Convert to src-layout ta/nix

1 files changed, 993 insertions, 0 deletions

diff --git a/src/miasm/os_dep/linux/environment.py b/src/miasm/os_dep/linux/environment.py
new file mode 100644
index 00000000..3ba4382f
--- /dev/null
+++ b/src/miasm/os_dep/linux/environment.py
@@ -0,0 +1,993 @@
+from __future__ import print_function
+from collections import namedtuple
+import functools
+import logging
+import os
+import re
+import struct
+import termios
+
+from future.utils import viewitems
+
+from miasm.core.interval import interval
+from miasm.jitter.csts import PAGE_READ, PAGE_WRITE
+
+
+REGEXP_T = type(re.compile(r''))
+
+StatInfo = namedtuple("StatInfo", [
+    "st_dev", "st_ino", "st_nlink", "st_mode", "st_uid", "st_gid", "st_rdev",
+    "st_size", "st_blksize", "st_blocks", "st_atime", "st_atimensec",
+    "st_mtime", "st_mtimensec", "st_ctime", "st_ctimensec"
+])
+StatFSInfo = namedtuple("StatFSInfo", [
+    "f_type", "f_bsize", "f_blocks", "f_bfree", "f_bavail", "f_files",
+    "f_ffree", "f_fsid", "f_namelen", "f_frsize", "f_flags", "f_spare",
+])
+
+log = logging.getLogger("environment")
+console_handler = logging.StreamHandler()
+console_handler.setFormatter(logging.Formatter("[%(levelname)-8s]: %(message)s"))
+log.addHandler(console_handler)
+log.setLevel(logging.WARNING)
+
+class FileDescriptor(object):
+    """Stand for a file descriptor on a system
+
+    According to inode(7), following types are possibles:
+     - socket
+     - symbolic link
+     - regular file
+     - block device
+     - directory
+     - character device
+     - FIFO
+    """
+
+    # st_mode's file type
+    file_type = None
+    # st_mode's file mode (9 least bits are file permission bits)
+    file_mode = 0o0777
+    # st_dev / st_rdev
+    cont_device_id = None
+    device_id = 0
+    # inode number (st_ino)
+    inode = None
+    # Number of hardlink (st_nlink)
+    nlink = 0
+    # Owner / group
+    uid = None
+    gid = None
+    # Size (st_size / st_blksize / st_blocks)
+    size = 0
+    blksize = 0
+    blocks = 0
+    # Times
+    atime = 0
+    atimensec = 0
+    mtime = 0
+    mtimensec = 0
+    ctime = 0
+    ctimensec = 0
+
+    def __init__(self, number):
+        self.number = number
+        self.is_closed = False
+
+    def stat(self):
+        mode = self.file_type | self.file_mode
+        return StatInfo(
+            st_dev=self.cont_device_id, st_ino=self.inode,
+            st_nlink=self.nlink, st_mode=mode,
+            st_uid=self.uid, st_gid=self.gid,
+            st_rdev=self.device_id, st_size=self.size,
+            st_blksize=self.blksize, st_blocks=self.blocks,
+            st_atime=self.atime, st_atimensec=self.atimensec,
+            st_mtime=self.mtime, st_mtimensec=self.mtimensec,
+            st_ctime=self.ctime, st_ctimensec=self.ctimensec
+        )
+
+    def close(self):
+        self.is_closed = True
+
+
+class FileDescriptorCharDevice(FileDescriptor):
+    file_type = 0o0020000 # S_IFCHR
+    file_mode = 0o0620
+    cont_device_id = 1
+    device_id = 1
+
+
+class FileDescriptorSTDIN(FileDescriptorCharDevice):
+    """Special file descriptor standinf for STDIN"""
+    inode = 0
+
+    def read(self, count):
+        raise RuntimeError("Not implemented")
+
+
+class FileDescriptorSTDOUT(FileDescriptorCharDevice):
+    """Special file descriptor standinf for STDOUT"""
+    inode = 1
+
+    def write(self, data):
+        print("[STDOUT] %s" % data.rstrip())
+
+
+class FileDescriptorSTDERR(FileDescriptorCharDevice):
+    """Special file descriptor standinf for STDERR"""
+    inode = 2
+
+    def write(self, data):
+        print("[STDERR] %s" % data.rstrip())
+
+
+class FileDescriptorDirectory(FileDescriptor):
+    """FileDescription designing a directory"""
+
+    file_type = 0o0040000 # S_IFDIR
+
+    def __init__(self, number, flags, filesystem, real_path):
+        super(FileDescriptorDirectory, self).__init__(number)
+        self.filesystem = filesystem
+        self.real_path = real_path
+        self.cur_listdir = None
+        self.flags = flags
+
+    def listdir(self):
+        if self.cur_listdir is None:
+            self.cur_listdir = os.listdir(self.real_path)
+        while self.cur_listdir:
+            yield self.cur_listdir.pop()
+
+
+class FileDescriptorRegularFile(FileDescriptor):
+    """FileDescriptor designing a regular file"""
+
+    file_type = 0o0100000 # S_IFREG
+
