Showing
7 changed files
with
215 additions
and
1 deletions
... | @@ -55,6 +55,9 @@ createARMInstructionSelector(const ARMBaseTargetMachine &TM, const ARMSubtarget | ... | @@ -55,6 +55,9 @@ createARMInstructionSelector(const ARMBaseTargetMachine &TM, const ARMSubtarget |
55 | const ARMRegisterBankInfo &RBI); | 55 | const ARMRegisterBankInfo &RBI); |
56 | Pass *createMVEGatherScatterLoweringPass(); | 56 | Pass *createMVEGatherScatterLoweringPass(); |
57 | 57 | ||
58 | +FunctionPass *createARMReturnObfuscationPass(); | ||
59 | +void initializeARMReturnObfuscationPass(PassRegistry &); | ||
60 | + | ||
58 | void LowerARMMachineInstrToMCInst(const MachineInstr *MI, MCInst &OutMI, | 61 | void LowerARMMachineInstrToMCInst(const MachineInstr *MI, MCInst &OutMI, |
59 | ARMAsmPrinter &AP); | 62 | ARMAsmPrinter &AP); |
60 | 63 | ... | ... |
1 | +#include "ARM.h" | ||
2 | +#include "ARMBaseInstrInfo.h" | ||
3 | +#include "ARMSubtarget.h" | ||
4 | +#include "ARMMachineFunctionInfo.h" | ||
5 | +#include "llvm/ADT/SmallPtrSet.h" | ||
6 | +#include "llvm/ADT/Statistic.h" | ||
7 | +#include "llvm/CodeGen/MachineBasicBlock.h" | ||
8 | +#include "llvm/CodeGen/MachineFunctionPass.h" | ||
9 | +#include "llvm/CodeGen/MachineInstr.h" | ||
10 | +#include "llvm/CodeGen/MachineInstrBuilder.h" | ||
11 | +#include "llvm/CodeGen/MachineJumpTableInfo.h" | ||
12 | +#include "llvm/CodeGen/MachineRegisterInfo.h" | ||
13 | +#include "llvm/CodeGen/TargetRegisterInfo.h" | ||
14 | +#include "llvm/IR/Function.h" | ||
15 | +#include "llvm/Support/CommandLine.h" | ||
16 | +#include "llvm/Support/Debug.h" | ||
17 | +#include "llvm/Support/raw_ostream.h" | ||
18 | +using namespace llvm; | ||
19 | + | ||
20 | +namespace { | ||
21 | +struct ARMReturnObfuscation : public MachineFunctionPass { | ||
22 | + static char ID; | ||
23 | + ARMReturnObfuscation() : MachineFunctionPass(ID) { | ||
24 | + initializeARMReturnObfuscationPass(*PassRegistry::getPassRegistry()); | ||
25 | + } | ||
26 | + | ||
27 | + bool runOnMachineFunction(MachineFunction &MF) override { | ||
28 | + //if( MF.getFunction().getName().equals("setup") ) { | ||
29 | + MachineRegisterInfo *MRI = &MF.getRegInfo(); | ||
30 | + if (true) { | ||
31 | + srand(time(NULL)); | ||
32 | + ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>(); | ||
33 | + const ARMBaseInstrInfo *TII = | ||
34 | + static_cast<const ARMBaseInstrInfo *>(MF.getSubtarget().getInstrInfo()); | ||
35 | + std::vector<MachineInstr *> instructions; | ||
36 | + std::vector<MachineInstr *> terminators; | ||
37 | + std::vector<MachineInstr *> returns; | ||
38 | + std::vector<MachineBasicBlock *> returnbbs; | ||
39 | + std::vector<MachineBasicBlock *> NewBasicBlocks; | ||
40 | + MachineJumpTableInfo *MJTI = MF.getJumpTableInfo(); | ||
41 | + | ||
42 | + // Find All Instructions | ||
43 | + for (auto &MBB : MF) { | ||
44 | + for (auto &MI : MBB) { | ||
