SimpleDebugger/Sources/SimpleDebugger/SimpleDebugger.cpp at main · EmergeTools/SimpleDebugger · GitHub

History

256 lines (211 loc) · 8.22 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

// SimpleDebugger.h

// SimpleDebugger

// Created by Noah Martin on 10/9/24.

#include "SimpleDebugger.h"

#if EMG_ENABLE_MACH_APIS

#import <pthread.h>

#import <mutex>

#import <mach/mach.h>

#import <libgen.h>

#import <os/log.h>

#import <mach-o/dyld_images.h>

#include "mach_messages.h"

#include "emg_vm_protect.h"

#include <mach/exception.h>

#include <mach/arm/thread_state.h>

SimpleDebugger::SimpleDebugger() : exceptionPort(MACH_PORT_NULL) {}

void replace_image_notifier(enum dyld_image_mode mode, uint32_t infoCount, const struct dyld_image_info info[]) { }

bool SimpleDebugger::startDebugging() {

struct task_dyld_info dyld_info;

mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;

task_info(mach_task_self_, TASK_DYLD_INFO, (task_info_t)&dyld_info, &count);

struct dyld_all_image_infos *infos = (struct dyld_all_image_infos *)dyld_info.all_image_info_addr;

infos->notification = replace_image_notifier;

if (mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &exceptionPort) != KERN_SUCCESS) {

return false;

}

if (mach_port_insert_right(mach_task_self(), exceptionPort, exceptionPort, MACH_MSG_TYPE_MAKE_SEND) != KERN_SUCCESS) {

return false;

}

if (task_set_exception_ports(

mach_task_self(),

// Register for EXC_MASK_BAD_ACCESS to catch cases where a thread

// is trying to access a page that we are in the middle of changing.

// It temporarily has execute permissions removed so could trigger this.

// When it is triggered we should ignore it and retry the original instruction.

EXC_MASK_BREAKPOINT | EXC_MASK_BAD_ACCESS,

exceptionPort,

EXCEPTION_DEFAULT,

ARM_THREAD_STATE64) != KERN_SUCCESS) {

return false;

}

m.lock();

pthread_create(&serverThread, nullptr, &SimpleDebugger::exceptionServerWrapper, this);

// Prevent returning until the server thread has started

m.lock();

return true;

}

void SimpleDebugger::setExceptionCallback(ExceptionCallback callback) {

exceptionCallback = std::move(callback);

}

void SimpleDebugger::setBadAccessCallback(BadAccessCallback callback) {

badAccessCallback = std::move(callback);

}

#define ARM64_BREAK_INSTRUCTION 0xD4200000

void protectPage(vm_address_t address, vm_size_t size, vm_prot_t newProtection) {

kern_return_t result = emg_vm_protect(mach_task_self(), address, size, 0, newProtection);

if (result != 0) {

printf("error calling vm_protect: %s (response value: %d)\n", mach_error_string(result), result);

}

uint32_t setInstruction(vm_address_t address, uint32_t newInst) {

uint32_t instruction = *((uint32_t *)address);

thread_act_array_t threads;

mach_msg_type_number_t thread_count;

if (task_threads(mach_task_self(), &threads, &thread_count) != KERN_SUCCESS) {

thread_count = 0;

}

thread_t myThread = mach_thread_self();

for (mach_msg_type_number_t i = 0; i < thread_count; i++) {

if (threads[i] != myThread) {

thread_suspend(threads[i]);

}

protectPage(address, 1, VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY);

*(uint32_t *)address = newInst;

protectPage(address, 1, VM_PROT_READ | VM_PROT_EXECUTE);

for (mach_msg_type_number_t i = 0; i < thread_count; i++) {

if (threads[i] != myThread) {

thread_resume(threads[i]);

}

vm_size_t size = thread_count * sizeof(thread_t);

vm_deallocate(mach_task_self(), (vm_address_t) threads, size);

return instruction;

}

int SimpleDebugger::hookFunction(void *originalFunc, void *newFunc) {

uintptr_t addr = reinterpret_cast<uintptr_t>(newFunc);

uint8_t reg = 9;

for (int shift = 0; shift <= 48; shift += 16) {

uint16_t imm16 = (addr >> shift) & 0xFFFF;

uint32_t inst;

if (shift == 0) {

// First instruction: MOVZ

inst = 0xD2800000 | (imm16 << 5) | reg;

} else {

// Subsequent instructions: MOVK

uint32_t shift_enc = (shift / 16) << 21;

inst = 0xF2800000 | shift_enc | (imm16 << 5) | reg;

}

setInstruction((vm_address_t) originalFunc + 4 * (shift/16), inst);

}

// Make sure address fits into 16 bits

setInstruction((vm_address_t) originalFunc + (4 * 4), 0xD61F0120); // Branch to X9

return 0;

