main.cpp

#include <iostream>
#include <string>
#include <bitset>
#include <random>
#include <thread>
#include <chrono>
#include <unistd.h>
#include <sys/wait.h>
#include <cstdlib>
#include <limits>
#include "Logger.hpp"
#include "config.h"

#define COLOR_RED     "\x1b[31m"
#define COLOR_RESET   "\x1b[0m"

using namespace std;
Logger logger;
vector<Target> objects = {{"xActiveTimerList1", 0x4315e0, 40, false}, {"hMainThread", 0x431ff0, 8, false}, {"xResumeSignals", 0x431e40, 128, false}, {"pxReadyTasksLists", 0x431320, 280, false}, {"xDelayedTaskList1", 0x431440, 40, false}, {"xPendingReadyList", 0x4314c0, 40, false}, {"xSuspendedTaskList", 0x431540, 40, false}, {"uxTopReadyPriority", 0x431578, 8, false}, {"xTickCount", 0x431570, 8, false}, {"xPendedTicks", 0x431588, 8, false}, {"uxSchedulerSuspended", 0x4315b8, 8, false}, {"xNextTaskUnblockTime", 0x4315a8, 8, false}, {"xSchedulerRunning", 0x431580, 8, false}, {"uxTaskNumber", 0x4315a0, 8, false}, {"xTimerTaskHandle", 0x431660, 176, true}, {"xTimerQueue", 0x431658, 168, true}, {"pxOverflowTimerList", 0x431650, 40, true}, {"pxCurrentTimerList", 0x431648, 40, true}, {"pxCurrentTCB", 0x431300, 176, true}, {"pxDelayedTaskList", 0x4314a8, 40, true}, {"xIdleTaskHandle", 0x4315b0, 176, true}, {"xQueue", 0x431d90, 168, true}, {"xTimer", 0x431d98, 88, true}};
static volatile int cnt = 0;

void getAddress(fstream& memFile, uint8_t *h, long address){
    //read the content of "address" and returns it in the h parameter
    memFile.seekg(address);
    memFile.read(reinterpret_cast<char *>(h), 4);
}

long getRandomAddressInRange(long a1, long a2){
    random_device generator;
    uniform_int_distribution<long> address_distribution = uniform_int_distribution<long>(a1, a2);
    return (long) address_distribution(generator);
}

long inject_list_item(fstream& memFile, long address, Target& t, long baseItem){
    //it performs a specific injection for a list_item object, specifying which parameter of the struct has been injected
    if (address >= baseItem and address < baseItem + 8) {
        cout << "Injecting " << t.getSubName() << "->xItemValue\n";
        t.setSubName(t.getSubName() + "->xItemValue");
    }
    else if(address >= baseItem + 8 and address < baseItem + 16) {
        cout << "Injecting " << t.getSubName() << "->pxNext\n";
        t.setSubName(t.getSubName() + "->pxNext");
    }
    else if(address >= baseItem + 16 and address < baseItem + 24) {
        cout << "Injecting " << t.getSubName() << "->pxPrevious\n";
        t.setSubName(t.getSubName() + "->pxPrevious");
    }
    else if(address >= baseItem + 24 and address < baseItem + 32) {
        cout << "Injecting " << t.getSubName() << "->pvOwner\n";
        t.setSubName(t.getSubName() + "->pvOwner");
    }
    else if(address >= baseItem + 32 and address < baseItem + 40) {
        cout << "Injecting " << t.getSubName() << "->pvContainer\n";
        t.setSubName(t.getSubName() + "->pvContainer");
    }
    return address;
}

