Skip to content

Commit 503c5f6

Browse files
author
laginimaineb
committed
Initial code for the FuzzZone fuzzing utility
0 parents  commit 503c5f6

File tree

3 files changed

+363
-0
lines changed

3 files changed

+363
-0
lines changed

‎FuzzZone/jni/Android.mk‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
LOCAL_PATH := $(call my-dir)
2+
3+
include $(CLEAR_VARS)
4+
LOCAL_MODULE := fuzz_zone
5+
LOCAL_CFLAGS += -std=c99
6+
LOCAL_LDLIBS := -llog
7+
LOCAL_SRC_FILES := main.c
8+
include $(BUILD_EXECUTABLE)

‎FuzzZone/jni/main.c‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
#include <fcntl.h>
2+
#include <errno.h>
3+
#include <sys/ioctl.h>
4+
#include <stdio.h>
5+
#include <stdlib.h>
6+
#include "qseecom.h"
7+
8+
struct __attribute__((packed)) qseecom_send_raw_scm_req {
9+
uint32_t svc_id;
10+
uint32_t cmd_id;
11+
void *cmd_req_buf; /* in */
12+
unsigned int cmd_req_len; /* in */
13+
void *resp_buf; /* in/out */
14+
unsigned int resp_len; /* in/out */
15+
};
16+
17+
struct __attribute__((packed)) qseecom_send_atomic_scm_req {
18+
uint32_t svc_id;
19+
uint32_t cmd_id;
20+
uint32_t num_args;
21+
uint32_t arg1;
22+
uint32_t arg2;
23+
uint32_t arg3;
24+
uint32_t arg4;
25+
};
26+
27+
28+
#define QSEECOM_IOCTL_SEND_RAW_SCM \
29+
_IOWR(QSEECOM_IOC_MAGIC, 21, struct qseecom_send_raw_scm_req)
30+
31+
#define QSEECOM_IOCTL_SEND_ATOMIC_SCM \
32+
_IOWR(QSEECOM_IOC_MAGIC, 24, struct qseecom_send_atomic_scm_req)
33+
34+
int main(int argc, char **argv) {
35+
36+
//Reading the command-line arguments
37+
if (argc < 2) {
38+
printf("USAGE: fuzz_zone <MODE>\n");
39+
return -EINVAL;
40+
}
41+
char* mode = argv[1];
42+
43+
//Opening the QSEECOM device
44+
int fd = open("/dev/qseecom", O_RDONLY);
45+
if (fd < 0) {
46+
perror("Failed to open /dev/qseecom");
47+
return -errno;
48+
}
49+
printf("FD: %d\n", fd);
50+
51+
52+
//Checking if this is an atomic call
53+
if (strstr(mode, "reg") == mode) {
54+
55+
//Reading the arguments from the user
56+
if (argc < 4) {
57+
printf("USAGE: %s reg <SVC_ID> <CMD_ID> <NUM_ARGS> <HEX ARGS...>\n", argv[0]);
58+
return -EINVAL;
59+
}
60+
struct qseecom_send_atomic_scm_req req;
61+
req.svc_id = atoi(argv[2]);
62+
