mirror of
https://codeberg.org/reverse-skill-lab/apk-reverse
synced 2026-11-15 20:54:31 +08:00
Hardware pass: hardware watchpoints, ETE differential tracing, kernel-side event injection
Add the layer under the software tooling, in the repository's shape: what runs on a host is measured, and every device-bound or kernel-bound piece is a gated, labelled template. - scripts/hw_watch.py: arm64 hardware watchpoints/execution breakpoints. WCR/ BCR encoders with the 8-byte-window and alignment rules (unit-tested to the canonical 0x1FFD/0x3F05), a self-contained on-device ptrace helper that compiles clean as a static aarch64 ELF (observed: cross gcc 16.2), adb orchestration, and hit decoding to module+offset. The stealth ledger is stated three times on purpose: the ptrace route leaves TracerPid visible. - scripts/ete_capture.py: CoreSight ETE capture with the five gates (kernel era, coresight sysfs, cs_etm PMU, perf-with-CORESIGHT, permission), the perf/OpenCSD build recipe, and the per-thread record wrapper whose --control one-instruction run must pass before any real capture. - scripts/trace_diff.py: differential reduction of two execution traces into first-divergence / divergent regions / blocks-unique-to-each-side. Producer-agnostic: Stalker BLK logs (raw or run_probe-wrapped) and decoded cs_etm address streams alike, host-tested on synthetic flattened-dispatcher fixtures. - scripts/kernel_instrument_scaffold.py: KPM/LKM watchpoint + register-rewrite templates plus an honest userspace carrier; every kernel file carries a NOT COMPILED AND NOT LOADED banner that verify enforces, and the register-rewrite action is fenced as experimental in the template itself. - references/hardware-watchpoints.md, references/ete-diff-tracing.md, references/kernel-event-injection.md: the mechanism, the gates, the traps, and the composition recipes (watch the key buffer; diff two runs; flip the decision at the trap), with hand-offs instead of duplication. - Registration: 3 symptom rows (SKILL.md + routing mirror), 3 reference rows, 4 script rows, coverage/route-inventory/evidence rows, capability-matrix entries, known-limitations entry, eval case 4, README trees and coverage paragraphs in both languages, and three EXTENSION evidence records stating exactly what was measured on this host (encoders, compile, fixtures, generate/verify) and what was not (no watchpoint armed, no cs_etm stream, nothing kernel-side compiled or loaded anywhere). Hardware pass 2: SPE/BRBE crash forensics, address symbolization, VM de-virtualization Calibrated against the two public obfuscator implementations the user supplied (dpkg123/ollvm-aosp-toolchain: Hikari-family and Pluto-family flattening, the xvmp IR virtualizer at 63fec41f/9b7cf75e; fetched read-only into tools/_work/refs, git-ignored). Source facts observed, runtime inferred. - scripts/trace_addr2sym.py: runtime addresses -> symbol + static offset, zero-dependency ELF64 (PT_LOAD vaddr<->file-off conversion, .dynsym/.symtab, stripped section+off fallback). Host-verified against a real cross-compiled aarch64 .so with readelf as the independent cross-check, plus a hand-built minimal ELF covering vaddr!=offset; accepts hw_watch hits, trace mod+off keys, or raw address lists. Fixes on the way: --base int coercion, and nearest-below symbol semantics for PCs in inter-symbol gaps. - scripts/vm_handler_slice.py: slice an interpreter trace into handler segments (dispatcher detection = histogram top + predecessor diversity; the first 4x-margin rule refused the calibrated fixture itself and was replaced), signature clustering, open-tail handling, and the guest-opcode trajectory via an optional handler->opcode map. Calibrated against xvmp's documented shape: vm_exec(code,size,vm_args,num) stubs, boxed arguments observable before interpretation, 11 opcodes + 19 arithmetic sub-ops, const-materialization dispatch as a distinct segment. - references/hardware-sampling-and-crash.md: SPE (data flow without a known address; PC + data address per sample), BRBE (branch records when a crash stack cannot be trusted), the crash loop (tombstone -> branch records -> symbolize), and what each adds to the OLLVM/VMP routes. All documented-and-gated: no SPE sample or BRBE record was captured here. - Flattening-recipe corrections from source: Hikari keeps a frame-resident switchVar written through an indirect pointer with scramble32-permuted cases; Pluto stores switchVar/switchXor rolling-XOR so memory only ever holds noise -- hardware-watchpoints.md's state-variable recipe now distinguishes the families, and ete-diff-tracing.md carries the family table plus the xvmp shape. AntiDebugging injects raw svc inline asm with randomized fields, so byte signatures cannot survive it; semantic site-location