/*
* decodes an escape code. These are
* shared between strings and characters.
* Unknown escape codes are ignored.
*/
static int decode(char **buf, size_t *len, size_t *sz)
{
char c, c1, c2;
int32_t v;
c = next();
/* we've already seen the '\' */
switch (c) {
case 'u':
v = unichar();
appendc(buf, len, sz, v);
return v;
case 'x': /* arbitrary hex */
c1 = next();
if (!isxdigit(c1))
lfatal(curloc, "expected hex digit, got %c", c1);
c2 = next();
if (!isxdigit(c2))
lfatal(curloc, "expected hex digit, got %c", c1);
v = 16*hexval(c1) + hexval(c2);
break;
case 'n': v = '\n'; break;
case 'r': v = '\r'; break;
case 't': v = '\t'; break;
case 'b': v = '\b'; break;
case '"': v = '\"'; break;
case '\'': v = '\''; break;
case 'v': v = '\v'; break;
case '\\': v = '\\'; break;
case '0': v = '\0'; break;
default: lfatal(curloc, "unknown escape code \\%c", c);
}
append(buf, len, sz, v);
return v;
}
int
parse_mac_address(const char *text, unsigned char *mac)
{
unsigned i;
for (i=0; i<6; i++) {
unsigned x;
char c;
while (isspace(*text & 0xFF) && ispunct(*text & 0xFF))
text++;
c = *text;
if (!isxdigit(c&0xFF))
return -1;
x = hexval(c)<<4;
text++;
c = *text;
if (!isxdigit(c&0xFF))
return -1;
x |= hexval(c);
text++;
mac[i] = (unsigned char)x;
if (ispunct(*text & 0xFF))
text++;
}
return 0;
}
void BaseInstructions::printMessage(S2EExecutionState *state, bool isWarning)
{
uint32_t address = 0; //XXX
bool ok = state->readCpuRegisterConcrete(CPU_OFFSET(regs[R_EAX]),
&address, 4);
if(!ok) {
s2e()->getWarningsStream(state)
<< "ERROR: symbolic argument was passed to s2e_op "
" message opcode\n";
return;
}
std::string str="";
if(!address || !state->readString(address, str)) {
s2e()->getWarningsStream(state)
<< "Error reading string message from the guest at address "
<< hexval(address) << '\n';
} else {
llvm::raw_ostream *stream;
if(isWarning)
stream = &s2e()->getWarningsStream(state);
else
stream = &s2e()->getMessagesStream(state);
(*stream) << "Message from guest (" << hexval(address) <<
"): " << str << '\n';
}
}
int url_pct_decode (char *s)
{
char *d;
if (!s)
return -1;
for (d = s; *s; s++)
{
if (*s == '%')
{
if (s[1] && s[2] &&
isxdigit ((unsigned char) s[1]) &&
isxdigit ((unsigned char) s[2]) &&
hexval (s[1]) >= 0 && hexval (s[2]) >= 0)
{
*d++ = (hexval (s[1]) << 4) | (hexval (s[2]));
s += 2;
}
else
return -1;
} else
*d++ = *s;
}
*d ='\0';
return 0;
}
/**
* Unquote Python or octal-style quoting of a string
*/
string feature_recorder::unquote_string(const string &s)
{
size_t len = s.size();
if(len<4) return s; // too small for a quote
string out;
for(size_t i=0;i<len;i++){
/* Look for octal coding */
if(i+3<len && s[i]=='\\' && isodigit(s[i+1]) && isodigit(s[i+2]) && isodigit(s[i+3])){
uint8_t code = (s[i+1]-'0') * 64 + (s[i+2]-'0') * 8 + (s[i+3]-'0');
out.push_back(code);
i += 3; // skip over the digits
continue;
}
/* Look for hex coding */
if(i+3<len && s[i]=='\\' && s[i+1]=='x' && isxdigit(s[i+2]) && isxdigit(s[i+3])){
uint8_t code = (hexval(s[i+2])<<4) | hexval(s[i+3]);
out.push_back(code);
i += 3; // skip over the digits
continue;
}
out.push_back(s[i]);
}
return out;
}
int parse_string(char* input, char* output) {
char* c = input;
char* o = output;
int h1, h2;
while (*c) {
/* parse escape sequence \xhh */
if ( c[0] == '\\' &&
(c[1] == 'x' || c[1] == 'X') &&
(h2=hexval(c[2])) != -1 &&
(h1=hexval(c[3])) != -1
) {
*o++ = h2*16 + h1;
c += 4;
continue;
}
/* or just copy char */
*o++ = *c++;
}
*o = 0;
return (o - output);
}
/**
* A call handler can invoke this function to register a return handler.
