Skip to content

nyx.h hprintf buffer issue fix #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
azanegin wants to merge 2 commits into
base: main
Choose a base branch
from
Open

nyx.h hprintf buffer issue fix #21

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ef1362e
new hprintf logic, proper retval handling in alloc_hprintf_buffer
azanegin Nov 7, 2022
7c7bd1f
add: hprintf function comment
azanegin Nov 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 50 additions & 19 deletions nyx.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,36 +235,67 @@ static inline uint64_t kAFL_hypercall(uint64_t rbx, uint64_t rcx){

//extern uint8_t* hprintf_buffer;

static inline uint8_t alloc_hprintf_buffer(uint8_t** hprintf_buffer){
if(!*hprintf_buffer){
static inline uint8_t alloc_hprintf_buffer(uint8_t** hprintf_buffer)
{
if (!*hprintf_buffer)
{
#ifdef __MINGW64__
*hprintf_buffer = (uint8_t*)VirtualAlloc(0, HPRINTF_MAX_SIZE, MEM_COMMIT, PAGE_READWRITE);
#else
*hprintf_buffer = (uint8_t*)mmap((void*)NULL, HPRINTF_MAX_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
*hprintf_buffer = (uint8_t*)VirtualAlloc(0, HPRINTF_MAX_SIZE, MEM_COMMIT, PAGE_READWRITE);
if (NULL == *hprintf_buffer) {
return 0;
}
#else
*hprintf_buffer = (uint8_t*)mmap((void*)NULL, HPRINTF_MAX_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (MAP_FAILED == *hprintf_buffer) {
*hprintf_buffer = NULL;
return 0;
}
#endif
if(!*hprintf_buffer){
return 0;
}
}
return 1;
}
return 1;
}

#ifdef __NOKAFL
int (*hprintf)(const char * format, ...) = printf;
#else
static void hprintf(const char * format, ...) __attribute__ ((unused));

static void hprintf(const char * format, ...){
static uint8_t* hprintf_buffer = NULL;
static int hprintf(const char * format, ...) __attribute__ ((unused));

/* sends limited-size formatted text message to fuzz-hypervisor
* most likely for logging/printing on a text console
* it should be signature-compatible with libc printf,
* but be aware - it is not full analogue
* in regular print functions it would be detrimental to send more
* bytes than return value, but here it would mostly be used
* in debugging, so it would be useful to know if your agent has
* issues */
static int hprintf(const char * format, ...)
{
int const err_char_idx = sizeof("_NYX_ERR_");
static uint8_t error_msg_buffer[] = "_NYX_ERR_\0\0\0\0\0\0\0";
static uint8_t* hprintf_buffer = NULL;
register int could_be_written = 0;

if (!alloc_hprintf_buffer(&hprintf_buffer)) {
kAFL_hypercall(HYPERCALL_KAFL_PRINTF, (uintptr_t) error_msg_buffer);
return -2;
}

va_list args;
va_start(args, format);
if(alloc_hprintf_buffer(&hprintf_buffer)){
vsnprintf((char*)hprintf_buffer, HPRINTF_MAX_SIZE, format, args);
kAFL_hypercall(HYPERCALL_KAFL_PRINTF, (uintptr_t)hprintf_buffer);
}
//vprintf(format, args);
could_be_written = vsnprintf((char *) hprintf_buffer, HPRINTF_MAX_SIZE, format, args);
va_end(args);
if (could_be_written < 0) {
error_msg_buffer[err_char_idx] = 'V';
kAFL_hypercall(HYPERCALL_KAFL_PRINTF, (uintptr_t) error_msg_buffer);
return could_be_written;
}
kAFL_hypercall(HYPERCALL_KAFL_PRINTF, (uintptr_t) hprintf_buffer);
if (could_be_written > HPRINTF_MAX_SIZE) {
error_msg_buffer[err_char_idx] = 'O';
kAFL_hypercall(HYPERCALL_KAFL_PRINTF, (uintptr_t) error_msg_buffer);
return HPRINTF_MAX_SIZE;
}
return could_be_written;
}
#endif

Expand Down