Skip to content

Commit eb1f650

Browse files
author
Abhiroop Dabral
committed
Instrumentation Code
0 parents  commit eb1f650

File tree

3 files changed

+535
-0
lines changed

3 files changed

+535
-0
lines changed

‎cr.cpp

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
#include <iostream>
2+
#include <fstream>
3+
#include <set>
4+
5+
#include "pin.H"
6+
7+
#define MAX_THREADS 512
8+
#define OUT_FILE "cnt.out"
9+
10+
ofstream OutFile;
11+
static UINT64 icount[MAX_THREADS] = {0};
12+
set<ADDRINT> RetAddrLocs;
13+
UINT64 my_tid = 0;
14+
15+
VOID PIN_FAST_ANALYSIS_CALL Count(THREADID tid, ADDRINT cnt)
16+
{
17+
if ( my_tid < tid )
18+
my_tid = tid;
19+
// return;
20+
icount[tid] += cnt;
21+
}
22+
23+
VOID Trace(TRACE trace, VOID *v)
24+
{
25+
for (BBL bbl = TRACE_BblHead(trace); BBL_Valid(bbl); bbl = BBL_Next(bbl))
26+
27+
BBL_InsertCall(bbl, IPOINT_ANYWHERE, AFUNPTR(Count),
28+
IARG_FAST_ANALYSIS_CALL,
29+
IARG_THREAD_ID,
30+
IARG_UINT32, BBL_NumIns(bbl),
31+
IARG_END);
32+
}
33+
int depth = 10;
34+
35+
VOID Ret(THREADID tid, ADDRINT sp, ADDRINT target, ADDRINT eip, UINT32 push)
36+
{
37+
// cout << "RET " << tid << hex << " " << sp << " " << target << " " << eip << " " << push << endl;
38+
// return;
39+
set<ADDRINT>::const_iterator sp_iter = RetAddrLocs.find(sp);
40+
41+
if (push) {
42+
OutFile << "PUSH FOUND" << endl;
43+
RetAddrLocs.erase(RetAddrLocs.begin());
44+
return;
45+
}
46+
if (sp_iter == RetAddrLocs.end()) {
47+
// cerr << hex << "ret address not found!! " << sp << " " << *(RetAddrLocs.begin())
48+
OutFile << tid << hex << "ret address not found!! " << sp << " " << *(RetAddrLocs.begin())
49+
<< " " << target << " " << eip << endl;
50+
return;
51+
}
52+
53+
// if (sp_iter != RetAddrLocs.begin())
54+
// OutFile << "ret address not in the beginning!! " << endl;
55+
56+
depth -= distance(RetAddrLocs.begin(), sp_iter) + 1;
57+
// OutFile << "Distance " << distance(RetAddrLocs.begin(), sp_iter) << endl;
58+
// for (int i=0; i < depth; i++) cerr << " ";
59+
// cerr << hex << tid << " ret " << sp << " " << target << endl;
60+
// if ( sp_iter == RetAddrLocs.begin() ) {
61+
// RetAddrLocs.erase(sp_iter);
62+
// return;
63+
// }
64+
65+
// RetAddrLocs.erase(RetAddrLocs.begin(), sp_iter);
66+
// RetAddrLocs.erase(sp);
67+
}
68+
69+
VOID Call(THREADID tid, ADDRINT sp, ADDRINT target, ADDRINT eip)
70+
{
71+
// cout << "CALL " << tid << hex << " " << sp << " " << target << " " << eip << endl;
72+
// return;
73+
// for (int i=0; i < depth; i++) cerr << " ";
74+
// cerr << hex << tid << " call " << sp << " " << target << endl;
75+
RetAddrLocs.insert(sp);
76+
depth++;
77+
}
78+
79+
VOID MemWrite(THREADID tid, ADDRINT ea)
80+
{
81+
if (RetAddrLocs.find(ea) != RetAddrLocs.end())
82+
OutFile << "return address overwrite!!!" << endl;
83+
}
84+
85+
86+
VOID Instruction(INS ins, VOID *v)
87+
{
88+
//if (RTN_Valid(INS_Rtn(ins)) && RTN_Name(INS_Rtn(ins)) == "__SEH_epilog4") {
89+
// cerr << "image " << IMG_Name(SEC_Img(RTN_Sec(INS_Rtn(ins)))) << endl;
90+
//}
91+
92+
if (INS_IsRet(ins)) {
93+
94+
INS prev = INS_Prev(ins);
95+
96+
INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(Ret),
97+
IARG_THREAD_ID,
98+
IARG_REG_VALUE, REG_ESP,
99+
IARG_BRANCH_TARGET_ADDR,
100+
IARG_INST_PTR,
101+
IARG_UINT32, (INS_Valid(prev) && INS_Opcode(prev) == XED_CATEGORY_PUSH),
102+
IARG_END);
103+
104+
}
105+
else if (INS_IsCall(ins))
106+
107+
INS_InsertCall(ins, IPOINT_TAKEN_BRANCH, AFUNPTR(Call),
108+
IARG_THREAD_ID,
109+
IARG_REG_VALUE, REG_ESP,
110+
IARG_BRANCH_TARGET_ADDR,
111+
IARG_INST_PTR,
112+
IARG_END);
113+
114+
else if (INS_IsMemoryWrite(ins))
115+
116+
INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(MemWrite),
117+
IARG_THREAD_ID,
118+
IARG_MEMORYWRITE_EA,
119+
IARG_END);
120+
}
121+
122+
123+
VOID Fini(INT32 code, VOID *v)
124+
{
125+
OutFile << "DUMP Count DS" << endl;
126+
127+
for (UINT32 i = 0; i < MAX_THREADS; i++)
128+
OutFile << icount[i] << endl;
129+
OutFile << "TID = " << my_tid;
130+
131+
OutFile.close();
132+
133+
cerr << "SIZE" << RetAddrLocs.size() << endl;
134+
135+
// for (auto ea : RetAddrLocs)
136+
// set<ADDRINT>::const_iterator ret_iter;
137+
// for ( ret_iter = RetAddrLocs.begin(); ret_iter != RetAddrLocs.end(); ret_iter++ )
138+
// cerr << hex << *ret_iter<< endl;
139+
}
140+
141+
142+
int main(int argc, char * argv[])
143+
{
144+
PIN_InitSymbols();
145+
146+
if (PIN_Init(argc, argv))
147+
return 1;
148+
149+
OutFile.open(OUT_FILE);
150+
151+
TRACE_AddInstrumentFunction(Trace, 0);
152+
153+
INS_AddInstrumentFunction(Instruction, 0);
154+
155+
PIN_AddFiniFunction(Fini, 0);
156+
157+
PIN_StartProgram();
158+
159+
return 0;
160+
}