can. - Registration: 3 symptom rows (untrustworthy crash stack; runtime addresses needing symbols; interpreter loop reading as noise), reference/script rows, coverage/evidence/capability-matrix entries, README trees in both languages, and EXTENSION-sampling-crash.md recording exactly what was measured (real .so symbolization, slicer fixtures, the slicer's self-found dispatcher-rule bug) and what was not (no SPE/BRBE capture, no hardened binary ever traced). Fix all PR #1 review findings by severity; un-entrench the tests that pinned them Major (device-breaking / wrong results): - hw_watch: match the arm64 user_hwdebug_state slot ABI (address register first, control second -- the swap armed nothing correctly) - hw_watch: every post-seize error path now clears slots and detaches; PTRACE_O_EXITKILL turned an analysis failure into a SIGKILL of the target - hw_watch: forward genuine target SIGTRAPs (raise/tgkill/int3); only ptrace event stops are consumed -- the reference's signal-preservation promise - hw_watch: run checks push/build/chmod and the helper's exit status; a dead capture is RESULT=blocked, never ok-no-hits - hw_watch: decode offsets from the module base, not each mapping's start - ete_capture: --control now requires the control record to DECODE (perf script event lines), the documented gate, not just a zero exit - ete_capture: -o before the -- workload separator in --cmd mode; all values shell-quoted into su -c; stale remote perf.data removed first; perf exit status checked (timeout's 124 is the normal window end) - kernel scaffold: --set-reg restricted to x0..x30; the rewrite is gated by its own breakpoint event so a watchpoint hit cannot run it; LKM pins the task (get/put_task_struct) across registration and calls the four-argument register_user_hw_breakpoint; --break rows initialize .addr/.len/.bp_type (there is no .pc member); --id validated against the module-id grammar - trace_addr2sym: exact module matching (path or basename, never substring); load bias aligned against the PT_LOAD (bias = start - (foff - p_offset) - p_vaddr); PCs outside the ELF span are refused instead of landing on the last symbol; --json stdout is a pure document (RESULT= in text mode only) - trace_diff: block keys need 0x or >=8 hex digits (PIDs/counts no longer parse); vm_handler_slice: dispatcher needs predecessor diversity, no frequency-margin fallback; both JSON outputs pure (check_commands' rule) Minor/nitpick: - capability-matrix + evidence-summary: trace reduction status ok->partial (no real-target producer ran it; the file's own definition of ok) - hardware-sampling-and-crash.md and the script examples carry --elf - kernel-event-injection.md no longer claims the callback's first statement is a filter (it prints unfiltered; the filter is a required change) - Elf64 caches symbol addresses for per-row bisect - docstring coverage of the touched surface: 16.67% -> 100% Tests: every json.loads workaround stripping RESULT= is gone; new regression tests cover the slot ABI, release-on-error, SIGTRAP forwarding, non-first mapping offsets, -o placement and su -c quoting, the control decode gate, x31/--id refusals, the guarded rewrite, outside-ELF PCs and bias math, short-token refusal and the dispatcher margin rule. The minimal-ELF fixture now packs a full 8-field Elf64_Phdr (its 7-field pack silently shifted p_memsz onto p_align). 739 passed; flake8/mypy and all five gates clean. Address the follow-up review on 0bd8dfe (6 findings) - ete_capture: two-layer quoting for the control-record, decode and cleanup commands -- shlex.quote spliced between literal single quotes broke out of su -c for any spaced output name; --seconds must be positive (timeout 0 disables the timer), refused before any adb check - kernel scaffold: --set-reg now refuses sp/pc as well (the template has no rewrite path for them; a generate that silently drops the action is the misleading kind of success); both templates arm with a sampling period (LKM via hw_breakpoint_init, KPM spells out sample_period=1) -- a zero period is a non-sampling event whose callback never fires: armed, silent - trace_addr2sym: contains_vaddr tests each PT_LOAD's loaded span instead of the whole-file extent; a PC in the unmapped gap between segments is refused rather than named after the nearest symbol below - trace_diff: a bare all-digit token is indistinguishable from a date or count, so block keys need 0x or a non-decimal hex digit; a date-only log stays refused as a capture failure Tests: two-layer quoting with a spaced control name, --seconds refusal, sp/pc in the rejection list, sampling-period assertions for both templates, a two-segment gap fixture, and a date-only parser case. 743 passed; flake8, mypy and all five gates clean.
