Rizin
unix-like reverse engineering framework and cli tools
io_rzk_linux.c
Go to the documentation of this file.
1 // SPDX-FileCopyrightText: 2016 Rakholiya Jenish
2 // SPDX-FileCopyrightText: 2016 NighterMan <jpenalbae@gmail.com>
3 // SPDX-FileCopyrightText: 2017-2020 pancake <pancake@nopcode.org>
4 // SPDX-License-Identifier: LGPL-3.0-only
5 
6 #ifndef __GNU__
7 
8 #include "io_rzk_linux.h"
9 
10 #define fset(num, shift) ((((num) & (((ut64)1) << (shift))) == 0) ? 0 : 1)
11 
12 #if __i386__ || __x86_64__
13 static void x86_ctrl_reg_pretty_print(RzIO *io, struct rzk_control_reg ctrl) {
14  io->cb_printf("CR0: 0x%" PFMT64x "\n", (ut64)ctrl.cr0);
15  io->cb_printf(" [*] PG: %d\n"
16  " [*] CD: %d\n"
17  " [*] NW: %d\n"
18  " [*] AM: %d\n"
19  " [*] WP: %d\n"
20  " [*] NE: %d\n"
21  " [*] ET: %d\n"
22  " [*] TS: %d\n"
23  " [*] EM: %d\n"
24  " [*] MP: %d\n"
25  " [*] PE: %d\n",
26  fset(ctrl.cr0, 31), fset(ctrl.cr0, 30), fset(ctrl.cr0, 29), fset(ctrl.cr0, 18),
27  fset(ctrl.cr0, 16), fset(ctrl.cr0, 5), fset(ctrl.cr0, 4), fset(ctrl.cr0, 3),
28  fset(ctrl.cr0, 2), fset(ctrl.cr0, 1), fset(ctrl.cr0, 1));
29  io->cb_printf("\n");
30 
31  io->cb_printf("CR2: 0x%" PFMT64x "\n", (ut64)ctrl.cr2);
32  io->cb_printf("Page-Fault Linear Address: 0x%" PFMT64x "\n", (ut64)ctrl.cr2);
33  io->cb_printf("\n");
34 
35  io->cb_printf("CR3: 0x%" PFMT64x "\n", (ut64)ctrl.cr3);
36  io->cb_printf(" [*] Page-Directory Base: 0x%" PFMT64x "\n"
37  " [*] PCD: %d\n"
38  " [*] PWT: %d\n",
39  (((ut64)ctrl.cr3) & 0xfffffffffffff000), fset(ctrl.cr3, 4), fset(ctrl.cr3, 3));
40  io->cb_printf("\n");
41 
42  io->cb_printf("CR4: 0x%" PFMT64x "\n", (ut64)ctrl.cr4);
43  io->cb_printf(" [*] PKE: %d\n"
44  " [*] SMAP: %d\n"
45  " [*] SMEP: %d\n"
46  " [*] OSXSAVE: %d\n"
47  " [*] PCIDE: %d\n"
48  " [*] FSGSBASE: %d\n"
49  " [*] SMXE: %d\n"
50  " [*] VMXE: %d\n"
51  " [*] UMIP: %d\n"
52  " [*] OSXMMEXCPT: %d\n"
53  " [*] OSFXSR: %d\n"
54  " [*] PCE: %d\n"
55  " [*] PGE: %d\n"
56  " [*] MCE: %d\n"
57  " [*] PAE: %d\n"
58  " [*] PSE: %d\n"
59  " [*] DE: %d\n"
60  " [*] TSD: %d\n"
61  " [*] PVI: %d\n"
62  " [*] VME: %d\n",
63  fset(ctrl.cr4, 22), fset(ctrl.cr4, 21), fset(ctrl.cr4, 20), fset(ctrl.cr4, 18),
64  fset(ctrl.cr4, 17), fset(ctrl.cr4, 16), fset(ctrl.cr4, 14), fset(ctrl.cr4, 13),
65  fset(ctrl.cr4, 11), fset(ctrl.cr4, 10), fset(ctrl.cr4, 9), fset(ctrl.cr4, 8),
66  fset(ctrl.cr4, 7), fset(ctrl.cr4, 6), fset(ctrl.cr4, 5), fset(ctrl.cr4, 4),
67  fset(ctrl.cr4, 3), fset(ctrl.cr4, 2), fset(ctrl.cr4, 1), fset(ctrl.cr4, 0));
68  io->cb_printf("\n");
69 
70 #if __x86_64__
71  io->cb_printf("CR8: 0x%" PFMT64x "\n", (ut64)ctrl.cr8);
72  io->cb_printf(" [*] TPL: %zu\n", ctrl.cr8 & 0xf);
73 #endif
74 }
75 
76 #elif __arm__
77 static void arm_ctrl_reg_pretty_print(RzIO *io, struct rzk_control_reg ctrl) {
78  io->cb_printf("TTBR0: 0x%" PFMT64x "\n", (ut64)ctrl.ttbr0);
79  io->cb_printf(" [*] Translation table base 0: 0x%" PFMT64x "\n"
80  " [*] UNP/SBZ: 0x%" PFMT64x "\n"
81  " [*] RGN: 0x%" PFMT64x "\n"
82  " [*] P: %d\n"
83  " [*] S: %d\n"
84  " [*] C: %d\n",
85  (ut64)((ctrl.ttbr0 & (0xffffffff << (14 - (ctrl.ttbcr & 7)))) >> (14 - (ctrl.ttbcr & 7))),
86  (ut64)((ctrl.ttbr0 & ((1 << (13 - (ctrl.ttbcr & 7) + 1)) - (1 << 5))) >> 6),
87  (ut64)((ctrl.ttbr0 & 0x18) >> 3), fset(ctrl.ttbr0, 2), fset(ctrl.ttbr0, 1), fset(ctrl.ttbr0, 0));
88  io->cb_printf("\n");
89 
90  io->cb_printf("TTBR1: 0x%" PFMT64x "\n", (ut64)ctrl.ttbr1);
91  io->cb_printf(" [*] Translation table base 1: 0x%" PFMT64x "\n"
92  " [*] UNP/SBZ: 0x%" PFMT64x "\n"
93  " [*] RGN: 0x%" PFMT64x "\n"
94  " [*] P: %d\n"
95  " [*] S: %d\n"
96  " [*] C: %d\n",
97  (ut64)((ctrl.ttbr1 & (0xffffffff << 14)) >> 14), (ut64)((ctrl.ttbr1 & ((1 << (13 + 1)) - (1 << 5))) >> 6),
98  (ut64)((ctrl.ttbr1 & 0x18) >> 3), fset(ctrl.ttbr1, 2), fset(ctrl.ttbr1, 1), fset(ctrl.ttbr1, 0));
99  io->cb_printf("\n");
100 
101  io->cb_printf("TTBCR: 0x%" PFMT64x "\n", (ut64)ctrl.ttbcr);
102  io->cb_printf(" [*] N: %d\n", ctrl.ttbcr & 7);
103  io->cb_printf("\n");
104 
105  io->cb_printf("C1: 0x%" PFMT64x "\n", (ut64)ctrl.c1);