‎loc_rop.cpp

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
#include <iostream>
2+
#include <fstream>
3+
#include <set>
4+
5+
#include "pin.H"
6+
7+
#define MAX_THREADS 512
8+
#define OUT_FILE "cnt.out"
9+
10+
ofstream OutFile;
11+
static UINT64 icount[MAX_THREADS] = {0};
12+
//set<ADDRINT> RetAddrLocs;
13+
UINT64 my_tid = 0;
14+
set<ADDRINT> *data_ar[MAX_THREADS];
15+
16+
VOID PIN_FAST_ANALYSIS_CALL Count(THREADID tid, ADDRINT cnt)
17+
{
18+
if ( my_tid < tid )
19+
my_tid = tid;
20+
// return;
21+
icount[tid] += cnt;
22+
}
23+
24+
VOID Trace(TRACE trace, VOID *v)
25+
{
26+
for (BBL bbl = TRACE_BblHead(trace); BBL_Valid(bbl); bbl = BBL_Next(bbl))
27+
28+
BBL_InsertCall(bbl, IPOINT_ANYWHERE, AFUNPTR(Count),
29+
IARG_FAST_ANALYSIS_CALL,
30+
IARG_THREAD_ID,
31+
IARG_UINT32, BBL_NumIns(bbl),
32+
IARG_END);
33+
}
34+
int depth = 10;
35+
36+
VOID Ret(THREADID tid, ADDRINT sp, ADDRINT target, ADDRINT eip, UINT32 push)
37+
{
38+
// cout << "RET " << tid << hex << " " << sp << " " << target << " " << eip << " " << push << endl;
39+
// return;
40+
set <ADDRINT> *tdata = data_ar[tid];
41+
set<ADDRINT>::const_iterator sp_iter = (*tdata).find(sp);
42+
43+
if (push) {
44+
OutFile << "PUSH FOUND" << endl;
45+
(*tdata).erase((*tdata).begin());
46+
//cout << "RET FROM RET-1" << tid<<endl;
47+
return;
48+
}
49+
if (sp_iter == (*tdata).end()) {
50+
// cerr << hex << "ret address not found!! " << sp << " " << *(RetAddrLocs.begin())
51+
OutFile << tid << hex << "ret address not found!! " << sp << " " << *((*tdata).begin())
52+
<< " " << target << " " << eip << endl;
53+
54+
//cout << "RET FROM RET-2" << tid <<endl;
55+
return;
56+
}
57+
58+
if (sp_iter != (*tdata).begin())
59+
OutFile << hex <<"ret address not in the beginning!! " << target<<endl;
60+
61+
depth -= distance((*tdata).begin(), sp_iter) + 1;
62+
// OutFile << "Distance " << distance(RetAddrLocs.begin(), sp_iter) << endl;
63+
// for (int i=0; i < depth; i++) cerr << " ";
64+
// cerr << hex << tid << " ret " << sp << " " << target << endl;
65+
// if ( sp_iter == RetAddrLocs.begin() ) {
66+
// RetAddrLocs.erase(sp_iter);
67+
// return;
68+
// }
69+
70+
(*tdata).erase((*tdata).begin(), sp_iter);
71+
(*tdata).erase(sp);
72+
//cout << "RET FROM RET-3" << tid<<endl;
73+
}
74+
75+
VOID Call(THREADID tid, ADDRINT sp, ADDRINT target, ADDRINT eip)
76+
{
77+
// //cout << "CALL " << tid << hex << " " << sp << " " << target << " " << eip << endl;
78+
// return;
79+
// for (int i=0; i < depth; i++) cerr << " ";
80+