* XXX: We assume that the passed execution state corresponds to the state in which
* this instance of FunctionMonitorState is used.
*/
void FunctionMonitorState::registerReturnSignal(S2EExecutionState *state, FunctionMonitor::ReturnSignal &sig)
{
if(sig.empty()) {
return;
}
uint32_t sp;
#ifdef TARGET_ARM
bool ok = state->readCpuRegisterConcrete(CPU_OFFSET(regs[13]),
&sp, sizeof(target_ulong));
#elif defined(TARGET_I386)
bool ok = state->readCpuRegisterConcrete(CPU_OFFSET(regs[R_ESP]),
&sp, sizeof(target_ulong));
#else
assert(false);
#endif
uint64_t pid = state->getPid();
if (m_plugin->m_monitor) {
pid = m_plugin->m_monitor->getPid(state, state->getPc());
}
if(!ok) {
m_plugin->s2e()->getWarningsStream(state)
<< "Function call with symbolic SP!" << std::endl
<< " PC=" << hexval(state->getPc()) << " PID=" << hexval(pid) << std::endl;
return;
}
ReturnDescriptor descriptor = {pid, sig };
m_returnDescriptors.insert(std::make_pair(sp, descriptor));
}
static char nmea_rx_validate(void)
{
char csok = 0;
unsigned char cs_calc = 0;
unsigned char cs_recv;
short i;
/* assume that $, CR and LF are not present the buffer */
/* check if a checksum is present */
if (rx_len >= 9 && rx[rx_len-3] == '*') /* contains at least "$XXXXX,*HH" */
{
/* calculate the checksum */
for (i=0; i<rx_len-3; i++)
cs_calc ^= rx[i];
/* retrieve the checksum */
cs_recv = hexval (rx[rx_len-2]) << 4 | hexval (rx[rx_len-1]);
if (cs_calc == cs_recv)
csok = 1;
}
/* no checksum */
else if (rx_len >= 6) /* contains at least "$XXXXX," */
csok = 1;
return (csok);
}
int
unescape(const char *src, char **dstp, unsigned int *dlenp)
{
char *dst;
size_t slen;
size_t dlen;
size_t i;
for (i = 0, dlen = 0, slen = strlen(src); i < slen; i++, dlen++)
if (src[i] == '\\')
i += 3;
if (!(dst = malloc(dlen + 1)))
return 0;
for (i = 0, dlen = 0, slen = strlen(src); i < slen; i++, dlen++)
if (src[i] == '\\') {
dst[dlen] = hexval((unsigned)src[i + 2]) * 16 +
hexval((unsigned)src[i + 3]);
i += 3;
} else
dst[dlen] = src[i];
if (dlenp)
*dlenp = (unsigned int)dlen;
dst[dlen] = 0;
*dstp = dst;
return 1;
}
GUID
name_to_guid(const char *in_name)
{
GUID result;
char *name = (char*)in_name;
unsigned i;
if (memcasecmp(name, "\\Device\\NPF_{", 13) == 0)
name += 13;
result.Data1 = strtoul(name, &name, 16);
if (*name == '-')
name++;
result.Data2 = (unsigned short)strtoul(name, &name, 16);
if (*name == '-')
name++;
result.Data3 = (unsigned short)strtoul(name, &name, 16);
if (*name == '-')
name++;
for (i=0; i<8; i++) {
if (*name == '-')
name++;
if (isxdigit(*name)) {
result.Data4[i] = hexval(*name)<<4;
name++;
}
if (isxdigit(*name)) {
unsigned char x = hexval(*name);
result.Data4[i] |= x;
name++;
}
}
return result;
}
static int monitor_command(struct gdb_data *data, char *buf)
{
char cmd[128];
int len = 0;
int i;
struct monitor_buf mbuf;
while (len + 1 < sizeof(cmd) && *buf && buf[1]) {
if (len + 1 >= sizeof(cmd))
break;
cmd[len++] = (hexval(buf[0]) << 4) | hexval(buf[1]);
buf += 2;
}
cmd[len] = 0;
printc("Monitor command received: %s\n", cmd);
mbuf.len = 0;
mbuf.trunc = 0;
capture_start(monitor_capture, &mbuf);
process_command(cmd);
capture_end();
if (!mbuf.len)
return gdb_send(data, "OK");
gdb_packet_start(data);
for (i = 0; i < mbuf.len; i++)
gdb_printf(data, "%02x", mbuf.buf[i]);
gdb_packet_end(data);
return gdb_flush_ack(data);
}
int main(int argc, char** argv)
{
int c;
while ((c = getchar()) != EOF) {
int d = getchar();
