void HybridAnalysis::badTransferCB(BPatch_point *point, void *returnValue)
{
Address pointAddr = (Address) point->getAddress();
Address target = (Address) returnValue;
time_t tstruct;
struct tm * tmstruct;
char timeStr[64];
time( &tstruct );
tmstruct = localtime( &tstruct );
strftime(timeStr, 64, "%X", tmstruct);
mal_printf("badTransferCB %lx=>%lx %s\n\n", pointAddr, target, timeStr);
BPatch_module * targMod = proc()->findModuleByAddr(target);
if (!targMod) {
mal_printf( "ERROR, NO MODULE for target addr %lx %s[%d]\n",
target,FILE__,__LINE__);
assert(0);
}
if (targMod == point->getFunction()->getModule() && targMod->isSystemLib()) {
return;
}
// 1. the target address is in a shared library
if ( targMod != point->getFunction()->getModule())
{
// process the edge, decide if we should instrument target function
bool doMoreProcessing = processInterModuleEdge(point, target, targMod);
if (!doMoreProcessing) {
return;
}
}
// 2. the point is a call:
if (point->getPointType() == BPatch_subroutine) {
proc()->beginInsertionSet();
// if the target is in the body of an existing function we'll split
// the function and wind up with two or more functions that share
// the target address, so make sure we're not in the middle of an
// overwrite loop; if we are, check for overwrites immediately
BPatch_function *targFunc = proc()->findFunctionByEntry(target);
vector<BPatch_function*> targFuncs;
proc()->findFunctionsByAddr(target, targFuncs);
if (!targFunc && targFuncs.size()) {
mal_printf("discovery instr. got new entry point for func\n");
std::set<HybridAnalysisOW::owLoop*> loops;
for (unsigned tidx=0; tidx < targFuncs.size(); tidx++) {
BPatch_function *curFunc = targFuncs[tidx];
if ( hybridOW()->hasLoopInstrumentation(false, *curFunc, &loops) )
{
/* Code sharing will change the loops, the appropriate response
is to trigger early exit analysis and remove the loops if
the underlying code hasn't changed */
mal_printf("[%d] Removing loop instrumentation for func %lx\n",
__LINE__,curFunc->getBaseAddr());
std::set<HybridAnalysisOW::owLoop*>::iterator lIter =
loops.begin();
while (lIter != loops.end()) {
hybridOW()->deleteLoop(*lIter,false);
lIter++;
}
}
}
}
// 2.1 if the target is new, parse at the target
if ( ! targFunc ) {
mal_printf("stopThread instrumentation found call %lx=>%lx, "
"parsing at call target %s[%d]\n",
(long)point->getAddress(), target,FILE__,__LINE__);
if (!analyzeNewFunction( point,target,false,false )) {
//this happens for some single-instruction functions
mal_printf("ERROR: parse of call target %lx=>%lx failed %s[%d]\n",
(long)point->getAddress(), target, FILE__,__LINE__);
assert(0);
instrumentModules(false);
proc()->finalizeInsertionSet(false);
return;
}
targFunc = proc()->findFunctionByEntry(target);
}
// 2.2 if the target is a returning function, parse at the fallthrough
bool instrument = true;
if ( ParseAPI::RETURN ==
targFunc->lowlevel_func()->ifunc()->retstatus() )
{
//mal_printf("stopThread instrumentation found returning call %lx=>%lx, "
// "parsing after call site\n",
// (long)point->getAddress(), target);
if (parseAfterCallAndInstrument(point, targFunc, false)) {
instrument = false;
}
}
if (instrument) {
instrumentModules(false);
}
proc()->finalizeInsertionSet(false);
// 2. return
return;
}
// 3. the point is a return instruction:
if ( point->getPointType() == BPatch_locExit ) {
// 3.2 find the call point so we can parse after it
// ( In this case "point" is the return statement and
// "target" is the fallthrough address of the call insn )
// in order to find the callPoint in the caller function that
// corresponds to the non-returning call, we traverse list of
// the caller's points to find the callpoint that is nearest
// to the return address
Address returnAddr = target;
using namespace ParseAPI;
// Find the call blocks preceding the address that we're returning
// past, but only set set returningCallB if we can be sure that
// that we've found a call block that actually called the function
