1*7c3d14c8STreehugger Robot //===-- interception_linux.cc -----------------------------------*- C++ -*-===//
2*7c3d14c8STreehugger Robot //
3*7c3d14c8STreehugger Robot // The LLVM Compiler Infrastructure
4*7c3d14c8STreehugger Robot //
5*7c3d14c8STreehugger Robot // This file is distributed under the University of Illinois Open Source
6*7c3d14c8STreehugger Robot // License. See LICENSE.TXT for details.
7*7c3d14c8STreehugger Robot //
8*7c3d14c8STreehugger Robot //===----------------------------------------------------------------------===//
9*7c3d14c8STreehugger Robot //
10*7c3d14c8STreehugger Robot // This file is a part of AddressSanitizer, an address sanity checker.
11*7c3d14c8STreehugger Robot //
12*7c3d14c8STreehugger Robot // Windows-specific interception methods.
13*7c3d14c8STreehugger Robot //
14*7c3d14c8STreehugger Robot // This file is implementing several hooking techniques to intercept calls
15*7c3d14c8STreehugger Robot // to functions. The hooks are dynamically installed by modifying the assembly
16*7c3d14c8STreehugger Robot // code.
17*7c3d14c8STreehugger Robot //
18*7c3d14c8STreehugger Robot // The hooking techniques are making assumptions on the way the code is
19*7c3d14c8STreehugger Robot // generated and are safe under these assumptions.
20*7c3d14c8STreehugger Robot //
21*7c3d14c8STreehugger Robot // On 64-bit architecture, there is no direct 64-bit jump instruction. To allow
22*7c3d14c8STreehugger Robot // arbitrary branching on the whole memory space, the notion of trampoline
23*7c3d14c8STreehugger Robot // region is used. A trampoline region is a memory space withing 2G boundary
24*7c3d14c8STreehugger Robot // where it is safe to add custom assembly code to build 64-bit jumps.
25*7c3d14c8STreehugger Robot //
26*7c3d14c8STreehugger Robot // Hooking techniques
27*7c3d14c8STreehugger Robot // ==================
28*7c3d14c8STreehugger Robot //
29*7c3d14c8STreehugger Robot // 1) Detour
30*7c3d14c8STreehugger Robot //
31*7c3d14c8STreehugger Robot // The Detour hooking technique is assuming the presence of an header with
32*7c3d14c8STreehugger Robot // padding and an overridable 2-bytes nop instruction (mov edi, edi). The
33*7c3d14c8STreehugger Robot // nop instruction can safely be replaced by a 2-bytes jump without any need
34*7c3d14c8STreehugger Robot // to save the instruction. A jump to the target is encoded in the function
35*7c3d14c8STreehugger Robot // header and the nop instruction is replaced by a short jump to the header.
36*7c3d14c8STreehugger Robot //
37*7c3d14c8STreehugger Robot // head: 5 x nop head: jmp <hook>
38*7c3d14c8STreehugger Robot // func: mov edi, edi --> func: jmp short <head>
39*7c3d14c8STreehugger Robot // [...] real: [...]
40*7c3d14c8STreehugger Robot //
41*7c3d14c8STreehugger Robot // This technique is only implemented on 32-bit architecture.
42*7c3d14c8STreehugger Robot // Most of the time, Windows API are hookable with the detour technique.
43*7c3d14c8STreehugger Robot //
44*7c3d14c8STreehugger Robot // 2) Redirect Jump
45*7c3d14c8STreehugger Robot //
46*7c3d14c8STreehugger Robot // The redirect jump is applicable when the first instruction is a direct
47*7c3d14c8STreehugger Robot // jump. The instruction is replaced by jump to the hook.
48*7c3d14c8STreehugger Robot //
49*7c3d14c8STreehugger Robot // func: jmp <label> --> func: jmp <hook>
50*7c3d14c8STreehugger Robot //
51*7c3d14c8STreehugger Robot // On an 64-bit architecture, a trampoline is inserted.
52*7c3d14c8STreehugger Robot //
53*7c3d14c8STreehugger Robot // func: jmp <label> --> func: jmp <tramp>
54*7c3d14c8STreehugger Robot // [...]
55*7c3d14c8STreehugger Robot //
56*7c3d14c8STreehugger Robot // [trampoline]
57*7c3d14c8STreehugger Robot // tramp: jmp QWORD [addr]
58*7c3d14c8STreehugger Robot // addr: .bytes <hook>
59*7c3d14c8STreehugger Robot //
60*7c3d14c8STreehugger Robot // Note: <real> is equilavent to <label>.
61*7c3d14c8STreehugger Robot //
62*7c3d14c8STreehugger Robot // 3) HotPatch
63*7c3d14c8STreehugger Robot //
64*7c3d14c8STreehugger Robot // The HotPatch hooking is assuming the presence of an header with padding
65*7c3d14c8STreehugger Robot // and a first instruction with at least 2-bytes.
66*7c3d14c8STreehugger Robot //
67*7c3d14c8STreehugger Robot // The reason to enforce the 2-bytes limitation is to provide the minimal
68*7c3d14c8STreehugger Robot // space to encode a short jump. HotPatch technique is only rewriting one
69*7c3d14c8STreehugger Robot // instruction to avoid breaking a sequence of instructions containing a
70*7c3d14c8STreehugger Robot // branching target.
71*7c3d14c8STreehugger Robot //
72*7c3d14c8STreehugger Robot // Assumptions are enforced by MSVC compiler by using the /HOTPATCH flag.
73*7c3d14c8STreehugger Robot // see: https://msdn.microsoft.com/en-us/library/ms173507.aspx
74*7c3d14c8STreehugger Robot // Default padding length is 5 bytes in 32-bits and 6 bytes in 64-bits.
75*7c3d14c8STreehugger Robot //
76*7c3d14c8STreehugger Robot // head: 5 x nop head: jmp <hook>
77*7c3d14c8STreehugger Robot // func: <instr> --> func: jmp short <head>
78*7c3d14c8STreehugger Robot // [...] body: [...]
79*7c3d14c8STreehugger Robot //
80*7c3d14c8STreehugger Robot // [trampoline]
81*7c3d14c8STreehugger Robot // real: <instr>
82*7c3d14c8STreehugger Robot // jmp <body>
83*7c3d14c8STreehugger Robot //
84*7c3d14c8STreehugger Robot // On an 64-bit architecture:
85*7c3d14c8STreehugger Robot //
86*7c3d14c8STreehugger Robot // head: 6 x nop head: jmp QWORD [addr1]
87*7c3d14c8STreehugger Robot // func: <instr> --> func: jmp short <head>
88*7c3d14c8STreehugger Robot // [...] body: [...]
89*7c3d14c8STreehugger Robot //
90*7c3d14c8STreehugger Robot // [trampoline]
91*7c3d14c8STreehugger Robot // addr1: .bytes <hook>
92*7c3d14c8STreehugger Robot // real: <instr>
93*7c3d14c8STreehugger Robot // jmp QWORD [addr2]
94*7c3d14c8STreehugger Robot // addr2: .bytes <body>
95*7c3d14c8STreehugger Robot //
96*7c3d14c8STreehugger Robot // 4) Trampoline
97*7c3d14c8STreehugger Robot //
98*7c3d14c8STreehugger Robot // The Trampoline hooking technique is the most aggressive one. It is
99*7c3d14c8STreehugger Robot // assuming that there is a sequence of instructions that can be safely
100*7c3d14c8STreehugger Robot // replaced by a jump (enough room and no incoming branches).
101*7c3d14c8STreehugger Robot //
102*7c3d14c8STreehugger Robot // Unfortunately, these assumptions can't be safely presumed and code may
103*7c3d14c8STreehugger Robot // be broken after hooking.
104*7c3d14c8STreehugger Robot //
105*7c3d14c8STreehugger Robot // func: <instr> --> func: jmp <hook>
106*7c3d14c8STreehugger Robot // <instr>
107*7c3d14c8STreehugger Robot // [...] body: [...]
108*7c3d14c8STreehugger Robot //
109*7c3d14c8STreehugger Robot // [trampoline]
110*7c3d14c8STreehugger Robot // real: <instr>
111*7c3d14c8STreehugger Robot // <instr>
112*7c3d14c8STreehugger Robot // jmp <body>
113*7c3d14c8STreehugger Robot //
114*7c3d14c8STreehugger Robot // On an 64-bit architecture:
115*7c3d14c8STreehugger Robot //
116*7c3d14c8STreehugger Robot // func: <instr> --> func: jmp QWORD [addr1]
117*7c3d14c8STreehugger Robot // <instr>
118*7c3d14c8STreehugger Robot // [...] body: [...]
