`SetupPathForFileName` is the "find a file beside my binary" helper: it is how
the driver path, the hwdbg test/script files, the exported
`hyperdbg_u_setup_path_for_filename` and (now) the PCI ID database are all
resolved. On Linux it was a stub that printed an error and returned FALSE, so
every one of those lookups failed. Implementing it also removes the blocker that
kept two neighbouring helpers stubbed, so all three are done here.
install-linux.cpp — SetupPathForFileName:
A call-for-call port of the Windows body. `readlink("/proc/self/exe")` is the
`GetModuleFileName(GetModuleHandle(NULL), ...)` counterpart, `strrchr(..., '/')`
replaces `strrchr(..., '\\')` to strip the program name, and `access(path, F_OK)`
replaces the `CreateFile(..., OPEN_EXISTING)` probe behind `CheckFileExists`.
Two things it does that the Windows version does not:
- BufferLength is honoured on every write. `readlink` truncates silently, so a
result that fills the buffer is rejected instead of being handed back as a
valid-looking path to the wrong file, and the directory + '/' + name + NUL
total is checked before appending. install.cpp gets the second half of this
from StringCbCat, but its GetModuleFileName truncation is unchecked.
- Windows-style separators in FileName are normalized to '/'. The names come
from shared headers and are spelled the Windows way —
HWDBG_TEST_READ_INSTANCE_INFO_PATH ("..\\..\\..\\..\\hwdbg\\...") and
PCI_ID_DATABASE_PATH ("constants\\pci.ids"). Normalizing here keeps those
constants shared and keeps the #ifdef out of every call site. Only the
appended part is rewritten, so a backslash inside a real Linux directory name
survives.
common.cpp — ListDirectory:
opendir/readdir with fnmatch for the wildcard, mirroring how FindFirstFileA
applies the pattern to the file name. No fnmatch flag is passed, so a leading
'.' is unremarkable and "." / ".." match a bare "*", as they do in the Win32
walk; a missing directory throws the same std::runtime_error as the
INVALID_HANDLE_VALUE branch. One deliberate difference: the result is sorted,
since readdir returns entries in file-system order and the caller (eval.cpp's
script-engine test harness) is easier to compare across runs when the order is
stable.
pci-id.cpp — GetVendorById:
The Linux branch now builds the database path with SetupPathForFileName and
calls the same GetVendorByIdStr as Windows. It had been left Windows-only
because wrapping just the two Win32 calls would have left strrchr looking for a
'\\' and silently resolving against the cwd; the normalization above removes
that objection. !pcitree and !pcicam resolve vendor and device names on Linux
whenever constants/pci.ids is deployed next to the binary.
Verified by extracting SetupPathForFileName and the Linux ListDirectory branch
into a standalone harness built with -fsanitize=address,undefined: 20 probes
covering the separator normalization, both CheckFileExists outcomes, the
exact-fit and one-byte-short buffer boundaries, a buffer too small for the
executable path itself, the NULL/zero-length arguments, and the four
ListDirectory cases (filtering, sorting, empty match, missing directory). All
pass with no sanitizer diagnostics. The three modified files were also compiled
with the project's own Linux CMake build. The Windows build is untouched: every
change is inside a non-Windows branch or in a file that is not in the Windows
project.
The ledger in hyperdbg/linux/PORTING_STATUS.md is updated accordingly;
GetConfigFilePath stays open, as it is the same walk behind a PWCHAR
out-parameter and remains blocked on the wide-char work.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W3C1DuhHtqK64eEkHjKCHM
The remaining std::stoi() call sites in the user-mode helpers throw on
malformed and out-of-range input. None of the callers catch, and there is
no top-level handler, so a bad command argument terminates the process
instead of being rejected with an error message.
common/common.cpp:
- IsNumber() tested against the character set "[0123456789]", so the two
square brackets were accepted as digits. It is used as the guard in
front of stoi() by several callers, which turns the mistake into a
crash: "[1]" passes validation and then throws std::invalid_argument.
Removed the brackets from the set.
- ValidateIP() called stoi() on every octet. Together with the above,
".connect [1].2.3.4 50000" aborted the process; so did an octet long
enough to overflow int, e.g. ".connect 99999999999.1.1.1". Replaced by
a strtoul() range check, which saturates instead of throwing.
- CheckAddressCanonicality() compared with a strict "<" against the start
of the higher-half canonical range, so the boundary address itself
(0xFFFF800000000000 at a 48-bit VA width) was reported as user-mode.
CheckAccessValidityAndSafety() would then probe a kernel address from
user mode rather than refusing it.
- ListDirectory() called FindNextFileA() before consuming the match that
FindFirstFileA() had already stored in FindData, so the first file of
every listing was silently dropped. Turned into a do/while.
