Skip to content

Commit

Permalink
potential bug fix
Browse files Browse the repository at this point in the history
  • Loading branch information
lenawanel committed Apr 17, 2024
1 parent 9237902 commit b541a10
Show file tree
Hide file tree
Showing 3 changed files with 78 additions and 25 deletions.
8 changes: 4 additions & 4 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

63 changes: 43 additions & 20 deletions src/emu.rs
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,36 @@ static mut IP: u64 = 0;
type Result<T> = std::result::Result<T, ExecErr>;

impl Emu {
// for reference https://github.com/jart/blink/blob/master/blink/argv.c
fn prepare_auxv(&mut self, progname: Virtaddr) -> Virtaddr {
fn push_auxv(emu: &mut Emu, k: u64, v: u64) -> Virtaddr {
emu.push(k);
emu.push(v)
}

let rand = push_auxv(self, 0xdeadbeefdeadbeef, 0xdeadbeefdeadbeef);

push_auxv(self, 0, 0);
push_auxv(self, 11, 1000);
push_auxv(self, 12, 1000);
push_auxv(self, 13, 1000);
push_auxv(self, 14, 1000);
push_auxv(self, 23, 0);
push_auxv(self, 6, 4096);
push_auxv(self, 17, 100);
push_auxv(self, 25, rand.0 as u64);
push_auxv(self, 31, progname.0 as u64)
}

fn push<const SIZE: usize>(&mut self, n: impl Primitive<SIZE>) -> Virtaddr {
let sp = self.get_reg::<u64, 8>(Register::RSP) as usize - SIZE;
self.memory
.write_primitive(Virtaddr(sp), n)
.expect("Push failed");
self.set_reg(sp, Register::RSP);
return Virtaddr(sp);
}

pub fn load<P: AsRef<Path>>(&mut self, file: P) {
let (rip, frame, exec_range) = self.memory.load(file);
self.set_reg(rip.0 as u64, Register::RIP);
Expand All @@ -44,31 +74,24 @@ impl Emu {
}

// Set up the program name
let argv = self
let progname = self
.memory
.allocate(8)
.expect("Failed to allocate program name");
self.memory
.write_from(Virtaddr(argv.0 - 8), b"test\0")
.allocate_write(b"/bin/test\0")
.expect("Failed to write program name");
self.prepare_auxv(progname);

macro_rules! push {
($expr:expr) => {
let sp = self.get_reg::<u64, 8>(Register::RSP) as usize
- core::mem::size_of_val(&$expr) as usize;
self.memory
.write_primitive(Virtaddr(sp), $expr)
.expect("Push failed");
self.set_reg(sp, Register::RSP);
};
}
// Set up the program name
let argv = self
.memory
.allocate_write(b"/bin/test\0")
.expect("Failed to write program name");

// Set up the initial program stack state
push!(0u64); // Auxp
push!(0u64); // Envp
push!(0u64); // Argv end
push!(argv.0); // Argv
push!(1u64); // Argc
self.push(0u64); // Auxp
self.push(0u64); // Envp
self.push(0u64); // Argv end
self.push(argv.0); // Argv
self.push(1u64); // Argc
}

pub fn new(size: usize) -> Self {
Expand Down
32 changes: 31 additions & 1 deletion src/mmu.rs
Original file line number Diff line number Diff line change
Expand Up @@ -96,11 +96,13 @@ impl MMU {
}

/// write a buffer to a virtual adress
#[must_use]
pub fn write_from(&mut self, addr: Virtaddr, buf: &[u8]) -> Result<()> {
self.write_from_perms(addr, buf, PERM_WRITE)
}

/// write a buffer to a virtual adress, checking if we have the given permissions
#[must_use]
pub fn write_from_perms(&mut self, addr: Virtaddr, buf: &[u8], exp_perm: Perm) -> Result<()> {
#[cfg(feature = "raw_tracking")]
let mut has_raw = false;
Expand Down Expand Up @@ -266,7 +268,35 @@ impl MMU {
return None;
}

Some(self.cur_alc)
Some(base)
}

pub fn allocate_write(&mut self, buf: &[u8]) -> Option<Virtaddr> {
// 32-byte align the allocation
// this is required for SSE memcpy
let align_size = (buf.len() + 0x1f) & !0x1f;

// Get the current allocation base
let base = self.cur_alc;

// Update the allocation address
self.cur_alc = Virtaddr(self.cur_alc.0.checked_add(align_size)?);

// Could not satisfy allocation without going OOM
if self.cur_alc.0 > self.memory.len() {
return None;
}

if self
.set_permissions(base, align_size, PERM_WRITE | PERM_READ)
.is_err()
{
return None;
}

self.write_from(base, buf).unwrap();

Some(base)
}
/// this function reads primitives as [u8; N],
/// this is to circumvent the restriction of using generic const expressions
Expand Down

0 comments on commit b541a10

Please sign in to comment.