119*7c3d14c8STreehugger Robot //
120*7c3d14c8STreehugger Robot // [trampoline]
121*7c3d14c8STreehugger Robot // addr1: .bytes <hook>
122*7c3d14c8STreehugger Robot // real: <instr>
123*7c3d14c8STreehugger Robot // <instr>
124*7c3d14c8STreehugger Robot // jmp QWORD [addr2]
125*7c3d14c8STreehugger Robot // addr2: .bytes <body>
126*7c3d14c8STreehugger Robot //===----------------------------------------------------------------------===//
127*7c3d14c8STreehugger Robot
128*7c3d14c8STreehugger Robot #ifdef _WIN32
129*7c3d14c8STreehugger Robot
130*7c3d14c8STreehugger Robot #include "interception.h"
131*7c3d14c8STreehugger Robot #include "sanitizer_common/sanitizer_platform.h"
132*7c3d14c8STreehugger Robot #define WIN32_LEAN_AND_MEAN
133*7c3d14c8STreehugger Robot #include <windows.h>
134*7c3d14c8STreehugger Robot
135*7c3d14c8STreehugger Robot namespace __interception {
136*7c3d14c8STreehugger Robot
137*7c3d14c8STreehugger Robot static const int kAddressLength = FIRST_32_SECOND_64(4, 8);
138*7c3d14c8STreehugger Robot static const int kJumpInstructionLength = 5;
139*7c3d14c8STreehugger Robot static const int kShortJumpInstructionLength = 2;
140*7c3d14c8STreehugger Robot static const int kIndirectJumpInstructionLength = 6;
141*7c3d14c8STreehugger Robot static const int kBranchLength =
142*7c3d14c8STreehugger Robot FIRST_32_SECOND_64(kJumpInstructionLength, kIndirectJumpInstructionLength);
143*7c3d14c8STreehugger Robot static const int kDirectBranchLength = kBranchLength + kAddressLength;
144*7c3d14c8STreehugger Robot
InterceptionFailed()145*7c3d14c8STreehugger Robot static void InterceptionFailed() {
146*7c3d14c8STreehugger Robot // Do we have a good way to abort with an error message here?
147*7c3d14c8STreehugger Robot __debugbreak();
148*7c3d14c8STreehugger Robot }
149*7c3d14c8STreehugger Robot
DistanceIsWithin2Gig(uptr from,uptr target)150*7c3d14c8STreehugger Robot static bool DistanceIsWithin2Gig(uptr from, uptr target) {
151*7c3d14c8STreehugger Robot if (from < target)
152*7c3d14c8STreehugger Robot return target - from <= (uptr)0x7FFFFFFFU;
153*7c3d14c8STreehugger Robot else
154*7c3d14c8STreehugger Robot return from - target <= (uptr)0x80000000U;
155*7c3d14c8STreehugger Robot }
156*7c3d14c8STreehugger Robot
GetMmapGranularity()157*7c3d14c8STreehugger Robot static uptr GetMmapGranularity() {
158*7c3d14c8STreehugger Robot SYSTEM_INFO si;
159*7c3d14c8STreehugger Robot GetSystemInfo(&si);
160*7c3d14c8STreehugger Robot return si.dwAllocationGranularity;
161*7c3d14c8STreehugger Robot }
162*7c3d14c8STreehugger Robot
RoundUpTo(uptr size,uptr boundary)163*7c3d14c8STreehugger Robot static uptr RoundUpTo(uptr size, uptr boundary) {
164*7c3d14c8STreehugger Robot return (size + boundary - 1) & ~(boundary - 1);
165*7c3d14c8STreehugger Robot }
166*7c3d14c8STreehugger Robot
167*7c3d14c8STreehugger Robot // FIXME: internal_str* and internal_mem* functions should be moved from the
168*7c3d14c8STreehugger Robot // ASan sources into interception/.
169*7c3d14c8STreehugger Robot
_memset(void * p,int value,size_t sz)170*7c3d14c8STreehugger Robot static void _memset(void *p, int value, size_t sz) {
171*7c3d14c8STreehugger Robot for (size_t i = 0; i < sz; ++i)
172*7c3d14c8STreehugger Robot ((char*)p)[i] = (char)value;
173*7c3d14c8STreehugger Robot }
174*7c3d14c8STreehugger Robot
_memcpy(void * dst,void * src,size_t sz)175*7c3d14c8STreehugger Robot static void _memcpy(void *dst, void *src, size_t sz) {
176*7c3d14c8STreehugger Robot char *dst_c = (char*)dst,
177*7c3d14c8STreehugger Robot *src_c = (char*)src;
178*7c3d14c8STreehugger Robot for (size_t i = 0; i < sz; ++i)
179*7c3d14c8STreehugger Robot dst_c[i] = src_c[i];
180*7c3d14c8STreehugger Robot }
181*7c3d14c8STreehugger Robot
ChangeMemoryProtection(uptr address,uptr size,DWORD * old_protection)182*7c3d14c8STreehugger Robot static bool ChangeMemoryProtection(
183*7c3d14c8STreehugger Robot uptr address, uptr size, DWORD *old_protection) {
184*7c3d14c8STreehugger Robot return ::VirtualProtect((void*)address, size,
185*7c3d14c8STreehugger Robot PAGE_EXECUTE_READWRITE,
186*7c3d14c8STreehugger Robot old_protection) != FALSE;
187*7c3d14c8STreehugger Robot }
188*7c3d14c8STreehugger Robot
RestoreMemoryProtection(uptr address,uptr size,DWORD old_protection)189*7c3d14c8STreehugger Robot static bool RestoreMemoryProtection(
190*7c3d14c8STreehugger Robot uptr address, uptr size, DWORD old_protection) {
191*7c3d14c8STreehugger Robot DWORD unused;
192*7c3d14c8STreehugger Robot return ::VirtualProtect((void*)address, size,
193*7c3d14c8STreehugger Robot old_protection,
194*7c3d14c8STreehugger Robot &unused) != FALSE;
195*7c3d14c8STreehugger Robot }
196*7c3d14c8STreehugger Robot
IsMemoryPadding(uptr address,uptr size)197*7c3d14c8STreehugger Robot static bool IsMemoryPadding(uptr address, uptr size) {
198*7c3d14c8STreehugger Robot u8* function = (u8*)address;
199*7c3d14c8STreehugger Robot for (size_t i = 0; i < size; ++i)
200*7c3d14c8STreehugger Robot if (function[i] != 0x90 && function[i] != 0xCC)
201*7c3d14c8STreehugger Robot return false;
202*7c3d14c8STreehugger Robot return true;
203*7c3d14c8STreehugger Robot }
204*7c3d14c8STreehugger Robot
205*7c3d14c8STreehugger Robot static const u8 kHintNop10Bytes[] = {
206*7c3d14c8STreehugger Robot 0x66, 0x66, 0x0F, 0x1F, 0x84,
207*7c3d14c8STreehugger Robot 0x00, 0x00, 0x00, 0x00, 0x00
208*7c3d14c8STreehugger Robot };
209*7c3d14c8STreehugger Robot
210*7c3d14c8STreehugger Robot template<class T>
FunctionHasPrefix(uptr address,const T & pattern)211*7c3d14c8STreehugger Robot static bool FunctionHasPrefix(uptr address, const T &pattern) {
212*7c3d14c8STreehugger Robot u8* function = (u8*)address - sizeof(pattern);
213*7c3d14c8STreehugger Robot for (size_t i = 0; i < sizeof(pattern); ++i)
214*7c3d14c8STreehugger Robot if (function[i] != pattern[i])
215*7c3d14c8STreehugger Robot return false;
216*7c3d14c8STreehugger Robot return true;
217*7c3d14c8STreehugger Robot }
218*7c3d14c8STreehugger Robot
FunctionHasPadding(uptr address,uptr size)219*7c3d14c8STreehugger Robot static bool FunctionHasPadding(uptr address, uptr size) {
220*7c3d14c8STreehugger Robot if (IsMemoryPadding(address - size, size))
221*7c3d14c8STreehugger Robot return true;
222*7c3d14c8STreehugger Robot if (size <= sizeof(kHintNop10Bytes) &&
223*7c3d14c8STreehugger Robot FunctionHasPrefix(address, kHintNop10Bytes))
224*7c3d14c8STreehugger Robot return true;
225*7c3d14c8STreehugger Robot return false;
226*7c3d14c8STreehugger Robot }
227*7c3d14c8STreehugger Robot
WritePadding(uptr from,uptr size)228*7c3d14c8STreehugger Robot static void WritePadding(uptr from, uptr size) {
229*7c3d14c8STreehugger Robot _memset((void*)from, 0xCC, (size_t)size);
230*7c3d14c8STreehugger Robot }
231*7c3d14c8STreehugger Robot
CopyInstructions(uptr from,uptr to,uptr size)232*7c3d14c8STreehugger Robot static void CopyInstructions(uptr from, uptr to, uptr size) {
233*7c3d14c8STreehugger Robot _memcpy((void*)from, (void*)to, (size_t)size);
234*7c3d14c8STreehugger Robot }
235*7c3d14c8STreehugger Robot
WriteJumpInstruction(uptr from,uptr target)236*7c3d14c8STreehugger Robot static void WriteJumpInstruction(uptr from, uptr target) {
237*7c3d14c8STreehugger Robot if (!DistanceIsWithin2Gig(from + kJumpInstructionLength, target))
238*7c3d14c8STreehugger Robot InterceptionFailed();
239*7c3d14c8STreehugger Robot ptrdiff_t offset = target - from - kJumpInstructionLength;
240*7c3d14c8STreehugger Robot *(u8*)from = 0xE9;
241*7c3d14c8STreehugger Robot *(u32*)(from + 1) = offset;
242*7c3d14c8STreehugger Robot }
243*7c3d14c8STreehugger Robot
WriteShortJumpInstruction(uptr from,uptr target)244*7c3d14c8STreehugger Robot static void WriteShortJumpInstruction(uptr from, uptr target) {
245*7c3d14c8STreehugger Robot sptr offset = target - from - kShortJumpInstructionLength;
246*7c3d14c8STreehugger Robot if (offset < -128 || offset > 127)
247*7c3d14c8STreehugger Robot InterceptionFailed();
248*7c3d14c8STreehugger Robot *(u8*)from = 0xEB;
249*7c3d14c8STreehugger Robot *(u8*)(from + 1) = (u8)offset;
250*7c3d14c8STreehugger Robot }
251*7c3d14c8STreehugger Robot
252*7c3d14c8STreehugger Robot #if SANITIZER_WINDOWS64
WriteIndirectJumpInstruction(uptr from,uptr indirect_target)253*7c3d14c8STreehugger Robot static void WriteIndirectJumpInstruction(uptr from, uptr indirect_target) {
254*7c3d14c8STreehugger Robot // jmp [rip + <offset>] = FF 25 <offset> where <offset> is a relative
255*7c3d14c8STreehugger Robot // offset.
