Fixing child memory write

asm_env.c

@@ -42,7 +42,7 @@ asmsh_env_t* asmsh_env(const char *childpath)
 	res->txt_map_addr = res->data_map_addr = res->stack_addr = NULL;
 	for(size_t i=0; i<res->mmap.size; i++)
 	{
-		if((res->mmap.maps[i].perm == (PROT_READ | PROT_EXEC)) &&
+		if((res->mmap.maps[i].perm == (PROT_READ | PROT_EXEC | PROT_WRITE)) &&
 			(res->mmap.maps[i].offset == 0) &&
 			strncmp("[vdso]", res->mmap.maps[i].pathname,
 					strlen("[vdso]")))
@@ -54,17 +54,6 @@ asmsh_env_t* asmsh_env(const char *childpath)
 			res->txt_map_addr = res->mmap.maps[i].start;
 			res->txt_map_sz = res->mmap.maps[i].stop - res->txt_map_addr;
 
-dprintf(2, "DEBUG : txtmap addr %p-%p (%dbytes) %d(%c%c%c)==%d '%s'\n",
-		res->txt_map_addr,
-		res->mmap.maps[i].stop,
-		res->txt_map_sz,
-		res->mmap.maps[i].perm,
-		(res->mmap.maps[i].perm & PROT_READ)?'r':'-',
-		(res->mmap.maps[i].perm & PROT_WRITE)?'w':'-',
-		(res->mmap.maps[i].perm & PROT_EXEC)?'x':'-',
-		PROT_READ|PROT_EXEC,
-		res->mmap.maps[i].pathname);
-
 		}
 		else if(res->mmap.maps[i].perm == PROT_READ | PROT_WRITE &&
 			res->mmap.maps[i].offset == 0)
@@ -90,7 +79,6 @@ dprintf(2, "DEBUG : txtmap addr %p-%p (%dbytes) %d(%c%c%c)==%d '%s'\n",
 			}
 		}
 	}
-dprintf(2, "Ptr %p\n", res->txt_map_addr);
 	res->txt_map_ptr = res->txt_map_addr;
 
 	res->code_write_ptr = res->txt_map_addr;
@@ -117,68 +105,84 @@ void asmsh_env_free(asmsh_env_t *asmenv)
 	free(asmenv);
 }
 
-int asmsh_env_write_code(asmsh_env_t *env, asmsh_bytecode_t *bcode)
-{
-	if(bcode->size < 8)
-	{
-		return asmsh_env_write_text(env, bcode->bytes, bcode->size);
-	}
-
-	if(asmsh_env_write_text(env, bcode->bytes, 8) < 0)
-	{
-		return -1;
-	}
-
-	if(bcode->size == 8)
-	{
-		return 0;
-	}
-	return asmsh_env_write_text(env, bcode->bytes + 8, bcode->size - 8);
-}
-
-
-int asmsh_env_write_text(asmsh_env_t *env, void *txt, size_t sz)
+int asmsh_env_write_mem(asmsh_env_t *env, void *addr, const unsigned char *buf, size_t buf_sz)
 {
-	uint64_t data;
 	int err;
-
-	if(sz > sizeof(data))
-	{
-		errno = EINVAL;
-		return -1;
+	u_int64_t data;
+	char written;
+	char bleft  = (u_int64_t)addr % 8;
+
+	written = 0;
+	if(bleft)
+	{
+		// First write to correct further write allignement
+		void *wr_addr = (void*)(((u_int64_t)addr / 8) * 8);
+		char towrite = 8 - bleft;
+		towrite = (towrite > buf_sz)?buf_sz:towrite;
+		
+		errno = 0;
+		data = ptrace(PTRACE_PEEKTEXT, env->pid, wr_addr, NULL);
+		if(errno)
+		{
+			err = errno;
+			perror("Unable to peektext in order to allign write");
+			errno = err;
+			return -1;
+		}
+		memcpy(((unsigned char*)&data)+bleft, &(buf[written]), towrite);
+		if(ptrace(PTRACE_POKETEXT, env->pid, wr_addr, data) < 0)
+		{
+			err = errno;
+			perror("Unable to poketext in order to allign write");
+			errno = err;
+			return -1;
+		}
+		written += towrite;
+		env->code_write_ptr += towrite;
 	}
-	if(sz == sizeof(data))
+	if(written >= buf_sz)
 	{
-		data = *(uint64_t*)txt;
+		return 0;
 	}
-	else
+	// env->code_write_ptr is now word alligned and "written" bytes are
+	// allready written
+	while(written < buf_sz)
 	{
-		data = 0;
-		memcpy(&data, txt, sz);
-	}
+		char towrite = buf_sz - written;
+		if(towrite >= 8)
+		{
+			data = *(u_int64_t*)(&buf[written]);
+		}
+		else
+		{
+			data = 0;
+			memcpy(&data, &buf[written], towrite);
+		}
 
