#pragma ident "@(#)baddof.c 1.1 06/08/28 SMI"
#include <sys/stat.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/varargs.h>
#include <errno.h>
#include <math.h>
#define DTRACE_VERSION 1
typedef struct dtrace_hdl dtrace_hdl_t;
typedef struct dtrace_prog dtrace_prog_t;
typedef struct dtrace_vector dtrace_vector_t;
typedef int64_t dtrace_aggvarid_t;
#define DTRACEIOC (('d' << 24) | ('t' << 16) | ('r' << 8))
#define DTRACEIOC_ENABLE (DTRACEIOC | 6)
extern dtrace_hdl_t *dtrace_open(int, int, int *);
extern dtrace_prog_t *dtrace_program_fcompile(dtrace_hdl_t *,
FILE *, uint_t, int, char *const []);
extern void *dtrace_program_dof(dtrace_hdl_t *, dtrace_prog_t *, uint_t);
#define DOF_ID_SIZE 16
typedef struct dof_hdr {
uint8_t dofh_ident[DOF_ID_SIZE];
uint32_t dofh_flags;
uint32_t dofh_hdrsize;
uint32_t dofh_secsize;
uint32_t dofh_secnum;
uint64_t dofh_secoff;
uint64_t dofh_loadsz;
uint64_t dofh_filesz;
uint64_t dofh_pad;
} dof_hdr_t;
void
fatal(char *fmt, ...)
{
va_list ap;
va_start(ap, fmt);
fprintf(stderr, "%s: ", "baddof");
vfprintf(stderr, fmt, ap);
if (fmt[strlen(fmt) - 1] != '\n')
fprintf(stderr, ": %s\n", strerror(errno));
exit(1);
}
#define LEAP_DISTANCE 20
void
corrupt(int fd, unsigned char *buf, int len)
{
static int ttl, valid;
int bit, i;
unsigned char saved;
int val[LEAP_DISTANCE], pos[LEAP_DISTANCE];
int new, rv;
again:
printf("valid DOF #%d\n", valid++);
for (bit = 0; bit < len * 8; bit++) {
saved = buf[bit / 8];
buf[bit / 8] ^= (1 << (bit % 8));
if ((bit % 100) == 0)
printf("%d\n", bit);
if ((rv = ioctl(fd, DTRACEIOC_ENABLE, buf)) == -1) {
buf[bit / 8] = saved;
continue;
}
ttl += rv;
if (ttl < 10000) {
buf[bit / 8] = saved;
continue;
}
printf("enabled %d probes; resetting device.\n", ttl);
close(fd);
new = open("/devices/pseudo/dtrace@0:dtrace", O_RDWR);
if (new == -1)
fatal("couldn't open DTrace pseudo device");
if (new != fd) {
dup2(new, fd);
close(new);
}
ttl = 0;
buf[bit / 8] = saved;
}
for (;;) {
for (i = 0; i < LEAP_DISTANCE; i++) {
bit = lrand48() % (len * 8);
val[i] = buf[bit / 8];
pos[i] = bit / 8;
buf[bit / 8] ^= (1 << (bit % 8));
}
if ((rv = ioctl(fd, DTRACEIOC_ENABLE, buf)) > 0) {
ttl += rv;
goto again;
}
for (i = LEAP_DISTANCE - 1; i >= 0; i--)
buf[pos[i]] = val[i];
}
}
void
main(int argc, char **argv)
{
char *filename = argv[1];
dtrace_hdl_t *dtp;
dtrace_prog_t *pgp;
int err, fd, len;
FILE *fp;
unsigned char *dof, *copy;
if (argc < 1)
fatal("expected D script as argument\n");
if ((fp = fopen(filename, "r")) == NULL)
fatal("couldn't open %s", filename);
if ((dtp = dtrace_open(DTRACE_VERSION, 0, &err)) == NULL) {
fatal("cannot open dtrace library: %s\n",
dtrace_errmsg(NULL, err));
}
pgp = dtrace_program_fcompile(dtp, fp, 0, 0, NULL);
fclose(fp);
if (pgp == NULL) {
fatal("failed to compile script %s: %s\n", filename,
dtrace_errmsg(dtp, dtrace_errno(dtp)));
}
dof = dtrace_program_dof(dtp, pgp, 0);
len = ((dof_hdr_t *)dof)->dofh_loadsz;
if ((copy = malloc(len)) == NULL)
fatal("could not allocate copy of %d bytes", len);
for (;;) {
bcopy(dof, copy, len);
fd = open("/devices/pseudo/dtrace@0:dtrace", O_RDWR);
if (fd == -1)
fatal("couldn't open DTrace pseudo device");
corrupt(fd, copy, len);
close(fd);
}
}