git clone --recursive https://github.com/github/vscode-codeql-starter

❯ unzip u-boot_u-boot_cpp-srcVersion_d0d07ba86afc8074d79e436b1ba4478fa0f0c1b5-dist_odasa-2019-07-25-linux64.zip
❯ ll
total 1011776
drwxr-xr-x   5 lzx  staff   160B  6  6 23:33 attach
drwxr-xr-x  38 lzx  staff   1.2K  6  5 23:02 codeql
drwxr-xr-x@ 22 lzx  staff   704B  5 24 18:28 codeql-cli
-rw-r--r--@  1 lzx  staff   420M  6  5 23:01 codeql-cli.zip
-rw-r--r--@  1 lzx  staff   2.1K  6  7 00:00 codeql.md
-rw-r--r--@  1 lzx  staff    74M  6  5 23:21 u-boot_u-boot_cpp-srcVersion_d0d07ba86afc8074d79e436b1ba4478fa0f0c1b5-dist_odasa-2019-07-25-linux64.zip
drwxr-xr-x@  9 lzx  staff   288B  6  7 00:01 u-boot_u-boot_d0d07ba  <-- 解压结果
drwxr-xr-x  21 lzx  staff   672B  6  6 22:51 vscode-codeql-starter

git clone https://github.com/hluwa/codeql-uboot.git

import cpp
from Function f
where f.getName() = "strlen"
select f, "a function named strlen"

import cpp
from Function f
where f.getName() = "memcpy"
select f, "a function named memcpy"

import cpp
from Macro m
where m.getName().regexpMatch("ntoh(l|ll|s)")
select m, "ntohl, ntohll, and ntohs"

import cpp
from Macro m
// where m.getName().regexpMatch("ntoh(l|ll|s)")
// select m, "ntohl, ntohll, and ntohs"
// where <your_variable_name> in [“bar”, “baz”, “quux”]
where m.getName() in ["ntohs","ntohl","ntohll"]
select m, "ntohl, ntohll, and ntohs 22222"

import cpp
from FunctionCall fc
// FunctionCall.getTarget()：返回值类型的是Function，功能是获取被这个函数调用fc所调用的函数
where fc.getTarget().getName() = "memcpy" // 如果fc调用的函数的名称是memcpy
select fc

import cpp
from MacroInvocation mi
where mi.getMacro().getName().regexpMatch("ntoh(l|ll|s)")
select mi

import cpp
from MacroInvocation mi
where mi.getMacro().getName().regexpMatch("ntoh(l|ll|s)")
select mi.getExpr()

import cpp
// 定义一个类：
// 1. 要有class关键字
// 2. 类名首字母必须大写
// 3. 类的supertypes需要由关键字 extends 或者 instanceof 来声明
// 4. 类的body要闭合
class MyMacroInvocation extends MacroInvocation{ // 这个类继承MacroInvocation
    MacroInvocation mi;// 声明一个宏调用的变量
    MyMacroInvocation(){ // characteristic predicate， 类似构造函数
        // mi满足下面的条件，并且this等于mi
        mi.getMacro().getName().regexpMatch("ntoh(l|ll|s)") and this = mi
    }
}
from MyMacroInvocation mmi
select mmi.getExpr() // 获取满足上面条件的宏调用的表达式

// 解法3:
import cpp
class MyExpr extends Expr {
    MacroInvocation mi;
        MyExpr(){
        mi.getMacro().getName().regexpMatch("ntoh(l|ll|s)") and this = mi.getExpr()
    }
}
from MyExpr me
select me, "33333"

import cpp
class NetworkByteSwap extends Expr {
    NetworkByteSwap() { 
        exists(MacroInvocation mi | mi.getMacro().getName().regexpMatch("ntoh.*") | mi.getExpr() = this)
     }
}
from NetworkByteSwap n
select n, "Network byte swap"

/**
* @kind path-problem
*/
import cpp
import semmle.code.cpp.dataflow.TaintTracking
import DataFlow::PathGraph
class YOUR_CLASS_HERE extends Expr {
  // 2.0 Todo 
}
class Config extends TaintTracking::Configuration {
  Config() { this = "NetworkToMemFuncLength" }
  override predicate isSource(DataFlow::Node source) {
      // 2.1 Todo
  }
  override predicate isSink(DataFlow::Node sink) {
     // 2.1Todo
}
from Config cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink, source, sink, "ntoh flows to memcpy"