+    def __init__(self, number, flags, filesystem, real_fd):
+        super(FileDescriptorRegularFile, self).__init__(number)
+        self.flags = flags
+        self.filesystem = filesystem
+        self.real_fd = real_fd
+
+    def write(self, data):
+        raise RuntimeError("Not implemented")
+
+    def read(self, count):
+        return os.read(self.real_fd, count)
+
+    def close(self):
+        super(FileDescriptorRegularFile, self).close()
+        return os.close(self.real_fd)
+
+    def lseek(self, offset, whence):
+        return os.lseek(self.real_fd, offset, whence) # SEEK_SET
+
+    def tell(self):
+        return self.lseek(0, 1) # SEEK_CUR
+
+    def seek(self, offset):
+        return self.lseek(offset, 0) # SEEK_SET
+
+
+class FileDescriptorSocket(FileDescriptor):
+    """FileDescription standing for a socket"""
+
+    file_type = 0o0140000 # S_IFSOCK
+
+    def __init__(self, number, family, type_, protocol):
+        super(FileDescriptorSocket, self).__init__(number)
+        self.family = family
+        self.type_ = type_
+        self.protocol = protocol
+
+
+class FileSystem(object):
+    """File system abstraction
+    Provides standard operations on the filesystem, (a bit like FUSE)
+
+    API using FileSystem only used sandbox-side path. FileSystem should be the
+    only object able to interact with real path, outside the sandbox.
+
+    Thus, if `resolve_path` is correctly implemented and used, it should not be
+    possible to modify files outside the sandboxed path
+    """
+
+    device_id = 0x1234 # ID of device containing file (stat.st_dev)
+    blocksize = 0x1000 # Size of block on this filesystem
+    f_type = 0xef53 # (Type of filesystem) EXT4_SUPER_MAGIC
+    nb_total_block = 0x1000
+    nb_free_block = 0x100
+    nb_avail_block = nb_free_block # Available to unprivileged user
+    nb_total_fnode = 100 # Total file nodes in filesystem
+    nb_free_fnode = 50
+    max_filename_len = 256
+    fragment_size = 0
+    mount_flags = 0
+
+    def __init__(self, base_path, linux_env):
+        self.base_path = base_path
+        self.linux_env = linux_env
+        self.passthrough = []
+        self.path_to_inode = {} # Real path (post-resolution) -> inode number
+
+    def resolve_path(self, path, follow_link=True):
+        """Resolve @path to the corresponding sandboxed path"""
+
+        # path_bytes is used for Python 2 / Python 3 compatibility
+        path_bytes = not isinstance(path, str)
+        path_sep = os.path.sep.encode() if path_bytes else os.path.sep
+
+        if path_bytes:
+            def _convert(subpath):
+                if not isinstance(subpath, str):
+                    return subpath
+                return subpath.encode()
+            def _convert_re(expr):
+                if isinstance(expr.pattern, str):
+                    try:
+                        return re.compile(
+                            expr.pattern.encode(),
+                            flags=expr.flags & ~re.UNICODE
+                        )
+                    except UnicodeEncodeError:
+                        # Will never match
+                        log.warning(
+                            'Cannot convert regexp to bytes %r %r',
+                            expr.pattern,
+                            expr.flags,
+                            exc_info=True,
+                        )
+                        return re.compile(b'$X')
+                return expr
+        else:
+            def _convert(subpath):
+                if not isinstance(subpath, str):
+                    return subpath.decode()
+                return subpath
+            def _convert_re(expr):
+                if not isinstance(expr.pattern, str):
+                    try:
+                        return re.compile(
+                            expr.pattern.decode(),
+                            flags=expr.flags & re.UNICODE
+                        )
+                    except UnicodeDecodeError:
+                        # Will never match
+                        log.warning(
+                            'Cannot convert regexp to str %r %r',
+                            expr.pattern,
+                            expr.flags,
+                            exc_info=True,
+                        )
+                        return re.compile(r'$X')
+                return expr
+
+        # Remove '../', etc.
