Skip to content

Commit e99b9da

Browse files
rmalmainandreafioraldi
rmalmain
and
andreafioraldi
authored
Add tcg_env to backdoor callback (#58)
* Add tcg_env to backdoor callback. Remove useless backslashes. * update self-hosted to qemu-specific runner (#57) * Change parameter order in backdoor * Revert "Revert "Implement user-space QEMU ASAN (#45)" (#56)" (#59) This reverts commit 821ad47. --------- Co-authored-by: Andrea Fioraldi <[email protected]>
1 parent 0b7b1f1 commit e99b9da

File tree

3 files changed

+44
-52
lines changed

3 files changed

+44
-52
lines changed

‎accel/tcg/translator.c

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -220,21 +220,11 @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,
220220
struct libafl_backdoor_hook* bhk = libafl_backdoor_hooks;
221221
while (bhk) {
222222
TCGv_i64 tmp0 = tcg_constant_i64(bhk->data);
223-
#if TARGET_LONG_BITS == 32
224-
TCGv_i32 tmp1 = tcg_constant_i32(db->pc_next);
225-
TCGTemp *tmp2[2] = { tcgv_i64_temp(tmp0), tcgv_i32_temp(tmp1) };
226-
#else
227-
TCGv_i64 tmp1 = tcg_constant_i64(db->pc_next);
228-
TCGTemp *tmp2[2] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1) };
229-
#endif
230-
// tcg_gen_callN(bhk->exec, NULL, 2, tmp2);
231-
tcg_gen_callN(&bhk->helper_info, NULL, tmp2);
232-
#if TARGET_LONG_BITS == 32
233-
tcg_temp_free_i32(tmp1);
234-
#else
235-
tcg_temp_free_i64(tmp1);
236-
#endif
237-
tcg_temp_free_i64(tmp0);
223+
TCGv tmp2 = tcg_constant_tl(db->pc_next);
224+
TCGTemp *args[3] = { tcgv_i64_temp(tmp0), tcgv_ptr_temp(tcg_env), tcgv_tl_temp(tmp2) };
225+
226+
tcg_gen_callN(&bhk->helper_info, NULL, args);
227+
238228
bhk = bhk->next;
239229
}
240230

‎libafl_extras/hook.c

Lines changed: 37 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -157,17 +157,19 @@ int libafl_qemu_remove_##name##_hook(size_t num) \
157157
return 0; \
158158
}
159159

160-
161160
static TCGHelperInfo libafl_exec_backdoor_hook_info = {
162-
.func = NULL, .name = "libafl_exec_backdoor_hook", \
163-
.flags = dh_callflag(void), \
164-
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(tl, 2)
161+
.func = NULL, .name = "libafl_exec_backdoor_hook",
162+
.flags = dh_callflag(void),
163+
.typemask = dh_typemask(void, 0)
164+
| dh_typemask(env, 1)
165+
| dh_typemask(i64, 2)
166+
| dh_typemask(tl, 3)
165167
};
166168

167169
struct libafl_backdoor_hook* libafl_backdoor_hooks;
168170
size_t libafl_backdoor_hooks_num = 0;
169171

170-
size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, target_ulong pc),
172+
size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, CPUArchState* cpu, target_ulong pc),
171173
uint64_t data)
172174
{
173175
struct libafl_backdoor_hook* hook = calloc(sizeof(struct libafl_backdoor_hook), 1);
@@ -186,8 +188,8 @@ size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, target_ulong pc),
186188
GEN_REMOVE_HOOK(backdoor)
187189

188190
static TCGHelperInfo libafl_exec_edge_hook_info = {
189-
.func = NULL, .name = "libafl_exec_edge_hook", \
190-
.flags = dh_callflag(void), \
191+
.func = NULL, .name = "libafl_exec_edge_hook",
192+
.flags = dh_callflag(void),
191193
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2)
192194
};
193195

@@ -285,54 +287,54 @@ bool libafl_qemu_block_hook_set_jit(size_t num, size_t (*jit)(uint64_t data, uin
285287
}
286288