req.cmd_id = atoi(argv[3]);
63+
req.num_args = atoi(argv[4]);
64+
if (req.num_args > 4) {
65+
printf("Illegal number of arguments supplied: %d\n", req.num_args);
66+
return -EINVAL;
67+
}
68+
if (req.num_args > 0)
69+
req.arg1 = (unsigned)strtoll(argv[5], NULL, 16);
70+
if (req.num_args > 1)
71+
req.arg2 = (unsigned)strtoll(argv[6], NULL, 16);
72+
if (req.num_args > 2)
73+
req.arg3 = (unsigned)strtoll(argv[7], NULL, 16);
74+
if (req.num_args > 3)
75+
req.arg4 = (unsigned)strtoll(argv[8], NULL, 16);
76+
int res = ioctl(fd, QSEECOM_IOCTL_SEND_ATOMIC_SCM, &req);
77+
printf("IOCTL RES: %u\n", (unsigned)res);
78+
if (res < 0) {
79+
perror("Failed to send ioctl");
80+
}
81+
82+
}
83+
84+
//Checking if this is a raw call
85+
else if (strstr(mode, "raw") == mode) {
86+
87+
if (argc != 6) {
88+
printf("USAGE: %s raw <SVC_ID> <CMD_ID> <REQ_BUF> <RESP_LEN>\n", argv[0]);
89+
return -EINVAL;
90+
}
91+
uint32_t svc_id = atoi(argv[2]);
92+
uint32_t cmd_id = atoi(argv[3]);
93+
char* hex_cmd_buf = argv[4];
94+
uint32_t resp_len = atoi(argv[5]);
95+
96+
//Converting the hex string to a binary string
97+
unsigned cmd_req_len = strlen(hex_cmd_buf)/2;
98+
char* bin_cmd_req = malloc(cmd_req_len);
99+
for (int i=0; i<cmd_req_len; i++)
100+
sscanf(hex_cmd_buf+i*2,"%2hhx", bin_cmd_req+i);
101+
102+
103+
//Sending the request
104+
struct qseecom_send_raw_scm_req raw_req;
105+
raw_req.svc_id = svc_id;
106+
raw_req.cmd_id = cmd_id;
107+
raw_req.cmd_req_len = cmd_req_len;
108+
raw_req.cmd_req_buf = bin_cmd_req;
109+
raw_req.resp_buf = malloc(resp_len);
110+
memset(raw_req.resp_buf, 'B', resp_len); //Visible garbage to see the actual change
111+
raw_req.resp_len = resp_len;
112+
int res = ioctl(fd, QSEECOM_IOCTL_SEND_RAW_SCM, &raw_req);
113+
if (res < 0) {
114+
perror("Failed to send raw SCM ioctl");
115+
return -errno;
116+
}
117+
printf("IOCTL RES: %d\n", res);
118+
119+
//Printing the response buffer
120+
printf("Response Buffer:\n");
121+
uint32_t i;
122+
for (i=0; i<raw_req.resp_len; i++)
123+
printf("%02X", ((unsigned char*)raw_req.resp_buf)[i]);
124+
printf("\n");
125+
}
126+
127+
else {
128+
printf("Unknown mode %s!\n", mode);
129+
return -EINVAL;
130+
}
131+
}

