FRET-qemu/libafl/hooks/tcg/read_write.c

#include "libafl/hooks/tcg/read_write.h"
#include "cpu.h"
#include "exec/tb-flush.h"

#include "libafl/tcg.h"
#include "libafl/cpu.h"
#include "libafl/hook.h"

static struct libafl_rw_hook* libafl_read_hooks;
static size_t libafl_read_hooks_num = 0;

static struct libafl_rw_hook* libafl_write_hooks;
static size_t libafl_write_hooks_num = 0;

#define TYPEMASK_RW_SIZED                                                      \
    (dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) |        \
     dh_typemask(i64, 3) | dh_typemask(tl, 4))

#define TYPEMASK_RW_UNSIZED (TYPEMASK_RW_SIZED | dh_typemask(i64, 5))

static TCGHelperInfo libafl_exec_read_hook1_info = {
    .func = NULL,
    .name = "libafl_exec_read_hook1",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_SIZED,
};

static TCGHelperInfo libafl_exec_read_hook2_info = {
    .func = NULL,
    .name = "libafl_exec_read_hook2",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_SIZED,
};

static TCGHelperInfo libafl_exec_read_hook4_info = {
    .func = NULL,
    .name = "libafl_exec_read_hook4",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_SIZED,
};

static TCGHelperInfo libafl_exec_read_hook8_info = {
    .func = NULL,
    .name = "libafl_exec_read_hook8",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_SIZED,
};

static TCGHelperInfo libafl_exec_read_hookN_info = {
    .func = NULL,
    .name = "libafl_exec_read_hookN",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_UNSIZED,
};

static TCGHelperInfo libafl_exec_write_hook1_info = {
    .func = NULL,
    .name = "libafl_exec_write_hook1",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_SIZED,
};

static TCGHelperInfo libafl_exec_write_hook2_info = {
    .func = NULL,
    .name = "libafl_exec_write_hook2",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_SIZED,
};

static TCGHelperInfo libafl_exec_write_hook4_info = {
    .func = NULL,
    .name = "libafl_exec_write_hook4",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_SIZED,
};

static TCGHelperInfo libafl_exec_write_hook8_info = {
    .func = NULL,
    .name = "libafl_exec_write_hook8",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_SIZED,
};

static TCGHelperInfo libafl_exec_write_hookN_info = {
    .func = NULL,
    .name = "libafl_exec_write_hookN",
    .flags = dh_callflag(void),
    .typemask = TYPEMASK_RW_UNSIZED,
};

GEN_REMOVE_HOOK(read)
GEN_REMOVE_HOOK(write)

static size_t
libafl_add_rw_hook(struct libafl_rw_hook** hooks, size_t* hooks_num,
                   libafl_rw_gen_cb gen_cb, libafl_rw_exec_cb exec1_cb,
                   TCGHelperInfo* exec1_info, libafl_rw_exec_cb exec2_cb,
                   TCGHelperInfo* exec2_info, libafl_rw_exec_cb exec4_cb,
                   TCGHelperInfo* exec4_info, libafl_rw_exec_cb exec8_cb,
                   TCGHelperInfo* exec8_info, libafl_rw_execN_cb execN_cb,
                   TCGHelperInfo* execN_info, uint64_t data)
{
    CPUState* cpu;
    CPU_FOREACH(cpu) { tb_flush(cpu); }

    struct libafl_rw_hook* hook = calloc(sizeof(struct libafl_rw_hook), 1);
    hook->gen_cb = gen_cb;
    hook->data = data;
    hook->num = (*hooks_num)++;
    hook->next = *hooks;
    *hooks = hook;