long inject_list(fstream& memFile, long address, Target& t){
    //specific injection for a list object, it can move the file pointer to move within the struct.
    long list;
    if(t.isPointer()) {
        uint8_t h[4];
        getAddress(memFile, h, t.getAddress());
        list = (long) (h[0] + h[1] * 256 + h[2] * 256 * 256);
    }
    else
        list = t.getAddress();
    if (address >= list and address < list + 8) {
        cout << "Injecting " << t.getSubName() << "->uxNumberOfItems\n";
        t.setSubName(t.getSubName() + (t.getSubName().empty() ? "" : "->") + "uxNumberOfItems");
    }
    else if(address >= list + 8 and address < list + 16) {
        uint8_t h[4];
        cout << "Injecting " << t.getSubName() << "->pxNext\n";
        t.setSubName(t.getSubName() + (t.getSubName().empty() ? "" : "->") + "pxNext");
        getAddress(memFile, h, list + 8);
        long baseItem = (long) (h[0] + h[1] * 256 + h[2] * 256 * 256);
        return inject_list_item(memFile, getRandomAddressInRange(baseItem, baseItem + 40), t, baseItem);
    }
    else if (address >= list + 16 and address < list + 40){
        cout << "Injecting " << t.getSubName() << "->xListEnd\n";
        t.setSubName(t.getSubName() + (t.getSubName().empty() ? "" : "->") + "xListEnd");
        return inject_list_item(memFile, address, t, list + 16);
    }
    return address;
}

long wrapListInj(fstream& memFile, long address, long base, Target& t, bool isItem){
    //this is just a wrapper for list and list_item injections
    if(!isItem) {
        t.setAddress(base);
        t.setPointer(false);
        return inject_list(memFile, address, t);
    }
    else
        return inject_list_item(memFile, address, t, base);
}

long inject_queue(fstream& memFile, long address, Target& t){
    //specific injection for queues, it can move the file pointer to move within the struct to explore it.
    uint8_t h[4];
    getAddress(memFile, h, t.getAddress());
    long queue = (long) (h[0] + h[1]*256 + h[2]*256*256);

    if (address >= queue and address < queue + 8) {
        cout << "Injecting " << t.getName() << "->pcHead\n";
        t.setSubName("pcHead");
        getAddress(memFile, h, queue);
        long newAddress = (long) (h[0] + h[1]*256 + h[2]*256*256);
        return getRandomAddressInRange(newAddress, newAddress + 50);
    }
    else if(address >= queue + 8 and address < queue + 16) {
        cout << "Injecting " << t.getName() << "->pcWriteTo\n";
        t.setSubName("pcWriteTo");
        getAddress(memFile, h, queue + 8);
        long newAddress = (long) (h[0] + h[1]*256 + h[2]*256*256);
        return getRandomAddressInRange(newAddress, newAddress + 50);
    }
    else if (address >= queue + 32 and address < queue + 72) {
        cout << "Injecting " << t.getName() << "->xTasksWaitingToSend\n";
        t.setSubName( "xTasksWaitingToSend");
        return wrapListInj(memFile, address, queue + 32, t, false);
    }
    else if (address >= queue + 72 and address < queue + 112) {
        cout << "Injecting " << t.getName() << "->xTasksWaitingToReceive\n";
        t.setSubName("xTasksWaitingToReceive");
        return wrapListInj(memFile, address, queue + 72, t, false);
    }
    else if (address >= queue + 112 and address < queue + 120) {
        cout << "Injecting " << t.getName() << "->uxMessagesWaiting\n";
        t.setSubName("uxMessagesWaiting");
    }
    else if(address >= queue + 120 and address < queue + 128) {
        cout << "Injecting " << t.getName() << "->uxLength\n";
        t.setSubName("uxLength");
    }
    else if(address >= queue + 128 and address < queue + 136) {
        cout << "Injecting " << t.getName() << "->uxItemSize\n";
        t.setSubName("uxItemSize");
    }
    return address;
}

long inject_TCB(fstream& memFile, long address, Target& t){
    //specific injection for TCB, it can move the file pointer to move within the struct.
    uint8_t h[4];
    getAddress(memFile, h, t.getAddress());