+        path = os.path.normpath(path)
+
+        # Passthrough
+        for passthrough in self.passthrough:
+            if isinstance(passthrough, REGEXP_T):
+                if _convert_re(passthrough).match(path):
+                    return path
+            elif _convert(passthrough) == path:
+                return path
+
+        # Remove leading '/' if any
+        path = path.lstrip(path_sep)
+
+        base_path = os.path.abspath(_convert(self.base_path))
+        out_path = os.path.join(base_path, path)
+        assert out_path.startswith(base_path + path_sep)
+        if os.path.islink(out_path):
+            link_target = os.readlink(out_path)
+            # Link can be absolute or relative -> absolute
+            link = os.path.normpath(os.path.join(os.path.dirname(path), link_target))
+            if follow_link:
+                out_path = self.resolve_path(link)
+            else:
+                out_path = link
+        return out_path
+
+    def get_path_inode(self, real_path):
+        inode = self.path_to_inode.setdefault(real_path, len(self.path_to_inode))
+        return inode
+
+    def exists(self, path):
+        sb_path = self.resolve_path(path)
+        return os.path.exists(sb_path)
+
+    def readlink(self, path):
+        sb_path = self.resolve_path(path, follow_link=False)
+        if not os.path.islink(sb_path):
+            return None
+        return os.readlink(sb_path)
+
+    def statfs(self):
+        return StatFSInfo(
+            f_type=self.f_type, f_bsize=self.blocksize,
+            f_blocks=self.nb_total_block, f_bfree=self.nb_free_block,
+            f_bavail=self.nb_avail_block, f_files=self.nb_total_fnode,
+            f_ffree=self.nb_free_fnode, f_fsid=self.device_id,
+            f_namelen=self.max_filename_len,
+            f_frsize=self.fragment_size, f_flags=self.mount_flags, f_spare=0)
+
+    def getattr_(self, path, follow_link=True):
+        sb_path = self.resolve_path(path, follow_link=follow_link)
+        flags = self.linux_env.O_RDONLY
+        if os.path.isdir(sb_path):
+            flags |= self.linux_env.O_DIRECTORY
+
+        fd = self.open_(path, flags, follow_link=follow_link)
+        info = self.linux_env.fstat(fd)
+        self.linux_env.close(fd)
+        return info
+
+    def open_(self, path, flags, follow_link=True):
+        path = self.resolve_path(path, follow_link=follow_link)
+        if not os.path.exists(path):
+            # ENOENT (No such file or directory)
+            return -1
+        fd = self.linux_env.next_fd()
+        acc_mode = flags & self.linux_env.O_ACCMODE
+
+        if os.path.isdir(path):
+            assert flags & self.linux_env.O_DIRECTORY == self.linux_env.O_DIRECTORY
+            if acc_mode == self.linux_env.O_RDONLY:
+                fdesc = FileDescriptorDirectory(fd, flags, self, path)
+            else:
+                raise RuntimeError("Not implemented")
+        elif os.path.isfile(path):
+            if acc_mode == os.O_RDONLY:
+                # Read only
+                real_fd = os.open(path, os.O_RDONLY)
+            else:
+                raise RuntimeError("Not implemented")
+            fdesc = FileDescriptorRegularFile(fd, flags, self, real_fd)
+
+        elif os.path.islink(path):
+            raise RuntimeError("Not implemented")
+        else:
+            raise RuntimeError("Unknown file type for %r" % path)
+
+        self.linux_env.file_descriptors[fd] = fdesc
+        # Set stat info
+        fdesc.cont_device_id = self.device_id
+        fdesc.inode = self.get_path_inode(path)
+        fdesc.uid = self.linux_env.user_uid
+        fdesc.gid = self.linux_env.user_gid
+        size = os.path.getsize(path)
+        fdesc.size = size
+        fdesc.blksize = self.blocksize
+        fdesc.blocks = (size + ((512 - (size % 512)) % 512)) // 512
+        return fd
+
+
+class Networking(object):
+    """Network abstraction"""
+
+    def __init__(self, linux_env):
+        self.linux_env = linux_env
+
+    def socket(self, family, type_, protocol):
+        fd = self.linux_env.next_fd()
+        fdesc = FileDescriptorSocket(fd, family, type_, protocol)
+        self.linux_env.file_descriptors[fd] = fdesc
+        return fd
+
+
+class LinuxEnvironment(object):
+    """A LinuxEnvironment regroups information to simulate a Linux-like