This commit is contained in:
root
@@ -0,0 +1,167 @@
|
||||
"""Unit tests for vm_handler_slice.py: dispatcher detection, slicing, clustering,
|
||||
the open tail, and the opcode-map trajectory.
|
||||
|
||||
The fixture is a synthetic interpreter trace in the calibrated shape (dispatcher
|
||||
loop + handler chains + one const-materialization segment + unclosed tail), per
|
||||
docs/tool-verification/EXTENSION-sampling-crash.md.
|
||||
"""
|
||||
import json
|
||||
|
||||
import pytest
|
||||
|
||||
from conftest import load_script, run_script
|
||||
|
||||
vs = load_script("vm_handler_slice.py")
|
||||
|
||||
H = {"D": 0x1000, "load": 0x2000, "arith": 0x3000, "store": 0x4000,
|
||||
"br": 0x5000, "ret": 0x6000, "mat": 0x7000, "spin": 0x8000}
|
||||
|
||||
RUN = "D load D load arith D store D br D load D load arith store D br D mat D load arith D ret"
|
||||
|
||||
MAP = {"libvm.so+0x2000": "OP_LOAD", "libvm.so+0x3000": "OP_ARITH",
|
||||
"libvm.so+0x4000": "OP_STORE", "libvm.so+0x5000": "OP_BR",
|
||||
"libvm.so+0x6000": "OP_RET", "libvm.so+0x7000": "OP_CALL"}
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def vm_log(tmp_path):
|
||||
"""Vm log."""
|
||||
p = tmp_path / "vm.log"
|
||||
p.write_text("\n".join("BLK %d libvm.so+0x%x" % (i, H[k])
|
||||
for i, k in enumerate(RUN.split())) + "\n",
|
||||
encoding="utf-8")
|
||||
return p
|
||||
|
||||
|
||||
class TestPickDispatcher:
|
||||
def test_top_plus_predecessor_diversity(self):
|
||||
"""Top plus predecessor diversity."""
|
||||
blocks = ["libvm.so+0x%x" % H[k] for k in RUN.split()]
|
||||
assert vs.pick_dispatcher(blocks) == "libvm.so+0x1000"
|
||||
|
||||
def test_hottest_handler_may_tie_with_dispatcher(self):
|
||||
"""A stack-shaped VM runs OP_LOAD on every guest instruction: D and the
|
||||
hottest handler occur equally often, and when that handler is a single
|
||||
block the pair is a genuine 2-cycle (each has one predecessor -- the
|
||||
other). That is ambiguity, not a dispatcher: refuse and demand an
|
||||
explicit --dispatcher."""
|
||||
seq = "D load D load D load D load D load D load"
|
||||
blocks = ["libvm.so+0x%x" % H[k] for k in seq.split()]
|
||||
assert vs.pick_dispatcher(blocks) is None
|
||||
|
||||
def test_tie_with_multiblock_handler_resolves(self):
|
||||
"""Same tie, but the hot handler is two blocks: its tail block is a
|
||||
predecessor of D that the handler's own head never is, and other
|
||||
handlers join -- predecessor diversity decides for D."""
|
||||
seq = ("D load arith D load arith D load arith "
|
||||
"D store D load arith D br D load arith")
|
||||
blocks = ["libvm.so+0x%x" % H[k] for k in seq.split()]
|
||||
assert vs.pick_dispatcher(blocks) == "libvm.so+0x1000"
|
||||
|
||||
def test_no_loop_refused(self):
|
||||
"""No loop refused."""
|
||||
blocks = ["a.so+0x1", "a.so+0x2", "a.so+0x3"]
|
||||
assert vs.pick_dispatcher(blocks) is None
|
||||
|
||||
def test_frequency_margin_cannot_substitute_for_predecessor_diversity(self):
|
||||
"""A block 3x hotter than the runner-up but entered from one
|
||||
predecessor is a plain hot loop, not a dispatch loop: the docstring's
|
||||
rule is top + many distinct predecessors, so no frequency fallback
|
||||
may rescue it."""
|
||||
blocks = ["hot+0x1"] + ["foo+0x2", "hot+0x1"] * 4 + ["bar+0x3", "hot+0x1"]
|
||||
assert vs.pick_dispatcher(blocks) is None
|
||||
|
||||
def test_single_entry_histogram_is_accepted(self):
|
||||
"""Only one distinct block: nothing to be diverse against."""
|
||||
assert vs.pick_dispatcher(["a+0x1"] * 8) == "a+0x1"
|
||||
|
||||
|
||||
class TestSlicing:
|
||||
def test_segments_preamble_tail(self):
|
||||
"""Segments preamble tail."""
|
||||
blocks = ["libvm.so+0x%x" % H[k] for k in RUN.split()]
|
||||
segments, preamble, tail = vs.slice_segments(blocks, "libvm.so+0x1000")
|
||||
runs = [r for r, _closed in segments]
|
||||
assert runs[0] == ["libvm.so+0x2000"] # load
|
||||
assert runs[1] == ["libvm.so+0x2000", "libvm.so+0x3000"] # load arith
|
||||
assert ["libvm.so+0x7000"] in runs # const materialization
|
||||
assert segments[-1] == (["libvm.so+0x6000"], False) # ret: unclosed
|
||||
assert preamble == [] and tail == ["libvm.so+0x6000"]
|
||||
|
||||
def test_preamble_kept_separate(self):
|
||||
"""Preamble kept separate."""