256*7c3d14c8STreehugger Robot // The offset is the distance from then end of the jump instruction to the
257*7c3d14c8STreehugger Robot // memory location containing the targeted address. The displacement is still
258*7c3d14c8STreehugger Robot // 32-bit in x64, so indirect_target must be located within +/- 2GB range.
259*7c3d14c8STreehugger Robot int offset = indirect_target - from - kIndirectJumpInstructionLength;
260*7c3d14c8STreehugger Robot if (!DistanceIsWithin2Gig(from + kIndirectJumpInstructionLength,
261*7c3d14c8STreehugger Robot indirect_target)) {
262*7c3d14c8STreehugger Robot InterceptionFailed();
263*7c3d14c8STreehugger Robot }
264*7c3d14c8STreehugger Robot *(u16*)from = 0x25FF;
265*7c3d14c8STreehugger Robot *(u32*)(from + 2) = offset;
266*7c3d14c8STreehugger Robot }
267*7c3d14c8STreehugger Robot #endif
268*7c3d14c8STreehugger Robot
WriteBranch(uptr from,uptr indirect_target,uptr target)269*7c3d14c8STreehugger Robot static void WriteBranch(
270*7c3d14c8STreehugger Robot uptr from, uptr indirect_target, uptr target) {
271*7c3d14c8STreehugger Robot #if SANITIZER_WINDOWS64
272*7c3d14c8STreehugger Robot WriteIndirectJumpInstruction(from, indirect_target);
273*7c3d14c8STreehugger Robot *(u64*)indirect_target = target;
274*7c3d14c8STreehugger Robot #else
275*7c3d14c8STreehugger Robot (void)indirect_target;
276*7c3d14c8STreehugger Robot WriteJumpInstruction(from, target);
277*7c3d14c8STreehugger Robot #endif
278*7c3d14c8STreehugger Robot }
279*7c3d14c8STreehugger Robot
WriteDirectBranch(uptr from,uptr target)280*7c3d14c8STreehugger Robot static void WriteDirectBranch(uptr from, uptr target) {
281*7c3d14c8STreehugger Robot #if SANITIZER_WINDOWS64
282*7c3d14c8STreehugger Robot // Emit an indirect jump through immediately following bytes:
283*7c3d14c8STreehugger Robot // jmp [rip + kBranchLength]
284*7c3d14c8STreehugger Robot // .quad <target>
285*7c3d14c8STreehugger Robot WriteBranch(from, from + kBranchLength, target);
286*7c3d14c8STreehugger Robot #else
287*7c3d14c8STreehugger Robot WriteJumpInstruction(from, target);
288*7c3d14c8STreehugger Robot #endif
289*7c3d14c8STreehugger Robot }
290*7c3d14c8STreehugger Robot
291*7c3d14c8STreehugger Robot struct TrampolineMemoryRegion {
292*7c3d14c8STreehugger Robot uptr content;
293*7c3d14c8STreehugger Robot uptr allocated_size;
294*7c3d14c8STreehugger Robot uptr max_size;
295*7c3d14c8STreehugger Robot };
296*7c3d14c8STreehugger Robot
297*7c3d14c8STreehugger Robot static const uptr kTrampolineScanLimitRange = 1 << 30; // 1 gig
298*7c3d14c8STreehugger Robot static const int kMaxTrampolineRegion = 1024;
299*7c3d14c8STreehugger Robot static TrampolineMemoryRegion TrampolineRegions[kMaxTrampolineRegion];
300*7c3d14c8STreehugger Robot
AllocateTrampolineRegion(uptr image_address,size_t granularity)301*7c3d14c8STreehugger Robot static void *AllocateTrampolineRegion(uptr image_address, size_t granularity) {
302*7c3d14c8STreehugger Robot #if SANITIZER_WINDOWS64
303*7c3d14c8STreehugger Robot uptr address = image_address;
304*7c3d14c8STreehugger Robot uptr scanned = 0;
305*7c3d14c8STreehugger Robot while (scanned < kTrampolineScanLimitRange) {
306*7c3d14c8STreehugger Robot MEMORY_BASIC_INFORMATION info;
307*7c3d14c8STreehugger Robot if (!::VirtualQuery((void*)address, &info, sizeof(info)))
308*7c3d14c8STreehugger Robot return nullptr;
309*7c3d14c8STreehugger Robot
310*7c3d14c8STreehugger Robot // Check whether a region can be allocated at |address|.
311*7c3d14c8STreehugger Robot if (info.State == MEM_FREE && info.RegionSize >= granularity) {
312*7c3d14c8STreehugger Robot void *page = ::VirtualAlloc((void*)RoundUpTo(address, granularity),
313*7c3d14c8STreehugger Robot granularity,
314*7c3d14c8STreehugger Robot MEM_RESERVE | MEM_COMMIT,
315*7c3d14c8STreehugger Robot PAGE_EXECUTE_READWRITE);
316*7c3d14c8STreehugger Robot return page;
317*7c3d14c8STreehugger Robot }
318*7c3d14c8STreehugger Robot
319*7c3d14c8STreehugger Robot // Move to the next region.
320*7c3d14c8STreehugger Robot address = (uptr)info.BaseAddress + info.RegionSize;
321*7c3d14c8STreehugger Robot scanned += info.RegionSize;
322*7c3d14c8STreehugger Robot }
323*7c3d14c8STreehugger Robot return nullptr;
324*7c3d14c8STreehugger Robot #else
325*7c3d14c8STreehugger Robot return ::VirtualAlloc(nullptr,
326*7c3d14c8STreehugger Robot granularity,
327*7c3d14c8STreehugger Robot MEM_RESERVE | MEM_COMMIT,
328*7c3d14c8STreehugger Robot PAGE_EXECUTE_READWRITE);
329*7c3d14c8STreehugger Robot #endif
330*7c3d14c8STreehugger Robot }
331*7c3d14c8STreehugger Robot
332*7c3d14c8STreehugger Robot // Used by unittests to release mapped memory space.
TestOnlyReleaseTrampolineRegions()333*7c3d14c8STreehugger Robot void TestOnlyReleaseTrampolineRegions() {
334*7c3d14c8STreehugger Robot for (size_t bucket = 0; bucket < kMaxTrampolineRegion; ++bucket) {
335*7c3d14c8STreehugger Robot TrampolineMemoryRegion *current = &TrampolineRegions[bucket];
336*7c3d14c8STreehugger Robot if (current->content == 0)
337*7c3d14c8STreehugger Robot return;
338*7c3d14c8STreehugger Robot ::VirtualFree((void*)current->content, 0, MEM_RELEASE);
339*7c3d14c8STreehugger Robot current->content = 0;
340*7c3d14c8STreehugger Robot }
341*7c3d14c8STreehugger Robot }
342*7c3d14c8STreehugger Robot
AllocateMemoryForTrampoline(uptr image_address,size_t size)343*7c3d14c8STreehugger Robot static uptr AllocateMemoryForTrampoline(uptr image_address, size_t size) {
344*7c3d14c8STreehugger Robot // Find a region within 2G with enough space to allocate |size| bytes.
345*7c3d14c8STreehugger Robot TrampolineMemoryRegion *region = nullptr;
346*7c3d14c8STreehugger Robot for (size_t bucket = 0; bucket < kMaxTrampolineRegion; ++bucket) {
347*7c3d14c8STreehugger Robot TrampolineMemoryRegion* current = &TrampolineRegions[bucket];
348*7c3d14c8STreehugger Robot if (current->content == 0) {
349*7c3d14c8STreehugger Robot // No valid region found, allocate a new region.