+    environment"""
+
+    # To be overridden
+    platform_arch = None
+
+    # User information
+    user_uid = 1000
+    user_euid = 1000
+    user_gid = 1000
+    user_egid = 1000
+    user_name = b"user"
+
+    # Memory mapping information
+    brk_current = 0x74000000
+    mmap_current = 0x75000000
+
+    # System information
+    sys_sysname = b"Linux"
+    sys_nodename = b"user-pc"
+    sys_release = b"4.13.0-19-generic"
+    sys_version = b"#22-Ubuntu"
+    sys_machine = None
+
+    # Filesystem
+    filesystem_base = "file_sb"
+    file_descriptors = None
+
+    # Current process
+    process_tid = 1000
+    process_pid = 1000
+
+    # Syscall restrictions
+    ioctl_allowed = None # list of (fd, cmd), None value for wildcard
+    ioctl_disallowed = None # list of (fd, cmd), None value for wildcard
+
+    # Time
+    base_time = 1531900000
+
+    # Arch specific constant
+    O_ACCMODE = None
+    O_CLOEXEC = None
+    O_DIRECTORY = None
+    O_LARGEFILE = None
+    O_NONBLOCK = None
+    O_RDONLY = None
+
+    def __init__(self):
+        stdin = FileDescriptorSTDIN(0)
+        stdout = FileDescriptorSTDOUT(1)
+        stderr = FileDescriptorSTDERR(2)
+        for std in [stdin, stdout, stderr]:
+            std.uid = self.user_uid
+            std.gid = self.user_gid
+        self.file_descriptors = {
+            0: stdin,
+            1: stdout,
+            2: stderr,
+        }
+        self.ioctl_allowed = [
+            (0, termios.TCGETS),
+            (0, termios.TIOCGWINSZ),
+            (0, termios.TIOCSWINSZ),
+            (1, termios.TCGETS),
+            (1, termios.TIOCGWINSZ),
+            (1, termios.TIOCSWINSZ),
+        ]
+        self.ioctl_disallowed = [
+            (2, termios.TCGETS),
+            (0, termios.TCSETSW),
+        ]
+        self.filesystem = FileSystem(self.filesystem_base, self)
+        self.network = Networking(self)
+
+    def next_fd(self):
+        return len(self.file_descriptors)
+
+    def clock_gettime(self):
+        out = self.base_time
+        self.base_time += 1
+        return out
+
+    def open_(self, path, flags, follow_link=True):
+        """Stub for 'open' syscall"""
+        return self.filesystem.open_(path, flags, follow_link=follow_link)
+
+    def socket(self, family, type_, protocol):
+        """Stub for 'socket' syscall"""
+        return self.network.socket(family, type_, protocol)
+
+    def fstat(self, fd):
+        """Get file status through fd"""
+        fdesc = self.file_descriptors.get(fd)
+        if fdesc is None:
+            return None
+        return fdesc.stat()
+
+    def stat(self, path):
+        """Get file status through path"""
+        return self.filesystem.getattr_(path)
+
+    def lstat(self, path):
+        """Get file status through path (not following links)"""
+        return self.filesystem.getattr_(path, follow_link=False)
+
+    def close(self, fd):
+        """Stub for 'close' syscall"""
+        fdesc = self.file_descriptors.get(fd)
+        if fdesc is None:
+            return None
+        return fdesc.close()
+
+    def write(self, fd, data):
+        """Stub for 'write' syscall"""
+        fdesc = self.file_descriptors.get(fd)
+        if fdesc is None:
+            return None
+        fdesc.write(data)
+        return len(data)
+
+    def read(self, fd, count):
+        """Stub for 'read' syscall"""
+        fdesc = self.file_descriptors.get(fd)
+        if fdesc is None:
+            return None
+        return fdesc.read(count)
+
+    def getdents(self, fd, count, packing_callback):
+        """Stub for 'getdents' syscall
+
+        'getdents64' must be handled by caller (only the structure layout is
+        modified)
+
+        @fd: getdents' fd argument
+        @count: getdents' count argument
+        @packing_callback(cur_len, d_ino, d_type, name) -> entry
+        """
+        fdesc = self.file_descriptors[fd]
+        if not isinstance(fdesc, FileDescriptorDirectory):
+            raise RuntimeError("Not implemented")
+
+        out = b""
+        # fdesc.listdir continues from where it stopped
+        for name in fdesc.listdir():
+            d_ino = 1 # Not the real one
+            d_type = 0 # DT_UNKNOWN (getdents(2) "All applications must properly
+                       # handle a return of DT_UNKNOWN.")
