/* * BPatch_addressSpace::replaceFunctionCall * * Replace a function call with a call to a different function. Returns true * upon success, false upon failure. * * point The call site that is to be changed. * newFunc The function that the call site will now call. */ bool BPatch_addressSpace::replaceFunctionCall(BPatch_point &point, BPatch_function &newFunc) { char name[1024]; newFunc.getName(name, 1024); // Can't make changes to code when mutations are not active. if (!getMutationsActive()) return false; assert(point.point && newFunc.lowlevel_func()); /* PatchAPI stuffs */ AddressSpace* addr_space = point.getAS(); DynModifyCallCommand* rep_call = DynModifyCallCommand::create(addr_space, point.point->block(), newFunc.lowlevel_func(), point.point->func()); addr_space->patcher()->add(rep_call); /* End of PatchAPI */ if (pendingInsertions == NULL) { // Trigger it now bool tmp; finalizeInsertionSet(false, &tmp); } return true; }
/* * BPatch_addressSpace::revertReplaceFunction * * Undoes a replaceFunction operation */ bool BPatch_addressSpace::revertReplaceFunction(BPatch_function &oldFunc) { assert(oldFunc.lowlevel_func()); if (!getMutationsActive()) return false; func_instance *func = oldFunc.lowlevel_func(); func->proc()->revertReplacedFunction(func); if (pendingInsertions == NULL) { // Trigger it now bool tmp; finalizeInsertionSet(false, &tmp); } return true; }
/* * BPatch_addressSpace::replaceFunction * * Replace all calls to function OLDFUNC with calls to NEWFUNC. * Returns true upon success, false upon failure. * * oldFunc The function to replace * newFunc The replacement function */ bool BPatch_addressSpace::replaceFunction(BPatch_function &oldFunc, BPatch_function &newFunc) { assert(oldFunc.lowlevel_func() && newFunc.lowlevel_func()); if (!getMutationsActive()) return false; // Self replacement is a nop // We should just test direct equivalence here... if (oldFunc.lowlevel_func() == newFunc.lowlevel_func()) { return true; } /* PatchAPI stuffs */ AddressSpace* addr_space = oldFunc.lowlevel_func()->proc(); DynReplaceFuncCommand* rep_func = DynReplaceFuncCommand::create(addr_space, oldFunc.lowlevel_func(), newFunc.lowlevel_func()); addr_space->patcher()->add(rep_func); /* End of PatchAPI */ if (pendingInsertions == NULL) { // Trigger it now bool tmp; finalizeInsertionSet(false, &tmp); } return true; }
void HybridAnalysis::badTransferCB(BPatch_point *point, void *returnValue) { Address pointAddr = (Address) point->getAddress(); Address target = (Address) returnValue; time_t tstruct; struct tm * tmstruct; char timeStr[64]; time( &tstruct ); tmstruct = localtime( &tstruct ); strftime(timeStr, 64, "%X", tmstruct); mal_printf("badTransferCB %lx=>%lx %s\n\n", pointAddr, target, timeStr); BPatch_module * targMod = proc()->findModuleByAddr(target); if (!targMod) { mal_printf( "ERROR, NO MODULE for target addr %lx %s[%d]\n", target,FILE__,__LINE__); assert(0); } if (targMod == point->getFunction()->getModule() && targMod->isSystemLib()) { return; } // 1. the target address is in a shared library if ( targMod != point->getFunction()->getModule()) { // process the edge, decide if we should instrument target function bool doMoreProcessing = processInterModuleEdge(point, target, targMod); if (!doMoreProcessing) { return; } } // 2. the point is a call: if (point->getPointType() == BPatch_subroutine) { proc()->beginInsertionSet(); // if the target is in the body of an existing function we'll split // the function and wind up with two or more functions that share // the target address, so make sure we're not in the middle of an // overwrite loop; if we are, check for overwrites immediately BPatch_function *targFunc = proc()->findFunctionByEntry(target); vector<BPatch_function*> targFuncs; proc()->findFunctionsByAddr(target, targFuncs); if (!targFunc && targFuncs.size()) { mal_printf("discovery instr. got new entry point for func\n"); std::set<HybridAnalysisOW::owLoop*> loops; for (unsigned tidx=0; tidx < targFuncs.size(); tidx++) { BPatch_function *curFunc = targFuncs[tidx]; if ( hybridOW()->hasLoopInstrumentation(false, *curFunc, &loops) ) { /* Code sharing will change the loops, the appropriate response is to trigger early exit analysis and remove the loops if the underlying code hasn't changed */ mal_printf("[%d] Removing loop instrumentation for func %lx\n", __LINE__,curFunc->getBaseAddr()); std::set<HybridAnalysisOW::owLoop*>::iterator lIter = loops.begin(); while (lIter != loops.end()) { hybridOW()->deleteLoop(*lIter,false); lIter++; } } } } // 