Skip to content

Commit 70c1cdf

Browse files
philzook58philzook58
committed
Enabled patches written in primus lisp. I am shocked this is working at all
1 parent 237c8bf commit 70c1cdf

File tree

15 files changed

+250
-27
lines changed

15 files changed

+250
-27
lines changed

‎bap-vibes/src/config.ml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ open !Core_kernel
55
module Hvar = Higher_var
66
module Wp_params = Bap_wp.Run_parameters
77

8-
type patch_code = CCode of Cabs.definition | ASMCode of string
8+
type patch_code = CCode of Cabs.definition | ASMCode of string | PrimusCode of string
99

1010
(* A type to represent a patch. *)
1111
type patch =
@@ -84,7 +84,8 @@ let string_of_hvar (v : Hvar.t) : string =
8484
let patch_to_string (p : patch) : string =
8585
let code = match p.patch_code with
8686
| CCode ccode -> Utils.print_c Cprint.print_def ccode
87-
| ASMCode asmcode -> asmcode in
87+
| ASMCode asmcode -> asmcode
88+
| PrimusCode funname -> funname in
8889
let h_vars =
8990
String.concat ~sep:"\n" (List.map p.patch_vars ~f:string_of_hvar)
9091
in

‎bap-vibes/src/config.mli‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ type patch
1313
type t
1414

1515
(** A type to represent patch cody which may either be C or literal assembly *)
16-
type patch_code = CCode of Cabs.definition | ASMCode of string
16+
type patch_code = CCode of Cabs.definition | ASMCode of string | PrimusCode of string
1717

1818
(** A type to represent known regions that may be overwritten with patch code *)
1919
type patch_space = {

‎bap-vibes/src/data.ml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ let sexp_domain : Sexp.t option KB.Domain.t = KB.Domain.optional
4444
"sexp-domain"
4545

4646
(* Optional C definition domain for the patch code. *)
47-
let source_domain : Cabs.definition option KB.Domain.t = KB.Domain.optional
47+
let source_domain : Config.patch_code option KB.Domain.t = KB.Domain.optional
4848
~equal:Poly.equal
4949
"source-domain"
5050

@@ -93,7 +93,7 @@ module Patch = struct
9393
let patch_name : (patch_cls, string option) KB.slot =
9494
KB.Class.property ~package patch "patch-name" string_domain
9595

96-
let patch_code : (patch_cls, Cabs.definition option) KB.slot =
96+
let patch_code : (patch_cls, Config.patch_code option) KB.slot =
9797
KB.Class.property ~package patch "patch-code" source_domain
9898

9999
let patch_label : (patch_cls, Theory.label option) KB.slot =
@@ -136,13 +136,16 @@ module Patch = struct
136136
| None -> Kb_error.fail Kb_error.Missing_patch_name
137137
| Some value -> KB.return value
138138

139-
let set_patch_code (obj : t) (data : Cabs.definition option) : unit KB.t =
140-
KB.provide patch_code obj data
139+
let set_patch_code (obj : t) (data : Config.patch_code option) : unit KB.t =
140+
KB.provide patch_code obj data (* (Option.map ~f:(fun c -> Config.CCode c) data) *)
141141

142-
let get_patch_code (obj : t) : Cabs.definition option KB.t =
143-
KB.collect patch_code obj
142+
let get_patch_code (obj : t) : Config.patch_code option KB.t =
143+
KB.collect patch_code obj (* >>= fun res ->
144+
match res with
145+
| Some (CCode code) -> KB.return (Some code)
146+
| _ -> KB.return None *)
144147

145-
let get_patch_code_exn (obj : t) : Cabs.definition KB.t =
148+
let get_patch_code_exn (obj : t) : Config.patch_code KB.t =
146149
get_patch_code obj >>= fun result ->
147150
match result with
148151
| None -> Kb_error.fail Kb_error.Missing_patch_code

