cscg24-haunted

HelloWorld.c (6419B)

#include "Base.h"
#include "ProcessorBind.h"
#include <Uefi.h>
#include <Library/PcdLib.h>
#include <Library/UefiLib.h>
#include <Library/UefiApplicationEntryPoint.h>

#define INTEL_ASM(x, ...) asm volatile \
	(".intel_syntax noprefix;" x ";.att_syntax prefix" : __VA_ARGS__)

UINT64
gcd(UINT64 a, UINT64 b)
{
	while (a != b) {
		if (a > b) {
			a -= b;
		} else {
			b -= a;
		}
	}

	return a;
}

UINT64
digitsum(UINT64 a)
{
	UINT64 sum = 0;

	while (a > 0) {
		sum += a % 10;
		a /= 10;
	}

	return sum;
}

void
register_handler(UINT8 no, UINT64 offset)
{
	char buf[0x10];
	UINT16 cs;

	INTEL_ASM("movw %[cs], cs;", [cs]"=r"(cs));

	UINT64 lower = ((offset & 0xffff0000UL) << 32)
		| (0b1ULL << 47) /* P = 1 */
		| (0b1110ULL << 40) /* Interrupt gate */
		| ((UINT64)cs << 16) /* Segment */
		| (offset & 0xffffUL); /* low offset */
	UINT64 upper = (offset >> 32) & 0xffffffff;

	INTEL_ASM(
		"sidt [rsp];"
		"movq rax, 2[rsp];"
		"xor ebx, ebx;"
		"movb bl, %[no];"
		"shl rbx, 4;"
		"add rax, rbx;"
		"movq [rax], %[lower];"
		"movq 8[rax], %[upper];",
		[buf]"+m"(buf)
		: [lower]"r"(lower), [upper]"r"(upper), [no]"r"(no)
		: "rax", "rbx");
}

EFI_STATUS
EFIAPI
UefiMain (IN EFI_HANDLE ImageHandle, IN EFI_SYSTEM_TABLE *SystemTable)
{
	UINT64 rax, rbx, rcx, rdx, res;
	UINT32 eax, ebx;
	UINT16 ocs;

	Print ((CHAR16 *)PcdGetPtr (PcdHelloWorldPrintString));

	// _start is already 0x1000 aligned..
	// INTEL_ASM(".align 0x10000;");

	*(UINT64 *)(0x4000) = 0xe6ff; // jmp rsi trampoline

	INTEL_ASM("jmp after_handler;");

	INTEL_ASM(
		"handler:"
		"movq [0x3ff8], rax;"
		"iretq;");

	UINT64 addr;
	INTEL_ASM("after_handler: lea %[addr], handler[rip]",
		[addr]"=r"(addr));

	register_handler(0x69, addr);

	INTEL_ASM(
		// Setup CS+EIP of our segment.
		"lea rax, post%=[rip]; push rax;"
		"xor eax, eax; movw ax, cs; movd 4[rsp], eax;"
		// Set magic value + 1.
		"movq rdi, 0xfef0000013ffffff;"
		// Loop until interrupt.
		"loop%=: jmp loop%=; nop; nop;"
		// Switch to original segment.
		"movw di, cs; retfd; .code64; post%=:"
		// Save registers.
		"movw %[ocs], di;"
		"push rax; push rbx; push rcx; push rdx;"
		"pop %[rdx]; pop %[rcx]; pop %[rbx]; pop %[rax];",
		[rax]"=r"(rax), [rbx]"=r"(rbx),
		[rcx]"=r"(rcx), [rdx]"=r"(rdx),
		[ocs]"=r"(ocs)
		: : "rax", "rbx", "rcx", "rdx", "rdi");

	for (int i = 0; i < 69; i++) {
		res = gcd(rax | (rbx << 32), rcx | (rdx << 32));
		eax = res;
		ebx = res >> 32;

		if (i == 68) break;

		INTEL_ASM(
			// Setup CS+EIP of our segment.
			"lea rax, post%=[rip]; push rax;"
			"xor eax, eax; movw ax, cs; movd 4[rsp], eax;"
			// Setup CS+EIP of other segment.
			"lea rax, pre%=[rip]; push rax;"
			"xor eax, eax; movw ax, %[ocs]; movd 4[rsp], eax;"
			// Set calculation result.
			"movd eax, %[eax]; movd ebx, %[ebx];"
			// Switch to other segment.
			"retfd; .code32; pre%=:"
			// Set magic.
			"movd ecx, 0xfefefefe;"
			// Loop until interrupt.
			"loop%=: jmp loop%=; nop; nop;"
			// Switch to original segment.
			"movw di, cs; retfd; .code64; post%=:"
			// Save registers.
			"movw %[ocs], di;"
			"push rax; push rbx; push rcx; push rdx;"
			"pop %[rdx]; pop %[rcx]; pop %[rbx]; pop %[rax];",
			[rdx]"=r"(rdx), [rcx]"=r"(rcx),
			[rbx]"=r"(rbx), [rax]"=r"(rax),
			[ocs]"+r"(ocs)
			: [eax]"r"(eax), [ebx]"r"(ebx)
			: "rax", "rbx", "rcx", "rdx", "rdi");
	}

