pre_gen_cb = pre_gen_cb;
hook->post_gen = post_gen; hook->post_gen_cb = post_gen_cb;
// hook->exec = exec;
hook->data = data; hook->data = data;
hook->num = libafl_block_hooks_num++; hook->num = libafl_block_hooks_num++;
hook->next = libafl_block_hooks; hook->next = libafl_block_hooks;
libafl_block_hooks = hook; libafl_block_hooks = hook;
if (exec) { if (exec_cb) {
memcpy(&hook->helper_info, &libafl_exec_block_hook_info, memcpy(&hook->helper_info, &libafl_exec_block_hook_info,
sizeof(TCGHelperInfo)); sizeof(TCGHelperInfo));
hook->helper_info.func = exec; hook->helper_info.func = exec_cb;
} }
return hook->num; return hook->num;
} }
bool libafl_qemu_block_hook_set_jit(size_t num, bool libafl_qemu_block_hook_set_jit(size_t num, libafl_block_jit_cb jit_cb)
size_t (*jit)(uint64_t data, uint64_t id))
{ {
struct libafl_block_hook* hk = libafl_block_hooks; struct libafl_block_hook* hk = libafl_block_hooks;
while (hk) { while (hk) {
if (hk->num == num) { if (hk->num == num) {
hk->jit = jit; hk->jit_cb = jit_cb;
return true; return true;
} else {
hk = hk->next;
} }
hk = hk->next;
} }
return false; return false;
} }
void libafl_qemu_hook_block_post_gen(TranslationBlock* tb, vaddr pc) void libafl_qemu_hook_block_post_run(TranslationBlock* tb, vaddr pc)
{ {
struct libafl_block_hook* hook = libafl_block_hooks; struct libafl_block_hook* hook = libafl_block_hooks;
while (hook) { while (hook) {
if (hook->post_gen) if (hook->post_gen_cb)
hook->post_gen(hook->data, pc, tb->size); hook->post_gen_cb(hook->data, pc, tb->size);
hook = hook->next; hook = hook->next;
} }
} }
void libafl_qemu_hook_block_run(target_ulong pc) void libafl_qemu_hook_block_pre_run(target_ulong pc)
{ {
struct libafl_block_hook* hook = libafl_block_hooks; struct libafl_block_hook* hook = libafl_block_hooks;
while (hook) { while (hook) {
uint64_t cur_id = 0; uint64_t cur_id = 0;
if (hook->gen) { if (hook->pre_gen_cb) {
cur_id = hook->gen(hook->data, pc); cur_id = hook->pre_gen_cb(hook->data, pc);
} }
if (cur_id != (uint64_t)-1 && hook->helper_info.func) { if (cur_id != (uint64_t)-1 && hook->helper_info.func) {
@ -87,8 +83,8 @@ void libafl_qemu_hook_block_run(target_ulong pc)
tcg_temp_free_i64(tmp1); tcg_temp_free_i64(tmp1);
} }
if (cur_id != (uint64_t)-1 && hook->jit) { if (cur_id != (uint64_t)-1 && hook->jit_cb) {
hook->jit(hook->data, cur_id); hook->jit_cb(hook->data, cur_id);
} }
hook = hook->next; hook = hook->next;

