Skip to content

Commit 1fa4cce

Browse files
committed
librasan: Simplify patch for ARM
1 parent 19f24cb commit 1fa4cce

File tree

1 file changed

+35
-51
lines changed
  • libafl_qemu/librasan/asan/src/patch

1 file changed

+35
-51
lines changed

libafl_qemu/librasan/asan/src/patch/raw.rs

+35-51
Original file line numberDiff line numberDiff line change
@@ -15,34 +15,18 @@ pub struct RawPatch;
1515
impl Patch for RawPatch {
1616
type Error = RawPatchError;
1717

18-
#[cfg(not(target_arch = "arm"))]
19-
fn patch(target: GuestAddr, destination: GuestAddr) -> Result<(), Self::Error> {
20-
debug!("patch - addr: {:#x}, target: {:#x}", target, destination);
21-
if target == destination {
22-
Err(RawPatchError::IdentityPatch(target))?;
23-
}
24-
let patch = Self::get_patch(destination)?;
25-
trace!("patch: {:02x?}", patch);
26-
let dest = unsafe { from_raw_parts_mut(target as *mut u8, patch.len()) };
27-
dest.copy_from_slice(&patch);
28-
Ok(())
29-
}
30-
31-
#[cfg(target_arch = "arm")]
3218
fn patch(target: GuestAddr, destination: GuestAddr) -> Result<(), Self::Error> {
3319
debug!("patch - addr: {:#x}, target: {:#x}", target, destination);
3420
if target == destination {
3521
Err(RawPatchError::IdentityPatch(target))?;
3622
}
23+
let patch = Self::get_patch(target, destination)?;
3724

38-
let patch = if target & 1 == 1 {
39-
Self::get_patch_thumb(destination)?
40-
} else {
41-
Self::get_patch_arm(destination)?
42-
};
25+
// Mask the thumb mode indicator bit
26+
#[cfg(target_arch = "arm")]
27+
let target = target & !1;
4328

4429
trace!("patch: {:02x?}", patch);
45-
let target = target & !1;
4630
let dest = unsafe { from_raw_parts_mut(target as *mut u8, patch.len()) };
4731
dest.copy_from_slice(&patch);
4832
Ok(())
@@ -51,7 +35,7 @@ impl Patch for RawPatch {
5135

5236
impl RawPatch {
5337
#[cfg(target_arch = "x86_64")]
54-
fn get_patch(destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
38+
fn get_patch(_target: GuestAddr, destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
5539
// mov rax, 0xdeadfacef00dd00d
5640
// jmp rax
5741
let insns = [
@@ -77,7 +61,7 @@ impl RawPatch {
7761
}
7862

7963
#[cfg(target_arch = "x86")]
80-
fn get_patch(destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
64+
fn get_patch(_target: GuestAddr, destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
8165
// mov eax, 0xdeadface
8266
// jmp eax
8367
let insns = [
@@ -91,37 +75,37 @@ impl RawPatch {
9175
}
9276

9377
#[cfg(target_arch = "arm")]
94-
fn get_patch_arm(destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
95-
// ldr ip, [pc]
96-
// bx ip
97-
// .long 0xdeadface
98-
let insns = [
99-
[0x00, 0xc0, 0x9f, 0xe5].to_vec(),
100-
[0x1c, 0xff, 0x2f, 0xe1].to_vec(),
101-
[0xce, 0xfa, 0xad, 0xde].to_vec(),
102-
];
103-
let addr = destination.to_ne_bytes().to_vec();
104-
let insns_mod = [&insns[0], &insns[1], &addr];
105-
Ok(insns_mod.into_iter().flatten().cloned().collect())
106-
}
107-
108-
#[cfg(target_arch = "arm")]
109-
fn get_patch_thumb(destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
110-
// ldr ip, [pc, #2]
111-
// bx ip
112-
// .long 0xdeadface
113-
let insns = [
114-
[0xdf, 0xf8, 0x02, 0xc0].to_vec(),
115-
[0x60, 0x47].to_vec(),
116-
[0xce, 0xfa, 0xad, 0xde].to_vec(),
117-
];
118-
let addr = destination.to_ne_bytes().to_vec();
119-
let insns_mod = [&insns[0], &insns[1], &addr];
120-
Ok(insns_mod.into_iter().flatten().cloned().collect())
78+
fn get_patch(target: GuestAddr, destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
79+
// If our target is in thumb mode
80+
if target & 1 == 1 {
81+
// ldr ip, [pc, #2]
82+
// bx ip
83+
// .long 0xdeadface
84+
let insns = [
85+
[0xdf, 0xf8, 0x02, 0xc0].to_vec(),
86+
[0x60, 0x47].to_vec(),
87+
[0xce, 0xfa, 0xad, 0xde].to_vec(),
88+
];
89+
let addr = destination.to_ne_bytes().to_vec();
90+
let insns_mod = [&insns[0], &insns[1], &addr];
91+
Ok(insns_mod.into_iter().flatten().cloned().collect())
92+
} else {
93+
// ldr ip, [pc]
94+
// bx ip
95+
// .long 0xdeadface
96+
let insns = [
97+
[0x00, 0xc0, 0x9f, 0xe5].to_vec(),
98+
[0x1c, 0xff, 0x2f, 0xe1].to_vec(),
99+
[0xce, 0xfa, 0xad, 0xde].to_vec(),
100+
];
101+
let addr = destination.to_ne_bytes().to_vec();
102+
let insns_mod = [&insns[0], &insns[1], &addr];
103+
Ok(insns_mod.into_iter().flatten().cloned().collect())
104+
}
121105
}
122106

123107
#[cfg(target_arch = "aarch64")]
124-
fn get_patch(destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
108+
fn get_patch(_target: GuestAddr, destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
125109
// ldr x16, #8
126110
// br x16
127111
// .quad 0xdeadfacef00dd00d
@@ -137,7 +121,7 @@ impl RawPatch {
137121
}
138122

139123
#[cfg(target_arch = "powerpc")]
140-
fn get_patch(destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
124+
fn get_patch(_target: GuestAddr, destination: GuestAddr) -> Result<Vec<u8>, RawPatchError> {
141125
// lis 12, 0xdead
142126
// ori 12, 12, 0xface
143127
// mtctr 12

0 commit comments

Comments
 (0)