Message ID | 20190612153600.13073-4-samcacc@amazon.de (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | x86 instruction emulator fuzzing | expand |
On 12.06.19 17:35, Sam Caccavale wrote: > Simple-harness.c uses inline asm support to generate asm and then has the > emulator emulate this code. This may be useful as a form of testing for > the emulator. > > CR: https://code.amazon.com/reviews/CR-8591638 > --- > tools/fuzz/x86ie/Makefile | 7 ++++-- > tools/fuzz/x86ie/simple-harness.c | 42 +++++++++++++++++++++++++++++++ > 2 files changed, 47 insertions(+), 2 deletions(-) > create mode 100644 tools/fuzz/x86ie/simple-harness.c > > diff --git a/tools/fuzz/x86ie/Makefile b/tools/fuzz/x86ie/Makefile > index d45fe6d266b9..e79d275e1040 100644 > --- a/tools/fuzz/x86ie/Makefile > +++ b/tools/fuzz/x86ie/Makefile > @@ -44,8 +44,11 @@ LOCAL_OBJS := emulator_ops.o stubs.o > afl-harness: afl-harness.o $(LOCAL_OBJS) $(KERNEL_OBJS) > @$(CC) -v $(KBUILD_CFLAGS) $(LOCAL_OBJS) $(KERNEL_OBJS) $< $(INCLUDES) -Istubs.h -o $@ -no-pie > > -all: afl-harness > +simple-harness: simple-harness.o $(LOCAL_OBJS) $(KERNEL_OBJS) > + @$(CC) -v $(KBUILD_CFLAGS) $(LOCAL_OBJS) $(KERNEL_OBJS) $< $(INCLUDES) -Istubs.h -o $@ -no-pie > + > +all: afl-harness simple-harness > > .PHONY: clean > clean: > - $(RM) -r *.o afl-harness > + $(RM) -r *.o afl-harness simple-harness > diff --git a/tools/fuzz/x86ie/simple-harness.c b/tools/fuzz/x86ie/simple-harness.c > new file mode 100644 > index 000000000000..f21fdafe1dd1 > --- /dev/null > +++ b/tools/fuzz/x86ie/simple-harness.c > @@ -0,0 +1,42 @@ > +// SPDX-License-Identifier: GPL-2.0 > + > +#include <assert.h> > +#include <stdint.h> > +#include <stdio.h> > +#include <string.h> > +#include "emulator_ops.h" > +#include <asm/kvm_emulate.h> > + > +extern void foo(void) > +{ > + asm volatile("__start:" > + ".byte 0x32, 0x05, 0x00, 0x00, 0x00, 0x00;" // xor eax,DWORD PTR [rip+0x0] > + ".byte 0x90;" > + //".byte 0x0f, 0x7f, 0xde;" // movq mm6,mm3 Why? Alex
diff --git a/tools/fuzz/x86ie/Makefile b/tools/fuzz/x86ie/Makefile index d45fe6d266b9..e79d275e1040 100644 --- a/tools/fuzz/x86ie/Makefile +++ b/tools/fuzz/x86ie/Makefile @@ -44,8 +44,11 @@ LOCAL_OBJS := emulator_ops.o stubs.o afl-harness: afl-harness.o $(LOCAL_OBJS) $(KERNEL_OBJS) @$(CC) -v $(KBUILD_CFLAGS) $(LOCAL_OBJS) $(KERNEL_OBJS) $< $(INCLUDES) -Istubs.h -o $@ -no-pie -all: afl-harness +simple-harness: simple-harness.o $(LOCAL_OBJS) $(KERNEL_OBJS) + @$(CC) -v $(KBUILD_CFLAGS) $(LOCAL_OBJS) $(KERNEL_OBJS) $< $(INCLUDES) -Istubs.h -o $@ -no-pie + +all: afl-harness simple-harness .PHONY: clean clean: - $(RM) -r *.o afl-harness + $(RM) -r *.o afl-harness simple-harness diff --git a/tools/fuzz/x86ie/simple-harness.c b/tools/fuzz/x86ie/simple-harness.c new file mode 100644 index 000000000000..f21fdafe1dd1 --- /dev/null +++ b/tools/fuzz/x86ie/simple-harness.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <assert.h> +#include <stdint.h> +#include <stdio.h> +#include <string.h> +#include "emulator_ops.h" +#include <asm/kvm_emulate.h> + +extern void foo(void) +{ + asm volatile("__start:" + ".byte 0x32, 0x05, 0x00, 0x00, 0x00, 0x00;" // xor eax,DWORD PTR [rip+0x0] + ".byte 0x90;" + //".byte 0x0f, 0x7f, 0xde;" // movq mm6,mm3 + ".byte 0x0f, 0x6f, 0xde;" // same instruction... + ".byte 0x90;" + "__end:"); +} + +int main(int argc, char **argv) +{ + extern unsigned char __start; + extern unsigned char __end; + struct state *state = create_emulator(); + int rc; + + /* Ensures the emulator is in a valid state. */ + initialize_emulator(state); + + /* Provide the emulator with instructions to emulate. */ + state->data = &__start; + state->data_available = &__end - &__start; + + /* rip addressed instruction */ + rc = emulate_until_complete(state); + + /* Free the emulator. */ + free_emulator(state); + + return 0; +}