	INTEL_ASM(
		// Setup CS+IP of our segment.
		"lea rax, post%=[rip]; movq rsi, rax; push 0x4000;"
		"movw ax, cs; movw 2[rsp], ax;"
		// Setup CS+EIP of other segment.
		"lea rax, pre%=[rip]; push rax;"
		"xor eax, eax; movw ax, %[ocs]; movd 4[rsp], eax;"
		// Set calculation result.
		"movd eax, %[eax]; movd ebx, %[ebx];"
		// Switch to other segment.
		"retfd; .code32; pre%=:"
		// Set magic.
		"movd ecx, 0xfefefefe;"
		// Loop until interrupt.
		"loop%=: jmp loop%=; .rept 256; nop; .endr;"
		// Switch to original segment.
		".code16; movw di, cs; retfw; .code64; post%=:"
		// Fixup stack misalignment.
		"add rsp, 4;"
		// Save registers.
		"movw %[ocs], di;"
		"push rax; push rbx; push rcx; push rdx;"
		"pop %[rdx]; pop %[rcx]; pop %[rbx]; pop %[rax];",
		[rdx]"=r"(rdx), [rcx]"=r"(rcx),
		[rbx]"=r"(rbx), [rax]"=r"(rax),
		[ocs]"+r"(ocs)
		: [eax]"r"(eax), [ebx]"r"(ebx)
		: "rax", "rbx", "rcx", "rdx", "rdi", "rsi");

	for (int i = 0; i < 420; i++) {
		eax = digitsum((rax & 0xffff) | ((rbx & 0xffff) << 16));

		if (i == 419) break;

		INTEL_ASM(
			// Setup CS+IP of our segment.
			"lea rax, post%=[rip]; movq rsi, rax; push 0x4000;"
			"movw ax, cs; movw 2[rsp], ax;"
			// Setup CS+EIP of other segment.
			"lea rax, pre%=[rip]; and rax, 0xffff; push rax;"
			"xor eax, eax; movw ax, %[ocs]; movd 4[rsp], eax;"
			// Set calculation result.
			"movd eax, %[eax];"
			// Switch to other segment
			"retfd; pre%=: .code16; "
			// Set magic (movw cl, 0xfefe is not 16-bit mode compat).
			"movb cl, 0xfe; movb ch, 0xfe;"
			// Loop until interrupt.
			"loop%=: jmp loop%=; nop; nop;"
			// Switch to original segment.
			"movw di, cs; retfw; post%=: .code64;"
			// Fixup stack misalignment.
			"add rsp, 4;"
			// Save registers.
			"movw %[ocs], di;"
			"push rax; push rbx; push rcx; push rdx;"
			"pop %[rdx]; pop %[rcx]; pop %[rbx]; pop %[rax];",
			[rdx]"=r"(rdx), [rcx]"=r"(rcx),
			[rbx]"=r"(rbx), [rax]"=r"(rax),
			[ocs]"+r"(ocs)
			: [eax]"r"(eax)
			: "rax", "rbx", "rcx", "rdx", "rsi", "rdi");
	}

	INTEL_ASM(
		// Setup CS+EIP of other segment.
		"lea rax, pre%=[rip]; and rax, 0xffff; push rax;"
		"xor eax, eax; movw ax, %[ocs]; movd 4[rsp], eax;"
		// Set calculation result.
		"movd eax, %[eax];"
		// Switch to other segment
		"retfd; pre%=: .code16; "
		// Set magic (movw cl, 0xfefe is not 16-bit mode compat).
		"movb cl, 0xfe; movb ch, 0xfe;"
		// Loop until interrupt.
		"loop%=: jmp loop%=; .code64;",
		: [eax]"r"(eax), [ocs]"r"(ocs)
		: "rax", "rbx", "rcx", "rdx");

	INTEL_ASM(
		// Move rdx from interrupt.
		"movq rdx, [0x3ff8];"
		// Set magic.
		"mov rcx, 0x12310FFAFFFFFFFF;"
		// Loop until interrupt.
		"loop2%=: jmp loop2%=;"
		// Finally, flag.
		"mov rax, 0x420; syscall",
		: : "rcx", "rdx");

	// Interrupt 0x69 gets called in loop after interrupt code injection.

	return EFI_SUCCESS;
}