350*7c3d14c8STreehugger Robot size_t bucket_size = GetMmapGranularity();
351*7c3d14c8STreehugger Robot void *content = AllocateTrampolineRegion(image_address, bucket_size);
352*7c3d14c8STreehugger Robot if (content == nullptr)
353*7c3d14c8STreehugger Robot return 0U;
354*7c3d14c8STreehugger Robot
355*7c3d14c8STreehugger Robot current->content = (uptr)content;
356*7c3d14c8STreehugger Robot current->allocated_size = 0;
357*7c3d14c8STreehugger Robot current->max_size = bucket_size;
358*7c3d14c8STreehugger Robot region = current;
359*7c3d14c8STreehugger Robot break;
360*7c3d14c8STreehugger Robot } else if (current->max_size - current->allocated_size > size) {
361*7c3d14c8STreehugger Robot #if SANITIZER_WINDOWS64
362*7c3d14c8STreehugger Robot // In 64-bits, the memory space must be allocated within 2G boundary.
363*7c3d14c8STreehugger Robot uptr next_address = current->content + current->allocated_size;
364*7c3d14c8STreehugger Robot if (next_address < image_address ||
365*7c3d14c8STreehugger Robot next_address - image_address >= 0x7FFF0000)
366*7c3d14c8STreehugger Robot continue;
367*7c3d14c8STreehugger Robot #endif
368*7c3d14c8STreehugger Robot // The space can be allocated in the current region.
369*7c3d14c8STreehugger Robot region = current;
370*7c3d14c8STreehugger Robot break;
371*7c3d14c8STreehugger Robot }
372*7c3d14c8STreehugger Robot }
373*7c3d14c8STreehugger Robot
374*7c3d14c8STreehugger Robot // Failed to find a region.
375*7c3d14c8STreehugger Robot if (region == nullptr)
376*7c3d14c8STreehugger Robot return 0U;
377*7c3d14c8STreehugger Robot
378*7c3d14c8STreehugger Robot // Allocate the space in the current region.
379*7c3d14c8STreehugger Robot uptr allocated_space = region->content + region->allocated_size;
380*7c3d14c8STreehugger Robot region->allocated_size += size;
381*7c3d14c8STreehugger Robot WritePadding(allocated_space, size);
382*7c3d14c8STreehugger Robot
383*7c3d14c8STreehugger Robot return allocated_space;
384*7c3d14c8STreehugger Robot }
385*7c3d14c8STreehugger Robot
386*7c3d14c8STreehugger Robot // Returns 0 on error.
GetInstructionSize(uptr address)387*7c3d14c8STreehugger Robot static size_t GetInstructionSize(uptr address) {
388*7c3d14c8STreehugger Robot switch (*(u8*)address) {
389*7c3d14c8STreehugger Robot case 0x90: // 90 : nop
390*7c3d14c8STreehugger Robot return 1;
391*7c3d14c8STreehugger Robot
392*7c3d14c8STreehugger Robot case 0x50: // push eax / rax
393*7c3d14c8STreehugger Robot case 0x51: // push ecx / rcx
394*7c3d14c8STreehugger Robot case 0x52: // push edx / rdx
395*7c3d14c8STreehugger Robot case 0x53: // push ebx / rbx
396*7c3d14c8STreehugger Robot case 0x54: // push esp / rsp
397*7c3d14c8STreehugger Robot case 0x55: // push ebp / rbp
398*7c3d14c8STreehugger Robot case 0x56: // push esi / rsi
399*7c3d14c8STreehugger Robot case 0x57: // push edi / rdi
400*7c3d14c8STreehugger Robot case 0x5D: // pop ebp / rbp
401*7c3d14c8STreehugger Robot return 1;
402*7c3d14c8STreehugger Robot
403*7c3d14c8STreehugger Robot case 0x6A: // 6A XX = push XX
404*7c3d14c8STreehugger Robot return 2;
405*7c3d14c8STreehugger Robot
406*7c3d14c8STreehugger Robot case 0xb8: // b8 XX XX XX XX : mov eax, XX XX XX XX
407*7c3d14c8STreehugger Robot case 0xB9: // b9 XX XX XX XX : mov ecx, XX XX XX XX
408*7c3d14c8STreehugger Robot case 0xA1: // A1 XX XX XX XX : mov eax, dword ptr ds:[XXXXXXXX]
409*7c3d14c8STreehugger Robot return 5;
410*7c3d14c8STreehugger Robot
411*7c3d14c8STreehugger Robot // Cannot overwrite control-instruction. Return 0 to indicate failure.
412*7c3d14c8STreehugger Robot case 0xE9: // E9 XX XX XX XX : jmp <label>
413*7c3d14c8STreehugger Robot case 0xE8: // E8 XX XX XX XX : call <func>
414*7c3d14c8STreehugger Robot case 0xC3: // C3 : ret
415*7c3d14c8STreehugger Robot case 0xEB: // EB XX : jmp XX (short jump)
416*7c3d14c8STreehugger Robot case 0x70: // 7Y YY : jy XX (short conditional jump)
417*7c3d14c8STreehugger Robot case 0x71:
418*7c3d14c8STreehugger Robot case 0x72:
419*7c3d14c8STreehugger Robot case 0x73:
420*7c3d14c8STreehugger Robot case 0x74:
421*7c3d14c8STreehugger Robot case 0x75:
422*7c3d14c8STreehugger Robot case 0x76:
423*7c3d14c8STreehugger Robot case 0x77:
424*7c3d14c8STreehugger Robot case 0x78:
425*7c3d14c8STreehugger Robot case 0x79:
426*7c3d14c8STreehugger Robot case 0x7A:
427*7c3d14c8STreehugger Robot case 0x7B:
428*7c3d14c8STreehugger Robot case 0x7C:
429*7c3d14c8STreehugger Robot case 0x7D:
430*7c3d14c8STreehugger Robot case 0x7E:
431*7c3d14c8STreehugger Robot case 0x7F:
432*7c3d14c8STreehugger Robot return 0;
433*7c3d14c8STreehugger Robot }
434*7c3d14c8STreehugger Robot
435*7c3d14c8STreehugger Robot switch (*(u16*)(address)) {
436*7c3d14c8STreehugger Robot case 0xFF8B: // 8B FF : mov edi, edi
437*7c3d14c8STreehugger Robot case 0xEC8B: // 8B EC : mov ebp, esp
438*7c3d14c8STreehugger Robot case 0xc889: // 89 C8 : mov eax, ecx
439*7c3d14c8STreehugger Robot case 0xC18B: // 8B C1 : mov eax, ecx
440*7c3d14c8STreehugger Robot case 0xC033: // 33 C0 : xor eax, eax
441*7c3d14c8STreehugger Robot case 0xC933: // 33 C9 : xor ecx, ecx
442*7c3d14c8STreehugger Robot case 0xD233: // 33 D2 : xor edx, edx
443*7c3d14c8STreehugger Robot return 2;
444*7c3d14c8STreehugger Robot
445*7c3d14c8STreehugger Robot // Cannot overwrite control-instruction. Return 0 to indicate failure.