-	if(ptrace(PTRACE_POKETEXT, env->pid, env->code_write_ptr, &data) < 0)
-	{
-		err = errno;
-		perror("Unable to ptrace poketext");
-		dprintf(2,"writing at %p map at %p rip %08X rax %08X\n",
-				env->code_write_ptr,
-				env->txt_map_addr,
-				env->regs.rip,
-				env->regs.rax);
-		errno = err;
-		return -1;
+		if(ptrace(PTRACE_POKETEXT, env->pid, env->code_write_ptr, data) < 0)
+		{
+			err = errno;
+			perror("Unable to poketext");
+			errno = err;
+			return -1;
+		}
+		written += towrite;
+		env->code_write_ptr += towrite;
 	}
+	return 0;
+}
 
-	env->code_write_ptr += sz;
 
-	return 0;
+int asmsh_env_write_code(asmsh_env_t *env, asmsh_bytecode_t *bcode)
+{
+	return asmsh_env_write_mem(env, env->code_write_ptr,
+			bcode->bytes, bcode->size);
 }
 
 
 int asmsh_env_step(asmsh_env_t *env, int *status)
 {
-	int err;
+	int err, ret;
 
 	if(status) { *status = 0; }
 
@@ -196,7 +200,7 @@ int asmsh_env_step(asmsh_env_t *env, int *status)
 	}
 	if(status) { *status = env->status; }
 
-	if(env->status != 1407)
+	if(!WIFSTOPPED(env->status))
 	{
 		goto err_wstatus;
 	}
@@ -356,7 +360,7 @@ static int _asmsh_env_spawn(asmsh_env_t *env, const char *childpath)
 	// WARNING totally depends on child.s source
 	// right now there is only 4 instructions (the fourth is the jmp to the txt_map)
 	// before reaching the start of the code mmap
-	for(int i=0; i<3; i++)
+	for(int i=0; i<4; i++)
 	{
 		/* // DEBUG to monitor placement in child exec
 		asmsh_env_update_regs(env);

asm_env.h

@@ -67,6 +67,18 @@ asmsh_env_t* asmsh_env(const char *childpath);
 /** Free an env returned by @ref asmsh_env() */
 void asmsh_env_free(asmsh_env_t *asmenv);
 
+/** Write a buffer in tracee memory
+ *
+ * Handle un-alligned addr by reading tracee memory before writing if
+ * needed.
+ * @param asmsh_env_t* 
+ * @param void* The address in tracee memory
+ * @param const unsigned char* The buffer to write
+ * @param size_t number of bytes to write
+ * @return 0 if no errors else -1 with errno set
+ */
+int asmsh_env_write_mem(asmsh_env_t *env, void *addr, const unsigned char *buf, size_t buf_sz);
+
 /** Write bytecode at the next location available in the text map
  * @param asmsh_env_t* The run environment
  * @param asmsh_bytecode_t* The bytecode to copy
@@ -75,9 +87,6 @@ void asmsh_env_free(asmsh_env_t *asmenv);
  */
 int asmsh_env_write_code(asmsh_env_t *env, asmsh_bytecode_t *bcode);
 
-/** Write sz of txt data in text map */
-int asmsh_env_write_text(asmsh_env_t *env, void *txt, size_t sz);
-
 /** Run the next instruction
  * @param asmsh_env_t* The run environment
  * @param int* If not null will be set to the status of the child PID (error cases)

child.s

@@ -1,18 +1,23 @@
 .file "child64.s"
 
+.comm map_len 8
+
 .section .text
 .global _start
 
 map_exec:
 
