Fixes for OSX instrumentation

1 files changed, 166 insertions, 56 deletions

diff --git a/frida_mode/src/instrument/instrument_x64.c b/frida_mode/src/instrument/instrument_x64.c
index 41162f2a..b51cb697 100644
--- a/frida_mode/src/instrument/instrument_x64.c
+++ b/frida_mode/src/instrument/instrument_x64.c
@@ -45,7 +45,9 @@ static gboolean instrument_coverage_in_range(gssize offset) {
 
 }
 
-  #pragma pack(push, 1)
+  #ifdef __APPLE__
+    #pragma pack(push, 1)
+
 typedef struct {
 
   // cur_location = (block_address >> 4) ^ (block_address << 8);
@@ -58,7 +60,7 @@ typedef struct {
   //  mov    QWORD PTR [rsp-0x90],rbx
   //  mov    eax,DWORD PTR [rip+0x333d5a]        # 0x7ffff6ff2740
   //  mov    DWORD PTR [rip+0x333d3c],0x9fbb        # 0x7ffff6ff2740
-  //  xor    eax,0x103f77
+  //  lea    rax,[rip + 0x103f77]
   //  mov    bl,BYTE PTR [rax]
   //  add    bl,0x1
   //  adc    bl,0x0
@@ -76,7 +78,7 @@ typedef struct {
   uint8_t mov_eax_prev_loc[6];
   uint8_t mov_prev_loc_curr_loc_shr1[10];
 
-  uint8_t xor_eax_curr_loc[5];
+  uint8_t leax_eax_curr_loc[7];
 
   uint8_t mov_rbx_ptr_rax[2];
   uint8_t add_bl_1[3];
@@ -90,14 +92,81 @@ typedef struct {
 
 } afl_log_code_asm_t;
 
-  #pragma pack(pop)
+    #pragma pack(pop)
 
-typedef union {
+static const afl_log_code_asm_t template =
+    {
 
-  afl_log_code_asm_t code;
-  uint8_t            bytes[0];
+        .mov_rax_rsp_88 = {0x48, 0x89, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
+        .lahf = 0x9f,
+        .mov_rax_rsp_90 = {0x48, 0x89, 0x84, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
+        .mov_rbx_rsp_98 = {0x48, 0x89, 0x9C, 0x24, 0x68, 0xFF, 0xFF, 0xFF},
 
-} afl_log_code;
+        .mov_eax_prev_loc = {0x8b, 0x05},
+        .mov_prev_loc_curr_loc_shr1 = {0xc7, 0x05},
+
+        .leax_eax_curr_loc = {0x48, 0x8d, 0x05},
+        .mov_rbx_ptr_rax = {0x8a, 0x18},
+        .add_bl_1 = {0x80, 0xc3, 0x01},
+        .adc_bl_0 = {0x80, 0xd3, 0x00},
+        .mov_ptr_rax_rbx = {0x88, 0x18},
+
+        .mov_rsp_98_rbx = {0x48, 0x8B, 0x9C, 0x24, 0x68, 0xFF, 0xFF, 0xFF},
+        .mov_rsp_90_rax = {0x48, 0x8B, 0x84, 0x24, 0x70, 0xFF, 0xFF, 0xFF},
+        .sahf = 0x9e,
+        .mov_rsp_88_rax = {0x48, 0x8B, 0x84, 0x24, 0x78, 0xFF, 0xFF, 0xFF},
+
+}
+
+;
+
+  #else
+    #pragma pack(push, 1)
+typedef struct {
+
+  // cur_location = (block_address >> 4) ^ (block_address << 8);
+  // shared_mem[cur_location ^ prev_location]++;
+  // prev_location = cur_location >> 1;
+
+  //  mov    QWORD PTR [rsp-0x80],rax
+  //  lahf
+  //  mov    QWORD PTR [rsp-0x88],rax
+  //  mov    QWORD PTR [rsp-0x90],rbx
+  //  mov    eax,DWORD PTR [rip+0x333d5a]        # 0x7ffff6ff2740
+  //  mov    DWORD PTR [rip+0x333d3c],0x9fbb        # 0x7ffff6ff2740
+  //  xor    eax,0x103f77
+  //  mov    bl,BYTE PTR [rax]
+  //  add    bl,0x1
+  //  adc    bl,0x0
+  //  mov    BYTE PTR [rax],bl
+  //  mov    rbx,QWORD PTR [rsp-0x90]
+  //  mov    rax,QWORD PTR [rsp-0x88]
+  //  sahf
+  //  mov    rax,QWORD PTR [rsp-0x80]
+
+  uint8_t mov_rax_rsp_88[8];
+  uint8_t lahf;
+  uint8_t mov_rax_rsp_90[8];
+  uint8_t mov_rbx_rsp_98[8];
+
+  uint8_t mov_eax_prev_loc[6];
+  uint8_t mov_prev_loc_curr_loc_shr1[10];
+
+  uint8_t xor_eax_curr_loc[5];
+
+  uint8_t mov_rbx_ptr_rax[2];
+  uint8_t add_bl_1[3];
+  uint8_t adc_bl_0[3];
+  uint8_t mov_ptr_rax_rbx[2];
+
+  uint8_t mov_rsp_98_rbx[8];
+  uint8_t mov_rsp_90_rax[8];
+  uint8_t sahf;
+  uint8_t mov_rsp_88_rax[8];
+
+} afl_log_code_asm_t;
+
+    #pragma pack(pop)
 
 static const afl_log_code_asm_t template =
     {
@@ -124,6 +193,22 @@ static const afl_log_code_asm_t template =
 }
 