42
libafl/hooks/tcg/cmp.c
View File

@ -1,8 +1,8 @@
#include "libafl/tcg.h" #include "libafl/tcg.h"
#include "libafl/hooks/tcg/cmp.h" #include "libafl/hooks/tcg/cmp.h"
struct libafl_cmp_hook* libafl_cmp_hooks; static struct libafl_cmp_hook* libafl_cmp_hooks;
size_t libafl_cmp_hooks_num = 0; static size_t libafl_cmp_hooks_num = 0;
static TCGHelperInfo libafl_exec_cmp_hook1_info = { static TCGHelperInfo libafl_exec_cmp_hook1_info = {
.func = NULL, .func = NULL,
@ -32,47 +32,41 @@ static TCGHelperInfo libafl_exec_cmp_hook8_info = {
GEN_REMOVE_HOOK(cmp) GEN_REMOVE_HOOK(cmp)
size_t libafl_add_cmp_hook( size_t libafl_add_cmp_hook(libafl_cmp_gen_cb gen_cb,
uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size), libafl_cmp_exec1_cb exec1_cb,
void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1), libafl_cmp_exec2_cb exec2_cb,
void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1), libafl_cmp_exec4_cb exec4_cb,
void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1), libafl_cmp_exec8_cb exec8_cb, uint64_t data)
void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1),
uint64_t data)
{ {
CPUState* cpu; CPUState* cpu;
CPU_FOREACH(cpu) { tb_flush(cpu); } CPU_FOREACH(cpu) { tb_flush(cpu); }
struct libafl_cmp_hook* hook = calloc(sizeof(struct libafl_cmp_hook), 1); struct libafl_cmp_hook* hook = calloc(sizeof(struct libafl_cmp_hook), 1);
hook->gen = gen; hook->gen_cb = gen_cb;
/*hook->exec1 = exec1;
hook->exec2 = exec2;
hook->exec4 = exec4;
hook->exec8 = exec8;*/
hook->data = data; hook->data = data;
hook->num = libafl_cmp_hooks_num++; hook->num = libafl_cmp_hooks_num++;
hook->next = libafl_cmp_hooks; hook->next = libafl_cmp_hooks;
libafl_cmp_hooks = hook; libafl_cmp_hooks = hook;
if (exec1) { if (exec1_cb) {
memcpy(&hook->helper_info1, &libafl_exec_cmp_hook1_info, memcpy(&hook->helper_info1, &libafl_exec_cmp_hook1_info,
sizeof(TCGHelperInfo)); sizeof(TCGHelperInfo));
hook->helper_info1.func = exec1; hook->helper_info1.func = exec1_cb;
} }
if (exec2) { if (exec2_cb) {
memcpy(&hook->helper_info2, &libafl_exec_cmp_hook2_info, memcpy(&hook->helper_info2, &libafl_exec_cmp_hook2_info,
sizeof(TCGHelperInfo)); sizeof(TCGHelperInfo));
hook->helper_info2.func = exec2; hook->helper_info2.func = exec2_cb;
} }
if (exec4) { if (exec4_cb) {
memcpy(&hook->helper_info4, &libafl_exec_cmp_hook4_info, memcpy(&hook->helper_info4, &libafl_exec_cmp_hook4_info,
sizeof(TCGHelperInfo)); sizeof(TCGHelperInfo));
hook->helper_info4.func = exec4; hook->helper_info4.func = exec4_cb;
} }
if (exec8) { if (exec8_cb) {
memcpy(&hook->helper_info8, &libafl_exec_cmp_hook8_info, memcpy(&hook->helper_info8, &libafl_exec_cmp_hook8_info,
sizeof(TCGHelperInfo)); sizeof(TCGHelperInfo));
hook->helper_info8.func = exec8; hook->helper_info8.func = exec8_cb;
} }
return hook->num; return hook->num;
@ -101,8 +95,8 @@ void libafl_gen_cmp(target_ulong pc, TCGv op0, TCGv op1, MemOp ot)
struct libafl_cmp_hook* hook = libafl_cmp_hooks; struct libafl_cmp_hook* hook = libafl_cmp_hooks;
while (hook) { while (hook) {
uint64_t cur_id = 0; uint64_t cur_id = 0;
if (hook->gen) if (hook->gen_cb)
cur_id = hook->gen(hook->data, pc, size); cur_id = hook->gen_cb(hook->data, pc, size);
TCGHelperInfo* info = NULL; TCGHelperInfo* info = NULL;
if (size == 1 && hook->helper_info1.func) if (size == 1 && hook->helper_info1.func)
info = &hook->helper_info1; info = &hook->helper_info1;

