arch_manager.hpp

Go to the documentation of this file.

#ifndef ARION_ARCH_MANAGER_HPP
#define ARION_ARCH_MANAGER_HPP
 
#include <arion/capstone/capstone.h>
#include <arion/common/global_defs.hpp>
#include <arion/common/global_excepts.hpp>
#include <arion/keystone/keystone.h>
#include <arion/unicorn/unicorn.h>
#include <arion/unicorn/x86.h>
#include <cstdint>
#include <map>
#include <memory>
#include <string>
#include <vector>
 
#define ARION_VVAR_PRESENT (1 << 0)
#define ARION_VDSO_PRESENT (1 << 1)
#define ARION_VSYSCALL_PRESENT (1 << 2)
#define ARION_ARM_TRAPS_PRESENT (1 << 3)
 
#define ARION_VSYSCALL_ENTRY_SZ 1024
 
namespace arion
{
using KERNEL_SEG_FLAGS = uint8_t;
 
class Arion;
 
struct ARION_EXPORT ABI_REGISTERS
{
    REG pc;
    REG sp;
    ABI_REGISTERS(REG pc, REG sp) : pc(pc), sp(sp) {};
};
 
struct ARION_EXPORT ABI_CALLING_CONVENTION
{
    REG ret_reg;
    std::vector<REG> param_regs;
    /*
     * Builder for ABI_CALLING_CONVENTION instances.
     * @param[in] ret_reg Unicorn register handling the call return value.
     * @param[in] param_regs Unicorn registers handling the call parameters.
     */
    ABI_CALLING_CONVENTION(REG ret_reg, std::vector<REG> param_regs)
        : ret_reg(ret_reg), param_regs(std::move(param_regs)) {};
};
 
struct ARION_EXPORT ABI_SYSCALLING_CONVENTION
{
    REG sysno_reg;
    REG ret_reg;
    std::vector<REG> sys_param_regs;
    ABI_SYSCALLING_CONVENTION(REG sysno_reg, REG ret_reg, std::vector<REG> sys_param_regs)
        : sysno_reg(sysno_reg), ret_reg(ret_reg), sys_param_regs(std::move(sys_param_regs)) {};
};
 
struct ARION_EXPORT ARCH_ATTRIBUTES
{
    CPU_ARCH arch;
    uint16_t arch_sz;
    size_t ptr_sz;
    uint32_t hwcap;
    uint32_t hwcap2;
    KERNEL_SEG_FLAGS seg_flags;
    ABI_REGISTERS regs;
    ABI_CALLING_CONVENTION calling_conv;
    ABI_SYSCALLING_CONVENTION syscalling_conv;
    std::map<uint64_t, std::string> name_by_syscall_no;
    ARCH_ATTRIBUTES(CPU_ARCH arch, uint16_t arch_sz, size_t ptr_sz, uint32_t hwcap, uint32_t hwcap2,
                    KERNEL_SEG_FLAGS seg_flags, ABI_REGISTERS regs, ABI_CALLING_CONVENTION calling_conv,
                    ABI_SYSCALLING_CONVENTION syscalling_conv, std::map<uint64_t, std::string> &name_by_syscall_no)
        : arch(arch), arch_sz(arch_sz), ptr_sz(ptr_sz), seg_flags(seg_flags), hwcap(hwcap), hwcap2(hwcap2), regs(regs),
          calling_conv(calling_conv), syscalling_conv(syscalling_conv), name_by_syscall_no(name_by_syscall_no) {};
};
 
enum ARION_EXPORT CPU_INTR
{
    // x86 interrupts
    DIVIDE_ERROR,                 
    DEBUG_EXCEPTION,              
    NON_MASKABLE_INTR,            
    BREAKPOINT,                   
    OVERFLOW,                     
    BOUND_RANGE_EXCEEDED,         
    INVALID_OPCODE,               
    DEVICE_NOT_AVAILABLE,         
    DOUBLE_FAULT,                 
    COPROCESSOR_SEGMENT_OVERRUN,  
    INVALID_TSS,                  
    SEGMENT_NOT_PRESENT,          
    STACK_SEGMENT_FAULT,          
    GENERAL_PROTECTION_FAULT,     
    PAGE_FAULT,                   
    RESERVED,                     
    X87_FLOATING_POINT_EXCEPTION, 
    ALIGNMENT_CHECK,              
    MACHINE_CHECK,                
    SIMD_FLOATING_POINT_ERROR,    
 
