131 lines
4.2 KiB
C
131 lines
4.2 KiB
C
#include "libafl/tcg.h"
|
|
#include "libafl/hooks/tcg/cmp.h"
|
|
|
|
struct libafl_cmp_hook* libafl_cmp_hooks;
|
|
size_t libafl_cmp_hooks_num = 0;
|
|
|
|
static TCGHelperInfo libafl_exec_cmp_hook1_info = {
|
|
.func = NULL,
|
|
.name = "libafl_exec_cmp_hook1",
|
|
.flags = dh_callflag(void),
|
|
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
|
|
dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(tl, 4)};
|
|
static TCGHelperInfo libafl_exec_cmp_hook2_info = {
|
|
.func = NULL,
|
|
.name = "libafl_exec_cmp_hook2",
|
|
.flags = dh_callflag(void),
|
|
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
|
|
dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(tl, 4)};
|
|
static TCGHelperInfo libafl_exec_cmp_hook4_info = {
|
|
.func = NULL,
|
|
.name = "libafl_exec_cmp_hook4",
|
|
.flags = dh_callflag(void),
|
|
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
|
|
dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(tl, 4)};
|
|
static TCGHelperInfo libafl_exec_cmp_hook8_info = {
|
|
.func = NULL,
|
|
.name = "libafl_exec_cmp_hook8",
|
|
.flags = dh_callflag(void),
|
|
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) |
|
|
dh_typemask(i64, 2) | dh_typemask(i64, 3) |
|
|
dh_typemask(i64, 4)};
|
|
|
|
GEN_REMOVE_HOOK(cmp)
|
|
|
|
size_t libafl_add_cmp_hook(
|
|
uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size),
|
|
void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1),
|
|
void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1),
|
|
void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1),
|
|
void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1),
|
|
uint64_t data)
|
|
{
|
|
CPUState* cpu;
|
|
CPU_FOREACH(cpu) { tb_flush(cpu); }
|
|
|
|
struct libafl_cmp_hook* hook = calloc(sizeof(struct libafl_cmp_hook), 1);
|
|
hook->gen = gen;
|
|
/*hook->exec1 = exec1;
|
|
hook->exec2 = exec2;
|
|
hook->exec4 = exec4;
|
|
hook->exec8 = exec8;*/
|
|
hook->data = data;
|
|
hook->num = libafl_cmp_hooks_num++;
|
|
hook->next = libafl_cmp_hooks;
|
|
libafl_cmp_hooks = hook;
|
|
|
|
if (exec1) {
|
|
memcpy(&hook->helper_info1, &libafl_exec_cmp_hook1_info,
|
|
sizeof(TCGHelperInfo));
|
|
hook->helper_info1.func = exec1;
|
|
}
|
|
if (exec2) {
|
|
memcpy(&hook->helper_info2, &libafl_exec_cmp_hook2_info,
|
|
sizeof(TCGHelperInfo));
|
|
hook->helper_info2.func = exec2;
|
|
}
|
|
if (exec4) {
|
|
memcpy(&hook->helper_info4, &libafl_exec_cmp_hook4_info,
|
|
sizeof(TCGHelperInfo));
|
|
hook->helper_info4.func = exec4;
|
|
}
|
|
if (exec8) {
|
|
memcpy(&hook->helper_info8, &libafl_exec_cmp_hook8_info,
|
|
sizeof(TCGHelperInfo));
|
|
hook->helper_info8.func = exec8;
|
|
}
|
|
|
|
return hook->num;
|
|
}
|
|
|
|
void libafl_gen_cmp(target_ulong pc, TCGv op0, TCGv op1, MemOp ot)
|
|
{
|
|
size_t size = 0;
|
|
switch (ot & MO_SIZE) {
|
|
case MO_64:
|
|
size = 8;
|
|
break;
|
|
case MO_32:
|
|
size = 4;
|
|
break;
|
|
case MO_16:
|
|
size = 2;
|
|
break;
|
|
case MO_8:
|
|
size = 1;
|
|
break;
|
|
default:
|
|
return;
|
|
}
|
|
|
|
struct libafl_cmp_hook* hook = libafl_cmp_hooks;
|
|
while (hook) {
|
|
uint64_t cur_id = 0;
|
|
if (hook->gen)
|
|
cur_id = hook->gen(hook->data, pc, size);
|
|
TCGHelperInfo* info = NULL;
|
|
if (size == 1 && hook->helper_info1.func)
|
|
info = &hook->helper_info1;
|
|
else if (size == 2 && hook->helper_info2.func)
|
|
info = &hook->helper_info2;
|
|
else if (size == 4 && hook->helper_info4.func)
|
|
info = &hook->helper_info4;
|
|
else if (size == 8 && hook->helper_info8.func)
|
|
info = &hook->helper_info8;
|
|
if (cur_id != (uint64_t)-1 && info) {
|
|
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
|
|
TCGv_i64 tmp1 = tcg_constant_i64(cur_id);
|
|
TCGTemp* tmp2[4] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1),
|
|
#if TARGET_LONG_BITS == 32
|
|
tcgv_i32_temp(op0), tcgv_i32_temp(op1)};
|
|
#else
|
|
tcgv_i64_temp(op0), tcgv_i64_temp(op1)};
|
|
#endif
|
|
tcg_gen_callN(info->func, info, NULL, tmp2);
|
|
tcg_temp_free_i64(tmp0);
|
|
tcg_temp_free_i64(tmp1);
|
|
}
|
|
hook = hook->next;
|
|
}
|
|
}
|