}

void SimpleDebugger::setBreakpoint(vm_address_t address) {

uint32_t instruction = setInstruction(address, ARM64_BREAK_INSTRUCTION);

originalInstruction.insert({address, instruction});

}

SimpleDebugger::~SimpleDebugger() {

// TODO: Handle stopping the exception server

}

void* SimpleDebugger::exceptionServerWrapper(void* arg) {

return static_cast<SimpleDebugger*>(arg)->exceptionServer();

}

void* SimpleDebugger::exceptionServer() {

MachExceptionMessage exceptionMessage = {{0}};

os_log(OS_LOG_DEFAULT, "Exception server started");

m.unlock();

while (true) {

kern_return_t kr = mach_msg(&exceptionMessage.header,

MACH_RCV_MSG,

sizeof(exceptionMessage),

exceptionPort,

MACH_MSG_TIMEOUT_NONE,

MACH_PORT_NULL);

if (kr != KERN_SUCCESS) {

os_log(OS_LOG_DEFAULT, "Error receiving message");

continue;

}

mach_port_t thread = exceptionMessage.thread.name;

arm_thread_state64_t state;

mach_msg_type_number_t state_count = ARM_THREAD_STATE64_COUNT;

kr = thread_get_state(thread, ARM_THREAD_STATE64, (thread_state_t)&state, &state_count);

if (kr != KERN_SUCCESS) {

printf("Error getting thread state: %s\n", mach_error_string(kr));

}

if (exceptionMessage.exception == EXC_BREAKPOINT) {

if (exceptionCallback && originalInstruction.contains(state.__pc)) {

exceptionCallback(thread, state, [this, thread, exceptionMessage, state, state_count](bool removeBreak) {

continueFromBreak(thread, removeBreak, exceptionMessage, state, state_count);

});

} else {

continueFromBreak(thread, false, exceptionMessage, state, state_count);

}

} else {

os_log(OS_LOG_DEFAULT, "Not breakpoint message");

if (badAccessCallback) {

badAccessCallback(thread, state);

}

continueFromBreak(thread, false, exceptionMessage, state, state_count);

}

return nullptr;

}

static void setSingleStep(thread_t thread, bool enable) {

arm_debug_state64_t dbg = {};

mach_msg_type_number_t count = ARM_DEBUG_STATE64_COUNT;

kern_return_t kr = thread_get_state(thread,

ARM_DEBUG_STATE64,

(thread_state_t)&dbg,

&count);

if (kr != KERN_SUCCESS) return;

// MDSCR_EL1.SS is bit 0 on ARMv8 (single-step enable).

if (enable) dbg.__mdscr_el1 |= 1ULL;

else dbg.__mdscr_el1 &= ~1ULL;

thread_set_state(thread,

ARM_DEBUG_STATE64,

(thread_state_t)&dbg,

ARM_DEBUG_STATE64_COUNT);

}

void SimpleDebugger::continueFromBreak(mach_port_t thread, bool removeBreak, MachExceptionMessage exceptionMessage, arm_thread_state64_t state, mach_msg_type_number_t state_count) {

if (originalInstruction.contains(state.__pc)) {

uint32_t orig = originalInstruction.at(state.__pc);

setInstruction(state.__pc, orig);

if (removeBreak) {

originalInstruction.erase(state.__pc);

} else {

setSingleStep(thread, true);

}

} else {

// This is expected to be called on single step

// Re-enable the breakpoint

setBreakpoint(state.__pc - 4);

// Disable single step

setSingleStep(thread, false);

}

MachReplyMessage replyMessage = {{0}};

replyMessage.header = exceptionMessage.header;

replyMessage.header.msgh_bits = MACH_MSGH_BITS(MACH_MSGH_BITS_REMOTE(exceptionMessage.header.msgh_bits), 0);

replyMessage.header.msgh_local_port = MACH_PORT_NULL;

replyMessage.header.msgh_size = sizeof(replyMessage);

replyMessage.NDR = exceptionMessage.NDR;

replyMessage.returnCode = KERN_SUCCESS;

replyMessage.header.msgh_id = exceptionMessage.header.msgh_id + 100;

kern_return_t kr = mach_msg(&replyMessage.header,

MACH_SEND_MSG,

sizeof(replyMessage),

MACH_PORT_NULL,

MACH_MSG_TIMEOUT_NONE,

MACH_PORT_NULL);

if (kr != KERN_SUCCESS) {

os_log(OS_LOG_DEFAULT, "Error sending reply: %s", mach_error_string(kr));

}

#endif

SimpleDebugger/Sources/SimpleDebugger/SimpleDebugger.cpp at main · EmergeTools/SimpleDebugger · GitHub

Uh oh!

Expand file tree

Breadcrumbs

SimpleDebugger.cpp

Latest commit

History

Breadcrumbs

SimpleDebugger.cpp

File metadata and controls