1ebbce04cSNico Weber //===-- interception_linux.cpp ----------------------------------*- C++ -*-===//
2ebbce04cSNico Weber //
3ebbce04cSNico Weber // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4ebbce04cSNico Weber // See https://llvm.org/LICENSE.txt for license information.
5ebbce04cSNico Weber // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6ebbce04cSNico Weber //
7ebbce04cSNico Weber //===----------------------------------------------------------------------===//
8ebbce04cSNico Weber //
9ebbce04cSNico Weber // This file is a part of AddressSanitizer, an address sanity checker.
10ebbce04cSNico Weber //
11ebbce04cSNico Weber // Windows-specific interception methods.
12ebbce04cSNico Weber //
13ebbce04cSNico Weber // This file is implementing several hooking techniques to intercept calls
14ebbce04cSNico Weber // to functions. The hooks are dynamically installed by modifying the assembly
15ebbce04cSNico Weber // code.
16ebbce04cSNico Weber //
17ebbce04cSNico Weber // The hooking techniques are making assumptions on the way the code is
18ebbce04cSNico Weber // generated and are safe under these assumptions.
19ebbce04cSNico Weber //
20ebbce04cSNico Weber // On 64-bit architecture, there is no direct 64-bit jump instruction. To allow
21ebbce04cSNico Weber // arbitrary branching on the whole memory space, the notion of trampoline
22ebbce04cSNico Weber // region is used. A trampoline region is a memory space withing 2G boundary
23ebbce04cSNico Weber // where it is safe to add custom assembly code to build 64-bit jumps.
24ebbce04cSNico Weber //
25ebbce04cSNico Weber // Hooking techniques
26ebbce04cSNico Weber // ==================
27ebbce04cSNico Weber //
28ebbce04cSNico Weber // 1) Detour
29ebbce04cSNico Weber //
30ebbce04cSNico Weber // The Detour hooking technique is assuming the presence of an header with
31ebbce04cSNico Weber // padding and an overridable 2-bytes nop instruction (mov edi, edi). The
32ebbce04cSNico Weber // nop instruction can safely be replaced by a 2-bytes jump without any need
33ebbce04cSNico Weber // to save the instruction. A jump to the target is encoded in the function
34ebbce04cSNico Weber // header and the nop instruction is replaced by a short jump to the header.
35ebbce04cSNico Weber //
36ebbce04cSNico Weber // head: 5 x nop head: jmp <hook>
37ebbce04cSNico Weber // func: mov edi, edi --> func: jmp short <head>
38ebbce04cSNico Weber // [...] real: [...]
39ebbce04cSNico Weber //
40ebbce04cSNico Weber // This technique is only implemented on 32-bit architecture.
41ebbce04cSNico Weber // Most of the time, Windows API are hookable with the detour technique.
42ebbce04cSNico Weber //
43ebbce04cSNico Weber // 2) Redirect Jump
44ebbce04cSNico Weber //
45ebbce04cSNico Weber // The redirect jump is applicable when the first instruction is a direct
46ebbce04cSNico Weber // jump. The instruction is replaced by jump to the hook.
47ebbce04cSNico Weber //
48ebbce04cSNico Weber // func: jmp <label> --> func: jmp <hook>
49ebbce04cSNico Weber //
50ebbce04cSNico Weber // On an 64-bit architecture, a trampoline is inserted.
51ebbce04cSNico Weber //
52ebbce04cSNico Weber // func: jmp <label> --> func: jmp <tramp>
53ebbce04cSNico Weber // [...]
54ebbce04cSNico Weber //
55ebbce04cSNico Weber // [trampoline]
56ebbce04cSNico Weber // tramp: jmp QWORD [addr]
57ebbce04cSNico Weber // addr: .bytes <hook>
58ebbce04cSNico Weber //
59a1e7e401SKazuaki Ishizaki // Note: <real> is equivalent to <label>.
60ebbce04cSNico Weber //
61ebbce04cSNico Weber // 3) HotPatch
62ebbce04cSNico Weber //
63ebbce04cSNico Weber // The HotPatch hooking is assuming the presence of an header with padding
64ebbce04cSNico Weber // and a first instruction with at least 2-bytes.
