No commit message

No commit message

Makefile

+
+
+PROGS=selective_cfi.exe
+
+CXX=g++
+INCLUDE=-I. -I../include -I../xform -I../../beaengine/include -I../../libIRDB/include/ -I../../libMEDSannotation/include/ -I../libtransform/include/ -I../transforms
+LIBS=-L../../lib -lxform -lIRDB-core -lIRDB-cfg -lBeaEngine_s_d -lpqxx  -lMEDSannotation -ltransform ../transforms/Rewrite_Utility.o
+CXXFLAGS= -g -Wall $(INCLUDE)
+
+
+OBJS=scfi_driver.o scfi_instr.o
+programs=selective_cfi.exe
+
+.SUFFIXES: .o .c .exe .cpp .hpp
+
+all: $(programs)
+	@echo "---------------------------------------------------"
+	@echo "- Return Shadow Stack directory -- Build complete -"
+	@echo "---------------------------------------------------"
+
+
+-include $(OBJS:.o=.d)
+
+%.o: %.cpp
+	$(CXX) -c  $(CXXFLAGS) $*.cpp 
+	@#
+	@# build dependencies --  http://scottmcpeak.com/autodepend/autodepend.html
+	@#
+	$(CXX) -MM $(CXXFLAGS) $*.cpp > $*.d
+	@cp -f $*.d $*.d.tmp
+	@sed -e 's/.*://' -e 's/\\$$//' < $*.d.tmp | fmt -1 | sed -e 's/^ *//' -e 's/$$/:/' >> $*.d
+	@rm -f $*.d.tmp
+	
+clean:
+	rm -f *.o core *.exe
+
+$(programs): ../../lib/*.a
+
+selective_cfi.exe:   $(OBJS)
+	$(CXX) $(CXXFLAGS) $^ $(INCLUDE) $(LIBS) -o $@
+

scfi_driver.cpp

+#include <stdlib.h>
+#include <fstream>
+#include <libIRDB-core.hpp>
+#include <libgen.h>
+
+#include "scfi_instr.hpp"
+
+using namespace std;
+using namespace libIRDB;
+
+
+#define BINARY_NAME "a.ncexe"
+#define SHARED_OBJECTS_DIR "shared_objects"
+
+
+void usage(char* name)
+{
+	cerr<<"Usage: "<<name<<" <variant_id>\n"; 
+}
+
+int main(int argc, char **argv)
+{
+        if(argc != 2)
+        {
+                usage(argv[0]);
+                exit(1);
+        }
+
+        string programName(argv[0]);
+        int variantID = atoi(argv[1]);
+
+        VariantID_t *pidp=NULL;
+
+        /* setup the interface to the sql server */
+        pqxxDB_t pqxx_interface;
+        BaseObj_t::SetInterface(&pqxx_interface);
+
+        pidp=new VariantID_t(variantID);
+        assert(pidp->IsRegistered()==true);
+
+	cout<<"ret_shadow_stack.exe started\n";
+
+        bool one_success = false;
+        for(set<File_t*>::iterator it=pidp->GetFiles().begin();
+            it!=pidp->GetFiles().end();
+                ++it)
+        {
+                File_t* this_file = *it;
+                FileIR_t *firp = new FileIR_t(*pidp, this_file);
+
+		cout<<"Transforming "<<this_file->GetURL()<<endl;
+
+                assert(firp && pidp);
+
+                try
+                {
+			SCFI_Instrument scfii(firp);
+
+
+			int success=scfii.execute();
+
+                        if (success)
+                        {
+				cout<<"Writing changes for "<<this_file->GetURL()<<endl;
+                                one_success = true;
+                                firp->WriteToDB();
+                                delete firp;
+                        }
+			else
+			{
+				cout<<"Skipping (no changes) "<<this_file->GetURL()<<endl;
+			}
+                }
+                catch (DatabaseError_t pnide)
+                {
+                        cerr << programName << ": Unexpected database error: " << pnide << "file url: " << this_file->GetURL() << endl;
+                }
+                catch (...)
+                {
+                        cerr << programName << ": Unexpected error file url: " << this_file->GetURL() << endl;
+                }
+        } // end file iterator
+
+        // if any integer transforms for any files succeeded, we commit
+        if (one_success)
+	{
+		cout<<"Commiting changes...\n";
+                pqxx_interface.Commit();
+	}
+
+        return 0;
+}
+