446*7c3d14c8STreehugger Robot case 0x25FF: // FF 25 XX XX XX XX : jmp [XXXXXXXX]
447*7c3d14c8STreehugger Robot return 0;
448*7c3d14c8STreehugger Robot }
449*7c3d14c8STreehugger Robot
450*7c3d14c8STreehugger Robot #if SANITIZER_WINDOWS64
451*7c3d14c8STreehugger Robot switch (*(u16*)address) {
452*7c3d14c8STreehugger Robot case 0x5040: // push rax
453*7c3d14c8STreehugger Robot case 0x5140: // push rcx
454*7c3d14c8STreehugger Robot case 0x5240: // push rdx
455*7c3d14c8STreehugger Robot case 0x5340: // push rbx
456*7c3d14c8STreehugger Robot case 0x5440: // push rsp
457*7c3d14c8STreehugger Robot case 0x5540: // push rbp
458*7c3d14c8STreehugger Robot case 0x5640: // push rsi
459*7c3d14c8STreehugger Robot case 0x5740: // push rdi
460*7c3d14c8STreehugger Robot case 0x5441: // push r12
461*7c3d14c8STreehugger Robot case 0x5541: // push r13
462*7c3d14c8STreehugger Robot case 0x5641: // push r14
463*7c3d14c8STreehugger Robot case 0x5741: // push r15
464*7c3d14c8STreehugger Robot case 0x9066: // Two-byte NOP
465*7c3d14c8STreehugger Robot return 2;
466*7c3d14c8STreehugger Robot }
467*7c3d14c8STreehugger Robot
468*7c3d14c8STreehugger Robot switch (0x00FFFFFF & *(u32*)address) {
469*7c3d14c8STreehugger Robot case 0xe58948: // 48 8b c4 : mov rbp, rsp
470*7c3d14c8STreehugger Robot case 0xc18b48: // 48 8b c1 : mov rax, rcx
471*7c3d14c8STreehugger Robot case 0xc48b48: // 48 8b c4 : mov rax, rsp
472*7c3d14c8STreehugger Robot case 0xd9f748: // 48 f7 d9 : neg rcx
473*7c3d14c8STreehugger Robot case 0xd12b48: // 48 2b d1 : sub rdx, rcx
474*7c3d14c8STreehugger Robot case 0x07c1f6: // f6 c1 07 : test cl, 0x7
475*7c3d14c8STreehugger Robot case 0xc0854d: // 4d 85 c0 : test r8, r8
476*7c3d14c8STreehugger Robot case 0xc2b60f: // 0f b6 c2 : movzx eax, dl
477*7c3d14c8STreehugger Robot case 0xc03345: // 45 33 c0 : xor r8d, r8d
478*7c3d14c8STreehugger Robot case 0xd98b4c: // 4c 8b d9 : mov r11, rcx
479*7c3d14c8STreehugger Robot case 0xd28b4c: // 4c 8b d2 : mov r10, rdx
480*7c3d14c8STreehugger Robot case 0xd2b60f: // 0f b6 d2 : movzx edx, dl
481*7c3d14c8STreehugger Robot case 0xca2b48: // 48 2b ca : sub rcx, rdx
482*7c3d14c8STreehugger Robot case 0x10b70f: // 0f b7 10 : movzx edx, WORD PTR [rax]
483*7c3d14c8STreehugger Robot case 0xc00b4d: // 3d 0b c0 : or r8, r8
484*7c3d14c8STreehugger Robot case 0xd18b48: // 48 8b d1 : mov rdx, rcx
485*7c3d14c8STreehugger Robot case 0xdc8b4c: // 4c 8b dc : mov r11,rsp
486*7c3d14c8STreehugger Robot case 0xd18b4c: // 4c 8b d1 : mov r10, rcx
487*7c3d14c8STreehugger Robot return 3;
488*7c3d14c8STreehugger Robot
489*7c3d14c8STreehugger Robot case 0xec8348: // 48 83 ec XX : sub rsp, XX
490*7c3d14c8STreehugger Robot case 0xf88349: // 49 83 f8 XX : cmp r8, XX
491*7c3d14c8STreehugger Robot case 0x588948: // 48 89 58 XX : mov QWORD PTR[rax + XX], rbx
492*7c3d14c8STreehugger Robot return 4;
493*7c3d14c8STreehugger Robot
494*7c3d14c8STreehugger Robot case 0x058b48: // 48 8b 05 XX XX XX XX :
495*7c3d14c8STreehugger Robot // mov rax, QWORD PTR [rip + XXXXXXXX]
496*7c3d14c8STreehugger Robot case 0x25ff48: // 48 ff 25 XX XX XX XX :
497*7c3d14c8STreehugger Robot // rex.W jmp QWORD PTR [rip + XXXXXXXX]
498*7c3d14c8STreehugger Robot return 7;
499*7c3d14c8STreehugger Robot }
500*7c3d14c8STreehugger Robot
501*7c3d14c8STreehugger Robot switch (*(u32*)(address)) {
502*7c3d14c8STreehugger Robot case 0x24448b48: // 48 8b 44 24 XX : mov rax, qword ptr [rsp + XX]
503*7c3d14c8STreehugger Robot case 0x245c8948: // 48 89 5c 24 XX : mov QWORD PTR [rsp + XX], rbx
504*7c3d14c8STreehugger Robot case 0x24748948: // 48 89 74 24 XX : mov QWORD PTR [rsp + XX], rsi
505*7c3d14c8STreehugger Robot return 5;
506*7c3d14c8STreehugger Robot }
507*7c3d14c8STreehugger Robot
508*7c3d14c8STreehugger Robot #else
509*7c3d14c8STreehugger Robot
510*7c3d14c8STreehugger Robot switch (*(u16*)address) {
511*7c3d14c8STreehugger Robot case 0x458B: // 8B 45 XX : mov eax, dword ptr [ebp + XX]
512*7c3d14c8STreehugger Robot case 0x5D8B: // 8B 5D XX : mov ebx, dword ptr [ebp + XX]
513*7c3d14c8STreehugger Robot case 0x7D8B: // 8B 7D XX : mov edi, dword ptr [ebp + XX]
514*7c3d14c8STreehugger Robot case 0xEC83: // 83 EC XX : sub esp, XX
515*7c3d14c8STreehugger Robot case 0x75FF: // FF 75 XX : push dword ptr [ebp + XX]
516*7c3d14c8STreehugger Robot return 3;
517*7c3d14c8STreehugger Robot case 0xC1F7: // F7 C1 XX YY ZZ WW : test ecx, WWZZYYXX
518*7c3d14c8STreehugger Robot case 0x25FF: // FF 25 XX YY ZZ WW : jmp dword ptr ds:[WWZZYYXX]
519*7c3d14c8STreehugger Robot return 6;
520*7c3d14c8STreehugger Robot case 0x3D83: // 83 3D XX YY ZZ WW TT : cmp TT, WWZZYYXX
521*7c3d14c8STreehugger Robot return 7;
522*7c3d14c8STreehugger Robot case 0x7D83: // 83 7D XX YY : cmp dword ptr [ebp + XX], YY
523*7c3d14c8STreehugger Robot return 4;
524*7c3d14c8STreehugger Robot }
525*7c3d14c8STreehugger Robot
526*7c3d14c8STreehugger Robot switch (0x00FFFFFF & *(u32*)address) {
527*7c3d14c8STreehugger Robot case 0x24448A: // 8A 44 24 XX : mov eal, dword ptr [esp + XX]
528*7c3d14c8STreehugger Robot case 0x24448B: // 8B 44 24 XX : mov eax, dword ptr [esp + XX]
529*7c3d14c8STreehugger Robot case 0x244C8B: // 8B 4C 24 XX : mov ecx, dword ptr [esp + XX]
530*7c3d14c8STreehugger Robot case 0x24548B: // 8B 54 24 XX : mov edx, dword ptr [esp + XX]
531*7c3d14c8STreehugger Robot case 0x24748B: // 8B 74 24 XX : mov esi, dword ptr [esp + XX]
532*7c3d14c8STreehugger Robot case 0x247C8B: // 8B 7C 24 XX : mov edi, dword ptr [esp + XX]
533*7c3d14c8STreehugger Robot return 4;
534*7c3d14c8STreehugger Robot }
535*7c3d14c8STreehugger Robot
536*7c3d14c8STreehugger Robot switch (*(u32*)address) {
537*7c3d14c8STreehugger Robot case 0x2444B60F: // 0F B6 44 24 XX : movzx eax, byte ptr [esp + XX]
538*7c3d14c8STreehugger Robot return 5;
539*7c3d14c8STreehugger Robot }
540*7c3d14c8STreehugger Robot #endif
541*7c3d14c8STreehugger Robot
542*7c3d14c8STreehugger Robot // Unknown instruction!
543*7c3d14c8STreehugger Robot // FIXME: Unknown instruction failures might happen when we add a new
544*7c3d14c8STreehugger Robot // interceptor or a new compiler version. In either case, they should result
545*7c3d14c8STreehugger Robot // in visible and readable error messages. However, merely calling abort()
546*7c3d14c8STreehugger Robot // leads to an infinite recursion in CheckFailed.
547*7c3d14c8STreehugger Robot InterceptionFailed();
548*7c3d14c8STreehugger Robot return 0;
549*7c3d14c8STreehugger Robot }
550*7c3d14c8STreehugger Robot
551*7c3d14c8STreehugger Robot // Returns 0 on error.
RoundUpToInstrBoundary(size_t size,uptr address)552*7c3d14c8STreehugger Robot static size_t RoundUpToInstrBoundary(size_t size, uptr address) {
553*7c3d14c8STreehugger Robot size_t cursor = 0;
554*7c3d14c8STreehugger Robot while (cursor < size) {
555*7c3d14c8STreehugger Robot size_t instruction_size = GetInstructionSize(address + cursor);
556*7c3d14c8STreehugger Robot if (!instruction_size)
557*7c3d14c8STreehugger Robot return 0;
558*7c3d14c8STreehugger Robot cursor += instruction_size;
559*7c3d14c8STreehugger Robot }
560*7c3d14c8STreehugger Robot return cursor;
561*7c3d14c8STreehugger Robot }
562*7c3d14c8STreehugger Robot
563*7c3d14c8STreehugger Robot #if !SANITIZER_WINDOWS64
OverrideFunctionWithDetour(uptr old_func,uptr new_func,uptr * orig_old_func)564*7c3d14c8STreehugger Robot bool OverrideFunctionWithDetour(
565*7c3d14c8STreehugger Robot uptr old_func, uptr new_func, uptr *orig_old_func) {
566*7c3d14c8STreehugger Robot const int kDetourHeaderLen = 5;
567*7c3d14c8STreehugger Robot const u16 kDetourInstruction = 0xFF8B;
568*7c3d14c8STreehugger Robot
569*7c3d14c8STreehugger Robot uptr header = (uptr)old_func - kDetourHeaderLen;
570*7c3d14c8STreehugger Robot uptr patch_length = kDetourHeaderLen + kShortJumpInstructionLength;
571*7c3d14c8STreehugger Robot
572*7c3d14c8STreehugger Robot // Validate that the function is hookable.
