> {
118 | let binary = self.binary.ok_or(CompilerError::LoaderOptionNotSet("binary has not been set"))?;
119 |
120 | let mut logger = Logger::spinner();
121 | logger.set_title("Building process image");
122 |
123 | let mut event_pool = EventPool::new();
124 | event_pool.add_event(EVENT_SYSCALL);
125 | event_pool.add_event(EVENT_BREAKPOINT);
126 |
127 | let image = ProcessImageBuilder::build(binary, &self.library_paths, &self.preloads, self.ignore_missing_deps, &mut event_pool, &logger)?;
128 | let mut compiler = Compiler {
129 | image,
130 | event_pool,
131 | modified: false,
132 | };
133 | drop(logger);
134 |
135 | compiler.verify()?;
136 | Ok(compiler)
137 | }
138 | }
139 |
140 | /// The Compiler is the center piece of `squid`. It loads ELF files, runs passes and launches a backend
141 | /// to obtain a [Runtime](crate::runtime::Runtime).
142 | ///
143 | /// To obtain a `Compiler` instance, call [`Compiler::loader`]. Then you can run one or more passes
144 | /// with [`Compiler::run_pass`] before compiling the process image with [`Compiler::compile`].
145 | #[derive(Debug)]
146 | pub struct Compiler {
147 | pub(crate) image: ProcessImage,
148 | pub(crate) event_pool: EventPool,
149 | modified: bool,
150 | }
151 |
152 | impl Compiler {
153 | /// Create a new `Compiler` by symbolically loading an ELF file and creating a process image.
154 | /// See the [`Loader`] for details about how the ELF-loader can be configured.
155 | pub fn loader() -> Loader {
156 | Loader::new()
157 | }
158 |
159 | /// Run a pass to inspect or modify the process image.
160 | ///
161 | /// # Arguments
162 | /// 1. `pass`: Anything that implements the [`Pass`] trait
163 | pub fn run_pass(&mut self, pass: &mut P) -> Result<(), P::Error>
164 | where
165 | P: Pass,
166 | {
167 | self.modified = true;
168 |
169 | let mut logger = Logger::spinner();
170 | logger.set_title(format!("Running Pass: {}", pass.name()));
171 | logger.set_prefix(pass.name());
172 |
173 | let ret = pass.run(&mut self.image, &mut self.event_pool, &logger);
174 |
175 | logger.clear_prefix();
176 | ret
177 | }
178 |
179 | fn verify(&mut self) -> Result<(), VerifyerPassError> {
180 | let mut verifyer = VerifyerPass::new(false);
181 | self.run_pass(&mut verifyer)?;
182 | self.modified = false;
183 | Ok(())
184 | }
185 |
186 | /// Compile the process image and create a [Runtime](crate::runtime::Runtime).
187 | /// The type of the runtime is determined by the backend. Each backend can have its own runtime.
188 | ///
189 | /// # Arguments
190 | /// 1. `backend`: Anything that implements the [`Backend`] trait
191 | pub fn compile<'a, B: Backend>(mut self, mut backend: B) -> Result>
192 | where
193 | ::Error: 'a,
194 | {
195 | if self.modified {
196 | self.verify()?;
197 | }
198 |
199 | let mut logger = Logger::spinner();
200 | logger.set_title(format!("Compiling with backend: {}", backend.name()));
201 | logger.set_prefix(backend.name());
202 |
203 | let ret = match backend.create_runtime(self.image, self.event_pool, &logger) {
204 | Ok(runtime) => runtime,
205 | Err(err) => return Err(CompilerError::BackendError(Box::new(err))),
206 | };
207 |
208 | logger.clear_prefix();
209 | logger.info("Compilation successful");
210 | Ok(ret)
211 | }
212 |
213 | /// Access the process image, which is the result of symbolically loading a binary
214 | pub fn process_image(&self) -> &ProcessImage {
215 | &self.image
216 | }
217 |
218 | /// Access the event pool, which manages all events that can be thrown at runtime
219 | pub fn event_pool(&self) -> &EventPool {
220 | &self.event_pool
221 | }
222 | }
223 |
--------------------------------------------------------------------------------
/squid/src/event.rs:
--------------------------------------------------------------------------------
1 | //! Contains the [`EventPool`] and other helper structs.
2 |
3 | use std::collections::HashMap;
4 |
5 | /// The ID of the syscall event is always the same: this value
6 | pub const EVENT_SYSCALL: usize = 0;
7 |
8 | /// The ID of the breakpint event is always the same: this value
9 | pub const EVENT_BREAKPOINT: usize = 1;
10 |
11 | /// The ID of an event in the [`EventPool`]
12 | #[derive(Copy, Clone, Debug, PartialEq, PartialOrd, Eq, Ord, Hash)]
13 | pub struct EventId(usize);
14 |
15 | impl EventId {
16 | fn new(id: usize) -> Self {
17 | EventId(id)
18 | }
19 |
20 | /// Get the ID as a usize
21 | pub fn id(&self) -> usize {
22 | self.0
23 | }
24 | }
25 |
26 | /// The EventPool manages all events that might be thrown during emulation of the target program.
27 | #[derive(Debug)]
28 | pub struct EventPool {
29 | events: HashMap,
30 | cursor: usize,
31 | }
32 |
33 | impl EventPool {
34 | pub(crate) fn new() -> Self {
35 | Self {
36 | events: HashMap::new(),
37 | cursor: 0,
38 | }
39 | }
40 |
41 | fn next_event(&mut self) -> EventId {
42 | let cursor = self.cursor;
43 | self.cursor = cursor.checked_add(1).expect("Ran out of possible event ids");
44 | EventId::new(cursor)
45 | }
46 |
47 | /// Given an event name, create a new event ID and return it.
48 | /// If the event name already exists, the corresponding ID is returned.
49 | pub fn add_event + AsRef>(&mut self, name: S) -> EventId {
50 | if let Some(id) = self.get_event(name.as_ref()) {
51 | id
52 | } else {
53 | let id = self.next_event();
54 | self.events.insert(name.into(), id);
55 | id
56 | }
57 | }
58 |
59 | /// Given an event name, return the corresponding event ID
60 | pub fn get_event>(&self, name: S) -> Option {
61 | self.events.get(name.as_ref()).copied()
62 | }
63 |
64 | /// Delete an event from the event pool
65 | pub fn remove_event>(&mut self, name: S) -> Option {
66 | self.events.remove(name.as_ref())
67 | }
68 |
69 | /// Return the total number of events
70 | pub fn len(&self) -> usize {
71 | self.events.len()
72 | }
73 |
74 | /// Return whether any events have been created
75 | pub fn is_empty(&self) -> bool {
76 | self.events.is_empty()
77 | }
78 | }
79 |
--------------------------------------------------------------------------------
/squid/src/frontend/ao/error.rs:
--------------------------------------------------------------------------------
1 | use thiserror::Error;
2 |
3 | use crate::frontend::{
4 | ao::cfg::CFGError,
5 | image::VAddr,
6 | };
7 |
8 | /// This error type shows everything that can go wrong when lifting RISC-V code
9 | /// into the ΑΩ IR.
10 | #[allow(missing_docs)]
11 | #[derive(Error, Debug)]
12 | pub enum AoError {
13 | #[error("Invalid operation size: {0}")]
14 | InvalidOpSize(usize),
15 |
16 | #[error("Invalid jump target address: {0:#x}")]
17 | InvalidJumpTarget(VAddr),
18 |
19 | #[error("No basic block at address {0:#x}")]
20 | BasicBlockNotFound(VAddr),
21 |
22 | #[error("{0:?}")]
23 | CFGError(#[from] CFGError),
24 |
25 | #[error("CFG is disonnected and no ewe metadata was available")]
26 | CFGDisconnected,
27 |
28 | #[error("Unknown RISC-V instruction: {0:x}")]
29 | UnknownInstr(u32),
30 |
31 | #[error("Invalid rounding mode: {0}")]
32 | InvalidRm(u64),
33 |
34 | #[error("Invalid variable type: {0}")]
35 | InvalidVarType(String),
36 | }
37 |
--------------------------------------------------------------------------------
/squid/src/frontend/ao/events.rs:
--------------------------------------------------------------------------------
1 | //! Contains all the events that can be thrown by RISC-V instructions
2 |
3 | /// The syscall event is thrown by the ECALL instruction
4 | pub const EVENT_SYSCALL: &str = "builtin::syscall";
5 |
6 | /// The breakpoint event is thrown by the EBREAK instruction
7 | pub const EVENT_BREAKPOINT: &str = "builtin::breakpoint";
8 |
--------------------------------------------------------------------------------
/squid/src/frontend/ao/func.rs:
--------------------------------------------------------------------------------
1 | use crate::frontend::ao::CFG;
2 |
3 | /// A Function corresponds to a function in an ELF file except that the
4 | /// CFG has been reconstructed and the code has been lifted into the ΑΩ IR.
5 | #[derive(Hash)]
6 | pub struct Function {
7 | cfg: CFG,
8 | perfect: bool,
9 | }
10 |
11 | impl Function {
12 | pub(crate) fn new(cfg: CFG, perfect: bool) -> Self {
13 | Self {
14 | cfg,
15 | perfect,
16 | }
17 | }
18 |
19 | /// Get the CFG of this function
20 | pub fn cfg(&self) -> &CFG {
21 | &self.cfg
22 | }
23 |
24 | /// Get the CFG of this function
25 | pub fn cfg_mut(&mut self) -> &mut CFG {
26 | &mut self.cfg
27 | }
28 |
29 | /// The CFG of this function is considered "perfect" if the graph is not disconnected
30 | pub fn perfect(&self) -> bool {
31 | self.perfect
32 | }
33 | }
34 |
--------------------------------------------------------------------------------
/squid/src/frontend/ao/mod.rs:
--------------------------------------------------------------------------------
1 | //! ΑΩ (ao) stands for "atomic operations" and is the IR of `squid`
2 |
3 | mod cfg;
4 | mod error;
5 | mod func;
6 | mod lifter;
7 | mod ops;
8 |
9 | pub(crate) use lifter::Lifter;
10 |
11 | pub mod engine;
12 | pub mod events;
13 | pub use cfg::{
14 | BasicBlock,
15 | CFGError,
16 | Edge,
17 | CFG,
18 | };
19 | pub use error::AoError;
20 | pub use func::Function;
21 | pub use ops::{
22 | ArithmeticBehavior,
23 | Comparison,
24 | Half,
25 | Op,
26 | Register,
27 | Signedness,
28 | Var,
29 | VarType,
30 | };
31 |
--------------------------------------------------------------------------------
/squid/src/frontend/dependency.rs:
--------------------------------------------------------------------------------
1 | use std::path::{
2 | Path,
3 | PathBuf,
4 | };
5 |
6 | struct Dependency {
7 | path: PathBuf,
8 | edges: Vec,
9 | }
10 |
11 | impl Dependency {
12 | fn new>(path: P) -> Self {
13 | Self {
14 | path: path.into(),
15 | edges: Vec::new(),
16 | }
17 | }
18 | }
19 |
20 | pub struct DependencyGraph {
21 | nodes: Vec,
22 | cursor: usize,
23 | }
24 |
25 | impl DependencyGraph {
26 | pub fn new() -> Self {
27 | Self {
28 | nodes: Vec::new(),
29 | cursor: 0,
30 | }
31 | }
32 |
33 | pub fn add_node>(&mut self, path: P) -> usize {
34 | let mut i = 0;
35 |
36 | while i < self.nodes.len() {
37 | if self.nodes[i].path.as_path() == path.as_ref() {
38 | return i;
39 | }
40 |
41 | i += 1;
42 | }
43 |
44 | self.nodes.push(Dependency::new(path.as_ref()));
45 | i
46 | }
47 |
48 | pub fn add_edge(&mut self, from: usize, to: usize) {
49 | if !self.nodes[from].edges.contains(&to) {
50 | self.nodes[from].edges.push(to);
51 | }
52 | }
53 |
54 | pub fn next_unvisited(&mut self) -> Option<(usize, &Path)> {
55 | if self.cursor < self.nodes.len() {
56 | let ret = Some((self.cursor, self.nodes[self.cursor].path.as_path()));
57 | self.cursor += 1;
58 | ret
59 | } else {
60 | None
61 | }
62 | }
63 |
64 | pub fn walk(&self, start: usize) -> Vec {
65 | let mut ret = Vec::::new();
66 | let mut cursor = 0;
67 |
68 | ret.push(start);
69 |
70 | while cursor < ret.len() {
71 | for edge in &self.nodes[ret[cursor]].edges {
72 | if !ret.contains(edge) {
73 | ret.push(*edge);
74 | }
75 | }
76 |
77 | cursor += 1;
78 | }
79 |
80 | ret
81 | }
82 | }
83 |
--------------------------------------------------------------------------------
/squid/src/frontend/error.rs:
--------------------------------------------------------------------------------
1 | use thiserror::Error;
2 |
3 | use crate::{
4 | frontend::ao::AoError,
5 | passes::VerifyerPassError,
6 | };
7 |
8 | /// This enum contains all error cases that can occur during creation of the process image
9 | #[allow(missing_docs)]
10 | #[derive(Error, Debug)]
11 | pub enum LoaderError {
12 | #[error("The dependency '{0}' cannot be found in the search paths")]
13 | DependencyNotFound(String),
14 |
15 | #[error("Invalid ELF binary: {0}")]
16 | InvalidELF(String),
17 |
18 | #[error("Symbol resolution error: {0}")]
19 | SymbolResolutionError(String),
20 |
21 | #[error("Error with ewe file: {0}")]
22 | EweError(String),
23 |
24 | #[error("{0:?}")]
25 | AoError(#[from] AoError),
26 |
27 | #[error("Error symbolizing code: {0}")]
28 | CodeSymbolizationError(String),
29 |
30 | #[error("Symbolic loading of ELF file failed: {0}")]
31 | LoadingError(String),
32 |
33 | #[error("IO error: {0}")]
34 | IOError(String),
35 |
36 | #[error("The symbolic ELF loader produced an invalid process image: {0}")]
37 | InvalidProcessImage(String),
38 |
39 | #[error("Verification failed: {0}")]
40 | VerificationError(#[from] VerifyerPassError),
41 | }
42 |
--------------------------------------------------------------------------------
/squid/src/frontend/fixedvec.rs:
--------------------------------------------------------------------------------
1 | use std::{
2 | fmt::{
3 | Debug,
4 | Formatter,
5 | },
6 | ops::{
7 | Index,
8 | IndexMut,
9 | },
10 | slice::SliceIndex,
11 | };
12 |
13 | /// A FixedVec is a vector that cannot change its length, only its content
14 | #[derive(Hash)]
15 | pub struct FixedVec {
16 | inner: Vec,
17 | }
18 |
19 | impl FixedVec {
20 | /// Fixate a vector and return a FixedVec
21 | pub fn lock>>(inner: V) -> Self {
22 | Self {
23 | inner: inner.into(),
24 | }
25 | }
26 |
27 | /// Unfixate this vector
28 | pub fn unlock(self) -> Vec {
29 | self.inner
30 | }
31 |
32 | /// The length of this vector
33 | pub fn len(&self) -> usize {
34 | self.inner.len()
35 | }
36 |
37 | /// Check whether this vector is empty
38 | pub fn is_empty(&self) -> bool {
39 | self.inner.is_empty()
40 | }
41 | }
42 |
43 | impl Index for FixedVec
44 | where
45 | I: SliceIndex<[T]>,
46 | {
47 | type Output = I::Output;
48 |
49 | fn index(&self, index: I) -> &Self::Output {
50 | self.inner.index(index)
51 | }
52 | }
53 |
54 | impl IndexMut for FixedVec
55 | where
56 | I: SliceIndex<[T]>,
57 | {
58 | fn index_mut(&mut self, index: I) -> &mut Self::Output {
59 | self.inner.index_mut(index)
60 | }
61 | }
62 |
63 | impl Debug for FixedVec {
64 | fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
65 | write!(f, "FixedVec")
66 | }
67 | }
68 |
--------------------------------------------------------------------------------
/squid/src/frontend/idmap.rs:
--------------------------------------------------------------------------------
1 | use std::{
2 | hash::{
3 | Hash,
4 | Hasher,
5 | },
6 | slice::{
7 | Iter,
8 | IterMut,
9 | },
10 | };
11 |
12 | /// The ID of an element in the ProcessImage
13 | pub type Id = usize;
14 |
15 | pub(crate) trait HasIdMut {
16 | fn id_mut(&mut self) -> &mut Id;
17 | }
18 |
19 | /// This trait provides access to the ID of elements in the process image
20 | pub trait HasId {
21 | /// Retrieve the ID of this element
22 | fn id(&self) -> Id;
23 | }
24 |
25 | #[derive(Debug, Clone)]
26 | pub(crate) struct IdFactory {
27 | cursor: Id,
28 | }
29 |
30 | impl IdFactory {
31 | pub(crate) fn new() -> Self {
32 | Self {
33 | cursor: Id::default().wrapping_add(1),
34 | }
35 | }
36 |
37 | pub(crate) fn next(&mut self) -> Id {
38 | let ret = self.cursor;
39 | self.cursor = ret.checked_add(1).expect("Ran out of possible ID values");
40 | ret
41 | }
42 |
43 | pub(crate) fn reset(&mut self) {
44 | self.cursor = Id::default().wrapping_add(1);
45 | }
46 | }
47 |
48 | pub(crate) type IdMapValues<'a, T> = Iter<'a, T>;
49 | pub(crate) type IdMapValuesMut<'a, T> = IterMut<'a, T>;
50 |
51 | #[derive(Clone, Debug)]
52 | pub(crate) struct IdMap
53 | where
54 | T: HasId + HasIdMut + Hash,
55 | {
56 | data: Vec,
57 | factory: IdFactory,
58 | }
59 |
60 | impl Hash for IdMap
61 | where
62 | T: HasId + HasIdMut + Hash,
63 | {
64 | fn hash(&self, state: &mut H) {
65 | state.write_usize(self.data.len());
66 | for elem in &self.data {
67 | elem.hash(state);
68 | }
69 | }
70 | }
71 |
72 | impl IdMap
73 | where
74 | T: HasId + HasIdMut + Hash,
75 | {
76 | pub(crate) fn new() -> Self {
77 | Self {
78 | data: Vec::new(),
79 | factory: IdFactory::new(),
80 | }
81 | }
82 |
83 | pub(crate) fn clear(&mut self) {
84 | self.data.clear();
85 | self.factory.reset();
86 | }
87 |
88 | pub(crate) fn reserve_id(&mut self, elem: &mut T) -> Id {
89 | let mut id = elem.id();
90 |
91 | if id == Id::default() {
92 | id = self.factory.next();
93 | *elem.id_mut() = id;
94 | }
95 |
96 | id
97 | }
98 |
99 | pub(crate) fn insert(&mut self, mut elem: T) -> Id {
100 | let id = self.reserve_id(&mut elem);
101 | self.data.push(elem);
102 | id
103 | }
104 |
105 | pub(crate) fn get(&self, id: Id) -> Option<&T> {
106 | self.data.iter().find(|&elem| elem.id() == id)
107 | }
108 |
109 | pub(crate) fn get_mut(&mut self, id: Id) -> Option<&mut T> {
110 | self.data.iter_mut().find(|elem| elem.id() == id)
111 | }
112 |
113 | pub(crate) fn values(&self) -> IdMapValues {
114 | self.data.iter()
115 | }
116 |
117 | pub(crate) fn values_mut(&mut self) -> IdMapValuesMut {
118 | self.data.iter_mut()
119 | }
120 |
121 | pub(crate) fn get_at(&self, idx: usize) -> Option<&T> {
122 | self.data.get(idx)
123 | }
124 |
125 | pub(crate) fn get_at_mut(&mut self, idx: usize) -> Option<&mut T> {
126 | self.data.get_mut(idx)
127 | }
128 |
129 | pub(crate) fn insert_at(&mut self, idx: usize, mut elem: T) -> Id {
130 | let id = self.reserve_id(&mut elem);
131 | self.data.insert(idx, elem);
132 | id
133 | }
134 |
135 | pub(crate) fn remove_at(&mut self, idx: usize) -> T {
136 | self.data.remove(idx)
137 | }
138 |
139 | pub(crate) fn len(&self) -> usize {
140 | self.data.len()
141 | }
142 |
143 | pub(crate) fn is_empty(&self) -> bool {
144 | self.data.is_empty()
145 | }
146 | }
147 |
148 | macro_rules! idmap_functions {
149 | ($parent:ty, $child:ty, $suffix:ident) => {
150 | /// Accessor methods that handle the children of this process image element
151 | impl $parent {
152 | /// Get the cursor of this process image element
153 | pub fn cursor(&self) -> usize {
154 | self.cursor
155 | }
156 |
157 | /// Set the cursor of this process image element
158 | pub fn set_cursor(&mut self, cursor: usize) {
159 | self.cursor = cursor;
160 | }
161 |
162 | /// Move the cursor of this process image element to the end of its children list.