106  io->cb_printf(" [*] AFE: %d\n"
107  " [*] TRE: %d\n"
108  " [*] EE: %d\n"
109  " [*] VE: %d\n"
110  " [*] XP: %d\n"
111  " [*] U: %d\n"
112  " [*] FI: %d\n"
113  " [*] IT: %d\n"
114  " [*] DT: %d\n"
115  " [*] L4: %d\n"
116  " [*] RR: %d\n"
117  " [*] V: %d\n"
118  " [*] I: %d\n"
119  " [*] Z: %d\n"
120  " [*] F: %d\n"
121  " [*] R: %d\n"
122  " [*] S: %d\n"
123  " [*] B: %d\n"
124  " [*] W: %d\n"
125  " [*] C: %d\n"
126  " [*] A: %d\n"
127  " [*] M: %d\n",
128  fset(ctrl.c1, 29), fset(ctrl.c1, 28), fset(ctrl.c1, 25), fset(ctrl.c1, 24),
129  fset(ctrl.c1, 23), fset(ctrl.c1, 22), fset(ctrl.c1, 21), fset(ctrl.c1, 18),
130  fset(ctrl.c1, 16), fset(ctrl.c1, 15), fset(ctrl.c1, 14), fset(ctrl.c1, 13),
131  fset(ctrl.c1, 12), fset(ctrl.c1, 11), fset(ctrl.c1, 10), fset(ctrl.c1, 9),
132  fset(ctrl.c1, 8), fset(ctrl.c1, 7), fset(ctrl.c1, 3), fset(ctrl.c1, 2),
133  fset(ctrl.c1, 1), fset(ctrl.c1, 0));
134  io->cb_printf("\n");
135 
136  io->cb_printf("C3: 0x%" PFMT64x "\n", (ut64)ctrl.c3);
137 }
138 
139 #elif __arm64__ || __aarch64__
140 /*ARM Cortex-A57 and ARM Cortex-A72. This might show some wrong values for other processor.*/
141 static void arm64_ctrl_reg_pretty_print(RzIO *io, struct rzk_control_reg ctrl) {
142  io->cb_printf("SCTLR_EL1: 0x%" PFMTSZx "\n", ctrl.sctlr_el1);
143  io->cb_printf(" [*] UCI: %d\n"
144  " [*] EE: %d\n"
145  " [*] E0E: %d\n"
146  " [*] WXN: %d\n"
147  " [*] nTWE: %d\n"
148  " [*] nTWI: %d\n"
149  " [*] UCT: %d\n"
150  " [*] DZE: %d\n"
151  " [*] I: %d\n"
152  " [*] UMA: %d\n"
153  " [*] SED: %d\n"
154  " [*] ITD: %d\n"
155  " [*] THEE: %d\n"
156  " [*] CP15BEN: %d\n"
157  " [*] SAO: %d\n"
158  " [*] SA: %d\n"
159  " [*] C: %d\n"
160  " [*] A: %d\n"
161  " [*] M: %d\n",
162  fset(ctrl.sctlr_el1, 26), fset(ctrl.sctlr_el1, 25), fset(ctrl.sctlr_el1, 24), fset(ctrl.sctlr_el1, 19),
163  fset(ctrl.sctlr_el1, 18), fset(ctrl.sctlr_el1, 16), fset(ctrl.sctlr_el1, 15), fset(ctrl.sctlr_el1, 14),
164  fset(ctrl.sctlr_el1, 12), fset(ctrl.sctlr_el1, 9), fset(ctrl.sctlr_el1, 8), fset(ctrl.sctlr_el1, 7),
165  fset(ctrl.sctlr_el1, 6), fset(ctrl.sctlr_el1, 5), fset(ctrl.sctlr_el1, 4), fset(ctrl.sctlr_el1, 3),
166  fset(ctrl.sctlr_el1, 2), fset(ctrl.sctlr_el1, 1), fset(ctrl.sctlr_el1, 0));
167  io->cb_printf("\n");
168 
169  io->cb_printf("TTBR0_EL1: 0x%" PFMTSZx "\n", ctrl.ttbr0_el1);
170  io->cb_printf(" [*] ASID [63:48]: 0x%" PFMT64x "\n"
171  " [*] BADDR [47:10]: 0x%" PFMT64x "\n",
172  (ctrl.ttbr0_el1 & 0xffff000000000000LLU) >> 48, (ctrl.ttbr0_el1 & ((((ut64)1) << (47 + 1)) - (1 << 10))) >> 10);
173  io->cb_printf("\n");
174 
175  io->cb_printf("TTBR1_EL1: 0x%" PFMTSZx "\n", ctrl.ttbr1_el1);
176  io->cb_printf(" [*] ASID [63:48]: 0x%" PFMT64x "\n"
177  " [*] BADDR [47:10]: 0x%" PFMT64x "\n",
178  (ctrl.ttbr1_el1 & 0xffff000000000000LLU) >> 48, (ctrl.ttbr1_el1 & ((((ut64)1) << (47 + 1)) - (1 << 10))) >> 10);
179  io->cb_printf("\n");
180 
181  io->cb_printf("TCR_EL1: 0x%" PFMTSZx "\n", ctrl.tcr_el1);
182  io->cb_printf(" [*] TBI1: %d\n"
183  " [*] TBI0: %d\n"
184  " [*] AS: %d\n"
185  " [*] IPS: %d\n"
186  " [*] TG1: %d\n"
187  " [*] SH1: %d\n"
188  " [*] ORGN1: %d\n"
189  " [*] IRGN1: %d\n"
190  " [*] EPD1: %d\n"
191  " [*] A1: %d\n"
192  " [*] T1SZ: %d\n"
193  " [*] TG0: %d\n"
194  " [*] SH0: %d\n"
195  " [*] ORGN0: %d\n"
196  " [*] IRGN0: %d\n"
197  " [*] EPD0: %d\n"
198  " [*] T0SZ: %d\n",
199  fset(ctrl.tcr_el1, 38), fset(ctrl.tcr_el1, 37), fset(ctrl.tcr_el1, 36),
200  (int)(ctrl.tcr_el1 >> 32) & 0x7, fset(ctrl.tcr_el1, 30), (int)(ctrl.tcr_el1 >> 28) & 0x3,
201  (int)(ctrl.tcr_el1 >> 26) & 0x3, (int)(ctrl.tcr_el1 >> 24) & 0x3, fset(ctrl.tcr_el1, 23),
202  fset(ctrl.tcr_el1, 22), (int)(ctrl.tcr_el1 >> 16) & 0x3f, fset(ctrl.tcr_el1, 14),
203  (int)(ctrl.tcr_el1 >> 12) & 0x3, (int)(ctrl.tcr_el1 >> 10) & 0x3, (int)(ctrl.tcr_el1 >> 8) & 0x3,
204  fset(ctrl.tcr_el1, 7), (int)ctrl.tcr_el1 & 0x3f);
205 }
206 #endif
207 
208 static const char *getargpos(const char *buf, int pos) {
209  int i;
210  for (i = 0; buf && i < pos; i++) {
211  buf = strchr(buf, ' ');
212  if (!buf) {
213  break;
