process.cpp

/*
 * line - Line Is Not an Emulator
 * Copyright (C) 2016 GeekProjects.com
 *
 * This file is part of line.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <ctype.h>
#include <sys/mman.h>
#include <sys/uio.h>

#include <mach/task.h>
#include <mach/mach_init.h>
#include <mach/mach_port.h>
#include <mach/mach_interface.h>

#include <libdis.h>

#include "process.h"
#include "elflibrary.h"
#include "kernel.h"
#include "utils.h"
#include "tls.h"

//#define DEBUG
//#define DEBUG_TLS
#define DEBUG_PATCH

#define X86_EFLAGS_T 0x100UL

using namespace std;

static LineProcess* g_process = NULL;

extern char **environ;

LineProcess::LineProcess(Line* line, ElfExec* exec)
    : Logger("Process"), m_elf(exec), m_line(line), m_patcher(this)
{
    g_process = this;

    m_fs = 0;
    m_fsPtr = 0;
    m_brk = 0;
    m_rip = NULL;
    m_mainThread = NULL;

    m_libraryLoadAddr = 0x40000000;

    x86_init(opt_64_bit, NULL, NULL);

    init();
}

LineProcess::~LineProcess()
{
}

bool LineProcess::init()
{
    pthread_cond_init(&m_requestCond, NULL);
    pthread_mutex_init(&m_requestCondMutex, NULL);
    pthread_mutex_init(&m_requestMutex, NULL);

    return true;
}

bool LineProcess::start(int argc, char** argv)
{
    // Set up sigtrap handler
    struct sigaction act;
    memset (&act, 0, sizeof(act));
    act.sa_sigaction = LineProcess::signalHandler;
    act.sa_flags = SA_SIGINFO;
    //sigemptyset(&act.sa_mask);
    sigaction(SIGTRAP, &act, 0);

    memset (&act, 0, sizeof(act));
    act.sa_sigaction = LineProcess::signalHandler;
    act.sa_flags = SA_SIGINFO;
    sigaction(SIGSEGV, &act, 0);

    memset (&act, 0, sizeof(act));
    act.sa_sigaction = LineProcess::signalHandler;
    act.sa_flags = SA_SIGINFO;
    sigaction(SIGILL, &act, 0);

    // Set the environment
    int envsize = 0;

#if 1
    while (environ[envsize] != NULL)
    {
        envsize++;
    }
    char** linux_environ = (char**)malloc(sizeof(char*) * (envsize + 3));

    int i;
    for (i = 0; i < envsize; i++)
    {
        const char* env = environ[i];
        if (!strncmp("PATH=", env, 5))
        {
            linux_environ[i] = (char*)"PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/sbin";
        }
/*
        else if (!strncmp("HOME=", env, 5))
        {
            linux_environ[i] = (char*)"HOME=/home/ian";
        }
*/
        else
        {
            linux_environ[i] = environ[i];
        }
    }
#else
    // Reset the environment
    envsize = 2;
    char** linux_environ = (char**)malloc(sizeof(char*) * (envsize + 3));

    int i = 0;
    linux_environ[i++] = (char*)"PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/sbin";
    linux_environ[i++] = (char*)"HOME=/home/ian";
#endif

    if (getenv("LINUX_ON_MAC") == NULL)
    {
        linux_environ[i++] = (char*)"LINUX_ON_MAC=1";
    }

    if (getenv("OSXHOME") == NULL)
    {
        string osxhome = string("OSXHOME=") + getenv("HOME");
        linux_environ[i++] = strdup(osxhome.c_str());
    }

    linux_environ[i] = NULL;

    // Set up brk pointer
    m_brk = m_elf->getEnd();

    // Set up TLS
    int tlssize = m_elf->getTLSSize();// + sizeof(struct linux_pthread);
    map<string, ElfLibrary*> libs = m_elf->getLibraries();
    map<string, ElfLibrary*>::iterator it;
    for (it = libs.begin(); it != libs.end(); it++)
    {
        int size = it->second->getTLSSize();
        tlssize += size;
    }

#ifdef DEBUG_TLS
    log("start: TLS: Total size: %d", tlssize);
#endif

    /*
     *   0  +----------+  -144 exec base
     *      | Exec TLS |
     *  16  +----------+  -128 libc base
     *      | libc TLS |
     * 128  +----------+    -0 libm base
     *      | libm TLS |
     * 128  +----------+    -0 <-- FS Pointer
     *  
     */

    int tlspos = 0;
    map<string, ElfLibrary*>::reverse_iterator rit;
    for (rit = libs.rbegin(); rit != libs.rend(); rit++)
    {
        int size = rit->second->getTLSSize();
        tlspos += size;
        rit->second->setTLSBase(-tlspos);
#ifdef DEBUG_TLS
        log("start: TLS: %s: size=0x%x, pos=%d", rit->first.c_str(), size, -tlspos);
#endif
    }

    int size = m_elf->getTLSSize();
    tlspos += size;

