Skip to content

Commit

Permalink
Replace reserved argument names in syscalls
Browse files Browse the repository at this point in the history
Just stick to the replaced names everywhere.
This actually only broke linkat(2) and symlinkat(2),
but it touches many len -> length renames as well
for the sake of consistency.
Fixes #1964
  • Loading branch information
Arusekk committed Nov 16, 2021
1 parent 4c78e18 commit 60e15d6
Show file tree
Hide file tree
Showing 33 changed files with 68 additions and 59 deletions.
53 changes: 31 additions & 22 deletions pwnlib/data/syscalls/generate.py
@@ -1,4 +1,4 @@
#!/usr/bin/env python2
#!/usr/bin/env python3
from __future__ import division
import argparse
import keyword
Expand Down Expand Up @@ -137,6 +137,7 @@ def can_be_string(arg):
if arg.type == 'void' and arg.derefcnt == 1:
return True


def can_be_array(arg):
if arg.type == 'char' and arg.derefcnt == 2:
return True
Expand All @@ -160,11 +161,13 @@ def fix_bad_arg_names(func, arg):
def get_arg_default(arg):
return 0


def fix_rt_syscall_name(name):
if name.startswith('rt_'):
return name[3:]
return name


def fix_syscall_names(name):
# Do not use old_mmap
if name == 'SYS_mmap':
Expand All @@ -180,6 +183,7 @@ def main(target):
with context.local(arch=arch):
generate_one(target)


def generate_one(target):
SYSCALL_NAMES = [c for c in dir(constants) if c.startswith('SYS_')]

Expand Down Expand Up @@ -214,46 +218,50 @@ def generate_one(target):

# Set up the argument string for Mako
argument_names = []
argument_names_ = []
argument_defaults = []

string_arguments = []
array_arguments = []
arg_docs = []

#

for arg in function.args:
argname = fix_bad_arg_names(function, arg)
argname_ = fix_bad_arg_names(function, arg)
argname = argname_.rstrip('_')
default = get_arg_default(arg)

if can_be_array(arg):
array_arguments.append(argname)

if can_be_string(arg):
string_arguments.append(argname)

argtype = str(arg.type) + ('*' * arg.derefcnt)
arg_docs.append(
' {argname_}({argtype}): {argname}'.format(
argname_=argname_,
argname=argname,
argtype=argtype,
))

# Mako is unable to use *vararg and *kwarg, so we just stub in
# a whole bunch of additional arguments.
if argname == 'vararg':
for j in range(5):
argname = 'vararg_%i' % j
argument_names.append(argname)
argument_names_.append(argname)
argument_defaults.append('%s=%s' % (argname, None))
break

argument_names.append(argname)
argument_defaults.append('%s=%s' % (argname, default))
argument_names_.append(argname_)
argument_defaults.append('%s=%s' % (argname_, default))

arguments_default_values = ', '.join(argument_defaults)
arguments_comma_separated = ', '.join(argument_names)

string_arguments = []
array_arguments = []
arg_docs = []

for arg in function.args:

if can_be_array(arg):
array_arguments.append(arg.name)

if can_be_string(arg):
string_arguments.append(arg.name)

argname = arg.name
argtype = str(arg.type) + ('*' * arg.derefcnt)
arg_docs.append(
' {argname}({argtype}): {argname}'.format(argname=argname,
argtype=argtype))
arguments_comma_separated = ', '.join(argument_names_)

return_type = str(function.type) + ('*' * function.derefcnt)
arg_docs = '\n'.join(arg_docs)
Expand Down Expand Up @@ -282,6 +290,7 @@ def generate_one(target):
with open(os.path.join(target, name + '.asm'), 'wt') as f:
f.write('\n'.join(map(str.strip, lines)) + '\n')