‎FuzzZone/jni/qseecom.h‎

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
#ifndef __QSEECOM_H_
2+
#define __QSEECOM_H_
3+
4+
#include <linux/types.h>
5+
#include <linux/ioctl.h>
6+
7+
#define MAX_ION_FD 4
8+
#define MAX_APP_NAME_SIZE 32
9+
#define QSEECOM_HASH_SIZE 32
10+
/*
11+
* struct qseecom_register_listener_req -
12+
* for register listener ioctl request
13+
* @listener_id - service id (shared between userspace and QSE)
14+
* @ifd_data_fd - ion handle
15+
* @virt_sb_base - shared buffer base in user space
16+
* @sb_size - shared buffer size
17+
*/
18+
struct qseecom_register_listener_req {
19+
uint32_t listener_id; /* in */
20+
int32_t ifd_data_fd; /* in */
21+
uint32_t virt_sb_base; /* in */
22+
uint32_t sb_size; /* in */
23+
};
24+
25+
/*
26+
* struct qseecom_send_cmd_req - for send command ioctl request
27+
* @cmd_req_len - command buffer length
28+
* @cmd_req_buf - command buffer
29+
* @resp_len - response buffer length
30+
* @resp_buf - response buffer
31+
*/
32+
struct qseecom_send_cmd_req {
33+
void *cmd_req_buf; /* in */
34+
unsigned int cmd_req_len; /* in */
35+
void *resp_buf; /* in/out */
36+
unsigned int resp_len; /* in/out */
37+
};
38+
39+
40+
/*
41+
* struct qseecom_ion_fd_info - ion fd handle data information
42+
* @fd - ion handle to some memory allocated in user space
43+
* @cmd_buf_offset - command buffer offset
44+
*/
45+
struct qseecom_ion_fd_info {
46+
int32_t fd;
47+
uint32_t cmd_buf_offset;
48+
};
49+
/*
50+
* struct qseecom_send_modfd_cmd_req - for send command ioctl request
51+
* @cmd_req_len - command buffer length
52+
* @cmd_req_buf - command buffer
53+
* @resp_len - response buffer length
54+
* @resp_buf - response buffer
55+
* @ifd_data_fd - ion handle to memory allocated in user space
56+
* @cmd_buf_offset - command buffer offset
57+
*/
58+
struct qseecom_send_modfd_cmd_req {
59+
void *cmd_req_buf; /* in */
60+
unsigned int cmd_req_len; /* in */
61+
void *resp_buf; /* in/out */
62+
unsigned int resp_len; /* in/out */
63+
struct qseecom_ion_fd_info ifd_data[MAX_ION_FD];
64+
};
65+
/*
66+
* struct qseecom_listener_send_resp_req - signal to continue the send_cmd req.
67+
* Used as a trigger from HLOS service to notify QSEECOM that it's done with its
68+
* operation and provide the response for QSEECOM can continue the incomplete
69+
* command execution
70+
* @resp_len - Length of the response
71+
* @resp_buf - Response buffer where the response of the cmd should go.
72+
*/
73+
struct qseecom_send_resp_req {
74+
void *resp_buf; /* in */
75+
unsigned int resp_len; /* in */
76+
};
77+
78+
/*
79+
* struct qseecom_load_img_data - for sending image length information and
80+
* ion file descriptor to the qseecom driver. ion file descriptor is used
81+
* for retrieving the ion file handle and in turn the physical address of
82+
* the image location.
83+
* @mdt_len - Length of the .mdt file in bytes.
84+
* @img_len - Length of the .mdt + .b00 +..+.bxx images files in bytes
85+
* @ion_fd - Ion file descriptor used when allocating memory.
86+
* @img_name - Name of the image.
87+
*/
88+
struct qseecom_load_img_req {
89+
uint32_t mdt_len; /* in */
90+
uint32_t img_len; /* in */
91+
int32_t ifd_data_fd; /* in */
92+
char img_name[MAX_APP_NAME_SIZE]; /* in */
93+
int app_id; /* out*/
94+
};
95+
96+
struct qseecom_set_sb_mem_param_req {
97+
int32_t ifd_data_fd; /* in */
98+
uint32_t virt_sb_base; /* in */
99+
uint32_t sb_len; /* in */
100+
};
101+
102+
/*
103+
* struct qseecom_qseos_version_req - get qseos version
104+
* @qseos_version - version number
105+
*/
106+
struct qseecom_qseos_version_req {
107+
unsigned int qseos_version; /* in */
108+
};
109+