‎bap-vibes/src/data.mli‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ val int_domain : int option KB.Domain.t
1414
val int64_domain : int64 option KB.Domain.t
1515
val bitvec_domain : Bitvec.t option KB.Domain.t
1616
val sexp_domain : Sexp.t option KB.Domain.t
17-
val source_domain : Cabs.definition option KB.Domain.t
17+
val source_domain : Config.patch_code option KB.Domain.t
1818
val assembly_domain : string list option KB.Domain.t
1919
val unit_domain : unit KB.Domain.t
2020
val higher_vars_domain : Hvar.t list option KB.Domain.t
@@ -49,7 +49,7 @@ module Patch : sig
4949
include Knowledge.Object.S with type t := t
5050

5151
val patch_name : (patch_cls, string option) KB.slot
52-
val patch_code : (patch_cls, Cabs.definition option) KB.slot
52+
val patch_code : (patch_cls, Config.patch_code option) KB.slot
5353
val patch_point : (patch_cls, Bitvec.t option) KB.slot
5454
val patch_size : (patch_cls, int option) KB.slot
5555
val patch_label : (patch_cls, Theory.label option) KB.slot
@@ -68,9 +68,9 @@ module Patch : sig
6868
val get_patch_name : t -> string option KB.t
6969
val get_patch_name_exn : t -> string KB.t
7070

71-
val set_patch_code : t -> Cabs.definition option -> unit KB.t
72-
val get_patch_code : t -> Cabs.definition option KB.t
73-
val get_patch_code_exn : t -> Cabs.definition KB.t
71+
val set_patch_code : t -> Config.patch_code option -> unit KB.t
72+
val get_patch_code : t -> Config.patch_code option KB.t
73+
val get_patch_code_exn : t -> Config.patch_code KB.t
7474

7575
val set_patch_point : t -> Bitvec.t option -> unit KB.t
7676
val get_patch_point : t -> Bitvec.t option KB.t

‎bap-vibes/src/patch_ingester.ml‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ open Bap_knowledge
55
open Knowledge.Syntax
66
open Core_kernel
77
open Bap_core_theory
8+
open Bap_primus.Std
89

910
module KB = Knowledge
1011
open KB.Let
@@ -15,14 +16,27 @@ let provide_bir (tgt : Theory.target) (patch : Data.Patch.t) : unit KB.t =
1516
let module CParser = Core_c.Eval(Core) in
1617
Data.Patch.init_sem patch >>= fun () ->
1718
Data.Patch.get_patch_name_exn patch >>= fun name ->
18-
Data.Patch.get_patch_code_exn patch >>= fun code ->
1919
Events.(send @@ Info (Printf.sprintf "Patch %s" name));
20-
let code_str = Utils.print_c Cprint.print_def code in
21-
Events.(send @@ Info (Printf.sprintf "%s" code_str));
22-
20+
Data.Patch.get_patch_code_exn patch >>= fun code ->
2321
(* Get the patch (as BIR). *)
24-
let* bir = CParser.c_patch_to_eff tgt code in
25-
22+
let* bir = match code with
23+
| CCode code -> begin
24+
let code_str = Utils.print_c Cprint.print_def code in
25+
Events.(send @@ Info (Printf.sprintf "%s" code_str));
26+
CParser.c_patch_to_eff tgt code
27+
end
28+
| PrimusCode name -> begin
29+
Primus.Lisp.Unit.create tgt >>= fun unit ->
30+
KB.Object.scoped Theory.Program.cls @@ fun obj ->
31+
KB.sequence [
32+
KB.provide Theory.Label.unit obj (Some unit);
33+
(* KB.provide Theory.Label.addr obj addr; *)
34+
KB.provide Primus.Lisp.Semantics.name obj (Some (KB.Name.create name));
35+
] >>= fun () ->
36+
KB.collect Theory.Semantics.slot obj
37+
end
38+
| ASMCode _asm -> Kb_error.fail (Kb_error.Not_implemented "yolo")
39+
in
2640
Events.(send @@ Info "The patch has the following BIL:");
2741
Events.(send @@ Rule);
2842
let bir_str = Format.asprintf "%a" Bil.pp (KB.Value.get Bil.slot bir) in