    long tcb = (long) (h[0] + h[1]*256 + h[2]*256*256);
    if (address >= tcb and address < tcb + 8) {
        cout << "Injecting " << t.getName() << "->pxTopOfStack\n";
        t.setSubName("pxTopOfStack");
        return address;
    }
    else if(address >= tcb + 8 and address < tcb + 48) {
        cout << "Injecting " << t.getName() << "->xStateListItem\n";
        t.setSubName("xStateListItem");
        return wrapListInj(memFile, address, tcb + 8, t, true);
    }
    else if(address >= tcb + 48 and address < tcb + 88) {
        cout << "Injecting " << t.getName() << "->xEventListItem\n";
        t.setSubName("xEventListItem");
        wrapListInj(memFile, address, tcb + 48, t, true);
    }
    else if(address >= tcb + 88 and address < tcb + 96) {
        cout << "Injecting " << t.getName() << "->uxPriority\n";
        t.setSubName("uxPriority");
    }
    else if (address >= tcb + 96 and address < tcb + 104) {
        t.setSubName("pxStack");
        cout << "Injecting " << t.getName() << "->pxStack\n";
        getAddress(memFile, h, tcb + 96);
        long newAddress = (long) (h[0] + h[1]*256 + h[2]*256*256);
        return getRandomAddressInRange(newAddress, newAddress + 70);
    }
    else if(address >= tcb + 104 and address < tcb + 112) {
        cout << "Injecting " << t.getName() << "->pcTaskName\n";
        t.setSubName("pcTaskName");
    }
    else if(address >= tcb + 116 and address < tcb + 124) {
        cout << "Injecting " << t.getName() << "->uxTCBNumber\n";
        t.setSubName("uxTCBNumber");
    }
    else if(address >= tcb + 104 and address < tcb + 112) {
        cout << "Injecting " << t.getName() << "->uxTaskNumber\n";
        t.setSubName("uxTaskNumber");
    }
    else if(address >= tcb + 112 and address < tcb + 120) {
        cout << "Injecting " << t.getName() << "->uxBasePriority\n";
        t.setSubName("uxBasePriority");
    }
    else if(address >= tcb + 120 and address < tcb + 128) {
        cout << "Injecting " << t.getName() << "->callback\n";
        t.setSubName("callback");
    }
    else if(address >= tcb + 128 and address < tcb + 136) {
        cout << "Injecting " << t.getName() << "->ulRunTimeCounter\n";
        t.setSubName("ulRunTimeCounter");
    }
    return address;
}

long inject_timer(fstream& memFile, long address, Target& t){
    //specific injection for timers
    uint8_t h[4];
    getAddress(memFile, h, objects[22].getAddress());
    long timer = (long) (h[0] + h[1]*256 + h[2]*256*256);
    if (address >= timer and address < timer + 8) {
        cout << "Injecting xTimer name\n";
        t.setSubName("name");
        getAddress(memFile, h, timer);
        return (long) (h[0] + h[1]*256 + h[2]*256*256);
    }
    else if(address >= timer + 8 and address < timer + 48) {
        cout << "Injecting xTimer->xTimerListItem\n";
        t.setSubName("xTimerListItem");
        return wrapListInj(memFile, address, timer + 8, t, true);;
    }
    else if (address >= timer + 48 and address < timer + 56) {
        t.setSubName("xTimerPeriodInTicks");
        cout << "Injecting xTimer->xTimerPeriodInTicks\n";
    }
    else if (address >= timer + 64 and address < timer + 72) {
        t.setSubName("callback");
        cout << "Injecting xTimer callback function\n";
    }
    return address;
}