65ebbce04cSNico Weber //
66ebbce04cSNico Weber // The reason to enforce the 2-bytes limitation is to provide the minimal
67ebbce04cSNico Weber // space to encode a short jump. HotPatch technique is only rewriting one
68ebbce04cSNico Weber // instruction to avoid breaking a sequence of instructions containing a
69ebbce04cSNico Weber // branching target.
70ebbce04cSNico Weber //
71ebbce04cSNico Weber // Assumptions are enforced by MSVC compiler by using the /HOTPATCH flag.
72ebbce04cSNico Weber // see: https://msdn.microsoft.com/en-us/library/ms173507.aspx
73ebbce04cSNico Weber // Default padding length is 5 bytes in 32-bits and 6 bytes in 64-bits.
74ebbce04cSNico Weber //
75ebbce04cSNico Weber // head: 5 x nop head: jmp <hook>
76ebbce04cSNico Weber // func: <instr> --> func: jmp short <head>
77ebbce04cSNico Weber // [...] body: [...]
78ebbce04cSNico Weber //
79ebbce04cSNico Weber // [trampoline]
80ebbce04cSNico Weber // real: <instr>
81ebbce04cSNico Weber // jmp <body>
82ebbce04cSNico Weber //
83ebbce04cSNico Weber // On an 64-bit architecture:
84ebbce04cSNico Weber //
85ebbce04cSNico Weber // head: 6 x nop head: jmp QWORD [addr1]
86ebbce04cSNico Weber // func: <instr> --> func: jmp short <head>
87ebbce04cSNico Weber // [...] body: [...]
88ebbce04cSNico Weber //
89ebbce04cSNico Weber // [trampoline]
90ebbce04cSNico Weber // addr1: .bytes <hook>
91ebbce04cSNico Weber // real: <instr>
92ebbce04cSNico Weber // jmp QWORD [addr2]
93ebbce04cSNico Weber // addr2: .bytes <body>
94ebbce04cSNico Weber //
95ebbce04cSNico Weber // 4) Trampoline
96ebbce04cSNico Weber //
97ebbce04cSNico Weber // The Trampoline hooking technique is the most aggressive one. It is
98ebbce04cSNico Weber // assuming that there is a sequence of instructions that can be safely
99ebbce04cSNico Weber // replaced by a jump (enough room and no incoming branches).
100ebbce04cSNico Weber //
101ebbce04cSNico Weber // Unfortunately, these assumptions can't be safely presumed and code may
102ebbce04cSNico Weber // be broken after hooking.
103ebbce04cSNico Weber //
104ebbce04cSNico Weber // func: <instr> --> func: jmp <hook>
105ebbce04cSNico Weber // <instr>
106ebbce04cSNico Weber // [...] body: [...]
107ebbce04cSNico Weber //
108ebbce04cSNico Weber // [trampoline]
109ebbce04cSNico Weber // real: <instr>
110ebbce04cSNico Weber // <instr>
111ebbce04cSNico Weber // jmp <body>
112ebbce04cSNico Weber //
113ebbce04cSNico Weber // On an 64-bit architecture:
114ebbce04cSNico Weber //
115ebbce04cSNico Weber // func: <instr> --> func: jmp QWORD [addr1]
116ebbce04cSNico Weber // <instr>
117ebbce04cSNico Weber // [...] body: [...]
118ebbce04cSNico Weber //
119ebbce04cSNico Weber // [trampoline]
120ebbce04cSNico Weber // addr1: .bytes <hook>
121ebbce04cSNico Weber // real: <instr>
122ebbce04cSNico Weber // <instr>
123ebbce04cSNico Weber // jmp QWORD [addr2]
124ebbce04cSNico Weber // addr2: .bytes <body>
125ebbce04cSNico Weber //===----------------------------------------------------------------------===//
126ebbce04cSNico Weber
127ebbce04cSNico Weber #include "interception.h"
128ebbce04cSNico Weber
129ebbce04cSNico Weber #if SANITIZER_WINDOWS
130ebbce04cSNico Weber #include "sanitizer_common/sanitizer_platform.h"
131ebbce04cSNico Weber #define WIN32_LEAN_AND_MEAN
132ebbce04cSNico Weber #include <windows.h>
133ebbce04cSNico Weber
134ebbce04cSNico Weber namespace __interception {
135ebbce04cSNico Weber
136ebbce04cSNico Weber static const int kAddressLength = FIRST_32_SECOND_64(4, 8);
137ebbce04cSNico Weber static const int kJumpInstructionLength = 5;
138ebbce04cSNico Weber static const int kShortJumpInstructionLength = 2;
139979c38ccSMartin Storsjö UNUSED static const int kIndirectJumpInstructionLength = 6;
140ebbce04cSNico Weber static const int kBranchLength =
141ebbce04cSNico Weber FIRST_32_SECOND_64(kJumpInstructionLength, kIndirectJumpInstructionLength);
142ebbce04cSNico Weber static const int kDirectBranchLength = kBranchLength + kAddressLength;
143ebbce04cSNico Weber
InterceptionFailed()144ebbce04cSNico Weber static void InterceptionFailed() {
145ebbce04cSNico Weber // Do we have a good way to abort with an error message here?
