ladybird/Userland/Utilities/functrace.cpp
Andreas Kling e87eac9273 Userland: Add LibSystem and funnel all syscalls through it
This achieves two things:

- Programs can now intentionally perform arbitrary syscalls by calling
  syscall(). This allows us to work on things like syscall fuzzing.

- It restricts the ability of userspace to make syscalls to a single
  4KB page of code. In order to call the kernel directly, an attacker
  must now locate this page and call through it.
2021-02-05 12:23:39 +01:00

180 lines
6.4 KiB
C++

/*
* Copyright (c) 2020, Itamar S. <itamar8910@gmail.com>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <AK/Assertions.h>
#include <AK/ByteBuffer.h>
#include <AK/Demangle.h>
#include <AK/HashMap.h>
#include <AK/LogStream.h>
#include <AK/NonnullOwnPtr.h>
#include <AK/StringBuilder.h>
#include <AK/kmalloc.h>
#include <LibC/sys/arch/i386/regs.h>
#include <LibCore/ArgsParser.h>
#include <LibCore/File.h>
#include <LibDebug/DebugSession.h>
#include <LibELF/Image.h>
#include <LibX86/Disassembler.h>
#include <LibX86/Instruction.h>
#include <math.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syscall.h>
#include <unistd.h>
static OwnPtr<Debug::DebugSession> g_debug_session;
static bool g_should_output_color = false;
static void handle_sigint(int)
{
printf("Debugger: SIGINT\n");
// The destructor of DebugSession takes care of detaching
g_debug_session = nullptr;
}
static void print_function_call(String function_name, size_t depth)
{
for (size_t i = 0; i < depth; ++i) {
out(" ");
}
outln("=> {}", function_name);
}
static void print_syscall(PtraceRegisters& regs, size_t depth)
{
for (size_t i = 0; i < depth; ++i) {
printf(" ");
}
const char* begin_color = g_should_output_color ? "\033[34;1m" : "";
const char* end_color = g_should_output_color ? "\033[0m" : "";
outln("=> {}SC_{}(0x{:x}, 0x{:x}, 0x{:x}){}",
begin_color,
Syscall::to_string((Syscall::Function)regs.eax),
regs.edx,
regs.ecx,
regs.ebx,
end_color);
}
static NonnullOwnPtr<HashMap<void*, X86::Instruction>> instrument_code()
{
auto instrumented = make<HashMap<void*, X86::Instruction>>();
g_debug_session->for_each_loaded_library([&](const Debug::DebugSession::LoadedLibrary& lib) {
lib.debug_info->elf().for_each_section_of_type(SHT_PROGBITS, [&](const ELF::Image::Section& section) {
if (section.name() != ".text")
return IterationDecision::Continue;
X86::SimpleInstructionStream stream((const u8*)((u32)lib.file->data() + section.offset()), section.size());
X86::Disassembler disassembler(stream);
for (;;) {
auto offset = stream.offset();
void* instruction_address = (void*)(section.address() + offset + lib.base_address);
auto insn = disassembler.next();
if (!insn.has_value())
break;
if (insn.value().mnemonic() == "RET" || insn.value().mnemonic() == "CALL") {
g_debug_session->insert_breakpoint(instruction_address);
instrumented->set(instruction_address, insn.value());
}
}
return IterationDecision::Continue;
});
return IterationDecision::Continue;
});
return instrumented;
}
int main(int argc, char** argv)
{
if (pledge("stdio proc exec rpath sigaction ptrace", nullptr) < 0) {
perror("pledge");
return 1;
}
if (isatty(STDOUT_FILENO))
g_should_output_color = true;
const char* command = nullptr;
Core::ArgsParser args_parser;
args_parser.add_positional_argument(command,
"The program to be traced, along with its arguments",
"program", Core::ArgsParser::Required::Yes);
args_parser.parse(argc, argv);
auto result = Debug::DebugSession::exec_and_attach(command);
if (!result) {
warnln("Failed to start debugging session for: \"{}\"", command);
exit(1);
}
g_debug_session = result.release_nonnull();
auto instrumented = instrument_code();
struct sigaction sa;
memset(&sa, 0, sizeof(struct sigaction));
sa.sa_handler = handle_sigint;
sigaction(SIGINT, &sa, nullptr);
size_t depth = 0;
bool new_function = true;
g_debug_session->run(Debug::DebugSession::DesiredInitialDebugeeState::Running, [&](Debug::DebugSession::DebugBreakReason reason, Optional<PtraceRegisters> regs) {
if (reason == Debug::DebugSession::DebugBreakReason::Exited) {
outln("Program exited.");
return Debug::DebugSession::DebugDecision::Detach;
}
if (reason == Debug::DebugSession::DebugBreakReason::Syscall) {
print_syscall(regs.value(), depth + 1);
return Debug::DebugSession::DebugDecision::ContinueBreakAtSyscall;
}
if (new_function) {
auto function_name = g_debug_session->symbolicate(regs.value().eip);
print_function_call(function_name.value().symbol, depth);
new_function = false;
return Debug::DebugSession::ContinueBreakAtSyscall;
}
auto instruction = instrumented->get((void*)regs.value().eip).value();
if (instruction.mnemonic() == "RET") {
if (depth != 0)
--depth;
return Debug::DebugSession::ContinueBreakAtSyscall;
}
// FIXME: we could miss some leaf functions that were called with a jump
ASSERT(instruction.mnemonic() == "CALL");
++depth;
new_function = true;
return Debug::DebugSession::DebugDecision::SingleStep;
});
}