#include "qemu/osdep.h" #include "qapi/error.h" #include "exec/exec-all.h" #include "exec/tb-flush.h" #include "hook.h" #include "exit.h" #ifndef TARGET_LONG_BITS #error "TARGET_LONG_BITS not defined" #endif target_ulong libafl_gen_cur_pc; struct libafl_hook* libafl_qemu_hooks[LIBAFL_TABLES_SIZE]; size_t libafl_qemu_hooks_num = 0; size_t libafl_qemu_set_hook(target_ulong pc, void (*callback)(uint64_t data, target_ulong pc), uint64_t data, int invalidate) { CPUState *cpu; if (invalidate) { CPU_FOREACH(cpu) { libafl_breakpoint_invalidate(cpu, pc); } } size_t idx = LIBAFL_TABLES_HASH(pc); struct libafl_hook* hk = calloc(sizeof(struct libafl_hook), 1); hk->addr = pc; // hk->callback = callback; hk->data = data; hk->helper_info.func = callback; hk->helper_info.name = "libafl_hook"; hk->helper_info.flags = dh_callflag(void); hk->helper_info.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(tl, 2); // TODO check for overflow hk->num = libafl_qemu_hooks_num++; hk->next = libafl_qemu_hooks[idx]; libafl_qemu_hooks[idx] = hk; return hk->num; } size_t libafl_qemu_remove_hooks_at(target_ulong addr, int invalidate) { CPUState *cpu; size_t r = 0; size_t idx = LIBAFL_TABLES_HASH(addr); struct libafl_hook** hk = &libafl_qemu_hooks[idx]; while (*hk) { if ((*hk)->addr == addr) { if (invalidate) { CPU_FOREACH(cpu) { libafl_breakpoint_invalidate(cpu, addr); } } void *tmp = *hk; *hk = (*hk)->next; free(tmp); r++; } else { hk = &(*hk)->next; } } return r; } int libafl_qemu_remove_hook(size_t num, int invalidate) { CPUState *cpu; size_t idx; for (idx = 0; idx < LIBAFL_TABLES_SIZE; ++idx) { struct libafl_hook** hk = &libafl_qemu_hooks[idx]; while (*hk) { if ((*hk)->num == num) { if (invalidate) { CPU_FOREACH(cpu) { libafl_breakpoint_invalidate(cpu, (*hk)->addr); } } void *tmp = *hk; *hk = (*hk)->next; free(tmp); return 1; } else { hk = &(*hk)->next; } } } return 0; } struct libafl_hook* libafl_search_hook(target_ulong addr) { size_t idx = LIBAFL_TABLES_HASH(addr); struct libafl_hook* hk = libafl_qemu_hooks[idx]; while (hk) { if (hk->addr == addr) { return hk; } hk = hk->next; } return NULL; } #define GEN_REMOVE_HOOK(name) \ int libafl_qemu_remove_##name##_hook(size_t num, int invalidate) \ { \ CPUState *cpu; \ struct libafl_##name##_hook** hk = &libafl_##name##_hooks; \ \ while (*hk) { \ if ((*hk)->num == num) { \ if (invalidate) { \ CPU_FOREACH(cpu) { \ tb_flush(cpu); \ } \ } \ \ void *tmp = *hk; \ *hk = (*hk)->next; \ free(tmp); \ return 1; \ } else { \ hk = &(*hk)->next; \ } \ } \ \ return 0; \ } #define GEN_REMOVE_HOOK1(name) \ int libafl_qemu_remove_##name##_hook(size_t num) \ { \ struct libafl_##name##_hook** hk = &libafl_##name##_hooks; \ \ while (*hk) { \ if ((*hk)->num == num) { \ void *tmp = *hk; \ *hk = (*hk)->next; \ free(tmp); \ return 1; \ } else { \ hk = &(*hk)->next; \ } \ } \ \ return 0; \ } static TCGHelperInfo libafl_exec_backdoor_hook_info = { .func = NULL, .name = "libafl_exec_backdoor_hook", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(tl, 2) }; struct libafl_backdoor_hook* libafl_backdoor_hooks; size_t libafl_backdoor_hooks_num = 0; size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, target_ulong pc), uint64_t data) { struct libafl_backdoor_hook* hook = calloc(sizeof(struct libafl_backdoor_hook), 1); // hook->exec = exec; hook->data = data; hook->num = libafl_backdoor_hooks_num++; hook->next = libafl_backdoor_hooks; libafl_backdoor_hooks = hook; memcpy(&hook->helper_info, &libafl_exec_backdoor_hook_info, sizeof(TCGHelperInfo)); hook->helper_info.func = exec; return hook->num; } GEN_REMOVE_HOOK(backdoor) static TCGHelperInfo libafl_exec_edge_hook_info = { .func = NULL, .name = "libafl_exec_edge_hook", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) }; struct libafl_edge_hook* libafl_edge_hooks; size_t libafl_edge_hooks_num = 0; size_t libafl_add_edge_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst), void (*exec)(uint64_t data, uint64_t id), uint64_t data) { CPUState *cpu; CPU_FOREACH(cpu) { tb_flush(cpu); } struct libafl_edge_hook* hook = calloc(sizeof(struct libafl_edge_hook), 1); hook->gen = gen; // hook->exec = exec; hook->data = data; hook->num = libafl_edge_hooks_num++; hook->next = libafl_edge_hooks; libafl_edge_hooks = hook; if (exec) { memcpy(&hook->helper_info, &libafl_exec_edge_hook_info, sizeof(TCGHelperInfo)); hook->helper_info.func = exec; } return hook->num; } GEN_REMOVE_HOOK(edge) static TCGHelperInfo libafl_exec_block_hook_info = { .func = NULL, .name = "libafl_exec_block_hook", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) }; struct libafl_block_hook* libafl_block_hooks; size_t libafl_block_hooks_num = 0; size_t libafl_add_block_hook(uint64_t (*gen)(uint64_t data, target_ulong pc), void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length), void (*exec)(uint64_t data, uint64_t id), uint64_t data) { CPUState *cpu; CPU_FOREACH(cpu) { tb_flush(cpu); } struct libafl_block_hook* hook = calloc(sizeof(struct libafl_block_hook), 1); hook->gen = gen; hook->post_gen = post_gen; // hook->exec = exec; hook->data = data; hook->num = libafl_block_hooks_num++; hook->next = libafl_block_hooks; libafl_block_hooks = hook; if (exec) { memcpy(&hook->helper_info, &libafl_exec_block_hook_info, sizeof(TCGHelperInfo)); hook->helper_info.func = exec; } return hook->num; } GEN_REMOVE_HOOK(block) static TCGHelperInfo libafl_exec_read_hook1_info = { .func = NULL, .name = "libafl_exec_read_hook1", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) }; static TCGHelperInfo libafl_exec_read_hook2_info = { .func = NULL, .name = "libafl_exec_read_hook2", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) }; static TCGHelperInfo libafl_exec_read_hook4_info = { .func = NULL, .name = "libafl_exec_read_hook4", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) }; static TCGHelperInfo libafl_exec_read_hook8_info = { .func = NULL, .name = "libafl_exec_read_hook8", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) }; static TCGHelperInfo libafl_exec_read_hookN_info = { .func = NULL, .name = "libafl_exec_read_hookN", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(i64, 4) }; static TCGHelperInfo libafl_exec_write_hook1_info = { .func = NULL, .name = "libafl_exec_write_hook1", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) }; static TCGHelperInfo libafl_exec_write_hook2_info = { .func = NULL, .name = "libafl_exec_write_hook2", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) }; static TCGHelperInfo libafl_exec_write_hook4_info = { .func = NULL, .name = "libafl_exec_write_hook4", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) }; static TCGHelperInfo libafl_exec_write_hook8_info = { .func = NULL, .name = "libafl_exec_write_hook8", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) }; static TCGHelperInfo libafl_exec_write_hookN_info = { .func = NULL, .name = "libafl_exec_write_hookN", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(i64, 4) }; struct libafl_rw_hook* libafl_read_hooks; size_t libafl_read_hooks_num = 0; size_t libafl_add_read_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, MemOpIdx oi), void (*exec1)(uint64_t data, uint64_t id, target_ulong addr), void (*exec2)(uint64_t data, uint64_t id, target_ulong addr), void (*exec4)(uint64_t data, uint64_t id, target_ulong addr), void (*exec8)(uint64_t data, uint64_t id, target_ulong addr), void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size), uint64_t data) { CPUState *cpu; CPU_FOREACH(cpu) { tb_flush(cpu); } struct libafl_rw_hook* hook = calloc(sizeof(struct libafl_rw_hook), 1); hook->gen = gen; /*hook->exec1 = exec1; hook->exec2 = exec2; hook->exec4 = exec4; hook->exec8 = exec8; hook->execN = execN;*/ hook->data = data; hook->num = libafl_read_hooks_num++; hook->next = libafl_read_hooks; libafl_read_hooks = hook; if (exec1) { memcpy(&hook->helper_info1, &libafl_exec_read_hook1_info, sizeof(TCGHelperInfo)); hook->helper_info1.func = exec1; } if (exec2) { memcpy(&hook->helper_info2, &libafl_exec_read_hook2_info, sizeof(TCGHelperInfo)); hook->helper_info2.func = exec2; } if (exec4) { memcpy(&hook->helper_info4, &libafl_exec_read_hook4_info, sizeof(TCGHelperInfo)); hook->helper_info4.func = exec4; } if (exec8) { memcpy(&hook->helper_info8, &libafl_exec_read_hook8_info, sizeof(TCGHelperInfo)); hook->helper_info8.func = exec8; } if (execN) { memcpy(&hook->helper_infoN, &libafl_exec_read_hookN_info, sizeof(TCGHelperInfo)); hook->helper_infoN.func = execN; } return hook->num; } GEN_REMOVE_HOOK(read) struct libafl_rw_hook* libafl_write_hooks; size_t libafl_write_hooks_num = 0; size_t libafl_add_write_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, MemOpIdx oi), void (*exec1)(uint64_t data, uint64_t id, target_ulong addr), void (*exec2)(uint64_t data, uint64_t id, target_ulong addr), void (*exec4)(uint64_t data, uint64_t id, target_ulong addr), void (*exec8)(uint64_t data, uint64_t id, target_ulong addr), void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size), uint64_t data) { CPUState *cpu; CPU_FOREACH(cpu) { tb_flush(cpu); } struct libafl_rw_hook* hook = calloc(sizeof(struct libafl_rw_hook), 1); hook->gen = gen; /*hook->exec1 = exec1; hook->exec2 = exec2; hook->exec4 = exec4; hook->exec8 = exec8; hook->execN = execN;*/ hook->data = data; hook->num = libafl_write_hooks_num++; hook->next = libafl_write_hooks; libafl_write_hooks = hook; if (exec1) { memcpy(&hook->helper_info1, &libafl_exec_write_hook1_info, sizeof(TCGHelperInfo)); hook->helper_info1.func = exec1; } if (exec2) { memcpy(&hook->helper_info2, &libafl_exec_write_hook2_info, sizeof(TCGHelperInfo)); hook->helper_info2.func = exec2; } if (exec4) { memcpy(&hook->helper_info4, &libafl_exec_write_hook4_info, sizeof(TCGHelperInfo)); hook->helper_info4.func = exec4; } if (exec8) { memcpy(&hook->helper_info8, &libafl_exec_write_hook8_info, sizeof(TCGHelperInfo)); hook->helper_info8.func = exec8; } if (execN) { memcpy(&hook->helper_infoN, &libafl_exec_write_hookN_info, sizeof(TCGHelperInfo)); hook->helper_infoN.func = execN; } return hook->num; } GEN_REMOVE_HOOK(write) static void libafl_gen_rw(TCGTemp *addr, MemOpIdx oi, struct libafl_rw_hook* hook) { size_t size = memop_size(get_memop(oi)); while (hook) { uint64_t cur_id = 0; if (hook->gen) cur_id = hook->gen(hook->data, libafl_gen_cur_pc, oi); TCGHelperInfo* info = NULL; if (size == 1 && hook->helper_info1.func) info = &hook->helper_info1; else if (size == 2 && hook->helper_info2.func) info = &hook->helper_info2; else if (size == 4 && hook->helper_info4.func) info = &hook->helper_info4; else if (size == 8 && hook->helper_info8.func) info = &hook->helper_info8; if (cur_id != (uint64_t)-1) { if (info) { TCGv_i64 tmp0 = tcg_constant_i64(hook->data); TCGv_i64 tmp1 = tcg_constant_i64(cur_id); TCGTemp *tmp2[3] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), addr }; tcg_gen_callN(info, NULL, tmp2); tcg_temp_free_i64(tmp0); tcg_temp_free_i64(tmp1); } else if (hook->helper_infoN.func) { TCGv_i64 tmp0 = tcg_constant_i64(hook->data); TCGv_i64 tmp1 = tcg_constant_i64(cur_id); TCGv tmp2 = tcg_constant_tl(size); TCGTemp *tmp3[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), addr, #if TARGET_LONG_BITS == 32 tcgv_i32_temp(tmp2) }; #else tcgv_i64_temp(tmp2) }; #endif tcg_gen_callN(&hook->helper_infoN, NULL, tmp3); tcg_temp_free_i64(tmp0); tcg_temp_free_i64(tmp1); #if TARGET_LONG_BITS == 32 tcg_temp_free_i32(tmp2); #else tcg_temp_free_i64(tmp2); #endif } } hook = hook->next; } } void libafl_gen_read(TCGTemp *addr, MemOpIdx oi) { libafl_gen_rw(addr, oi, libafl_read_hooks); } void libafl_gen_write(TCGTemp *addr, MemOpIdx oi) { libafl_gen_rw(addr, oi, libafl_write_hooks); } static TCGHelperInfo libafl_exec_cmp_hook1_info = { .func = NULL, .name = "libafl_exec_cmp_hook1", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(tl, 4) }; static TCGHelperInfo libafl_exec_cmp_hook2_info = { .func = NULL, .name = "libafl_exec_cmp_hook2", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(tl, 4) }; static TCGHelperInfo libafl_exec_cmp_hook4_info = { .func = NULL, .name = "libafl_exec_cmp_hook4", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(tl, 4) }; static TCGHelperInfo libafl_exec_cmp_hook8_info = { .func = NULL, .name = "libafl_exec_cmp_hook8", \ .flags = dh_callflag(void), \ .typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4) }; struct libafl_cmp_hook* libafl_cmp_hooks; size_t libafl_cmp_hooks_num = 0; size_t libafl_add_cmp_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size), void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1), void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1), void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1), void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1), uint64_t data) { CPUState *cpu; CPU_FOREACH(cpu) { tb_flush(cpu); } struct libafl_cmp_hook* hook = calloc(sizeof(struct libafl_cmp_hook), 1); hook->gen = gen; /*hook->exec1 = exec1; hook->exec2 = exec2; hook->exec4 = exec4; hook->exec8 = exec8;*/ hook->data = data; hook->num = libafl_cmp_hooks_num++; hook->next = libafl_cmp_hooks; libafl_cmp_hooks = hook; if (exec1) { memcpy(&hook->helper_info1, &libafl_exec_cmp_hook1_info, sizeof(TCGHelperInfo)); hook->helper_info1.func = exec1; } if (exec2) { memcpy(&hook->helper_info2, &libafl_exec_cmp_hook2_info, sizeof(TCGHelperInfo)); hook->helper_info2.func = exec2; } if (exec4) { memcpy(&hook->helper_info4, &libafl_exec_cmp_hook4_info, sizeof(TCGHelperInfo)); hook->helper_info4.func = exec4; } if (exec8) { memcpy(&hook->helper_info8, &libafl_exec_cmp_hook8_info, sizeof(TCGHelperInfo)); hook->helper_info8.func = exec8; } return hook->num; } GEN_REMOVE_HOOK(cmp) void libafl_gen_cmp(target_ulong pc, TCGv op0, TCGv op1, MemOp ot) { size_t size = 0; switch (ot & MO_SIZE) { case MO_64: size = 8; break; case MO_32: size = 4; break; case MO_16: size = 2; break; case MO_8: size = 1; break; default: return; } struct libafl_cmp_hook* hook = libafl_cmp_hooks; while (hook) { uint64_t cur_id = 0; if (hook->gen) cur_id = hook->gen(hook->data, pc, size); TCGHelperInfo* info = NULL; if (size == 1 && hook->helper_info1.func) info = &hook->helper_info1; else if (size == 2 && hook->helper_info2.func) info = &hook->helper_info2; else if (size == 4 && hook->helper_info4.func) info = &hook->helper_info4; else if (size == 8 && hook->helper_info8.func) info = &hook->helper_info8; if (cur_id != (uint64_t)-1 && info) { TCGv_i64 tmp0 = tcg_constant_i64(hook->data); TCGv_i64 tmp1 = tcg_constant_i64(cur_id); TCGTemp *tmp2[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), #if TARGET_LONG_BITS == 32 tcgv_i32_temp(op0), tcgv_i32_temp(op1) }; #else tcgv_i64_temp(op0), tcgv_i64_temp(op1) }; #endif tcg_gen_callN(info, NULL, tmp2); tcg_temp_free_i64(tmp0); tcg_temp_free_i64(tmp1); } hook = hook->next; } } struct libafl_pre_syscall_hook* libafl_pre_syscall_hooks; struct libafl_post_syscall_hook* libafl_post_syscall_hooks; size_t libafl_pre_syscall_hooks_num = 0; size_t libafl_post_syscall_hooks_num = 0; size_t libafl_add_pre_syscall_hook(struct syshook_ret (*callback)( uint64_t data, int sys_num, target_ulong arg0, target_ulong arg1, target_ulong arg2, target_ulong arg3, target_ulong arg4, target_ulong arg5, target_ulong arg6, target_ulong arg7), uint64_t data) { struct libafl_pre_syscall_hook* hook = calloc(sizeof(struct libafl_pre_syscall_hook), 1); hook->callback = callback; hook->data = data; hook->num = libafl_pre_syscall_hooks_num++; hook->next = libafl_pre_syscall_hooks; libafl_pre_syscall_hooks = hook; return hook->num; } size_t libafl_add_post_syscall_hook(target_ulong (*callback)( uint64_t data, target_ulong ret, int sys_num, target_ulong arg0, target_ulong arg1, target_ulong arg2, target_ulong arg3, target_ulong arg4, target_ulong arg5, target_ulong arg6, target_ulong arg7), uint64_t data) { struct libafl_post_syscall_hook* hook = calloc(sizeof(struct libafl_post_syscall_hook), 1); hook->callback = callback; hook->data = data; hook->num = libafl_post_syscall_hooks_num++; hook->next = libafl_post_syscall_hooks; libafl_post_syscall_hooks = hook; return hook->num; } GEN_REMOVE_HOOK1(pre_syscall) GEN_REMOVE_HOOK1(post_syscall) struct libafl_new_thread_hook* libafl_new_thread_hooks; size_t libafl_new_thread_hooks_num = 0; size_t libafl_add_new_thread_hook(bool (*callback)(uint64_t data, uint32_t tid), uint64_t data) { struct libafl_new_thread_hook* hook = calloc(sizeof(struct libafl_new_thread_hook), 1); hook->callback = callback; hook->data = data; hook->num = libafl_new_thread_hooks_num++; hook->next = libafl_new_thread_hooks; libafl_new_thread_hooks = hook; return hook->num; } GEN_REMOVE_HOOK1(new_thread)