RT-Task-Generator-QEMU/libafl_extras/hook.h

#pragma once

#include "qemu/osdep.h"
#include "qapi/error.h"

#include "tcg/tcg-op.h"
#include "tcg/tcg-internal.h"
#include "tcg/tcg-temp-internal.h"

#define LIBAFL_TABLES_SIZE 16384
#define LIBAFL_TABLES_HASH(p) (((13*((size_t)(p))) ^ (((size_t)(p)) >> 15)) % LIBAFL_TABLES_SIZE)

void tcg_gen_callN(TCGHelperInfo *info, TCGTemp *ret, TCGTemp **args);

TranslationBlock *libafl_gen_edge(CPUState *cpu, target_ulong src_block,
                                  target_ulong dst_block, int exit_n,
                                  target_ulong cs_base, uint32_t flags,
                                  int cflags);

void libafl_gen_cmp(target_ulong pc, TCGv op0, TCGv op1, MemOp ot);
void libafl_gen_backdoor(target_ulong pc);

extern target_ulong libafl_gen_cur_pc;

struct libafl_hook {
    target_ulong addr;
    // void (*callback)(uint64_t, target_ulong);
    uint64_t data;
    size_t num;
    TCGHelperInfo helper_info;
    struct libafl_hook* next;
};

extern struct libafl_hook* libafl_qemu_hooks[LIBAFL_TABLES_SIZE];
extern size_t libafl_qemu_hooks_num;

size_t libafl_qemu_set_hook(target_ulong pc, void (*callback)(uint64_t data, target_ulong pc),
                            uint64_t data, int invalidate);
size_t libafl_qemu_remove_hooks_at(target_ulong addr, int invalidate);
int libafl_qemu_remove_hook(size_t num, int invalidate);
struct libafl_hook* libafl_search_hook(target_ulong addr);

struct libafl_backdoor_hook {
    void (*exec)(uint64_t data, target_ulong pc);
    uint64_t data;
    size_t num;
    TCGHelperInfo helper_info;
    struct libafl_backdoor_hook* next;
};

extern struct libafl_backdoor_hook* libafl_backdoor_hooks;

size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, target_ulong pc),
                                uint64_t data);
int libafl_qemu_remove_backdoor_hook(size_t num, int invalidate);

struct libafl_edge_hook {
    uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
    // void (*exec)(uint64_t data, uint64_t id);
    size_t (*jit)(uint64_t data, uint64_t id); // optional opt
    uint64_t data;
    size_t num;
    uint64_t cur_id;
    TCGHelperInfo helper_info;
    struct libafl_edge_hook* next;
};

extern struct libafl_edge_hook* libafl_edge_hooks;

size_t libafl_add_edge_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
                            void (*exec)(uint64_t data, uint64_t id),
                            uint64_t data);
int libafl_qemu_remove_edge_hook(size_t num, int invalidate);
void libafl_qemu_edge_hook_set_jit(size_t num, size_t (*jit)(uint64_t, uint64_t)); // no param names to avoid to be marked as safe

struct libafl_block_hook {
    uint64_t (*gen)(uint64_t data, target_ulong pc);
    void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length);
    // void (*exec)(uint64_t data, uint64_t id);
    uint64_t data;
    size_t num;
    TCGHelperInfo helper_info;
    struct libafl_block_hook* next;
};

extern struct libafl_block_hook* libafl_block_hooks;

size_t libafl_add_block_hook(uint64_t (*gen)(uint64_t data, target_ulong pc),
                             void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length),
                             void (*exec)(uint64_t data, uint64_t id), uint64_t data);
int libafl_qemu_remove_block_hook(size_t num, int invalidate);

struct libafl_rw_hook {
    uint64_t (*gen)(uint64_t data, target_ulong pc, MemOpIdx oi);
    /*void (*exec1)(uint64_t data, uint64_t id, target_ulong addr);
    void (*exec2)(uint64_t data, uint64_t id, target_ulong addr);
    void (*exec4)(uint64_t data, uint64_t id, target_ulong addr);
    void (*exec8)(uint64_t data, uint64_t id, target_ulong addr);
    void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size);*/
    uint64_t data;
    size_t num;
    TCGHelperInfo helper_info1;
    TCGHelperInfo helper_info2;
    TCGHelperInfo helper_info4;
    TCGHelperInfo helper_info8;
    TCGHelperInfo helper_infoN;
    struct libafl_rw_hook* next;
};

