Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Explicitly pass the size of the requested arguments #188

Merged
merged 9 commits into from
Dec 2, 2023
Merged

Explicitly pass the size of the requested arguments #188

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
def27ff
explicitly pass the size of the requested arguments
1ndahous3 Nov 4, 2023
6675ea5
fix ci
0vercl0k Nov 26, 2023
2c21c9b
Revert "explicitly pass the size of the requested arguments"
0vercl0k Nov 26, 2023
806fc39
fix ioctl fuzzer
0vercl0k Nov 26, 2023
b9fdc43
32->4 for more consistency
0vercl0k Nov 26, 2023
fecc1d7
getarg8
0vercl0k Nov 27, 2023
675b085
more touchups
0vercl0k Nov 27, 2023
3ad20c8
fix bcode
0vercl0k Nov 29, 2023
df06e91
deprecate GetArg
0vercl0k Dec 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/wtf.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,8 +105,8 @@ jobs:
- name: Build with clang
if: matrix.compiler == 'clang'
env:
CC: clang-16
CXX: clang++-16
CC: clang-17
CXX: clang++-17
run: |
cd src/build
chmod u+x ./build-release.sh
Expand Down
18 changes: 14 additions & 4 deletions src/wtf/backend.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,16 +191,26 @@ uint64_t Backend_t::GetArg(const uint64_t Idx) {
}
}

Gva_t Backend_t::GetArgGva(const uint64_t Idx) { return Gva_t(GetArg(Idx)); }
uint64_t Backend_t::GetArg8(const uint64_t Idx) { return GetArg(Idx); }

std::pair<uint64_t, Gva_t> Backend_t::GetArgAndAddress(const uint64_t Idx) {
return {GetArg(Idx), GetArgAddress(Idx)};
uint32_t Backend_t::GetArg4(const uint64_t Idx) {
return uint32_t(GetArg8(Idx));
}

std::pair<Gva_t, Gva_t> Backend_t::GetArgAndAddressGva(const uint64_t Idx) {
Gva_t Backend_t::GetArgGva(const uint64_t Idx) { return Gva_t(GetArg8(Idx)); }

std::pair<Gva_t, Gva_t> Backend_t::GetArgGvaAndAddress(const uint64_t Idx) {
return {GetArgGva(Idx), GetArgAddress(Idx)};
}

std::pair<uint64_t, Gva_t> Backend_t::GetArg8AndAddress(const uint64_t Idx) {
return {GetArg8(Idx), GetArgAddress(Idx)};
}

std::pair<uint32_t, Gva_t> Backend_t::GetArg4AndAddress(const uint64_t Idx) {
return {GetArg4(Idx), GetArgAddress(Idx)};
}

bool Backend_t::SaveCrash(const Gva_t ExceptionAddress,
const uint32_t ExceptionCode) {
const auto ExceptionCodeStr = ExceptionCodeToStr(ExceptionCode);
Expand Down
13 changes: 9 additions & 4 deletions src/wtf/backend.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -489,7 +489,10 @@ class Backend_t {
// calling convention.
//

[[nodiscard]] uint64_t GetArg(const uint64_t Idx);
[[nodiscard]] [[deprecated("Use GetArg4/GetArg8 instead.")]] uint64_t
GetArg(const uint64_t Idx);
[[nodiscard]] uint64_t GetArg8(const uint64_t Idx);
[[nodiscard]] uint32_t GetArg4(const uint64_t Idx);
[[nodiscard]] Gva_t GetArgGva(const uint64_t Idx);

//
Expand All @@ -500,9 +503,11 @@ class Backend_t {
//

[[nodiscard]] Gva_t GetArgAddress(const uint64_t Idx);
[[nodiscard]] std::pair<uint64_t, Gva_t> GetArgAndAddress(const uint64_t Idx);
[[nodiscard]] std::pair<Gva_t, Gva_t> GetArgAndAddressGva(const uint64_t Idx);