2.1 if the target is new, parse at the target if ( ! targFunc ) { mal_printf("stopThread instrumentation found call %lx=>%lx, " "parsing at call target %s[%d]\n", (long)point->getAddress(), target,FILE__,__LINE__); if (!analyzeNewFunction( point,target,false,false )) { //this happens for some single-instruction functions mal_printf("ERROR: parse of call target %lx=>%lx failed %s[%d]\n", (long)point->getAddress(), target, FILE__,__LINE__); assert(0); instrumentModules(false); proc()->finalizeInsertionSet(false); return; } targFunc = proc()->findFunctionByEntry(target); } // 2.2 if the target is a returning function, parse at the fallthrough bool instrument = true; if ( ParseAPI::RETURN == targFunc->lowlevel_func()->ifunc()->retstatus() ) { //mal_printf("stopThread instrumentation found returning call %lx=>%lx, " // "parsing after call site\n", // (long)point->getAddress(), target); if (parseAfterCallAndInstrument(point, targFunc, false)) { instrument = false; } } if (instrument) { instrumentModules(false); } proc()->finalizeInsertionSet(false); // 2. return return; } // 3. the point is a return instruction: if ( point->getPointType() == BPatch_locExit ) { // 3.2 find the call point so we can parse after it // ( In this case "point" is the return statement and // "target" is the fallthrough address of the call insn ) // in order to find the callPoint in the caller function that // corresponds to the non-returning call, we traverse list of // the caller's points to find the callpoint that is nearest // to the return address Address returnAddr = target; using namespace ParseAPI; // Find the call blocks preceding the address that we're returning // past, but only set set returningCallB if we can be sure that // that we've found a call block that actually called the function // we're returning from pair<Block*, Address> returningCallB((Block*)NULL,0); set<Block*> callBlocks; getCallBlocks(returnAddr, point->llpoint()->func(), point->llpoint()->block(), returningCallB, callBlocks); // 3.2.1 parse at returnAddr as the fallthrough of the preceding // call block, if there is one if (!callBlocks.empty()) { // we don't know if the function we called returns, so // invoke parseAfterCallAndInstrument with NULL as the // called func, so we won't try to parse after other // callers to the called func, as it may not actually // return in a normal fashion if (NULL == returningCallB.first) { vector<BPatch_point*> callPts; for (set<Block*>::iterator bit = callBlocks.begin(); bit != callBlocks.end(); bit++) { getPreCallPoints(*bit, proc(), callPts); } for (vector<BPatch_point*>::iterator pit = callPts.begin(); pit != callPts.end(); pit++) { parseAfterCallAndInstrument( *pit, NULL, true ); } } // if the return address has been parsed as the entry point // of a block, patch post-call areas and return else if ( returningCallB.first->obj()->findBlockByEntry( returningCallB.first->region(), target)) { vector<BPatch_point*> callPts; getPreCallPoints(returningCallB.first, proc(), callPts); for (unsigned j=0; j < callPts.size(); j++) { callPts[j]->patchPostCallArea(); } } else { // parse at the call fallthrough // find one callPoint, any other ones will // be found by parseAfterCallAndInstrument vector<BPatch_point*> callPoints; getPreCallPoints(returningCallB.first, proc(), callPoints); assert(!callPoints.empty()); mal_printf("stopThread instrumentation found return at %lx, " "parsing return addr %lx as fallthrough of call " "instruction at %lx %s[%d]\n", (long)point->getAddress(), target,callPoints[0]->getAddress(),FILE__,__LINE__); if (point->llpoint()->block()->llb()->isShared()) { // because of pc emulation, if the return point is shared, // we may have flipped between functions that share the // return point, so use the call target function BPatch_function *calledFunc = proc()-> findFunctionByEntry(returningCallB.second); parseAfterCallAndInstrument( callPoints[0], calledFunc, true ); } else { parseAfterCallAndInstrument( callPoints[0], point->getFunction(), true); } } } // 3.2.2 no call blocks, parse the return addr as a new function else { if ( point->getFunction()->getModule()->isExploratoryModeOn() ) { // otherwise we've instrumented a function in trusted library // because we want to catch its callbacks into our code, but in // the process are catching calls into other modules mal_printf("hybridCallbacks.C[%d] Observed abuse of normal return " "instruction semantics for insn at %lx target %lx\n", __LINE__, point->getAddress(), returnAddr); } analyzeNewFunction( point, returnAddr, true , true ); // there are no call blocks, so we don't have any post-call pads to patch } // 3. return return; } // 4. else case: the point is a jump/branch proc()->beginInsertionSet(); // 4.1 if the point is a direct branch, remove any instrumentation if (!point->isDynamic()) { BPatch_function *func = point->getFunction(); if (instrumentedFuncs->end() != instrumentedFuncs->find(func) && (*instrumentedFuncs)[func]->end() != (*instrumentedFuncs)[func]->find(point)) { proc()->deleteSnippet( (*(*instrumentedFuncs)[func])[point] ); (*instrumentedFuncs)[func]->erase(point); } //point is set to resolved in handleStopThread } bool newParsing; vector<BPatch_function*> targFuncs; proc()->findFunctionsByAddr(target, targFuncs); if ( 0 == targFuncs.size() ) { newParsing = true; mal_printf("stopThread instrumentation found jump " "at 0x%lx leading to an unparsed target at 0x%lx\n", (long)point->getAddress(), target); } else { newParsing = false; mal_printf("stopThread instrumentation added an edge for jump " " at 0x%lx leading to a previously parsed target at 0x%lx\n", (long)point->getAddress(), target); } // add the new edge to the program, parseNewEdgeInFunction will figure // out whether to extend the current function or parse as a new one. if (targMod != point->getFunction()->getModule()) { // Don't put in inter-module branches if (newParsing) analyzeNewFunction(point, target, true, false); } else { parseNewEdgeInFunction(point, target, false); } if (0 == targFuncs.size()) { proc()->findFunctionsByAddr( target, targFuncs ); } // manipulate init_retstatus so that we will instrument the function's // return addresses, since this jump might be a tail call for (unsigned tidx=0; tidx < targFuncs.size(); tidx++) { parse_func *imgfunc = targFuncs[tidx]->lowlevel_func()->ifunc(); FuncReturnStatus initStatus = imgfunc->init_retstatus(); if (ParseAPI::RETURN == initStatus) { imgfunc->setinit_retstatus(ParseAPI::UNKNOWN); removeInstrumentation(targFuncs[tidx],false,false); instrumentFunction(targFuncs[tidx],false,true); } } // re-instrument the function or the whole module, as needed if (newParsing) { instrumentModules(false); } proc()->finalizeInsertionSet(false); } // end badTransferCB
void HybridAnalysis::virtualFreeCB(BPatch_point *, void *t) { assert(virtualFreeAddr_ != 0); unsigned type = (unsigned) t; cerr << "virtualFree [" << hex << virtualFreeAddr_ << "," << virtualFreeAddr_ + (unsigned) virtualFreeSize_ << "], " << (unsigned) type << dec << endl; Address pageSize = proc()->lowlevel_process()->getMemoryPageSize(); // Windows page-aligns everything. unsigned addrShift = virtualFreeAddr_ % pageSize; unsigned sizeShift = pageSize - (virtualFreeSize_ % pageSize); virtualFreeAddr_ -= addrShift; if (type != MEM_RELEASE) { virtualFreeSize_ += addrShift + sizeShift; } // We need to: // 1) Remove any function with a block in the deleted range // 2) Remove memory translation for that range // 3) Skip trying to set permissions for any page in the range. // DEBUG! if (1 || type == MEM_RELEASE) { mapped_object *obj = proc()->lowlevel_process()->findObject(virtualFreeAddr_); if (!obj) return; virtualFreeAddr_ = obj->codeBase(); virtualFreeSize_ = obj->imageSize(); // DEBUG! cerr << "Removing VirtualAlloc'ed shared object " << obj->fileName() << endl; image *img = obj->parse_img(); proc()->lowlevel_process()->removeASharedObject(obj); virtualFreeAddr_ = 0; // Since removeASharedObject doesn't actually delete the object, // or its image (even if its refCount==0), make sure the image // goes away from global datastructure allImages for (unsigned int i=0; i < allImages.size(); i++) { if (img == allImages[i]) { allImages[i] = allImages.back(); allImages.pop_back(); } } return; } std::set<func_instance *> deletedFuncs; for (Address i = virtualFreeAddr_; i < (virtualFreeAddr_ + virtualFreeSize_); ++i) { proc()->lowlevel_process()->findFuncsByAddr(i, deletedFuncs); } for (std::set<func_instance *>::iterator iter = deletedFuncs.begin(); iter != deletedFuncs.end(); ++iter) { BPatch_function * bpfunc = proc()->findOrCreateBPFunc(*iter, NULL); if (!bpfunc) continue; PatchAPI::PatchModifier::remove(bpfunc->lowlevel_func()); } proc()->lowlevel_process()->getMemEm()->removeRegion(virtualFreeAddr_, virtualFreeSize_); // And nuke the RT cache proc()->lowlevel_process()->proc()->flushAddressCache_RT(virtualFreeAddr_, virtualFreeSize_); virtualFreeAddr_ = 0; return; }