35
libafl/hooks/tcg/edge.c
View File

@ -1,8 +1,8 @@
#include "libafl/tcg.h" #include "libafl/tcg.h"
#include "libafl/hooks/tcg/edge.h" #include "libafl/hooks/tcg/edge.h"
struct libafl_edge_hook* libafl_edge_hooks; static struct libafl_edge_hook* libafl_edge_hooks;
size_t libafl_edge_hooks_num = 0; static size_t libafl_edge_hooks_num = 0;
static TCGHelperInfo libafl_exec_edge_hook_info = { static TCGHelperInfo libafl_exec_edge_hook_info = {
.func = NULL, .func = NULL,
@ -13,42 +13,39 @@ static TCGHelperInfo libafl_exec_edge_hook_info = {
GEN_REMOVE_HOOK(edge) GEN_REMOVE_HOOK(edge)
size_t libafl_add_edge_hook(uint64_t (*gen)(uint64_t data, target_ulong src, size_t libafl_add_edge_hook(libafl_edge_gen_cb gen_cb,
target_ulong dst), libafl_edge_exec_cb exec_cb, uint64_t data)
void (*exec)(uint64_t data, uint64_t id),
uint64_t data)
{ {
CPUState* cpu; CPUState* cpu;
CPU_FOREACH(cpu) { tb_flush(cpu); } CPU_FOREACH(cpu) { tb_flush(cpu); }
struct libafl_edge_hook* hook = calloc(sizeof(struct libafl_edge_hook), 1); struct libafl_edge_hook* hook = calloc(sizeof(struct libafl_edge_hook), 1);
hook->gen = gen; hook->gen_cb = gen_cb;
// hook->exec = exec; // hook->exec = exec;
hook->data = data; hook->data = data;
hook->num = libafl_edge_hooks_num++; hook->num = libafl_edge_hooks_num++;
hook->next = libafl_edge_hooks; hook->next = libafl_edge_hooks;
libafl_edge_hooks = hook; libafl_edge_hooks = hook;
if (exec) { if (exec_cb) {
memcpy(&hook->helper_info, &libafl_exec_edge_hook_info, memcpy(&hook->helper_info, &libafl_exec_edge_hook_info,
sizeof(TCGHelperInfo)); sizeof(TCGHelperInfo));
hook->helper_info.func = exec; hook->helper_info.func = exec_cb;
} }
return hook->num; return hook->num;
} }
bool libafl_qemu_edge_hook_set_jit(size_t num, bool libafl_qemu_edge_hook_set_jit(size_t num, libafl_edge_jit_cb jit_cb)
size_t (*jit)(uint64_t data, uint64_t id))
{ {
struct libafl_edge_hook* hk = libafl_edge_hooks; struct libafl_edge_hook* hk = libafl_edge_hooks;
while (hk) { while (hk) {
if (hk->num == num) { if (hk->num == num) {
hk->jit = jit; hk->jit_cb = jit_cb;
return true; return true;
} else {
hk = hk->next;
} }
hk = hk->next;
} }
return false; return false;
} }
@ -61,12 +58,12 @@ bool libafl_qemu_hook_edge_gen(target_ulong src_block, target_ulong dst_block)
while (hook) { while (hook) {
hook->cur_id = 0; hook->cur_id = 0;
if (hook->gen) { if (hook->gen_cb) {
hook->cur_id = hook->gen(hook->data, src_block, dst_block); hook->cur_id = hook->gen_cb(hook->data, src_block, dst_block);
} }
if (hook->cur_id != (uint64_t)-1 && if (hook->cur_id != (uint64_t)-1 &&
(hook->helper_info.func || hook->jit)) { (hook->helper_info.func || hook->jit_cb)) {
no_exec_hook = false; no_exec_hook = false;
} }
@ -90,8 +87,8 @@ void libafl_qemu_hook_edge_run(void)
tcg_temp_free_i64(tmp0); tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1); tcg_temp_free_i64(tmp1);
} }
if (hook->cur_id != (uint64_t)-1 && hook->jit) { if (hook->cur_id != (uint64_t)-1 && hook->jit_cb) {
hook->jit(hook->data, hook->cur_id); hook->jit_cb(hook->data, hook->cur_id);
} }
hook = hook->next; hook = hook->next;
} }

9
libafl/hooks/tcg/instruction.c
View File

@ -11,12 +11,13 @@ static TCGHelperInfo libafl_instruction_info = {
}; };
tcg_target_ulong libafl_gen_cur_pc; tcg_target_ulong libafl_gen_cur_pc;
struct libafl_instruction_hook*
static struct libafl_instruction_hook*
libafl_qemu_instruction_hooks[LIBAFL_TABLES_SIZE]; libafl_qemu_instruction_hooks[LIBAFL_TABLES_SIZE];
size_t libafl_qemu_hooks_num = 0; static size_t libafl_qemu_hooks_num = 0;
size_t libafl_qemu_add_instruction_hooks(target_ulong pc, size_t libafl_qemu_add_instruction_hooks(target_ulong pc,
libafl_instruction_cb callback, libafl_instruction_cb exec_cb,
uint64_t data, int invalidate) uint64_t data, int invalidate)
{ {
CPUState* cpu; CPUState* cpu;
@ -32,7 +33,7 @@ size_t libafl_qemu_add_instruction_hooks(target_ulong pc,
hk->addr = pc; hk->addr = pc;
hk->data = data; hk->data = data;
hk->helper_info = libafl_instruction_info; hk->helper_info = libafl_instruction_info;
hk->helper_info.func = callback; hk->helper_info.func = exec_cb;
// TODO check for overflow // TODO check for overflow
hk->num = libafl_qemu_hooks_num++; hk->num = libafl_qemu_hooks_num++;
hk->next = libafl_qemu_instruction_hooks[idx]; hk->next = libafl_qemu_instruction_hooks[idx];

