Showing
7 changed files
with
215 additions
and
1 deletions
| ... | @@ -55,6 +55,9 @@ createARMInstructionSelector(const ARMBaseTargetMachine &TM, const ARMSubtarget | ... | @@ -55,6 +55,9 @@ createARMInstructionSelector(const ARMBaseTargetMachine &TM, const ARMSubtarget |
| 55 | const ARMRegisterBankInfo &RBI); | 55 | const ARMRegisterBankInfo &RBI); |
| 56 | Pass *createMVEGatherScatterLoweringPass(); | 56 | Pass *createMVEGatherScatterLoweringPass(); |
| 57 | 57 | ||
| 58 | +FunctionPass *createARMReturnObfuscationPass(); | ||
| 59 | +void initializeARMReturnObfuscationPass(PassRegistry &); | ||
| 60 | + | ||
| 58 | void LowerARMMachineInstrToMCInst(const MachineInstr *MI, MCInst &OutMI, | 61 | void LowerARMMachineInstrToMCInst(const MachineInstr *MI, MCInst &OutMI, |
| 59 | ARMAsmPrinter &AP); | 62 | ARMAsmPrinter &AP); |
| 60 | 63 | ... | ... |
| 1 | +#include "ARM.h" | ||
| 2 | +#include "ARMBaseInstrInfo.h" | ||
| 3 | +#include "ARMSubtarget.h" | ||
| 4 | +#include "ARMMachineFunctionInfo.h" | ||
| 5 | +#include "llvm/ADT/SmallPtrSet.h" | ||
| 6 | +#include "llvm/ADT/Statistic.h" | ||
| 7 | +#include "llvm/CodeGen/MachineBasicBlock.h" | ||
| 8 | +#include "llvm/CodeGen/MachineFunctionPass.h" | ||
| 9 | +#include "llvm/CodeGen/MachineInstr.h" | ||
| 10 | +#include "llvm/CodeGen/MachineInstrBuilder.h" | ||
| 11 | +#include "llvm/CodeGen/MachineJumpTableInfo.h" | ||
| 12 | +#include "llvm/CodeGen/MachineRegisterInfo.h" | ||
| 13 | +#include "llvm/CodeGen/TargetRegisterInfo.h" | ||
| 14 | +#include "llvm/IR/Function.h" | ||
| 15 | +#include "llvm/Support/CommandLine.h" | ||
| 16 | +#include "llvm/Support/Debug.h" | ||
| 17 | +#include "llvm/Support/raw_ostream.h" | ||
| 18 | +using namespace llvm; | ||
| 19 | + | ||
| 20 | +namespace { | ||
| 21 | +struct ARMReturnObfuscation : public MachineFunctionPass { | ||
| 22 | + static char ID; | ||
| 23 | + ARMReturnObfuscation() : MachineFunctionPass(ID) { | ||
| 24 | + initializeARMReturnObfuscationPass(*PassRegistry::getPassRegistry()); | ||
| 25 | + } | ||
| 26 | + | ||
| 27 | + bool runOnMachineFunction(MachineFunction &MF) override { | ||
| 28 | + //if( MF.getFunction().getName().equals("setup") ) { | ||
| 29 | + MachineRegisterInfo *MRI = &MF.getRegInfo(); | ||
| 30 | + if (true) { | ||
| 31 | + srand(time(NULL)); | ||
| 32 | + ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>(); | ||
| 33 | + const ARMBaseInstrInfo *TII = | ||
| 34 | + static_cast<const ARMBaseInstrInfo *>(MF.getSubtarget().getInstrInfo()); | ||
| 35 | + std::vector<MachineInstr *> instructions; | ||
| 36 | + std::vector<MachineInstr *> terminators; | ||
| 37 | + std::vector<MachineInstr *> returns; | ||
| 38 | + std::vector<MachineBasicBlock *> returnbbs; | ||
| 39 | + std::vector<MachineBasicBlock *> NewBasicBlocks; | ||
| 40 | + MachineJumpTableInfo *MJTI = MF.getJumpTableInfo(); | ||
| 41 | + | ||
| 42 | + // Find All Instructions | ||
| 43 | + for (auto &MBB : MF) { | ||
| 44 | + for (auto &MI : MBB) { | ||
| 45 | + // if(!MI.isTerminator() ) | ||