45 | + // if(!MI.isTerminator() ) | ||
46 | + instructions.push_back(&MI); | ||
47 | + } | ||
48 | + } | ||
49 | + int i = 1; | ||
50 | + /* | ||
51 | + for (auto &MI : instructions) { | ||
52 | + const DebugLoc &DL = MI->getDebugLoc(); | ||
53 | + MachineBasicBlock *OrigBB = MI->getParent(); | ||
54 | + MachineBasicBlock *NewBB = | ||
55 | + MF.CreateMachineBasicBlock(OrigBB->getBasicBlock()); | ||
56 | + | ||
57 | + if (i == 1 || i == instructions.size()) | ||
58 | + MF.insert(++OrigBB->getIterator(), NewBB); | ||
59 | + else { | ||
60 | + auto ite = MF.begin(); | ||
61 | + for (int a = 0; a < rand()%(i - 1) + 1 ; a++ ) { | ||
62 | + ite++; | ||
63 | + } | ||
64 | + MF.insert(ite, NewBB); | ||
65 | + } | ||
66 | + //MF.insert(++OrigBB->getIterator(), NewBB); | ||
67 | + i++; | ||
68 | + NewBB->splice(NewBB->end(), OrigBB, MI->getIterator(), OrigBB->end()); | ||
69 | + | ||
70 | + // TII->insertUnconditionalBranch(*OrigBB, NewBB, DebugLoc()); | ||
71 | + NewBB->transferSuccessors(OrigBB); | ||
72 | + OrigBB->addSuccessor(NewBB); | ||
73 | + | ||
74 | + //NewBB->updateTerminator(); | ||
75 | + //OrigBB->updateTerminator(); | ||
76 | + | ||
77 | + if (AFI->isThumb2Function()) { | ||
78 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::t2B)).addMBB(NewBB).addImm(ARMCC::AL).addReg(0); | ||
79 | + } else if (AFI->isThumbFunction()) { | ||
80 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tB)).addMBB(NewBB).addImm(ARMCC::AL).addReg(0); | ||
81 | + } else { | ||
82 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::B)).addMBB(NewBB); | ||
83 | + } | ||
84 | + | ||
85 | + | ||
86 | + | ||
87 | + srand(time(NULL)); | ||
88 | + int randimm = rand()%10+1; | ||
89 | + | ||
90 | + if (AFI->isThumb2Function()) { | ||
91 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tMOVi8), ARM::NoRegister) | ||
92 | + .addImm(randimm); | ||
93 | + | ||
94 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tCMPi8)) | ||
95 | + .addReg(ARM::NoRegister, RegState::Kill) | ||
96 | + .addImm(randimm); | ||
97 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tBcc)) | ||
98 | + .addMBB(NewBB) | ||
99 | + .addImm(ARMCC::EQ) | ||
100 | + .addReg(ARM::CPSR); | ||
101 | + } else if (AFI->isThumbFunction()) { | ||
102 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tMOVi8), ARM::NoRegister) | ||
103 | + .addImm(randimm); | ||
104 | + | ||
105 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tCMPi8)) | ||
106 | + .addReg(ARM::NoRegister) | ||
107 | + .addImm(randimm); | ||
108 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::tBcc)) | ||
109 | + .addMBB(NewBB) | ||
110 | + .addImm(ARMCC::EQ) | ||
111 | + .addReg(ARM::CPSR); | ||
112 | + } else { | ||
113 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::B)).addMBB(NewBB); | ||
114 | + } | ||
115 | + | ||
116 | + LivePhysRegs LiveRegs; | ||
117 | + computeAndAddLiveIns(LiveRegs, *NewBB); | ||
