Skip to content
Snippets Groups Projects
Commit d1ec912f authored by whh8b's avatar whh8b
Browse files

Update fix_canaries to send additional parameters

to the debugging callback function.



Former-commit-id: 668914bc63d0f814955b2d3198bdcdc0deeb5f02
parent ec95745a
No related branches found
No related tags found
No related merge requests found
......@@ -55,15 +55,18 @@ void FixCanaries::FindStartAddress()
}
Instruction_t *FixCanaries::add_instrumentation(Instruction_t *site,
const char *canary_register, const char *callback_name)
const char *canary_register, const char *callback_name, const char *lea)
{
FileIR_t *firp = getFileIR();
virtual_offset_t postCallbackReturn = getAvailableAddress();
char pushRetBuf[100], movCanaryValueBuf[100], movfs0x28Buf[100];
char pushRetBuf[100], movCanaryValueBuf[100], movfs0x28Buf[100], setRdx[100];
sprintf(pushRetBuf,"push 0x%x", postCallbackReturn);
sprintf(movCanaryValueBuf,"mov rsi, %s", canary_register);
sprintf(movfs0x28Buf,"mov rdi, [fs:0x28]");
if (lea != NULL)
sprintf(setRdx,"lea rdx, [%s]", lea);
Instruction_t *tmp=site, *callback=NULL, *post_callback=NULL;
tmp=::insertAssemblyAfter(firp,tmp,"push rsp");
......@@ -85,6 +88,10 @@ Instruction_t *FixCanaries::add_instrumentation(Instruction_t *site,
tmp=insertAssemblyAfter(firp,tmp,"pushf");
tmp=insertAssemblyAfter(firp,tmp,movfs0x28Buf);
tmp=insertAssemblyAfter(firp,tmp,movCanaryValueBuf);
if (lea != NULL)
tmp=insertAssemblyAfter(firp,tmp,setRdx);
else
tmp=insertAssemblyAfter(firp,tmp,"mov rdx, 0x0");
/*
* The "bogus" return address that we push here
* will be popped by the callback handler
......@@ -268,7 +275,7 @@ int FixCanaries::execute()
tmp_insn = add_instrumentation(
tmp_insn,
target_reg_name,
m_callback.c_str());
m_callback.c_str(), rsp_reg_and_offset);
tmp_insn->SetFallthrough(mov_insn);
}
......
......@@ -20,7 +20,7 @@ class FixCanaries : public libTransform::Transform
void set_verbose(bool v) { m_verbose = v; }
void set_callback(const std::string &);
private:
libIRDB::Instruction_t *add_instrumentation(libIRDB::Instruction_t *, const char *, const char *);
libIRDB::Instruction_t *add_instrumentation(libIRDB::Instruction_t *, const char *, const char *, const char *lea = NULL);
void LoadElf();
void FindStartAddress();
std::unique_ptr<ELFIO::elfio> m_elfiop;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment