one_gadget 1.6.2 → 1.7.4

data/lib/one_gadget/emulators/x86.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'one_gadget/emulators/instruction'
 require 'one_gadget/emulators/lambda'
 require 'one_gadget/emulators/processor'
@@ -7,19 +9,10 @@ module OneGadget
   module Emulators
     # Super class for amd64 and i386 processor.
     class X86 < Processor
-      attr_reader :sp # @return [String] Stack pointer.
-      attr_reader :pc # @return [String] Program counter.
       # Constructor for a x86 processor.
       def initialize(registers, sp, pc)
-        super(registers)
-        @sp = sp
+        super(registers, sp)
         @pc = pc
-        @stack = Hash.new do |h, k|
-          h[k] = OneGadget::Emulators::Lambda.new(sp).tap do |lmda|
-            lmda.immi = k
-            lmda.deref!
-          end
-        end
       end
 
       # Process one command.
@@ -27,6 +20,7 @@ module OneGadget
       # @param [String] cmd
       #   One line from result of objdump.
       # @return [Boolean]
+      #   If successfully processed.
       def process!(cmd)
         inst, args = parse(cmd)
         # return registers[pc] = args[0] if inst.inst == 'call'
@@ -36,16 +30,6 @@ module OneGadget
         __send__(sym, *args) != :fail
       end
 
-      # Process one command, without raising any exceptions.
-      # @param [String] cmd
-      #   See {#process!} for more information.
-      # @return [Boolean]
-      def process(cmd)
-        process!(cmd)
-      rescue OneGadget::Error::Error
-        false
-      end
-
       # Supported instruction set.
       # @return [Array<Instruction>] The supported instructions.
       def instructions
@@ -65,133 +49,112 @@ module OneGadget
         ]
       end
 
-      class << self
-        # 32 or 64.
-        # @return [Integer] 32 or 64.
-        def bits; raise NotImplementedError
-        end
-      end
-
-      # To be inherited.
-      #
-      # @param [Integer] _idx
-      #   The idx-th argument.
-      #
-      # @return [Lambda, Integer]
-      #   Return value can be a {Lambda} or an +Integer+.
-      def argument(_idx); raise NotImplementedError
-      end
-
       private
 
-      def register?(reg)
-        registers.include?(reg)
-      end
-
-      def inst_mov(tar, src)
+      def inst_mov(dst, src)
         src = OneGadget::Emulators::Lambda.parse(src, predefined: registers)
-        if register?(tar)
-          registers[tar] = src
+        if register?(dst)
+          registers[dst] = src
         else
           # Just ignore strange case...
-          return unless tar.include?(sp)
+          # TODO(david942j): #120
+          return add_writable(dst) unless dst.include?(sp)
 
-          tar = OneGadget::Emulators::Lambda.parse(tar, predefined: registers)
-          return if tar.deref_count != 1 # should not happen
+          dst = OneGadget::Emulators::Lambda.parse(dst, predefined: registers)
+          return if dst.deref_count != 1 # should not happen
 
-          tar.ref!
-          stack[tar.evaluate(eval_dict)] = src
+          dst.ref!
+          stack[dst.evaluate(eval_dict)] = src
         end
       end
 
       # This instruction moves 128bits.
-      def inst_movaps(tar, src)
+      def inst_movaps(dst, src)
         # XXX: here we only support `movaps [sp+*], xmm*`
-        # TODO: This need an extra constraint: sp & 0xf == 0
-        src, tar = check_xmm_sp(src, tar) { raise_unsupported('movaps', tar, src) }
-        off = tar.evaluate(eval_dict)
+        src, dst = check_xmm_sp(src, dst) { raise_unsupported('movaps', dst, src) }
+        off = dst.evaluate(eval_dict)
+        @constraints << [:raw, "#{sp} & 0xf == #{0x10 - off & 0xf}"]
         (128 / self.class.bits).times do |i|
           stack[off + i * size_t] = src[i]
         end
       end
 
-      # Mov *src to tar[:64]
-      def inst_movq(tar, src)
+      # Move *src to dst[:64]
+      def inst_movq(dst, src)
         # XXX: here we only support `movq xmm*, [sp+*]`
-        tar, src = check_xmm_sp(tar, src) { raise_unsupported('movq', tar, src) }
+        dst, src = check_xmm_sp(dst, src) { raise_unsupported('movq', dst, src) }
         off = src.evaluate(eval_dict)
         (64 / self.class.bits).times do |i|
-          tar[i] = stack[off + i * size_t]
+          dst[i] = stack[off + i * size_t]
         end
       end
 
-      # Move *src to tar[64:128]
-      def inst_movhps(tar, src)
+      # Move *src to dst[64:128]
+      def inst_movhps(dst, src)
         # XXX: here we only support `movhps xmm*, [sp+*]`
-        tar, src = check_xmm_sp(tar, src) { raise_unsupported('movhps', tar, src) }
+        dst, src = check_xmm_sp(dst, src) { raise_unsupported('movhps', dst, src) }
         off = src.evaluate(eval_dict)
         (64 / self.class.bits).times do |i|
-          tar[i + 64 / self.class.bits] = stack[off + i * size_t]
+          dst[i + 64 / self.class.bits] = stack[off + i * size_t]
         end
       end
 
-      # check if (tar, src) in form (xmm*, [sp+*])
-      def check_xmm_sp(tar, src)
-        return yield unless tar.start_with?('xmm') && register?(tar) && src.include?(sp)
+      # check if (dst, src) in form (xmm*, [sp+*])
+      def check_xmm_sp(dst, src)
+        return yield unless dst.start_with?('xmm') && register?(dst) && src.include?(sp)
 
-        tar_lm = OneGadget::Emulators::Lambda.parse(tar, predefined: registers)
+        dst_lm = OneGadget::Emulators::Lambda.parse(dst, predefined: registers)
         src_lm = OneGadget::Emulators::Lambda.parse(src, predefined: registers)
         return yield if src_lm.deref_count != 1
 
         src_lm.ref!
-        [tar_lm, src_lm]
+        [dst_lm, src_lm]
       end
 
-      def inst_lea(tar, src)
+      def inst_lea(dst, src)
+        check_register!(dst)
+
         src = OneGadget::Emulators::Lambda.parse(src, predefined: registers)
         src.ref!
-        registers[tar] = src
+        registers[dst] = src
       end
 
       def inst_push(val)
         val = OneGadget::Emulators::Lambda.parse(val, predefined: registers)
         registers[sp] -= size_t
         cur_top = registers[sp].evaluate(eval_dict)
-        raise Error::ArgumentError, "Corrupted stack pointer: #{cur_top}" unless cur_top.is_a?(Integer)
+        raise Error::InstructionArgumentError, "Corrupted stack pointer: #{cur_top}" unless cur_top.is_a?(Integer)
 
         stack[cur_top] = val
       end
 
       def inst_xor(dst, src)
+        check_register!(dst)
+
         # only supports dst == src
-        raise Error::ArgumentError, 'xor operator only supports dst = src' unless dst == src
+        raise Error::UnsupportedInstructionArgumentError, 'xor operator only supports dst = src' unless dst == src
 
         dst[0] = 'r' if self.class.bits == 64 && dst.start_with?('e')
         registers[dst] = 0
       end
 
-      def inst_add(tar, src)
+      def inst_add(dst, src)
+        check_register!(dst)
+
         src = OneGadget::Emulators::Lambda.parse(src, predefined: registers)
-        registers[tar] += src
+        registers[dst] += src
       end
 
-      def inst_sub(tar, src)
+      def inst_sub(dst, src)
         src = OneGadget::Emulators::Lambda.parse(src, predefined: registers)
-        raise Error::ArgumentError, "Can't handle -= of type #{src.class}" unless src.is_a?(Integer)
+        raise Error::UnsupportedInstructionArgumentError, "Unhandled -= of type #{src.class}" unless src.is_a?(Integer)
 
-        registers[tar] -= src
+        registers[dst] -= src
       end
 
       # yap, nop
       def inst_nop(*); end
 
-      def check_argument(idx, expect)
-        case expect
-        when :global then argument(idx).to_s.include?(pc) # easy check
-        when :zero? then argument(idx).is_a?(Integer) && argument(idx).zero?
-        end
-      end
-
       # Handle some valid calls.
       # For example, +sigprocmask+ will always be a valid call
       # because it just invokes syscall.
@@ -203,8 +166,8 @@ module OneGadget
         checker = {
           'sigprocmask' => {},
           '__close' => {},
-          'unsetenv' => { 0 => :global },
-          '__sigaction' => { 1 => :global, 2 => :zero? }
+          'unsetenv' => { 0 => :global_var? },
+          '__sigaction' => { 1 => :global_var?, 2 => :zero? }
         }
         func = checker.keys.find { |n| addr.include?(n) }
         return if func && checker[func].all? { |idx, sym| check_argument(idx, sym) }
@@ -213,16 +176,12 @@ module OneGadget
         :fail
       end
 
-      def size_t
-        self.class.bits / 8
-      end
-
-      def eval_dict
-        { sp => 0 }
-      end
+      def add_writable(dst)
+        lmda = OneGadget::Emulators::Lambda.parse(dst, predefined: registers).ref!
+        # pc-relative addresses should be writable
+        return if lmda.obj == pc
 
-      def raise_unsupported(inst, *args)
-        raise OneGadget::Error::UnsupportedInstructionArgumentsError, "#{inst} #{args.join(', ')}"
+        @constraints << [:writable, lmda]
       end
 
       def to_lambda(reg)

data/lib/one_gadget/error.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module OneGadget
   # OneGadget errors.
   module Error
@@ -5,12 +7,24 @@ module OneGadget
     class Error < StandardError
     end
 
-    # Unsupported arguments of intructions.
-    class UnsupportedInstructionArgumentsError < Error
+    # Super class of unsupported errors.
+    class UnsupportedError < Error
+    end
+
+    # Unsupported instruction.
+    class UnsupportedInstructionError < UnsupportedError
+    end
+
+    # Raises when arguments form of an instruction is invalid.
+    class InstructionArgumentError < Error
+    end
+
+    # Raises when form of arguments is valid but not supported.
+    class UnsupportedInstructionArgumentError < UnsupportedError
     end
 
     # Unsupported architecture.
-    class UnsupportedArchitectureError < Error
+    class UnsupportedArchitectureError < UnsupportedError
     end
 
     # Argument error of ruby methods.

data/lib/one_gadget/fetcher.rb

@@ -1,4 +1,7 @@
+# frozen_string_literal: true
+
 require 'one_gadget/error'
+require 'one_gadget/fetchers/aarch64'
 require 'one_gadget/fetchers/amd64'
 require 'one_gadget/fetchers/i386'
 require 'one_gadget/gadget'
@@ -27,6 +30,7 @@ module OneGadget
       def from_file(file)
         arch = OneGadget::Helper.architecture(file)
         klass = {
+          aarch64: OneGadget::Fetcher::AArch64,
           amd64: OneGadget::Fetcher::Amd64,
           i386: OneGadget::Fetcher::I386
         }[arch]
@@ -46,7 +50,7 @@ module OneGadget
             (gadgets[j].constraints - g.constraints).empty?
           end
         end
-        res.sort_by!(&:offset)
+        res.sort_by(&:offset)
       end
     end
     extend ClassMethods

data/lib/one_gadget/fetchers/aarch64.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'one_gadget/emulators/aarch64'
+require 'one_gadget/fetchers/base'
+
+module OneGadget
+  module Fetcher
+    # Define common methods for gadget fetchers.
+    class AArch64 < Base
+      private
+
+      def emulator
+        OneGadget::Emulators::AArch64.new
+      end
+
+      # If str contains a branch instruction.
+      def branch?(str)
+        %w[b b.hi b.gt b.eq b.le b.ls b.lt b.ne b.cs].any? { |f| str.include?(" #{f} ") }
+      end
+
+      def call_str
+        'bl'
+      end
+
+      def bin_sh_offset
+        @bin_sh_offset ||= str_offset('/bin/sh')
+      end
+
+      def str_bin_sh?(str)
+        str.include?('$base') && str.include?(bin_sh_offset.to_s(16))
+      end
+
+      def str_sh?(str)
+        # XXX: hardcode -0x10 is bad
+        str.include?('$base') && str.include?((bin_sh_offset - 0x10).to_s(16))
+      end
+
+      def global_var?(str)
+        str.include?('$base')
+      end
+    end
+  end
+end

data/lib/one_gadget/fetchers/amd64.rb

@@ -1,10 +1,12 @@
+# frozen_string_literal: true
+
 require 'one_gadget/emulators/amd64'
-require 'one_gadget/fetchers/base'
+require 'one_gadget/fetchers/x86'
 
 module OneGadget
   module Fetcher
     # Fetcher for amd64.
-    class Amd64 < OneGadget::Fetcher::Base
+    class Amd64 < OneGadget::Fetcher::X86
       private
 
       def emulator
@@ -30,14 +32,16 @@ module OneGadget
       #   ...
       #   call execve
       def jmp_case_candidates
-        `#{objdump_cmd}|egrep 'rdi.*# #{bin_sh_hex}' -A 3`.split('--').map do |cand|
+        `#{@objdump.command}|egrep 'rdi.*# #{bin_sh_hex}' -A 3`.split('--').map do |cand|
           cand = cand.lines.map(&:strip).reject(&:empty?)
           jmp_at = cand.index { |c| c.include?('jmp') }
           next nil if jmp_at.nil?
 
           cand = cand[0..jmp_at]
+          next if cand.any? { |c| c.include?(call_str) }
+
           jmp_addr = cand.last.scan(/jmp\s+([\da-f]+)\s/)[0][0].to_i(16)
-          dump = `#{objdump_cmd(start: jmp_addr, stop: jmp_addr + 100)}|egrep '[0-9a-f]+:'`
+          dump = `#{@objdump.command(start: jmp_addr, stop: jmp_addr + 100)}|egrep '[0-9a-f]+:'`
           remain = dump.lines.map(&:strip).reject(&:empty?)
           remain = remain[0..remain.index { |r| r.match(/call.*<execve[^+]*>/) }]
           [cand + remain].join("\n")

data/lib/one_gadget/fetchers/base.rb

@@ -1,4 +1,7 @@
-require 'shellwords'
+# frozen_string_literal: true
+
+require 'one_gadget/error'
+require 'one_gadget/fetchers/objdump'
 
 module OneGadget
   module Fetcher
@@ -7,10 +10,14 @@ module OneGadget
       # The absolute path of glibc.
       # @return [String] The filename.
       attr_reader :file
+
       # Instantiate a fetcher object.
       # @param [String] file Absolute path of target libc.
       def initialize(file)
         @file = file
+        arch = self.class.name.split('::').last.downcase.to_sym
+        @objdump = Objdump.new(file, arch)
+        @objdump.extra_options = objdump_options
       end
 
       # Do find gadgets in glibc.
@@ -26,10 +33,10 @@ module OneGadget
             next if options.nil? # impossible be a gadget
 
             offset = offset_of(lines[i])
-            gadgets << OneGadget::Gadget::Gadget.new(offset, options)
+            gadgets << OneGadget::Gadget::Gadget.new(offset, **options)
           end
           gadgets
-        end.flatten.compact
+        end.flatten
       end
 
       # Fetch candidates that end with call exec*.
@@ -42,8 +49,17 @@ module OneGadget
       # @return [Array<String>]
       #   Each +String+ returned is multi-lines of assembly code.
       def candidates(&block)
-        cands = `#{objdump_cmd}|egrep 'call.*<exec[^+]*>$' -B 30`.split('--').map do |cand|
-          cand.lines.map(&:strip).reject(&:empty?).join("\n")
+        call_regexp = "#{call_str}.*<exec[^+]*>$"
+        cands = []
+        `#{@objdump.command}|egrep '#{call_regexp}' -B 30`.split('--').each do |cand|
+          lines = cand.lines.map(&:strip).reject(&:empty?)
+          # split with call_regexp
+          loop do
+            idx = lines.index { |l| l =~ /#{call_regexp}/ }
+            break if idx.nil?
+
+            cands << lines.shift(idx + 1).join("\n")
+          end
         end
         # remove all jmps
         cands = slice_prefix(cands, &method(:branch?))
@@ -83,7 +99,7 @@ module OneGadget
         # arg[2] == NULL || [arg[2]] == NULL || arg[2] == envp
         arg1 = processor.argument(1).to_s
         arg2 = processor.argument(2).to_s
-        cons = []
+        cons = processor.constraints
         cons << check_execve_arg(processor, arg1)
         return nil unless cons.all?
 
@@ -134,8 +150,9 @@ module OneGadget
         return nil if global_var?(arg) # we don't want base-related constraints
 
         args << arg
+        cons = processor.constraints + ["#{arg} == NULL"]
         # now arg is the constraint.
-        { constraints: ["#{arg} == NULL"], effect: %(execl("/bin/sh", #{args.join(', ')})) }
+        { constraints: cons, effect: %(execl("/bin/sh", #{args.join(', ')})) }
       end
 
       def global_var?(_str); raise NotImplementedError
@@ -147,6 +164,9 @@ module OneGadget
       def str_sh?(_str); raise NotImplementedError
       end
 
+      def call_str; raise NotImplementedError
+      end
+
       def emulate(cmds)
         cmds.each_with_object(emulator) { |cmd, obj| break obj unless obj.process(cmd) }
       end
@@ -154,30 +174,26 @@ module OneGadget
       def emulator; raise NotImplementedError
       end
 
-      def objdump_cmd(start: nil, stop: nil)
-        cmd = %(objdump --no-show-raw-insn -w -d -M intel #{::Shellwords.escape(file)})
-        cmd.concat(" --start-address #{start}") if start
-        cmd.concat(" --stop-address #{stop}") if stop
-        cmd
+      def objdump_options
+        []
       end
 
-      def slice_prefix(cands)
+      def slice_prefix(cands, &block)
         cands.map do |cand|
           lines = cand.lines
-          to_rm = lines[0...-1].rindex { |c| yield(c) }
+          to_rm = lines[0...-1].rindex(&block)
           lines = lines[to_rm + 1..-1] unless to_rm.nil?
           lines.join
         end
       end
 
       # If str contains a branch instruction.
-      def branch?(str)
-        %w(jmp je jne jl jb ja jg).any? { |f| str.include?(f) }
+      def branch?(_str); raise NotImplementedError
       end
 
       def str_offset(str)
-        IO.binread(file).index(str + "\x00") ||
-          raise(Error::ArgumentError, "File #{file.inspect} doesn't contain string \"/bin/sh\", not glibc?")
+        IO.binread(file).index("#{str}\x00") ||
+          raise(Error::ArgumentError, "File #{file.inspect} doesn't contain string #{str.inspect}, not glibc?")
       end
 
       def offset_of(assembly)