214  }
215  buf = rz_str_ichr((char *)buf, ' ');
216  }
217  return buf;
218 }
219 
220 static size_t getvalue(const char *buf, int pos) {
221  size_t ret;
222  buf = getargpos(buf, pos);
223  if (buf) {
224  ret = strtoul(buf, 0, 0);
225  } else {
226  ret = -1;
227  }
228  return ret;
229 }
230 
231 static void print_help(RzIO *io, char *cmd, int p_usage) {
232  int i = 0;
233  int cmd_len = cmd ? strlen(cmd) : 0;
234  const char *usage = "Usage: \\[MprRw][lpP] [args...]";
235  const char *help_msg[] = {
236  "\\dm Print kernel memory map (or process if rzk.io==1)",
237  "\\dr Print control registers",
238  "\\dR Print control registers in detailed mode",
239  "\\dp [pid] Print current selected pid or change it",
240  "\\e rzk.io=[012] Read/Write from 0: Linear, 1: Process, 2: Physical addresses"
241  };
242  const char *help_msg_old[] = {
243  "\\M Print kernel memory map",
244  "\\b beid [pid] Change rzk backend. pid is required when beid is 1.",
245  " 0: linear address; 1: process address; 2: physical address",
246  "\\p pid Print process information",
247  "\\rl addr len Read from linear address",
248  "\\rp pid addr len Read from process address",
249  "\\rP addr len Read physical address",
250  "\\R[p] Print control registers. Use R!Rp for detailed description",
251  "\\wl[x] addr input Write at linear address. Use R!wlx for input in hex",
252  "\\wp[x] pid addr input Write at process address. Use R!wpx for input in hex",
253  "\\wP[x] addr input Write at physical address. Use R!wPx for input in hex",
254  "\\W 1|0 Honor arch write protect (1 enable WP, 0 disable WP)"
255  };
256  if (p_usage) {
257  io->cb_printf("%s\n", usage);
258  }
259  for (i = 0; i < (sizeof(help_msg) / sizeof(char *)); i++) {
260  if (!cmd || !strncmp(cmd, help_msg[i] + 1, cmd_len)) {
261  io->cb_printf("%s\n", help_msg[i]);
262  }
263  }
264  io->cb_printf("\nOld Commands: (deprecated)\n");
265  for (i = 0; i < (sizeof(help_msg_old) / sizeof(char *)); i++) {
266  if (!cmd || !strncmp(cmd, help_msg_old[i] + 1, cmd_len)) {
267  io->cb_printf("%s\n", help_msg_old[i]);
268  }
269  }
270 }
271 
272 int ReadMemory(RzIO *io, RzIODesc *iodesc, int ioctl_n, size_t pid, size_t address, ut8 *buf, int len) {
273  int ret = -1;
274  int pagesize, newlen;
275  ut64 pageaddr, offset;
276  bool flag = 0;
277  ut8 garbage;
278 
279  if (iodesc && iodesc->data > 0 && buf) {
280  struct rzk_data data;
281 
282  data.pid = pid;
283  data.addr = address;
284  data.len = len;
285  data.buff = (ut8 *)calloc(len + 1, 1);
286  if (!data.buff) {
287  return -1;
288  }
289 
290  ret = ioctl((int)(size_t)iodesc->data, ioctl_n, &data);
291  if (!ret) {
292  memcpy(buf, data.buff, len);
293  ret = len;
294  } else {
295  garbage = 0xff;
296  flag = 0;
297  offset = 0;
298  pagesize = getpagesize();
299  pageaddr = address + pagesize;
300  pageaddr -= (pageaddr % pagesize);
301  if ((len - (int)(pageaddr - address)) > 0) {
302  data.len = pageaddr - address;
303  ret = ioctl((int)(size_t)iodesc->data, ioctl_n, &data);
304  if (!ret) {
305  memcpy(buf + offset, data.buff, pageaddr - address);
306  flag = 1;
307  } else {
308  memset(buf + offset, garbage, pageaddr - address);
309  }
310 
311  offset = pageaddr - address;
312  newlen = len - offset;
313  while (newlen >= pagesize) {
314  data.addr = pageaddr;
315  data.len = pagesize;
316 
317  ret = ioctl((int)(size_t)iodesc->data, ioctl_n, &data);
318  if (!ret) {
319  memcpy(buf + offset, data.buff, pagesize);
320  flag = 1;
321  } else {
322  memset(buf + offset, garbage, pagesize);
323  }
324  pageaddr += pagesize;
325  offset += pagesize;
326  newlen -= pagesize;
327  }
328 
329  data.addr = pageaddr;
330  data.len = newlen;
331  ret = ioctl((int)(size_t)iodesc->data, ioctl_n, &data);
332  if (!ret) {
333  memcpy(buf + offset, data.buff, newlen);
334  flag = 1;
335  } else {
336  memset(buf + offset, garbage, newlen);
337  }
338  }
339  ret = flag ? len : -1;
340  }
341 
342  free(data.buff);
343  } else if (!buf) {
344  io->cb_printf("Invalid input buffer.\n");
345  } else {