573*7c3d14c8STreehugger Robot if (*(u16*)old_func != kDetourInstruction ||
574*7c3d14c8STreehugger Robot !IsMemoryPadding(header, kDetourHeaderLen))
575*7c3d14c8STreehugger Robot return false;
576*7c3d14c8STreehugger Robot
577*7c3d14c8STreehugger Robot // Change memory protection to writable.
578*7c3d14c8STreehugger Robot DWORD protection = 0;
579*7c3d14c8STreehugger Robot if (!ChangeMemoryProtection(header, patch_length, &protection))
580*7c3d14c8STreehugger Robot return false;
581*7c3d14c8STreehugger Robot
582*7c3d14c8STreehugger Robot // Write a relative jump to the redirected function.
583*7c3d14c8STreehugger Robot WriteJumpInstruction(header, new_func);
584*7c3d14c8STreehugger Robot
585*7c3d14c8STreehugger Robot // Write the short jump to the function prefix.
586*7c3d14c8STreehugger Robot WriteShortJumpInstruction(old_func, header);
587*7c3d14c8STreehugger Robot
588*7c3d14c8STreehugger Robot // Restore previous memory protection.
589*7c3d14c8STreehugger Robot if (!RestoreMemoryProtection(header, patch_length, protection))
590*7c3d14c8STreehugger Robot return false;
591*7c3d14c8STreehugger Robot
592*7c3d14c8STreehugger Robot if (orig_old_func)
593*7c3d14c8STreehugger Robot *orig_old_func = old_func + kShortJumpInstructionLength;
594*7c3d14c8STreehugger Robot
595*7c3d14c8STreehugger Robot return true;
596*7c3d14c8STreehugger Robot }
597*7c3d14c8STreehugger Robot #endif
598*7c3d14c8STreehugger Robot
OverrideFunctionWithRedirectJump(uptr old_func,uptr new_func,uptr * orig_old_func)599*7c3d14c8STreehugger Robot bool OverrideFunctionWithRedirectJump(
600*7c3d14c8STreehugger Robot uptr old_func, uptr new_func, uptr *orig_old_func) {
601*7c3d14c8STreehugger Robot // Check whether the first instruction is a relative jump.
602*7c3d14c8STreehugger Robot if (*(u8*)old_func != 0xE9)
603*7c3d14c8STreehugger Robot return false;
604*7c3d14c8STreehugger Robot
605*7c3d14c8STreehugger Robot if (orig_old_func) {
606*7c3d14c8STreehugger Robot uptr relative_offset = *(u32*)(old_func + 1);
607*7c3d14c8STreehugger Robot uptr absolute_target = old_func + relative_offset + kJumpInstructionLength;
608*7c3d14c8STreehugger Robot *orig_old_func = absolute_target;
609*7c3d14c8STreehugger Robot }
610*7c3d14c8STreehugger Robot
611*7c3d14c8STreehugger Robot #if SANITIZER_WINDOWS64
612*7c3d14c8STreehugger Robot // If needed, get memory space for a trampoline jump.
613*7c3d14c8STreehugger Robot uptr trampoline = AllocateMemoryForTrampoline(old_func, kDirectBranchLength);
614*7c3d14c8STreehugger Robot if (!trampoline)
615*7c3d14c8STreehugger Robot return false;
616*7c3d14c8STreehugger Robot WriteDirectBranch(trampoline, new_func);
617*7c3d14c8STreehugger Robot #endif
618*7c3d14c8STreehugger Robot
619*7c3d14c8STreehugger Robot // Change memory protection to writable.
620*7c3d14c8STreehugger Robot DWORD protection = 0;
621*7c3d14c8STreehugger Robot if (!ChangeMemoryProtection(old_func, kJumpInstructionLength, &protection))
622*7c3d14c8STreehugger Robot return false;
623*7c3d14c8STreehugger Robot
624*7c3d14c8STreehugger Robot // Write a relative jump to the redirected function.
625*7c3d14c8STreehugger Robot WriteJumpInstruction(old_func, FIRST_32_SECOND_64(new_func, trampoline));
626*7c3d14c8STreehugger Robot
627*7c3d14c8STreehugger Robot // Restore previous memory protection.
628*7c3d14c8STreehugger Robot if (!RestoreMemoryProtection(old_func, kJumpInstructionLength, protection))
629*7c3d14c8STreehugger Robot return false;
630*7c3d14c8STreehugger Robot
631*7c3d14c8STreehugger Robot return true;
632*7c3d14c8STreehugger Robot }
633*7c3d14c8STreehugger Robot
OverrideFunctionWithHotPatch(uptr old_func,uptr new_func,uptr * orig_old_func)634*7c3d14c8STreehugger Robot bool OverrideFunctionWithHotPatch(
635*7c3d14c8STreehugger Robot uptr old_func, uptr new_func, uptr *orig_old_func) {
636*7c3d14c8STreehugger Robot const int kHotPatchHeaderLen = kBranchLength;
637*7c3d14c8STreehugger Robot
638*7c3d14c8STreehugger Robot uptr header = (uptr)old_func - kHotPatchHeaderLen;
639*7c3d14c8STreehugger Robot uptr patch_length = kHotPatchHeaderLen + kShortJumpInstructionLength;
640*7c3d14c8STreehugger Robot
641*7c3d14c8STreehugger Robot // Validate that the function is hot patchable.
642*7c3d14c8STreehugger Robot size_t instruction_size = GetInstructionSize(old_func);
643*7c3d14c8STreehugger Robot if (instruction_size < kShortJumpInstructionLength ||
644*7c3d14c8STreehugger Robot !FunctionHasPadding(old_func, kHotPatchHeaderLen))
645*7c3d14c8STreehugger Robot return false;
646*7c3d14c8STreehugger Robot
647*7c3d14c8STreehugger Robot if (orig_old_func) {
648*7c3d14c8STreehugger Robot // Put the needed instructions into the trampoline bytes.
649*7c3d14c8STreehugger Robot uptr trampoline_length = instruction_size + kDirectBranchLength;
650*7c3d14c8STreehugger Robot uptr trampoline = AllocateMemoryForTrampoline(old_func, trampoline_length);
651*7c3d14c8STreehugger Robot if (!trampoline)
652*7c3d14c8STreehugger Robot return false;
653*7c3d14c8STreehugger Robot CopyInstructions(trampoline, old_func, instruction_size);
654*7c3d14c8STreehugger Robot WriteDirectBranch(trampoline + instruction_size,
655*7c3d14c8STreehugger Robot old_func + instruction_size);
656*7c3d14c8STreehugger Robot *orig_old_func = trampoline;
657*7c3d14c8STreehugger Robot }
658*7c3d14c8STreehugger Robot
659*7c3d14c8STreehugger Robot // If needed, get memory space for indirect address.
660*7c3d14c8STreehugger Robot uptr indirect_address = 0;
661*7c3d14c8STreehugger Robot #if SANITIZER_WINDOWS64
662*7c3d14c8STreehugger Robot indirect_address = AllocateMemoryForTrampoline(old_func, kAddressLength);
663*7c3d14c8STreehugger Robot if (!indirect_address)
664*7c3d14c8STreehugger Robot return false;
665*7c3d14c8STreehugger Robot #endif
666*7c3d14c8STreehugger Robot
667*7c3d14c8STreehugger Robot // Change memory protection to writable.
668*7c3d14c8STreehugger Robot DWORD protection = 0;
669*7c3d14c8STreehugger Robot if (!ChangeMemoryProtection(header, patch_length, &protection))
670*7c3d14c8STreehugger Robot return false;
671*7c3d14c8STreehugger Robot
672*7c3d14c8STreehugger Robot // Write jumps to the redirected function.
673*7c3d14c8STreehugger Robot WriteBranch(header, indirect_address, new_func);
674*7c3d14c8STreehugger Robot WriteShortJumpInstruction(old_func, header);
675*7c3d14c8STreehugger Robot
676*7c3d14c8STreehugger Robot // Restore previous memory protection.
677*7c3d14c8STreehugger Robot if (!RestoreMemoryProtection(header, patch_length, protection))
678*7c3d14c8STreehugger Robot return false;
679*7c3d14c8STreehugger Robot
680*7c3d14c8STreehugger Robot return true;
681*7c3d14c8STreehugger Robot }
682*7c3d14c8STreehugger Robot
OverrideFunctionWithTrampoline(uptr old_func,uptr new_func,uptr * orig_old_func)683*7c3d14c8STreehugger Robot bool OverrideFunctionWithTrampoline(
684*7c3d14c8STreehugger Robot uptr old_func, uptr new_func, uptr *orig_old_func) {
685*7c3d14c8STreehugger Robot
686*7c3d14c8STreehugger Robot size_t instructions_length = kBranchLength;
687*7c3d14c8STreehugger Robot size_t padding_length = 0;
688*7c3d14c8STreehugger Robot uptr indirect_address = 0;
689*7c3d14c8STreehugger Robot
690*7c3d14c8STreehugger Robot if (orig_old_func) {
691*7c3d14c8STreehugger Robot // Find out the number of bytes of the instructions we need to copy
692*7c3d14c8STreehugger Robot // to the trampoline.