putchar((hexval(c) << 4) | hexval(d));
}
}
static void process_field(jed_data *data, const UINT8 *cursrc, const UINT8 *srcend, UINT16 *checksum)
{
/* switch off of the field type */
switch (*cursrc)
{
case 'Q':
cursrc++;
switch (*cursrc)
{
/* number of fuses */
case 'F':
cursrc++;
data->numfuses = suck_number(&cursrc);
break;
}
break;
/* default fuse state (0 or 1) */
case 'F':
cursrc++;
if (LOG_PARSE) printf("F%c\n", *cursrc);
if (*cursrc == '0')
memset(data->fusemap, 0x00, sizeof(data->fusemap));
else
memset(data->fusemap, 0xff, sizeof(data->fusemap));
break;
/* fuse states */
case 'L':
{
UINT32 curfuse;
/* read the fuse number */
cursrc++;
curfuse = suck_number(&cursrc);
if (LOG_PARSE) printf("L%d\n", curfuse);
/* read digits, skipping delimiters */
for ( ; cursrc < srcend; cursrc++)
if (*cursrc == '0' || *cursrc == '1')
{
jed_set_fuse(data, curfuse, *cursrc - '0');
if (LOG_PARSE) printf(" fuse %d = %d\n", curfuse, 0);
if (curfuse >= data->numfuses)
data->numfuses = curfuse + 1;
curfuse++;
}
break;
}
/* fuse checksum */
case 'C':
cursrc++;
if (cursrc < srcend + 4 && ishex(cursrc[0]) && ishex(cursrc[1]) && ishex(cursrc[2]) && ishex(cursrc[3]))
*checksum = (hexval(cursrc[0]) << 12) | (hexval(cursrc[1]) << 8) | (hexval(cursrc[2]) << 4) | hexval(cursrc[3] << 0);
break;
}
}
/*
* Hex to binary conversion
*/
static void
hex2bin(int len, char *hexnum, char *binnum)
{
int i;
for (i = 0; i < len; i++) {
*binnum++ = 16 * hexval(hexnum[2*i]) + hexval(hexnum[2*i+1]);
}
}
/*
* Hex to binary conversion
*/
static void
internal_function
hex2bin (int len, char *hexnum, char *binnum)
{
int i;
for (i = 0; i < len; i++)
*binnum++ = 16 * hexval (hexnum[2 * i]) + hexval (hexnum[2 * i + 1]);
}
static int get_hex_color(const char *in, unsigned char *out)
{
unsigned int val;
val = (hexval(in[0]) << 4) | hexval(in[1]);
if (val & ~0xff)
return -1;
*out = val;
return 0;
}
void hex2str (char *out, char *in) {
while (*in) {
*out = hexval(*in) << 4;
in++;
if (*in) {
*out |= hexval(*in);
in++;
}
out++;
}
}
int get_sha1_hex(const char *hex, unsigned char *sha1)
{
int i;
for (i = 0; i < SHA1_LEN; i++) {
unsigned int val = (hexval(hex[0]) << 4) | hexval(hex[1]);
if (val & ~0xff)
return -1;
*sha1++ = val;
hex += 2;
}
return 0;
}
int
hex_to_rawdata (const char *hex_str, unsigned char *rawdata, int n_bytes)
{
int i;
for (i = 0; i < n_bytes; i++) {
unsigned int val = (hexval(hex_str[0]) << 4) | hexval(hex_str[1]);
if (val & ~0xff)
return -1;
*rawdata++ = val;
hex_str += 2;
}
return 0;
}
static int append_normalized_escapes(struct strbuf *buf,
const char *from,
size_t from_len,
const char *esc_extra,
const char *esc_ok)
{
/*
* Append to strbuf 'buf' characters from string 'from' with length
* 'from_len' while unescaping characters that do not need to be escaped
* and escaping characters that do. The set of characters to escape
* (the complement of which is unescaped) starts out as the RFC 3986
* unsafe characters (0x00-0x1F,0x7F-0xFF," <>\"#%{}|\\^`"). If
* 'esc_extra' is not NULL, those additional characters will also always
* be escaped. If 'esc_ok' is not NULL, those characters will be left
* escaped if found that way, but will not be unescaped otherwise (used
* for delimiters). If a %-escape sequence is encountered that is not
* followed by 2 hexadecimal digits, the sequence is invalid and
* false (0) will be returned. Otherwise true (1) will be returned for
* success.