346  io->cb_printf("IOCTL device not initialized.\n");
347  }
348  return ret;
349 }
350 
351 int WriteMemory(RzIO *io, RzIODesc *iodesc, int ioctl_n, size_t pid, ut64 address, const ut8 *buf, int len) {
352  int ret = -1;
353 
354  if (iodesc && iodesc->data > 0 && buf) {
355  struct rzk_data data;
356 
357  data.pid = pid;
358  data.addr = address;
359  data.len = len;
360  data.buff = (ut8 *)calloc(len + 1, 1);
361  data.wp = rzk_struct.wp;
362 
363  if (!data.buff) {
364  return -1;
365  }
366 
367  memcpy(data.buff, buf, len);
368  ret = ioctl((int)(size_t)iodesc->data, ioctl_n, &data);
369  if (!ret) {
370  ret = len;
371  } else {
372  io->cb_printf("Write failed. ioctl err: %s\n", strerror(errno));
373  ret = -1;
374  }
375 
376  free(data.buff);
377  } else if (!buf) {
378  io->cb_printf("Invalid input buffer.\n");
379  } else {
380  io->cb_printf("IOCTL device not initialized.\n");
381  }
382  return ret;
383 }
384 
385 int run_old_command(RzIO *io, RzIODesc *iodesc, const char *buf) {
386  int ret, inphex, ioctl_n;
387  size_t pid, addr, len;
388  ut8 *databuf = NULL;
389  switch (*buf) {
390  case 'W': {
391  if (buf[1] != ' ') {
392  io->cb_printf("Write Protect: %d\n", rzk_struct.wp);
393  io->cb_printf("Usage:\n");
394  print_help(io, "W", 0);
395  break;
396  }
397 
398  int wp = getvalue(buf, 1);
399  if (wp < 0 || wp > 1) {
400  io->cb_printf("Invalid usage of W\n");
401  print_help(io, "W", 0);
402  break;
403  }
404  rzk_struct.wp = (ut8)wp;
405  } break;
406  case 'b': {
407  char *cmd = NULL;
408  if (buf[1] != ' ') {
409  io->cb_printf("beid: %d\n", rzk_struct.beid);
410  io->cb_printf("pid: %d\n", rzk_struct.pid);
411  io->cb_printf("Usage:\n");
412  print_help(io, "b", 0);
413  goto end;
414  }
415  int beid = getvalue(buf, 1);
416  int pid = getvalue(buf, 2);
417  if (beid < 0 || beid > 2) {
418  io->cb_printf("Invalid usage of b\n");
419  print_help(io, "b", 0);
420  break;
421  }
422  if (beid == 1 && pid < 0) {
423  io->cb_printf("Invalid pid read.\n");
424  print_help(io, "b", 0);
425  break;
426  }
427  rzk_struct.beid = beid;
428  rzk_struct.pid = (beid == 1) ? pid : 0;
429 
430  cmd = (char *)malloc(27);
431  if (!cmd) {
432  io->cb_printf("io_rzk_linux : Malloc failed. Seeking to 0x0\n");
433  io->corebind.cmd(io->corebind.core, "s 0");
434  } else {
435  sprintf(cmd, "s 0x%" PFMT64x, io->off);
436  io->corebind.cmd(io->corebind.core, cmd);
437  free(cmd);
438  }
439  } break;
440  case 'r': {
441  RzPrint *print = rz_print_new();
442  switch (buf[1]) {
443  case 'l':
444  // read linear address
445  // R! rl addr len
446  if (buf[2] != ' ') {
447  print_help(io, "rl", 0);
448  goto end;
449  }
450  pid = 0;
451  addr = getvalue(buf, 1);
452  len = getvalue(buf, 2);
453  if (addr == -1 || len == -1) {
454  io->cb_printf("Invalid number of arguments.\n");
455  print_help(io, "rl", 0);
456  goto end;
457  }
458  ioctl_n = IOCTL_READ_KERNEL_MEMORY;
459  break;
460  case 'p':
461  // read process address
462  // R! rp pid address len
463  if (buf[2] != ' ') {
464  print_help(io, "rp", 0);
465  goto end;
466  }
467  pid = getvalue(buf, 1);
468  addr = getvalue(buf, 2);
469  len = getvalue(buf, 3);
470  if (pid == -1 || addr == -1 || len == -1) {
471  io->cb_printf("Invalid number of arguments.\n");
472  print_help(io, "rp", 0);
473  goto end;
474  ;
475  }
476  ioctl_n = IOCTL_READ_PROCESS_ADDR;
477  break;
478  case 'P':
479  // read physical address
480  // R! rP address len
481  if (buf[2] != ' ') {
482  print_help(io, "rP", 0);
483  goto end;
484  }
485  pid = 0;
486  addr = getvalue(buf, 1);
487  len = getvalue(buf, 2);
488  if (addr == -1 || len == -1) {
489  io->cb_printf("Invalid number of arguments.\n");
490  print_help(io, "rP", 0);
491  goto end;
492  }
493  ioctl_n = IOCTL_READ_PHYSICAL_ADDR;
494  break;
495  default:
496  print_help(io, "r", 0);
497  rz_print_free(print);
498  goto end;
499  }
500  databuf = (ut8 *)calloc(len + 1, 1);
501  if (databuf) {
502  ret = ReadMemory(io, iodesc, ioctl_n, pid, addr, databuf, len);
503  if (ret > 0) {