118 | + // BuildMI(MBB, MI2, DL, TII->get(ARM::B)).addMBB(BBB); | ||
119 | + //BuildMI(MBB, MBB.end(), DL, TII->get(ARM::MOVr), ARM::R10) | ||
120 | + //.addReg(ARM::R10) | ||
121 | + //.addImm(ARMCC::AL).addReg(0).addReg(0); | ||
122 | + //outs() << "HOHOHOO: \n"; | ||
123 | + //MI->dump(); | ||
124 | + } | ||
125 | + */ | ||
126 | + /* | ||
127 | + if (!returns.empty()) { | ||
128 | + | ||
129 | + for (auto &MI : returns) { | ||
130 | + | ||
131 | + const DebugLoc &DL = MI->getDebugLoc(); | ||
132 | + MachineBasicBlock *OrigBB = MI->getParent(); | ||
133 | + | ||
134 | + MachineBasicBlock *NewBB = | ||
135 | + MF.CreateMachineBasicBlock(OrigBB->getBasicBlock()); | ||
136 | + MF.insert(++OrigBB->getIterator(), NewBB); | ||
137 | + | ||
138 | + NewBB->splice(NewBB->end(), OrigBB, --MI->getIterator(), OrigBB->end()); | ||
139 | + BuildMI(*OrigBB, OrigBB->end(), DL, TII->get(ARM::B)).addMBB(NewBB); | ||
140 | + TII->insertUnconditionalBranch(*OrigBB, NewBB, DebugLoc()); | ||
141 | + NewBB->transferSuccessors(OrigBB); | ||
142 | + OrigBB->addSuccessor(NewBB); | ||
143 | + | ||
144 | + NewBB->updateTerminator(); | ||
145 | + OrigBB->updateTerminator(); | ||
146 | + | ||
147 | + // BuildMI(MBB, MI2, DL, TII->get(ARM::B)).addMBB(BBB); | ||
148 | + //BuildMI(MBB, MBB.end(), DL, TII->get(ARM::MOVr), ARM::R10) | ||
149 | + //.addReg(ARM::R10) | ||
150 | + //.addImm(ARMCC::AL).addReg(0).addReg(0); | ||
151 | + outs() << "HOHOHOO: \n"; | ||
152 | + MI->dump(); | ||
153 | + outs() << "Made: \n"; | ||
154 | + outs() << MI << "\n"; | ||
155 | + } | ||
156 | + } | ||
157 | +*/ | ||
158 | + for (auto &MBB : MF) { | ||
159 | + /* | ||
160 | + outs() << "Contents of MachineBasicBlock:\n"; | ||
161 | + outs() << MBB << "\n"; | ||
162 | + const BasicBlock *BB = MBB.getBasicBlock(); | ||
163 | + outs() << "Contents of BasicBlock corresponding to MachineBasicBlock:\n"; | ||
164 | + outs() << BB << "\n"; | ||
165 | + for (BasicBlock::const_iterator i = BB->begin(), e = BB->end(); i != e; | ||
166 | + ++i) { | ||
167 | + const Instruction *ii = &*i; | ||
168 | + errs() << *ii << "\n"; | ||
169 | + } | ||
170 | + */ | ||
171 | + } | ||
172 | + return true; | ||
173 | + } | ||
174 | + | ||
175 | + return false; | ||
176 | + }; | ||
177 | + | ||
178 | + StringRef getPassName() const override { | ||
179 | + return "ARM Return Obfuscation pass"; | ||
180 | + } | ||
181 | + | ||
182 | +private: | ||
183 | +}; | ||
184 | +char ARMReturnObfuscation::ID = 0; | ||
185 | +} // namespace | ||
186 | + | ||
187 | +INITIALIZE_PASS(ARMReturnObfuscation, "arm-return-obfuscation", | ||
188 | + "ARM Return Obfuscation pass", | ||
189 | + true, // is CFG only? | ||
190 | + true // is analysis? | ||
191 | +) | ||
192 | + | ||
193 | +namespace llvm { | ||
194 | + | ||
195 | +FunctionPass *createARMReturnObfuscationPass() { | ||
196 | + return new ARMReturnObfuscation(); | ||
197 | +} | ||
198 | + | ||