+            entry = packing_callback(len(out), d_ino, d_type, name)
+
+            if len(out) + len(entry) > count:
+                # Report to a further call
+                fdesc.cur_listdir.append(name)
+                break
+            out = out + entry
+        return out
+
+    def ioctl(self, fd, cmd, arg):
+        """Stub for 'ioctl' syscall
+        Return the list of element to pack back depending on target ioctl
+        If the ioctl is disallowed, return False
+        """
+        allowed = False
+        disallowed = False
+        for test in [(fd, cmd), (None, cmd), (fd, None)]:
+            if test in self.ioctl_allowed:
+                allowed = True
+            if test in self.ioctl_disallowed:
+                disallowed = True
+
+        if allowed and disallowed:
+            raise ValueError("fd: %x, cmd: %x is allowed and disallowed" % (fd, cmd))
+
+        if allowed:
+            if cmd == termios.TCGETS:
+                return 0, 0, 0, 0
+            elif cmd == termios.TIOCGWINSZ:
+                # struct winsize
+                # {
+                #   unsigned short ws_row;	/* rows, in characters */
+                #   unsigned short ws_col;	/* columns, in characters */
+                #   unsigned short ws_xpixel;	/* horizontal size, pixels */
+                #   unsigned short ws_ypixel;	/* vertical size, pixels */
+                # };
+                return 1000, 360, 1000, 1000
+            elif cmd == termios.TIOCSWINSZ:
+                # Ignore it
+                return
+            else:
+                raise RuntimeError("Not implemented")
+
+        elif disallowed:
+            return False
+
+        else:
+            raise KeyError("Unknown ioctl fd:%x cmd:%x" % (fd, cmd))
+
+    def mmap(self, addr, len_, prot, flags, fd, off, vmmngr):
+        """Stub for 'mmap' syscall
+
+        'mmap2' must be implemented by calling this function with off * 4096
+        """
+        if addr == 0:
+            addr = self.mmap_current
+            self.mmap_current += (len_ + 0x1000) & ~0xfff
+
+        all_mem = vmmngr.get_all_memory()
+        mapped = interval(
+            [
+                (start, start + info["size"] - 1)
+                for start, info in viewitems(all_mem)
+            ]
+        )
+
+        MAP_FIXED = 0x10
+        if flags & MAP_FIXED:
+            # Alloc missing and override
+            missing = interval([(addr, addr + len_ - 1)]) - mapped
+            for start, stop in missing:
+                vmmngr.add_memory_page(
+                    start,
+                    PAGE_READ|PAGE_WRITE,
+                    b"\x00" * (stop - start + 1),
+                    "mmap allocated"
+                )
+        else:
+            # Find first candidate segment nearby addr
+            for start, stop in mapped:
+                if stop < addr:
+                    continue
+                rounded = (stop + 1 + 0x1000) & ~0xfff
+                if (interval([(rounded, rounded + len_)]) & mapped).empty:
+                    addr = rounded
+                    break
+            else:
+                assert (interval([(addr, addr + len_)]) & mapped).empty
+
+            vmmngr.add_memory_page(
+                addr,
+                PAGE_READ|PAGE_WRITE,
+                b"\x00" * len_,