‎bap-vibes/src/seeder.ml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,10 @@ let create_patches
6767
~addr:(Config.patch_point p)
6868
in
6969
let* () = Data.Patch.set_patch_name obj (Some patch_name) in
70+
let* () = Data.Patch.set_patch_code obj (Some (Config.patch_code p)) in
7071
let* () = match Config.patch_code p with
71-
| CCode ccode -> Data.Patch.set_patch_code obj (Some ccode)
7272
| ASMCode asmcode -> Data.Patch.set_assembly obj (Some [asmcode])
73+
| _ -> KB.return ()
7374
in
7475
let* () = Data.Patch.set_patch_point obj (Some (Config.patch_point p)) in
7576
let* () = Data.Patch.set_patch_size obj (Some (Config.patch_size p)) in

‎plugin/lib/vibes_plugin_parameters.ml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,15 +87,18 @@ let validate_patch_name (obj : Json.t) : (string, error) Stdlib.result =
8787
into a [Cabs.definition] *)
8888
let validate_patch_code (nm : string) (obj : Json.t)
8989
: (Vibes_config.patch_code, error) Stdlib.result =
90-
match Json.Util.member "patch-code" obj, Json.Util.member "asm-code" obj with
91-
| `String s, `Null ->
90+
match Json.Util.member "patch-code" obj, Json.Util.member "asm-code" obj, Json.Util.member "lisp-code" obj with
91+
| `String s, `Null, `Null ->
9292
(match Parse_c.parse_c_patch s with
9393
| Ok code -> Ok (Vibes_config.CCode code)
9494
| Error msg -> Error (Errors.Invalid_patch_code msg))
95-
| `Null, `String s -> Ok (Vibes_config.ASMCode s)
96-
| `String s, `String s' -> Error
95+
| `Null, `String s, `Null -> Ok (Vibes_config.ASMCode s)
96+
| `Null, `Null, `String s -> Ok (Vibes_config.PrimusCode s)
97+
| `String s, `String s', _
98+
| _, `String s', `String s
99+
| `String s, _, `String s' -> Error
97100
(Errors.Invalid_patch_code "Specified both assembly and C code in patch")
98-
| _, _ -> Err.fail Errors.Missing_patch_code
101+
| _, _, _ -> Err.fail Errors.Missing_patch_code
99102

100103
(* Extract the patch point field and parse the hex string into a bitvector, or
101104
error. *)