*
* Note that all %-escape sequences will be normalized to UPPERCASE
* as indicated in RFC 3986. Unless included in esc_extra or esc_ok
* alphanumerics and "-._~" will always be unescaped as per RFC 3986.
*/
while (from_len) {
int ch = *from++;
int was_esc = 0;
from_len--;
if (ch == '%') {
if (from_len < 2 ||
!isxdigit(from[0]) ||
!isxdigit(from[1]))
return 0;
ch = hexval(*from++) << 4;
ch |= hexval(*from++);
from_len -= 2;
was_esc = 1;
}
if ((unsigned char)ch <= 0x1F || (unsigned char)ch >= 0x7F ||
strchr(URL_UNSAFE_CHARS, ch) ||
(esc_extra && strchr(esc_extra, ch)) ||
(was_esc && strchr(esc_ok, ch)))
strbuf_addf(buf, "%%%02X", (unsigned char)ch);
else
strbuf_addch(buf, ch);
}
return 1;
}
void HttpServerConnection::get_all_parameters(const char *qpos,
std::multimap<std::string,
std::string> &pars) {
const char *ppos = qpos; // Start of parameter name
while (*qpos) {
if (*qpos == '&') {
// Epmty value:
pars.insert(std::make_pair(std::string(ppos, qpos), std::string()));
++qpos;
ppos = qpos;
} else if (*qpos == '=') {
// Urldecode value:
std::string par_name = std::string(ppos, qpos);
++qpos; ; // Start of value
std::ostringstream res;
while (char c = *qpos) {
if (c == '&') {
++qpos;
break;
} else if (c == '+') {
++qpos;
c = ' ';
} else if (c == '%') {
// Should be two hex digits after %,
// but if not, ignore errors and just keep the %
if (*++qpos) {
char c1 = *qpos, c2;
if (*++qpos) {
c2 = *qpos;
if (c2) {
++qpos;
int n = hexval(c1)*16+hexval(c2);
if (n >= 0)
c = static_cast<char>(n);
}
}
}
} else {
++qpos;
}
res << c;
}
pars.insert(std::make_pair(par_name, res.str()));
ppos = qpos;
} else {
++qpos;
}
}
}
QColor ColorScheme::colorSpec(QString name)
{
QColor color;
QString rgbi = name;
if (rgbi.left(5) != "rgbi:")
color.setNamedColor(name);
else {
float fr, fg, fb;
if (sscanf((const char *)rgbi.toAscii(), "rgbi:%f/%f/%f", &fr, &fg, &fb) == 3)
color.setRgb(hexval(fr), hexval(fg), hexval(fb));
// else return color as-is, i.e. invalid.