 _start:
-	pushq $0x1000 #  map size
+	movq $0x1000, (map_len)
+	lea redo(%rip), %rax
+	push %rax # redo addr
+	pushq $0x1000 # map size
 
 	mov $0x9, %rax # MMAP
 	xor %rdi, %rdi
 	mov (%rsp), %rsi # 1 page map
 	#mov $(0x1|0x2), %rdx # PROT_READ | PROT_WRITE
-	mov $(0x1|0x4), %rdx # PROT_READ | PROT_EXEC
+	mov $(0x1|0x4|0x2), %rdx # PROT_READ | PROT_EXEC | PROT_WRITE
 	mov $(0x20 | 0x1), %r10 # MAP_ANONYMOUS | MAP_SHARED
 	mov $-1, %r8 # fd
 	xor %r9, %r9
@@ -22,36 +27,7 @@ _start:
 	cmp $0, %rax
 	jle .errmap
 
-	mov $0xA, %rax # mprotect
-	mov (%rsp), %rdi # map addr
-	mov -8(%rsp), %rsi # map size
-	mov $(0x1|0x2), %rdx # PROT_READ | PROT_WRITE
-	syscall
-
-	####################
-	# TRACER STOP HERE #
-	#############################################################
-	# this is the point where you are able to write             #
-	# the map :                                                 #
-	# - start addr in (%rsp)                                    #
-	# - size in 8(%rsp)                                         #
-	# This informations can be fetched from /proc/[pid]/maps    #
-	# too                                                       #
-	#############################################################
-	# After this point you will be at 1 syscall (enter + exit)  #
-	# and 3 instructions (the third is the jump) from jumpexec  #
-	# in the map                                                #
-	#############################################################
-
-	mov $0xA, %rax # mprotect
-	mov (%rsp), %rdi # map start
-	mov -8(%rsp), %rsi # map size
-	mov $(0x1|0x4), %rdx # PROT_READ | PROT_EXEC
-	syscall
-	
-	cmp $0, %rax
-	jle .err
-
+	redo:
 	jmp *(%rsp)
 
 

tests/tests_asm_env.c

@@ -57,7 +57,7 @@ START_TEST(test_env_update)
 }
 END_TEST
 
-START_TEST(test_env_steps)
+START_TEST(test_env_exit42)
 {
 	const char childpath[] = REAL_CHILD;
 
@@ -80,11 +80,13 @@ START_TEST(test_env_steps)
 
 	asmsh_asmc_ctx_free(cctx);
 
-	for(int i=0; i<3; i++)
+	for(int i=0; i<2; i++)
 	{
 		ret = asmsh_env_step(env, &status);
 		ck_assert_int_eq(ret, 0);
-		ck_assert_int_eq(status, 0);
+		ck_assert_msg(WCOREDUMP(status) ==  0, "SEGFAULT");
+		ck_assert_int_ne(WIFSTOPPED(status), 0);
+		ck_assert_int_eq(status>>8, 5);
 	}
 	ret = asmsh_env_step(env, &status);
 	ck_assert_int_eq(ret, 1);
@@ -96,10 +98,136 @@ START_TEST(test_env_steps)
 }
 END_TEST
 