// we're returning from
pair<Block*, Address> returningCallB((Block*)NULL,0);
set<Block*> callBlocks;
getCallBlocks(returnAddr, point->llpoint()->func(),
point->llpoint()->block(), returningCallB, callBlocks);
// 3.2.1 parse at returnAddr as the fallthrough of the preceding
// call block, if there is one
if (!callBlocks.empty()) {
// we don't know if the function we called returns, so
// invoke parseAfterCallAndInstrument with NULL as the
// called func, so we won't try to parse after other
// callers to the called func, as it may not actually
// return in a normal fashion
if (NULL == returningCallB.first) {
vector<BPatch_point*> callPts;
for (set<Block*>::iterator bit = callBlocks.begin();
bit != callBlocks.end();
bit++)
{
getPreCallPoints(*bit, proc(), callPts);
}
for (vector<BPatch_point*>::iterator pit = callPts.begin();
pit != callPts.end();
pit++)
{
parseAfterCallAndInstrument( *pit, NULL, true );
}
}
// if the return address has been parsed as the entry point
// of a block, patch post-call areas and return
else if ( returningCallB.first->obj()->findBlockByEntry(
returningCallB.first->region(),
target))
{
vector<BPatch_point*> callPts;
getPreCallPoints(returningCallB.first, proc(), callPts);
for (unsigned j=0; j < callPts.size(); j++) {
callPts[j]->patchPostCallArea();
}
}
else { // parse at the call fallthrough
// find one callPoint, any other ones will
// be found by parseAfterCallAndInstrument
vector<BPatch_point*> callPoints;
getPreCallPoints(returningCallB.first, proc(), callPoints);
assert(!callPoints.empty());
mal_printf("stopThread instrumentation found return at %lx, "
"parsing return addr %lx as fallthrough of call "
"instruction at %lx %s[%d]\n", (long)point->getAddress(),
target,callPoints[0]->getAddress(),FILE__,__LINE__);
if (point->llpoint()->block()->llb()->isShared()) {
// because of pc emulation, if the return point is shared,
// we may have flipped between functions that share the
// return point, so use the call target function
BPatch_function *calledFunc = proc()->
findFunctionByEntry(returningCallB.second);
parseAfterCallAndInstrument( callPoints[0], calledFunc, true );
}
else {
parseAfterCallAndInstrument( callPoints[0],
point->getFunction(),
true);
}
}
}
// 3.2.2 no call blocks, parse the return addr as a new function
else {
if ( point->getFunction()->getModule()->isExploratoryModeOn() ) {
// otherwise we've instrumented a function in trusted library
// because we want to catch its callbacks into our code, but in
// the process are catching calls into other modules
mal_printf("hybridCallbacks.C[%d] Observed abuse of normal return "
"instruction semantics for insn at %lx target %lx\n",
__LINE__, point->getAddress(), returnAddr);
}
analyzeNewFunction( point, returnAddr, true , true );
// there are no call blocks, so we don't have any post-call pads to patch
}
// 3. return
return;
}
// 4. else case: the point is a jump/branch
proc()->beginInsertionSet();
// 4.1 if the point is a direct branch, remove any instrumentation
if (!point->isDynamic()) {
BPatch_function *func = point->getFunction();
if (instrumentedFuncs->end() != instrumentedFuncs->find(func)
&&
(*instrumentedFuncs)[func]->end() !=
(*instrumentedFuncs)[func]->find(point))
{
proc()->deleteSnippet(
(*(*instrumentedFuncs)[func])[point] );
(*instrumentedFuncs)[func]->erase(point);
}
//point is set to resolved in handleStopThread
}
bool newParsing;
vector<BPatch_function*> targFuncs;
proc()->findFunctionsByAddr(target, targFuncs);
if ( 0 == targFuncs.size() ) {
newParsing = true;
mal_printf("stopThread instrumentation found jump "
"at 0x%lx leading to an unparsed target at 0x%lx\n",
(long)point->getAddress(), target);
} else {
newParsing = false;
mal_printf("stopThread instrumentation added an edge for jump "
" at 0x%lx leading to a previously parsed target at 0x%lx\n",
(long)point->getAddress(), target);
}
// add the new edge to the program, parseNewEdgeInFunction will figure
// out whether to extend the current function or parse as a new one.