287289
static TCGHelperInfo libafl_exec_read_hook1_info = {
288-
.func = NULL, .name = "libafl_exec_read_hook1", \
289-
.flags = dh_callflag(void), \
290+
.func = NULL, .name = "libafl_exec_read_hook1",
291+
.flags = dh_callflag(void),
290292
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3)
291293
};
292294
static TCGHelperInfo libafl_exec_read_hook2_info = {
293-
.func = NULL, .name = "libafl_exec_read_hook2", \
294-
.flags = dh_callflag(void), \
295+
.func = NULL, .name = "libafl_exec_read_hook2",
296+
.flags = dh_callflag(void),
295297
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3)
296298
};
297299
static TCGHelperInfo libafl_exec_read_hook4_info = {
298-
.func = NULL, .name = "libafl_exec_read_hook4", \
299-
.flags = dh_callflag(void), \
300+
.func = NULL, .name = "libafl_exec_read_hook4",
301+
.flags = dh_callflag(void),
300302
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3)
301303
};
302304
static TCGHelperInfo libafl_exec_read_hook8_info = {
303-
.func = NULL, .name = "libafl_exec_read_hook8", \
304-
.flags = dh_callflag(void), \
305+
.func = NULL, .name = "libafl_exec_read_hook8",
306+
.flags = dh_callflag(void),
305307
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3)
306308
};
307309
static TCGHelperInfo libafl_exec_read_hookN_info = {
308-
.func = NULL, .name = "libafl_exec_read_hookN", \
309-
.flags = dh_callflag(void), \
310+
.func = NULL, .name = "libafl_exec_read_hookN",
311+
.flags = dh_callflag(void),
310312
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2)
311313
| dh_typemask(tl, 3) | dh_typemask(i64, 4)
312314
};
313315
static TCGHelperInfo libafl_exec_write_hook1_info = {
314-
.func = NULL, .name = "libafl_exec_write_hook1", \
315-
.flags = dh_callflag(void), \
316+
.func = NULL, .name = "libafl_exec_write_hook1",
317+
.flags = dh_callflag(void),
316318
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3)
317319
};
318320
static TCGHelperInfo libafl_exec_write_hook2_info = {
319-
.func = NULL, .name = "libafl_exec_write_hook2", \
320-
.flags = dh_callflag(void), \
321+
.func = NULL, .name = "libafl_exec_write_hook2",
322+
.flags = dh_callflag(void),
321323
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3)
322324
};
323325
static TCGHelperInfo libafl_exec_write_hook4_info = {
324-
.func = NULL, .name = "libafl_exec_write_hook4", \
325-
.flags = dh_callflag(void), \
326+
.func = NULL, .name = "libafl_exec_write_hook4",
327+
.flags = dh_callflag(void),
326328
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3)
327329
};
328330
static TCGHelperInfo libafl_exec_write_hook8_info = {
329-
.func = NULL, .name = "libafl_exec_write_hook8", \
330-
.flags = dh_callflag(void), \
331+
.func = NULL, .name = "libafl_exec_write_hook8",
332+
.flags = dh_callflag(void),
331333
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2) | dh_typemask(tl, 3)
332334
};
333335
static TCGHelperInfo libafl_exec_write_hookN_info = {
334-
.func = NULL, .name = "libafl_exec_write_hookN", \
335-
.flags = dh_callflag(void), \
336+
.func = NULL, .name = "libafl_exec_write_hookN",
337+
.flags = dh_callflag(void),
336338
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1) | dh_typemask(i64, 2)
337339
| dh_typemask(tl, 3) | dh_typemask(i64, 4)
338340
};
@@ -505,26 +507,26 @@ void libafl_gen_write(TCGTemp *addr, MemOpIdx oi)
505507
}
506508

507509
static TCGHelperInfo libafl_exec_cmp_hook1_info = {
508-
.func = NULL, .name = "libafl_exec_cmp_hook1", \
509-
.flags = dh_callflag(void), \
510+
.func = NULL, .name = "libafl_exec_cmp_hook1",
511+
.flags = dh_callflag(void),
510512
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1)
511513
| dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(tl, 4)
512514
};
513515
static TCGHelperInfo libafl_exec_cmp_hook2_info = {
514-
.func = NULL, .name = "libafl_exec_cmp_hook2", \
515-
.flags = dh_callflag(void), \
516+
.func = NULL, .name = "libafl_exec_cmp_hook2",
517+
.flags = dh_callflag(void),
516518
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1)
517519
| dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(tl, 4)
518520
};
519521
static TCGHelperInfo libafl_exec_cmp_hook4_info = {
520-
.func = NULL, .name = "libafl_exec_cmp_hook4", \
521-
.flags = dh_callflag(void), \
522+
.func = NULL, .name = "libafl_exec_cmp_hook4",
523+
.flags = dh_callflag(void),
522524
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1)
523525
| dh_typemask(i64, 2) | dh_typemask(tl, 3) | dh_typemask(tl, 4)
524526
};
525527
static TCGHelperInfo libafl_exec_cmp_hook8_info = {
526-
.func = NULL, .name = "libafl_exec_cmp_hook8", \
527-
.flags = dh_callflag(void), \
528+
.func = NULL, .name = "libafl_exec_cmp_hook8",
529+
.flags = dh_callflag(void),
528530
.typemask = dh_typemask(void, 0) | dh_typemask(i64, 1)
529531
| dh_typemask(i64, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4)
530532
};

‎libafl_extras/hook.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ int libafl_qemu_remove_hook(size_t num, int invalidate);
4141
struct libafl_hook* libafl_search_hook(target_ulong addr);
4242

4343
struct libafl_backdoor_hook {
44-
void (*exec)(uint64_t data, target_ulong pc);
44+
void (*exec)(uint64_t data, CPUArchState* cpu, target_ulong pc);
4545
uint64_t data;
4646
size_t num;
4747
TCGHelperInfo helper_info;
@@ -50,7 +50,7 @@ struct libafl_backdoor_hook {
5050

5151
extern struct libafl_backdoor_hook* libafl_backdoor_hooks;
5252

53-
size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, target_ulong pc),
53+
size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, CPUArchState* cpu, target_ulong pc),
5454
uint64_t data);
5555
int libafl_qemu_remove_backdoor_hook(size_t num, int invalidate);
5656

0 commit comments

Comments
 (0)