+START_TEST(test_env_steps)
+{
+	const char childpath[] = REAL_CHILD;
+	const char *instr[] = {
+		"mov $60, %rax",
+		"mov $0x42,%rdi",
+		"syscall",
+	};
+
+	asmsh_asmc_ctx_t *cctx;
+	asmsh_bytecode_t bcode;
+	int ret, status, i;
+
+	asmsh_env_t *env = asmsh_env(childpath);
+	ck_assert_ptr_nonnull(env);
+
+	cctx = asmsh_asmc_ctx_default();
+	ck_assert_ptr_nonnull(cctx);
+
+
+	for(i=0; i<(sizeof(instr)/sizeof(*instr))-1; i++)
+	{
+		ck_assert_int_ge(asmsh_asmc_compile(cctx, instr[i], &bcode), 0);
+		ck_assert_int_ge(asmsh_env_write_code(env, &bcode), 0);
+		ret = asmsh_env_step(env, &status);
+		ck_assert_int_eq(ret, 0);
+		ck_assert_msg(WCOREDUMP(status) ==  0, "SEGFAULT");
+		ck_assert_int_ne(WIFSTOPPED(status), 0);
+		ck_assert_int_eq(status>>8, 5);
+	}
+	ck_assert_int_ge(asmsh_asmc_compile(cctx, instr[i], &bcode), 0);
+	ck_assert_int_ge(asmsh_env_write_code(env, &bcode), 0);
+	ret = asmsh_env_step(env, &status);
+	ck_assert_int_eq(ret, 1);
+	ck_assert(WIFEXITED(status));
+	ck_assert_int_eq(WEXITSTATUS(status), 0x42);
+
+	asmsh_asmc_ctx_free(cctx);
+	asmsh_env_free(env);
+
+}
+END_TEST
+
+START_TEST(test_env_regs)
+{
+	const char childpath[] = REAL_CHILD;
+	asmsh_env_t *env = asmsh_env(childpath);
+	ck_assert_ptr_nonnull(env);
+
+	asmsh_asmc_ctx_t *cctx;
+	asmsh_bytecode_t bcode;
+	int ret, status, i;
+	struct _instr_tests {
+		char *instr;
+		long long unsigned int *reg;
+		u_int64_t val;
+	} tinstr[] = {
+		{
+			.instr = "mov $42, %r15",
+			.reg = &env->regs.r15,
+			.val = 42,
+		},
+		{
+			.instr = "mov %r15, %rcx",
+			.reg = &env->regs.rcx,
+			.val = 42,
+		},
+		{
+			.instr = "mov $24, %rbx",
+			.reg = &env->regs.rbx,
+			.val = 24,
+		},
+		{
+			.instr = "add %rbx, %rcx",
+			.reg = &env->regs.rcx,
+			.val = 0x42,
+		},
+		{
+			.instr = "mov $60, %rax",
+			.reg = &env->regs.rax,
+			.val = 60,
+		},
+		{
+			.instr = "xor %rdi, %rdi",
+			.reg = &env->regs.rdi,
+			.val = 0,
+		},
+		{
+			.instr = "syscall",
+			.reg = NULL,
+			.val = 0,
+		},
+	};
+
+	cctx = asmsh_asmc_ctx_default();
+	ck_assert_ptr_nonnull(cctx);
+
+	for(i=0; i<(sizeof(tinstr)/sizeof(*tinstr))-1;i++)
+	{
+		ck_assert_int_ge(asmsh_asmc_compile(cctx, tinstr[i].instr, &bcode), 0);
+		ck_assert_int_ge(asmsh_env_write_code(env, &bcode), 0);
+		ret = asmsh_env_step(env, &status);
+		ck_assert_int_eq(ret, 0);
+		ck_assert_msg(WCOREDUMP(status) ==  0, "SEGFAULT");
+		ck_assert_int_ne(WIFSTOPPED(status), 0);
+		ck_assert_int_eq(status>>8, 5);
+		if(!tinstr[i].reg) { continue; }
+		asmsh_env_update_regs(env);
+		ck_assert_int_eq(*(tinstr[i].reg), tinstr[i].val);
+	}
+	ck_assert_int_ge(asmsh_asmc_compile(cctx, tinstr[i].instr, &bcode), 0);
+	ck_assert_int_ge(asmsh_env_write_code(env, &bcode), 0);
+	ret = asmsh_env_step(env, &status);
+	ck_assert_int_eq(ret, 1);
+	ck_assert(WIFEXITED(status));
+	ck_assert_int_eq(WEXITSTATUS(status), 0);
+
+	asmsh_asmc_ctx_free(cctx);
+	asmsh_env_free(env);
+
+}
+END_TEST
+
+
 ASMSH_CHECK_START("Testing asm env", "testing asm environment")
 	ASMSH_ADD_TEST(test_env);
 	ASMSH_ADD_TEST(test_asm_stamps);
 	ASMSH_ADD_TEST(test_env_update);
+	ASMSH_ADD_TEST(test_env_exit42);
 	ASMSH_ADD_TEST(test_env_steps);
+	ASMSH_ADD_TEST(test_env_regs);
 ASMSH_CHECK_END
 

tests/tests_compile.c

@@ -153,6 +153,7 @@ typedef struct
 static const compile_sample_t comp_samples[] = {
 	{{"\x48\x83\xc0\x03\0", 4}, "add $3, %rax"},
 	{{"\x48\x89\xc3\0", 3}, "mov %rax, %rbx"},
+	{{"\xbf\x2a\x00\x00\x00", 5}, "mov $42, %rdi"},
 	{{"\x31\xc0\0", 2}, "xor %rax, %rax"},
 	{{"\x53\0", 1}, "push %rbx"},
 	{{"\x0f\x05\0", 2}, "syscall"},