110+
/*
111+
* struct qseecom_qseos_app_load_query - verify if app is loaded in qsee
112+
* @app_name[MAX_APP_NAME_SIZE]- name of the app.
113+
* @app_id - app id.
114+
*/
115+
struct qseecom_qseos_app_load_query {
116+
char app_name[MAX_APP_NAME_SIZE]; /* in */
117+
int app_id; /* out */
118+
};
119+
120+
struct qseecom_send_svc_cmd_req {
121+
uint32_t cmd_id;
122+
void *cmd_req_buf; /* in */
123+
unsigned int cmd_req_len; /* in */
124+
void *resp_buf; /* in/out */
125+
unsigned int resp_len; /* in/out */
126+
};
127+
128+
enum qseecom_key_management_usage_type {
129+
QSEOS_KM_USAGE_DISK_ENCRYPTION = 0x01,
130+
};
131+
132+
struct qseecom_create_key_req {
133+
unsigned char hash32[QSEECOM_HASH_SIZE];
134+
enum qseecom_key_management_usage_type usage;
135+
};
136+
137+
struct qseecom_wipe_key_req {
138+
enum qseecom_key_management_usage_type usage;
139+
};
140+
141+
#define SHA256_DIGEST_LENGTH (256/8)
142+
/*
143+
* struct qseecom_save_partition_hash_req
144+
* @partition_id - partition id.
145+
* @hash[SHA256_DIGEST_LENGTH] - sha256 digest.
146+
*/
147+
struct qseecom_save_partition_hash_req {
148+
int partition_id; /* in */
149+
char digest[SHA256_DIGEST_LENGTH]; /* in */
150+
};
151+
152+
/*
153+
* struct qseecom_is_es_activated_req
154+
* @is_activated - 1=true , 0=false
155+
*/
156+
struct qseecom_is_es_activated_req {
157+
int is_activated; /* out */
158+
};
159+
160+
#define QSEECOM_IOC_MAGIC 0x97
161+
162+
163+
#define QSEECOM_IOCTL_REGISTER_LISTENER_REQ \
164+
_IOWR(QSEECOM_IOC_MAGIC, 1, struct qseecom_register_listener_req)
165+
166+
#define QSEECOM_IOCTL_UNREGISTER_LISTENER_REQ \
167+
_IO(QSEECOM_IOC_MAGIC, 2)
168+
169+
#define QSEECOM_IOCTL_SEND_CMD_REQ \
170+
_IOWR(QSEECOM_IOC_MAGIC, 3, struct qseecom_send_cmd_req)
171+
172+
#define QSEECOM_IOCTL_SEND_MODFD_CMD_REQ \
173+
_IOWR(QSEECOM_IOC_MAGIC, 4, struct qseecom_send_modfd_cmd_req)
174+
175+
#define QSEECOM_IOCTL_RECEIVE_REQ \
176+
_IO(QSEECOM_IOC_MAGIC, 5)
177+
178+
#define QSEECOM_IOCTL_SEND_RESP_REQ \
179+
_IO(QSEECOM_IOC_MAGIC, 6)
180+
181+
#define QSEECOM_IOCTL_LOAD_APP_REQ \
182+
_IOWR(QSEECOM_IOC_MAGIC, 7, struct qseecom_load_img_req)
183+
184+
#define QSEECOM_IOCTL_SET_MEM_PARAM_REQ \
185+
_IOWR(QSEECOM_IOC_MAGIC, 8, struct qseecom_set_sb_mem_param_req)
186+
187+
#define QSEECOM_IOCTL_UNLOAD_APP_REQ \
188+
_IO(QSEECOM_IOC_MAGIC, 9)
189+
190+
#define QSEECOM_IOCTL_GET_QSEOS_VERSION_REQ \
191+
_IOWR(QSEECOM_IOC_MAGIC, 10, struct qseecom_qseos_version_req)
192+
193+
#define QSEECOM_IOCTL_PERF_ENABLE_REQ \
194+
_IO(QSEECOM_IOC_MAGIC, 11)
195+
196+
#define QSEECOM_IOCTL_PERF_DISABLE_REQ \
197+
_IO(QSEECOM_IOC_MAGIC, 12)
198+
199+
#define QSEECOM_IOCTL_LOAD_EXTERNAL_ELF_REQ \
200+
_IOWR(QSEECOM_IOC_MAGIC, 13, struct qseecom_load_img_req)
201+
202+
#define QSEECOM_IOCTL_UNLOAD_EXTERNAL_ELF_REQ \
203+
_IO(QSEECOM_IOC_MAGIC, 14)
204+
205+
#define QSEECOM_IOCTL_APP_LOADED_QUERY_REQ \
206+
_IOWR(QSEECOM_IOC_MAGIC, 15, struct qseecom_qseos_app_load_query)
207+
208+
#define QSEECOM_IOCTL_SEND_CMD_SERVICE_REQ \
209+
_IOWR(QSEECOM_IOC_MAGIC, 16, struct qseecom_send_svc_cmd_req)
210+
211+
#define QSEECOM_IOCTL_CREATE_KEY_REQ \
212+
_IOWR(QSEECOM_IOC_MAGIC, 17, struct qseecom_create_key_req)
213+
214+
#define QSEECOM_IOCTL_WIPE_KEY_REQ \
215+
_IOWR(QSEECOM_IOC_MAGIC, 18, struct qseecom_wipe_key_req)
216+
217+
#define QSEECOM_IOCTL_SAVE_PARTITION_HASH_REQ \
218+
_IOWR(QSEECOM_IOC_MAGIC, 19, struct qseecom_save_partition_hash_req)
219+
220+
#define QSEECOM_IOCTL_IS_ES_ACTIVATED_REQ \
221+
_IOWR(QSEECOM_IOC_MAGIC, 20, struct qseecom_is_es_activated_req)
222+
223+
#endif /* __QSEECOM_H_ */
224+

0 commit comments

Comments
 (0)