163 | /// This enables appending children.
164 | pub fn move_cursor_beyond_end(&mut self) {
165 | self.cursor = self.idmap.len();
166 | }
167 |
168 | /// Increment the cursor of this process image element or return `false` if the cursor
169 | /// is already at the last child
170 | pub fn move_cursor_forward(&mut self) -> bool {
171 | if self.cursor >= self.idmap.len().saturating_sub(1) {
172 | false
173 | } else {
174 | self.cursor += 1;
175 | true
176 | }
177 | }
178 |
179 | /// Decrement the cursor of this process image element or return `false` if it's already
180 | /// at the first child
181 | pub fn move_cursor_backwards(&mut self) -> bool {
182 | if self.cursor == 0 {
183 | false
184 | } else {
185 | self.cursor -= 1;
186 | true
187 | }
188 | }
189 |
190 | /// Retrieve the child with the given ID of this process image element
191 | pub fn $suffix(&self, id: Id) -> Option<&$child> {
192 | self.idmap.get(id)
193 | }
194 |
195 | paste! {
196 | /// Get the number of children for this process image element
197 | pub fn [](&self) -> usize {
198 | self.idmap.len()
199 | }
200 |
201 | /// Get the child at the current cursor position for this process image element
202 | pub fn [](&self) -> Option<&$child> {
203 | self.idmap.get_at(self.cursor)
204 | }
205 |
206 | /// Get the child at the current cursor position for this process image element
207 | pub fn [](&mut self) -> Option<&mut $child> {
208 | self.idmap.get_at_mut(self.cursor)
209 | }
210 |
211 | /// Insert the given child into the list of children at the current cursor position for this process image element
212 | pub fn [](&mut self, child: $child) -> Id {
213 | self.idmap.insert_at(self.cursor, child)
214 | }
215 |
216 | /// Delete the child at the current cursor position of this process image element and return it
217 | pub fn [](&mut self) -> $child {
218 | self.idmap.remove_at(self.cursor)
219 | }
220 |
221 | /// Iterate over all children of this process image element independent of the current cursor position
222 | pub fn [](&self) -> IdMapValues<$child> {
223 | self.idmap.values()
224 | }
225 |
226 | /// Iterate over all children of this process image element independent of the current cursor position
227 | pub fn [](&mut self) -> IdMapValuesMut<$child> {
228 | self.idmap.values_mut()
229 | }
230 |
231 | /// Retrieve the child with the given ID of this process image element
232 | pub fn [<$suffix _mut>](&mut self, id: Id) -> Option<&mut $child> {
233 | self.idmap.get_mut(id)
234 | }
235 | }
236 | }
237 | };
238 | }
239 | pub(crate) use idmap_functions;
240 |
--------------------------------------------------------------------------------
/squid/src/frontend/mod.rs:
--------------------------------------------------------------------------------
1 | //! The frontend handles everything related to symbolic ELF-loading and the creation
2 | //! of the process image
3 |
4 | mod chunk;
5 | mod dependency;
6 | mod elf;
7 | mod error;
8 | mod fixedvec;
9 | mod idmap;
10 | mod image;
11 | mod perms;
12 | mod pointer;
13 | mod reloc;
14 | mod section;
15 | mod symbol;
16 |
17 | pub(crate) mod symbolization_passes;
18 |
19 | pub(crate) use image::ProcessImageBuilder;
20 | pub(crate) use reloc::Relocation;
21 |
22 | pub mod ao;
23 | pub use chunk::{
24 | Chunk,
25 | ChunkBuilder,
26 | ChunkContent,
27 | };
28 | pub use elf::{
29 | Elf,
30 | ElfBuilder,
31 | };
32 | pub use error::LoaderError;
33 | pub use fixedvec::FixedVec;
34 | pub use idmap::{
35 | HasId,
36 | Id,
37 | };
38 | pub use image::{
39 | ProcessImage,
40 | VAddr,
41 | };
42 | pub use perms::Perms;
43 | pub use pointer::{
44 | BasicBlockPointer,
45 | FunctionPointer,
46 | GlobalPointer,
47 | Pointer,
48 | };
49 | pub use section::{
50 | Section,
51 | SectionBuilder,
52 | };
53 | pub use symbol::{
54 | Symbol,
55 | SymbolBuilder,
56 | };
57 |
--------------------------------------------------------------------------------
/squid/src/frontend/perms.rs:
--------------------------------------------------------------------------------
1 | use goblin;
2 |
3 | const PERM_X: u8 = 1;
4 | const PERM_W: u8 = 2;
5 | const PERM_R: u8 = 4;
6 |
7 | /// The permissions memory and elements in the process image can have
8 | #[derive(Copy, Clone, PartialEq, Debug, Default, Hash)]
9 | pub struct Perms(u8);
10 |
11 | impl Perms {
12 | pub(crate) fn from_segment_flags(flags: u32) -> Self {
13 | let mut perms = Perms(0);
14 |
15 | if (flags & goblin::elf::program_header::PF_X) != 0 {
16 | perms.make_executable();
17 | }
18 |
19 | if (flags & goblin::elf::program_header::PF_W) != 0 {
20 | perms.make_writable();
21 | }
22 |
23 | if (flags & goblin::elf::program_header::PF_R) != 0 {
24 | perms.make_readable();
25 | }
26 |
27 | perms
28 | }
29 |
30 | pub(crate) fn from_section_header(header: &goblin::elf::section_header::SectionHeader) -> Self {
31 | let mut perms = Perms(0);
32 | perms.make_readable();
33 |
34 | if header.is_executable() {
35 | perms.make_executable();
36 | }
37 |
38 | if header.is_writable() {
39 | perms.make_writable();
40 | }
41 |
42 | perms
43 | }
44 |
45 | #[allow(missing_docs)]
46 | pub fn is_executable(&self) -> bool {
47 | (self.0 & PERM_X) != 0
48 | }
49 |
50 | #[allow(missing_docs)]
51 | pub fn is_writable(&self) -> bool {
52 | (self.0 & PERM_W) != 0
53 | }
54 |
55 | #[allow(missing_docs)]
56 | pub fn is_readable(&self) -> bool {
57 | (self.0 & PERM_R) != 0
58 | }
59 |
60 | #[allow(missing_docs)]
61 | pub fn is_inaccessible(&self) -> bool {
62 | self.0 == 0
63 | }
64 |
65 | #[allow(missing_docs)]
66 | pub fn clear_executable(&mut self) {
67 | self.0 &= !PERM_X;
68 | }
69 |
70 | #[allow(missing_docs)]
71 | pub fn clear_writable(&mut self) {
72 | self.0 &= !PERM_W;
73 | }
74 |
75 | #[allow(missing_docs)]
76 | pub fn clear_readable(&mut self) {
77 | self.0 &= !PERM_R;
78 | }
79 |
80 | #[allow(missing_docs)]
81 | pub fn make_executable(&mut self) {
82 | self.0 |= PERM_X
83 | }
84 |
85 | #[allow(missing_docs)]
86 | pub fn make_readable(&mut self) {
87 | self.0 |= PERM_R
88 | }
89 |
90 | #[allow(missing_docs)]
91 | pub fn make_writable(&mut self) {
92 | self.0 |= PERM_W
93 | }
94 | }
95 |
--------------------------------------------------------------------------------
/squid/src/frontend/pointer.rs:
--------------------------------------------------------------------------------
1 | use crate::frontend::idmap::Id;
2 |
3 | /// A symbolic pointer to a global variable in the process image
4 | #[allow(missing_docs)]
5 | #[derive(Debug, Clone, PartialEq, Eq, Hash)]
6 | pub struct GlobalPointer {
7 | pub elf: Id,
8 | pub section: Id,
9 | pub symbol: Id,
10 | pub chunk: Id,
11 | pub offset: usize,
12 | }
13 |
14 | /// A symbolic pointer to a basic block in a function of the process image
15 | #[allow(missing_docs)]
16 | #[derive(Debug, Clone, PartialEq, Eq, Hash)]
17 | pub struct BasicBlockPointer {
18 | pub elf: Id,
19 | pub section: Id,
20 | pub symbol: Id,
21 | pub chunk: Id,
22 | pub bb: Id,
23 | }
24 |
25 | /// A symbolic pointer to a function in the process image.
26 | /// Note that the difference to the [`BasicBlockPointer`] is that this pointer
27 | /// always points to the entrypoint bb of a function, even when the entrypoint changes.
28 | #[allow(missing_docs)]
29 | #[derive(Debug, Clone, PartialEq, Eq, Hash)]
30 | pub struct FunctionPointer {
31 | pub elf: Id,
32 | pub section: Id,
33 | pub symbol: Id,
34 | pub chunk: Id,
35 | }
36 |
37 | /// A symbolic pointer that points to a leaf in the process image
38 | #[derive(Debug, Clone, PartialEq, Eq, Hash)]
39 | pub enum Pointer {
40 | /// This pointer points nowhere
41 | Null,
42 |
43 | /// This pointer points to a global variable
44 | Global(GlobalPointer),
45 |
46 | /// This pointer points to a specific basic block of a function
47 | BasicBlock(BasicBlockPointer),
48 |
49 | /// This pointer points to a specific function
50 | Function(FunctionPointer),
51 | }
52 |
--------------------------------------------------------------------------------
/squid/src/frontend/reloc.rs:
--------------------------------------------------------------------------------
1 | use crate::frontend::error::LoaderError;
2 |
3 | #[derive(Debug, PartialEq, Eq, Hash)]
4 | pub(crate) enum Relocation {
5 | Offset(usize),
6 | SymbolImport(String),
7 | TlsSymbolImport(String),
8 | }
9 |
10 | fn reloc_size(typ: u32) -> usize {
11 | match typ {
12 | goblin::elf::reloc::R_RISCV_RELATIVE
13 | | goblin::elf::reloc::R_RISCV_TLS_TPREL64
14 | | goblin::elf::reloc::R_RISCV_JUMP_SLOT
15 | | goblin::elf::reloc::R_RISCV_64 => 8,
16 | _ => todo!("{}", typ),
17 | }
18 | }
19 |
20 | pub(crate) fn parse_relocations(
21 | elf: &goblin::elf::Elf,
22 | parent_start: u64,
23 | parent_size: u64,
24 | ) -> Result, LoaderError> {
25 | if !elf.dynrels.is_empty() {
26 | return Err(LoaderError::InvalidELF("Binary uses rels instead of relas".to_string()));
27 | }
28 |
29 | let mut result = Vec::new();
30 |
31 | for rela in elf.dynrelas.iter() {
32 | let vaddr = rela.r_offset;
33 | let size = reloc_size(rela.r_type);
34 |
35 | let has_start = parent_start <= vaddr && vaddr < parent_start + parent_size;
36 | let has_end =
37 | parent_start <= (vaddr + size as u64 - 1) && (vaddr + size as u64 - 1) < parent_start + parent_size;
38 |
39 | if has_start != has_end {
40 | return Err(LoaderError::InvalidELF(format!(
41 | "Relocation at {:#x} overlaps parent {:#x}",
42 | vaddr, parent_start
43 | )));
44 | }
45 |
46 | if has_start {
47 | let addend = rela.r_addend.unwrap();
48 |
49 | let rel = if rela.r_sym == 0 {
50 | // Use zero as symbol value
51 |
52 | match rela.r_type {
53 | goblin::elf::reloc::R_RISCV_RELATIVE => Relocation::Offset(addend as usize),
54 | t => todo!("{}", t),
55 | }
56 | } else {
57 | let linked_sym = elf.dynsyms.get(rela.r_sym).unwrap();
58 |
59 | // Is this even correct? Nobody documents shit anymore
60 | if linked_sym.is_import() {
61 | assert_eq!(addend, 0);
62 |
63 | let name = elf.dynstrtab.get_at(linked_sym.st_name).unwrap().to_string();
64 |
65 | match rela.r_type {
66 | goblin::elf::reloc::R_RISCV_JUMP_SLOT => Relocation::SymbolImport(name),
67 | goblin::elf::reloc::R_RISCV_64 => Relocation::SymbolImport(name),
68 | goblin::elf::reloc::R_RISCV_TLS_TPREL64 => Relocation::TlsSymbolImport(name),
69 | t => todo!("{}", t),
70 | }
71 | } else {
72 | match rela.r_type {
73 | goblin::elf::reloc::R_RISCV_64 => {
74 | Relocation::Offset(linked_sym.st_value as usize + addend as usize)
75 | },
76 | goblin::elf::reloc::R_RISCV_JUMP_SLOT => Relocation::Offset(linked_sym.st_value as usize),
77 | t => todo!("{}", t),
78 | }
79 | }
80 | };
81 |
82 | result.push((rel, vaddr, size));
83 | }
84 | }
85 |
86 | Ok(result)
87 | }
88 |
--------------------------------------------------------------------------------
/squid/src/frontend/symbolization_passes/arith.rs:
--------------------------------------------------------------------------------
1 | use crate::frontend::ao::{
2 | engine::{
3 | Engine,
4 | Value,
5 | },
6 | Function,
7 | Op,
8 | };
9 |
10 | pub(crate) struct EliminateArithmeticPass {}
11 |
12 | impl EliminateArithmeticPass {
13 | #[allow(clippy::new_without_default)]
14 | pub(crate) fn new() -> Self {
15 | Self {}
16 | }
17 |
18 | pub(crate) fn run(&mut self, func: &mut Function) -> Result<(), String> {
19 | for bb in func.cfg_mut().iter_basic_blocks_mut() {
20 | let vars = {
21 | let mut engine = Engine::<()>::attach(bb, None);
22 |
23 | if let Err(err) = engine.execute() {
24 | return Err(format!("EngineError: {}", err));
25 | }
26 |
27 | engine.vars().to_owned()
28 | };
29 |
30 | bb.set_cursor(0);
31 |
32 | while let Some(op) = bb.cursor_op() {
33 | #[allow(clippy::single_match)]
34 | match op {
35 | Op::Add {
36 | dst,
37 | src1,
38 | src2,
39 | ..
40 | } => {
41 | if let Value::Integer(0) = &vars[src1.id()] {
42 | bb.replace_op(Op::Copy {
43 | dst: *dst,
44 | src: *src2,
45 | });
46 | } else if let Value::Integer(0) = &vars[src2.id()] {
47 | bb.replace_op(Op::Copy {
48 | dst: *dst,
49 | src: *src1,
50 | });
51 | }
52 | },
53 | //TODO: maybe support more arithmetic operators
54 | _ => {},
55 | }
56 |
57 | if !bb.move_cursor_forward() {
58 | break;
59 | }
60 | }
61 | }
62 |
63 | Ok(())
64 | }
65 | }
66 |
--------------------------------------------------------------------------------
/squid/src/frontend/symbolization_passes/deadcode.rs:
--------------------------------------------------------------------------------
1 | use crate::frontend::ao::Function;
2 |
3 | pub(crate) struct DeadCodeEliminationPass {}
4 |
5 | impl DeadCodeEliminationPass {
6 | #[allow(clippy::new_without_default)]
7 | pub(crate) fn new() -> Self {
8 | Self {}
9 | }
10 |
11 | pub(crate) fn run(&mut self, func: &mut Function) -> Result<(), String> {
12 | for bb in func.cfg_mut().iter_basic_blocks_mut() {
13 | let mut used = vec![0; bb.num_variables()];
14 |
15 | for op in bb.ops() {
16 | for var in op.input_variables() {
17 | used[var.id()] += 1;
18 | }
19 | }
20 |
21 | bb.move_cursor_beyond_end();
22 | bb.move_cursor_backwards();
23 |
24 | while let Some(op) = bb.cursor_op() {
25 | let mut output_used = false;
26 | let mut has_output = false;
27 |
28 | for var in op.output_variables() {
29 | output_used |= used[var.id()] > 0;
30 | has_output = true;
31 | }
32 |
33 | if has_output && !output_used {
34 | let op = bb.delete_op();
35 |
36 | for var in op.input_variables() {
37 | used[var.id()] -= 1;
38 | }
39 | }
40 |
41 | if !bb.move_cursor_backwards() {
42 | break;
43 | }
44 | }
45 | }
46 |
47 | Ok(())
48 | }
49 | }
50 |
--------------------------------------------------------------------------------
/squid/src/frontend/symbolization_passes/empty.rs:
--------------------------------------------------------------------------------
1 | use crate::frontend::{
2 | ao::{
3 | Edge,
4 | Function,
5 | },
6 | HasId,
7 | };
8 |
9 | pub(crate) struct EliminateEmptyBasicBlocksPass {}
10 |
11 | impl EliminateEmptyBasicBlocksPass {
12 | #[allow(clippy::new_without_default)]
13 | pub(crate) fn new() -> Self {
14 | Self {}
15 | }
16 |
17 | pub(crate) fn run(&mut self, func: &mut Function) -> Result<(), String> {
18 | for bb in func.cfg_mut().iter_basic_blocks_mut() {
19 | if bb.ops().is_empty() {
20 | let mut next = None;
21 |
22 | for edge in bb.edges() {
23 | match edge {
24 | Edge::Next(id) => {
25 | assert!(next.is_none());
26 | next = Some(*id);
27 | },
28 | Edge::Jump(_) => return Err("Empty basic block with a jump edge".to_string()),
29 | }
30 | }
31 |
32 | if let Some(next) = next {
33 | assert_ne!(bb.id(), next);
34 |
35 | bb.set_cursor(0);
36 | bb.nop();
37 | } else {
38 | todo!("???");
39 | }
40 | }
41 | }
42 |
43 | Ok(())
44 | }
45 | }
46 |
--------------------------------------------------------------------------------
/squid/src/frontend/symbolization_passes/metadata.rs:
--------------------------------------------------------------------------------
1 | use crate::frontend::ao::{
2 | Function,
3 | Op,
4 | };
5 |
6 | pub(crate) struct MetadataPass {}
7 |
8 | impl MetadataPass {
9 | pub(crate) fn new() -> Self {
10 | Self {}
11 | }
12 |
13 | pub(crate) fn run(&self, func: &mut Function) -> Result<(), String> {
14 | for bb in func.cfg_mut().iter_basic_blocks_mut() {
15 | let mut count = 0;
16 | let mut prev_cursor = None;
17 |
18 | bb.set_cursor(0);
19 |
20 | while let Some(op) = bb.cursor_op() {
21 | if let Op::NextInstruction {
22 | ..
23 | } = op
24 | {
25 | if count == 0 {
26 | if let Some(prev_cursor) = prev_cursor {
27 | let current_cursor = bb.cursor();
28 | bb.set_cursor(prev_cursor);
29 | bb.delete_op();
30 | bb.set_cursor(current_cursor - 1);
31 | }
32 | }
33 |
34 | count = 0;
35 | prev_cursor = Some(bb.cursor());
36 | } else {
37 | count += 1;
38 | }
39 |
40 | if !bb.move_cursor_forward() {
41 | break;
42 | }
43 | }
44 |
45 | if count == 0 && prev_cursor.is_some() {
46 | bb.delete_op();
47 | }
48 | }
49 |
50 | Ok(())
51 | }
52 | }
53 |
--------------------------------------------------------------------------------
/squid/src/frontend/symbolization_passes/mod.rs:
--------------------------------------------------------------------------------
1 | mod arith;
2 | mod deadcode;
3 | mod empty;
4 | mod metadata;
5 | mod propagate;
6 | mod regcache;
7 | mod relax;
8 | mod symbolize;
9 |
10 | pub(crate) use arith::EliminateArithmeticPass;
11 | pub(crate) use deadcode::DeadCodeEliminationPass;
12 | pub(crate) use empty::EliminateEmptyBasicBlocksPass;
13 | pub(crate) use metadata::MetadataPass;
14 | pub(crate) use propagate::AddressPropagationPass;
15 | pub(crate) use regcache::RegisterCachingPass;
16 | pub(crate) use relax::HandleRelaxationPass;
17 | pub(crate) use symbolize::SymbolizerPass;
18 |
--------------------------------------------------------------------------------
/squid/src/frontend/symbolization_passes/regcache.rs:
--------------------------------------------------------------------------------
1 | use crate::frontend::ao::{
2 | Function,
3 | Op,
4 | Register,
5 | Var,
6 | };
7 |
8 | const REGISTER_COUNT: usize = 32 + 32 + 1;
9 | fn register_index(reg: &Register) -> usize {
10 | match reg {
11 | Register::Gp(reg) => *reg as usize,
12 | Register::Fp(reg) => 32 + *reg as usize,
13 | Register::Csr(_) => 64,
14 | }
15 | }
16 |
17 | pub(crate) struct RegisterCachingPass {
18 | registers: [Option; REGISTER_COUNT],
19 | }
20 |
21 | impl RegisterCachingPass {
22 | #[allow(clippy::new_without_default)]
23 | pub(crate) fn new() -> Self {
24 | Self {
25 | registers: [None; REGISTER_COUNT],
26 | }
27 | }
28 |
29 | pub(crate) fn run(&mut self, func: &mut Function) -> Result<(), String> {
30 | for bb in func.cfg_mut().iter_basic_blocks_mut() {
31 | for reg in &mut self.registers {
32 | *reg = None;
33 | }
34 |
35 | bb.set_cursor(0);
36 |
37 | while let Some(op) = bb.cursor_op() {
38 | match op {
39 | Op::StoreRegister {
40 | reg,
41 | var,
42 | } => {
43 | self.registers[register_index(reg)] = Some(*var);
44 | },
45 | Op::LoadRegister {
46 | var,
47 | reg,
48 | } => {
49 | if let Some(orig_var) = &self.registers[register_index(reg)] {
50 | bb.replace_op(Op::Copy {
51 | dst: *var,
52 | src: *orig_var,
53 | });
54 | }
55 | },
56 | _ => {},
57 | }
58 |
59 | if !bb.move_cursor_forward() {
60 | break;
61 | }
62 | }
63 | }
64 |
65 | Ok(())
66 | }
67 | }
68 |
--------------------------------------------------------------------------------
/squid/src/frontend/symbolization_passes/relax.rs:
--------------------------------------------------------------------------------
1 | use crate::{
2 | frontend::{
3 | ao::BasicBlock,
4 | ChunkContent,
5 | Elf,
6 | HasId,
7 | Pointer,
8 | },
9 | riscv::register::GpRegister,
10 | };
11 |
12 | pub(crate) struct HandleRelaxationPass {}
13 |
14 | impl HandleRelaxationPass {
15 | #[allow(clippy::new_without_default)]
16 | pub(crate) fn new() -> Self {
17 | Self {}
18 | }
19 |
20 | pub(crate) fn run(&mut self, elf: &mut Elf) -> Result<(), String> {
21 | for section in elf.iter_sections_mut() {
22 | if !section.perms().is_executable() {
23 | continue;
24 | }
25 |
26 | for symbol in section.iter_symbols_mut() {
27 | if symbol.private_name("load_gp").is_some() {
28 | let mut id = None;
29 |
30 | for chunk in symbol.iter_chunks() {
31 | assert!(id.is_none());
32 | id = Some(chunk.id());
33 | }
34 |
35 | let id = id.unwrap();
36 |
37 | let chunk = symbol.chunk_mut(id).unwrap();
38 | let addr = chunk.vaddr();
39 | let ChunkContent::Code(func) = chunk.content_mut() else { unreachable!() };
40 |
41 | func.cfg_mut().clear();
42 |
43 | let mut bb = BasicBlock::at_vaddr(addr);
44 | let null = bb.load_pointer(Pointer::Null);
45 | bb.store_gp_register(GpRegister::gp, null).unwrap();
46 | let ra = bb.load_gp_register(GpRegister::ra);
47 | bb.jump(ra).unwrap();
48 |
49 | let id = func.cfg_mut().add_basic_block(bb);
50 | func.cfg_mut().set_entry(id);
51 | }
52 | }
53 | }
54 |
55 | Ok(())
56 | }
57 | }
58 |
--------------------------------------------------------------------------------
/squid/src/kernel/mod.rs:
--------------------------------------------------------------------------------
1 | //! Unstable. Use at your own risk.
2 |
3 | #![allow(missing_docs)]
4 |
5 | pub mod fs;
6 | pub mod linux;
7 | pub mod structs;
8 |
--------------------------------------------------------------------------------
/squid/src/kernel/structs.rs:
--------------------------------------------------------------------------------
1 | #[derive(Debug, Clone)]
2 | #[repr(C)]
3 | pub struct Timespec {
4 | pub tv_sec: u64,
5 | pub tv_nsec: u64,
6 | }
7 |
8 | #[derive(Debug, Clone)]
9 | #[repr(C)]
10 | pub struct Stat {
11 | pub st_dev: u64,
12 | pub st_ino: u64,
13 | pub st_mode: u32,
14 | pub st_nlink: u32,
15 | pub st_uid: u32,
16 | pub st_gid: u32,
17 | pub st_rdev: u64,
18 | pub unknown: u64,
19 | pub st_size: u64,
20 | pub st_blksize: u64,
21 | pub st_blocks: u64,
22 | pub st_atime: Timespec,
23 | pub st_mtime: Timespec,
24 | pub st_ctime: Timespec,
25 | pub pad: u64,
26 | }
27 |
--------------------------------------------------------------------------------
/squid/src/lib.rs:
--------------------------------------------------------------------------------
1 | //! 
2 | //!
3 | //! `squid` is a RISC-V emulation library with features that make it a powerful tool for vulnerability research and fuzzing.
4 | //!
5 | //! Unlike other emulators, `squid` utilizes AOT instead of JIT compilation and allows you to rewrite your target's code before emulation.
6 | //! During runtime, you get full control over your target by handling all system calls and other events yourself.
7 | //! This makes it easy to create and combine new sanitizers and test programs for all kinds of vulnerabilities, not just memory corruptions.
8 | //!
9 | //! # Where to start
10 | //! Everything in `squid` starts with the [`Compiler`], so have a look at that.
11 | //!
12 | //! # Examples, a wiki and more...
13 | //! ...can be found in the [repository](https://github.com/fkie-cad/squid).
14 | //!
15 | //! # What is supported
16 | //! Binaries compiled with `squid`s own [RISC-V toolchain](https://github.com/fkie-cad/squid/blob/main/wiki/TOOLCHAIN.md) and this special set of flags:
17 | //! ```
18 | //! -fPIE -pie -O0 -g -fno-jump-tables -mno-relax -D__thread=
19 | //! ```
20 | //!
21 | //! # Features
22 | //! - `tui` (enabled by default): Enables animations and fancy loading graphics
23 | //!
24 |
25 | #![warn(missing_docs)]
26 | #![feature(btree_extract_if)]
27 |
28 | mod compiler;
29 | mod listing;
30 | mod logger;
31 |
32 | /* Squids interface: */
33 | pub mod backends;
34 | pub mod event;
35 | pub mod frontend;
36 | pub mod kernel;
37 | pub mod passes;
38 | pub mod riscv;
39 | pub mod runtime;
40 |
41 | pub use compiler::{Loader, Compiler};
42 | pub use logger::Logger;
43 |
--------------------------------------------------------------------------------
/squid/src/listing.rs:
--------------------------------------------------------------------------------
1 | use std::path::Path;
2 |
3 | use squid_ewe::{
4 | Listing,
5 | ListingFunction,
6 | };
7 |
8 | use crate::frontend::{
9 | LoaderError,
10 | Symbol,
11 | };
12 |
13 | pub(crate) struct ListingManager {
14 | listing: Option,
15 | }
16 |
17 | impl ListingManager {
18 | pub(crate) fn new>(path: P) -> Self {
19 | let path = format!("{}.{}", path.as_ref().display(), squid_ewe::EXTENSION);
20 | let path = Path::new(&path);
21 | Self {
22 | listing: if path.exists() { Some(Listing::from_file(path)) } else { None },
23 | }
24 | }
25 |
26 | pub(crate) fn have_metadata(&self) -> bool {
27 | self.listing.is_some()
28 | }
29 |
30 | pub(crate) fn lookup_symbol(&self, symbol: &Symbol) -> Result, LoaderError> {
31 | if let Some(listing) = &self.listing {
32 | let mut funcs = Vec::new();
33 |
34 | for private_name in symbol.private_names() {
35 | if !funcs.is_empty() {
36 | break;
37 | }
38 |
39 | funcs = listing.match_symbol(private_name.as_str(), Some(symbol.size()), symbol.file());
40 | }
41 |
42 | for public_name in symbol.public_names() {
43 | if !funcs.is_empty() {
44 | break;
45 | }
46 |
47 | funcs = listing.match_symbol(public_name.as_str(), Some(symbol.size()), symbol.file());
48 | }
49 |
50 | match funcs.len() {
51 | 0 => Ok(None),
52 | 1 => Ok(Some(funcs[0])),
53 | _ => Err(LoaderError::EweError(format!(
54 | "Multiple functions in listing for symbol {:#x}",
55 | symbol.vaddr()
56 | ))),
57 | }
58 | } else {
59 | Ok(None)
60 | }
61 | }
62 | }
63 |
--------------------------------------------------------------------------------
/squid/src/logger.rs:
--------------------------------------------------------------------------------
1 | #[cfg(feature = "tui")]
2 | use core::time::Duration;
3 | use std::{
4 | borrow::Cow,
5 | fmt::Display,
6 | };
7 |
8 | use colored::Colorize;
9 | use indicatif::{
10 | ProgressBar,
11 | ProgressStyle,
12 | };
13 |
14 | /// The Logger is a helper struct that displays log messages to the terminal.
