yannick.naumann/RT-Task-Generator-QEMU
1
0
Fork 0
forked from alwin.berger/FRET-qemu
Code Pull Requests Activity

fix jmp instrumentation

Browse Source
This commit is contained in:
Alwin Berger 2023-09-18 10:59:41 +02:00
parent b2feee86a4
commit cb70307812
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
accel/tcg/translate-all.c
View File

@ -73,7 +73,7 @@
static TCGHelperInfo libafl_exec_jmp_hook_info = { static TCGHelperInfo libafl_exec_jmp_hook_info = {
.func = NULL, .name = "libafl_exec_jmp_hook", \ .func = NULL, .name = "libafl_exec_jmp_hook", \
.flags = dh_callflag(void), \ .flags = dh_callflag(void), \
.typemask = dh_typemask(void, 0) | dh_typemask(tl, 2) | dh_typemask(i64, 1) .typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \
}; };
struct libafl_jmp_hook { struct libafl_jmp_hook {
@ -93,7 +93,7 @@ void libafl_add_jmp_hook(uint64_t (*gen)(target_ulong src, target_ulong dst, uin
void (*exec)(target_ulong src, target_ulong dst, uint64_t id, uint64_t data), void (*exec)(target_ulong src, target_ulong dst, uint64_t id, uint64_t data),
uint64_t data) uint64_t data)
{ {
struct libafl_jmp_hook* hook = malloc(sizeof(struct libafl_jmp_hook)); struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
hook->gen = gen; hook->gen = gen;
hook->exec = exec; hook->exec = exec;
hook->data = data; hook->data = data;
@ -102,7 +102,6 @@ void libafl_add_jmp_hook(uint64_t (*gen)(target_ulong src, target_ulong dst, uin
memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo)); memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
hook->helper_info.func = exec; hook->helper_info.func = exec;
//libafl_helper_table_add(&hook->helper_info);
} }
void libafl_gen_jmp(target_ulong src, target_ulong dst); void libafl_gen_jmp(target_ulong src, target_ulong dst);
@ -114,14 +113,13 @@ void libafl_gen_jmp(target_ulong src, target_ulong dst)
uint64_t cur_id = 0; uint64_t cur_id = 0;
if (hook->gen) if (hook->gen)
cur_id = hook->gen(src, dst, hook->data); cur_id = hook->gen(src, dst, hook->data);
void* func = hook->exec; if (cur_id != (uint64_t)-1 && hook->exec) {
if (cur_id != (uint64_t)-1 && func) {
TCGv_i64 tmp0 = tcg_constant_i64(src); TCGv_i64 tmp0 = tcg_constant_i64(src);
TCGv_i64 tmp1 = tcg_constant_i64(dst); TCGv_i64 tmp1 = tcg_constant_i64(dst);
TCGv_i64 tmp2 = tcg_constant_i64(cur_id); TCGv_i64 tmp2 = tcg_constant_i64(cur_id);
TCGv_i64 tmp3 = tcg_constant_i64(hook->data); TCGv_i64 tmp3 = tcg_constant_i64(hook->data);
TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) }; TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
tcg_gen_callN(func, NULL, tmp4); tcg_gen_callN(&hook->helper_info, NULL, tmp4);
tcg_temp_free_i64(tmp0); tcg_temp_free_i64(tmp0);
tcg_temp_free_i64(tmp1); tcg_temp_free_i64(tmp1);
tcg_temp_free_i64(tmp2); tcg_temp_free_i64(tmp2);