Пример #1
0
void uninit_plugin(void *self) {
    /*
     * XXX: Here, we unload our pass from the PassRegistry.  This seems to work
     * fine, until we reload this plugin again into QEMU and we get an LLVM
     * assertion saying the pass is already registered.  This seems like a bug
     * with LLVM.  Switching between TCG and LLVM works fine when passes aren't
     * added to LLVM.
     */
    llvm::PassRegistry *pr = llvm::PassRegistry::getPassRegistry();
    const llvm::PassInfo *pi =
        //pr->getPassInfo(&llvm::PandaInstrFunctionPass::ID);
        pr->getPassInfo(llvm::StringRef("PandaInstr"));
    if (!pi){
        printf("Unable to find 'PandaInstr' pass in pass registry\n");
    }
    else {
        pr->unregisterPass(*pi);
    }

    if (taintfpm) delete taintfpm; // Delete function pass manager and pass

    if (shadow) tp_free(shadow);

    panda_disable_llvm();
    panda_disable_memcb();
    panda_enable_tb_chaining();
}
Пример #2
0
// Execute taint ops
int after_block_exec(CPUState *env, TranslationBlock *tb,
        TranslationBlock *next_tb){
    if (taintJustEnabled){
        // need to wait until the next TB to start executing taint ops
        taintJustEnabled = false;
        return 0;
    }
    if (taintJustDisabled){
        taintJustDisabled = false;
        execute_llvm = 0;
        generate_llvm = 0;
        panda_do_flush_tb();
        panda_disable_memcb();
        return 0;
    }
    if (taintEnabled){
        DynValBuffer *dynval_buffer = PIFP->PIV->getDynvalBuffer();
        rewind_dynval_buffer(dynval_buffer);

        //printf("%s\n", tb->llvm_function->getName().str().c_str());
        //PTFP->debugTaintOps();
        //printf("\n\n");
        execute_taint_ops(PTFP->ttb, shadow, dynval_buffer);

        // Make sure there's nothing left in the buffer
        assert(dynval_buffer->ptr - dynval_buffer->start == dynval_buffer->cur_size);
    }
    return 0;
}
Пример #3
0
void uninit_plugin(void *self) {

    printf ("uninit taint plugin\n");

    if (shadow) tp_free(shadow);

    panda_disable_llvm();
    panda_disable_memcb();
    panda_enable_tb_chaining();

}
Пример #4
0
// Execute taint ops
int after_block_exec(CPUState *env, TranslationBlock *tb,
        TranslationBlock *next_tb){

    if (taintJustDisabled){
        taintJustDisabled = false;
        execute_llvm = 0;
        generate_llvm = 0;
        panda_do_flush_tb();
        panda_disable_memcb();
	//	mytimer_start(ttimer);
        return 0;
    }

    return 0;
}
Пример #5
0
void uninit_plugin(void *self) {
  if (tubtf_on) {
    tubtf_close();
  }
  else {
    DynValBuffer *dynval_buffer = PIFP->PIV->getDynvalBuffer();
    if (dynval_buffer->cur_size > 0){
        // Buffer wasn't flushed before, have to flush it now
        fwrite(dynval_buffer->start, dynval_buffer->cur_size, 1, memlog);
    }
  }

    // XXX: more unsafe string manipulation
    char modpath[256];
    strcpy(modpath, basedir);
    strcat(modpath, "/llvm-mod.bc");
    tcg_llvm_write_module(tcg_llvm_ctx, modpath);

    /*
     * XXX: Here, we unload our pass from the PassRegistry.  This seems to work
     * fine, until we reload this plugin again into QEMU and we get an LLVM
     * assertion saying the pass is already registered.  This seems like a bug
     * with LLVM.  Switching between TCG and LLVM works fine when passes aren't
     * added to LLVM.
     */
    llvm::PassRegistry *pr = llvm::PassRegistry::getPassRegistry();
    const llvm::PassInfo *pi =
        //pr->getPassInfo(&llvm::PandaInstrFunctionPass::ID);
        pr->getPassInfo(llvm::StringRef("PandaInstr"));
    if (!pi){
        printf("Unable to find 'PandaInstr' pass in pass registry\n");
    }
    else {
        pr->unregisterPass(*pi);
    }

    panda_disable_llvm_helpers();

    if (execute_llvm){
        panda_disable_llvm();
    }
    panda_disable_memcb();
    
    if (tubtf_on == 0) {
      fclose(funclog);
      close_memlog();
    }
}
Пример #6
0
void uninit_plugin(void *self) {

    printf ("uninit taint plugin\n");
    
    if (tainted_instructions) {
        for ( auto &kvp : shadow->tpc ) {
            uint64_t asid = kvp.first;
            printf ("asid = %lx\n", asid);
            for ( auto &pc : kvp.second ) {
                printf ("instr is tainted :  asid=0x%lx : pc=0x%lx \n", asid, pc);
            }
        }
    }
    
    
    /*
     * XXX: Here, we unload our pass from the PassRegistry.  This seems to work
     * fine, until we reload this plugin again into QEMU and we get an LLVM
     * assertion saying the pass is already registered.  This seems like a bug
     * with LLVM.  Switching between TCG and LLVM works fine when passes aren't
     * added to LLVM.
     */
    llvm::PassRegistry *pr = llvm::PassRegistry::getPassRegistry();
    const llvm::PassInfo *pi =
        //pr->getPassInfo(&llvm::PandaInstrFunctionPass::ID);
        pr->getPassInfo(llvm::StringRef("PandaInstr"));
    if (!pi){
        printf("Unable to find 'PandaInstr' pass in pass registry\n");
    }
    else {
        pr->unregisterPass(*pi);
    }



    if (taintfpm) delete taintfpm; // Delete function pass manager and pass
    if (shadow) tp_free(shadow);
    if (tob_io_thread) tob_delete(tob_io_thread);

    panda_disable_llvm();
    panda_disable_memcb();
    panda_enable_tb_chaining();


}