// cerr << hex << tid << " call " << sp << " " << target << endl;
81+
set <ADDRINT> *tdata = data_ar[tid];
82+
(*tdata).insert(sp);
83+
depth++;
84+
//cout << "RET from CALL" << tid <<endl;
85+
}
86+
87+
VOID MemWrite(THREADID tid, ADDRINT ea)
88+
{
89+
set<ADDRINT> *tdata = data_ar[tid];
90+
if ((*tdata).find(ea) != (*tdata).end())
91+
OutFile << "return address overwrite!!!" << endl;
92+
//cout << "RET FROM MEWRITE" << tid<<endl;
93+
}
94+
95+
96+
VOID Instruction(INS ins, VOID *v)
97+
{
98+
//if (RTN_Valid(INS_Rtn(ins)) && RTN_Name(INS_Rtn(ins)) == "__SEH_epilog4") {
99+
// cerr << "image " << IMG_Name(SEC_Img(RTN_Sec(INS_Rtn(ins)))) << endl;
100+
//}
101+
102+
if (INS_IsRet(ins)) {
103+
104+
INS prev = INS_Prev(ins);
105+
//cout<< "CALL TO RET" << endl;
106+
107+
INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(Ret),
108+
IARG_THREAD_ID,
109+
IARG_REG_VALUE, REG_ESP,
110+
IARG_BRANCH_TARGET_ADDR,
111+
IARG_INST_PTR,
112+
IARG_UINT32, (INS_Valid(prev) && INS_Opcode(prev) == XED_CATEGORY_PUSH),
113+
IARG_END);
114+
115+
}
116+
else if (INS_IsCall(ins)) {
117+
//cout << "CALL TO CALL" << endl;
118+
119+
INS_InsertCall(ins, IPOINT_TAKEN_BRANCH, AFUNPTR(Call),
120+
IARG_THREAD_ID,
121+
IARG_REG_VALUE, REG_ESP,
122+
IARG_BRANCH_TARGET_ADDR,
123+
IARG_INST_PTR,
124+
IARG_END);
125+
}
126+
else if (INS_IsMemoryWrite(ins)) {
127+
//cout<< "CALL TO MEWRITE" << endl;
128+
129+
INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(MemWrite),
130+
IARG_THREAD_ID,
131+
IARG_MEMORYWRITE_EA,
132+
IARG_END);
133+
}
134+
}
135+
136+
137+
VOID Fini(INT32 code, VOID *v)
138+
{
139+
OutFile << "DUMP Count DS" << endl;
140+
141+
for (UINT32 i = 0; i < MAX_THREADS; i++)
142+
OutFile << icount[i] << endl;
143+
OutFile << "TID = " << my_tid;
144+
145+
OutFile.close();
146+
147+
// cerr << "SIZE" << RetAddrLocs.size() << endl;
148+
149+
// for (auto ea : RetAddrLocs)
150+
// set<ADDRINT>::const_iterator ret_iter;
151+
// for ( ret_iter = RetAddrLocs.begin(); ret_iter != RetAddrLocs.end(); ret_iter++ )
152+
// cerr << hex << *ret_iter<< endl;
153+
}
154+
155+
156+
int main(int argc, char * argv[])
157+
{
158+
int i = 0;
159+
PIN_InitSymbols();
160+
161+
if (PIN_Init(argc, argv))
162+
return 1;
163+
for (i = 0; i<MAX_THREADS; i++)
164+
data_ar[i] = new set<ADDRINT>();
165+
166+
OutFile.open(OUT_FILE);
167+
168+
TRACE_AddInstrumentFunction(Trace, 0);
169+
170+
INS_AddInstrumentFunction(Instruction, 0);
171+
172+
PIN_AddFiniFunction(Fini, 0);
173+
174+
PIN_StartProgram();
175+
176+
return 0;
177+
}

0 commit comments

Comments
 (0)