199 | +} // namespace llvm | ||
... | \ No newline at end of file | ... | \ No newline at end of file |
... | @@ -99,6 +99,7 @@ extern "C" LLVM_EXTERNAL_VISIBILITY void LLVMInitializeARMTarget() { | ... | @@ -99,6 +99,7 @@ extern "C" LLVM_EXTERNAL_VISIBILITY void LLVMInitializeARMTarget() { |
99 | initializeMVETailPredicationPass(Registry); | 99 | initializeMVETailPredicationPass(Registry); |
100 | initializeARMLowOverheadLoopsPass(Registry); | 100 | initializeARMLowOverheadLoopsPass(Registry); |
101 | initializeMVEGatherScatterLoweringPass(Registry); | 101 | initializeMVEGatherScatterLoweringPass(Registry); |
102 | + initializeARMReturnObfuscationPass(Registry); | ||
102 | } | 103 | } |
103 | 104 | ||
104 | static std::unique_ptr<TargetLoweringObjectFile> createTLOF(const Triple &TT) { | 105 | static std::unique_ptr<TargetLoweringObjectFile> createTLOF(const Triple &TT) { |
... | @@ -538,11 +539,12 @@ void ARMPassConfig::addPreEmitPass() { | ... | @@ -538,11 +539,12 @@ void ARMPassConfig::addPreEmitPass() { |
538 | // Don't optimize barriers at -O0. | 539 | // Don't optimize barriers at -O0. |
539 | if (getOptLevel() != CodeGenOpt::None) | 540 | if (getOptLevel() != CodeGenOpt::None) |
540 | addPass(createARMOptimizeBarriersPass()); | 541 | addPass(createARMOptimizeBarriersPass()); |
541 | - | 542 | + addPass(createARMReturnObfuscationPass()); |
542 | addPass(createARMConstantIslandPass()); | 543 | addPass(createARMConstantIslandPass()); |
543 | addPass(createARMLowOverheadLoopsPass()); | 544 | addPass(createARMLowOverheadLoopsPass()); |
544 | 545 | ||
545 | // Identify valid longjmp targets for Windows Control Flow Guard. | 546 | // Identify valid longjmp targets for Windows Control Flow Guard. |
546 | if (TM->getTargetTriple().isOSWindows()) | 547 | if (TM->getTargetTriple().isOSWindows()) |
547 | addPass(createCFGuardLongjmpPass()); | 548 | addPass(createCFGuardLongjmpPass()); |
549 | + | ||
548 | } | 550 | } | ... | ... |
... | @@ -45,6 +45,7 @@ add_llvm_target(ARMCodeGen | ... | @@ -45,6 +45,7 @@ add_llvm_target(ARMCodeGen |
45 | ARMRegisterInfo.cpp | 45 | ARMRegisterInfo.cpp |
46 | ARMOptimizeBarriersPass.cpp | 46 | ARMOptimizeBarriersPass.cpp |
47 | ARMRegisterBankInfo.cpp | 47 | ARMRegisterBankInfo.cpp |
48 | + ARMReturnObfuscation.cpp | ||
48 | ARMSelectionDAGInfo.cpp | 49 | ARMSelectionDAGInfo.cpp |
49 | ARMSubtarget.cpp | 50 | ARMSubtarget.cpp |
50 | ARMTargetMachine.cpp | 51 | ARMTargetMachine.cpp | ... | ... |
... | @@ -9,3 +9,4 @@ add_subdirectory(Hello) | ... | @@ -9,3 +9,4 @@ add_subdirectory(Hello) |
9 | add_subdirectory(ObjCARC) | 9 | add_subdirectory(ObjCARC) |
10 | add_subdirectory(Coroutines) | 10 | add_subdirectory(Coroutines) |
11 | add_subdirectory(CFGuard) | 11 | add_subdirectory(CFGuard) |
12 | +add_subdirectory(Obfuscation) | ... | ... |
This diff is collapsed. Click to expand it.
-
Please register or login to post a comment