// alias
#define libafl_read_hook libafl_rw_hook
#define libafl_write_hook libafl_rw_hook

extern struct libafl_rw_hook* libafl_read_hooks;
extern struct libafl_rw_hook* libafl_write_hooks;

size_t libafl_add_read_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, MemOpIdx oi),
                             void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
                             void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
                             void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
                             void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
                             void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
                             uint64_t data);
size_t libafl_add_write_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, MemOpIdx oi),
                             void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
                             void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
                             void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
                             void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
                             void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
                             uint64_t data);

int libafl_qemu_remove_read_hook(size_t num, int invalidate);
int libafl_qemu_remove_write_hook(size_t num, int invalidate);

void libafl_gen_read(TCGTemp *addr, MemOpIdx oi);
void libafl_gen_write(TCGTemp *addr, MemOpIdx oi);

struct libafl_cmp_hook {
    uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size);
    /*void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1);
    void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1);
    void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1);
    void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1);*/
    uint64_t data;
    size_t num;
    TCGHelperInfo helper_info1;
    TCGHelperInfo helper_info2;
    TCGHelperInfo helper_info4;
    TCGHelperInfo helper_info8;
    struct libafl_cmp_hook* next;
};

extern struct libafl_cmp_hook* libafl_cmp_hooks;

size_t libafl_add_cmp_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size),
                           void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1),
                           void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1),
                           void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1),
                           void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1),
                           uint64_t data);
int libafl_qemu_remove_cmp_hook(size_t num, int invalidate);

struct syshook_ret {
    target_ulong retval;
    bool skip_syscall;
};

struct libafl_pre_syscall_hook {
    struct syshook_ret (*callback)(uint64_t data, int sys_num, target_ulong arg0,
                                   target_ulong arg1, target_ulong arg2,
                                   target_ulong arg3, target_ulong arg4,
                                   target_ulong arg5, target_ulong arg6,
                                   target_ulong arg7);
    uint64_t data;
    size_t num;
    struct libafl_pre_syscall_hook* next;
};

struct libafl_post_syscall_hook {
    target_ulong (*callback)(uint64_t data, target_ulong ret, int sys_num,
                             target_ulong arg0, target_ulong arg1,
                             target_ulong arg2, target_ulong arg3,
                             target_ulong arg4, target_ulong arg5,
                             target_ulong arg6, target_ulong arg7);
    uint64_t data;
    size_t num;
    struct libafl_post_syscall_hook* next;
};

extern struct libafl_pre_syscall_hook* libafl_pre_syscall_hooks;
extern struct libafl_post_syscall_hook* libafl_post_syscall_hooks;

size_t libafl_add_pre_syscall_hook(struct syshook_ret (*callback)(
                                     uint64_t data, int sys_num, target_ulong arg0,
                                     target_ulong arg1, target_ulong arg2,
                                     target_ulong arg3, target_ulong arg4,
                                     target_ulong arg5, target_ulong arg6,
                                     target_ulong arg7),
                                   uint64_t data);
size_t libafl_add_post_syscall_hook(target_ulong (*callback)(
                                      uint64_t data, target_ulong ret, int sys_num,
                                      target_ulong arg0, target_ulong arg1,
                                      target_ulong arg2, target_ulong arg3,
                                      target_ulong arg4, target_ulong arg5,
                                      target_ulong arg6, target_ulong arg7),
                                    uint64_t data);

int libafl_qemu_remove_pre_syscall_hook(size_t num);
int libafl_qemu_remove_post_syscall_hook(size_t num);

struct libafl_new_thread_hook {
    bool (*callback)(uint64_t data, uint32_t tid);
    uint64_t data;
    size_t num;
    struct libafl_new_thread_hook* next;
};

extern struct libafl_new_thread_hook* libafl_new_thread_hooks;

size_t libafl_add_new_thread_hook(bool (*callback)(uint64_t data, uint32_t tid),
                                  uint64_t data);
int libafl_qemu_remove_new_thread_hook(size_t num);