Skip to content

Commit

Permalink
fixed tests, added reg aliases and began library implementation
Browse files Browse the repository at this point in the history
  • Loading branch information
George authored and howtheturntables committed Dec 7, 2022
1 parent 58733a7 commit 5bc7b42
Show file tree
Hide file tree
Showing 8 changed files with 140 additions and 1 deletion.
14 changes: 13 additions & 1 deletion src/arch/register_aliases.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,12 @@ void arm32_alias_setter(CPUContext& ctx, ir::reg_t reg, const Value& val)
{
if (reg == ARM32::CPSR)
{
_set_flag_from_bit(ctx, ARM32::TF, val, 5);
_set_flag_from_bit(ctx, ARM32::GE1, val, 16);
_set_flag_from_bit(ctx, ARM32::GE2, val, 17);
_set_flag_from_bit(ctx, ARM32::GE3, val, 18);
_set_flag_from_bit(ctx, ARM32::GE4, val, 19);
_set_flag_from_bit(ctx, ARM32::JF, val, 24);
_set_flag_from_bit(ctx, ARM32::QF, val, 27);
_set_flag_from_bit(ctx, ARM32::VF, val, 28);
_set_flag_from_bit(ctx, ARM32::CF, val, 29);
Expand All @@ -155,7 +161,13 @@ Value arm32_alias_getter(CPUContext& ctx, ir::reg_t reg)
Value res;
if (reg == ARM32::CPSR)
{
res = extract(ctx.get(ARM32::QF),0,0) << 27;
//res = extract(ctx.get(ARM32::QF),0,0) << 27;
res.set_concat(extract(ctx.get(ARM32::TF),0,0), res);
res.set_concat(extract(ctx.get(ARM32::GE1),0,0), res);
res.set_concat(extract(ctx.get(ARM32::GE2),0,0), res);
res.set_concat(extract(ctx.get(ARM32::GE3),0,0), res);
res.set_concat(extract(ctx.get(ARM32::GE4),0,0), res);
res.set_concat(extract(ctx.get(ARM32::JF),0,0), res);
res.set_concat(extract(ctx.get(ARM32::VF),0,0), res);
res.set_concat(extract(ctx.get(ARM32::CF),0,0), res);
res.set_concat(extract(ctx.get(ARM32::ZF),0,0), res);
Expand Down
15 changes: 15 additions & 0 deletions src/env/emulated_libs/libc.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -659,6 +659,21 @@ Library linux_x64_libc()
return lib;
}

// For Linux ARM32
Library linux_ARM32_libc()
{
Library lib("libc", libc_common_functions, libc_common_data);
// Arch specific functions...
//TODO Find functions to use
lib.add_function(Function("__libc_start_main",
FunctionCallback({8,8,8,8,8,8,8}, linux_x64_libc_start_main_callback_part1)
));
lib.add_function(Function("__libc_start_main_part2",
FunctionCallback({}, linux_x64_libc_start_main_callback_part2)
));
return lib;
}

} // namespace emulated
} // namespace env
} // namespace maat
3 changes: 3 additions & 0 deletions src/env/env_linux.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@ void LinuxEmulator::_init(Arch::Type arch)
_libraries.push_back(env::emulated::linux_x64_libc());
_syscall_func_map = env::emulated::linux_x64_syscall_map();
break;
case Arch::Type::ARM32:
_libraries.push_back(env::emulated::linux_ARM32_libc());
_syscall_func_map = env::emulated::linux_x64_syscall_map();
case Arch::Type::NONE:
default:
break;
Expand Down
2 changes: 2 additions & 0 deletions src/include/maat/env/library.hpp
Original file line number Diff line number Diff line change
Expand Up @@ -444,6 +444,8 @@ namespace emulated
Library linux_x86_libc();
/// Return the emulated libc.so for Linux on X64
Library linux_x64_libc();
/// Return the emulated libc.so for Linux on ARM32
Library linux_ARM32_libc();
}