83
libafl/hooks/tcg/read_write.c
View File

@ -6,11 +6,11 @@
#include "libafl/cpu.h" #include "libafl/cpu.h"
#include "libafl/hook.h" #include "libafl/hook.h"
struct libafl_rw_hook* libafl_read_hooks; static struct libafl_rw_hook* libafl_read_hooks;
size_t libafl_read_hooks_num = 0; static size_t libafl_read_hooks_num = 0;
struct libafl_rw_hook* libafl_write_hooks; static struct libafl_rw_hook* libafl_write_hooks;
size_t libafl_write_hooks_num = 0; static size_t libafl_write_hooks_num = 0;
#define TYPEMASK_RW_SIZED \ #define TYPEMASK_RW_SIZED \
(dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | \ (dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | \
@ -93,70 +93,73 @@ GEN_REMOVE_HOOK(write)
static size_t static size_t
libafl_add_rw_hook(struct libafl_rw_hook** hooks, size_t* hooks_num, libafl_add_rw_hook(struct libafl_rw_hook** hooks, size_t* hooks_num,
libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1, libafl_rw_gen_cb gen_cb, libafl_rw_exec_cb exec1_cb,
TCGHelperInfo* exec1_info, libafl_rw_exec_cb exec2, TCGHelperInfo* exec1_info, libafl_rw_exec_cb exec2_cb,
TCGHelperInfo* exec2_info, libafl_rw_exec_cb exec4, TCGHelperInfo* exec2_info, libafl_rw_exec_cb exec4_cb,
TCGHelperInfo* exec4_info, libafl_rw_exec_cb exec8, TCGHelperInfo* exec4_info, libafl_rw_exec_cb exec8_cb,
TCGHelperInfo* exec8_info, libafl_rw_execN_cb execN, TCGHelperInfo* exec8_info, libafl_rw_execN_cb execN_cb,
TCGHelperInfo* execN_info, uint64_t data) TCGHelperInfo* execN_info, uint64_t data)
{ {
CPUState* cpu; CPUState* cpu;
CPU_FOREACH(cpu) { tb_flush(cpu); } CPU_FOREACH(cpu) { tb_flush(cpu); }
struct libafl_rw_hook* hook = calloc(sizeof(struct libafl_rw_hook), 1); struct libafl_rw_hook* hook = calloc(sizeof(struct libafl_rw_hook), 1);
hook->gen = gen; hook->gen_cb = gen_cb;
hook->data = data; hook->data = data;
hook->num = (*hooks_num)++; hook->num = (*hooks_num)++;
hook->next = *hooks; hook->next = *hooks;
*hooks = hook; *hooks = hook;
if (exec1) { if (exec1_cb) {
memcpy(&hook->helper_info1, exec1_info, sizeof(TCGHelperInfo)); memcpy(&hook->helper_info1, exec1_info, sizeof(TCGHelperInfo));
hook->helper_info1.func = exec1; hook->helper_info1.func = exec1_cb;
} }
if (exec2) { if (exec2_cb) {
memcpy(&hook->helper_info2, exec2_info, sizeof(TCGHelperInfo)); memcpy(&hook->helper_info2, exec2_info, sizeof(TCGHelperInfo));
hook->helper_info2.func = exec2; hook->helper_info2.func = exec2_cb;
} }
if (exec4) { if (exec4_cb) {
memcpy(&hook->helper_info4, exec4_info, sizeof(TCGHelperInfo)); memcpy(&hook->helper_info4, exec4_info, sizeof(TCGHelperInfo));
hook->helper_info4.func = exec4; hook->helper_info4.func = exec4_cb;
} }
if (exec8) { if (exec8_cb) {
memcpy(&hook->helper_info8, exec8_info, sizeof(TCGHelperInfo)); memcpy(&hook->helper_info8, exec8_info, sizeof(TCGHelperInfo));
hook->helper_info8.func = exec8; hook->helper_info8.func = exec8_cb;
} }
if (execN) { if (execN_cb) {