+                "mmap allocated"
+            )
+
+        if fd == 0xffffffff:
+            MAP_ANONYMOUS = 0x20    # mman.h
+            # fd and offset are ignored if MAP_ANONYMOUS flag is present
+            if not(flags & MAP_ANONYMOUS) and off != 0:
+                raise RuntimeError("Not implemented")
+            data = b"\x00" * len_
+        else:
+            fdesc = self.file_descriptors[fd]
+            cur_pos = fdesc.tell()
+            fdesc.seek(off)
+            data = fdesc.read(len_)
+            fdesc.seek(cur_pos)
+
+        vmmngr.set_mem(addr, data)
+        return addr
+
+    def brk(self, addr, vmmngr):
+        """Stub for 'brk' syscall"""
+        if addr == 0:
+            addr = self.brk_current
+        else:
+            all_mem = vmmngr.get_all_memory()
+            mapped = interval(
+                [
+                    (start, start + info["size"] - 1)
+                    for start, info in viewitems(all_mem)
+                ]
+            )
+
+            # Alloc missing and override
+            missing = interval([(self.brk_current, addr)]) - mapped
+            for start, stop in missing:
+                vmmngr.add_memory_page(
+                    start,
+                    PAGE_READ|PAGE_WRITE,
+                    b"\x00" * (stop - start + 1),
+                    "BRK"
+                )
+
+            self.brk_current = addr
+        return addr
+
+
+class LinuxEnvironment_x86_32(LinuxEnvironment):
+    platform_arch = b"x86_32"
+    sys_machine = b"x86_32"
+
+    # TODO FIXME
+    ## O_ACCMODE = 0x3
+    ## O_CLOEXEC = 0x80000
+    ## O_DIRECTORY = 0x10000
+    ## O_LARGEFILE = 0x8000
+    ## O_NONBLOCK = 0x800
+    ## O_RDONLY = 0
+
+
+class LinuxEnvironment_x86_64(LinuxEnvironment):
+    platform_arch = b"x86_64"
+    sys_machine = b"x86_64"
+
+    O_ACCMODE = 0x3
+    O_CLOEXEC = 0x80000
+    O_DIRECTORY = 0x10000
+    O_LARGEFILE = 0x8000
+    O_NONBLOCK = 0x800
+    O_RDONLY = 0
+
+
+class LinuxEnvironment_arml(LinuxEnvironment):
+    platform_arch = b"arml"
+    sys_machine = b"arml"
+
+    O_ACCMODE = 0x3
+    O_CLOEXEC = 0x80000
+    O_DIRECTORY = 0x4000
+    O_LARGEFILE = 0x20000
+    O_NONBLOCK = 0x800
+    O_RDONLY = 0
+
+    # ARM specific
+    tls = 0
+    # get_tls: __kuser_helper_version >= 1
+    # cmpxchg: __kuser_helper_version >= 2
+    # memory_barrier: __kuser_helper_version >= 3
+    kuser_helper_version = 3
+
+
+class LinuxEnvironment_mips32b(LinuxEnvironment):
+    platform_arch = b"mips32b"
+    sys_machine = b"mips32b"
+
+
+class AuxVec(object):
+    """Auxiliary vector abstraction, filled with default values
+    (mainly based on https://lwn.net/Articles/519085)
+
+    # Standard usage
+    >>> auxv = AuxVec(elf_base_addr, cont_target.entry_point, linux_env)
+
+    # Enable AT_SECURE
+    >>> auxv = AuxVec(..., AuxVec.AT_SECURE=1)
+    # Modify AT_RANDOM
+    >>> auxv = AuxVec(..., AuxVec.AT_RANDOM="\x00"*0x10)
+
+    # Using AuxVec instance for stack preparation
+    # First, fill memory with vectors data
+    >>> for AT_number, data in auxv.data_to_map():
+            dest_ptr = ...
+            copy_to_dest(data, dest_ptr)
+            auxv.ptrs[AT_number] = dest_ptr
+    # Then, get the key: value (with value being sometime a pointer)
+    >>> for auxid, auxval in auxv.iteritems():
+            ...