int injector(pid_t pid, Target& t, long *chosenAddr, int timer_range) {
    //the real injector, given a target t it will choose a random address inside this object and inject it
    //returns the random address in the chosenAddr parameter.
	random_device generator;
	uniform_int_distribution<int> random_time(100, timer_range);
	int millisecond_time = random_time(generator);
	this_thread::sleep_for(chrono::milliseconds(millisecond_time));
	cout << "Child starting injector" << endl;
	fstream memFile("/proc/" + to_string(pid) + "/mem", ios::binary | ios::in | ios::out);
	if (!memFile.is_open()) {
		cout << "Can't open file /proc/" + to_string(pid) + "/mem" << endl;
		return -1;
	}
	uniform_int_distribution<int> bit_distribution(0, 7);
	uint8_t byte, mask = bit_distribution(generator);
	uniform_int_distribution<long> address_distribution;
    if (!t.isPointer())
        address_distribution = uniform_int_distribution<long>(t.getAddress(), t.getAddress() + t.getSize());
    else{
        uint8_t h[4];
        getAddress(memFile, h, t.getAddress());
        long heapAddress = (long) (h[0] + h[1]*256 + h[2]*256*256);
        address_distribution = uniform_int_distribution<long>(heapAddress, heapAddress + t.getSize());
    }
    long addr = address_distribution(generator);
    if(t.getName() == "xTimer")
        addr = inject_timer(memFile, addr, t);
    else if(t.getName() == "pxCurrentTCB" or t.getName() == "xTimerTaskHandle")
        addr = inject_TCB(memFile, addr, t);
    else if(t.getName() == "xQueue" or t.getName() == "xTimerQueue")
        addr = inject_queue(memFile, addr, t);
    else if(t.getName() == "xActiveTimerList1" or t.getName() == "xDelayedTaskList1" or t.getName() == "xPendingReadyList" or t.getName() == "xSuspendedTaskList" or t.getName() == "pxOverflowTimerList" or t.getName() == "pxCurrentTimerList" or t.getName() == "pxDelayedTaskList")
        addr = inject_list(memFile, addr, t);
    memFile.seekg(addr);
    byte = memFile.peek();

    //Bitflip
    byte ^= 1 << mask;
    memFile.put((char) byte);

    cout << "Modified " <<
         // put red color for the bit flipped
         bitset<8>(byte).to_string().insert(8 - mask, COLOR_RESET).insert(7 - mask, COLOR_RED)
         << " at 0x" << hex << addr << endl;
    memFile.close();
    *chosenAddr = addr;
    cout << hex << *chosenAddr << endl;
	return millisecond_time;
}

void rtos() {
    //just launch an instance of RTOS
	cout << endl << "Child running rtos" << endl;
	execve("../build/freeRTOS", nullptr, nullptr);
}

void sigCHLDHandler(int){
    //used to handle hangs
    //TODO: check if this function can be removed
    cnt++;
}

void sigINTHandler(int){
    //used to print the log generated when we interrupt the program with a SIGINT (Ctrl+C)
#if WRITE_ON_FILE
        logger.logOnfile();
#else
        logger.printInj();
#endif
    exit(0);
}

long getFileLen(ifstream &file) {
	file.ignore(std::numeric_limits<std::streamsize>::max());
	std::streamsize length = file.gcount();
	file.clear();   //  Since ignore will have set eof.
	file.seekg(0, std::ios_base::beg);
	return (long) length;
}

int checkFiles(Target &t, pid_t pid_rtos, chrono::duration<long, std::ratio<1, 1000>> elapsed) {
    //it compares the Golden execution output with the one generated by an instance of RTOS affected by the injection
    //it will register the type of error found
    // if output file is empty --> crash
    // if they differ in some way --> SDC
    // else --> Masked
	ifstream golden_output("../files/Golden_execution.txt");
	string fileName = "../files/Falso_Dante_" + to_string(pid_rtos) + ".txt";
	ifstream rtos_output(fileName);
	bool found = false;
	long s1, s2;
	int error = 0; // 0 --> Masked, 1 --> SDC, 2 --> Crash

	if (!golden_output.is_open()) {
		cout << pid_rtos << endl;
		cout << "Can't open the golden execution output" << endl;
		return -1;
	}
	if (!rtos_output.is_open()) {
		cout << pid_rtos << endl;
		cout << "Can't open the rtos execution output" << endl;
		return -1;
	}
	s1 = getFileLen(golden_output);
	s2 = getFileLen(rtos_output);

	if (s2 == 0) { // Crash
		cout << endl << "Files differ in size" << endl << "golden = " << s1 << "; falso = " << s2 << endl;
		logger.addInjection(t, elapsed, "Crash");
		error = 2;
	} else {
        if(s1 == s2) {
            for (string g_line, f_line; getline(golden_output, g_line), getline(rtos_output, f_line);) {
                if (g_line != f_line) {
                    found = true;
                    error = 1;
                    cout << "The output should be" << endl << g_line << endl
                         << "instead I found" << endl << f_line << endl;
                }
            }
        }
        else
            found = true;
		if (!found) { //Masked
			cout << endl << "No differences have been found" << endl;
			logger.addInjection(t, elapsed, "Masked");
		} else
			logger.addInjection(t, elapsed, "SDC");
	}
	rtos_output.close();
	remove(fileName.c_str());
	golden_output.close();
	return error;
}

