Пример #1
0
func CgcSyscall(u models.Usercorn) {
	// TODO: handle errors or something
	args, _ := u.ReadRegs(LinuxRegs)
	eax, _ := u.RegRead(uc.X86_REG_EAX)
	var ret uint64
	switch eax {
	case 1: // _terminate
		syscall.Exit(int(args[0]))
	case 2: // transmit
		mem, _ := u.MemRead(args[1], args[2])
		n, _ := syscall.Write(int(args[0]), mem)
		writeAddr(u, args[3], uint64(n))
	case 3: // receive
		tmp := make([]byte, args[2])
		n, _ := syscall.Read(int(args[0]), tmp)
		u.MemWrite(args[1], tmp[:n])
		writeAddr(u, args[3], uint64(n))
	case 5: // allocate
		addr, _ := u.Mmap(0, args[0])
		// args[1] == is executable
		writeAddr(u, args[2], addr)
	case 6: // fdwait
		nfds := int(args[0])
		var readSet, writeSet *fdset32
		var timeout posix.Timespec
		u.StrucAt(args[1]).Unpack(&readSet)
		u.StrucAt(args[2]).Unpack(&writeSet)
		u.StrucAt(args[3]).Unpack(&timeout)
		readyFds := args[4]

		readNative := readSet.Native()
		writeNative := writeSet.Native()
		n, err := cgcNativeSelect(nfds, readNative, writeNative, &timeout)
		if err != nil {
			ret = UINT32_MAX // FIXME?
		} else {
			numReady := int32(n)
			if readyFds != 0 {
				u.StrucAt(readyFds).Pack(numReady)
			}
		}
	case 7: // random
		tmp := make([]byte, args[1])
		rand.Read(tmp)
		u.MemWrite(args[0], tmp)
		writeAddr(u, args[2], args[1])
	}
	u.RegWrite(uc.X86_REG_EAX, ret)
}
Пример #2
0
func enterUsermode(u models.Usercorn) error {
	// move CPU from System to User mode
	modeSwitch := []byte{
		0x00, 0x00, 0x0f, 0xe1, // mrs r0, cpsr
		0x1f, 0x00, 0xc0, 0xe3, // bic r0, r0, $0x1f
		0x10, 0x00, 0x80, 0xe3, // orr r0, r0, $0x10
		0x00, 0xf0, 0x21, 0xe1, // msr cpsr_c, r0
	}
	mmap, err := u.Mmap(0, uint64(len(modeSwitch)))
	if err != nil {
		return err
	}
	defer u.MemUnmap(mmap.Addr, mmap.Size)
	end := mmap.Addr + uint64(len(modeSwitch))
	err = u.RunShellcodeMapped(mmap, modeSwitch,
		map[int]uint64{uc.ARM_REG_LR: end},
		[]int{uc.ARM_REG_R0, uc.ARM_REG_LR, uc.ARM_REG_SP},
	)
	return err
}