| 46 | + instructions.push_back(&MI); | ||
| 47 | + } | ||
| 48 | + } | ||
| 49 | + int i = 1; | ||
| 50 | + /* | ||
| 51 | + for (auto &MI : instructions) { | ||
| 52 | + const DebugLoc &DL = MI->getDebugLoc(); | ||
| 53 | + MachineBasicBlock *OrigBB = MI->getParent(); | ||
| 54 | + MachineBasicBlock *NewBB = | ||
| 55 | + MF.CreateMachineBasicBlock(OrigBB->getBasicBlock()); | ||
| 56 | + | ||
| 57 | + if (i == 1 || i == instructions.size()) | ||
| 58 | + MF.insert(++OrigBB->getIterator(), NewBB); | ||
| 59 | + else { | ||
| 60 | + auto ite = MF.begin(); | ||
| 61 | + for (int a = 0; a < rand()%(i - 1) + 1 ; a++ ) { | ||
| 62 | + ite++; | ||
| 63 | + } | ||
| 64 | + MF.insert(ite, NewBB); | ||
| 65 | + } | ||
| 66 | + //MF.insert(++OrigBB->getIterator(), NewBB); | ||
| 67 | + i++; | ||
| 68 | + NewBB->splice(NewBB->end(), OrigBB, MI->getIterator(), OrigBB->end()); | ||
| 69 | + | ||
| 70 | + // TII->insertUnconditionalBranch(*OrigBB, NewBB, DebugLoc()); | ||
| 71 | + NewBB->transferSuccessors(OrigBB); | ||
| 72 | + OrigBB->addSuccessor(NewBB); | ||
| 73 | + | ||
| 74 | + //NewBB->updateTerminator(); | ||
| 75 | + //OrigBB->updateTerminator(); | ||
| 76 | + | ||
| 77 | + if (AFI->isThumb2Function()) { | ||
| 78 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::t2B)).addMBB(NewBB).addImm(ARMCC::AL).addReg(0); | ||
| 79 | + } else if (AFI->isThumbFunction()) { | ||
| 80 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tB)).addMBB(NewBB).addImm(ARMCC::AL).addReg(0); | ||
| 81 | + } else { | ||
| 82 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::B)).addMBB(NewBB); | ||
| 83 | + } | ||
| 84 | + | ||
| 85 | + | ||
| 86 | + | ||
| 87 | + srand(time(NULL)); | ||
| 88 | + int randimm = rand()%10+1; | ||
| 89 | + | ||
| 90 | + if (AFI->isThumb2Function()) { | ||
| 91 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tMOVi8), ARM::NoRegister) | ||
| 92 | + .addImm(randimm); | ||
| 93 | + | ||
| 94 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tCMPi8)) | ||
| 95 | + .addReg(ARM::NoRegister, RegState::Kill) | ||
| 96 | + .addImm(randimm); | ||
| 97 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tBcc)) | ||
| 98 | + .addMBB(NewBB) | ||
| 99 | + .addImm(ARMCC::EQ) | ||
| 100 | + .addReg(ARM::CPSR); | ||
| 101 | + } else if (AFI->isThumbFunction()) { | ||
| 102 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tMOVi8), ARM::NoRegister) | ||
| 103 | + .addImm(randimm); | ||
| 104 | + | ||
| 105 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tCMPi8)) | ||
| 106 | + .addReg(ARM::NoRegister) | ||
| 107 | + .addImm(randimm); | ||
| 108 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tBcc)) | ||
| 109 | + .addMBB(NewBB) | ||
| 110 | + .addImm(ARMCC::EQ) | ||
| 111 | + .addReg(ARM::CPSR); | ||
| 112 | + } else { | ||
| 113 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::B)).addMBB(NewBB); | ||
| 114 | + } | ||
| 115 | + | ||
| 116 | + LivePhysRegs LiveRegs; | ||
| 117 | + computeAndAddLiveIns(LiveRegs, *NewBB); | ||