146ebbce04cSNico Weber __debugbreak();
147ebbce04cSNico Weber }
148ebbce04cSNico Weber
DistanceIsWithin2Gig(uptr from,uptr target)149ebbce04cSNico Weber static bool DistanceIsWithin2Gig(uptr from, uptr target) {
150ebbce04cSNico Weber #if SANITIZER_WINDOWS64
151ebbce04cSNico Weber if (from < target)
152ebbce04cSNico Weber return target - from <= (uptr)0x7FFFFFFFU;
153ebbce04cSNico Weber else
154ebbce04cSNico Weber return from - target <= (uptr)0x80000000U;
155ebbce04cSNico Weber #else
156ebbce04cSNico Weber // In a 32-bit address space, the address calculation will wrap, so this check
157ebbce04cSNico Weber // is unnecessary.
158ebbce04cSNico Weber return true;
159ebbce04cSNico Weber #endif
160ebbce04cSNico Weber }
161ebbce04cSNico Weber
GetMmapGranularity()162ebbce04cSNico Weber static uptr GetMmapGranularity() {
163ebbce04cSNico Weber SYSTEM_INFO si;
164ebbce04cSNico Weber GetSystemInfo(&si);
165ebbce04cSNico Weber return si.dwAllocationGranularity;
166ebbce04cSNico Weber }
167ebbce04cSNico Weber
RoundUpTo(uptr size,uptr boundary)168979c38ccSMartin Storsjö UNUSED static uptr RoundUpTo(uptr size, uptr boundary) {
169ebbce04cSNico Weber return (size + boundary - 1) & ~(boundary - 1);
170ebbce04cSNico Weber }
171ebbce04cSNico Weber
172ebbce04cSNico Weber // FIXME: internal_str* and internal_mem* functions should be moved from the
173ebbce04cSNico Weber // ASan sources into interception/.
174ebbce04cSNico Weber
_strlen(const char * str)175ebbce04cSNico Weber static size_t _strlen(const char *str) {
176ebbce04cSNico Weber const char* p = str;
177ebbce04cSNico Weber while (*p != '\0') ++p;
178ebbce04cSNico Weber return p - str;
179ebbce04cSNico Weber }
180ebbce04cSNico Weber
_strchr(char * str,char c)181ebbce04cSNico Weber static char* _strchr(char* str, char c) {
182ebbce04cSNico Weber while (*str) {
183ebbce04cSNico Weber if (*str == c)
184ebbce04cSNico Weber return str;
185ebbce04cSNico Weber ++str;
186ebbce04cSNico Weber }
187ebbce04cSNico Weber return nullptr;
188ebbce04cSNico Weber }
189ebbce04cSNico Weber
_memset(void * p,int value,size_t sz)190ebbce04cSNico Weber static void _memset(void *p, int value, size_t sz) {
191ebbce04cSNico Weber for (size_t i = 0; i < sz; ++i)
192ebbce04cSNico Weber ((char*)p)[i] = (char)value;
193ebbce04cSNico Weber }
194ebbce04cSNico Weber
_memcpy(void * dst,void * src,size_t sz)195ebbce04cSNico Weber static void _memcpy(void *dst, void *src, size_t sz) {
196ebbce04cSNico Weber char *dst_c = (char*)dst,
197ebbce04cSNico Weber *src_c = (char*)src;
198ebbce04cSNico Weber for (size_t i = 0; i < sz; ++i)
199ebbce04cSNico Weber dst_c[i] = src_c[i];
200ebbce04cSNico Weber }
201ebbce04cSNico Weber
ChangeMemoryProtection(uptr address,uptr size,DWORD * old_protection)202ebbce04cSNico Weber static bool ChangeMemoryProtection(
203ebbce04cSNico Weber uptr address, uptr size, DWORD *old_protection) {
204ebbce04cSNico Weber return ::VirtualProtect((void*)address, size,
205ebbce04cSNico Weber PAGE_EXECUTE_READWRITE,
206ebbce04cSNico Weber old_protection) != FALSE;