}
return color;
}
long atol(const char *num)
{
long value = 0;
int neg = 0;
if (num[0] == '0' && num[1] == 'x') {
// hex
num += 2;
while (*num && isxdigit(*num))
value = value * 16 + hexval(*num++);
} else {
// decimal
if (num[0] == '-') {
neg = 1;
num++;
}
while (*num && isdigit(*num))
value = value * 10 + *num++ - '0';
}
if (neg)
value = -value;
return value;
}
void MemoryManager::grant()
{
m_grantedMemory.address = address;
m_grantedMemory.size = size;
s2e()->getMessagesStream() << "---grant Memory map address: " << hexval(address) << " size: " << size << '\n';
memory_granted_expression.push_back(m_grantedMemory);
}
//BOOLEAN HalpValidPCISlot(IN PBUS_HANDLER BusHandler, IN PCI_SLOT_NUMBER Slot)
void HalHandlers::HalpValidPciSlot(S2EExecutionState* state, FunctionMonitorState *fns)
{
//Invoke this function in all contexts
s2e()->getDebugStream(state) << "Calling " << __FUNCTION__ << " at " << hexval(state->getPc()) << std::endl;
uint32_t pBusHandler, slotNumber;
bool ok = true;
ok &= readConcreteParameter(state, 0, &pBusHandler);
ok &= readConcreteParameter(state, 1, &slotNumber);
if (!ok) {
s2e()->getDebugStream() << "Could not read in HalpValidPciSlot" << std::endl;
return;
}
BUS_HANDLER32 BusHandler;
ok = state->readMemoryConcrete(pBusHandler, &BusHandler, sizeof(BusHandler));
if (!ok) {
s2e()->getDebugStream() << "Could not read BUS_HANDLER32 at address 0x" << std::hex << pBusHandler << std::endl;
return;
}
std::ostream &os = s2e()->getMessagesStream(state);
BusHandler.print(os);
}
int pack (PBYTE hex, const PBYTE ascii, ULONG len)
{
ULONG i;
BYTE val;
PBYTE pascii= ascii;
if ( len%2 ) return 0;
for (i= 0; i<len; ++i) {
BYTE v;
if ( hexval(*pascii, &v) ) {
if ( i%2 ) {
val<<= 4;
val|= v;
*hex= val;
++hex;
} else {
val= v;
}
} else {
return 0;
}
++pascii;
}
return 1;
}
X86FunctionMonitorState* X86FunctionMonitorState::clone() const
{
X86FunctionMonitorState *ret = new X86FunctionMonitorState(*this);
m_plugin->s2e()->getDebugStream() << "Forking FunctionMonitorState ret=" << hexval(ret) << '\n';
assert(ret->m_returnDescriptors.size() == m_returnDescriptors.size());
return ret;
}
void MemoryTracer::onCustomInstruction(S2EExecutionState* state, uint64_t opcode)
{
if (!OPCODE_CHECK(opcode, MEMORY_TRACER_OPCODE)) {
return;
}
//XXX: remove this mess. Should have a function for extracting
//info from opcodes.
opcode >>= 16;
uint8_t op = opcode & 0xFF;
opcode >>= 8;
MemoryTracerOpcodes opc = (MemoryTracerOpcodes)op;
switch(opc) {
case Enable:
enableTracing();
break;
case Disable:
disableTracing();
break;
default:
s2e()->getWarningsStream() << "MemoryTracer: unsupported opcode " << hexval(opc) << '\n';
break;
}
}
void BaseInstructions::concretize(S2EExecutionState *state, bool addConstraint)
{
uint32_t address, size;
bool ok = true;
ok &= state->readCpuRegisterConcrete(CPU_OFFSET(regs[R_EAX]),
&address, 4);
ok &= state->readCpuRegisterConcrete(CPU_OFFSET(regs[R_EBX]),
&size, 4);
if(!ok) {
s2e()->getWarningsStream(state)
<< "ERROR: symbolic argument was passed to s2e_op "
" get_example opcode\n";
return;
}
for(unsigned i = 0; i < size; ++i) {
if (!state->readMemoryConcrete8(address + i, NULL, S2EExecutionState::VirtualAddress, addConstraint)) {
s2e()->getWarningsStream(state)
<< "Can not concretize memory"
<< " at " << hexval(address + i) << '\n';
}
}
}
void BaseInstructions::isSymbolic(S2EExecutionState *state)
{
uint32_t address;
uint32_t result;
char buf;
bool ok = true;
ok &= state->readCpuRegisterConcrete(CPU_OFFSET(regs[R_ECX]),
&address, 4);
if(!ok) {
s2e()->getWarningsStream(state)
<< "ERROR: symbolic argument was passed to s2e_op is_symbolic\n";
return;
}
s2e()->getMessagesStream(state)
<< "Testing whether data at " << hexval(address)
<< " is symbolic:";
// readMemoryConcrete fails if the value is symbolic
result = !state->readMemoryConcrete(address, &buf, 1);
s2e()->getMessagesStream(state)
<< (result ? " true" : " false") << '\n';
state->writeCpuRegisterConcrete(CPU_OFFSET(regs[R_EAX]), &result, 4);
}