504  char *dump = rz_print_hexdump_str(print, addr, (const ut8 *)databuf, ret, 16, 1, 1);
505  rz_cons_print(dump);
506  free(dump);
507  }
508  } else {
509  io->cb_printf("Failed to allocate buffer\n");
510  }
511  rz_print_free(print);
512  } break;
513  case 'w':
514  inphex = (buf[2] == 'x') ? 1 : 0;
515  switch (buf[1]) {
516  case 'l':
517  // write linear address
518  // R! wl addr str
519  if ((inphex && buf[3] != ' ') || (!inphex && buf[2] != ' ')) {
520  print_help(io, "wl", 0);
521  goto end;
522  }
523  pid = 0;
524  addr = getvalue(buf, 1);
525  buf = getargpos(buf, 2);
526  if (addr == -1 || !buf) {
527  io->cb_printf("Invalid number of arguments.\n");
528  print_help(io, "wl", 0);
529  goto end;
530  }
531  ioctl_n = IOCTL_WRITE_KERNEL_MEMORY;
532  break;
533  case 'p':
534  // write process address
535  // R! wp pid address str
536  if ((inphex && buf[3] != ' ') || (!inphex && buf[2] != ' ')) {
537  print_help(io, "wp", 0);
538  goto end;
539  }
540  pid = getvalue(buf, 1);
541  addr = getvalue(buf, 2);
542  buf = getargpos(buf, 3);
543  if (pid == -1 || addr == -1 || !buf) {
544  io->cb_printf("Invalid number of arguments.\n");
545  print_help(io, "wp", 0);
546  goto end;
547  }
548  ioctl_n = IOCTL_WRITE_PROCESS_ADDR;
549  break;
550  case 'P':
551  // write physical address
552  // R! wP address str
553  if ((inphex && buf[3] != ' ') || (!inphex && buf[2] != ' ')) {
554  print_help(io, "wP", 0);
555  goto end;
556  }
557  pid = 0;
558  addr = getvalue(buf, 1);
559  buf = getargpos(buf, 2);
560  if (addr == -1 || !buf) {
561  io->cb_printf("Invalid number of arguments.\n");
562  print_help(io, "wP", 0);
563  goto end;
564  }
565  ioctl_n = IOCTL_WRITE_PHYSICAL_ADDR;
566  break;
567  default:
568  print_help(io, "w", 0);
569  goto end;
570  }
571  // coverity says this cant happen, but it doesnt hurts to add a check
572  if (!buf) {
573  break;
574  }
575  len = strlen(buf);
576  databuf = (ut8 *)calloc(len + 1, 1);
577  if (databuf) {
578  if (inphex) {
579  len = rz_hex_str2bin(buf, databuf);
580  } else {
581  memcpy(databuf, buf, strlen(buf) + 1);
582  len = rz_str_unescape((char *)databuf);
583  }
584  WriteMemory(io, iodesc, ioctl_n, pid, addr, (const ut8 *)databuf, len);
585  } else {
586  eprintf("Failed to allocate buffer.\n");
587  }
588  break;
589  case 'M': {
590  // Print kernel memory map.
591  // R! M
592  int i, j;
593  struct rzk_kernel_maps map_data;
594  struct rzk_kernel_map_info *info;
595  long page_size = sysconf(_SC_PAGESIZE);
596 
597  ioctl_n = IOCTL_GET_KERNEL_MAP;
598  ret = ioctl((int)(size_t)iodesc->data, ioctl_n, &map_data);
599 
600  if (ret < 0) {
601  io->cb_printf("ioctl err: %s\n", strerror(errno));
602  break;
603  }
604 
605  io->cb_printf("map_data.size: %d, map_data.n_entries: %d\n", map_data.size, map_data.n_entries);
606  info = mmap(0, map_data.size, PROT_READ, MAP_SHARED, (int)(size_t)iodesc->data, 0);
607  if (info == MAP_FAILED) {
608  io->cb_printf("mmap err: %s\n", strerror(errno));
609  break;
610  }
611 
612  for (i = 0; i < map_data.n_entries; i++) {
613  struct rzk_kernel_map_info *in = &info[i];
614  io->cb_printf("start_addr: 0x%" PFMT64x "\n", (ut64)in->start_addr);
615  io->cb_printf("end_addr: 0x%" PFMT64x "\n", (ut64)in->end_addr);
616  io->cb_printf("n_pages: %d (%ld Kbytes)\n", in->n_pages, (in->n_pages * page_size) / 1024);
617  io->cb_printf("n_phys_addr: %d\n", in->n_phys_addr);
618  for (j = 0; j < in->n_phys_addr; j++) {
619  io->cb_printf("\tphys_addr: 0x%" PFMT64x "\n", (ut64)in->phys_addr[j]);
620  }
621  io->cb_printf("\n");
622  }
623 
624  if (munmap(info, map_data.size) == -1) {
625  io->cb_printf("munmap failed.\n");
626  }
627  } break;
628  case 'R': {
629  // Read control registers
630  // R! R[p]
631  struct rzk_control_reg reg_data;
632  ioctl_n = IOCTL_READ_CONTROL_REG;
633  ret = ioctl((int)(size_t)iodesc->data, ioctl_n, &reg_data);
634 
635  if (ret) {
636  io->cb_printf("ioctl err: %s\n", strerror(errno));
637  break;
638  }
639 
640 #if __i386__ || __x86_64__
641  // Print cr1 as null instead of random value from kernel land.