#ifdef DEBUG_TLS
    log("start: TLS: %s: size=0x%x, base=%d", m_elf->getPath(), size, -tlspos);
#endif
    m_elf->setTLSBase(-tlspos);

    m_fs = (uint64_t)malloc(tlssize + sizeof(struct linux_pthread));
    m_fsPtr = m_fs + tlssize;
#ifdef DEBUG_TLS
    log("start: TLS: FS: 0x%llx - 0x%llx", m_fs, m_fsPtr);
#endif

    m_elf->relocateLibraries();
    m_elf->relocate();

    tlspos = m_elf->getTLSSize();

    void* initpos = (void*)((int64_t)m_fsPtr + m_elf->getTLSBase());
#ifdef DEBUG_TLS
    log(
        "start: TLS: %s: init: %d: %p-0x%llx, size=%d",
        m_elf->getPath(),
        m_elf->getTLSBase(),
        initpos,
        (uint64_t)initpos + m_elf->getTLSSize(),
        m_elf->getTLSSize());
#endif
    m_elf->initTLS(initpos);

    for (it = libs.begin(); it != libs.end(); it++)
    {
        void* initpos = (void*)((int64_t)m_fsPtr + it->second->getTLSBase());
#ifdef DEBUG_TLS
        int size = it->second->getTLSSize();
        log(
            "start: TLS: %s: %d: init: %p-0x%llx, size=%d",
            it->first.c_str(),
            it->second->getTLSBase(),
            initpos,
            (uint64_t)initpos + size,
            size);
#endif
        it->second->initTLS(initpos);
    }

    // Set up the initial pthread
    struct linux_pthread* pthread = (struct linux_pthread*)m_fsPtr;
    //*((uint64_t*)(m_fsPtr + 0x00)) = (uint64_t)pthread;
    *((uint64_t*)(m_fsPtr + 0x10)) = (uint64_t)pthread;
    pthread->pid = getpid();
    uint64_t tid;
    pthread_threadid_np(NULL, &tid);
    pthread->tid = tid;

#ifdef DEBUG
    log("start: pthread pid=%p", &(pthread->pid));
    log("start: pthread tid=%p", &(pthread->tid));
#endif

    writeFS64(0, m_fsPtr);

#ifdef DEBUG
    log("start: Starting main thread...");
#endif

    m_mainThread = new MainThread(this);
    m_mainThread->start(argc, argv, linux_environ);

    return requestLoop();
}

bool LineProcess::requestLoop()
{
    while (true)
    {
        pthread_cond_wait(&m_requestCond, &m_requestCondMutex);

        ProcessRequest* request;
        bool hasRequest = false;
        pthread_mutex_lock(&m_requestMutex);
        if (!m_requests.empty())
        {
            request = m_requests.front();
            hasRequest = true;
            m_requests.pop_front();
        }
        pthread_mutex_unlock(&m_requestMutex);
#ifdef DEBUG
        log("start: request: %p", request);
#endif
        if (hasRequest)
        {
            switch (request->type)
            {
                case REQUEST_SINGLESTEP:
                {
                    ProcessRequestSingleStep* singleStep = (ProcessRequestSingleStep*)request;
                    setSingleStep(singleStep->thread, singleStep->enable);
                } break;
            }
            request->thread->signalFromProcess();
            // XXX TODO: delete request;
        }
    }

    return true;
}

void LineProcess::addThread(LineThread* thread)
{
    m_threads.insert(make_pair(thread->getPThread(), thread));
}

void LineProcess::signalHandler(int sig, siginfo_t* info, void* contextptr)
{
    ucontext_t* ucontext = (ucontext_t*)contextptr;

    if (sig == SIGTRAP)
    {
        g_process->trap(info, ucontext);
    }
    else
    {
        g_process->error(sig, info, ucontext);
    }
}