15 | ///
16 | /// If the feature `tui` is activated, it also displays some nice TUI animations.
17 | /// Use the functions [`Logger::info`], [`Logger::warning`], [`Logger::error`] to emit log messages
18 | /// at the corresponding log levels.
19 | pub struct Logger {
20 | bar: ProgressBar,
21 | running: bool,
22 | prefix: Option,
23 | }
24 |
25 | #[cfg(feature = "tui")]
26 | const ANIMATION: &[&str; 9] = &[". ", ".. ", "...", " ..", " .", " ..", "...", "..", ""];
27 |
28 | #[cfg(not(feature = "tui"))]
29 | const ANIMATION: &[&str; 2] = &["...", ""];
30 |
31 | impl Logger {
32 | pub(crate) fn spinner() -> Self {
33 | let bar = ProgressBar::new_spinner();
34 | bar.set_style(
35 | ProgressStyle::with_template("{prefix:.magenta/red} {msg} {spinner}").unwrap().tick_strings(ANIMATION),
36 | );
37 | bar.set_prefix("[🦑]");
38 |
39 | Self {
40 | bar,
41 | running: false,
42 | prefix: None,
43 | }
44 | }
45 |
46 | pub(crate) fn set_prefix>(&mut self, prefix: S) {
47 | self.prefix = Some(prefix.into());
48 | }
49 |
50 | pub(crate) fn clear_prefix(&mut self) {
51 | self.prefix = None;
52 | }
53 |
54 | pub(crate) fn set_title(&mut self, title: impl Into>) {
55 | #[cfg(feature = "tui")]
56 | if !self.running {
57 | self.bar.enable_steady_tick(Duration::from_millis(100));
58 | self.running = true;
59 | }
60 | self.bar.set_message(title.into());
61 | }
62 |
63 | fn stop(&mut self) {
64 | if self.running {
65 | self.running = false;
66 | self.bar.finish_and_clear();
67 | }
68 | }
69 |
70 | fn emit>(&self, level: L, msg: S) {
71 | if let Some(prefix) = &self.prefix {
72 | self.bar.println(format!("{} {}{}{} {}", level, "(".bold(), prefix.bold(), ")".bold(), msg.as_ref()))
73 | } else {
74 | self.bar.println(format!("{} {}", level, msg.as_ref()));
75 | }
76 | }
77 |
78 | /// Emit a log message with log level "INFO"
79 | pub fn info>(&self, msg: S) {
80 | self.emit("[🦑::INFO]".blue().bold(), msg);
81 | }
82 |
83 | /// Emit a log message with log level "WARN"
84 | pub fn warning>(&self, msg: S) {
85 | self.emit("[🦑::WARN]".yellow().bold(), msg);
86 | }
87 |
88 | /// Emit a log message with log level "DEBUG"
89 | pub fn debug>(&self, _msg: S) {
90 | #[cfg(debug_assertions)]
91 | {
92 | self.emit("[🦑::DEBUG]".black().on_white(), _msg);
93 | }
94 | }
95 |
96 | /// Emit a log message with log level "ERROR"
97 | pub fn error>(&self, msg: S) {
98 | self.emit("[🦑::ERROR]".red().bold(), msg);
99 | }
100 | }
101 |
102 | impl Drop for Logger {
103 | fn drop(&mut self) {
104 | self.stop();
105 | }
106 | }
107 |
108 | #[cfg(test)]
109 | mod tests {
110 | use super::*;
111 |
112 | #[test]
113 | #[ignore]
114 | fn test_style() {
115 | let mut logger = Logger::spinner();
116 | logger.set_title("TITLE HERE");
117 | logger.info("info");
118 | logger.warning("warning");
119 | logger.debug("debug");
120 | logger.error("error");
121 |
122 | std::thread::sleep(std::time::Duration::from_secs(5));
123 | }
124 | }
125 |
--------------------------------------------------------------------------------
/squid/src/passes/breakpoint.rs:
--------------------------------------------------------------------------------
1 | use std::collections::HashSet;
2 |
3 | use thiserror::Error;
4 |
5 | use crate::{
6 | event::EventPool,
7 | frontend::{
8 | ao::{
9 | events::EVENT_BREAKPOINT,
10 | BasicBlock,
11 | Edge,
12 | Function,
13 | Op,
14 | },
15 | ChunkContent,
16 | ProcessImage,
17 | VAddr,
18 | },
19 | logger::Logger,
20 | passes::Pass,
21 | };
22 |
23 | /// The error type of the [`BreakpointPass`]
24 | #[derive(Error, Debug)]
25 | #[error("BreakpointPassError")]
26 | pub struct BreakpointPassError;
27 |
28 | /// The BreakpointPass allows you to insert breakpoints into the application.
29 | pub struct BreakpointPass {
30 | private_names: HashSet,
31 | public_names: HashSet,
32 | addrs: HashSet,
33 | all: bool,
34 | }
35 |
36 | impl BreakpointPass {
37 | /// Create a new BreakpointPass
38 | #[allow(clippy::new_without_default)]
39 | pub fn new() -> Self {
40 | Self {
41 | private_names: HashSet::new(),
42 | public_names: HashSet::new(),
43 | addrs: HashSet::new(),
44 | all: false,
45 | }
46 | }
47 |
48 | /// Break on all basic blocks
49 | pub fn all(&mut self) -> &mut Self {
50 | self.all = true;
51 | self
52 | }
53 |
54 | /// Break on functions with the given private name
55 | pub fn private_name>(&mut self, name: S) -> &mut Self {
56 | self.private_names.insert(name.into());
57 | self
58 | }
59 |
60 | /// Break on functions with the given public name
61 | pub fn public_name>(&mut self, name: S) -> &mut Self {
62 | self.public_names.insert(name.into());
63 | self
64 | }
65 |
66 | /// Break at the provided address
67 | pub fn address(&mut self, addr: VAddr) -> &mut Self {
68 | self.addrs.insert(addr);
69 | self
70 | }
71 |
72 | fn instrument(&self, func: &mut Function, event_pool: &EventPool) {
73 | let breakpoint = event_pool.get_event(EVENT_BREAKPOINT).unwrap();
74 |
75 | let old_entry = func.cfg().entry();
76 | let entry_vaddr = func.cfg().basic_block(old_entry).unwrap().vaddr();
77 | let mut entry_instr = None;
78 |
79 | for op in func.cfg().basic_block(old_entry).unwrap().ops() {
80 | if let Op::NextInstruction { vaddr } = op {
81 | entry_instr = Some(*vaddr);
82 | break;
83 | }
84 | }
85 |
86 | let mut bb = BasicBlock::new();
87 |
88 | if let Some(entry_vaddr) = entry_vaddr {
89 | bb.set_vaddr(entry_vaddr);
90 | }
91 |
92 | if let Some(entry_instr) = entry_instr {
93 | bb.next_instruction(entry_instr);
94 | }
95 |
96 | bb.fire_event(breakpoint);
97 |
98 | bb.add_edge(Edge::Next(old_entry));
99 |
100 | let id = func.cfg_mut().add_basic_block(bb);
101 | func.cfg_mut().set_entry(id);
102 |
103 | assert_ne!(old_entry, id);
104 | }
105 | }
106 |
107 | impl Pass for BreakpointPass {
108 | type Error = BreakpointPassError;
109 |
110 | fn name(&self) -> String {
111 | "BreakpointPass".to_string()
112 | }
113 |
114 | fn run(
115 | &mut self,
116 | image: &mut ProcessImage,
117 | event_pool: &mut EventPool,
118 | logger: &Logger,
119 | ) -> Result<(), Self::Error> {
120 | let mut count = 0;
121 |
122 | for elf in image.iter_elfs_mut() {
123 | for section in elf.iter_sections_mut() {
124 | for symbol in section.iter_symbols_mut() {
125 | let mut found = self.all;
126 |
127 | /* Check if it matches a public name */
128 | if !found {
129 | for name in &self.public_names {
130 | if symbol.public_name(name).is_some() {
131 | found = true;
132 | break;
133 | }
134 | }
135 | }
136 |
137 | /* Check if it matches a private name */
138 | if !found {
139 | for name in &self.private_names {
140 | if symbol.private_name(name).is_some() {
141 | found = true;
142 | break;
143 | }
144 | }
145 | }
146 |
147 | for chunk in symbol.iter_chunks_mut() {
148 | /* Check if the address matches */
149 | if !found {
150 | found |= self.addrs.contains(&chunk.vaddr());
151 | }
152 |
153 | if found {
154 | if let ChunkContent::Code(func) = chunk.content_mut() {
155 | self.instrument(func, event_pool);
156 | count += 1;
157 | }
158 | }
159 | }
160 | }
161 | }
162 | }
163 |
164 | logger.info(format!("Set {} breakpoints", count));
165 |
166 | Ok(())
167 | }
168 | }
169 |
--------------------------------------------------------------------------------
/squid/src/passes/mod.rs:
--------------------------------------------------------------------------------
1 | //! Contains the passes that are provided by `squid`
2 |
3 | mod asan;
4 | mod breakpoint;
5 | mod dot;
6 | mod pass;
7 | mod verify;
8 |
9 | pub use asan::AsanPass;
10 | pub use breakpoint::{
11 | BreakpointPass,
12 | BreakpointPassError,
13 | };
14 | pub use dot::{
15 | FunctionDOTPass,
16 | ImageDOTPass,
17 | };
18 | pub use pass::{
19 | NoPassError,
20 | Pass,
21 | };
22 | pub(crate) use verify::VerifyerPass;
23 | pub use verify::VerifyerPassError;
24 |
--------------------------------------------------------------------------------
/squid/src/passes/pass.rs:
--------------------------------------------------------------------------------
1 | use thiserror::Error;
2 |
3 | use crate::{
4 | event::EventPool,
5 | frontend::ProcessImage,
6 | logger::Logger,
7 | };
8 |
9 | /// This type can be used as a `Pass::Error` to signal
10 | /// that a pass never fails.
11 | #[derive(Error, Debug)]
12 | #[error("This pass is supposed to not throw any errors")]
13 | pub struct NoPassError;
14 |
15 | /// A pass in `squid` is any type that implements this trait.
16 | ///
17 | /// Passes can be used to inspect or modify the process image.
18 | pub trait Pass {
19 | /// The error that might be returned by the pass
20 | type Error: std::error::Error;
21 |
22 | /// The name of the pass (displayed on the terminal)
23 | fn name(&self) -> String;
24 |
25 | /// Run the pass.
26 | ///
27 | /// # Arguments
28 | /// 1. `image`: The process image that contains all code and data of the target application and all its dependencies
29 | /// 2. `event_pool`: The event pool that manages all events that can be thrown by the application
30 | /// 3. `logger`: A helper struct that can display log messages at different log levels
31 | fn run(&mut self, image: &mut ProcessImage, event_pool: &mut EventPool, logger: &Logger)
32 | -> Result<(), Self::Error>;
33 | }
34 |
--------------------------------------------------------------------------------
/squid/src/riscv/fflags.rs:
--------------------------------------------------------------------------------
1 | //! The flags that can be set in the `fflags` CSR.
2 |
3 | /// Inexact
4 | pub const NX: u32 = 1 << 0;
5 |
6 | /// Underflow
7 | pub const UF: u32 = 1 << 1;
8 |
9 | /// Overflow
10 | pub const OF: u32 = 1 << 2;
11 |
12 | /// Divide by zero
13 | pub const DZ: u32 = 1 << 3;
14 |
15 | /// Invalid operation
16 | pub const NV: u32 = 1 << 4;
17 |
--------------------------------------------------------------------------------
/squid/src/riscv/ieee754.rs:
--------------------------------------------------------------------------------
1 | //! Contains types related to the IEEE754 usage of the RISC-V ISA.
2 |
3 | use std::ops::{
4 | AddAssign,
5 | SubAssign,
6 | };
7 |
8 | use num_traits::{
9 | bounds::Bounded,
10 | cast::NumCast,
11 | float::Float,
12 | };
13 |
14 | pub(crate) const NAN_BOX: u64 = 0xFFFFFFFF00000000;
15 | pub(crate) const SINGLE_NAN: u32 = 0x7fc00000;
16 | pub(crate) const DOUBLE_NAN: u64 = 0x7ff8000000000000;
17 |
18 | pub(crate) trait RiscvFloat: Float {
19 | fn is_half(&self) -> bool;
20 | fn is_odd(&self) -> bool;
21 | fn is_signaling(&self) -> bool;
22 | fn riscv_nan() -> Self;
23 |
24 | fn is_special(&self) -> bool {
25 | self.is_infinite() || self.is_nan() || *self == Self::max_value() || *self == Self::min_value()
26 | }
27 | }
28 |
29 | impl RiscvFloat for f32 {
30 | fn is_half(&self) -> bool {
31 | self.abs() == 0.5f32
32 | }
33 |
34 | fn is_odd(&self) -> bool {
35 | (self % 2.0f32).abs() != 0.0f32
36 | }
37 |
38 | fn is_signaling(&self) -> bool {
39 | (self.to_bits() & (1u32 << 22)) == 0
40 | }
41 |
42 | fn riscv_nan() -> Self {
43 | Self::from_bits(SINGLE_NAN)
44 | }
45 | }
46 |
47 | impl RiscvFloat for f64 {
48 | fn is_half(&self) -> bool {
49 | self.abs() == 0.5f64
50 | }
51 |
52 | fn is_odd(&self) -> bool {
53 | (self % 2.0f64).abs() != 0.0f64
54 | }
55 |
56 | fn is_signaling(&self) -> bool {
57 | (self.to_bits() & (1u64 << 51)) == 0
58 | }
59 |
60 | fn riscv_nan() -> Self {
61 | Self::from_bits(DOUBLE_NAN)
62 | }
63 | }
64 |
65 | /// Round to nearest, tie to even
66 | pub(crate) fn round_nte(mut x: T) -> T {
67 | if x.is_special() {
68 | return x;
69 | }
70 |
71 | let (trunk, fract) = (x.trunc(), x.fract());
72 |
73 | if fract.is_half() {
74 | if trunk.is_odd() {
75 | x = (x + fract).copysign(x);
76 | } else {
77 | x = (x - fract).copysign(x);
78 | }
79 | }
80 |
81 | x.round()
82 | }
83 |
84 | /// Round towards zero
85 | pub(crate) fn round_tz(x: T) -> T {
86 | if x.is_special() {
87 | return x;
88 | }
89 |
90 | if x.is_sign_positive() {
91 | x.floor()
92 | } else {
93 | x.ceil()
94 | }
95 | }
96 |
97 | /// Round down
98 | pub(crate) fn round_dn(x: T) -> T {
99 | if x.is_special() {
100 | return x;
101 | }
102 |
103 | x.floor()
104 | }
105 |
106 | /// Round up
107 | pub(crate) fn round_up(x: T) -> T {
108 | if x.is_special() {
109 | return x;
110 | }
111 |
112 | x.ceil()
113 | }
114 |
115 | /// Round to nearest, tie to max magnitude
116 | pub(crate) fn round_nmm(mut x: T) -> T {
117 | if x.is_special() {
118 | return x;
119 | }
120 |
121 | let fract = x.fract();
122 |
123 | if fract.is_half() {
124 | x += fract;
125 | }
126 |
127 | x.round()
128 | }
129 |
130 | pub(crate) fn add(a: T, b: T) -> T
131 | where
132 | T: RiscvFloat,
133 | {
134 | if a.is_nan() || b.is_nan() {
135 | T::riscv_nan()
136 | } else if a.is_infinite() {
137 | if b.is_infinite() && (a.is_sign_positive() ^ b.is_sign_positive()) {
138 | T::riscv_nan()
139 | } else {
140 | a
141 | }
142 | } else if b.is_infinite() {
143 | if a.is_infinite() && (a.is_sign_positive() ^ b.is_sign_positive()) {
144 | T::riscv_nan()
145 | } else {
146 | b
147 | }
148 | } else {
149 | a + b
150 | }
151 | }
152 |
153 | pub(crate) fn sub(a: T, b: T) -> T {
154 | if a.is_nan() || b.is_nan() {
155 | T::riscv_nan()
156 | } else if a.is_infinite() && b.is_infinite() {
157 | if a.is_sign_positive() ^ b.is_sign_positive() {
158 | a
159 | } else {
160 | T::riscv_nan()
161 | }
162 | } else {
163 | a - b
164 | }
165 | }
166 |
167 | pub(crate) fn mul(a: T, b: T) -> T {
168 | if (a.is_nan() || b.is_nan()) || (a.is_infinite() && b.is_zero()) || (a.is_zero() && b.is_infinite()) {
169 | T::riscv_nan()
170 | } else {
171 | a * b
172 | }
173 | }
174 |
175 | pub(crate) fn div(a: T, b: T) -> T {
176 | if a.is_nan() || b.is_nan() {
177 | T::riscv_nan()
178 | } else if b.is_infinite() {
179 | if a.is_infinite() {
180 | T::riscv_nan()
181 | } else if a.is_sign_positive() ^ b.is_sign_positive() {
182 | -T::zero()
183 | } else {
184 | T::zero()
185 | }
186 | } else if a.is_infinite() {
187 | if a.is_sign_positive() ^ b.is_sign_positive() {
188 | T::neg_infinity()
189 | } else {
190 | T::infinity()
191 | }
192 | } else if b.is_zero() {
193 | if a.is_zero() {
194 | T::riscv_nan()
195 | } else if a.is_sign_positive() ^ b.is_sign_positive() {
196 | T::neg_infinity()
197 | } else {
198 | T::infinity()
199 | }
200 | } else {
201 | a / b
202 | }
203 | }
204 |
205 | pub(crate) fn min(a: T, b: T) -> T {
206 | if a.is_nan() || b.is_nan() {
207 | if a.is_nan() && b.is_nan() {
208 | T::riscv_nan()
209 | } else if b.is_nan() {
210 | a
211 | } else {
212 | b
213 | }
214 | } else if a.is_zero() && b.is_zero() && a.is_sign_positive() != b.is_sign_positive() {
215 | -T::zero()
216 | } else {
217 | a.min(b)
218 | }
219 | }
220 |
221 | pub(crate) fn max(a: T, b: T) -> T {
222 | if a.is_nan() || b.is_nan() {
223 | if a.is_nan() && b.is_nan() {
224 | T::riscv_nan()
225 | } else if a.is_nan() {
226 | b
227 | } else {
228 | a
229 | }
230 | } else if a.is_zero() && b.is_zero() && a.is_sign_positive() != b.is_sign_positive() {
231 | T::zero()
232 | } else {
233 | a.max(b)
234 | }
235 | }
236 |
237 | pub(crate) fn classify(a: T) -> u64 {
238 | let mut mask: u64 = 0;
239 |
240 | if a.is_nan() {
241 | if a.is_signaling() {
242 | mask |= 1 << 8;
243 | } else {
244 | mask |= 1 << 9;
245 | }
246 | } else if a.is_sign_negative() {
247 | if a.is_infinite() {
248 | mask |= 1 << 0;
249 | } else if a.is_subnormal() {
250 | mask |= 1 << 2;
251 | } else if a.is_zero() {
252 | mask |= 1 << 3;
253 | } else {
254 | mask |= 1 << 1;
255 | }
256 | } else if a.is_infinite() {
257 | mask |= 1 << 7;
258 | } else if a.is_subnormal() {
259 | mask |= 1 << 5;
260 | } else if a.is_zero() {
261 | mask |= 1 << 4;
262 | } else {
263 | mask |= 1 << 6;
264 | }
265 |
266 | mask
267 | }
268 |
269 | pub(crate) fn convert(f: F) -> I
270 | where
271 | F: RiscvFloat,
272 | I: Bounded + NumCast,
273 | {
274 | if f.is_nan() {
275 | I::max_value()
276 | } else if f.is_infinite() {
277 | if f.is_sign_positive() {
278 | I::max_value()
279 | } else {
280 | I::min_value()
281 | }
282 | } else if let Some(i) = I::from(f) {
283 | i
284 | } else if f.is_sign_positive() {
285 | I::max_value()
286 | } else {
287 | I::min_value()
288 | }
289 | }
290 |
--------------------------------------------------------------------------------
/squid/src/riscv/mod.rs:
--------------------------------------------------------------------------------
1 | //! Provides constants and types that are related to the RISC-V ISA.