642  reg_data.cr1 = 0;
643  if (buf[1] != 0 && buf[1] == 'p') {
644  x86_ctrl_reg_pretty_print(io, reg_data);
645  } else {
646  io->cb_printf("cr0 = 0x%" PFMT64x "\n", (ut64)reg_data.cr0);
647  io->cb_printf("cr1 = 0x%" PFMT64x "\n", (ut64)reg_data.cr1);
648  io->cb_printf("cr2 = 0x%" PFMT64x "\n", (ut64)reg_data.cr2);
649  io->cb_printf("cr3 = 0x%" PFMT64x "\n", (ut64)reg_data.cr3);
650  io->cb_printf("cr4 = 0x%" PFMT64x "\n", (ut64)reg_data.cr4);
651 #if __x86_64__
652  io->cb_printf("cr8 = 0x%" PFMT64x "\n", (ut64)reg_data.cr8);
653 #endif
654  }
655 #elif __arm__
656  if (buf[1] != 0 && buf[1] == 'p') {
657  arm_ctrl_reg_pretty_print(io, reg_data);
658  } else {
659  io->cb_printf("ttbr0 = 0x%" PFMT64x "\n", (ut64)reg_data.ttbr0);
660  io->cb_printf("ttbr1 = 0x%" PFMT64x "\n", (ut64)reg_data.ttbr1);
661  io->cb_printf("ttbcr = 0x%" PFMT64x "\n", (ut64)reg_data.ttbcr);
662  io->cb_printf("c1 = 0x%" PFMT64x "\n", (ut64)reg_data.c1);
663  io->cb_printf("c3 = 0x%" PFMT64x "\n", (ut64)reg_data.c3);
664  }
665 #elif __arm64__ || __aarch64__
666  if (buf[1] != 0 && buf[1] == 'p') {
667  arm64_ctrl_reg_pretty_print(io, reg_data);
668  } else {
669  io->cb_printf("sctlr_el1 = 0x%" PFMT64x "\n", (ut64)reg_data.sctlr_el1);
670  io->cb_printf("ttbr0_el1 = 0x%" PFMT64x "\n", (ut64)reg_data.ttbr0_el1);
671  io->cb_printf("ttbr1_el1 = 0x%" PFMT64x "\n", (ut64)reg_data.ttbr1_el1);
672  io->cb_printf("tcr_el1 = 0x%" PFMT64x "\n", (ut64)reg_data.tcr_el1);
673  }
674 #endif
675  } break;
676  case 'p': {
677  // Print process info
678  // R! p pid
679  ut64 i;
680  ut64 nextstart;
681  ut64 buffsize;
682  bool fflag = 0;
683  struct rzk_proc_info proc_data;
684 
685  if (*(buf + 1) == '*') {
686  fflag = 1;
687  }
688  switch (*(buf + 1)) {
689  case '*':
690  fflag = 1;
691  if (*(buf + 2) != ' ') {
692  print_help(io, "p*", 0);
693  goto end;
694  }
695  break;
696  case ' ':
697  break;
698  default:
699  print_help(io, "p", 0);
700  goto end;
701  }
702 
703  pid = getvalue(buf, 1);
704  if (pid == -1) {
705  io->cb_printf("Invalid number of arguments.\n");
706  print_help(io, "p", 0);
707  break;
708  }
709  proc_data.pid = pid;
710  ioctl_n = IOCTL_PRINT_PROC_INFO;
711 
712  ret = ioctl((int)(size_t)iodesc->data, ioctl_n, &proc_data);
713  if (ret) {
714  io->cb_printf("ioctl err: %s\n", strerror(errno));
715  break;
716  }
717 
718  buffsize = (ut64)(sizeof(proc_data.vmareastruct) / sizeof(proc_data.vmareastruct[0]));
719  if (fflag) {
720  int j = 0;
721  for (i = 0; i + 1 < buffsize;) {
722  nextstart = 0;
723  if (i + 7 < buffsize) {
724  nextstart = i + 7 + (strlen((const char *)&(proc_data.vmareastruct[i + 7])) - 1 + sizeof(size_t)) / sizeof(size_t);
725  }
726  if (!proc_data.vmareastruct[i] && (i + 1 < buffsize) &&
727  !proc_data.vmareastruct[i + 1] &&
728  nextstart > 0 && nextstart - 1 < buffsize) {
729  break;
730  }
731  io->cb_printf("f pid.%d.%s.%d.start @ 0x%" PFMT64x "\n", proc_data.pid, (char *)&(proc_data.vmareastruct[i + 7]), j, (ut64)proc_data.vmareastruct[i]);
732  io->cb_printf("f pid.%d.%s.%d.end @ 0x%" PFMT64x "\n", proc_data.pid, (char *)&(proc_data.vmareastruct[i + 7]), j, (ut64)proc_data.vmareastruct[i + 1]);
733  j += 1;
734  i = nextstart;
735  }
736  io->cb_printf("f pid.%d.task_struct @ 0x%08zu\n", proc_data.pid, proc_data.task);
737  } else {
738  io->cb_printf("pid = %d\nprocess name = %s\n", proc_data.pid, proc_data.comm);
739  io->cb_printf("task_struct = 0x%08zu\n", proc_data.task);
740  for (i = 0; i < buffsize;) {
741  nextstart = 0;
742  if (i + 7 < buffsize) {
743  nextstart = i + 7 + (strlen((const char *)&(proc_data.vmareastruct[i + 7])) - 1 + sizeof(size_t)) / sizeof(size_t);
744  }
745  if (!proc_data.vmareastruct[i] && !proc_data.vmareastruct[i + 1] &&
746  nextstart > 0 && nextstart - 1 < buffsize) {
747  break;
748  }
749  io->cb_printf("0x%08" PFMT64x " - 0x%08" PFMT64x " %c%c%c%c 0x%08" PFMT64x " %02zu:%02zu %-8" PFMT64u "",
750  (ut64)proc_data.vmareastruct[i], (ut64)proc_data.vmareastruct[i + 1],
751  proc_data.vmareastruct[i + 2] & VM_READ ? 'r' : '-',
752  proc_data.vmareastruct[i + 2] & VM_WRITE ? 'w' : '-',
753  proc_data.vmareastruct[i + 2] & VM_EXEC ? 'x' : '-',
754  proc_data.vmareastruct[i + 2] & VM_MAYSHARE ? 's' : 'p',
755  (ut64)proc_data.vmareastruct[i + 3], proc_data.vmareastruct[i + 4],
756  proc_data.vmareastruct[i + 5], (ut64)proc_data.vmareastruct[i + 6]);
757  io->cb_printf("\t%s\n", (char *)&(proc_data.vmareastruct[i + 7]));
758  i = nextstart;
759  }
760  io->cb_printf("STACK BASE ADDRESS = 0x%zx\n", proc_data.stack);
761  }
762  } break;
763  default: {
764  print_help(io, NULL, 1);
765  }
766  }
767 end:
768  free(databuf);
769  return 0;
770 }
771 
772 int run_new_command(RzIO *io, RzIODesc *iodesc, const char *buf) {
773  if (rz_str_startswith(buf, "dm")) {
774  if (buf[2] == ' ') {