void LineProcess::printregs(ucontext_t* ucontext)
{
    log("rax=0x%08llx, rbx=0x%08llx, rcx=0x%08llx, rdx=0x%08llx",
        ucontext->uc_mcontext->__ss.__rax,
        ucontext->uc_mcontext->__ss.__rbx,
        ucontext->uc_mcontext->__ss.__rcx,
        ucontext->uc_mcontext->__ss.__rdx);
    log("rdi=0x%08llx, rsi=0x%08llx, rbp=0x%08llx, rsp=0x%08llx",
        ucontext->uc_mcontext->__ss.__rdi,
        ucontext->uc_mcontext->__ss.__rsi,
        ucontext->uc_mcontext->__ss.__rbp,
        ucontext->uc_mcontext->__ss.__rsp);
    log(" r8=0x%08llx,  r9=0x%08llx, r10=0x%08llx, r11=0x%08llx",
        ucontext->uc_mcontext->__ss.__r8,
        ucontext->uc_mcontext->__ss.__r9,
        ucontext->uc_mcontext->__ss.__r10,
        ucontext->uc_mcontext->__ss.__r11);
    log("r12=0x%08llx, r13=0x%08llx, r14=0x%08llx, r15=0x%08llx",
        ucontext->uc_mcontext->__ss.__r12,
        ucontext->uc_mcontext->__ss.__r13,
        ucontext->uc_mcontext->__ss.__r14,
        ucontext->uc_mcontext->__ss.__r15);
    log("rip=0x%08llx, rflags=0x%08llx",
        ucontext->uc_mcontext->__ss.__rip,
        ucontext->uc_mcontext->__ss.__rflags);
    log(" cs=0x%08llx,  fs=0x%08llx,  gs=0x%08llx, m_fs=0x%08llx",
        ucontext->uc_mcontext->__ss.__cs,
        ucontext->uc_mcontext->__ss.__fs,
        ucontext->uc_mcontext->__ss.__gs,
        m_fs);
}

void LineProcess::error(int sig, siginfo_t* info, ucontext_t* ucontext)
{
    uint64_t rip = ucontext->uc_mcontext->__ss.__rip;

    log(
        "error: sig=%d, errno=%d, address=%p, rip=%p, patched=%d",
        sig,
        info->si_errno,
        info->si_addr,
        rip,
        m_patcher.isPatched(rip));
    printregs(ucontext);

/*
    if (rip > 4096 && rip < IMAGE_BASE && !m_patcher.isPatched(rip))
    {
        // HACK HACK HACK
        log("Failed in unpatched code! ATTEMPTING TO PATCH, THIS MIGHT FAIL");
        m_patcher.patch(ucontext->uc_mcontext->__ss.__rip);
        return;
    }
*/

    fprintf(stderr, "line: Received signal %d\n", sig);
    abort();
}

uint64_t LineProcess::getRegister(x86_reg_t reg, ucontext_t* ucontext)
{
    switch (reg.id)
    {
        case 0: return 0;
        case 1: return ucontext->uc_mcontext->__ss.__rax;
        case 2: return ucontext->uc_mcontext->__ss.__rcx;
        case 3: return ucontext->uc_mcontext->__ss.__rdx;
        case 4: return ucontext->uc_mcontext->__ss.__rbx;
        case 5: return ucontext->uc_mcontext->__ss.__rsp;
        case 6: return ucontext->uc_mcontext->__ss.__rbp;
        case 7: return ucontext->uc_mcontext->__ss.__rsi;
        case 8: return ucontext->uc_mcontext->__ss.__rdi;
        case 97: return ucontext->uc_mcontext->__ss.__r8;
        case 98: return ucontext->uc_mcontext->__ss.__r9;
        case 99: return ucontext->uc_mcontext->__ss.__r10;
        case 100: return ucontext->uc_mcontext->__ss.__r11;
        case 101: return ucontext->uc_mcontext->__ss.__r12;
        case 102: return ucontext->uc_mcontext->__ss.__r13;
        case 103: return ucontext->uc_mcontext->__ss.__r14;
        case 104: return ucontext->uc_mcontext->__ss.__r15;
        default:
            //log("patchCode: 0x%llx: %s: Unhandled register: %d", patchedAddr, insntype, target->data.reg.id);
            log("getregister: Unhandled register: %s, id=%d", reg.name, reg.id);
            exit(255);
            break;
    }
}

void LineProcess::trap(siginfo_t* info, ucontext_t* ucontext)
{
    uint8_t* addr = (uint8_t*)(ucontext->uc_mcontext->__ss.__rip - 1);

    if (m_line->getConfigTrace() && addr > (uint8_t*)IMAGE_BASE)
    {
        return;
    }

    if (m_line->getConfigTrace())
    {
        x86_insn_t insn;
        x86_disasm((unsigned char*)addr, 0x10000, (uint64_t)addr, 0, &insn );
        char line[4096];
        x86_format_insn(&insn, line, 4096, att_syntax);
        log("trace: %p: %s", addr, line);
    }
 