void execGolden(chrono::duration<long, ratio<1, 1000>> &gtime) {
    //launch an instance of RTOS, without performing any injection, then renames the output file as "Golden_execution".
	chrono::steady_clock::time_point beginTime = chrono::steady_clock::now();
	pid_t pid_golden = fork();
	if (pid_golden == 0) {
		//DO NOT REMOVE, FOR SOME REASON THE PROGRAM WONT START IF YOU REMOVE THIS
		this_thread::sleep_for(chrono::seconds(1));

		rtos(); //golden
		exit(0);
	}
	int status;
    waitpid(pid_golden, &status, 0);
    //Golden time
	gtime = chrono::duration_cast<chrono::milliseconds>(
			chrono::steady_clock::now() - beginTime);
	cout << endl << "Golden time : " << gtime.count() << endl;
	ofstream time_golden("../files/Time_golden.txt");
	if (time_golden)
		time_golden << gtime.count();
	else
		cout << "Can't create Time_golden.txt";
	time_golden.close();
	cnt = 0;
	const string old = "../files/Falso_Dante_" + to_string(pid_golden) + ".txt";
	rename(old.c_str(), "../files/Golden_execution.txt");
}

void injectRTos(int chosen, int timer_range, chrono::duration<long, ratio<1, 1000>> gtime, int iter) {
    //this is the function that actually launches an instance of rtos and the injector that will perform the bitflip
    //after the injection is done it will analyze its results and check which kind of error has been generated.
    //it uses checkFiles() to look for Crash, SDC and Masked
    //in order to detect hangs it uses the select() function
    //delay are detected by measuring the execution time of the RTOS instance.
	int status;
	string name = objects[chosen].getName();

	cout << endl << "Itering injections, iteration : " << iter << endl;
	chrono::steady_clock::time_point begin = std::chrono::steady_clock::now();

	pid_t pid_rtos = fork();
	if (pid_rtos == 0) {
		cout << "freeRTOS iter : " << iter << endl;
		this_thread::sleep_for(chrono::milliseconds(300));
		rtos();
		exit(0);
	}

	long inj_addr;
    auto *t = new Target(objects[chosen]);
	injector(pid_rtos, *t, &inj_addr, timer_range);
    t->setAddress(inj_addr);

	chrono::duration<long, std::ratio<1, 1000>> elapsed = chrono::duration_cast<std::chrono::milliseconds>(
			chrono::steady_clock::now() - begin);

	//hang handling
	struct timeval timeout = {40, 0};
	int hang;
	hang = select(0, nullptr, nullptr, nullptr, &timeout);
	if (hang == 0) { //HANG
		cout << endl << "Timeout expired, killing process " << endl;
		kill(pid_rtos, SIGKILL);

		logger.addInjection(reinterpret_cast<Target &>(*t), elapsed, "Hang");
	} else if (cnt > 0) {
		cnt = 0;
	}
	waitpid(pid_rtos, &status, 0);
	chrono::steady_clock::time_point end = chrono::steady_clock::now();

	chrono::duration<long, std::ratio<1, 1000>> rtime = chrono::duration_cast<std::chrono::milliseconds>(
			end - begin);
	cout << endl << "RTOS iter time : " << rtime.count() << endl;

	int err = 0;
	if (hang != 0)
		err = checkFiles(*t, pid_rtos, elapsed);

	long timeDifference = chrono::duration_cast<chrono::milliseconds>(rtime - gtime).count();
    bool delay = abs(timeDifference) > 750 || abs(timeDifference) < 650;

	if (delay && hang != 0 && err != 2) //delay detected when there was not a crash or a hang
		logger.addInjection(reinterpret_cast<Target &>(*t), elapsed, "Delay");

	cout << endl << "Time difference = " << to_string(timeDifference) << "[ms]" << endl;
    delete t;
}

void menu(int &c, int &range, int &numInjection) {
    //just prints a menu to get the injection's parameters
	cout << "Type what do you want to inject:" << endl;
    for(int i = 0; i < objects.size(); i++)
        cout << i << " - " << objects[i].getName() << endl;
	do {
		cin >> c;
	}while(c >= objects.size() || c < 0);