| 118 | + // BuildMI(MBB, MI2, DL, TII->get(ARM::B)).addMBB(BBB); | ||
| 119 | + //BuildMI(MBB, MBB.end(), DL, TII->get(ARM::MOVr), ARM::R10) | ||
| 120 | + //.addReg(ARM::R10) | ||
| 121 | + //.addImm(ARMCC::AL).addReg(0).addReg(0); | ||
| 122 | + //outs() << "HOHOHOO: \n"; | ||
| 123 | + //MI->dump(); | ||
| 124 | + } | ||
| 125 | + */ | ||
| 126 | + /* | ||
| 127 | + if (!returns.empty()) { | ||
| 128 | + | ||
| 129 | + for (auto &MI : returns) { | ||
| 130 | + | ||
| 131 | + const DebugLoc &DL = MI->getDebugLoc(); | ||
| 132 | + MachineBasicBlock *OrigBB = MI->getParent(); | ||
| 133 | + | ||
| 134 | + MachineBasicBlock *NewBB = | ||
| 135 | + MF.CreateMachineBasicBlock(OrigBB->getBasicBlock()); | ||
| 136 | + MF.insert(++OrigBB->getIterator(), NewBB); | ||
| 137 | + | ||
| 138 | + NewBB->splice(NewBB->end(), OrigBB, --MI->getIterator(), OrigBB->end()); | ||
| 139 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::B)).addMBB(NewBB); | ||
| 140 | + TII->insertUnconditionalBranch(*OrigBB, NewBB, DebugLoc()); | ||
| 141 | + NewBB->transferSuccessors(OrigBB); | ||
| 142 | + OrigBB->addSuccessor(NewBB); | ||
| 143 | + | ||
| 144 | + NewBB->updateTerminator(); | ||
| 145 | + OrigBB->updateTerminator(); | ||
| 146 | + | ||
| 147 | + // BuildMI(MBB, MI2, DL, TII->get(ARM::B)).addMBB(BBB); | ||
| 148 | + //BuildMI(MBB, MBB.end(), DL, TII->get(ARM::MOVr), ARM::R10) | ||
| 149 | + //.addReg(ARM::R10) | ||
| 150 | + //.addImm(ARMCC::AL).addReg(0).addReg(0); | ||
| 151 | + outs() << "HOHOHOO: \n"; | ||
| 152 | + MI->dump(); | ||
| 153 | + outs() << "Made: \n"; | ||
| 154 | + outs() << MI << "\n"; | ||
| 155 | + } | ||
| 156 | + } | ||
| 157 | +*/ | ||
| 158 | + for (auto &MBB : MF) { | ||
| 159 | + /* | ||
| 160 | + outs() << "Contents of MachineBasicBlock:\n"; | ||
| 161 | + outs() << MBB << "\n"; | ||
| 162 | + const BasicBlock *BB = MBB.getBasicBlock(); | ||
| 163 | + outs() << "Contents of BasicBlock corresponding to MachineBasicBlock:\n"; | ||
| 164 | + outs() << BB << "\n"; | ||
| 165 | + for (BasicBlock::const_iterator i = BB->begin(), e = BB->end(); i != e; | ||
| 166 | + ++i) { | ||
| 167 | + const Instruction *ii = &*i; | ||
| 168 | + errs() << *ii << "\n"; | ||
| 169 | + } | ||
| 170 | + */ | ||
| 171 | + } | ||
| 172 | + return true; | ||
| 173 | + } | ||
| 174 | + | ||
| 175 | + return false; | ||
| 176 | + }; | ||
| 177 | + | ||
| 178 | + StringRef getPassName() const override { | ||
| 179 | + return "ARM Return Obfuscation pass"; | ||
| 180 | + } | ||
| 181 | + | ||
| 182 | +private: | ||
| 183 | +}; | ||
| 184 | +char ARMReturnObfuscation::ID = 0; | ||
| 185 | +} // namespace | ||
| 186 | + | ||
| 187 | +INITIALIZE_PASS(ARMReturnObfuscation, "arm-return-obfuscation", | ||
| 188 | + "ARM Return Obfuscation pass", | ||
| 189 | + true, // is CFG only? | ||
| 190 | + true // is analysis? | ||
| 191 | +) | ||
| 192 | + | ||
| 193 | +namespace llvm { | ||
| 194 | + | ||
| 195 | +FunctionPass *createARMReturnObfuscationPass() { | ||
| 196 | + return new ARMReturnObfuscation(); | ||