+    """
+
+    AT_PHDR = 3
+    AT_PHNUM = 5
+    AT_PAGESZ = 6
+    AT_ENTRY = 9
+    AT_UID = 11
+    AT_EUID = 12
+    AT_GID = 13
+    AT_EGID = 14
+    AT_PLATFORM = 15
+    AT_HWCAP = 16
+    AT_SECURE = 23
+    AT_RANDOM = 25
+    AT_SYSINFO_EHDR = 33
+
+    def __init__(self, elf_phdr_vaddr, entry_point, linux_env, **kwargs):
+        """Instantiate an AuxVec, with required elements:
+        - elf_phdr_vaddr: virtual address of the ELF's PHDR in memory
+        - entry_point: virtual address of the ELF entry point
+        - linux_env: LinuxEnvironment instance, used to provides some of the
+          option values
+
+        Others options can be overridden by named arguments
+
+        """
+        self.info = {
+            self.AT_PHDR: elf_phdr_vaddr,
+            self.AT_PHNUM: 9,
+            self.AT_PAGESZ: 0x1000,
+            self.AT_ENTRY: entry_point,
+            self.AT_UID: linux_env.user_uid,
+            self.AT_EUID: linux_env.user_euid,
+            self.AT_GID: linux_env.user_gid,
+            self.AT_EGID: linux_env.user_egid,
+            self.AT_PLATFORM: linux_env.platform_arch,
+            self.AT_HWCAP: 0,
+            self.AT_SECURE: 0,
+            self.AT_RANDOM: b"\x00" * 0x10,
+            # vDSO is not mandatory
+            self.AT_SYSINFO_EHDR: None,
+        }
+        self.info.update(kwargs)
+        self.ptrs = {} # info key -> corresponding virtual address
+
+    def data_to_map(self):
+        """Iterator on (AT_number, data)
+        Once the data has been mapped, the corresponding ptr must be set in
+        'self.ptrs[AT_number]'
+        """
+        for AT_number in [self.AT_PLATFORM, self.AT_RANDOM]:
+            yield (AT_number, self.info[AT_number])
+
+    def iteritems(self):
+        """Iterator on auxiliary vector id and values"""
+        for AT_number, value in viewitems(self.info):
+            if AT_number in self.ptrs:
+                value = self.ptrs[AT_number]
+            if value is None:
+                # AT to ignore
+                continue
+            yield (AT_number, value)
+
+    items = iteritems
+
+def prepare_loader_x86_64(jitter, argv, envp, auxv, linux_env,
+                          hlt_address=0x13371acc):
+    """Fill the environment with enough information to run a linux loader
+
+    @jitter: Jitter instance
+    @argv: list of strings
+    @envp: dict of environment variables names to their values
+    @auxv: AuxVec instance
+    @hlt_address (default to 0x13371acc): stopping address
+
+    Example of use:
+    >>> jitter = machine.jitter()
+    >>> jitter.init_stack()
+    >>> linux_env = LinuxEnvironment_x86_64()
+    >>> argv = ["/bin/ls", "-lah"]
+    >>> envp = {"PATH": "/usr/local/bin", "USER": linux_env.user_name}
+    >>> auxv = AuxVec(elf_base_addr, entry_point, linux_env)
+    >>> prepare_loader_x86_64(jitter, argv, envp, auxv, linux_env)
+    # One may want to enable syscall handling here
+    # The program can now run from the loader
+    >>> jitter.init_run(ld_entry_point)
+    >>> jitter.continue_run()
+    """
+    # Stack layout looks like
+    # [data]
+    #  - auxv values
+    #  - envp name=value
+    #  - argv arguments
+    # [auxiliary vector]
+    # [environment pointer]
+    # [argument vector]
+
+    for AT_number, data in auxv.data_to_map():
+        data += b"\x00"
+        jitter.cpu.RSP -= len(data)
+        ptr = jitter.cpu.RSP
+        jitter.vm.set_mem(ptr, data)
+        auxv.ptrs[AT_number] = ptr
+
+    env_ptrs = []
+    for name, value in viewitems(envp):
+        env = b"%s=%s\x00" % (name, value)
+        jitter.cpu.RSP -= len(env)
+        ptr = jitter.cpu.RSP
+        jitter.vm.set_mem(ptr, env)
+        env_ptrs.append(ptr)
+
+    argv_ptrs = []
+    for arg in argv:
+        arg += b"\x00"
+        jitter.cpu.RSP -= len(arg)
+        ptr = jitter.cpu.RSP
+        jitter.vm.set_mem(ptr, arg)
+        argv_ptrs.append(ptr)
+
+    jitter.push_uint64_t(hlt_address)
+    jitter.push_uint64_t(0)
+    jitter.push_uint64_t(0)