 ;
+  #endif
+
+typedef union {
+
+  afl_log_code_asm_t code;
+  uint8_t            bytes[0];
+
+} afl_log_code;
+
+  #ifdef __APPLE__
+
+void instrument_coverage_optimize_init(void) {
+
+}
+
+  #else
 
 static gboolean instrument_coverage_find_low(const GumRangeDetails *details,
                                              gpointer               user_data) {
@@ -181,10 +266,10 @@ static void instrument_coverage_optimize_map_mmap(char *   shm_file_path,
 
   __afl_area_ptr = NULL;
 
-  #if !defined(__ANDROID__)
+    #if !defined(__ANDROID__)
   shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
   if (shm_fd == -1) { FATAL("shm_open() failed\n"); }
-  #else
+    #else
   shm_fd = open("/dev/ashmem", O_RDWR);
   if (shm_fd == -1) { FATAL("open() failed\n"); }
   if (ioctl(shm_fd, ASHMEM_SET_NAME, shm_file_path) == -1) {
@@ -199,7 +284,7 @@ static void instrument_coverage_optimize_map_mmap(char *   shm_file_path,
 
   }
 
-  #endif
+    #endif
 
   __afl_area_ptr = mmap(address, __afl_map_size, PROT_READ | PROT_WRITE,
                         MAP_FIXED_NOREPLACE | MAP_SHARED, shm_fd, 0);
@@ -231,51 +316,6 @@ static void instrument_coverage_optimize_map_shm(guint64  shm_env_val,
 
 }
 
-static void instrument_coverage_switch(GumStalkerObserver *self,
-                                       gpointer            start_address,
-                                       const cs_insn *     from_insn,
-                                       gpointer *          target) {
-
-  UNUSED_PARAMETER(self);
-  UNUSED_PARAMETER(start_address);
-
-  cs_x86 *   x86;
-  cs_x86_op *op;
-  if (from_insn == NULL) { return; }
-
-  x86 = &from_insn->detail->x86;
-  op = x86->operands;
-
-  if (!g_hash_table_contains(coverage_blocks, GSIZE_TO_POINTER(*target))) {
-
-    return;
-
-  }
-
-  switch (from_insn->id) {
-
-    case X86_INS_CALL:
-    case X86_INS_JMP:
-      if (x86->op_count != 1) {
-
-        FATAL("Unexpected operand count: %d", x86->op_count);
-
-      }
-
-      if (op[0].type != X86_OP_IMM) { return; }
-
-      break;
-    case X86_INS_RET:
-      break;
-    default:
-      return;
-
-  }
-
-  *target = (guint8 *)*target + sizeof(afl_log_code);
-
-}
-
 void instrument_coverage_optimize_init(void) {
 
   gpointer low_address = NULL;
@@ -324,6 +364,53 @@ void instrument_coverage_optimize_init(void) {
 
 }
 
+  #endif
+
+static void instrument_coverage_switch(GumStalkerObserver *self,
+                                       gpointer            start_address,
+                                       const cs_insn *     from_insn,
+                                       gpointer *          target) {
+
+  UNUSED_PARAMETER(self);
+  UNUSED_PARAMETER(start_address);
+
+  cs_x86 *   x86;
+  cs_x86_op *op;
+  if (from_insn == NULL) { return; }
+
+  x86 = &from_insn->detail->x86;
+  op = x86->operands;
+
+  if (!g_hash_table_contains(coverage_blocks, GSIZE_TO_POINTER(*target))) {
+
+    return;
+
+  }
+
+  switch (from_insn->id) {
+
+    case X86_INS_CALL:
+    case X86_INS_JMP:
+      if (x86->op_count != 1) {
+
+        FATAL("Unexpected operand count: %d", x86->op_count);
+
+      }
+
+      if (op[0].type != X86_OP_IMM) { return; }
+
+      break;
+    case X86_INS_RET:
+      break;
+    default:
+      return;
+
+  }
+
+  *target = (guint8 *)*target + sizeof(afl_log_code);
+
+}
+
 static void instrument_coverage_suppress_init(void) {
 
   static gboolean initialized = false;
@@ -405,12 +492,35 @@ void instrument_coverage_optimize(const cs_insn *   instr,
 
   *((gint *)&code.bytes[prev_loc_value_offset2]) = (gint)prev_loc_value2;
 
+  #ifdef __APPLE__
+
+  gssize xor_curr_loc_offset = offsetof(afl_log_code, code.leax_eax_curr_loc) +
+                               sizeof(code.code.leax_eax_curr_loc) -
+                               sizeof(guint32);
+
+  gssize xor_curr_loc_value =
+      ((GPOINTER_TO_SIZE(__afl_area_ptr) | area_offset) -
+       (code_addr + offsetof(afl_log_code, code.mov_eax_prev_loc) +
+        sizeof(code.code.mov_eax_prev_loc)));
+
+  if (!instrument_coverage_in_range(xor_curr_loc_value)) {
+
+    FATAL("Patch out of range (xor_curr_loc_value): 0x%016lX",
+          xor_curr_loc_value);
+
+  }
+
+  *((guint32 *)&code.bytes[xor_curr_loc_offset]) = xor_curr_loc_value;
+
+  #else
+
   gssize xor_curr_loc_offset = offsetof(afl_log_code, code.xor_eax_curr_loc) +
                                sizeof(code.code.xor_eax_curr_loc) -
                                sizeof(guint32);
 
   *((guint32 *)&code.bytes[xor_curr_loc_offset]) =
       (guint32)(GPOINTER_TO_SIZE(__afl_area_ptr) | area_offset);
+  #endif
 
   gum_x86_writer_put_bytes(cw, code.bytes, sizeof(afl_log_code));