‎resources/exes/arm-simple-primus/Makefile‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
SRC := main.c
2+
3+
PROG := main
4+
PATCHED_PROG := main.patched
5+
6+
REF_PROG := main.reference
7+
PATCHED_REF_PROG := main.patched.reference
8+
9+
PATCHED_PROG_FOR_TESTING := test.patched.by.vibes
10+
11+
12+
#####################################################
13+
# DEFAULT
14+
#####################################################
15+
16+
.DEFAULT_GOAL := all
17+
all: clean build patch
18+
19+
20+
#####################################################
21+
# BUILD
22+
#####################################################
23+
24+
build: $(PROG)
25+
$(PROG): $(SRC)
26+
arm-linux-gnueabi-gcc -marm -o $@ $<
27+
28+
29+
#####################################################
30+
# CLEAN
31+
#####################################################
32+
33+
.PHONY: clean
34+
clean:
35+
rm -rf $(OBJ) $(PROG) $(PATCHED_PROG) $(PATCHED_PROG_FOR_TESTING)
36+
37+
38+
#####################################################
39+
# PATCH
40+
#####################################################
41+
42+
$(PATCHED_PROG): $(PROG)
43+
bap vibes $(PROG) \
44+
--config=config.json \
45+
--primus-lisp-load=patch \
46+
-o $(PATCHED_PROG) \
47+
--verbose
48+
chmod +x $(PATCHED_PROG)
49+
50+
patch: $(PATCHED_PROG)
51+
52+
53+
#####################################################
54+
# PATCH THE REFERENCE EXECUTABLE
55+
#####################################################
56+
57+
$(PATCHED_PROG_FOR_TESTING): $(REF_PROG)
58+
bap vibes $(REF_PROG) \
59+
--config=config.json \
60+
-o $(PATCHED_PROG_FOR_TESTING) \
61+
--verbose
62+
chmod +x $(PATCHED_PROG_FOR_TESTING)
63+
64+
patch.reference: $(PATCHED_PROG_FOR_TESTING)
65+
66+
67+
#####################################################
68+
# CREATE REFERENCE FILES
69+
#####################################################
70+
71+
$(REF_PROG):
72+
$(MAKE) $(PROG)
73+
cp $(PROG) $(REF_PROG)
74+
75+
$(PATCHED_REF_PROG):
76+
$(MAKE) patch.reference
77+
cp $(PATCHED_PROG_FOR_TESTING) $(PATCHED_REF_PROG)
78+
79+
reference:
80+
rm -rf $(REF_PROG) $(PATCHED_REF_PROG)
81+
$(MAKE) $(REF_PROG)
82+
$(MAKE) $(PATCHED_REF_PROG)
83+
84+
85+
#####################################################
86+
# RUN
87+
#####################################################
88+
89+
.PHONY: run.orig
90+
run.orig: $(PROG)
91+
-QEMU_LD_PREFIX=/usr/arm-linux-gnueabi qemu-arm $(PROG)
92+
93+
.PHONY: run.patched
94+
run.patched: $(PATCHED_PROG)
95+
-QEMU_LD_PREFIX=/usr/arm-linux-gnueabi qemu-arm $(PATCHED_PROG)
96+
97+
.PHONY: run.ref
98+
run.ref: $(REF_PROG)
99+
-QEMU_LD_PREFIX=/usr/arm-linux-gnueabi qemu-arm $(REF_PROG)
100+
101+
.PHONY: run.patched-ref
102+
run.patched-ref: $(PATCHED_REF_PROG)
103+
-QEMU_LD_PREFIX=/usr/arm-linux-gnueabi qemu-arm $(PATCHED_REF_PROG)
104+
105+
.PHONY: run.test
106+
run.test: run.orig run.patched

‎resources/exes/arm-simple-primus/README.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# ARM Simple Compiled
2+
3+
To clean, build, and patch:
4+
5+
make
6+
7+
To build:
8+
9+
make build
10+
11+
To patch:
12+
13+
make patch
14+
15+
To run the executable and the patched executable (in qemu):
16+
17+
make run.test
18+
19+
To create reference versions of the executables:
20+
21+
make reference
22+
23+
To patch the reference executable:
24+
25+
make patch.reference
26+
27+
To clean:
28+
29+
make clean

‎resources/exes/arm-simple-primus/config.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"max-tries": 3,
3+
"wp-params": {
4+
"func": "main",
5+
"postcond" : "(assert (= (bvadd R0_mod #x00000002) R0_orig))"
6+
},
7+
"patches" : [
8+
{"patch-name" : "ret-3",
9+
"lisp-code" : "ret-3",
10+
"patch-point" : "0x103d4",
11+
"patch-size" : 8,
12+
"patch-vars": [
13+
{"name": "retvar",
14+
"at-entry": {
15+
"stored-in": "register",
16+
"register": "R0"
17+
},
18+
"at-exit": {
19+
"stored-in": "register",
20+
"register": "R12"
21+
}}
22+
]
23+
}
24+
]
25+
}

0 commit comments

Comments
 (0)