if __name__ == '__main__':
p = argparse.ArgumentParser()
p.add_argument('target_directory')
Expand Down
Expand Up @@ -15,7 +15,7 @@ Arguments:
fd(int): fd
advice(int): advice
offset(loff_t): offset
len(loff_t): len
length(loff_t): length
Returns:
long
</%docstring>
Expand Down
2 changes: 1 addition & 1 deletion pwnlib/shellcraft/templates/common/linux/syscalls/bind.asm
Expand Up @@ -14,7 +14,7 @@ See 'man 2 bind' for more information.
Arguments:
fd(int): fd
addr(CONST_SOCKADDR_ARG): addr
len(socklen_t): len
length(socklen_t): length
Returns:
int
</%docstring>
Expand Down
Expand Up @@ -14,7 +14,7 @@ See 'man 2 connect' for more information.
Arguments:
fd(int): fd
addr(CONST_SOCKADDR_ARG): addr
len(socklen_t): len
length(socklen_t): length
Returns:
int
</%docstring>
Expand Down
Expand Up @@ -15,7 +15,7 @@ Arguments:
fd(int): fd
mode(int): mode
offset(off_t): offset
len(off_t): len
length(off_t): length
Returns:
int
</%docstring>
Expand Down
Expand Up @@ -14,7 +14,7 @@ See 'man 2 getpeername' for more information.
Arguments:
fd(int): fd
addr(SOCKADDR_ARG): addr
len(socklen_t*): len
length(socklen_t*): length
Returns:
int
</%docstring>
Expand Down
Expand Up @@ -14,7 +14,7 @@ See 'man 2 getsockname' for more information.
Arguments:
fd(int): fd
addr(SOCKADDR_ARG): addr
len(socklen_t*): len
length(socklen_t*): length
Returns:
int
</%docstring>
Expand Down
4 changes: 2 additions & 2 deletions pwnlib/shellcraft/templates/common/linux/syscalls/ioperm.asm
Expand Up @@ -12,7 +12,7 @@ Invokes the syscall ioperm.
See 'man 2 ioperm' for more information.

Arguments:
from(unsigned): from
from_(unsigned): from
num(unsigned): num
turn_on(int): turn_on
Returns:
Expand All @@ -28,7 +28,7 @@ Returns:
can_pushstr = []
can_pushstr_array = []

argument_names = ['from_', 'num', 'turn_on']
argument_names = ['from', 'num', 'turn_on']
argument_values = [from_, num, turn_on]

# Load all of the arguments into their destination registers / stack slots.
Expand Down
4 changes: 2 additions & 2 deletions pwnlib/shellcraft/templates/common/linux/syscalls/link.asm
Expand Up @@ -12,7 +12,7 @@ Invokes the syscall link.
See 'man 2 link' for more information.

Arguments:
from(char*): from
from_(char*): from
to(char*): to
Returns:
int
Expand All @@ -27,7 +27,7 @@ Returns:
can_pushstr = ['from', 'to']
can_pushstr_array = []

argument_names = ['from_', 'to']
argument_names = ['from', 'to']
argument_values = [from_, to]

# Load all of the arguments into their destination registers / stack slots.
Expand Down
4 changes: 2 additions & 2 deletions pwnlib/shellcraft/templates/common/linux/syscalls/linkat.asm
Expand Up @@ -13,7 +13,7 @@ See 'man 2 linkat' for more information.

Arguments:
fromfd(int): fromfd
from(char*): from
from_(char*): from
tofd(int): tofd
to(char*): to
flags(int): flags
Expand All @@ -30,7 +30,7 @@ Returns:
can_pushstr = ['from', 'to']
can_pushstr_array = []

argument_names = ['fromfd', 'from_', 'tofd', 'to', 'flags']
argument_names = ['fromfd', 'from', 'tofd', 'to', 'flags']
argument_values = [fromfd, from_, tofd, to, flags]

# Load all of the arguments into their destination registers / stack slots.
Expand Down
Expand Up @@ -14,7 +14,7 @@ See 'man 2 lookup_dcookie' for more information.
Arguments:
cookie(u64): cookie
buffer(char*): buffer
len(size_t): len
length(size_t): length
Returns:
int
</%docstring>
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 madvise' for more information.

