func CgcSyscall(u models.Usercorn) { // TODO: handle errors or something args, _ := u.ReadRegs(LinuxRegs) eax, _ := u.RegRead(uc.X86_REG_EAX) var ret uint64 switch eax { case 1: // _terminate syscall.Exit(int(args[0])) case 2: // transmit mem, _ := u.MemRead(args[1], args[2]) n, _ := syscall.Write(int(args[0]), mem) writeAddr(u, args[3], uint64(n)) case 3: // receive tmp := make([]byte, args[2]) n, _ := syscall.Read(int(args[0]), tmp) u.MemWrite(args[1], tmp[:n]) writeAddr(u, args[3], uint64(n)) case 5: // allocate addr, _ := u.Mmap(0, args[0]) // args[1] == is executable writeAddr(u, args[2], addr) case 6: // fdwait nfds := int(args[0]) var readSet, writeSet *fdset32 var timeout posix.Timespec u.StrucAt(args[1]).Unpack(&readSet) u.StrucAt(args[2]).Unpack(&writeSet) u.StrucAt(args[3]).Unpack(&timeout) readyFds := args[4] readNative := readSet.Native() writeNative := writeSet.Native() n, err := cgcNativeSelect(nfds, readNative, writeNative, &timeout) if err != nil { ret = UINT32_MAX // FIXME? } else { numReady := int32(n) if readyFds != 0 { u.StrucAt(readyFds).Pack(numReady) } } case 7: // random tmp := make([]byte, args[1]) rand.Read(tmp) u.MemWrite(args[0], tmp) writeAddr(u, args[2], args[1]) } u.RegWrite(uc.X86_REG_EAX, ret) }
func writeAddr(u models.Usercorn, addr, val uint64) { var buf [4]byte u.PackAddr(buf[:], val) u.MemWrite(addr, buf[:]) }
func setupTraps(u models.Usercorn, kernel *ArmLinuxKernel) error { // handle arm kernel traps // https://www.kernel.org/doc/Documentation/arm/kernel_user_helpers.txt if err := u.MemMap(0xffff0000, 0x10000); err != nil { return err } for addr := 0; addr < 0x10000; addr += 4 { // write "bx lr" to all kernel trap addresses so they will return bxlr := []byte{0x1e, 0xff, 0x2f, 0xe1} if err := u.MemWrite(0xffff0000+uint64(addr), bxlr); err != nil { return err } } _, err := u.HookAdd(uc.HOOK_CODE, func(_ uc.Unicorn, addr uint64, size uint32) { switch addr { case 0xffff0fa0: // __kuser_memory_barrier // *shrug* case 0xffff0f60: // __kuser_cmpxchg64 // TODO: DRY possible here? oldval, _ := u.RegRead(uc.ARM_REG_R0) newval, _ := u.RegRead(uc.ARM_REG_R1) ptr, _ := u.RegRead(uc.ARM_REG_R2) var tmp [8]byte var status uint64 if err := u.MemReadInto(tmp[:], ptr); err != nil { // error } else if u.ByteOrder().Uint64(tmp[:]) == oldval { u.ByteOrder().PutUint64(tmp[:], newval) u.MemWrite(ptr, tmp[:]) status = 1 } u.RegWrite(uc.ARM_REG_R0, status) case 0xffff0fc0: // __kuser_cmpxchg // TODO: would this throw a segfault? // TODO: flags are not set oldval, _ := u.RegRead(uc.ARM_REG_R0) newval, _ := u.RegRead(uc.ARM_REG_R1) ptr, _ := u.RegRead(uc.ARM_REG_R2) var tmp [4]byte var status uint64 if err := u.MemReadInto(tmp[:], ptr); err != nil { // error } else if u.UnpackAddr(tmp[:]) == oldval { u.PackAddr(tmp[:], newval) u.MemWrite(ptr, tmp[:]) status = 1 } u.RegWrite(uc.ARM_REG_R0, status) case 0xffff0fe0: // __kuser_get_tls u.RegWrite(uc.ARM_REG_R0, kernel.tls) case 0xffff0ffc: // __kuser_helper_version u.RegWrite(uc.ARM_REG_R0, 2) default: panic(fmt.Sprintf("unsupported kernel trap: 0x%x\n", addr)) } }, 0xffff0000, 0xffffffff) if err != nil { return err } return nil }