    if (*addr != 0xcc)
    {
        if (m_line->getConfigTrace())
        {
            return;
        }
        else
        {
            log("trap: %p: ERROR: Trap in non patched code");
            exit(255);
        }
    }

    uint64_t patchedAddr = ucontext->uc_mcontext->__ss.__rip - 1;
    Patch* patch = m_patcher.getPatch(patchedAddr);
    if (patch == NULL)
    {
        Logger::error("Invalid patch: address=%p", patchedAddr);
        x86_insn_t insn;
        x86_disasm((unsigned char*)addr, 0x10000, (uint64_t)addr, 0, &insn );
        char line[4096];
        x86_format_insn(&insn, line, 4096, att_syntax);
        log("trace: %p: %s", addr, line);
 
return;
    }

    switch (patch->type)
    {
        case PATCH_CALL:
        {
            const char* insntype;
            if (patch->insn.type == insn_jmp || patch->insn.type == insn_jcc)
            {
                insntype = "BRANCH";
            }
            else
            {
                insntype = "CALL";
            }

            x86_op_t* target = x86_get_branch_target(&(patch->insn));
            if (target->datatype == op_byte )
            {
                log("trap: 0x%llx: NEAR patched call/jmp!?", patchedAddr);
                exit(255);
            }

            // FAR !
            uint64_t targetAddr = 0;
            bool fixedTarget = false;

            // If a BRANCH, treat this like a RET, this is the end unless we have a JMP to a point after this
            //uint64_t addr = x86_get_address(target);
            log("trap: 0x%llx: %s: FAR: op=%p, type=%d", patchedAddr, insntype, target, target->type);

            switch (target->type)
            {
                case op_register:
                    log("trap: 0x%llx: %s: register: %d", patchedAddr, insntype, target->data.reg.id);
                    targetAddr = getRegister(target->data.reg, ucontext);
                    log("trap: 0x%llx: %s: register: targetAddr=0x%llx", patchedAddr, insntype, targetAddr);
                    break;
                case op_relative_far:
                    targetAddr = patch->insn.addr + target->data.relative_far + patch->insn.size;
                    fixedTarget = true;
                    log("trap: 0x%llx: %s: Relative FAR: 0x%llx", patchedAddr, insntype, targetAddr);
                    break;
                case op_expression:
                    log("trap: 0x%llx: %s: scale=%d, index=%s (%d), base=%s, disp=%d",
                        patchedAddr,
                        insntype,
                        target->data.expression.scale,
                        target->data.expression.index.name,
                        target->data.expression.index.type,
                        target->data.expression.base.name,
                        target->data.expression.disp);
                    if (target->data.expression.scale == 0 &&
                        target->data.expression.index.type == 0 &&
                        target->data.expression.base.type == reg_pc &&
                        target->data.expression.disp != 0)
                    {
                        uint64_t* ea = (uint64_t*)(patch->insn.addr + patch->insn.size + target->data.expression.disp);

                        log("trap: 0x%llx: %s: Relative to IP, ea: %p", patchedAddr, insntype, ea);
                        targetAddr = *ea;
                        log("trap: 0x%llx: %s: Relative to IP, value: 0x%llx", patchedAddr, insntype, targetAddr);
                        fixedTarget = true;
                    }
                    else
                    {
                        int64_t index = getRegister(target->data.expression.index, ucontext);
                        int64_t base = getRegister(target->data.expression.base, ucontext);

                        log("trap: 0x%llx: %s: index=0x%llx, base=0x%llx", patchedAddr, insntype, index, base);
                        uint64_t* ea = (uint64_t*)(targetAddr = base + (index * target->data.expression.scale) + target->data.expression.disp);
                        log("trap: 0x%llx: %s: ea=0x%llx", patchedAddr, insntype, ea);
                        targetAddr = *ea;
                        log("trap: 0x%llx: %s: targetAddr=0x%llx", patchedAddr, insntype, targetAddr);
//exit(255);
                    }
                    break;

                default:
                    log("trap: 0x%llx: %s: Unhandled type: %d", patchedAddr, insntype, target->type);
                    exit(255);
            }

            if (targetAddr < 1024)
            {
                log("trap: 0x%llx: %s: targetAddr is in zero page!", patchedAddr, insntype);
                exit(255);
            }

            bool isPatched = m_patcher.isPatched(targetAddr);
            log("trap: PATCH_CALL: targetAddr=0x%llx, isPatched=%d", targetAddr, isPatched);
            if (!isPatched)
            {
                m_patcher.patch(targetAddr);
            }