[[nodiscard]] std::pair<uint64_t, Gva_t>
GetArg8AndAddress(const uint64_t Idx);
[[nodiscard]] std::pair<uint32_t, Gva_t>
GetArg4AndAddress(const uint64_t Idx);
[[nodiscard]] std::pair<Gva_t, Gva_t> GetArgGvaAndAddress(const uint64_t Idx);

//
// Shortcuts to grab / set some registers.
Expand Down
68 changes: 34 additions & 34 deletions src/wtf/fshooks.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ bool SetupFilesystemHooks() {
//__kernel_entry NTSTATUS NtClose(
// IN HANDLE Handle
//);
const HANDLE Handle = HANDLE(Backend->GetArg(0));
const auto Handle = HANDLE(Backend->GetArg8(0));

FsDebugPrint("ntdll!NtClose(Handle={})\n", fmt::ptr(Handle));

Expand Down Expand Up @@ -240,16 +240,16 @@ bool SetupFilesystemHooks() {
// IN ULONG EaLength
//);
const Gva_t GuestFileHandle = Backend->GetArgGva(0);
const uint32_t DesiredAccess = uint32_t(Backend->GetArg(1));
const uint32_t DesiredAccess = Backend->GetArg4(1);
const Gva_t GuestObjectAttributes = Backend->GetArgGva(2);
const Gva_t GuestIoStatusBlock = Backend->GetArgGva(3);
const uint64_t GuestAllocationSize = Backend->GetArg(4);
const uint32_t FileAttributes = uint32_t(Backend->GetArg(5));
const uint32_t ShareAccess = uint32_t(Backend->GetArg(6));
const uint32_t CreateDisposition = uint32_t(Backend->GetArg(7));
const uint32_t CreateOptions = uint32_t(Backend->GetArg(8));
const uint64_t EaBuffer = Backend->GetArg(9);
const uint32_t EaLength = uint32_t(Backend->GetArg(10));
const uint64_t GuestAllocationSize = Backend->GetArg8(4);
const uint32_t FileAttributes = Backend->GetArg4(5);
const uint32_t ShareAccess = Backend->GetArg4(6);
const uint32_t CreateDisposition = Backend->GetArg4(7);
const uint32_t CreateOptions = Backend->GetArg4(8);
const uint64_t EaBuffer = Backend->GetArg8(9);
const uint32_t EaLength = Backend->GetArg4(10);

HostObjectAttributes_t HostObjectAttributes;
if (!HostObjectAttributes.ReadFromGuest(Backend,
Expand Down Expand Up @@ -378,11 +378,11 @@ bool SetupFilesystemHooks() {
// IN ULONG OpenOptions
//);
const Gva_t GuestFileHandle = Backend->GetArgGva(0);
const uint32_t DesiredAccess = uint32_t(Backend->GetArg(1));
const uint32_t DesiredAccess = Backend->GetArg4(1);
const Gva_t GuestObjectAttributes = Backend->GetArgGva(2);
const Gva_t GuestIoStatusBlock = Backend->GetArgGva(3);
const uint32_t ShareAccess = uint32_t(Backend->GetArg(4));
const uint32_t OpenOptions = uint32_t(Backend->GetArg(5));
const uint32_t ShareAccess = Backend->GetArg4(4);
const uint32_t OpenOptions = Backend->GetArg4(5);

HostObjectAttributes_t HostObjectAttributes;
if (!HostObjectAttributes.ReadFromGuest(Backend,
Expand Down Expand Up @@ -459,12 +459,12 @@ bool SetupFilesystemHooks() {
// ULONG Length,
// FS_INFORMATION_CLASS FsInformationClass
//);
const HANDLE FileHandle = HANDLE(Backend->GetArg(0));
const auto FileHandle = HANDLE(Backend->GetArg8(0));
const Gva_t GuestIoStatusBlock = Backend->GetArgGva(1);
const Gva_t GuestFsInformation = Backend->GetArgGva(2);
const uint32_t Length = uint32_t(Backend->GetArg(3));
const uint32_t Length = Backend->GetArg4(3);
const FS_INFORMATION_CLASS FsInformationClass =
FS_INFORMATION_CLASS(Backend->GetArg(4));
FS_INFORMATION_CLASS(Backend->GetArg8(4));