scfi_instr.cpp

+
+#include "scfi_instr.hpp"
+#include "MEDS_SafeFuncAnnotation.hpp"
+#include "FuncExitAnnotation.hpp"
+#include "MEDS_ProblemFuncAnnotation.hpp"
+#include "Rewrite_Utility.hpp"
+#include <stdlib.h>
+
+
+
+using namespace std;
+using namespace libIRDB;
+using namespace MEDS_Annotation;
+
+virtual_offset_t getAvailableAddress(FileIR_t *p_virp)
+{
+
+        static int counter = -16;
+        counter += 16;
+        return 0xf0020000 + counter;
+}
+
+
+
+
+static Instruction_t* addNewAssembly(FileIR_t* firp, Instruction_t *p_instr, string p_asm)
+{
+        Instruction_t* newinstr;
+        if (p_instr)
+                newinstr = allocateNewInstruction(firp,p_instr->GetAddress()->GetFileID(), p_instr->GetFunction());
+        else   
+                newinstr = allocateNewInstruction(firp,BaseObj_t::NOT_IN_DATABASE, NULL);
+
+        firp->RegisterAssembly(newinstr, p_asm);
+
+        if (p_instr)
+        {
+                newinstr->SetFallthrough(p_instr->GetFallthrough());
+                p_instr->SetFallthrough(newinstr);
+        }
+
+        return newinstr;
+}
+
+
+static Instruction_t* registerCallbackHandler64(FileIR_t* firp, Instruction_t *p_orig, string p_callbackHandler, int p_numArgs)
+{
+
+        Instruction_t *instr;
+        Instruction_t *first;
+        char tmpbuf[1024];
+
+        // save flags and 16 registers (136 bytes)
+        // call pushes 8 bytes
+        // Total: 8 * 18 = 144
+        first = instr = addNewAssembly(firp,NULL, "push rsp");
+        instr = addNewAssembly(firp,instr, "push rbp");
+        instr = addNewAssembly(firp,instr, "push rdi");
+        instr = addNewAssembly(firp,instr, "push rsi");
+        instr = addNewAssembly(firp,instr, "push rdx");
+        instr = addNewAssembly(firp,instr, "push rcx");
+        instr = addNewAssembly(firp,instr, "push rbx");
+        instr = addNewAssembly(firp,instr, "push rax");
+        instr = addNewAssembly(firp,instr, "push r8");
+        instr = addNewAssembly(firp,instr, "push r9");
+        instr = addNewAssembly(firp,instr, "push r10");
+        instr = addNewAssembly(firp,instr, "push r11");
+        instr = addNewAssembly(firp,instr, "push r12");
+        instr = addNewAssembly(firp,instr, "push r13");
+        instr = addNewAssembly(firp,instr, "push r14");
+        instr = addNewAssembly(firp,instr, "push r15");
+        instr = addNewAssembly(firp,instr, "pushf");
+
+        // handle the arguments (if any): rdi, rsi, rdx, rcx, r8, r9
+        // first arg starts at byte +144
+        instr = addNewAssembly(firp,instr, "mov rdi, rsp");
+
+	if (p_numArgs >= 1)
+                instr = addNewAssembly(firp,instr,  "mov rsi, [rsp+144]");
+        if (p_numArgs >= 2)
+                instr = addNewAssembly(firp,instr,  "mov rdx, [rsp+152]");
+        if (p_numArgs >= 3)
+                instr = addNewAssembly(firp,instr,  "mov rcx, [rsp+160]");
+        if (p_numArgs >= 4)
+                instr = addNewAssembly(firp,instr,  "mov r8, [rsp+168]");
+        if (p_numArgs > 4)
+                assert(0); // only handle up to 5 args
+
+        // pin the instruction that follows the callback handler
+        Instruction_t* postCallback = allocateNewInstruction(firp, BaseObj_t::NOT_IN_DATABASE, NULL);
+        virtual_offset_t postCallbackReturn = getAvailableAddress(firp);
+        postCallback->GetAddress()->SetVirtualOffset(postCallbackReturn);
+
+        // push the address to return to once the callback handler is invoked
+        sprintf(tmpbuf,"mov rax, 0x%x", postCallbackReturn);
+        instr = addNewAssembly(firp,instr, tmpbuf);
+
+        instr = addNewAssembly(firp,instr, "push rax");
+
+        // use a nop instruction for the actual callback
+        instr = addNewAssembly(firp,instr, "nop");
+        instr->SetComment(" -- callback: " + p_callbackHandler);
+        instr->SetCallback(p_callbackHandler);
+        instr->SetFallthrough(postCallback);
+
+
+        // need to make sure the post callback address is pinned
+        // (so that ILR and other transforms do not relocate it)
+        AddressID_t *indTarg = new AddressID_t();