|
||||
blocks = ["entry+0x1", "D", "h+0x2", "D", "h+0x3"]
|
||||
segments, preamble, tail = vs.slice_segments(blocks, "D")
|
||||
assert preamble == ["entry+0x1"]
|
||||
assert [r for r, _ in segments] == [["h+0x2"], ["h+0x3"]]
|
||||
|
||||
|
||||
class TestCluster:
|
||||
def test_signatures_and_counts(self):
|
||||
"""Signatures and counts."""
|
||||
blocks = ["libvm.so+0x%x" % H[k] for k in RUN.split()]
|
||||
segments, _, _ = vs.slice_segments(blocks, "libvm.so+0x1000")
|
||||
trajectory, stats = vs.cluster(segments)
|
||||
assert len(trajectory) == len(segments)
|
||||
# the load-only segment occurs twice (positions 0 and 4)
|
||||
load_sig = vs.signature(["libvm.so+0x2000"])
|
||||
assert stats[load_sig]["count"] == 2
|
||||
# every trajectory entry is a known signature
|
||||
assert set(trajectory) <= set(stats)
|
||||
|
||||
def test_spin_loop_diagnostic(self):
|
||||
"""Spin loop diagnostic."""
|
||||
blocks = ["a+0x1"] * 20
|
||||
segments, _, _ = vs.slice_segments(blocks, "a+0x1")
|
||||
segments = [(["b+0x2"], True)] * 20 if not segments else segments
|
||||
trajectory, stats = vs.cluster(segments)
|
||||
diag = vs.diagnostics(blocks, "a+0x1", [r for r, _ in segments], stats)
|
||||
assert any("spin" in n for n in diag["notes"])
|
||||
|
||||
|
||||
class TestCli:
|
||||
def test_full_run_with_opcode_map(self, vm_log, tmp_path):
|
||||
"""Full run with opcode map."""
|
||||
mp = tmp_path / "map.json"
|
||||
mp.write_text(json.dumps(MAP), encoding="utf-8")
|
||||
r = run_script("vm_handler_slice.py", ["--log", str(vm_log),
|
||||
"--opcode-map", str(mp)])
|
||||
assert r.returncode == 0, r.output
|
||||
assert "dispatcher: libvm.so+0x1000" in r.output
|
||||
assert "UNCLOSED" in r.output
|
||||
assert "OP_CALL" in r.output # const materialization named
|
||||
assert r.output.rstrip().endswith("RESULT=ok")
|
||||
|
||||
def test_json_shape(self, vm_log, tmp_path):
|
||||
"""Json shape."""
|
||||
mp = tmp_path / "map.json"
|
||||
mp.write_text(json.dumps(MAP), encoding="utf-8")
|
||||
r = run_script("vm_handler_slice.py", ["--log", str(vm_log),
|
||||
"--opcode-map", str(mp), "--json"])
|
||||
doc = json.loads(r.stdout) # --json stdout is one pure document
|
||||
assert doc["status"] == "ok"
|
||||
assert doc["opcode_trajectory"][-1] == "OP_RET"
|
||||
assert all("sig" in s for s in doc["segments"])
|
||||
|
||||
def test_explicit_dispatcher(self, vm_log):
|
||||
"""Explicit dispatcher."""
|
||||
r = run_script("vm_handler_slice.py", ["--log", str(vm_log),
|
||||
"--dispatcher", "libvm.so+0x1000"])
|
||||
assert r.returncode == 0 and "segments: 10 total" in r.output
|
||||
|
||||
def test_non_vm_trace_refused(self, tmp_path):
|
||||
"""Non vm trace refused."""
|
||||
p = tmp_path / "flat.log"
|
||||
p.write_text("BLK 0 a+0x1\nBLK 1 a+0x2\nBLK 2 a+0x3\n", encoding="utf-8")
|
||||
r = run_script("vm_handler_slice.py", ["--log", str(p)])
|
||||
assert r.returncode == 2
|
||||
assert "interpreter" in r.output or "dispatcher" in r.output
|
||||
|
||||
def test_unmapped_handler_blocks_reported(self, vm_log, tmp_path):
|
||||
"""Unmapped handler blocks reported."""
|
||||
mp = tmp_path / "map.json"
|
||||
mp.write_text(json.dumps({"libvm.so+0x2000": "OP_LOAD"}), encoding="utf-8")
|
||||
r = run_script("vm_handler_slice.py", ["--log", str(vm_log),
|
||||
"--opcode-map", str(mp)])
|
||||
assert r.returncode == 0
|
||||
assert "unmapped handler blocks" in r.output
|
||||
Reference in New Issue
Block a user