    if (exec1_cb) {
        memcpy(&hook->helper_info1, exec1_info, sizeof(TCGHelperInfo));
        hook->helper_info1.func = exec1_cb;
    }
    if (exec2_cb) {
        memcpy(&hook->helper_info2, exec2_info, sizeof(TCGHelperInfo));
        hook->helper_info2.func = exec2_cb;
    }
    if (exec4_cb) {
        memcpy(&hook->helper_info4, exec4_info, sizeof(TCGHelperInfo));
        hook->helper_info4.func = exec4_cb;
    }
    if (exec8_cb) {
        memcpy(&hook->helper_info8, exec8_info, sizeof(TCGHelperInfo));
        hook->helper_info8.func = exec8_cb;
    }
    if (execN_cb) {
        memcpy(&hook->helper_infoN, execN_info, sizeof(TCGHelperInfo));
        hook->helper_infoN.func = execN_cb;
    }

    return hook->num;
}

size_t libafl_add_read_hook(libafl_rw_gen_cb gen_cb, libafl_rw_exec_cb exec1_cb,
                            libafl_rw_exec_cb exec2_cb,
                            libafl_rw_exec_cb exec4_cb,
                            libafl_rw_exec_cb exec8_cb,
                            libafl_rw_execN_cb execN_cb, uint64_t data)
{
    return libafl_add_rw_hook(&libafl_read_hooks, &libafl_read_hooks_num,
                              gen_cb, exec1_cb, &libafl_exec_read_hook1_info,
                              exec2_cb, &libafl_exec_read_hook2_info, exec4_cb,
                              &libafl_exec_read_hook4_info, exec8_cb,
                              &libafl_exec_read_hook8_info, execN_cb,
                              &libafl_exec_read_hookN_info, data);
}

size_t libafl_add_write_hook(libafl_rw_gen_cb gen_cb,
                             libafl_rw_exec_cb exec1_cb,
                             libafl_rw_exec_cb exec2_cb,
                             libafl_rw_exec_cb exec4_cb,
                             libafl_rw_exec_cb exec8_cb,
                             libafl_rw_execN_cb execN_cb, uint64_t data)
{
    return libafl_add_rw_hook(&libafl_write_hooks, &libafl_write_hooks_num,
                              gen_cb, exec1_cb, &libafl_exec_write_hook1_info,
                              exec2_cb, &libafl_exec_write_hook2_info, exec4_cb,
                              &libafl_exec_write_hook4_info, exec8_cb,
                              &libafl_exec_write_hook8_info, execN_cb,
                              &libafl_exec_write_hookN_info, data);
}

static void libafl_gen_rw(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi,
                          struct libafl_rw_hook* hook)
{
    size_t size = memop_size(get_memop(oi));

    while (hook) {
        uint64_t cur_id = 0;

        if (hook->gen_cb) {
            cur_id = hook->gen_cb(hook->data, libafl_gen_cur_pc, addr, oi);
        }

        TCGHelperInfo* info = NULL;
        if (size == 1 && hook->helper_info1.func)
            info = &hook->helper_info1;
        else if (size == 2 && hook->helper_info2.func)
            info = &hook->helper_info2;
        else if (size == 4 && hook->helper_info4.func)
            info = &hook->helper_info4;
        else if (size == 8 && hook->helper_info8.func)
            info = &hook->helper_info8;

        if (cur_id != (uint64_t)-1) {
            TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
            TCGv_i64 tmp1 = tcg_constant_i64(cur_id);

            if (info) {
                tcg_gen_call4(info->func, info, NULL, tcgv_i64_temp(tmp0),
                              tcgv_i64_temp(tmp1), pc, addr);
            } else if (hook->helper_infoN.func) {
                TCGv tmp3 = tcg_constant_tl(size);

                tcg_gen_call5(hook->helper_infoN.func, &hook->helper_infoN,
                              NULL, tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1),
                              pc, addr, tcgv_tl_temp(tmp3));
            }
        }
        hook = hook->next;
    }
}

void libafl_gen_read(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi)
{
    libafl_gen_rw(pc, addr, oi, libafl_read_hooks);
}

void libafl_gen_write(TCGTemp* pc, TCGTemp* addr, MemOpIdx oi)
{
    libafl_gen_rw(pc, addr, oi, libafl_write_hooks);
}