2 |
3 | pub(crate) mod ieee754;
4 | pub(crate) mod instr;
5 |
6 | pub mod fflags;
7 | pub mod register;
8 | pub mod rm;
9 | pub mod syscalls;
10 |
--------------------------------------------------------------------------------
/squid/src/riscv/register.rs:
--------------------------------------------------------------------------------
1 | //! Contains everything related to RISC-V registers
2 |
3 | #![allow(non_upper_case_globals)]
4 |
5 | mod gp {
6 | pub(super) const zero: usize = 0;
7 | pub(super) const ra: usize = 1;
8 | pub(super) const sp: usize = 2;
9 | pub(super) const gp: usize = 3;
10 | pub(super) const tp: usize = 4;
11 | pub(super) const t0: usize = 5;
12 | pub(super) const t1: usize = 6;
13 | pub(super) const t2: usize = 7;
14 | pub(super) const s0: usize = 8;
15 | pub(super) const s1: usize = 9;
16 | pub(super) const a0: usize = 10;
17 | pub(super) const a1: usize = 11;
18 | pub(super) const a2: usize = 12;
19 | pub(super) const a3: usize = 13;
20 | pub(super) const a4: usize = 14;
21 | pub(super) const a5: usize = 15;
22 | pub(super) const a6: usize = 16;
23 | pub(super) const a7: usize = 17;
24 | pub(super) const s2: usize = 18;
25 | pub(super) const s3: usize = 19;
26 | pub(super) const s4: usize = 20;
27 | pub(super) const s5: usize = 21;
28 | pub(super) const s6: usize = 22;
29 | pub(super) const s7: usize = 23;
30 | pub(super) const s8: usize = 24;
31 | pub(super) const s9: usize = 25;
32 | pub(super) const s10: usize = 26;
33 | pub(super) const s11: usize = 27;
34 | pub(super) const t3: usize = 28;
35 | pub(super) const t4: usize = 29;
36 | pub(super) const t5: usize = 30;
37 | pub(super) const t6: usize = 31;
38 | }
39 |
40 | mod fp {
41 | pub(super) const ft0: usize = 0;
42 | pub(super) const ft1: usize = 1;
43 | pub(super) const ft2: usize = 2;
44 | pub(super) const ft3: usize = 3;
45 | pub(super) const ft4: usize = 4;
46 | pub(super) const ft5: usize = 5;
47 | pub(super) const ft6: usize = 6;
48 | pub(super) const ft7: usize = 7;
49 | pub(super) const fs0: usize = 8;
50 | pub(super) const fs1: usize = 9;
51 | pub(super) const fa0: usize = 10;
52 | pub(super) const fa1: usize = 11;
53 | pub(super) const fa2: usize = 12;
54 | pub(super) const fa3: usize = 13;
55 | pub(super) const fa4: usize = 14;
56 | pub(super) const fa5: usize = 15;
57 | pub(super) const fa6: usize = 16;
58 | pub(super) const fa7: usize = 17;
59 | pub(super) const fs2: usize = 18;
60 | pub(super) const fs3: usize = 19;
61 | pub(super) const fs4: usize = 20;
62 | pub(super) const fs5: usize = 21;
63 | pub(super) const fs6: usize = 22;
64 | pub(super) const fs7: usize = 23;
65 | pub(super) const fs8: usize = 24;
66 | pub(super) const fs9: usize = 25;
67 | pub(super) const fs10: usize = 26;
68 | pub(super) const fs11: usize = 27;
69 | pub(super) const ft8: usize = 28;
70 | pub(super) const ft9: usize = 29;
71 | pub(super) const ft10: usize = 30;
72 | pub(super) const ft11: usize = 31;
73 | }
74 |
75 | mod csr {
76 | pub(super) const fflags: usize = 1;
77 | pub(super) const frm: usize = 2;
78 | pub(super) const fcsr: usize = 3;
79 | }
80 |
81 | /// The general purpose registers of the RISC-V ISA
82 | #[allow(missing_docs)]
83 | #[allow(non_camel_case_types)]
84 | #[derive(Debug, Clone, Copy, Eq, PartialEq, Hash)]
85 | #[repr(usize)]
86 | pub enum GpRegister {
87 | zero = gp::zero,
88 | ra = gp::ra,
89 | sp = gp::sp,
90 | gp = gp::gp,
91 | tp = gp::tp,
92 | t0 = gp::t0,
93 | t1 = gp::t1,
94 | t2 = gp::t2,
95 | s0 = gp::s0,
96 | s1 = gp::s1,
97 | a0 = gp::a0,
98 | a1 = gp::a1,
99 | a2 = gp::a2,
100 | a3 = gp::a3,
101 | a4 = gp::a4,
102 | a5 = gp::a5,
103 | a6 = gp::a6,
104 | a7 = gp::a7,
105 | s2 = gp::s2,
106 | s3 = gp::s3,
107 | s4 = gp::s4,
108 | s5 = gp::s5,
109 | s6 = gp::s6,
110 | s7 = gp::s7,
111 | s8 = gp::s8,
112 | s9 = gp::s9,
113 | s10 = gp::s10,
114 | s11 = gp::s11,
115 | t3 = gp::t3,
116 | t4 = gp::t4,
117 | t5 = gp::t5,
118 | t6 = gp::t6,
119 | }
120 |
121 | impl GpRegister {
122 | pub(crate) fn from_usize(number: usize) -> Self {
123 | assert!(number < 32);
124 | unsafe { std::mem::transmute::(number) }
125 | }
126 | }
127 |
128 | /// The floating point register of the RISC-V ISA
129 | #[allow(missing_docs)]
130 | #[allow(non_camel_case_types)]
131 | #[derive(Debug, Clone, Copy, Eq, PartialEq, Hash)]
132 | #[repr(usize)]
133 | pub enum FpRegister {
134 | ft0 = fp::ft0,
135 | ft1 = fp::ft1,
136 | ft2 = fp::ft2,
137 | ft3 = fp::ft3,
138 | ft4 = fp::ft4,
139 | ft5 = fp::ft5,
140 | ft6 = fp::ft6,
141 | ft7 = fp::ft7,
142 | fs0 = fp::fs0,
143 | fs1 = fp::fs1,
144 | fa0 = fp::fa0,
145 | fa1 = fp::fa1,
146 | fa2 = fp::fa2,
147 | fa3 = fp::fa3,
148 | fa4 = fp::fa4,
149 | fa5 = fp::fa5,
150 | fa6 = fp::fa6,
151 | fa7 = fp::fa7,
152 | fs2 = fp::fs2,
153 | fs3 = fp::fs3,
154 | fs4 = fp::fs4,
155 | fs5 = fp::fs5,
156 | fs6 = fp::fs6,
157 | fs7 = fp::fs7,
158 | fs8 = fp::fs8,
159 | fs9 = fp::fs9,
160 | fs10 = fp::fs10,
161 | fs11 = fp::fs11,
162 | ft8 = fp::ft8,
163 | ft9 = fp::ft9,
164 | ft10 = fp::ft10,
165 | ft11 = fp::ft11,
166 | }
167 |
168 | impl FpRegister {
169 | pub(crate) fn from_usize(number: usize) -> Self {
170 | assert!(number < 32);
171 | unsafe { std::mem::transmute::(number) }
172 | }
173 | }
174 |
175 | /// The control/status registers of the RISC-V ISA
176 | #[allow(missing_docs)]
177 | #[allow(non_camel_case_types)]
178 | #[derive(Debug, Clone, Copy, Eq, PartialEq, Hash)]
179 | #[repr(usize)]
180 | pub enum CsrRegister {
181 | fflags = csr::fflags,
182 | frm = csr::frm,
183 | fcsr = csr::fcsr,
184 | }
185 |
186 | impl CsrRegister {
187 | pub(crate) fn from_usize(number: usize) -> Self {
188 | match number {
189 | csr::fflags => CsrRegister::fflags,
190 | csr::frm => CsrRegister::frm,
191 | csr::fcsr => CsrRegister::fcsr,
192 | _ => panic!(),
193 | }
194 | }
195 | }
196 |
197 | /* syscall related registers */
198 | /// The general purpose register that holds the syscall number
199 | pub const syscall_number: GpRegister = GpRegister::a7;
200 | /// The general purpose registers that hold the syscall arguments
201 | pub const syscall_args: [GpRegister; 6] =
202 | [GpRegister::a0, GpRegister::a1, GpRegister::a2, GpRegister::a3, GpRegister::a4, GpRegister::a5];
203 | /// The general purpose register that holds the return value of a syscall
204 | pub const syscall_ret: GpRegister = GpRegister::a0;
205 |
--------------------------------------------------------------------------------
/squid/src/riscv/rm.rs:
--------------------------------------------------------------------------------
1 | //! The rounding modes of the RISC-V ISA that might appear in the `frm` CSR or in floating point instructions
2 |
3 | /// Round to nearest, ties to even
4 | pub const RNE: u64 = 0b000;
5 | /// Round towards zero
6 | pub const RTZ: u64 = 0b001;
7 | /// Round towards -infinity
8 | pub const RDN: u64 = 0b010;
9 | /// Round towards +infinity
10 | pub const RUP: u64 = 0b011;
11 | /// Round to nearest, ties to max magnitude
12 | pub const RMM: u64 = 0b100;
13 |
14 | /// Only valid in instructions but not in fcsr
15 | pub const DYNAMIC: u64 = 0b111;
16 |
--------------------------------------------------------------------------------
/squid/src/runtime.rs:
--------------------------------------------------------------------------------
1 | //! Contains the [`Runtime`] trait.
2 |
3 | use crate::{
4 | frontend::VAddr,
5 | riscv::register::{
6 | CsrRegister,
7 | FpRegister,
8 | GpRegister,
9 | },
10 | };
11 |
12 | /// Snapshots are referred to by IDs of this type
13 | pub type SnapshotId = usize;
14 |
15 | /// This trait contains the minimum behavior that is expected from any runtime.
16 | pub trait Runtime {
17 | /// Each runtime has its corresponding error type
18 | type Error: std::error::Error;
19 |
20 | /// The Event is the return value of the [`Runtime::run`] function
21 | type Event;
22 |
23 | /* Register I/O */
24 | /// Set the program counter to the specified address
25 | fn set_pc(&mut self, pc: VAddr);
26 | /// Get the program counter of the program
27 | fn get_pc(&self) -> VAddr;
28 | /// Store a value into a general puporse register
29 | fn set_gp_register(&mut self, register: GpRegister, value: u64);
30 | /// Retrieve the value of a general purpose register
31 | fn get_gp_register(&self, register: GpRegister) -> u64;
32 | /// Store a value into a floating point register
33 | fn set_fp_register(&mut self, register: FpRegister, value: f64);
34 | /// Retrieve the value of a floating point register
35 | fn get_fp_register(&self, register: FpRegister) -> f64;
36 | /// Store a value into one of the control/status registers
37 | fn set_csr_register(&mut self, register: CsrRegister, value: u64);
38 | /// Retrieve the value of one of the control/status registers
39 | fn get_csr_register(&self, register: CsrRegister) -> u64;
40 |
41 | /* Interact with the code */
42 | /// Execute the program starting at the current program counter until an event is thrown
43 | fn run(&mut self) -> Result;
44 |
45 | /* Snapshot handling */
46 | /// Check if a snapshot with the given ID is available
47 | fn has_snapshot(&self, id: SnapshotId) -> bool;
48 | /// Take a snapshot of the current program state and assign it the given ID.
49 | /// If a snapshot with the same ID has already been created, it is overwritten.
50 | fn take_snapshot(&mut self, id: SnapshotId);
51 | /// Given a snapshot ID, restore the corresponding snapshot
52 | fn restore_snapshot(&mut self, id: SnapshotId) -> Result<(), Self::Error>;
53 | /// Delete the snapshot with the given ID from the snapshot store
54 | fn delete_snapshot(&mut self, id: SnapshotId) -> Result<(), Self::Error>;
55 |
56 | /* Event channel I/O */
57 | /// Get read-only access to the data in the event channel
58 | fn event_channel(&self) -> &[u64];
59 | /// Get write-access to the event channel. `size` determines how many elements you want to place into the event channel.