+        firp->GetAddresses().insert(indTarg);
+        indTarg->SetVirtualOffset(postCallback->GetAddress()->GetVirtualOffset());
+        indTarg->SetFileID(BaseObj_t::NOT_IN_DATABASE); // SPRI global namespace
+        postCallback->SetIndirectBranchTargetAddress(indTarg);
+
+        // restore registers
+        firp->RegisterAssembly(postCallback, "popf");
+
+
+        instr = addNewAssembly(firp,postCallback, "pop r15");
+        instr = addNewAssembly(firp,instr, "pop r14");
+        instr = addNewAssembly(firp,instr, "pop r13");
+        instr = addNewAssembly(firp,instr, "pop r12");
+        instr = addNewAssembly(firp,instr, "pop r11");
+        instr = addNewAssembly(firp,instr, "pop r10");
+        instr = addNewAssembly(firp,instr, "pop r9");
+        instr = addNewAssembly(firp,instr, "pop r8");
+        instr = addNewAssembly(firp,instr, "pop rax");
+        instr = addNewAssembly(firp,instr, "pop rbx");
+        instr = addNewAssembly(firp,instr, "pop rcx");
+        instr = addNewAssembly(firp,instr, "pop rdx");
+        instr = addNewAssembly(firp,instr, "pop rsi");
+        instr = addNewAssembly(firp,instr, "pop rdi");
+        instr = addNewAssembly(firp,instr, "pop rbp");
+        instr = addNewAssembly(firp,instr, "lea rsp, [rsp+8]");
+
+        instr = addNewAssembly(firp,instr, "ret");
+
+        // return first instruction in the callback handler chain
+        return first;
+
+}
+
+
+// x86-64
+// 20140421
+static void ConvertCallToCallbackHandler64(FileIR_t* firp, Instruction_t *p_orig, string p_callbackHandler, int p_numArgs)
+{
+	static std::map<std::string, Instruction_t*> m_handlerMap;
+        // nb: if first time, register and cache callback handler sequence
+        if (m_handlerMap.count(p_callbackHandler) == 0)
+        {
+                m_handlerMap[p_callbackHandler] = registerCallbackHandler64(firp,p_orig, p_callbackHandler, p_numArgs);
+        }
+
+        if (p_orig)
+                p_orig->SetTarget(m_handlerMap[p_callbackHandler]);
+}
+
+
+static Instruction_t* addCallbackHandlerSequence
+	(
+	  FileIR_t* firp,
+  	  Instruction_t *p_orig, 
+	  bool before,
+	  std::string p_detector
+	)
+{
+
+	if(before)
+		insertAssemblyBefore(firp,p_orig,"lea rsp, [rsp-128]");
+	else
+		assert(0); // add handling  for inserting lea after given insn
+
+        p_orig->SetComment("callback: " + p_detector);
+
+
+        Instruction_t* call =insertAssemblyAfter(firp,p_orig,"call 0");
+
+        ConvertCallToCallbackHandler64(firp, call, p_detector, 0); // no args for now
+
+	insertAssemblyAfter(firp,call,"lea rsp, [rsp + 128 + 0]"); // no args for nwo 
+
+        return p_orig;
+}
+
+
+
+Relocation_t* SCFI_Instrument::create_reloc(Instruction_t* insn)
+{
+        Relocation_t* reloc=new Relocation_t;
+        insn->GetRelocations().insert(reloc);
+        firp->GetRelocations().insert(reloc);
+
+	return reloc;
+}
+
+
+
+
+
+
+bool SCFI_Instrument::add_scfi_instrumentation(Instruction_t* insn)
+{
+	bool success=true;
+
+	if(getenv("SCFI_VERBOSE")!=NULL)
+		;
+
+
+	return success;
+}
+
+
+
+
+
+bool SCFI_Instrument::needs_scfi_instrumentation(Instruction_t* insn)
+{
+	return false;
+
+}
+
+bool SCFI_Instrument::mark_targets() 
+{
+	return true;
+}
+
+bool SCFI_Instrument::instrument_jumps() 
+{
+	return true;
+}
+
+
+bool SCFI_Instrument::execute()
+{
+
+	bool success=false;
+
+	success = success && mark_targets();
+	success = success && instrument_jumps();
+
+	return success;
+}
+
+

scfi_instr.hpp

+#ifndef scfi_instrument_hpp
+#define scfi_instrument_hpp
+
+#include <libIRDB-core.hpp>
+
+
+
+class SCFI_Instrument
+{
+	public:
+		SCFI_Instrument(libIRDB::FileIR_t *the_firp) : firp(the_firp) {}
+		bool execute();
+
+	private:
+
+
+		// find instrumentation points.
+		bool mark_targets();
+		bool instrument_jumps();
+
+		// helper
+		libIRDB::Relocation_t* create_reloc(libIRDB::Instruction_t* insn);
+
+		// add instrumentation
+		bool add_scfi_instrumentation(libIRDB::Instruction_t* insn);
+		bool needs_scfi_instrumentation(libIRDB::Instruction_t* insn);
+	
+		libIRDB::FileIR_t* firp;
+
+
+};
+
+#endif
+