FsDebugPrint("ntdll!NtQueryVolumeInformationFile(FileHandle={}, "
"IoStatusBlock={:#x}, "
Expand Down Expand Up @@ -556,12 +556,12 @@ bool SetupFilesystemHooks() {
// ULONG Length,
// FILE_INFORMATION_CLASS FileInformationClass
//);
const HANDLE FileHandle = HANDLE(Backend->GetArg(0));
const auto FileHandle = HANDLE(Backend->GetArg8(0));
const Gva_t GuestIoStatusBlock = Backend->GetArgGva(1);
const Gva_t GuestFileInformation = Backend->GetArgGva(2);
const uint32_t Length = uint32_t(Backend->GetArg(3));
const uint32_t Length = Backend->GetArg4(3);
const FILE_INFORMATION_CLASS FileInformationClass =
FILE_INFORMATION_CLASS(Backend->GetArg(4));
FILE_INFORMATION_CLASS(Backend->GetArg8(4));

FsDebugPrint("ntdll!NtQueryInformationFile(FileHandle={}, "
"IoStatusBlock={:#x}, "
Expand Down Expand Up @@ -645,12 +645,12 @@ bool SetupFilesystemHooks() {
// ULONG Length,
// FILE_INFORMATION_CLASS FileInformationClass
//);
const HANDLE FileHandle = HANDLE(Backend->GetArg(0));
const auto FileHandle = HANDLE(Backend->GetArg8(0));
const Gva_t GuestIoStatusBlock = Backend->GetArgGva(1);
const Gva_t GuestFileInformation = Backend->GetArgGva(2);
const uint32_t Length = uint32_t(Backend->GetArg(3));
const uint32_t Length = Backend->GetArg4(3);
const FILE_INFORMATION_CLASS FileInformationClass =
FILE_INFORMATION_CLASS(Backend->GetArg(4));
FILE_INFORMATION_CLASS(Backend->GetArg8(4));

FsDebugPrint("ntdll!NtSetInformationFile(FileHandle={}, "
"IoStatusBlock={:#x}, "
Expand Down Expand Up @@ -736,15 +736,15 @@ bool SetupFilesystemHooks() {
// PLARGE_INTEGER ByteOffset,
// PULONG Key
//);
const HANDLE FileHandle = HANDLE(Backend->GetArg(0));
const uint64_t Event = Backend->GetArg(1);
const uint64_t ApcRoutine = Backend->GetArg(2);
const uint64_t ApcContext = Backend->GetArg(3);
const auto FileHandle = HANDLE(Backend->GetArg8(0));
const uint64_t Event = Backend->GetArg8(1);
const uint64_t ApcRoutine = Backend->GetArg8(2);
const uint64_t ApcContext = Backend->GetArg8(3);
const Gva_t GuestIoStatusBlock = Backend->GetArgGva(4);
const Gva_t GuestBuffer = Backend->GetArgGva(5);
const uint32_t Length = uint32_t(Backend->GetArg(6));
const uint64_t GuestByteOffset = Backend->GetArg(7);
const uint64_t Key = Backend->GetArg(8);
const uint32_t Length = Backend->GetArg4(6);
const uint64_t GuestByteOffset = Backend->GetArg8(7);
const uint64_t Key = Backend->GetArg8(8);

FsDebugPrint(
"nt!NtWriteFile(FileHandle={}, Event={:#x}, ApcRoutine={:#x}, "
Expand Down Expand Up @@ -825,15 +825,15 @@ bool SetupFilesystemHooks() {
// _In_opt_ PLARGE_INTEGER ByteOffset,
// _In_opt_ PULONG Key
//);
const HANDLE FileHandle = HANDLE(Backend->GetArg(0));
const uint64_t Event = Backend->GetArg(1);
const uint64_t ApcRoutine = Backend->GetArg(2);
const uint64_t ApcContext = Backend->GetArg(3);
const auto FileHandle = HANDLE(Backend->GetArg8(0));
const uint64_t Event = Backend->GetArg8(1);
const uint64_t ApcRoutine = Backend->GetArg8(2);
const uint64_t ApcContext = Backend->GetArg8(3);
const Gva_t GuestIoStatusBlock = Backend->GetArgGva(4);
const Gva_t GuestBuffer = Backend->GetArgGva(5);
const uint32_t Length = uint32_t(Backend->GetArg(6));
const uint32_t Length = Backend->GetArg4(6);
const Gva_t GuestByteOffset = Backend->GetArgGva(7);
const uint64_t Key = Backend->GetArg(8);
const uint64_t Key = Backend->GetArg8(8);

