99 lines
2.7 KiB
C
99 lines
2.7 KiB
C
#include "libafl/tcg.h"
|
|
#include "libafl/hooks/tcg/edge.h"
|
|
|
|
struct libafl_edge_hook* libafl_edge_hooks;
|
|
size_t libafl_edge_hooks_num = 0;
|
|
|
|
static TCGHelperInfo libafl_exec_edge_hook_info = {
|
|
.func = NULL,
|
|
.name = "libafl_exec_edge_hook",
|
|
.flags = dh_callflag(void),
|
|
.typemask =
|
|
dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2)
|
|
};
|
|
|
|
GEN_REMOVE_HOOK(edge)
|
|
|
|
size_t libafl_add_edge_hook(uint64_t (*gen)(uint64_t data, target_ulong src,
|
|
target_ulong dst),
|
|
void (*exec)(uint64_t data, uint64_t id),
|
|
uint64_t data)
|
|
{
|
|
CPUState* cpu;
|
|
CPU_FOREACH(cpu) { tb_flush(cpu); }
|
|
|
|
struct libafl_edge_hook* hook = calloc(sizeof(struct libafl_edge_hook), 1);
|
|
hook->gen = gen;
|
|
// hook->exec = exec;
|
|
hook->data = data;
|
|
hook->num = libafl_edge_hooks_num++;
|
|
hook->next = libafl_edge_hooks;
|
|
libafl_edge_hooks = hook;
|
|
|
|
if (exec) {
|
|
memcpy(&hook->helper_info, &libafl_exec_edge_hook_info,
|
|
sizeof(TCGHelperInfo));
|
|
hook->helper_info.func = exec;
|
|
}
|
|
|
|
return hook->num;
|
|
}
|
|
|
|
bool libafl_qemu_edge_hook_set_jit(size_t num,
|
|
size_t (*jit)(uint64_t data, uint64_t id))
|
|
{
|
|
struct libafl_edge_hook* hk = libafl_edge_hooks;
|
|
while (hk) {
|
|
if (hk->num == num) {
|
|
hk->jit = jit;
|
|
return true;
|
|
} else {
|
|
hk = hk->next;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
bool libafl_qemu_hook_edge_gen(target_ulong src_block, target_ulong dst_block)
|
|
{
|
|
struct libafl_edge_hook* hook = libafl_edge_hooks;
|
|
bool no_exec_hook = true;
|
|
|
|
while (hook) {
|
|
hook->cur_id = 0;
|
|
|
|
if (hook->gen) {
|
|
hook->cur_id = hook->gen(hook->data, src_block, dst_block);
|
|
}
|
|
|
|
if (hook->cur_id != (uint64_t)-1 &&
|
|
(hook->helper_info.func || hook->jit)) {
|
|
no_exec_hook = false;
|
|
}
|
|
|
|
hook = hook->next;
|
|
}
|
|
|
|
return no_exec_hook;
|
|
}
|
|
|
|
void libafl_qemu_hook_edge_run(void)
|
|
{
|
|
struct libafl_edge_hook* hook = libafl_edge_hooks;
|
|
|
|
while (hook) {
|
|
if (hook->cur_id != (uint64_t)-1 && hook->helper_info.func) {
|
|
TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
|
|
TCGv_i64 tmp1 = tcg_constant_i64(hook->cur_id);
|
|
TCGTemp* tmp2[2] = {tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1)};
|
|
tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL, tmp2);
|
|
tcg_temp_free_i64(tmp0);
|
|
tcg_temp_free_i64(tmp1);
|
|
}
|
|
if (hook->cur_id != (uint64_t)-1 && hook->jit) {
|
|
hook->jit(hook->data, hook->cur_id);
|
|
}
|
|
hook = hook->next;
|
|
}
|
|
}
|