Peter Goodman pgoodman

QEMU arm64 cloud server emulation

This is basically a rehash of an original post on CNXSoft - all credit (particularly for the Virtio device arguments used below) belongs to the author of that piece.

Download the latest uefi1.img image. E.g. ubuntu-16.04-server-cloudimg-arm64-uefi1.img from https://cloud-images.ubuntu.com/releases/16.04/release/

Download the UEFI firmware image QEMU_EFI.fd from https://releases.linaro.org/components/kernel/uefi-linaro/latest/release/qemu64/

Determine your current username and get your current ssh public key:

	static bool TryExtractCMEQ_ASIMDMISC_Z(InstData &inst, uint32_t bits) {
	// bits
	// & 10111111001111111111110000000000
	// --------------------------------
	// 00001110001000001001100000000000
	if ((bits & 0xbf3ffc00U) != 0xe209800U) {
	return false;
	}
	union {
	uint32_t flat;

	import logging
	import os
	import re
	from subprocess import call
	import sys

	def _convert_data(data):
	'''
	'data' is a string of the 'disassembled' bitcode (could be
	read in from file/stdin)

	/*
	* Copyright (c) 2018 Trail of Bits, Inc.
	*/

	#include "mcsema/Util/ProgressBar.h"

	#include <algorithm>
	#include <cinttypes>
	#include <cmath>
	#include <cstdio>

	// This source code comes from:
	// http://stackoverflow.com/questions/8941711/is-is-possible-to-set-a-gdb-watchpoint-programatically
	// with additional tricks from:
	// https://code.google.com/p/google-breakpad/source/browse/trunk/src/client/linux/handler/exception_handler.cc?r=1361

	#include <errno.h>
	#include <signal.h>
	#include <stddef.h>
	#include <stdio.h>
	#include <stdlib.h>

	/* Copyright 2014 Peter Goodman, all rights reserved. */

	#include <granary/granary.h>

	using namespace granary;

	// Simple tool decoding all blocks in a function.
	class WholeFunctionDecoder : public InstrumentationTool {
	public:
	virtual ~WholeFunctionDecoder(void) = default;

	(gdb) print-arch-instr &($12->instruction)
	MOV_MEMv_GPRv [SLOT:0], R15
	(gdb)

	# Print $arg1 instructions starting at address $arg0.
	define pi
	set $__rip = $arg0
	set $__ni = $arg1
	python None ; \
	rip = str(gdb.parse_and_eval("$__rip")).lower() ; \
	ni = str(gdb.parse_and_eval("$__ni")).lower() ; \
	gdb.execute( \
	"x/%si %s\n" % (ni, rip), \
	from_tty=True, to_string=False) ;

	/// based off of: https://gist.github.com/1227319/957809d74d902a4d7fc44c44c946eeed38c1cd1b
	/// Need to be running this code somewhere inside of a Fiber.



	/// Block execution until a callback to some function is executed.
	///
	/// Args:
	/// context: The object context of the function (which takes a
	/// callback) that is being called.

	/* Copyright 2014 Peter Goodman, all rights reserved. */

	#include <granary/granary.h>

	using namespace granary;

	// TODO(pag): Generic allocators (similar to with meta-data) but for allowing
	// multiple tools to register descriptor info.
	// TODO(pag): Eventually handle user space syscalls to avoid EFAULTs.
	// TODO(pag): Eventually handle user space signals.