60 | fn event_channel_mut(&mut self, size: usize) -> Result<&mut [u64], Self::Error>;
61 |
62 | /* Memory I/O */
63 | /// Return the memory contents at the given address as a dword (8 bytes)
64 | fn load_dword(&self, address: VAddr) -> Result;
65 | /// Return the memory contents at the given address as a word (4 bytes)
66 | fn load_word(&self, address: VAddr) -> Result;
67 | /// Return the memory contents at the given address as an hword (2 bytes)
68 | fn load_hword(&self, address: VAddr) -> Result;
69 | /// Return the memory contents at the given address as a byte
70 | fn load_byte(&self, address: VAddr) -> Result;
71 | /// Return the memory contents at the given address as an array of bytes with size `size`
72 | fn load_slice(&self, address: VAddr, size: usize) -> Result<&[u8], Self::Error>;
73 | /// Store the given value at the given address as a byte
74 | fn store_byte(&mut self, address: VAddr, value: u8) -> Result<(), Self::Error>;
75 | /// Store the given value at the given address as a hword (2 bytes)
76 | fn store_hword(&mut self, address: VAddr, value: u16) -> Result<(), Self::Error>;
77 | /// Store the given value at the given address as a word (4 bytes)
78 | fn store_word(&mut self, address: VAddr, value: u32) -> Result<(), Self::Error>;
79 | /// Store the given value at the given address as a dword (8 bytes)
80 | fn store_dword(&mut self, address: VAddr, value: u64) -> Result<(), Self::Error>;
81 | /// Store the given byte array at the given address
82 | fn store_slice>(&mut self, address: VAddr, value: S) -> Result<(), Self::Error>;
83 | /// Retreive a NUL-terminated string at the given address.
84 | /// The NUL terminator must not be included in the return value but exists in memory.
85 | fn load_string(&self, address: VAddr) -> Result<&[u8], Self::Error>;
86 | /// Store the provided string as is at the given address. A NUL-terminator must be added by the implementation.
87 | fn store_string>(&mut self, address: VAddr, value: S) -> Result<(), Self::Error>;
88 | }
89 |
--------------------------------------------------------------------------------
/squid_ewe/Cargo.toml:
--------------------------------------------------------------------------------
1 | [package]
2 | name = "squid_ewe"
3 | readme = "README.md"
4 | description = "A helper tool for squid that extracts CFG metadata from C code"
5 | version.workspace = true
6 | authors.workspace = true
7 | edition.workspace = true
8 | license.workspace = true
9 |
10 | [dev-dependencies]
11 | goblin = { version = "0.6", features = ["std", "elf32", "elf64"]}
12 |
--------------------------------------------------------------------------------
/squid_ewe/README.md:
--------------------------------------------------------------------------------
1 | # ewe
2 |
3 | `ewe` is a compiler wrapper toolset that extracts metadata from C
4 | code and stores it in addition to the binaries as `.ewe` files.
5 |
6 | Its primary purpose is to tackle the information loss problem during compilation
7 | and reconstruct basic block boundaries in machine code.
8 | This enables CFG reconstruction from C code making use of the `goto*` extension.
9 |
10 | ## Toolchain
11 | The `ewe` tools are part of squid's toolchain and can be found in the `/ewe/` directory
12 | inside the docker container.
13 | The following tools are available:
14 |
15 | - `/ewe/gcc`: A wrapper around `riscv64-unknown-linux-gnu-gcc`
16 | - `/ewe/as`: A wrapper around `riscv64-unknown-linux-gnu-as`
17 | - `/ewe/ar`: A wrapper around `riscv64-unknown-linux-gnu-ar`
18 | - `/ewe/ld`: A wrapper around `riscv64-unknown-linux-gnu-ld`
19 |
20 | Use these programs instead of their RISC-V counterparts whenever your target uses `goto*` statements.
21 |
22 | ## Integration into squid
23 | `squid` automatically detects if the binaries it loads have a corresponding `.ewe` file and uses that
24 | for CFG reconstruction.
25 | It is important that the `.ewe` files follow the following convention: For a binary `path/to/binary.ext` that is loaded
26 | by `squid` the `.ewe` file must be named `path/to/binary.ext.ewe`. So, the `.ewe` extension is appended to the filename
27 | in order to signal that this `.ewe` file belongs to this binary.
28 |
--------------------------------------------------------------------------------
/squid_ewe/src/bin/ar.rs:
--------------------------------------------------------------------------------
1 | use std::{
2 | env,
3 | process::{
4 | exit,
5 | Command,
6 | },
7 | };
8 |
9 | use squid_ewe::{
10 | container::*,
11 | env::*,
12 | };
13 |
14 | fn build_cmd() -> Command {
15 | let wrapper_path = env_value(EWE_WRAPPER, EWE_WRAPPER_PATH);
16 | let mut cmd = Command::new(wrapper_path);
17 | cmd.arg(env_value(RISCV_AR, RISCV_AR_PATH));
18 | cmd.args(env::args().skip(1));
19 | cmd
20 | }
21 |
22 | fn main() -> ! {
23 | let status = build_cmd().envs(env::vars()).status().unwrap();
24 |
25 | if let Some(code) = status.code() {
26 | exit(code);
27 | } else {
28 | exit(-1);
29 | }
30 | }
31 |
--------------------------------------------------------------------------------
/squid_ewe/src/bin/as.rs:
--------------------------------------------------------------------------------
1 | use std::{
2 | env,
3 | process::{
4 | exit,
5 | Command,
6 | },
7 | };
8 |
9 | use squid_ewe::{
10 | container::*,
11 | env::*,
12 | };
13 |
14 | fn build_cmd() -> Command {
15 | let wrapper_path = env_value(EWE_WRAPPER, EWE_WRAPPER_PATH);
16 | let mut cmd = Command::new(wrapper_path);
17 | cmd.arg(env_value(RISCV_AS, RISCV_AS_PATH));
18 | cmd.args(env::args().skip(1));
19 | cmd
20 | }
21 |
22 | fn main() -> ! {
23 | let status = build_cmd().envs(env::vars()).status().unwrap();
24 |
25 | if let Some(code) = status.code() {
26 | exit(code);
27 | } else {
28 | exit(-1);
29 | }
30 | }
31 |
--------------------------------------------------------------------------------
/squid_ewe/src/bin/gcc.rs:
--------------------------------------------------------------------------------
1 | use std::{
2 | env,
3 | process::{
4 | exit,
5 | Command,
6 | },
7 | };
8 |
9 | use squid_ewe::{
10 | container::*,
11 | env::*,
12 | };
13 |
14 | fn build_cmd(args: &[String]) -> Command {
15 | #[cfg(debug_assertions)]
16 | eprintln!("[EWE] {args:?}");
17 |
18 | let mut is_cpp = false;
19 | let nostdlib = env_flag(EWE_NOSTDLIB);
20 |
21 | let prog_path = if args[0].ends_with("gcc") {
22 | env_value(RISCV_GCC, RISCV_GCC_PATH)
23 | } else if args[0].ends_with("g++") {
24 | is_cpp = true;
25 | env_value(RISCV_GPP, RISCV_GPP_PATH)
26 | } else {
27 | panic!("Invalid program name {}", args[0])
28 | };
29 |
30 | let mut cmd = Command::new(prog_path);
31 |
32 | cmd.arg("-wrapper");
33 | cmd.arg(env_value(EWE_WRAPPER, EWE_WRAPPER_PATH));
34 |
35 | if nostdlib {
36 | if is_cpp {
37 | todo!("C++ not supported yet");
38 | } else {
39 | cmd.arg("-nostdlib");
40 | }
41 |
42 | cmd.arg(env_value(RISCV_CRT1, RISCV_CRT1_PATH));
43 | }
44 |
45 | for arg in args.iter().skip(1) {
46 | match arg.as_str() {
47 | "-pipe" => {
48 | continue;
49 | },
50 | _ => {
51 | cmd.arg(arg);
52 | },
53 | }
54 | }
55 |
56 | if nostdlib {
57 | if is_cpp {
58 | todo!();
59 | } else {
60 | cmd.arg("-lc");
61 | }
62 | }
63 |
64 | cmd
65 | }
66 |
67 | fn has_print_prog_name(args: &[String]) -> Option {
68 | for (i, arg) in args.iter().enumerate().skip(1) {
69 | if arg.starts_with("-print-prog-name=") {
70 | return Some(i);
71 | }
72 | }
73 |
74 | None
75 | }
76 |
77 | fn check_misc_action(args: &mut Vec) {
78 | if let Some(i) = has_print_prog_name(args) {
79 | let (_, prog) = args[i].split_once('=').unwrap();
80 |
81 | let hooked = match prog {
82 | "ar" => {
83 | println!("{}", env_value(EWE_AR, EWE_AR_PATH));
84 | true
85 | },
86 | "as" => {
87 | println!("{}", env_value(EWE_AS, EWE_AS_PATH));
88 | true
89 | },
90 | "ld" => {
91 | println!("{}", env_value(EWE_LD, EWE_LD_PATH));
92 | true
93 | },
94 | _ => false,
95 | };
96 |
97 | if hooked {
98 | args.remove(i);
99 |
100 | if args.len() <= 1 {
101 | exit(0);
102 | }
103 | }
104 | }
105 | }
106 |
107 | fn main() -> ! {
108 | let mut args = env::args().collect::>();
109 |
110 | check_misc_action(&mut args);
111 |
112 | let status = build_cmd(&args).envs(env::vars()).status().unwrap();
113 |
114 | if let Some(code) = status.code() {
115 | exit(code);
116 | } else {
117 | exit(-1);
118 | }
119 | }
120 |
--------------------------------------------------------------------------------
/squid_ewe/src/bin/ld.rs:
--------------------------------------------------------------------------------
1 | use std::{
2 | env,
3 | process::{
4 | exit,
5 | Command,
6 | },
7 | };
8 |
9 | use squid_ewe::{
10 | container::*,
11 | env::*,
12 | };
13 |
14 | fn build_cmd() -> Command {
15 | let nostdlib = env_flag(EWE_NOSTDLIB);
16 | let wrapper_path = env_value(EWE_WRAPPER, EWE_WRAPPER_PATH);
17 |
18 | let mut cmd = Command::new(wrapper_path);
19 | cmd.arg(env_value(RISCV_LD, RISCV_LD_PATH));
20 |
21 | if nostdlib {
22 | cmd.arg("-nostdlib");
23 | cmd.arg(env_value(RISCV_CRT1, RISCV_CRT1_PATH));
24 | }
25 |
26 | cmd.args(env::args().skip(1));
27 |
28 | if nostdlib {
29 | cmd.arg("-L");
30 | cmd.arg(RISCV_LIB_PATH);
31 | cmd.arg("-lc");
32 | }
33 |
34 | cmd
35 | }
36 |
37 | fn main() -> ! {
38 | let status = build_cmd().envs(env::vars()).status().unwrap();
39 |
40 | if let Some(code) = status.code() {
41 | exit(code);
42 | } else {
43 | exit(-1);
44 | }
45 | }
46 |
--------------------------------------------------------------------------------
/squid_ewe/src/bin/wrapper.rs:
--------------------------------------------------------------------------------
1 | use std::{
2 | env,
3 | path::Path,
4 | process::{
5 | exit,
6 | Command,
7 | },
8 | };
9 |
10 | use squid_ewe::{
11 | container::RISCV_PREFIX,
12 | toolchain::{
13 | ArWrapper,
14 | AsWrapper,
15 | Cc1Wrapper,
16 | LdWrapper,
17 | },
18 | };
19 |
20 | fn forward() -> ! {
21 | let mut args = env::args().skip(1);
22 | let status = Command::new(args.next().unwrap()).args(args).envs(env::vars()).status().unwrap();
23 |
24 | if let Some(code) = status.code() {
25 | exit(code);
26 | } else {
27 | exit(-1);
28 | }
29 | }
30 |
31 | fn extract_program(args: &[String]) -> Option<&str> {
32 | let arg = args.first()?;
33 | let path = Path::new(arg);
34 | path.file_name().and_then(|x| x.to_str()).map(|x| {
35 | if x.starts_with(RISCV_PREFIX) {
36 | &x[RISCV_PREFIX.len() + 1..]
37 | } else {
38 | x
39 | }
40 | })
41 | }
42 |
43 | fn usage(prog: &str) {
44 | println!("USAGE: {prog} ");
45 | println!();
46 | println!("Use this program with: gcc -wrapper {prog}");
47 | }
48 |
49 | fn main() {
50 | let args = env::args().skip(1).collect::>();
51 |
52 | match extract_program(&args) {
53 | Some("cc1") => {
54 | if let Some(wrapper) = Cc1Wrapper::from_cmdline(args) {
55 | #[cfg(debug_assertions)]
56 | eprintln!("[EWE] -> {wrapper:?}");
57 |
58 | wrapper.compile();
59 | wrapper.postprocess();
60 | exit(0);
61 | }
62 | },
63 | Some("as") => {
64 | if let Some(wrapper) = AsWrapper::from_cmdline(args) {
65 | #[cfg(debug_assertions)]
66 | eprintln!("[EWE] -> {wrapper:?}");
67 |
68 | wrapper.preprocess();
69 | wrapper.compile();
70 | exit(0);
71 | }
72 | },
73 | Some("ld") | Some("collect2") => {
74 | if let Some(wrapper) = LdWrapper::from_cmdline(args) {
75 | #[cfg(debug_assertions)]
76 | eprintln!("[EWE] -> {wrapper:?}");
77 |
78 | wrapper.link();
79 | exit(0);
80 | }
81 | },
82 | Some("ar") => {
83 | if let Some(wrapper) = ArWrapper::from_cmdline(args) {
84 | #[cfg(debug_assertions)]
85 | eprintln!("[EWE] -> {wrapper:?}");
86 |
87 | wrapper.archive();
88 | exit(0);
89 | }
90 | },
91 | Some(_prog) => {
92 | // Ignore other subprograms
93 | #[cfg(debug_assertions)]
94 | eprintln!("[EWE] Ignoring {_prog}");
95 | },
96 | None => {
97 | usage(&args[0]);
98 | exit(1);
99 | },
100 | }
101 |
102 | forward()
103 | }
104 |
--------------------------------------------------------------------------------
/squid_ewe/src/container.rs:
--------------------------------------------------------------------------------
1 | pub const RISCV_AS_PATH: &str = "/riscv/bin/riscv64-unknown-linux-gnu-as";
2 | pub const RISCV_GCC_PATH: &str = "/riscv/bin/riscv64-unknown-linux-gnu-gcc";
3 | pub const RISCV_GPP_PATH: &str = "/riscv/bin/riscv64-unknown-linux-gnu-g++";
4 | pub const RISCV_CRT1_PATH: &str = "/riscv/sysroot/usr/lib/crt1.o";
5 | pub const RISCV_LD_PATH: &str = "/riscv/bin/riscv64-unknown-linux-gnu-ld";
6 | pub const RISCV_AR_PATH: &str = "/riscv/bin/riscv64-unknown-linux-gnu-ar";
7 | pub const RISCV_LIB_PATH: &str = "/riscv/sysroot/usr/lib";
8 | pub const RISCV_PREFIX: &str = "riscv64-unknown-linux-gnu";
9 |
10 | pub const EWE_WRAPPER_PATH: &str = "/ewe/wrapper";
11 | pub const EWE_AS_PATH: &str = "/ewe/as";
12 | pub const EWE_LD_PATH: &str = "/ewe/ld";
13 | pub const EWE_AR_PATH: &str = "/ewe/ar";
14 |
--------------------------------------------------------------------------------
/squid_ewe/src/env.rs:
--------------------------------------------------------------------------------
1 | pub const EWE_WRAPPER: &str = "EWE_WRAPPER";
2 | pub const EWE_AS: &str = "EWE_AS";
3 | pub const EWE_LD: &str = "EWE_LD";
4 | pub const EWE_AR: &str = "EWE_AR";
5 | pub const EWE_NOSTDLIB: &str = "EWE_NOSTDLIB";
6 | pub const RISCV_GCC: &str = "RISCV_GCC";
7 | pub const RISCV_GPP: &str = "RISCV_G++";
8 | pub const RISCV_CRT1: &str = "RISCV_CRT1";
9 | pub const RISCV_AR: &str = "RISCV_AR";
10 | pub const RISCV_AS: &str = "RISCV_AS";
11 | pub const RISCV_LD: &str = "RISCV_LD";
12 |
13 | pub fn env_value(key: &str, default: &str) -> String {
14 | if let Ok(value) = std::env::var(key) {
15 | value
16 | } else {
17 | default.to_string()
18 | }
19 | }
20 |
21 | pub fn env_flag(key: &str) -> bool {
22 | if let Ok(value) = std::env::var(key) {
23 | matches!(value.to_ascii_lowercase().as_str(), "1" | "yes" | "on" | "true")
24 | } else {
25 | false
26 | }
27 | }
28 |
--------------------------------------------------------------------------------
/squid_ewe/src/lib.rs:
--------------------------------------------------------------------------------
1 | //! `ewe` is a compiler wrapper toolset that extracts metadata from C
2 | //! code and stores it in addition to the generated binaries in `.ewe` files.
3 | //! Its primary purpose is to tackle the information loss problem during compilation
4 | //! and reconstruct basic block boundaries in machine code.
5 | //! This enables CFG reconstruction from C code making use of the `goto*` extension.
6 | //!
7 | //! This crate is a helper for [squid](https://github.com/fkie-cad/squid) and is not meant to be
8 | //! generally usable. Use at your own risk.
