1 files changed, 106 insertions, 34 deletions

diff --git a/debuggerd/crasher.c b/debuggerd/crasher.c
index 00652e9..8c225cb 100644
--- a/debuggerd/crasher.c
+++ b/debuggerd/crasher.c
@@ -17,9 +17,11 @@
 
 #include <cutils/sockets.h>
 
+extern const char* __progname;
+
 void crash1(void);
 void crashnostack(void);
-void maybeabort(void);
+static int do_action(const char* arg);
 
 static void debuggerd_connect()
 {
@@ -27,30 +29,44 @@ static void debuggerd_connect()
     int s;
     sprintf(tmp, "%d", gettid());
     s = socket_local_client("android:debuggerd",
-            ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_STREAM);    
+            ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_STREAM);
     if(s >= 0) {
         read(s, tmp, 1);
         close(s);
     }
 }
 
-void test_call1()
-{
-    *((int*) 32) = 1;
+static void maybeabort() {
+    if(time(0) != 42) {
+        abort();
+    }
 }
 
-void *test_thread(void *x)
-{
-    printf("crasher: thread pid=%d tid=%d\n", getpid(), gettid());
+static int smash_stack(int i) {
+    printf("crasher: deliberately corrupting stack...\n");
+    // Unless there's a "big enough" buffer on the stack, gcc
+    // doesn't bother inserting checks.
+    char buf[8];
+    // If we don't write something relatively unpredicatable
+    // into the buffer and then do something with it, gcc
+    // optimizes everything away and just returns a constant.
+    *(int*)(&buf[7]) = (uintptr_t) &buf[0];
+    return *(int*)(&buf[0]);
+}
 
-    sleep(1);
-    test_call1();
-    printf("goodbye\n");
+__attribute__((noinline)) static void overflow_stack(void* p) {
+    fprintf(stderr, "p = %p\n", p);
+    void* buf[1];
+    buf[0] = p;
+    overflow_stack(&buf);
+}
 
-    return 0;
+static void test_call1()
+{
+    *((int*) 32) = 1;
 }
 
-void *noisy(void *x)
+static void *noisy(void *x)
 {
     char c = (unsigned) x;
     for(;;) {
@@ -61,7 +77,7 @@ void *noisy(void *x)
     return 0;
 }
 
-int ctest()
+static int ctest()
 {
     pthread_t thr;
     pthread_attr_t attr;
@@ -74,33 +90,89 @@ int ctest()
     return 0;
 }
 
-int main(int argc, char **argv)
+static void* thread_callback(void* raw_arg)
 {
-    pthread_t thr;
-    pthread_attr_t attr;
+    return (void*) do_action((const char*) raw_arg);
+}
+
+static int do_action_on_thread(const char* arg)
+{
+    pthread_t t;
+    pthread_create(&t, NULL, thread_callback, (void*) arg);
+    void* result = NULL;
+    pthread_join(t, &result);
+    return (int) result;
+}
+
+__attribute__((noinline)) static int crash3(int a) {
+    *((int*) 0xdead) = a;
+    return a*4;
+}
 
-    fprintf(stderr,"crasher: " __TIME__ "!@\n");
+__attribute__((noinline)) static int crash2(int a) {
+    a = crash3(a) + 2;
+    return a*3;
+}
+
+__attribute__((noinline)) static int crash(int a) {
+    a = crash2(a) + 1;
+    return a*2;
+}
+
+static void abuse_heap() {
+    char buf[16];
+    free((void*) buf); // GCC is smart enough to warn about this, but we're doing it deliberately.
+}
+
+static int do_action(const char* arg)
+{
     fprintf(stderr,"crasher: init pid=%d tid=%d\n", getpid(), gettid());
 
+    if (!strncmp(arg, "thread-", strlen("thread-"))) {
+        return do_action_on_thread(arg + strlen("thread-"));
+    } else if (!strcmp(arg,"smash-stack")) {
+        return smash_stack(42);
+    } else if (!strcmp(arg,"stack-overflow")) {
+        overflow_stack(NULL);
+    } else if (!strcmp(arg,"nostack")) {
+        crashnostack();
+    } else if (!strcmp(arg,"ctest")) {
+        return ctest();
+    } else if (!strcmp(arg,"exit")) {
+        exit(1);
+    } else if (!strcmp(arg,"crash")) {
+        return crash(42);
+    } else if (!strcmp(arg,"abort")) {
+        maybeabort();
+    } else if (!strcmp(arg, "heap-usage")) {
+        abuse_heap();
+    }
+
+    fprintf(stderr, "%s OP\n", __progname);
+    fprintf(stderr, "where OP is:\n");
+    fprintf(stderr, "  smash-stack     overwrite a stack-guard canary\n");
+    fprintf(stderr, "  stack-overflow  recurse until the stack overflows\n");
+    fprintf(stderr, "  heap-corruption cause a libc abort by corrupting the heap\n");
+    fprintf(stderr, "  heap-usage      cause a libc abort by abusing a heap function\n");
+    fprintf(stderr, "  nostack         crash with a NULL stack pointer\n");
+    fprintf(stderr, "  ctest           (obsoleted by thread-crash?)\n");
+    fprintf(stderr, "  exit            call exit(1)\n");
+    fprintf(stderr, "  crash           cause a SIGSEGV\n");
+    fprintf(stderr, "  abort           call abort()\n");
+    fprintf(stderr, "prefix any of the above with 'thread-' to not run\n");
+    fprintf(stderr, "on the process' main thread.\n");
+    return EXIT_SUCCESS;
+}
+
+int main(int argc, char **argv)
+{
+    fprintf(stderr,"crasher: built at " __TIME__ "!@\n");
+
     if(argc > 1) {
-        if(!strcmp(argv[1],"nostack")) crashnostack();
-        if(!strcmp(argv[1],"ctest")) return ctest();
-        if(!strcmp(argv[1],"exit")) exit(1);
-        if(!strcmp(argv[1],"abort")) maybeabort();
-        
-        pthread_attr_init(&attr);
-        pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
-        pthread_create(&thr, &attr, test_thread, 0);
-        while(1) sleep(1);
+        return do_action(argv[1]);
     } else {
         crash1();
-//        *((int*) 0) = 42;
     }
-    
-    return 0;
-}
 
-void maybeabort()
-{
-    if(time(0) != 42) abort();
+    return 0;
 }