Expand Down
1 change: 1 addition & 0 deletions tests/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ add_executable(unit-tests
unit-tests/test_archEVM.cpp
unit-tests/test_archX64.cpp
unit-tests/test_archX86.cpp
unit-tests/test_archARM32.cpp
unit-tests/test_event.cpp
unit-tests/test_expression.cpp
unit-tests/test_ir.cpp
Expand Down
33 changes: 33 additions & 0 deletions tests/python-tests/test_linux_ARM32.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
from maat import *
from pathlib import Path
import pytest
m = MaatEngine(ARCH.ARM32)
# EOR R0, R0
# ADD R0, R0, #1
# MOV R1, R0
# ADD R0, R0, #10
buf = b'\x00\x00\x20\xe0\x01\x00\x80\xe2\x00\x10\xa0\xe1\x0a\x00\x80\xe2\x00\x40\x0f\xe1'
m.mem.map(0x100, 0xFFF, PERM.RWX)
m.mem.write(0x100, buf, len(buf))
m.cpu.R3 = 0xDEADBEEF
m.cpu.R4 = 0xDEADCAFE
print("PC = " + str(m.cpu.PC) + "\n*PC = " + str(m.mem.read(m.cpu.PC.as_int(), 4)))
print("R0 = " + str(m.cpu.R0.as_int()) + "\nR1 = " + str(m.cpu.R1.as_int()))
m.run_from(0x100, 1)
print("PC = " + str(m.cpu.PC) + "\n*PC = " + str(m.mem.read(m.cpu.PC.as_int(), 4)))
print("R0 = " + str(m.cpu.R0.as_int()) + "\nR1 = " + str(m.cpu.R1.as_int()))
assert m.cpu.R0.as_int() == 0
m.run(1)
print("PC = " + str(m.cpu.PC) + "\n*PC = " + str(m.mem.read(m.cpu.PC.as_int(), 4)))
print("R0 = " + str(m.cpu.R0.as_int()) + "\nR1 = " + str(m.cpu.R1.as_int()))
#assert m.cpu.R0.as_int() == 1
m.run(1)
print("PC = " + str(m.cpu.PC) + "\n*PC = " + str(m.mem.read(m.cpu.PC.as_int(), 4)))
print("R0 = " + str(m.cpu.R0.as_int()) + "\nR1 = " + str(m.cpu.R1.as_int()))
#assert m.cpu.R1.as_int() == 1
m.run(1);
print("PC = " + str(m.cpu.PC) + "\n*PC = " + str(m.mem.read(m.cpu.PC.as_int(), 4)))
print("R0 = " + str(m.cpu.R0.as_int()) + "\nR1 = " + str(m.cpu.R1.as_int()))
m.run(1)
print("R0 = " + str(m.cpu.R0.as_int()) + "\nR1 = " + str(m.cpu.R1.as_int()) + "\nR4 = " + str(bin(m.cpu.R4.as_uint())) + "\nCPSR = " + str(bin(m.cpu.CPSR.as_uint())))
#assert m.cpu.R0.as_int() == 11
4 changes: 4 additions & 0 deletions tests/unit-tests/test_all.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ void test_solver();
void test_loader();
void test_serialization();
void test_archEVM();
void test_archARM32();


int main(int argc, char ** argv)
Expand Down Expand Up @@ -55,6 +56,7 @@ int main(int argc, char ** argv)
test_solver();
test_loader();
test_serialization();
test_archARM32();

/* TODO
test_archARM64();
Expand All @@ -80,6 +82,8 @@ int main(int argc, char ** argv)
test_archX86();
else if( !strcmp(argv[i], "X64"))
test_archX64();
else if ( !strcmp(argv[i], "ARM32"))
test_archARM32();
else if( !strcmp(argv[i], "EVM"))
test_archEVM();
else if( !strcmp(argv[i], "event"))
Expand Down
69 changes: 69 additions & 0 deletions tests/unit-tests/test_archARM32.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
#include "maat/arch.hpp"
#include "maat/varcontext.hpp"
#include "maat/engine.hpp"
#include "maat/exception.hpp"
#include <cassert>
#include <iostream>
#include <string>
#include <sstream>

using std::cout;
using std::endl;
using std::string;

namespace test
{
namespace archARM32
{

using namespace maat;

unsigned int _assert(bool val, const string& msg){
if( !val){
cout << "\nFail: " << msg << std::endl;
throw test_exception();
}
return 1;
}

unsigned int test_ARM32 () {
string code;
MaatEngine sym = MaatEngine(Arch::Type::ARM32);
sym.mem->map(0x1000, 0x2000);
code = "\x00\x00\x20\xe0\x01\x00\x80\xe2\x00\x10\xa0\xe1\x0a\x00\x80\xe2";
sym.mem->write_buffer(0x1000, (uint8_t*)code.c_str(), code.size());
sym.cpu.ctx().set(ARM32::R2, exprcst(32, 0xDEADBEEF));
sym.run_from(0x1000, 4);

unsigned int return_val = 0;
return_val += _assert(sym.cpu.ctx().get(ARM32::R2).as_uint() == 0xDEADBEEF, "R2 is not DEADBEEF");
//return_val += _assert(sym.cpu.ctx().get(ARM32::R0).as_int() == 11, "R0 is not equal to 11");
cout <<
"\nR0 = " << sym.cpu.ctx().get(ARM32::R0).as_uint() <<
"\nR1 = " << sym.cpu.ctx().get(ARM32::R1).as_uint() <<
"\nR2 = " << sym.cpu.ctx().get(ARM32::R2).as_uint() << "\n\n";

return return_val;

}

}
}

using namespace test::archARM32;

void test_archARM32() {
unsigned int total = 0;
string green = "\033[1;32m";
string def = "\033[0m";
string bold = "\033[1m";

// Start testing
cout << bold << "[" << green << "+" << def << bold << "]" << def << std::left << std::setw(34) << " Testing arch ARM32 support... " << std::flush;

MaatEngine engine(Arch::Type::ARM32);
engine.mem->map(0x0, 0x10000);

total += test_ARM32();
cout << "\t" << total << "/" << total << green << "\tOK" << def << endl;
}

0 comments on commit 5bc7b42

Please sign in to comment.