FsDebugPrint(
"nt!NtReadFile(FileHandle={}, Event={:#x}, ApcRoutine={:#x}, "
Expand Down
12 changes: 6 additions & 6 deletions src/wtf/fuzzer_hevd.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,12 +112,12 @@ bool Init(const Options_t &Opts, const CpuState_t &) {
//

if (!g_Backend->SetBreakpoint("nt!KeBugCheck2", [](Backend_t *Backend) {
const uint64_t BCode = Backend->GetArg(0);
const uint64_t B0 = Backend->GetArg(1);
const uint64_t B1 = Backend->GetArg(2);
const uint64_t B2 = Backend->GetArg(3);
const uint64_t B3 = Backend->GetArg(4);
const uint64_t B4 = Backend->GetArg(5);
const uint32_t BCode = Backend->GetArg4(0);
const uint64_t B0 = Backend->GetArg8(1);
const uint64_t B1 = Backend->GetArg8(2);
const uint64_t B2 = Backend->GetArg8(3);
const uint64_t B3 = Backend->GetArg8(4);
const uint64_t B4 = Backend->GetArg8(5);
const std::string Filename =
fmt::format("crash-{:#x}-{:#x}-{:#x}-{:#x}-{:#x}-{:#x}", BCode, B0,
B1, B2, B3, B4);
Expand Down
18 changes: 9 additions & 9 deletions src/wtf/fuzzer_ioctl.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,16 +75,16 @@ bool InsertTestcase(const uint8_t *Buffer, const size_t BufferSize) {
//

const auto &[InputBufferSize, InputBufferSizePtr] =
g_Backend->GetArgAndAddress(7);
g_Backend->GetArg4AndAddress(7);
const uint32_t MutatedInputBufferSize =
std::min(TotalInputBufferSize, uint32_t(InputBufferSize));
std::min(TotalInputBufferSize, InputBufferSize);

//
// Calculate the new InputBuffer address by pushing the mutated buffer as
// close as possible from its end.
//

const auto &[InputBuffer, InputBufferPtr] = g_Backend->GetArgAndAddress(6);
const auto &[InputBuffer, InputBufferPtr] = g_Backend->GetArg8AndAddress(6);
const auto NewInputBuffer =
Gva_t(InputBuffer + InputBufferSize - MutatedInputBufferSize);

Expand Down Expand Up @@ -212,12 +212,12 @@ bool Init(const Options_t &Opts, const CpuState_t &) {
//

if (!g_Backend->SetBreakpoint("nt!KeBugCheck2", [](Backend_t *Backend) {
const uint64_t BCode = Backend->GetArg(0);
const uint64_t B0 = Backend->GetArg(1);
const uint64_t B1 = Backend->GetArg(2);
const uint64_t B2 = Backend->GetArg(3);
const uint64_t B3 = Backend->GetArg(4);
const uint64_t B4 = Backend->GetArg(5);
const uint32_t BCode = Backend->GetArg4(0);
const uint64_t B0 = Backend->GetArg8(1);
const uint64_t B1 = Backend->GetArg8(2);
const uint64_t B2 = Backend->GetArg8(3);
const uint64_t B3 = Backend->GetArg8(4);
const uint64_t B4 = Backend->GetArg8(5);
const std::string Filename =
fmt::format("crash-{:#x}-{:#x}-{:#x}-{:#x}-{:#x}-{:#x}", BCode, B0,
B1, B2, B3, B4);
Expand Down