// 1. 声明3个变量，Config类型的cfg，PathNode类型的source和sink
from Config cfg, DataFlow::PathNode source, DataFlow::PathNode sink
// 2. 将source 和 sink 作为参数传入hasFlowPath。顾名思义，也就是判断是否有从source到sink的数据流动的path
where cfg.hasFlowPath(source, sink)
// 3. 打印sink 和source，不过为啥要打印两遍sink？
select sink, source, sink, "ntoh flows to memcpy"

  /**
   * Holds if data may flow from `source` to `sink` for this configuration.
   *
   * The corresponding paths are generated from the end-points and the graph
   * included in the module `PathGraph`.
   */
      相应的path是通过模块PathGraph里的end-points和graph来生成的

class Config extends TaintTracking::Configuration {
  Config() { this = "NetworkToMemFuncLength" }
  override predicate isSource(DataFlow::Node source) { 
      // 2.1 Todo
  }
  override predicate isSink(DataFlow::Node sink) {
     // 2.1Todo
}

predicate isCountry(string country) {
  country = "Germany"
  or
  country = "Belgium"
  or
  country = "France"
}

/**
* @kind path-problem
*/
import cpp
import semmle.code.cpp.dataflow.TaintTracking
import DataFlow::PathGraph
class MyExpr extends Expr {
  // 2.0 Todo 
  MacroInvocation mi;
      MyExpr(){
      mi.getMacro().getName().regexpMatch("ntoh(l|ll|s)") and this = mi.getExpr()
  }
}
class Config extends TaintTracking::Configuration {
  Config() { this = "NetworkToMemFuncLength" }
  override predicate isSource(DataFlow::Node source) {
      // 2.1 Todo
      source.asExpr() instanceof MyExpr
  }
  override predicate isSink(DataFlow::Node sink) {
     // 2.1Todo
     // 存在memcpy的函数调用，并且该调用的第二个参数是sink.asExpr()
     exists(FunctionCall fc | fc.getTarget().hasName("memcpy") | sink.asExpr() = fc.getArgument(2))
  }
}
from Config cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink, source, sink, "ntoh flows to memcpy"

static void nfs_handler(uchar *pkt, unsigned dest, struct in_addr sip,
            unsigned src, unsigned len)
{
    int rlen;
    int reply;
    debug("%s\n", __func__);
    if (dest != nfs_our_port)
        return;
    switch (nfs_state) {
    case STATE_PRCLOOKUP_PROG_MOUNT_REQ:
        if (rpc_lookup_reply(PROG_MOUNT, pkt, len) == -NFS_RPC_DROP)
            break;
        ......
        break;
    case STATE_PRCLOOKUP_PROG_NFS_REQ:
        if (rpc_lookup_reply(PROG_NFS, pkt, len) == -NFS_RPC_DROP)
            break;
        ......
        break;
    case STATE_MOUNT_REQ:
        reply = nfs_mount_reply(pkt, len);
        ......
        break;
    case STATE_UMOUNT_REQ:
        reply = nfs_umountall_reply(pkt, len);
        ......
        break;
    case STATE_LOOKUP_REQ:
        reply = nfs_lookup_reply(pkt, len);
        ......
        break;
    case STATE_READLINK_REQ:
        reply = nfs_readlink_reply(pkt, len);
        ......
        break;
    case STATE_READ_REQ:
        rlen = nfs_read_reply(pkt, len);
        ......
        break;
    }
}

struct rpc_t {
    union {
        uint8_t data[NFS_READ_SIZE + (6 + NFS_MAX_ATTRS) *
            sizeof(uint32_t)];
        struct {
            uint32_t id;
            uint32_t type;
            uint32_t rpcvers;
            uint32_t prog;
            uint32_t vers;
            uint32_t proc;
            uint32_t data[1];
        } call;
        struct {
            uint32_t id;
            uint32_t type;
            uint32_t rstatus;
            uint32_t verifier;
            uint32_t v2;
            uint32_t astatus;
            uint32_t data[NFS_READ_SIZE / sizeof(uint32_t) +
                NFS_MAX_ATTRS];
        } reply;
    } u;
} __attribute__((packed));

# 往期推荐

1、2023 SDC 议题回顾 | 芯片安全和无线电安全底层渗透技术

2、SWPUCTF 2021 新生赛-老鼠走迷宫

3、OWASP 实战分析 level 1

4、【远控木马】银狐组织最新木马样本-分析

5、自研Unidbg trace工具实战ollvm反混淆

6、2023 SDC 议题回顾 | 深入 Android 可信应用漏洞挖掘