- isxdigit()/isdigit()/isspace() were handed a plain char; passing a
negative value to the <ctype.h> functions is undefined behavior and
trips the MSVC debug CRT on any input with a byte above 0x7f. Cast to
UCHAR at the four call sites.
The same crash class at the call sites that use stoi() directly on user
input, all replaced with strtoul() so the existing range checks reject
the value instead of an exception escaping:
- connect.cpp (x2) and listen.cpp: TCP port validation.
- debug.cpp: serial baud rate.
Verified by extracting the affected functions from common.cpp and running
them under ASan/UBSan over a 316-probe corpus, before and after. The
baseline aborts with SIGABRT on three inputs; afterwards every probe
returns a defined result and exactly the seven intended lines differ.
The four modified files were also compiled with the project's own Linux
CMake build to confirm they build clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W3C1DuhHtqK64eEkHjKCHM
Code audit of the script engine's scanner/token handling and of the PCI ID
database parser. Each of the issues below was reproduced against the current
code before the fix and re-checked afterwards.
script-engine/scanner.c
* An unterminated string literal ("abc or L"abc) hung the scanner in an
endless loop: sgetc() returns EOF without consuming input, and neither
string loop tested for it, so the token grew until allocation failed.
Both loops now stop at EOF and report the token as UNKNOWN.
script-engine/common.c
* AppendByte()/AppendWchar() doubled Token->MaxLen before checking whether
the larger buffer was actually allocated. After a failed allocation MaxLen
described memory that did not exist and the next append wrote past the end
of the old buffer. MaxLen is now committed only on success.
* CopyToken() allocated strlen(Value) + 1 bytes but carried over the source
token's Len and MaxLen, so the copy's advertised capacity did not match its
allocation, and WSTRING payloads were truncated at their first embedded
null byte. The copy is now sized from Len/MaxLen and copied by length, with
a fallback to the string length for the grammar tokens in parse-table.c,
which only initialize Type and Value.
* NewToken() set MaxLen to the value length, which is zero for an empty
value. The 'Len >= MaxLen - 1' test in the append routines is unsigned, so
a zero MaxLen wrapped and disabled buffer growth entirely.
* IsUnderscore() tested 'c >= '_'', which also accepted the backtick, the
lowercase letters, '{', '|', '}', '~' and DEL. Register scanning uses it,
so '@rax|1' was lexed as one malformed register name instead of a register,
an operator and a number. The pseudo-register path already compared against
'_' directly.
* NewTokenList() did not check the allocation of its Head buffer.
* NewTemp() kept the last handed-out id in a static, so an exhausted temp
list produced a token aliasing a temporary still in use, and it derived
MaxTempNumber from an out-of-range index. It also dereferenced the new
token without a null check.
* FreeTemp() indexed the MAX_TEMP_COUNT-entry map with an unchecked value
parsed out of the token text.
* RotateLeftStringOnce() wrote to str[-1] when handed an empty string.
libhyperdbg/debugger/misc/pci-id.cpp
* The database file was read into a malloc(Length) buffer that was never
null-terminated, while ReadLine() walks it with strchr(). Looking up an
absent vendor scans to the end and reads past the allocation.
* The matched Vendor was allocated with malloc() and its Devices list head
was only assigned once a device line was parsed, so a vendor with no
device entries left it uninitialized and FreeVendor() walked a garbage
pointer.
* FreeVendor() released the device and subdevice lists but never the Vendor
itself, leaking one per lookup for every enumerated PCI device.
* The file handle leaked when the buffer allocation failed, ftell() and
fread() results were unused, and several error paths leaked the Vendor or
the not-yet-linked Device/SubDevice.
* strncmp() compared sizeof(VendorId) bytes, which is the size of the
pointer rather than the length of a vendor id.
* ReadLine() passed an unclamped count to strncpy_s(), which triggers the
invalid parameter handler for a line longer than the destination.
* GetVendorById() ignored the GetModuleFileName() result and overwrote the
tail of the path buffer without checking the room left in it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W3C1DuhHtqK64eEkHjKCHM
The debuggee-side hyperkd fix stops the driver flooding, but the same
delimiter-only framing with a blind retry loop also lives in the
user-mode receivers. Mirror the resync there so an unclean disconnect
does not flood the console either: KdReceivePacketFromDebuggee,
KdReceivePacketFromDebugger, and the ListeningSerialPortInDebuggee loop.
On overflow with no end-of-buffer marker, warn once per episode and
discard to the next frame boundary (bounded by SERIAL_RESYNC_MAX_BYTES)
instead of returning into the still-desynced stream.
Refs #661