9 |
10 | mod asm;
11 | mod getopt;
12 | mod listing;
13 |
14 | pub mod container;
15 | pub mod env;
16 | pub mod toolchain;
17 | pub use listing::{
18 | Listing,
19 | ListingFunction,
20 | EXTENSION,
21 | };
22 |
--------------------------------------------------------------------------------
/squid_ewe/src/toolchain/ar.rs:
--------------------------------------------------------------------------------
1 | use std::{
2 | fs::OpenOptions,
3 | io::Write,
4 | process::{
5 | exit,
6 | Command,
7 | },
8 | };
9 |
10 | use crate::{
11 | getopt::{
12 | ArgList,
13 | GetoptParser,
14 | OptVal,
15 | },
16 | listing::EXTENSION,
17 | };
18 |
19 | fn command_as_opt(cmdline: &ArgList) -> bool {
20 | cmdline.arg_present('d')
21 | || cmdline.arg_present('m')
22 | || cmdline.arg_present('p')
23 | || cmdline.arg_present('q')
24 | || cmdline.arg_present('r')
25 | || cmdline.arg_present('s')
26 | || cmdline.arg_present('t')
27 | || cmdline.arg_present('x')
28 | }
29 |
30 | #[derive(Debug)]
31 | pub struct ArWrapper {
32 | args: Vec,
33 | inputs: Vec,
34 | output: String,
35 | }
36 |
37 | impl ArWrapper {
38 | pub fn from_cmdline(args: Vec) -> Option {
39 | let parser = GetoptParser::new()
40 | .optstring("dmpqrstxabcDfiMNoOPsSTuvV")
41 | .long("plugin", OptVal::Required, None)
42 | .long("target", OptVal::Required, None)
43 | .long("output", OptVal::Required, None)
44 | .long("record-libdeps", OptVal::Required, None)
45 | .long("thin", OptVal::None, None)
46 | .short('M', OptVal::Required, None);
47 | let cmdline = parser.parse_long(&args).unwrap();
48 | let mut i;
49 |
50 | if cmdline.arg_present('M') {
51 | return None;
52 | }
53 |
54 | let is_create = if command_as_opt(&cmdline) {
55 | i = 0;
56 | cmdline.arg_present('q') || cmdline.arg_present('r')
57 | } else {
58 | i = 1;
59 | let command = cmdline.positionals()[0];
60 | command.contains('q') || command.contains('r')
61 | };
62 |
63 | if !is_create {
64 | return None;
65 | }
66 |
67 | let mut inputs = Vec::new();
68 | let output = cmdline.positionals()[i].to_string();
69 |
70 | i += 1;
71 |
72 | while i < cmdline.positionals().len() {
73 | inputs.push(cmdline.positionals()[i].to_string());
74 | i += 1;
75 | }
76 |
77 | Some(Self {
78 | args,
79 | inputs,
80 | output,
81 | })
82 | }
83 |
84 | pub fn archive(&self) {
85 | /* Run ar */
86 | let status = Command::new(&self.args[0]).args(&self.args[1..]).envs(std::env::vars()).status().unwrap();
87 |
88 | if let Some(code) = status.code() {
89 | if code != 0 {
90 | exit(code);
91 | }
92 | } else {
93 | exit(-1);
94 | }
95 |
96 | /* Merge metadata files */
97 | let mut output = OpenOptions::new()
98 | .read(true)
99 | .write(true)
100 | .create(true)
101 | .append(true)
102 | .open(format!("{}.{}", self.output, EXTENSION))
103 | .unwrap();
104 |
105 | for input in &self.inputs {
106 | let input = OpenOptions::new().read(true).open(format!("{input}.{EXTENSION}"));
107 |
108 | if let Ok(mut input) = input {
109 | output.write_all(&[0xC]).unwrap();
110 | std::io::copy(&mut input, &mut output).unwrap();
111 | output.write_all(&[0xA]).unwrap();
112 | }
113 | }
114 | }
115 | }
116 |
117 | #[cfg(test)]
118 | mod tests {
119 | use super::*;
120 |
121 | #[test]
122 | fn test_glibc() {
123 | let wrapper = ArWrapper::from_cmdline(vec![
124 | "/ewe/ar".to_string(),
125 | "cr".to_string(),
126 | "librpc_compat_pic.a".to_string(),
127 | "compat-auth_des.os".to_string(),
128 | "compat-auth_unix.os".to_string(),
129 | "compat-clnt_gen.os".to_string(),
130 | ]);
131 | println!("{:?}", wrapper);
132 | }
133 | }
134 |
--------------------------------------------------------------------------------
/squid_ewe/src/toolchain/gas.rs:
--------------------------------------------------------------------------------
1 | use std::{
2 | io::Write,
3 | process::{
4 | exit,
5 | Command,
6 | },
7 | };
8 |
9 | use crate::{
10 | asm::separate_statements,
11 | getopt::{
12 | GetoptParser,
13 | OptVal,
14 | },
15 | listing::EXTENSION,
16 | };
17 |
18 | const OPTION_BLACKLIST: [&str; 1] = ["-mrelax"];
19 |
20 | #[derive(Debug)]
21 | pub struct AsWrapper {
22 | args: Vec,
23 | inputs: Vec,
24 | output: String,
25 | }
26 |
27 | impl AsWrapper {
28 | pub fn from_cmdline(args: Vec) -> Option {
29 | let parser = GetoptParser::new()
30 | .optstring("o:JKLMRWZa::Dg::I:vwXt:")
31 | .optstring("O::g::G:")
32 | .long("alternate", OptVal::None, None)
33 | .long("compress-debug-sections", OptVal::Optional, None)
34 | .long("nocompress-debug-sections", OptVal::None, None)
35 | .long("debug-prefix-map", OptVal::Required, None)
36 | .long("defsym", OptVal::Required, None)
37 | .long("dump-config", OptVal::None, None)
38 | .long("emulation", OptVal::Required, None)
39 | .long("execstack", OptVal::None, None)
40 | .long("noexecstack", OptVal::None, None)
41 | .long("size-check", OptVal::Required, None)
42 | .long("elf-stt-common", OptVal::Required, None)
43 | .long("sectname-subst", OptVal::None, None)
44 | .long("generate-missing-build-notes", OptVal::Required, None)
45 | .long("fatal-warnings", OptVal::None, None)
46 | .long("gdwarf-cie-version", OptVal::Required, None)
47 | .long("gen-debug", OptVal::None, None)
48 | .long("gstabs", OptVal::None, None)
49 | .long("gstabs+", OptVal::None, None)
50 | .long("gdwarf-2", OptVal::None, None)
51 | .long("gdwarf-3", OptVal::None, None)
52 | .long("gdwarf-4", OptVal::None, None)
53 | .long("gdwarf-5", OptVal::None, None)
54 | .long("gdwarf-sections", OptVal::None, None)
55 | .long("hash-size", OptVal::Required, None)
56 | .long("help", OptVal::None, None)
57 | .long("itbl", OptVal::Required, None)
58 | .long("keep-locals", OptVal::None, None)
59 | .long("listing-lhs-width", OptVal::Required, None)
60 | .long("listing-lhs-width2", OptVal::Required, None)
61 | .long("listing-rhs-width", OptVal::Required, None)
62 | .long("listing-cont-lines", OptVal::Required, None)
63 | .long("MD", OptVal::Required, None)
64 | .long("mri", OptVal::None, None)
65 | .long("nocpp", OptVal::None, None)
66 | .long("no-pad-sections", OptVal::None, None)
67 | .long("no-warn", OptVal::None, None)
68 | .long("reduce-memory-overheads", OptVal::None, None)
69 | .long("statistics", OptVal::None, None)
70 | .long("strip-local-absolute", OptVal::None, None)
71 | .long("version", OptVal::None, None)
72 | .long("verbose", OptVal::None, None)
73 | .long("target-help", OptVal::None, None)
74 | .long("traditional-format", OptVal::None, None)
75 | .long("warn", OptVal::None, None)
76 | .long("multibyte-handling", OptVal::Required, None)
77 | .long("march", OptVal::Required, None)
78 | .short('f', OptVal::Required, None)
79 | .long("mabi", OptVal::Required, None)
80 | .long("misa-spec", OptVal::Required, None)
81 | .long("mpriv-spec", OptVal::Required, None)
82 | .short('m', OptVal::Required, None);
83 |
84 | let cmdline = parser.parse_long_only(&args).unwrap();
85 | let output = if let Some(output) = cmdline.arg_value('o') {
86 | output.to_string()
87 | } else {
88 | return None;
89 | };
90 | let mut inputs = Vec::new();
91 |
92 | for input in cmdline.positionals() {
93 | if *input != "-" {
94 | inputs.push(input.to_string());
95 | }
96 | }
97 |
98 | Some(Self {
99 | args,
100 | inputs,
101 | output,
102 | })
103 | }
104 |
105 | pub fn preprocess(&self) {
106 | for filename in &self.inputs {
107 | let input = std::fs::read(filename).unwrap();
108 | let output = separate_statements(&input, filename);
109 | let mut file = std::fs::OpenOptions::new().create(true).truncate(true).write(true).open(filename).unwrap();
110 | file.write_all(&output).unwrap();
111 | }
112 | }
113 |
114 | pub fn compile(&self) {
115 | let listing = format!("{}.{}", self.output, EXTENSION);
116 | let status = Command::new(&self.args[0])
117 | .arg(format!("-almd={listing}"))
118 | .args(self.args[1..].iter().filter(|x| !OPTION_BLACKLIST.contains(&x.as_str())))
119 | .arg("-mno-relax")
120 | .envs(std::env::vars())
121 | .status()
122 | .unwrap();
123 |
124 | if let Some(code) = status.code() {
125 | if code != 0 {
126 | exit(code);
127 | }
128 | } else {
129 | exit(-1);
130 | }
131 | }
132 | }
133 |
134 | #[cfg(test)]
135 | mod tests {
136 | use super::*;
137 |
138 | #[test]
139 | fn test_assembly_preprocessing() {
140 | let output = separate_statements(
141 | b".file \":;\\\"\\\\\"# single-line comment\n/* multi-line\ncomment */.L0:.directive;inst;\n",
142 | "",
143 | );
144 | println!("{}", std::str::from_utf8(&output).unwrap());
145 | }
146 |
147 | #[test]
148 | fn test_as_wrapper1() {
149 | let wrapper = AsWrapper::from_cmdline(vec!["as".to_string(), "--help".to_string()]);
150 | assert!(wrapper.is_none());
151 | }
152 |
153 | #[test]
154 | fn test_as_wrapper2() {
155 | let wrapper = AsWrapper::from_cmdline(vec![
156 | "as".to_string(),
157 | "-fpic".to_string(),
158 | "--traditional-format".to_string(),
159 | "-march=rv64imafd".to_string(),
160 | "-mabi=lp64d".to_string(),
161 | "-misa-spec=2.2".to_string(),
162 | "-o".to_string(),
163 | "/tmp/cc5hz51Q.o".to_string(),
164 | "/tmp/ccNyPyiT.s".to_string(),
165 | "-".to_string(),
166 | ])
167 | .unwrap();
168 | assert_eq!(wrapper.inputs, &["/tmp/ccNyPyiT.s"]);
169 | assert_eq!(wrapper.output, "/tmp/cc5hz51Q.o");
170 | }
171 |
172 | #[test]
173 | fn test_glibc() {
174 | let wrapper = AsWrapper::from_cmdline(vec![
175 | "as".to_string(),
176 | "-I".to_string(),
177 | "../include".to_string(),
178 | "--gdwarf-5".to_string(),
179 | "--traditional-format".to_string(),
180 | "-fpic".to_string(),
181 | "-march=rv64imafd".to_string(),
182 | "-march=rv64imafd".to_string(),
183 | "-mabi=lp64d".to_string(),
184 | "-misa-spec=2.2".to_string(),
185 | "-o".to_string(),
186 | "/io/test-data/glibc/build/libio/clearerr.os".to_string(),
187 | "/tmp/ccJfUCIc.s".to_string(),
188 | ])
189 | .unwrap();
190 | println!("{:?}", wrapper);
191 | }
192 | }
193 |
--------------------------------------------------------------------------------
/squid_ewe/src/toolchain/mod.rs:
--------------------------------------------------------------------------------
1 | mod ar;
2 | mod cc1;
3 | mod gas;
4 | mod ld;
5 |
6 | pub use ar::ArWrapper;
7 | pub use cc1::Cc1Wrapper;
8 | pub use gas::AsWrapper;
9 | pub use ld::LdWrapper;
10 |
--------------------------------------------------------------------------------
/tests/Cargo.toml:
--------------------------------------------------------------------------------
1 | [package]
2 | name = "squid-tests"
3 | edition.workspace = true
4 | publish = false
5 |
6 | [dev-dependencies]
7 | squid_ewe = { path = "../squid_ewe" }
8 | squid = { path = "../squid" }
9 | libafl = "0.13"
10 | libafl_bolts = "0.13"
11 | serde = "1.0"
12 | mimalloc = { version = "0.1", default-features = false }
13 |
14 | [[test]]
15 | name = "benchmark"
16 | path = "benchmark/benchmark.rs"
17 |
--------------------------------------------------------------------------------
/tests/benchmark/.gitignore:
--------------------------------------------------------------------------------
1 | bench
2 | emu.*
3 |
--------------------------------------------------------------------------------
/tests/benchmark/Makefile:
--------------------------------------------------------------------------------
1 | CC=/riscv/bin/riscv64-unknown-linux-gnu-gcc
2 | CFLAGS=-Wall -Wextra -Wpedantic -Werror -fPIE -pie -O0 -g -fno-jump-tables -mno-relax -D__thread= -nostdlib -Wl,-emain -Wl,-dynamic-linker,/riscv/sysroot/lib/ld-2.33.so
3 |
4 | bench: main.c
5 | $(CC) -o $@ $(CFLAGS) $^
6 |
7 | .PHONY: clean
8 | clean:
9 | @rm -fv bench
10 |
--------------------------------------------------------------------------------
/tests/benchmark/README.md:
--------------------------------------------------------------------------------
1 | # Benchmarking squid
2 |
3 | ## Results
4 | QEMU: runtime 0m30.763s => 1,977,474,525 instrs/s
5 | squid: runtime 39.14s => 652,456,705.0020577 instr/s
6 |
--------------------------------------------------------------------------------
/tests/benchmark/benchmark.rs:
--------------------------------------------------------------------------------
1 | use squid::{
2 | backends::clang::ClangBackend,
3 | event::EVENT_BREAKPOINT,
4 | runtime::Runtime,
5 | Compiler,
6 | };
7 |
8 | #[test]
9 | fn benchmark_emulator() {
10 | let compiler = Compiler::loader()
11 | .binary("../tests/benchmark/bench")
12 | .load()
13 | .unwrap();
14 | let backend = ClangBackend::builder()
15 | .stack_size(1024 * 1024)
16 | .progname("bench")
17 | .source_file("../tests/benchmark/emu.c")
18 | .cflag("-Ofast")
19 | .cflag("-ffast-math")
20 | .cflag("-flto")
21 | .cflag("-s")
22 | .cflag("-fno-stack-protector")
23 | .cflag("-march=native")
24 | .cflag("-fomit-frame-pointer")
25 | .cflag("-g")
26 | .build_symbol_table(false)
27 | .update_pc(false)
28 | .update_last_instruction(false)
29 | .enable_uninit_stack(false)
30 | .build()
31 | .unwrap();
32 | let mut runtime = compiler.compile(backend).unwrap();
33 |
34 | let start = std::time::Instant::now();
35 | match runtime.run() {
36 | Ok(EVENT_BREAKPOINT) => {},
37 | e => unreachable!("{:?}", e),
38 | }
39 | let secs = start.elapsed().as_secs_f64();
40 |
41 | println!("{} instr/s", runtime.get_executed_instructions() as f64 / secs);
42 | }
43 |
--------------------------------------------------------------------------------
/tests/benchmark/main.c:
--------------------------------------------------------------------------------
1 | #include
2 |
3 | #define MEM_SIZE (16 * 1024 * 1024)
4 | char data[MEM_SIZE];
5 |
6 | uint64_t state = 0x12345;
7 | static inline __attribute__((always_inline)) uint64_t rand (void) {
8 | uint64_t x = state;
9 | x ^= x << 13;
10 | x ^= x >> 7;
11 | x ^= x << 17;
12 | return state = x;
13 | }
14 |
15 | int main (void) {
16 | for (unsigned long i = 0; i < (1UL << 28); ++i) {
17 | uint64_t index = rand() % (MEM_SIZE - 8);
18 |
19 | switch (rand() % 4) {
20 | case 0: {
21 | uint8_t* p = (uint8_t*) &data[index];
22 | *p = (uint8_t) rand();
23 | break;
24 | }
25 |
26 | case 1: {
27 | uint16_t* p = (uint16_t*) &data[index];
28 | *p = (uint16_t) rand();
29 | break;
30 | }
31 |
32 | case 2: {
33 | uint32_t* p = (uint32_t*) &data[index];
34 | *p = (uint32_t) rand();
35 | break;
36 | }
37 |
38 | case 3: {
39 | uint64_t* p = (uint64_t*) &data[index];
40 | *p = (uint64_t) rand();
41 | break;
42 | }
43 |
44 | default: {
45 | __builtin_unreachable();
46 | }
47 | }
48 | }
49 |
50 | __builtin_trap();
51 | }
52 |
--------------------------------------------------------------------------------
/wiki/EVENTS.md:
--------------------------------------------------------------------------------
1 | # Events
2 |
3 | Events are a means of communication between the guest and the host and
4 | can be used to pass information to the harness and back.
