mirrors/unicorn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fxsave / fxsave64 should store the floating point instruction pointer (fpip) (#1467)

Browse Source 
* fxsave / fxsave64 should store the floating point instruction pointer (fpip)
- fxsave / fxsave64 happen to be used as GetPC code in exploits

* unit tests for the storage of FPIP in fxsave (x86) and fxsave64 (x64)
This commit is contained in:
Dimitris Glynos 2021-12-13 02:40:32 +02:00 committed by GitHub
parent 017c82e561
commit 63a445cbba
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 121 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
qemu/target-i386/fpu_helper.c
View File

@ -1127,12 +1127,12 @@ void helper_fxsave(CPUX86State *env, target_ulong ptr, int data64)
cpu_stw_data(env, ptr + 4, fptag ^ 0xff);
#ifdef TARGET_X86_64
if (data64) {
cpu_stq_data(env, ptr + 0x08, 0); /* rip */
cpu_stq_data(env, ptr + 0x08, env->fpip); /* rip */
cpu_stq_data(env, ptr + 0x10, 0); /* rdp */
} else
#endif
{
cpu_stl_data(env, ptr + 0x08, 0); /* eip */
cpu_stl_data(env, ptr + 0x08, (uint32_t) env->fpip); /* eip */
cpu_stl_data(env, ptr + 0x0c, 0); /* sel */
cpu_stl_data(env, ptr + 0x10, 0); /* dp */
cpu_stl_data(env, ptr + 0x14, 0); /* sel */

1
tests/unit/Makefile
View File

@ -58,6 +58,7 @@ test: all
${EXECUTE_VARS} ./test_multihook
${EXECUTE_VARS} ./test_pc_change
${EXECUTE_VARS} ./test_hookcounts
${EXECUTE_VARS} ./test_x86_fxsave_fpip
echo "skipping test_tb_x86"
echo "skipping test_x86_soft_paging"
echo "skipping test_hang"

118
tests/unit/test_x86_fxsave_fpip.c Normal file
View File

@ -0,0 +1,118 @@
#include "unicorn_test.h"
#include "unicorn/unicorn.h"
#define MEM_BASE 0x40000000
#define MEM_SIZE 1024*1024
#define MEM_STACK MEM_BASE + (MEM_SIZE / 2)
#define MEM_TEXT MEM_STACK + 4096
#define CODE_X86_NOP_OFFSET 4
// note: fxsave was introduced in Pentium II
static uint8_t code_x86[] = {
// help testing through NOP offset [disassembly in at&t syntax]
0x90, 0x90, 0x90, 0x90, // nop nop nop nop
// run a floating point instruction
0xdb, 0xc9, // fcmovne %st(1), %st
// fxsave needs 512 bytes of storage space
0x81, 0xec, 0x00, 0x02, 0x00, 0x00, // subl $512, %esp
// fxsave needs a 16-byte aligned address for storage
0x83, 0xe4, 0xf0, // andl $0xfffffff0, %esp
// store fxsave data on the stack
0x0f, 0xae, 0x04, 0x24, // fxsave (%esp)
// fxsave stores FPIP at an 8-byte offset, move FPIP to eax register
0x8b, 0x44, 0x24, 0x08 // movl 0x8(%esp), %eax
};
#define CODE_X64_NOP_OFFSET 8
static uint8_t code_x64[] = {
// help testing through NOP offset [disassembly in at&t]
0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, // nops
// run a floating point instruction
0xdb, 0xc9, // fcmovne %st(1), %st
// fxsave64 needs 512 bytes of storage space
0x48, 0x81, 0xec, 0x00, 0x02, 0x00, 0x00, // subq $512, %rsp
// fxsave needs a 16-byte aligned address for storage
0x48, 0x83, 0xe4, 0xf0, // andq 0xfffffffffffffff0, %rsp
// store fxsave64 data on the stack
0x48, 0x0f, 0xae, 0x04, 0x24, // fxsave64 (%rsp)
// fxsave64 stores FPIP at an 8-byte offset, move FPIP to rax register
0x48, 0x8b, 0x44, 0x24, 0x08, // movq 0x8(%rsp), %rax
};
static void test_x86(void **state) {
uc_err err;
uint32_t stack_top = (uint32_t) MEM_STACK;
uint32_t value;
uc_engine *uc;
// initialize emulator in X86-32bit mode
err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
uc_assert_success(err);
// map 1MB of memory for this emulation
err = uc_mem_map(uc, MEM_BASE, MEM_SIZE, UC_PROT_ALL);
uc_assert_success(err);
err = uc_mem_write(uc, MEM_TEXT, code_x86, sizeof(code_x86));
uc_assert_success(err);
err = uc_reg_write(uc, UC_X86_REG_ESP, &stack_top);
uc_assert_success(err);
err = uc_emu_start(uc, MEM_TEXT, MEM_TEXT + sizeof(code_x86), 0, 0);
uc_assert_success(err);
err = uc_reg_read(uc, UC_X86_REG_EAX, &value);
uc_assert_success(err);
assert_true(value == ((uint32_t) MEM_TEXT + CODE_X86_NOP_OFFSET));
err = uc_mem_unmap(uc, MEM_BASE, MEM_SIZE);
uc_assert_success(err);
err = uc_close(uc);
uc_assert_success(err);
}
static void test_x64(void **state) {
uc_err err;
uint64_t stack_top = (uint64_t) MEM_STACK;
uint64_t value;
uc_engine *uc;
// initialize emulator in X86-32bit mode
err = uc_open(UC_ARCH_X86, UC_MODE_64, &uc);
uc_assert_success(err);
// map 1MB of memory for this emulation
err = uc_mem_map(uc, MEM_BASE, MEM_SIZE, UC_PROT_ALL);
uc_assert_success(err);
err = uc_mem_write(uc, MEM_TEXT, code_x64, sizeof(code_x64));
uc_assert_success(err);
err = uc_reg_write(uc, UC_X86_REG_RSP, &stack_top);
uc_assert_success(err);
err = uc_emu_start(uc, MEM_TEXT, MEM_TEXT + sizeof(code_x64), 0, 0);
uc_assert_success(err);
err = uc_reg_read(uc, UC_X86_REG_RAX, &value);
uc_assert_success(err);
assert_true(value == ((uint64_t) MEM_TEXT + CODE_X64_NOP_OFFSET));
err = uc_mem_unmap(uc, MEM_BASE, MEM_SIZE);
uc_assert_success(err);
err = uc_close(uc);
uc_assert_success(err);
}
int main(void) {
const struct CMUnitTest tests[] = {
cmocka_unit_test(test_x86),
cmocka_unit_test(test_x64),
};
return cmocka_run_group_tests(tests, NULL, NULL);
}