4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
31 #include <sys/varargs.h>
43 fprintf(stderr, "%s: ", "baddof");
44 vfprintf(stderr, fmt, ap);
46 if (fmt[strlen(fmt) - 1] != '\n')
47 fprintf(stderr, ": %s\n", strerror(errno));
52 #define LEAP_DISTANCE 20
55 corrupt(int fd, unsigned char *buf, int len)
57 static int ttl, valid;
60 int val[LEAP_DISTANCE], pos[LEAP_DISTANCE];
64 printf("valid DOF #%d\n", valid++);
67 * We are going iterate through, flipping one bit and attempting
70 for (bit = 0; bit < len * 8; bit++) {
72 buf[bit / 8] ^= (1 << (bit % 8));
77 if ((rv = ioctl(fd, DTRACEIOC_ENABLE, buf)) == -1) {
79 * That failed -- restore the bit and drive on.
86 * That worked -- and it may have enabled probes. To keep
87 * enabled probes down to a reasonable level, we'll close
88 * and reopen pseudodevice if we have more than 10,000
98 printf("enabled %d probes; resetting device.\n", ttl);
101 new = open("/devices/pseudo/dtrace@0:dtrace", O_RDWR);
104 fatal("couldn't open DTrace pseudo device");
112 buf[bit / 8] = saved;
117 * Now we want to get as many bits away as possible. We flip
118 * bits randomly -- getting as far away as we can until we don't
119 * seem to be making any progress.
121 for (i = 0; i < LEAP_DISTANCE; i++) {
123 * Pick a random bit and corrupt it.
125 bit = lrand48() % (len * 8);
127 val[i] = buf[bit / 8];
129 buf[bit / 8] ^= (1 << (bit % 8));
133 * Let's see if that managed to get us valid DOF...
135 if ((rv = ioctl(fd, DTRACEIOC_ENABLE, buf)) > 0) {
137 * Success! This will be our new base for valid DOF.
144 * No luck -- we'll restore those bits and try flipping a
145 * different set. Note that this must be done in reverse
148 for (i = LEAP_DISTANCE - 1; i >= 0; i--)
149 buf[pos[i]] = val[i];
154 main(int argc, char **argv)
156 char *filename = argv[1];
161 unsigned char *dof, *copy;
164 fatal("expected D script as argument\n");
166 if ((fp = fopen(filename, "r")) == NULL)
167 fatal("couldn't open %s", filename);
170 * First, we need to compile our provided D into DOF.
172 if ((dtp = dtrace_open(DTRACE_VERSION, 0, &err)) == NULL) {
173 fatal("cannot open dtrace library: %s\n",
174 dtrace_errmsg(NULL, err));
177 pgp = dtrace_program_fcompile(dtp, fp, 0, 0, NULL);
181 fatal("failed to compile script %s: %s\n", filename,
182 dtrace_errmsg(dtp, dtrace_errno(dtp)));
185 dof = dtrace_dof_create(dtp, pgp, 0);
186 len = ((dof_hdr_t *)dof)->dofh_loadsz;
188 if ((copy = malloc(len)) == NULL)
189 fatal("could not allocate copy of %d bytes", len);
192 bcopy(dof, copy, len);
194 * Open another instance of the dtrace device.
196 fd = open("/devices/pseudo/dtrace@0:dtrace", O_RDWR);
199 fatal("couldn't open DTrace pseudo device");
201 corrupt(fd, copy, len);