5 | They can be thrown at any point in the code with the `FireEvent` IR instruction.
6 | Two events are built into `squid`. The syscall event that is caused by an ECALL instruction
7 | and the breakpoint event that is caused by an EBREAK instruction.
8 | You can also define custom events.
9 |
10 | ### Creating events
11 | Events can be created inside passes with the `EventPool`.
12 | Call `EventPool::add_event()` with the name of your custom event to get a unique event ID in return.
13 | This event ID can be used in the `FireEvent` instruction to throw your custom event.
14 |
15 | ### Handling events
16 | An event ID is the return value of the `Runtime::run` method that can be used to execute a target.
17 | The host must inspect that return value and handle it accordingly.
18 |
19 | ### Event channel
20 | Events have their own arguments and return values such that you can communicate more than just an event ID.
21 | The arguments and return values are placed into the "event channel", which is a buffer of a fixed size.
22 | Push data into the event channel before throwing an event, by using the `PushEventArgs` IR instruction.
23 | Then, when harness handles the event, it can access the arguments via the `Runtime::event_channel()` method.
24 | The harness can in turn place return values into the event channel after handling an event. This is done with
25 | the `Runtime::event_channel_mut()` method. The return values can be collected inside the guest with the `CollectEventReturns`
26 | IR instruction.
27 |
28 | ## Example
29 | The following example shows how to hook the `malloc()` function of the libc by throwing a custom `HANDLE_MALLOC` event
30 | and using the return value of the event as the return value of the function.
31 |
32 | ```rs
33 | use squid::*;
34 |
35 | struct MallocPass;
36 |
37 | impl Pass for MallocPass {
38 | fn run(&mut self, image: &mut ProcessImage, event_pool: &mut EventPool, logger: &Logger) -> Result<(), ()> {
39 | // Create a new event in the event pool
40 | let event_id = event_pool.add_event("HANDLE_MALLOC");
41 |
42 | // Search the malloc function
43 | let libc = image.elf_by_filename_mut("libc.so.6");
44 | for section in libc.iter_sections_mut() {
45 | for symbol in section.iter_symbols_mut() {
46 | if symbol.name("malloc").is_some() {
47 |
48 | // Get the CFG of the function
49 | let function = symbol.chunk_mut(1).content_mut();
50 | let cfg = function.cfg_mut();
51 |
52 | // This bb pushes the argument onto the event channel and throws the HANDLE_MALLOC event
53 | let mut bb1 = BasicBlock::new();
54 | let a0 = bb1.load_gp_register(GpRegister::a0);
55 | bb1.push_event_args([a0]);
56 | bb1.fire_event(event_id);
57 |
58 | // This bb collects the address from the harness and returns it
59 | let mut bb2 = BasicBlock::new();
60 | let rets = bb2.collect_event_returns(1);
61 | bb2.store_gp_register(GpRegister::a0, rets[0]);
62 | let ra = bb2.load_gp_register(GpRegister::ra);
63 | bb2.jump(ra);
64 |
65 | // Replace the malloc function with these two basic blocks
66 | cfg.clear();
67 | let bb2_id = cfg.add_basic_block(bb2);
68 | bb1.add_edge(Edge::Next(bb2_id));
69 | let bb1_id = cfg.add_basic_block(bb1);
70 | cfg.set_entry(bb1_id);
71 |
72 | // Now the malloc() function consists entirely of the two basic blocks from above and
73 | // the harness has full control over the allocation strategy.
74 | }
75 | }
76 | }
77 |
78 | Ok(())
79 | }
80 | }
81 | ```
82 |
83 |
--------------------------------------------------------------------------------
/wiki/PROCESS_IMAGE/README.md:
--------------------------------------------------------------------------------
1 | # Process Image
2 |
3 | The process image is a data structure that holds the code and data of ELF files.
4 | It is the result of a dynamic linking process where all dependencies are collected,
5 | allocatable sections are parsed, symbols are resolved, etc.
6 | The only difference to traditional dynamic linking is that a process image is a hierachical tree structure and not a linear memory image.
7 | This hierachical approach enables us to modify the ELF files' content without messing up its overall structure.
8 | Its primary purpose is to make manipulations of global variables and functions easy.
9 |
10 | Creating a process image is the first step in using `squid` and can be done with `Compiler::loader`:
11 | ```rs
12 | let mut compiler = Compiler::loader()
13 | // The binary that we want to emulate
14 | .binary("/path/to/binary")
15 | // Directories that contain the dependencies of the binary similar to LD_LIBRARY_PATH
16 | .search_path("/path/with/deps")
17 | // List of shared objects to preload similar to LD_PRELOAD
18 | .preload("/path/to/library.so")
19 | // Start the ELF-loading process
20 | .load()
21 | .expect("Loading binary failed");
22 | ```
23 |
24 | This produces a process image that looks something like this (excerpt, the full graph can be found [here](./symimg.svg)):
25 | 
26 |
27 | As you can see the process image is a tree.
28 | The root points to the loaded ELF files - in this case a "helloworld" executable and its dependency "libc.so.6".
29 | The children of ELF files are their allocatable sections (identified here by their permission bits "rwx").
30 | The children of sections are all ELF symbols that are inside those sections.
31 | For example, the symbol "main" is a child of the section "r-x" because the program has a `main()` function.
32 | The leafs of the process image are so-called "chunks" that hold the actual contents of a symbol.
33 | They tell us whether to interpret the stream of bytes as either code, data or pointers.
34 |
35 | One of the things you're gonna do most frequently with a process image is traversing it.
36 | This can be done like so:
37 | ```rs
38 | for elf in compiler.process_image().iter_elfs() {
39 | for section in elf.iter_sections() {
40 | for symbol in section.iter_symbols() {
41 | for chunk in symbol.iter_chunks() {
42 | match chunk.content() {
43 | ChunkContent::Code(code) => {
44 | // ...
45 | },
46 | ChunkContent::Data { content, perms } => {
47 | // ...
48 | },
49 | ChunkContent::Pointer(pointer) => {
50 | // ...
51 | },
52 | }
53 | }
54 | }
55 | }
56 | }
57 | ```
58 |
59 | You can also add new nodes, delete nodes or modify existing nodes.
60 | To add new nodes call their respective builder objects, e.g. `Elf::builder()` or
61 | `Section::builder()` and to insert the newly created nodes use the `insert_*`
62 | methods like `elf.insert_section(...)` or `section.insert_symbol(...)`.
63 | The following example demonstrates how to create an AFL-style coverage map and insert
64 | it into the process image.
65 |
66 | ```rs
67 | // This function will make it appear as if the AFL coverage map has been statically linked
68 | // into the application. It creates a new ELF file with a single symbol "coverage_map" that
69 | // holds the entire coverage map.
70 | // This way, we can access the map from the harness and from inside the guest.
71 | fn build_coverage_map(image: &mut ProcessImage, map_size: usize) {
72 | // The map will be readable and writable
73 | let mut perms = Perms::default();
74 | perms.make_readable();
75 | perms.make_writable();
76 |
77 | // The chunk holds the actual data and permission bits
78 | let chunk = Chunk::builder()
79 | .uninitialized_data(map_size, perms)
80 | .build()
81 | .unwrap();
82 |
83 | // Create a symbol named "coverage_map" that contains the chunk
84 | let mut symbol = Symbol::builder()
85 | .public_name("coverage_map")
86 | .size(map_size)
87 | .build()
88 | .unwrap();
89 |
90 | // Create a section that can hold the symbol
91 | let mut section = Section::builder()
92 | .perms(perms)
93 | .size(map_size)
94 | .build()
95 | .unwrap();
96 |
97 | // Finally, create the ELF file that contains the section
98 | let mut elf = Elf::builder()
99 | .path("")
100 | .build()
101 | .unwrap();
102 |
103 | // Chain all objects together
104 | symbol.insert_chunk(chunk);
105 | section.insert_symbol(symbol);
106 | elf.insert_section(section);
107 | image.insert_elf(elf);
108 | }
109 | ```
110 |
111 | ## Symbolization
112 | One key thing that has been left out so far is how `squid` handles code.
113 | Since the point of the process image is to manipulate binaries, we run into one particular problem.
114 | Whenever there are pointers to objects inside ELF files, they may become invalid when manipulating the ELF files' content.
115 | The way `squid` solves this problem is that it abstracts pointers with concrete values away to higher-level
116 | "symbolic pointers".
117 | A symbolic pointer also is a pointer but it points to a chunk in the process image instead of a memory location.
118 | You may have noticed that in the image above each node in the tree is prefixed with a number in square brackets.
119 | This is the ID of the element. Each child of each node gets a unique ID such that we can identify chunks with a
120 | 5-tuple of IDs: `(elf_id, section_id, symbol_id, chunk_id)`.
121 | For example, every concrete pointer to the `main()` function has the value `0x4c0` in the ELF file but gets replaced with `(1, 2, 5, 1)`
122 | in the process image.
123 |
124 | In order to do this symbolization technique, the RISC-V code has to be lifted into an IR that is specifically designed
125 | to make symbolization easy. This also means that when you want to modify functions, you have to
126 | do it on the higher-level IR instead of the raw RISC-V code.
127 |
--------------------------------------------------------------------------------
/wiki/PROCESS_IMAGE/symimg.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/fkie-cad/squid/a081a984f2d54362498f332496c93113858db514/wiki/PROCESS_IMAGE/symimg.png
--------------------------------------------------------------------------------
/wiki/README.md:
--------------------------------------------------------------------------------
1 | # Overview
2 |
3 | This page briefly introduces the most important aspects of `squid`.
4 | Since `squid` is a RISC-V emulator with AOT-compilation its usage can be divided into 3 phases:
5 |
6 | 1. Compiling the target to RISC-V
7 | 2. Doing the AOT compilation
8 | 1. Loading the binary and all its dependencies
9 | 2. Running passes to modify code or data
10 | 3. Compiling the code to the native ISA
11 | 3. Emulating the target by running the compiled code
12 |
13 | Each phase is explained in more detail below.
14 |
15 | ## Compiling the target
16 | Follow the instructions in [TOOLCHAIN](./TOOLCHAIN.md) to compile your target to RISC-V.
17 | Please note, that you also need to compile all of the targets dependencies to RISC-V.
18 |
19 | ## Loading the binary
20 | Once you have compiled the binary and all it's dependencies to RISC-V, the next step is to create the so-called "process image".
21 | The process image is the result of ELF-loading the fuzz target and lifting all functions into an IR.
22 | All dependencies of the program are collected, symbol imports are being resolved and all pointers are "symbolized" in
23 | a manner similar to [RetroWrite](https://github.com/HexHive/RetroWrite).
24 | This creates an in-memory data structure that makes all functions and global variables of the loaded ELF files available for
25 | inspection and modification. Because of the symbolization we can freely modify everything without having to worry about
26 | invalidating references or offsets.
27 |
28 | Load your binary like so:
29 | ```rs
30 | let mut compiler = Compiler::loader()
31 | // The binary that we want to emulate
32 | .binary("/path/to/binary")
33 | // Directories that contain the dependencies of the binary similar to LD_LIBRARY_PATH
34 | .search_path("/path/with/deps")
35 | // List of shared objects to preload similar to LD_PRELOAD
36 | .preload("/path/to/library.so")
37 | // Start the ELF-loading process
38 | .load()
39 | .expect("Loading binary failed");
40 | ```
41 |
42 | For more information about the process image, see [PROCESS\_IMAGE](./PROCESS_IMAGE/).
43 |
44 | ## Running Passes
45 | Once the process image has been created, we can run passes to modify functions or data.
46 | A pass in `squid` is anything that implements the `Pass` trait. Otherwise, it functions exactly
47 | like an LLVM pass.
48 |
49 | ```rs
50 | struct MyPass;
51 |
52 | impl Pass for MyPass {
53 | fn name(&self) -> String {
54 | // return the name of this pass here
55 | }
56 |
57 | fn run(&mut self, image: &mut ProcessImage, event_pool: &mut EventPool, logger: &Logger) -> Result<(), String> {
58 | // modify functions or data in the process image here
59 | }
60 | }
61 |
62 | // Run the pass with the compiler
63 | compiler.run_pass(&mut MyPass {}).expect("Pass had an error");
64 | ```
65 |
66 | ## Creating a Runtime
67 | The final step before emulation is to AOT-compile all functions to the host ISA.
68 | This is the responsibility of a "backend".
69 | The backend receives a process image and produces a "runtime" that interfaces with the target program.
70 | In a similar manner like before, a backend is anything that implements the `Backend` trait and a runtime
71 | is anything that implements the `Runtime` trait.
72 |
73 | Currently, `squid` comes with the `ClangBackend` and the `ClangRuntime`:
74 | ```rs
75 | // Create the backend responsible for compilation
76 | let backend = ClangBackend::builder()
77 | .stack_size(1 * 1024 * 1024) // Size of the stack region
78 | .progname("my-fuzz-target") // argv[0]
79 | .arg("--with-bugs-pls") // argv[1]
80 | .build()
81 | .expect("Could not configure backend");
82 |
83 | // Start AOT-compilation with the given backend and get a runtime in return
84 | let runtime = compiler.compile(backend).expect("Backend had an error");
85 | ```
86 |
87 | ## Running the target
88 | Once we have obtained the runtime, we can start interacting with the program.
89 | The runtime gives us access to registers, memory, lets us create/restore snapshots,
90 | and of course run our target with the `Runtime::run` method.
91 | Running the target will throw certain events like system calls that
92 | must be handled by the harness.
93 | It is also possible to throw custom events that can be created inside passes.
94 | For more on that see [EVENTS](./EVENTS.md).
95 |
96 | Run the target like so:
97 | ```rs
98 | loop {
99 | match runtime.run() {
100 | Ok(event) => match event {
101 | EVENT_SYSCALL => {
102 | // Handle syscall
103 | },
104 | CUSTOM_EVENT => {
105 | // Handle custom events from passes
106 | },
107 | },
108 | Err(fault) => {
109 | // a fault (e.g. segfault) happened
110 | break;
111 | }
112 | }
113 | }
114 | ```
115 |
116 |
--------------------------------------------------------------------------------
/wiki/TOOLCHAIN.md:
--------------------------------------------------------------------------------
1 | # Toolchain
2 |
3 | `squid` is a RISC-V emulator, so you have to compile every target you want to fuzz to RISC-V.
4 | This can be done in the docker container that comes with `squid` and provides you with a RISC-V gcc toolchain.
5 |
6 | You can either build the toolchain from scratch:
7 | ```
8 | docker pull rust:latest
9 | docker pull archlinux:latest
10 | docker build -t squid-toolchain --build-arg="jobs=$(nproc)" .
11 | ```
12 |
13 | Or you can download a pre-built image from docker hub (900MB):
14 | ```
15 | docker pull pdfkie/squid-toolchain:1.0.0
16 | ```
17 |
18 | Inside the container, you can find the cross-compiler at `/riscv/bin/riscv64-unknown-linux-gnu-gcc` and the sysroot at
19 | `/riscv/sysroot/`.
20 |
21 | Please note that `squid` has certain requirements for the binaries it can emulate.
22 | The binaries __must__ be compiled with the flags
23 | ```
24 | -fPIE -pie -O0 -g -fno-jump-tables -mno-relax -D__thread=
25 | ```
26 | and must not use thread-local storage, otherwise they won't work with `squid`.
27 |
28 | If your target makes use of the C extension that enables `goto*` statements and references to labels,
29 | use `/ewe/gcc` instead of `riscv64-unknown-linux-gnu-gcc`.
30 | This tool is a compiler wrapper that collects certain metadata about the code and is necessary to
31 | correctly reconstruct CFG's. It produces an `.ewe` file alongside your binary that contains said metadata.
32 | For more information on this see the documentation of [ewe](../ewe).
33 |
34 |
--------------------------------------------------------------------------------