if (targMod != point->getFunction()->getModule()) {
// Don't put in inter-module branches
if (newParsing)
analyzeNewFunction(point, target, true, false);
}
else
{
parseNewEdgeInFunction(point, target, false);
}
if (0 == targFuncs.size()) {
proc()->findFunctionsByAddr( target, targFuncs );
}
// manipulate init_retstatus so that we will instrument the function's
// return addresses, since this jump might be a tail call
for (unsigned tidx=0; tidx < targFuncs.size(); tidx++) {
parse_func *imgfunc = targFuncs[tidx]->lowlevel_func()->ifunc();
FuncReturnStatus initStatus = imgfunc->init_retstatus();
if (ParseAPI::RETURN == initStatus) {
imgfunc->setinit_retstatus(ParseAPI::UNKNOWN);
removeInstrumentation(targFuncs[tidx],false,false);
instrumentFunction(targFuncs[tidx],false,true);
}
}
// re-instrument the function or the whole module, as needed
if (newParsing) {
instrumentModules(false);
}
proc()->finalizeInsertionSet(false);
} // end badTransferCB
/* Parse and instrument any signal handlers that have yet to be
* analyzed (and instrumented), and that are not in system libraries
*/
void HybridAnalysis::signalHandlerCB(BPatch_point *point, long signum,
std::vector<Address> &handlers)
{
mal_printf("signalHandlerCB(%lx , %lx, %d handlers)\n",
point->getAddress(), signum, handlers.size());
bool onlySysHandlers = true;
std::vector<Address> handlerAddrs;
proc()->beginInsertionSet();
// eliminate any handlers in system libraries, and handlers that have
// already been parsed, add new handlers to handler function list
std::vector<Address>::iterator it=handlers.begin();
while (it < handlers.end())
{
BPatch_module *mod = proc()->findModuleByAddr(*it);
if (!mod || mod->isSystemLib()) {
it = handlers.erase(it);
continue;
}
BPatch_function *handlerFunc = proc()->findFunctionByEntry(*it);
handlerFunctions[*it] = ExceptionDetails();
if (handlerFunc) {
it = handlers.erase(it);
continue;
}
// parse and instrument handler
mal_printf("found handler at %x %s[%d]\n", *it,FILE__,__LINE__);
onlySysHandlers = false;
analyzeNewFunction(point,*it,true,false);
handlerFunc = proc()->findFunctionByEntry(*it);
assert(handlerFunc);
handlerAddrs.push_back(*it);
BPatch_point *entryPt = (*handlerFunc->findPoint(BPatch_entry))[0];
// instrument the handler at its entry and exit points
proc()->beginInsertionSet();
// instrument handler entry with callbacks that will deliver the stack
// addresses at which the fault addr is stored
BPatch_paramExpr excRecAddr(0,BPatch_ploc_entry);
BPatch_paramExpr excCtxtAddr(2,BPatch_ploc_entry);
BPatch_stopThreadExpr sThread1
(signalHandlerEntryCB_wrapper,excRecAddr,false,BPatch_noInterp);
BPatch_stopThreadExpr sThread2
(signalHandlerEntryCB2_wrapper,excCtxtAddr,false,BPatch_noInterp);
proc()->insertSnippet(sThread2, *entryPt);
proc()->insertSnippet(sThread1, *entryPt);
// remove any exit-point instrumentation and add new instrumentation
// at exit points
std::map<BPatch_point*,BPatchSnippetHandle*> *funcPoints =
(*instrumentedFuncs)[handlerFunc];
if ( funcPoints ) {
std::map<BPatch_point*, BPatchSnippetHandle*>::iterator pit;
pit = funcPoints->begin();
while (pit != funcPoints->end())
{
if ( BPatch_exit == (*pit).first->getPointType() ) {
proc()->deleteSnippet((*pit).second);
funcPoints->erase( (*pit).first );
pit = funcPoints->begin();
} else {
pit++;
}
}
}
instrumentFunction(handlerFunc, false, true);
it++;
}
proc()->finalizeInsertionSet(false);
// trigger the signal-handler callback
if (bpatchSignalHandlerCB) {
bpatchSignalHandlerCB(point,signum,&handlerAddrs);
}
}