775  // use \p pid
776  char *cmd = rz_str_newf("p %d", atoi(buf + 2));
777  run_old_command(io, iodesc, cmd);
778  free(cmd);
779  } else if (rzk_struct.beid == 1) {
780  // use \p pid
781  char *cmd = rz_str_newf("p %d", rzk_struct.pid);
782  run_old_command(io, iodesc, cmd);
783  free(cmd);
784  } else {
785  // use \M
786  run_old_command(io, iodesc, "M");
787  }
788  return 1;
789  }
790  if (rz_str_startswith(buf, "dr")) {
791  run_old_command(io, iodesc, "R");
792  return 1;
793  }
794  if (rz_str_startswith(buf, "dR")) {
795  run_old_command(io, iodesc, "Rp");
796  return 1;
797  }
798  if (rz_str_startswith(buf, "dp")) {
799  if (buf[2] == ' ') {
800  rzk_struct.pid = atoi(buf + 3);
801  } else {
802  io->cb_printf("%d\n", rzk_struct.pid);
803  }
804  return 1;
805  }
806  if (rz_str_startswith(buf, "e rzk.io")) {
807  if (strchr(buf, '?')) {
808  io->cb_printf("0: Linear memory\n");
809  io->cb_printf("1: Process memory\n");
810  io->cb_printf("2: Physical memory\n");
811  return 1;
812  }
813  const char *eq = strchr(buf, '=');
814  if (eq) {
815  int v = atoi(eq + 1);
816  int p = rzk_struct.pid;
817  char *cmd = rz_str_newf("b %d %d", v, p);
818  run_old_command(io, iodesc, cmd);
819  free(cmd);
820  } else {
821  run_new_command(io, iodesc, "dp");
822  }
823  return 1;
824  }
825  if (rz_str_startswith(buf, "e rzk.wp")) {
826  if (strchr(buf, '?')) {
827  io->cb_printf("<bool> enable write protection (disabled by default)\n");
828  return 1;
829  }
830  const char *eq = strchr(buf, '=');
831  if (eq) {
832  int v = atoi(eq + 1);
833  rzk_struct.wp = (ut8)v;
834  } else {
835  io->cb_printf("%s", rz_str_bool(rzk_struct.wp));
836  }
837  return 1;
838  }
839  return 0;
840 }
841 
842 int run_ioctl_command(RzIO *io, RzIODesc *iodesc, const char *buf) {
843  buf = rz_str_ichr((char *)buf, ' ');
844 
845  if (!run_new_command(io, iodesc, buf)) {
846  return run_old_command(io, iodesc, buf);
847  }
848  return 0;
849 }
850 
851 #endif
len
size_t len
Definition: 6502dis.c:15
i
lzma_index ** i
Definition: index.h:629
info
RzBinInfo * info(RzBinFile *bf)
Definition: bin_ne.c:86
in
const lzma_allocator const uint8_t * in
Definition: block.h:527
usage
void usage(const char *message)
Definition: compress_functions.c:98
NULL
#define NULL
Definition: cris-opc.c:27
cmd
static static sync static getppid static getegid const char static filename char static len const char char static bufsiz static mask static vfork const void static prot static getpgrp const char static swapflags cmd
Definition: sflib.h:79
ioctl
static static sync static getppid static getegid const char static filename ioctl
Definition: sflib.h:62
ut8
#define ut8
Definition: dcpu16.h:8
v
const char * v
Definition: dsignal.c:12
free
RZ_API void Ht_() free(HtName_(Ht) *ht)
Definition: ht_inc.c:130
print_help
static void print_help(RzIO *io, char *cmd, int p_usage)
Definition: io_rzk_linux.c:231
fset
#define fset(num, shift)
Definition: io_rzk_linux.c:10
run_new_command
int run_new_command(RzIO *io, RzIODesc *iodesc, const char *buf)
Definition: io_rzk_linux.c:772
run_old_command
int run_old_command(RzIO *io, RzIODesc *iodesc, const char *buf)
Definition: io_rzk_linux.c:385
getvalue
static size_t getvalue(const char *buf, int pos)
Definition: io_rzk_linux.c:220
WriteMemory
int WriteMemory(RzIO *io, RzIODesc *iodesc, int ioctl_n, size_t pid, ut64 address, const ut8 *buf, int len)
Definition: io_rzk_linux.c:351
getargpos
static const char * getargpos(const char *buf, int pos)
Definition: io_rzk_linux.c:208
ReadMemory
int ReadMemory(RzIO *io, RzIODesc *iodesc, int ioctl_n, size_t pid, size_t address, ut8 *buf, int len)
Definition: io_rzk_linux.c:272
run_ioctl_command
int run_ioctl_command(RzIO *io, RzIODesc *iodesc, const char *buf)
Definition: io_rzk_linux.c:842
io_rzk_linux.h
IOCTL_READ_KERNEL_MEMORY
#define IOCTL_READ_KERNEL_MEMORY
Definition: io_rzk_linux.h:110
IOCTL_GET_KERNEL_MAP
#define IOCTL_GET_KERNEL_MAP
Definition: io_rzk_linux.h:116
VM_EXEC
#define VM_EXEC
Definition: io_rzk_linux.h:122
IOCTL_READ_PHYSICAL_ADDR
#define IOCTL_READ_PHYSICAL_ADDR
Definition: io_rzk_linux.h:114
rzk_struct
struct io_rzk_linux rzk_struct
IOCTL_WRITE_PHYSICAL_ADDR
#define IOCTL_WRITE_PHYSICAL_ADDR
Definition: io_rzk_linux.h:115
VM_MAYSHARE
#define VM_MAYSHARE
Definition: io_rzk_linux.h:123
IOCTL_WRITE_PROCESS_ADDR
#define IOCTL_WRITE_PROCESS_ADDR
Definition: io_rzk_linux.h:113
IOCTL_WRITE_KERNEL_MEMORY
#define IOCTL_WRITE_KERNEL_MEMORY
Definition: io_rzk_linux.h:111
IOCTL_READ_CONTROL_REG
#define IOCTL_READ_CONTROL_REG
Definition: io_rzk_linux.h:117
IOCTL_PRINT_PROC_INFO
#define IOCTL_PRINT_PROC_INFO
Definition: io_rzk_linux.h:118
IOCTL_READ_PROCESS_ADDR
#define IOCTL_READ_PROCESS_ADDR
Definition: io_rzk_linux.h:112
VM_WRITE
#define VM_WRITE
Definition: io_rzk_linux.h:121
VM_READ
#define VM_READ
