FilesExpand file tree

master

/

test_uefi.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

115 lines (83 loc) · 4 KB

master

/

test_uefi.py

Copy path

Top

File metadata and controls

• Code
• Blame

115 lines (83 loc) · 4 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

#!/usr/bin/env python3

#

# Cross Platform and Multi Architecture Advanced Binary Emulation Framework

#

import pickle, sys, unittest

sys.path.append("..")

from qiling import Qiling

from qiling.extensions.sanitizers.heap import QlSanitizedMemoryHeap

from qiling.const import QL_INTERCEPT, QL_VERBOSE

from qiling.os.uefi import utils

from qiling.os.uefi.const import EFI_SUCCESS, EFI_INVALID_PARAMETER

ROOTFS_UEFI = r'../examples/rootfs/x8664_efi'

class Checklist:

def __init__(self) -> None:

self.visited_oncall = False

self.visited_onenter = False

self.visited_onexit = False

class Test_UEFI(unittest.TestCase):

def test_x8664_uefi_santizier(self):

def my_abort(msg: str):

print(f"\n*** {msg} ***\n")

def enable_sanitized_heap(ql: Qiling):

heap = QlSanitizedMemoryHeap(ql, ql.os.heap, fault_rate=0)

heap.oob_handler = lambda *args: my_abort(f'Out-of-bounds read detected')

heap.bo_handler = lambda *args: my_abort(f'Buffer overflow/underflow detected')

heap.bad_free_handler = lambda *args: my_abort(f'Double free or bad free detected')

heap.uaf_handler = lambda *args: my_abort(f'Use-after-free detected')

# make sure future allocated buffers are not too close to UEFI data

heap.alloc(0x1000)

ql.os.heap = heap

if __name__ == "__main__":

env = {

# the FaultType NVRAM variable is read by the executable to determine which

# memory corruption it should trigger.

#

# fault types are:

# 0 - POOL_OVERFLOW_MEMCPY

# 1 - POOL_UNDERFLOW_MEMCPY

# 2 - POOL_OVERFLOW_USER,

# 3 - POOL_UNDERFLOW_USER

# 4 - POOL_OOB_READ_AHEAD

# 5 - POOL_OOB_READ_BEHIND

# 6 - POOL_DOUBLE_FREE

# 7 - POOL_INVALID_FREE

'FaultType': bytes([1])

}

ql = Qiling([f'{ROOTFS_UEFI}/bin/EfiPoolFault.efi'], ROOTFS_UEFI, env=env, verbose=QL_VERBOSE.DEBUG)

enable_sanitized_heap(ql)

ql.run()

self.assertFalse(ql.os.heap.validate(), 'expected heap corruption')

def test_x8664_uefi(self):

def force_notify_RegisterProtocolNotify(ql: Qiling, address: int, params):

ql.log.info(f'[force_notify] address = {address:#x}, params = {params}')

self.ck.visited_oncall = True

event_id = params['Event']

if event_id in ql.loader.events:

event = ql.loader.events[event_id]

# let's force notify

event["Set"] = False

utils.signal_event(ql, event_id)

utils.execute_protocol_notifications(ql, True)

return EFI_SUCCESS

return EFI_INVALID_PARAMETER

def my_onenter(ql: Qiling, address: int, params):

ql.log.info(f'[my_onenter] address = {address:#x}, params = {params}')

self.ck.visited_onenter = True

def my_onexit(ql: Qiling, address: int, params, retval: int):

ql.log.info(f'[my_onexit] address = {address:#x}, params = {params}')

self.ck.visited_onexit = True

if __name__ == "__main__":

with open(f'{ROOTFS_UEFI}/rom2_nvar.pickel', 'rb') as f:

env = pickle.load(f)

ql = Qiling([f'{ROOTFS_UEFI}/bin/TcgPlatformSetupPolicy'], ROOTFS_UEFI, env=env, verbose=QL_VERBOSE.DEBUG)

self.ck = Checklist()

ql.os.set_api("RegisterProtocolNotify", force_notify_RegisterProtocolNotify)

ql.os.set_api("CopyMem", my_onenter, QL_INTERCEPT.ENTER)

ql.os.set_api("LocateProtocol", my_onexit, QL_INTERCEPT.EXIT)

ql.run()

self.assertTrue(self.ck.visited_oncall)

self.assertTrue(self.ck.visited_onenter)

self.assertTrue(self.ck.visited_onexit)

if __name__ == "__main__":

unittest.main()