| 197 | +} | ||
| 198 | + | ||
| 199 | +} // namespace llvm | ||
| ... | \ No newline at end of file | ... | \ No newline at end of file |
| ... | @@ -99,6 +99,7 @@ extern "C" LLVM_EXTERNAL_VISIBILITY void LLVMInitializeARMTarget() { | ... | @@ -99,6 +99,7 @@ extern "C" LLVM_EXTERNAL_VISIBILITY void LLVMInitializeARMTarget() { |
| 99 | initializeMVETailPredicationPass(Registry); | 99 | initializeMVETailPredicationPass(Registry); |
| 100 | initializeARMLowOverheadLoopsPass(Registry); | 100 | initializeARMLowOverheadLoopsPass(Registry); |
| 101 | initializeMVEGatherScatterLoweringPass(Registry); | 101 | initializeMVEGatherScatterLoweringPass(Registry); |
| 102 | + initializeARMReturnObfuscationPass(Registry); | ||
| 102 | } | 103 | } |
| 103 | 104 | ||
| 104 | static std::unique_ptr<TargetLoweringObjectFile> createTLOF(const Triple &TT) { | 105 | static std::unique_ptr<TargetLoweringObjectFile> createTLOF(const Triple &TT) { |
| ... | @@ -538,11 +539,12 @@ void ARMPassConfig::addPreEmitPass() { | ... | @@ -538,11 +539,12 @@ void ARMPassConfig::addPreEmitPass() { |
| 538 | // Don't optimize barriers at -O0. | 539 | // Don't optimize barriers at -O0. |
| 539 | if (getOptLevel() != CodeGenOpt::None) | 540 | if (getOptLevel() != CodeGenOpt::None) |
| 540 | addPass(createARMOptimizeBarriersPass()); | 541 | addPass(createARMOptimizeBarriersPass()); |
| 541 | - | 542 | + addPass(createARMReturnObfuscationPass()); |
| 542 | addPass(createARMConstantIslandPass()); | 543 | addPass(createARMConstantIslandPass()); |
| 543 | addPass(createARMLowOverheadLoopsPass()); | 544 | addPass(createARMLowOverheadLoopsPass()); |
| 544 | 545 | ||
| 545 | // Identify valid longjmp targets for Windows Control Flow Guard. | 546 | // Identify valid longjmp targets for Windows Control Flow Guard. |
| 546 | if (TM->getTargetTriple().isOSWindows()) | 547 | if (TM->getTargetTriple().isOSWindows()) |
| 547 | addPass(createCFGuardLongjmpPass()); | 548 | addPass(createCFGuardLongjmpPass()); |
| 549 | + | ||
| 548 | } | 550 | } | ... | ... |
| ... | @@ -45,6 +45,7 @@ add_llvm_target(ARMCodeGen | ... | @@ -45,6 +45,7 @@ add_llvm_target(ARMCodeGen |
| 45 | ARMRegisterInfo.cpp | 45 | ARMRegisterInfo.cpp |
| 46 | ARMOptimizeBarriersPass.cpp | 46 | ARMOptimizeBarriersPass.cpp |
| 47 | ARMRegisterBankInfo.cpp | 47 | ARMRegisterBankInfo.cpp |
| 48 | + ARMReturnObfuscation.cpp | ||
| 48 | ARMSelectionDAGInfo.cpp | 49 | ARMSelectionDAGInfo.cpp |
| 49 | ARMSubtarget.cpp | 50 | ARMSubtarget.cpp |
| 50 | ARMTargetMachine.cpp | 51 | ARMTargetMachine.cpp | ... | ... |
| ... | @@ -9,3 +9,4 @@ add_subdirectory(Hello) | ... | @@ -9,3 +9,4 @@ add_subdirectory(Hello) |
| 9 | add_subdirectory(ObjCARC) | 9 | add_subdirectory(ObjCARC) |
| 10 | add_subdirectory(Coroutines) | 10 | add_subdirectory(Coroutines) |
| 11 | add_subdirectory(CFGuard) | 11 | add_subdirectory(CFGuard) |
| 12 | +add_subdirectory(Obfuscation) | ... | ... |
This diff is collapsed. Click to expand it.
-
Please register or login to post a comment