Definition: io_rzk_linux.h:120
offset
voidpf uLong offset
Definition: ioapi.h:144
buf
voidpf void * buf
Definition: ioapi.h:138
sprintf
sprintf
Definition: kernel.h:365
ut8
uint8_t ut8
Definition: lh5801.h:11
memset
return memset(p, 0, total)
p
void * p
Definition: libc.cpp:67
memcpy
memcpy(mem, inblock.get(), min(CONTAINING_RECORD(inblock.get(), MEMBLOCK, data) ->size, size))
malloc
void * malloc(size_t size)
Definition: malloc.c:123
calloc
void * calloc(size_t number, size_t size)
Definition: malloc.c:102
pid
static static fork const void static count static fd const char const char static newpath char char char static envp time_t static t const char static mode static whence const char static dir time_t static t unsigned static seconds const char struct utimbuf static buf static inc pid
Definition: sflib.h:64
mmap
static static fork const void static count static fd const char const char static newpath char char char static envp time_t static t const char static mode static whence const char static dir time_t static t unsigned static seconds const char struct utimbuf static buf static inc static sig const char static mode static oldfd struct tms static buf static getgid static geteuid const char static filename static arg static mask struct ustat static ubuf static getppid static setsid static egid sigset_t static set struct timeval struct timezone static tz fd_set fd_set fd_set struct timeval static timeout const char char static bufsiz const char static swapflags mmap
Definition: sflib.h:115
munmap
static const void static count static fd struct stat static buf struct pollfd unsigned static timeout void static offset munmap
Definition: sflib.h:43
test_evm.end
end
Definition: test_evm.py:20
rz_print_new
RZ_API RzPrint * rz_print_new(void)
Definition: print.c:56
rz_print_free
RZ_API RzPrint * rz_print_free(RzPrint *p)
Definition: print.c:101
rz_print_hexdump_str
RZ_API RZ_OWN char * rz_print_hexdump_str(RZ_NONNULL RzPrint *p, ut64 addr, RZ_NONNULL const ut8 *buf, int len, int base, int step, size_t zoomsz)
Prints a hexdump of buf at addr.
Definition: print.c:573
eprintf
#define eprintf(x, y...)
Definition: rlcc.c:7
rz_hex_str2bin
RZ_API int rz_hex_str2bin(const char *in, ut8 *out)
Convert an input string in into the binary form in out.
Definition: hex.c:444
rz_str_newf
RZ_API char * rz_str_newf(const char *fmt,...) RZ_PRINTF_CHECK(1
rz_str_bool
RZ_API const char * rz_str_bool(int b)
Definition: str.c:3896
rz_str_ichr
RZ_API char * rz_str_ichr(char *str, char chr)
Definition: str.c:660
rz_str_startswith
RZ_API bool rz_str_startswith(RZ_NONNULL const char *str, RZ_NONNULL const char *needle)
Checks if a string starts with a specifc sequence of characters (case sensitive)
Definition: str.c:3286
rz_str_unescape
RZ_API int rz_str_unescape(char *buf)
Definition: str.c:1300
PFMTSZx
#define PFMTSZx
Definition: rz_types.h:397
PFMT64u
#define PFMT64u
Definition: rz_types.h:395
PFMT64x
#define PFMT64x
Definition: rz_types.h:393
PROT_READ
#define PROT_READ
Definition: sftypes.h:95
size_t
int size_t
Definition: sftypes.h:40
MAP_SHARED
#define MAP_SHARED
Definition: sftypes.h:101
io_rzk_linux::pid
int pid
Definition: io_rzk_linux.h:29
io_rzk_linux::wp
ut8 wp
Definition: io_rzk_linux.h:30
io_rzk_linux::beid
int beid
Definition: io_rzk_linux.h:28
rz_core_bind_t::cmd
RzCoreCmd cmd
Definition: rz_bind.h:32
rz_core_bind_t::core
void * core
Definition: rz_bind.h:31
rz_io_desc_t
Definition: rz_io.h:95
rz_io_desc_t::data
void * data
Definition: rz_io.h:102
rz_io_t
Definition: rz_io.h:59
rz_io_t::corebind
RzCoreBind corebind
Definition: rz_io.h:92
rz_io_t::off
ut64 off
Definition: rz_io.h:61
rz_io_t::cb_printf
PrintfCallback cb_printf
Definition: rz_io.h:91
rz_print_t
Definition: rz_print.h:109
rzk_control_reg
Definition: io_rzk_linux.h:54
rzk_data
Definition: io_rzk_linux.h:33
rzk_data::wp
ut8 wp
Definition: io_rzk_linux.h:38
rzk_data::pid
int pid
Definition: io_rzk_linux.h:34
rzk_data::len
size_t len
Definition: io_rzk_linux.h:36
rzk_data::addr
size_t addr
Definition: io_rzk_linux.h:35
rzk_data::buff
ut8 * buff
Definition: io_rzk_linux.h:37
rzk_kernel_map_info
Definition: io_rzk_linux.h:41
rzk_kernel_maps
Definition: io_rzk_linux.h:49
rzk_kernel_maps::size
int size
Definition: io_rzk_linux.h:51
rzk_kernel_maps::n_entries
int n_entries
Definition: io_rzk_linux.h:50
rzk_proc_info
Definition: io_rzk_linux.h:78
rzk_proc_info::pid
int pid
Definition: io_rzk_linux.h:79
rzk_proc_info::comm
char comm[16]
Definition: io_rzk_linux.h:80
rzk_proc_info::stack
size_t stack
Definition: io_rzk_linux.h:82
rzk_proc_info::task
size_t task
Definition: io_rzk_linux.h:83
rzk_proc_info::vmareastruct
size_t vmareastruct[4096]
Definition: io_rzk_linux.h:81
pos
int pos
Definition: main.c:11
ut64
ut64(WINAPI *w32_GetEnabledXStateFeatures)()
addr
static int addr
Definition: z80asm.c:58