693*7c3d14c8STreehugger Robot instructions_length = RoundUpToInstrBoundary(kBranchLength, old_func);
694*7c3d14c8STreehugger Robot if (!instructions_length)
695*7c3d14c8STreehugger Robot return false;
696*7c3d14c8STreehugger Robot
697*7c3d14c8STreehugger Robot // Put the needed instructions into the trampoline bytes.
698*7c3d14c8STreehugger Robot uptr trampoline_length = instructions_length + kDirectBranchLength;
699*7c3d14c8STreehugger Robot uptr trampoline = AllocateMemoryForTrampoline(old_func, trampoline_length);
700*7c3d14c8STreehugger Robot if (!trampoline)
701*7c3d14c8STreehugger Robot return false;
702*7c3d14c8STreehugger Robot CopyInstructions(trampoline, old_func, instructions_length);
703*7c3d14c8STreehugger Robot WriteDirectBranch(trampoline + instructions_length,
704*7c3d14c8STreehugger Robot old_func + instructions_length);
705*7c3d14c8STreehugger Robot *orig_old_func = trampoline;
706*7c3d14c8STreehugger Robot }
707*7c3d14c8STreehugger Robot
708*7c3d14c8STreehugger Robot #if SANITIZER_WINDOWS64
709*7c3d14c8STreehugger Robot // Check if the targeted address can be encoded in the function padding.
710*7c3d14c8STreehugger Robot // Otherwise, allocate it in the trampoline region.
711*7c3d14c8STreehugger Robot if (IsMemoryPadding(old_func - kAddressLength, kAddressLength)) {
712*7c3d14c8STreehugger Robot indirect_address = old_func - kAddressLength;
713*7c3d14c8STreehugger Robot padding_length = kAddressLength;
714*7c3d14c8STreehugger Robot } else {
715*7c3d14c8STreehugger Robot indirect_address = AllocateMemoryForTrampoline(old_func, kAddressLength);
716*7c3d14c8STreehugger Robot if (!indirect_address)
717*7c3d14c8STreehugger Robot return false;
718*7c3d14c8STreehugger Robot }
719*7c3d14c8STreehugger Robot #endif
720*7c3d14c8STreehugger Robot
721*7c3d14c8STreehugger Robot // Change memory protection to writable.
722*7c3d14c8STreehugger Robot uptr patch_address = old_func - padding_length;
723*7c3d14c8STreehugger Robot uptr patch_length = instructions_length + padding_length;
724*7c3d14c8STreehugger Robot DWORD protection = 0;
725*7c3d14c8STreehugger Robot if (!ChangeMemoryProtection(patch_address, patch_length, &protection))
726*7c3d14c8STreehugger Robot return false;
727*7c3d14c8STreehugger Robot
728*7c3d14c8STreehugger Robot // Patch the original function.
729*7c3d14c8STreehugger Robot WriteBranch(old_func, indirect_address, new_func);
730*7c3d14c8STreehugger Robot
731*7c3d14c8STreehugger Robot // Restore previous memory protection.
732*7c3d14c8STreehugger Robot if (!RestoreMemoryProtection(patch_address, patch_length, protection))
733*7c3d14c8STreehugger Robot return false;
734*7c3d14c8STreehugger Robot
735*7c3d14c8STreehugger Robot return true;
736*7c3d14c8STreehugger Robot }
737*7c3d14c8STreehugger Robot
OverrideFunction(uptr old_func,uptr new_func,uptr * orig_old_func)738*7c3d14c8STreehugger Robot bool OverrideFunction(
739*7c3d14c8STreehugger Robot uptr old_func, uptr new_func, uptr *orig_old_func) {
740*7c3d14c8STreehugger Robot #if !SANITIZER_WINDOWS64
741*7c3d14c8STreehugger Robot if (OverrideFunctionWithDetour(old_func, new_func, orig_old_func))
742*7c3d14c8STreehugger Robot return true;
743*7c3d14c8STreehugger Robot #endif
744*7c3d14c8STreehugger Robot if (OverrideFunctionWithRedirectJump(old_func, new_func, orig_old_func))
745*7c3d14c8STreehugger Robot return true;
746*7c3d14c8STreehugger Robot if (OverrideFunctionWithHotPatch(old_func, new_func, orig_old_func))
747*7c3d14c8STreehugger Robot return true;
748*7c3d14c8STreehugger Robot if (OverrideFunctionWithTrampoline(old_func, new_func, orig_old_func))
749*7c3d14c8STreehugger Robot return true;
750*7c3d14c8STreehugger Robot return false;
751*7c3d14c8STreehugger Robot }
752*7c3d14c8STreehugger Robot
InterestingDLLsAvailable()753*7c3d14c8STreehugger Robot static void **InterestingDLLsAvailable() {
754*7c3d14c8STreehugger Robot static const char *InterestingDLLs[] = {
755*7c3d14c8STreehugger Robot "kernel32.dll",
756*7c3d14c8STreehugger Robot "msvcr110.dll", // VS2012
757*7c3d14c8STreehugger Robot "msvcr120.dll", // VS2013
758*7c3d14c8STreehugger Robot "vcruntime140.dll", // VS2015
759*7c3d14c8STreehugger Robot "ucrtbase.dll", // Universal CRT
760*7c3d14c8STreehugger Robot // NTDLL should go last as it exports some functions that we should
761*7c3d14c8STreehugger Robot // override in the CRT [presumably only used internally].
762*7c3d14c8STreehugger Robot "ntdll.dll", NULL};
763*7c3d14c8STreehugger Robot static void *result[ARRAY_SIZE(InterestingDLLs)] = { 0 };
764*7c3d14c8STreehugger Robot if (!result[0]) {
765*7c3d14c8STreehugger Robot for (size_t i = 0, j = 0; InterestingDLLs[i]; ++i) {
766*7c3d14c8STreehugger Robot if (HMODULE h = GetModuleHandleA(InterestingDLLs[i]))
767*7c3d14c8STreehugger Robot result[j++] = (void *)h;
768*7c3d14c8STreehugger Robot }
769*7c3d14c8STreehugger Robot }
770*7c3d14c8STreehugger Robot return &result[0];
771*7c3d14c8STreehugger Robot }
772*7c3d14c8STreehugger Robot
773*7c3d14c8STreehugger Robot namespace {
774*7c3d14c8STreehugger Robot // Utility for reading loaded PE images.
775*7c3d14c8STreehugger Robot template <typename T> class RVAPtr {
776*7c3d14c8STreehugger Robot public:
RVAPtr(void * module,uptr rva)777*7c3d14c8STreehugger Robot RVAPtr(void *module, uptr rva)
778*7c3d14c8STreehugger Robot : ptr_(reinterpret_cast<T *>(reinterpret_cast<char *>(module) + rva)) {}
operator T*()779*7c3d14c8STreehugger Robot operator T *() { return ptr_; }
operator ->()780*7c3d14c8STreehugger Robot T *operator->() { return ptr_; }
operator ++()781*7c3d14c8STreehugger Robot T *operator++() { return ++ptr_; }
782*7c3d14c8STreehugger Robot
783*7c3d14c8STreehugger Robot private:
784*7c3d14c8STreehugger Robot T *ptr_;
785*7c3d14c8STreehugger Robot };
786*7c3d14c8STreehugger Robot } // namespace
787*7c3d14c8STreehugger Robot
788*7c3d14c8STreehugger Robot // Internal implementation of GetProcAddress. At least since Windows 8,
789*7c3d14c8STreehugger Robot // GetProcAddress appears to initialize DLLs before returning function pointers
790*7c3d14c8STreehugger Robot // into them. This is problematic for the sanitizers, because they typically
791*7c3d14c8STreehugger Robot // want to intercept malloc *before* MSVCRT initializes. Our internal
792*7c3d14c8STreehugger Robot // implementation walks the export list manually without doing initialization.
InternalGetProcAddress(void * module,const char * func_name)793*7c3d14c8STreehugger Robot uptr InternalGetProcAddress(void *module, const char *func_name) {
794*7c3d14c8STreehugger Robot // Check that the module header is full and present.
