yannick.naumann/RT-Task-Generator-QEMU
1
0
Fork 0
forked from alwin.berger/FRET-qemu
Code Pull Requests Activity

fix jmp instrumentation

Browse Source
This commit is contained in:
Alwin Berger 2024-01-16 15:53:38 +01:00
parent 349d96795b
commit 0cda19cbcf
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
accel/tcg/translate-all.c
View File

@ -77,8 +77,8 @@ static TCGHelperInfo libafl_exec_jmp_hook_info = {
}; };
struct libafl_jmp_hook { struct libafl_jmp_hook {
uint64_t (*gen)(target_ulong src, target_ulong dst, uint64_t data); uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
void (*exec)(target_ulong src, target_ulong dst, uint64_t id, uint64_t data); void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
uint64_t data; uint64_t data;
TCGHelperInfo helper_info; TCGHelperInfo helper_info;
struct libafl_jmp_hook* next; struct libafl_jmp_hook* next;
@ -86,11 +86,11 @@ struct libafl_jmp_hook {
struct libafl_jmp_hook* libafl_jmp_hooks; struct libafl_jmp_hook* libafl_jmp_hooks;
void libafl_add_jmp_hook(uint64_t (*gen)(target_ulong src, target_ulong dst, uint64_t data), void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(target_ulong src, target_ulong dst, uint64_t id, uint64_t data), void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data); uint64_t data);
void libafl_add_jmp_hook(uint64_t (*gen)(target_ulong src, target_ulong dst, uint64_t data), void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
void (*exec)(target_ulong src, target_ulong dst, uint64_t id, uint64_t data), void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
uint64_t data) uint64_t data)
{ {
struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1); struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
@ -112,12 +112,12 @@ void libafl_gen_jmp(target_ulong src, target_ulong dst)
while (hook) { while (hook) {
uint64_t cur_id = 0; uint64_t cur_id = 0;
if (hook->gen) if (hook->gen)
cur_id = hook->gen(src, dst, hook->data); cur_id = hook->gen(hook->data, src, dst);
if (cur_id != (uint64_t)-1 && hook->exec) { if (cur_id != (uint64_t)-1 && hook->exec) {
TCGv_i64 tmp0 = tcg_constant_i64(src); TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
TCGv_i64 tmp1 = tcg_constant_i64(dst); TCGv_i64 tmp1 = tcg_constant_i64(src);
TCGv_i64 tmp2 = tcg_constant_i64(cur_id); TCGv_i64 tmp2 = tcg_constant_i64(dst);
TCGv_i64 tmp3 = tcg_constant_i64(hook->data); TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) }; TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
tcg_gen_callN(&hook->helper_info, NULL, tmp4); tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0); tcg_temp_free_i64(tmp0);