            if (fixedTarget)
            {
                *((uint8_t*)patchedAddr) = patch->patchedByte;
                ucontext->uc_mcontext->__ss.__rip--;
            }
            else
            {
                ucontext->uc_mcontext->__ss.__rip = targetAddr;
                if (patch->insn.type == insn_jmp)
                {
                    // No return address
                }
                else if (patch->insn.type == insn_jcc)
                {
                    log("trap: PATCH_CALL: A BRANCHCC without a fixed target!?");

                    exit(255);
                }
                else
                {
                    // Push the return address on to the stack
                    ucontext->uc_mcontext->__ss.__rsp -= 8;

                    uint64_t* stack = (uint64_t*)ucontext->uc_mcontext->__ss.__rsp;
                    uint64_t returnAddr = patch->insn.addr + patch->insn.size;
                    *stack = returnAddr;
                    log("trap: PATCH_CALL: Calling a non fixed address 0x%llx: returnAddr=%p", targetAddr, returnAddr);
                }
            }
        } break;

        case PATCH_SYSCALL:
        {
            int syscall = ucontext->uc_mcontext->__ss.__rax;
#ifdef DEBUG
            log("trap: PATCH_SYSCALL: Syscall: %lld",  syscall);
#endif
            getKernel()->syscall(syscall, ucontext);

            // Skip it!
            ucontext->uc_mcontext->__ss.__rip++;
        } break;

        case PATCH_FS:
        {
#ifdef DEBUG
            log("trap: PATCH_FS");
#endif
            execFSInstruction((uint8_t*)(patchedAddr + 1), patch->patchedByte, ucontext);
        } break;

        default:
            log("trap: Unhandled patch type: type=%d", patch->type);
            exit(255);
    }
}

LineThread* LineProcess::getCurrentThread()
{
    pthread_t self = pthread_self();
    map<pthread_t, LineThread*>::iterator it;
    it = m_threads.find(self);
    if (it != m_threads.end())
    {
        return it->second;
    }
    return NULL;
}

void LineProcess::setSingleStep(LineThread* thread, bool enable)
{
    int res;

    // Get ELF Thread port
    task_t port = thread->getTask();

    /*
     * Set the Trace flag on the child
     */

    // Get current state
    x86_thread_state_t gp_regs;
    unsigned int gp_count = x86_THREAD_STATE_COUNT;
    res = thread_get_state(port, x86_THREAD_STATE, (thread_state_t)&gp_regs, &gp_count);
    if (res != 0)
    {
        int err = errno;
        log("setSingleStep: Failed to get thread state: res=%d, err=%d", res, err);
        exit(1);
    }

    // Set Single Step flags in eflags
    if (enable)
    {
        gp_regs.uts.ts64.__rflags |= X86_EFLAGS_T;
    }
    else
    {
        gp_regs.uts.ts64.__rflags &= ~X86_EFLAGS_T;
    }

    res = thread_set_state(
        port,
        x86_THREAD_STATE,
        (thread_state_t) &gp_regs,
        gp_count);

    if (res != 0)
    {
        int err = errno;
        log("setSingleStep: Failed to set thread state: res=%d, err=%d", res, err);
        exit(1);
    }
}

void LineProcess::checkSingleStep()
{
    task_t port = mach_thread_self();

    /*
     * Set the Trace flag on the child
     */

    // Get current state
    x86_thread_state_t gp_regs;
    unsigned int gp_count = x86_THREAD_STATE_COUNT;
    int res = thread_get_state(port, x86_THREAD_STATE, (thread_state_t)&gp_regs, &gp_count);
    if (res != 0)
    {
        int err = errno;
        log("checkSingleStep: Failed to get thread state: res=%d, err=%d", res, err);
        exit(1);
    }
    log("checkSingleStep: rflags=0x%llx, T=%d", gp_regs.uts.ts64.__rflags, !!(gp_regs.uts.ts64.__rflags & X86_EFLAGS_T));
}

bool LineProcess::request(ProcessRequest* request)
{
#ifdef DEBUG
    log("request: Adding request...");
#endif

    // Add the request to the queue
    pthread_mutex_lock(&m_requestMutex);
    m_requests.push_back(request);
    pthread_mutex_unlock(&m_requestMutex);

    // Tell the request thread that there's a request waiting
    pthread_cond_signal(&m_requestCond);

    // Wait for the request to be handled
    request->thread->waitForProcess();

    return true;
}

bool LineProcess::requestSingleStep(LineThread* thread, bool enable)
{
    ProcessRequestSingleStep* req = new ProcessRequestSingleStep();
    req->type = REQUEST_SINGLESTEP;
    req->thread = thread;
    req->enable = enable;

    return request(req);
}

LineProcess* LineProcess::getProcess()
{
    return g_process;
}