795*7c3d14c8STreehugger Robot RVAPtr<IMAGE_DOS_HEADER> dos_stub(module, 0);
796*7c3d14c8STreehugger Robot RVAPtr<IMAGE_NT_HEADERS> headers(module, dos_stub->e_lfanew);
797*7c3d14c8STreehugger Robot if (!module || dos_stub->e_magic != IMAGE_DOS_SIGNATURE || // "MZ"
798*7c3d14c8STreehugger Robot headers->Signature != IMAGE_NT_SIGNATURE || // "PE\0\0"
799*7c3d14c8STreehugger Robot headers->FileHeader.SizeOfOptionalHeader <
800*7c3d14c8STreehugger Robot sizeof(IMAGE_OPTIONAL_HEADER)) {
801*7c3d14c8STreehugger Robot return 0;
802*7c3d14c8STreehugger Robot }
803*7c3d14c8STreehugger Robot
804*7c3d14c8STreehugger Robot IMAGE_DATA_DIRECTORY *export_directory =
805*7c3d14c8STreehugger Robot &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
806*7c3d14c8STreehugger Robot RVAPtr<IMAGE_EXPORT_DIRECTORY> exports(module,
807*7c3d14c8STreehugger Robot export_directory->VirtualAddress);
808*7c3d14c8STreehugger Robot RVAPtr<DWORD> functions(module, exports->AddressOfFunctions);
809*7c3d14c8STreehugger Robot RVAPtr<DWORD> names(module, exports->AddressOfNames);
810*7c3d14c8STreehugger Robot RVAPtr<WORD> ordinals(module, exports->AddressOfNameOrdinals);
811*7c3d14c8STreehugger Robot
812*7c3d14c8STreehugger Robot for (DWORD i = 0; i < exports->NumberOfNames; i++) {
813*7c3d14c8STreehugger Robot RVAPtr<char> name(module, names[i]);
814*7c3d14c8STreehugger Robot if (!strcmp(func_name, name)) {
815*7c3d14c8STreehugger Robot DWORD index = ordinals[i];
816*7c3d14c8STreehugger Robot RVAPtr<char> func(module, functions[index]);
817*7c3d14c8STreehugger Robot return (uptr)(char *)func;
818*7c3d14c8STreehugger Robot }
819*7c3d14c8STreehugger Robot }
820*7c3d14c8STreehugger Robot
821*7c3d14c8STreehugger Robot return 0;
822*7c3d14c8STreehugger Robot }
823*7c3d14c8STreehugger Robot
GetFunctionAddressInDLLs(const char * func_name,uptr * func_addr)824*7c3d14c8STreehugger Robot static bool GetFunctionAddressInDLLs(const char *func_name, uptr *func_addr) {
825*7c3d14c8STreehugger Robot *func_addr = 0;
826*7c3d14c8STreehugger Robot void **DLLs = InterestingDLLsAvailable();
827*7c3d14c8STreehugger Robot for (size_t i = 0; *func_addr == 0 && DLLs[i]; ++i)
828*7c3d14c8STreehugger Robot *func_addr = InternalGetProcAddress(DLLs[i], func_name);
829*7c3d14c8STreehugger Robot return (*func_addr != 0);
830*7c3d14c8STreehugger Robot }
831*7c3d14c8STreehugger Robot
OverrideFunction(const char * name,uptr new_func,uptr * orig_old_func)832*7c3d14c8STreehugger Robot bool OverrideFunction(const char *name, uptr new_func, uptr *orig_old_func) {
833*7c3d14c8STreehugger Robot uptr orig_func;
834*7c3d14c8STreehugger Robot if (!GetFunctionAddressInDLLs(name, &orig_func))
835*7c3d14c8STreehugger Robot return false;
836*7c3d14c8STreehugger Robot return OverrideFunction(orig_func, new_func, orig_old_func);
837*7c3d14c8STreehugger Robot }
838*7c3d14c8STreehugger Robot
OverrideImportedFunction(const char * module_to_patch,const char * imported_module,const char * function_name,uptr new_function,uptr * orig_old_func)839*7c3d14c8STreehugger Robot bool OverrideImportedFunction(const char *module_to_patch,
840*7c3d14c8STreehugger Robot const char *imported_module,
841*7c3d14c8STreehugger Robot const char *function_name, uptr new_function,
842*7c3d14c8STreehugger Robot uptr *orig_old_func) {
843*7c3d14c8STreehugger Robot HMODULE module = GetModuleHandleA(module_to_patch);
844*7c3d14c8STreehugger Robot if (!module)
845*7c3d14c8STreehugger Robot return false;
846*7c3d14c8STreehugger Robot
847*7c3d14c8STreehugger Robot // Check that the module header is full and present.
848*7c3d14c8STreehugger Robot RVAPtr<IMAGE_DOS_HEADER> dos_stub(module, 0);
849*7c3d14c8STreehugger Robot RVAPtr<IMAGE_NT_HEADERS> headers(module, dos_stub->e_lfanew);
850*7c3d14c8STreehugger Robot if (!module || dos_stub->e_magic != IMAGE_DOS_SIGNATURE || // "MZ"
851*7c3d14c8STreehugger Robot headers->Signature != IMAGE_NT_SIGNATURE || // "PE\0\0"
852*7c3d14c8STreehugger Robot headers->FileHeader.SizeOfOptionalHeader <
853*7c3d14c8STreehugger Robot sizeof(IMAGE_OPTIONAL_HEADER)) {
854*7c3d14c8STreehugger Robot return false;
855*7c3d14c8STreehugger Robot }
856*7c3d14c8STreehugger Robot
857*7c3d14c8STreehugger Robot IMAGE_DATA_DIRECTORY *import_directory =
858*7c3d14c8STreehugger Robot &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
859*7c3d14c8STreehugger Robot
860*7c3d14c8STreehugger Robot // Iterate the list of imported DLLs. FirstThunk will be null for the last
861*7c3d14c8STreehugger Robot // entry.
862*7c3d14c8STreehugger Robot RVAPtr<IMAGE_IMPORT_DESCRIPTOR> imports(module,
863*7c3d14c8STreehugger Robot import_directory->VirtualAddress);
864*7c3d14c8STreehugger Robot for (; imports->FirstThunk != 0; ++imports) {
865*7c3d14c8STreehugger Robot RVAPtr<const char> modname(module, imports->Name);
866*7c3d14c8STreehugger Robot if (_stricmp(&*modname, imported_module) == 0)
867*7c3d14c8STreehugger Robot break;
868*7c3d14c8STreehugger Robot }
869*7c3d14c8STreehugger Robot if (imports->FirstThunk == 0)
870*7c3d14c8STreehugger Robot return false;
871*7c3d14c8STreehugger Robot
872*7c3d14c8STreehugger Robot // We have two parallel arrays: the import address table (IAT) and the table
873*7c3d14c8STreehugger Robot // of names. They start out containing the same data, but the loader rewrites
874*7c3d14c8STreehugger Robot // the IAT to hold imported addresses and leaves the name table in
875*7c3d14c8STreehugger Robot // OriginalFirstThunk alone.
876*7c3d14c8STreehugger Robot RVAPtr<IMAGE_THUNK_DATA> name_table(module, imports->OriginalFirstThunk);
877*7c3d14c8STreehugger Robot RVAPtr<IMAGE_THUNK_DATA> iat(module, imports->FirstThunk);
878*7c3d14c8STreehugger Robot for (; name_table->u1.Ordinal != 0; ++name_table, ++iat) {
879*7c3d14c8STreehugger Robot if (!IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) {
880*7c3d14c8STreehugger Robot RVAPtr<IMAGE_IMPORT_BY_NAME> import_by_name(
881*7c3d14c8STreehugger Robot module, name_table->u1.ForwarderString);
882*7c3d14c8STreehugger Robot const char *funcname = &import_by_name->Name[0];
883*7c3d14c8STreehugger Robot if (strcmp(funcname, function_name) == 0)
884*7c3d14c8STreehugger Robot break;
885*7c3d14c8STreehugger Robot }
886*7c3d14c8STreehugger Robot }
887*7c3d14c8STreehugger Robot if (name_table->u1.Ordinal == 0)
888*7c3d14c8STreehugger Robot return false;
889*7c3d14c8STreehugger Robot
890*7c3d14c8STreehugger Robot // Now we have the correct IAT entry. Do the swap. We have to make the page
891*7c3d14c8STreehugger Robot // read/write first.
892*7c3d14c8STreehugger Robot if (orig_old_func)
893*7c3d14c8STreehugger Robot *orig_old_func = iat->u1.AddressOfData;
894*7c3d14c8STreehugger Robot DWORD old_prot, unused_prot;
895*7c3d14c8STreehugger Robot if (!VirtualProtect(&iat->u1.AddressOfData, 4, PAGE_EXECUTE_READWRITE,
896*7c3d14c8STreehugger Robot &old_prot))
897*7c3d14c8STreehugger Robot return false;
898*7c3d14c8STreehugger Robot iat->u1.AddressOfData = new_function;
899*7c3d14c8STreehugger Robot if (!VirtualProtect(&iat->u1.AddressOfData, 4, old_prot, &unused_prot))
900*7c3d14c8STreehugger Robot return false; // Not clear if this failure bothers us.
901*7c3d14c8STreehugger Robot return true;
902*7c3d14c8STreehugger Robot }
903*7c3d14c8STreehugger Robot
904*7c3d14c8STreehugger Robot } // namespace __interception
905*7c3d14c8STreehugger Robot
906*7c3d14c8STreehugger Robot #endif // _WIN32
907