	// Sta frase non ha molto senso, magari qualcosa in inglese non sarebbe male
	cout << "Insert a range in millisecond to randomly inject:" << endl;
	cin >> range;
	cout << "Number of injection:" << endl;
	cin >> numInjection;
}

void fillAddresses(){
    //it takes the gdb.output file (containing all the addresses of the injectable objects) and updates all the addresses in the object list
    ifstream file("gdb.output");
    if (!file.is_open()){
        cout << "Cannot open gdb.output\n";
        exit(-1);
    }
    for(Target& obj : objects){
        char n[100];
        long addr;
        char trash[100];
        file.getline(n, 100);
        sscanf(n, "%lx %s", &addr, trash);
        obj.setAddress(addr);
    }
	file.close();
	remove("gdb.output");
}

int main() {
    signal(SIGCHLD, sigCHLDHandler);
    signal(SIGINT, sigINTHandler);
    srand(std::chrono::system_clock::now().time_since_epoch().count());
    //removing ASLR (maybe useless since we update the addresses at each execution)
    system("echo 0 | sudo tee /proc/sys/kernel/randomize_va_space > /dev/null 2>&1");
    //running the gdb script to find out the addresses
    system("echo \"source ../gdb_stuff/gdb_script\" | sudo gdb freeRTOS > /dev/null 2>&1");
    int chosen, numInjection, timer_range;
    chrono::duration<long, ratio<1, 1000>> gtime{};
    menu(chosen, timer_range, numInjection);
    fillAddresses();
    //If already exist a golden execution, don't start another one
    ifstream gold("../files/Golden_execution.txt");
    if (!gold) {
        execGolden(gtime);
    } else {
        cout << "Found another golden execution output, skipping execution..." << endl;
        ifstream time_golden("../files/Time_golden.txt");
        if (time_golden) {
            long time;
            time_golden >> time;
            gtime = chrono::milliseconds(time);
            time_golden.close();
        } else {
            cout << "Can't open Time_golden.txt: re-exec the golden execution";
            execGolden(gtime);
        }
    }
    gold.close();
#if PARALLELIZATION
    //sort of a thread pool to avoid the generation of too many threads.
    int rounds = (int) (numInjection / (HW_CONCURRENCY_FACTOR * thread::hardware_concurrency()));
    int extra = (int) (numInjection % (HW_CONCURRENCY_FACTOR * thread::hardware_concurrency()));
    vector<thread> p(HW_CONCURRENCY_FACTOR * thread::hardware_concurrency());
    for (int r = 0; r < rounds; r++){
        for (int iter = 0; iter < HW_CONCURRENCY_FACTOR * thread::hardware_concurrency(); iter++) {
            p[iter] = thread(injectRTos, chosen, timer_range, gtime, iter);
        }
        for (int i = 0; i < HW_CONCURRENCY_FACTOR * thread::hardware_concurrency(); i++) {
            if(p[i].joinable())
                p[i].join();
        }
    }
    //remaining iterations
    for (int r = 0; r < extra; r++){
        p[r] = thread(injectRTos, chosen, timer_range, gtime, r);
    }
    for (int r = 0; r < extra; r++){
        if(p[r].joinable())
            p[r].join();
    }
#else
    for (int iter = 0; iter < numInjection; iter++)
        injectRTos(chosen, timer_range, gtime, iter);
#endif

#if WRITE_ON_FILE
    logger.logOnfile();
#else
    logger.printInj();
#endif
    //re-enabling ASLR
    system("echo 2 | sudo tee /proc/sys/kernel/randomize_va_space > /dev/null 2>&1");
	return 0;
}