Arguments:
addr(void*): addr
len(size_t): len
length(size_t): length
advice(int): advice
Returns:
int
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 mbind' for more information.

Arguments:
addr(void*): addr
len(unsigned): len
length(unsigned): length
mode(int): mode
nodemask(unsigned*): nodemask
maxnode(unsigned): maxnode
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 mincore' for more information.

Arguments:
start(void*): start
len(size_t): len
length(size_t): length
vec(unsigned*): vec
Returns:
int
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 mlock' for more information.

Arguments:
addr(void*): addr
len(size_t): len
length(size_t): length
Returns:
int
</%docstring>
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 mlock2' for more information.

Arguments:
addr(void*): addr
len(size_t): len
length(size_t): length
flags(int): flags
Returns:
int
Expand Down
2 changes: 1 addition & 1 deletion pwnlib/shellcraft/templates/common/linux/syscalls/mmap.asm
Expand Up @@ -13,7 +13,7 @@ See 'man 2 mmap' for more information.

Arguments:
addr(void*): addr
len(size_t): len
length(size_t): length
prot(int): prot
flags(int): flags
fd(int): fd
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 mprotect' for more information.

Arguments:
addr(void*): addr
len(size_t): len
length(size_t): length
prot(int): prot
Returns:
int
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 msync' for more information.

Arguments:
addr(void*): addr
len(size_t): len
length(size_t): length
flags(int): flags
Returns:
int
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 munlock' for more information.

Arguments:
addr(void*): addr
len(size_t): len
length(size_t): length
Returns:
int
</%docstring>
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 munmap' for more information.

Arguments:
addr(void*): addr
len(size_t): len
length(size_t): length
Returns:
int
</%docstring>
Expand Down
2 changes: 1 addition & 1 deletion pwnlib/shellcraft/templates/common/linux/syscalls/open.asm
Expand Up @@ -14,7 +14,7 @@ See 'man 2 open' for more information.
Arguments:
file(char*): file
oflag(int): oflag
vararg(int): vararg
mode(int): mode
Returns:
int
</%docstring>
Expand Down
Expand Up @@ -15,7 +15,7 @@ Arguments:
bus(unsigned): bus
dfn(unsigned): dfn
off(unsigned): off
len(unsigned): len
length(unsigned): length
buf(void*): buf
Returns:
int
Expand Down
Expand Up @@ -15,7 +15,7 @@ Arguments:
bus(unsigned): bus
dfn(unsigned): dfn
off(unsigned): off
len(unsigned): len
length(unsigned): length
buf(void*): buf
Returns:
int
Expand Down
Expand Up @@ -14,7 +14,7 @@ See 'man 2 readlink' for more information.
Arguments:
path(char*): path
buf(char*): buf
len(size_t): len
length(size_t): length
Returns:
ssize_t
</%docstring>
Expand Down
Expand Up @@ -15,7 +15,7 @@ Arguments:
fd(int): fd
path(char*): path
buf(char*): buf
len(size_t): len
length(size_t): length
Returns:
ssize_t
</%docstring>
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 set_robust_list' for more information.

Arguments:
head(robust_list_head*): head
len(size_t): len
length(size_t): length
Returns:
long
</%docstring>
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 setdomainname' for more information.

Arguments:
name(char*): name
len(size_t): len
length(size_t): length
Returns:
int
</%docstring>
Expand Down
Expand Up @@ -13,7 +13,7 @@ See 'man 2 sethostname' for more information.

Arguments:
name(char*): name
len(size_t): len
length(size_t): length
Returns:
int
</%docstring>
Expand Down

0 comments on commit 60e15d6

Please sign in to comment.