+    for auxid, auxval in viewitems(auxv):
+        jitter.push_uint64_t(auxval)
+        jitter.push_uint64_t(auxid)
+    jitter.push_uint64_t(0)
+    for ptr in reversed(env_ptrs):
+        jitter.push_uint64_t(ptr)
+    jitter.push_uint64_t(0)
+    for ptr in reversed(argv_ptrs):
+        jitter.push_uint64_t(ptr)
+    jitter.push_uint64_t(len(argv))
+
+
+
+def _arml__kuser_get_tls(linux_env, jitter):
+    # __kuser_get_tls
+    jitter.pc = jitter.cpu.LR
+    jitter.cpu.R0 = linux_env.tls
+    return True
+
+def _arml__kuser_cmpxchg(jitter):
+    oldval = jitter.cpu.R0
+    newval = jitter.cpu.R1
+    ptr = jitter.cpu.R2
+
+    value = struct.unpack("<I", jitter.vm.get_mem(ptr, 4))[0]
+    if value == oldval:
+        jitter.vm.set_mem(ptr, struct.pack("<I", newval))
+        jitter.cpu.R0 = 0
+        jitter.cpu.cf = 1
+    else:
+        jitter.cpu.R0 = -1
+        jitter.cpu.cf = 0
+
+    jitter.pc = jitter.cpu.LR
+    return True
+
+def _arml__kuser_memory_barrier(jitter):
+    # __kuser_memory_barrier
+    jitter.pc = jitter.cpu.LR
+    return True
+
+def _arml__kuser_helper_version(linux_env, jitter):
+    jitter.pc = jitter.cpu.LR
+    jitter.cpu.R0 = linux_env.kuser_helper_version
+    return True
+
+
+def prepare_loader_arml(jitter, argv, envp, auxv, linux_env,
+                        hlt_address=0x13371acc):
+    """Fill the environment with enough information to run a linux loader
+
+    @jitter: Jitter instance
+    @argv: list of strings
+    @envp: dict of environment variables names to their values
+    @auxv: AuxVec instance
+    @hlt_address (default to 0x13371acc): stopping address
+
+    Example of use:
+    >>> jitter = machine.jitter()
+    >>> jitter.init_stack()
+    >>> linux_env = LinuxEnvironment_arml()
+    >>> argv = ["/bin/ls", "-lah"]
+    >>> envp = {"PATH": "/usr/local/bin", "USER": linux_env.user_name}
+    >>> auxv = AuxVec(elf_base_addr, entry_point, linux_env)
+    >>> prepare_loader_arml(jitter, argv, envp, auxv, linux_env)
+    # One may want to enable syscall handling here
+    # The program can now run from the loader
+    >>> jitter.init_run(ld_entry_point)
+    >>> jitter.continue_run()
+    """
+    # Stack layout looks like
+    # [data]
+    #  - auxv values
+    #  - envp name=value
+    #  - argv arguments
+    # [auxiliary vector]
+    # [environment pointer]
+    # [argument vector]
+
+    for AT_number, data in auxv.data_to_map():
+        data += b"\x00"
+        jitter.cpu.SP -= len(data)
+        ptr = jitter.cpu.SP
+        jitter.vm.set_mem(ptr, data)
+        auxv.ptrs[AT_number] = ptr
+
+    env_ptrs = []
+    for name, value in viewitems(envp):
+        env = b"%s=%s\x00" % (name, value)
+        jitter.cpu.SP -= len(env)
+        ptr = jitter.cpu.SP
+        jitter.vm.set_mem(ptr, env)
+        env_ptrs.append(ptr)
+
+    argv_ptrs = []
+    for arg in argv:
+        arg += b"\x00"
+        jitter.cpu.SP -= len(arg)
+        ptr = jitter.cpu.SP
+        jitter.vm.set_mem(ptr, arg)
+        argv_ptrs.append(ptr)
+
+    jitter.push_uint32_t(hlt_address)
+    jitter.push_uint32_t(0)
+    jitter.push_uint32_t(0)
+    for auxid, auxval in viewitems(auxv):
+        jitter.push_uint32_t(auxval)
+        jitter.push_uint32_t(auxid)
+    jitter.push_uint32_t(0)
+    for ptr in reversed(env_ptrs):
+        jitter.push_uint32_t(ptr)
+    jitter.push_uint32_t(0)
+    for ptr in reversed(argv_ptrs):
+        jitter.push_uint32_t(ptr)
+    jitter.push_uint32_t(len(argv))
+
+    # Add kernel user helpers
+    # from Documentation/arm/kernel_user_helpers.txt
+
+    if linux_env.kuser_helper_version >= 1:
+        jitter.add_breakpoint(
+            0xFFFF0FE0,
+            functools.partial(_arml__kuser_get_tls, linux_env)
+        )
+
+    if linux_env.kuser_helper_version >= 2:
+        jitter.add_breakpoint(0XFFFF0FC0, _arml__kuser_cmpxchg)
+
+    if linux_env.kuser_helper_version >= 3:
+        jitter.add_breakpoint(0xFFFF0FA0, _arml__kuser_memory_barrier)
+
+    jitter.add_breakpoint(0xffff0ffc, _arml__kuser_helper_version)