add jmp instrumentation
This commit is contained in:
parent
32206d23c3
commit
6b7718f671
@ -70,6 +70,67 @@
|
||||
|
||||
#include "libafl_extras/hook.h"
|
||||
|
||||
static TCGHelperInfo libafl_exec_jmp_hook_info = {
|
||||
.func = NULL, .name = "libafl_exec_jmp_hook", \
|
||||
.flags = dh_callflag(void), \
|
||||
.typemask = dh_typemask(void, 0) | dh_typemask(tl, 2) | dh_typemask(i64, 1)
|
||||
};
|
||||
|
||||
struct libafl_jmp_hook {
|
||||
uint64_t (*gen)(target_ulong src, target_ulong dst, uint64_t data);
|
||||
void (*exec)(target_ulong src, target_ulong dst, uint64_t id, uint64_t data);
|
||||
uint64_t data;
|
||||
TCGHelperInfo helper_info;
|
||||
struct libafl_jmp_hook* next;
|
||||
};
|
||||
|
||||
struct libafl_jmp_hook* libafl_jmp_hooks;
|
||||
|
||||
void libafl_add_jmp_hook(uint64_t (*gen)(target_ulong src, target_ulong dst, uint64_t data),
|
||||
void (*exec)(target_ulong src, target_ulong dst, uint64_t id, uint64_t data),
|
||||
uint64_t data);
|
||||
void libafl_add_jmp_hook(uint64_t (*gen)(target_ulong src, target_ulong dst, uint64_t data),
|
||||
void (*exec)(target_ulong src, target_ulong dst, uint64_t id, uint64_t data),
|
||||
uint64_t data)
|
||||
{
|
||||
struct libafl_jmp_hook* hook = malloc(sizeof(struct libafl_jmp_hook));
|
||||
hook->gen = gen;
|
||||
hook->exec = exec;
|
||||
hook->data = data;
|
||||
hook->next = libafl_jmp_hooks;
|
||||
libafl_jmp_hooks = hook;
|
||||
|
||||
memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
|
||||
hook->helper_info.func = exec;
|
||||
libafl_helper_table_add(&hook->helper_info);
|
||||
}
|
||||
|
||||
void libafl_gen_jmp(target_ulong src, target_ulong dst);
|
||||
void libafl_gen_jmp(target_ulong src, target_ulong dst)
|
||||
{
|
||||
|
||||
struct libafl_jmp_hook* hook = libafl_jmp_hooks;
|
||||
while (hook) {
|
||||
uint64_t cur_id = 0;
|
||||
if (hook->gen)
|
||||
cur_id = hook->gen(src, dst, hook->data);
|
||||
void* func = hook->exec;
|
||||
if (cur_id != (uint64_t)-1 && func) {
|
||||
TCGv_i64 tmp0 = tcg_const_i64(src);
|
||||
TCGv_i64 tmp1 = tcg_const_i64(dst);
|
||||
TCGv_i64 tmp2 = tcg_const_i64(cur_id);
|
||||
TCGv_i64 tmp3 = tcg_const_i64(hook->data);
|
||||
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
|
||||
tcg_gen_callN(func, NULL,4, tmp4);
|
||||
tcg_temp_free_i64(tmp0);
|
||||
tcg_temp_free_i64(tmp1);
|
||||
tcg_temp_free_i64(tmp2);
|
||||
tcg_temp_free_i64(tmp3);
|
||||
}
|
||||
hook = hook->next;
|
||||
}
|
||||
}
|
||||
|
||||
//// --- End LibAFL code ---
|
||||
|
||||
TBContext tb_ctx;
|
||||
|
@ -2602,8 +2602,14 @@ static void gen_jmp_tb(DisasContext *s, target_long diff, int tbno)
|
||||
}
|
||||
}
|
||||
|
||||
//// --- Begin LibAFL code ---
|
||||
void libafl_gen_jmp(target_ulong src, target_ulong dst); // see translate-all.c
|
||||
//// --- End LibAFL code ---
|
||||
static inline void gen_jmp(DisasContext *s, target_long diff)
|
||||
{
|
||||
//// --- Begin LibAFL code ---
|
||||
libafl_gen_jmp(s->pc_curr,s->pc_curr+diff);
|
||||
//// --- End LibAFL code ---
|
||||
gen_jmp_tb(s, diff, 0);
|
||||
}
|
||||
|
||||
|
Loading…
x
Reference in New Issue
Block a user