memcpy(&hook->helper_infoN, execN_info, sizeof(TCGHelperInfo)); memcpy(&hook->helper_infoN, execN_info, sizeof(TCGHelperInfo));
hook->helper_infoN.func = execN; hook->helper_infoN.func = execN_cb;
} }
return hook->num; return hook->num;
} }
size_t libafl_add_read_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1, size_t libafl_add_read_hook(libafl_rw_gen_cb gen_cb, libafl_rw_exec_cb exec1_cb,
libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4, libafl_rw_exec_cb exec2_cb,
libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN, libafl_rw_exec_cb exec4_cb,
uint64_t data) libafl_rw_exec_cb exec8_cb,
libafl_rw_execN_cb execN_cb, uint64_t data)
{ {
return libafl_add_rw_hook(&libafl_read_hooks, &libafl_read_hooks_num, gen, return libafl_add_rw_hook(&libafl_read_hooks, &libafl_read_hooks_num,
exec1, &libafl_exec_read_hook1_info, exec2, gen_cb, exec1_cb, &libafl_exec_read_hook1_info,
&libafl_exec_read_hook2_info, exec4, exec2_cb, &libafl_exec_read_hook2_info, exec4_cb,
&libafl_exec_read_hook4_info, exec8, &libafl_exec_read_hook4_info, exec8_cb,
&libafl_exec_read_hook8_info, execN, &libafl_exec_read_hook8_info, execN_cb,
&libafl_exec_read_hookN_info, data); &libafl_exec_read_hookN_info, data);
} }
size_t libafl_add_write_hook(libafl_rw_gen_cb gen, libafl_rw_exec_cb exec1, size_t libafl_add_write_hook(libafl_rw_gen_cb gen_cb,
libafl_rw_exec_cb exec2, libafl_rw_exec_cb exec4, libafl_rw_exec_cb exec1_cb,
libafl_rw_exec_cb exec8, libafl_rw_execN_cb execN, libafl_rw_exec_cb exec2_cb,
uint64_t data) libafl_rw_exec_cb exec4_cb,
libafl_rw_exec_cb exec8_cb,
libafl_rw_execN_cb execN_cb, uint64_t data)
{ {
return libafl_add_rw_hook(&libafl_write_hooks, &libafl_write_hooks_num, gen, return libafl_add_rw_hook(&libafl_write_hooks, &libafl_write_hooks_num,
exec1, &libafl_exec_write_hook1_info, exec2, gen_cb, exec1_cb, &libafl_exec_write_hook1_info,
&libafl_exec_write_hook2_info, exec4, exec2_cb, &libafl_exec_write_hook2_info, exec4_cb,
&libafl_exec_write_hook4_info, exec8, &libafl_exec_write_hook4_info, exec8_cb,
&libafl_exec_write_hook8_info, execN, &libafl_exec_write_hook8_info, execN_cb,
&libafl_exec_write_hookN_info, data); &libafl_exec_write_hookN_info, data);
} }
@ -168,8 +171,8 @@ static void libafl_gen_rw(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi,
while (hook) { while (hook) {
uint64_t cur_id = 0; uint64_t cur_id = 0;
if (hook->gen) { if (hook->gen_cb) {
cur_id = hook->gen(hook->data, libafl_gen_cur_pc, addr, oi); cur_id = hook->gen_cb(hook->data, libafl_gen_cur_pc, addr, oi);
} }
TCGHelperInfo* info = NULL; TCGHelperInfo* info = NULL;

1
target/i386/kvm/kvm.c
View File

@ -5649,6 +5649,7 @@ static int kvm_handle_debug(X86CPU *cpu,
} else if (kvm_find_sw_breakpoint(cs, arch_info->pc)) { } else if (kvm_find_sw_breakpoint(cs, arch_info->pc)) {
ret = EXCP_DEBUG; ret = EXCP_DEBUG;
} }
if (ret == 0) { if (ret == 0) {
cpu_synchronize_state(cs); cpu_synchronize_state(cs);
assert(env->exception_nr == -1); assert(env->exception_nr == -1);