    // ARM interrupts
    UDEF, 
    // SWI
    PREFETCH_ABORT, 
    DATA_ABORT,     
    IRQ,            
    FIQ,            
    BKPT,           
    EXCEPTION_EXIT, 
    KERNEL_TRAP,    
    HVC,            
    HYP_TRAP,       
    SMC,            
    VIRQ,           
    VFIQ,           
    SEMIHOST,       
    NOCP,           
    INVSTATE,       
    STKOF,          
    LAZYFP,         
    LSERR,          
    UNALIGNED       
};
 
class ARION_EXPORT ArchManager
{
  private:
    static std::map<CPU_INTR, int> signo_by_intr;
 
  protected:
    std::weak_ptr<Arion> arion;
    uc_engine *uc;
    std::vector<ks_engine *> ks;
    std::vector<csh *> cs;
    std::shared_ptr<ARCH_ATTRIBUTES> attrs;
    std::map<std::string, REG> arch_regs;
    std::map<REG, uint8_t> arch_regs_sz;
    std::vector<REG> ctxt_regs;
    std::map<uint64_t, CPU_INTR> cpu_idt;
    bool hooks_intr;
    ArchManager(std::shared_ptr<ARCH_ATTRIBUTES> attrs, std::map<std::string, REG> arch_regs,
                std::map<REG, uint8_t> arch_regs_sz, std::vector<REG> ctxt_regs, std::map<uint64_t, CPU_INTR> cpu_idt,
                bool hooks_intr)
        : attrs(attrs), arch_regs(arch_regs), arch_regs_sz(arch_regs_sz), ctxt_regs(ctxt_regs), cpu_idt(cpu_idt),
          hooks_intr(hooks_intr) {};
 
  public:
    /*
     * Destructor for ArchManager instances.
     */
    virtual ~ArchManager() = default;
    static std::unique_ptr<ArchManager> initialize(std::weak_ptr<Arion> arion, CPU_ARCH arch,
                                                   PLATFORM platform = PLATFORM::UNKNOWN_PLATFORM);
    static int get_signal_from_intr(CPU_INTR intr);
    std::shared_ptr<ARCH_ATTRIBUTES> ARION_EXPORT get_attrs();
    bool does_hook_intr();
    std::string ARION_EXPORT get_name_by_syscall_no(uint64_t syscall_no);
    bool ARION_EXPORT has_syscall_with_name(std::string name);
    uint64_t ARION_EXPORT get_syscall_no_by_name(std::string name);
    std::vector<REG> ARION_EXPORT get_context_regs();
    std::unique_ptr<std::map<REG, RVAL>> ARION_EXPORT dump_regs();
    void ARION_EXPORT load_regs(std::unique_ptr<std::map<REG, RVAL>> regs);
    bool ARION_EXPORT has_idt_entry(uint64_t intno);
    CPU_INTR ARION_EXPORT get_idt_entry(uint64_t intno);
    std::unique_ptr<std::map<REG, RVAL>> init_thread_regs(ADDR pc, ADDR sp);
    virtual ks_engine ARION_EXPORT *curr_ks() = 0;
    virtual csh ARION_EXPORT *curr_cs() = 0;
    virtual void setup() = 0;
    virtual ADDR ARION_EXPORT dump_tls() = 0;
    virtual void ARION_EXPORT load_tls(ADDR new_tls) = 0;
    virtual void prerun_hook(ADDR &start) {};
    template <typename T> T ARION_EXPORT read_reg(REG reg)
    {
        auto reg_sz_it = this->arch_regs_sz.find(reg);
        if (reg_sz_it == this->arch_regs_sz.end())
            throw arion_exception::NoRegWithValueException(reg);
        if (sizeof(T) < reg_sz_it->second)
            throw arion_exception::HeavierRegException(reg_sz_it->second, sizeof(T));
        T val;
        uc_err uc_reg_err = uc_reg_read(this->uc, reg, &val);
        if (uc_reg_err != UC_ERR_OK)
            throw arion_exception::UnicornRegReadException(uc_reg_err);
        return val;
    }
    template <typename T> T ARION_EXPORT read_reg(std::string reg_name)
    {
        reg_name = str_to_uppercase(reg_name);
        auto reg_it = this->arch_regs.find(reg_name);
        if (reg_it == this->arch_regs.end())
            throw arion_exception::NoRegWithNameException(reg_name);
        return this->read_reg<T>(reg_it->second);
    }
    uint64_t read_arch_reg(REG reg);
    template <typename T> void ARION_EXPORT write_reg(REG reg, T val)
    {
        auto reg_sz_it = this->arch_regs_sz.find(reg);
        if (reg_sz_it == this->arch_regs_sz.end())
            throw arion_exception::NoRegWithValueException(reg);
        if (sizeof(T) < reg_sz_it->second)
            throw arion_exception::HeavierRegException(reg_sz_it->second, sizeof(T));
        uc_err uc_reg_err = uc_reg_write(this->uc, reg, &val);
        if (uc_reg_err != UC_ERR_OK)
            throw arion_exception::UnicornRegWriteException(uc_reg_err);
    }
    template <typename T> void ARION_EXPORT write_reg(std::string reg_name, T val)
    {
        reg_name = str_to_uppercase(reg_name);
        auto reg_it = this->arch_regs.find(reg_name);
        if (reg_it == this->arch_regs.end())
            throw arion_exception::NoRegWithNameException(reg_name);
        this->write_reg(reg_it->second, val);
    }
    void write_arch_reg(REG reg, uint64_t val);
};
 
}; // namespace arion
 
#endif // ARION_ARCH_MANAGER_HPP