207ebbce04cSNico Weber }
208ebbce04cSNico Weber
RestoreMemoryProtection(uptr address,uptr size,DWORD old_protection)209ebbce04cSNico Weber static bool RestoreMemoryProtection(
210ebbce04cSNico Weber uptr address, uptr size, DWORD old_protection) {
211ebbce04cSNico Weber DWORD unused;
212ebbce04cSNico Weber return ::VirtualProtect((void*)address, size,
213ebbce04cSNico Weber old_protection,
214ebbce04cSNico Weber &unused) != FALSE;
215ebbce04cSNico Weber }
216ebbce04cSNico Weber
IsMemoryPadding(uptr address,uptr size)217ebbce04cSNico Weber static bool IsMemoryPadding(uptr address, uptr size) {
218ebbce04cSNico Weber u8* function = (u8*)address;
219ebbce04cSNico Weber for (size_t i = 0; i < size; ++i)
220ebbce04cSNico Weber if (function[i] != 0x90 && function[i] != 0xCC)
221ebbce04cSNico Weber return false;
222ebbce04cSNico Weber return true;
223ebbce04cSNico Weber }
224ebbce04cSNico Weber
225ebbce04cSNico Weber static const u8 kHintNop8Bytes[] = {
226ebbce04cSNico Weber 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00
227ebbce04cSNico Weber };
228ebbce04cSNico Weber
229ebbce04cSNico Weber template<class T>
FunctionHasPrefix(uptr address,const T & pattern)230ebbce04cSNico Weber static bool FunctionHasPrefix(uptr address, const T &pattern) {
231ebbce04cSNico Weber u8* function = (u8*)address - sizeof(pattern);
232ebbce04cSNico Weber for (size_t i = 0; i < sizeof(pattern); ++i)
233ebbce04cSNico Weber if (function[i] != pattern[i])
234ebbce04cSNico Weber return false;
235ebbce04cSNico Weber return true;
236ebbce04cSNico Weber }
237ebbce04cSNico Weber
FunctionHasPadding(uptr address,uptr size)238ebbce04cSNico Weber static bool FunctionHasPadding(uptr address, uptr size) {
239ebbce04cSNico Weber if (IsMemoryPadding(address - size, size))
240ebbce04cSNico Weber return true;
241ebbce04cSNico Weber if (size <= sizeof(kHintNop8Bytes) &&
242ebbce04cSNico Weber FunctionHasPrefix(address, kHintNop8Bytes))
243ebbce04cSNico Weber return true;
244ebbce04cSNico Weber return false;
245ebbce04cSNico Weber }
246ebbce04cSNico Weber
WritePadding(uptr from,uptr size)247ebbce04cSNico Weber static void WritePadding(uptr from, uptr size) {
248ebbce04cSNico Weber _memset((void*)from, 0xCC, (size_t)size);
249ebbce04cSNico Weber }
250ebbce04cSNico Weber
WriteJumpInstruction(uptr from,uptr target)251ebbce04cSNico Weber static void WriteJumpInstruction(uptr from, uptr target) {
252ebbce04cSNico Weber if (!DistanceIsWithin2Gig(from + kJumpInstructionLength, target))
253ebbce04cSNico Weber InterceptionFailed();
254ebbce04cSNico Weber ptrdiff_t offset = target - from - kJumpInstructionLength;
255ebbce04cSNico Weber *(u8*)from = 0xE9;
256ebbce04cSNico Weber *(u32*)(from + 1) = offset;
257ebbce04cSNico Weber }
258ebbce04cSNico Weber
WriteShortJumpInstruction(uptr from,uptr target)259ebbce04cSNico Weber static void WriteShortJumpInstruction(uptr from, uptr target) {
260ebbce04cSNico Weber sptr offset = target - from - kShortJumpInstructionLength;
261ebbce04cSNico Weber if (offset < -128 || offset > 127)
262ebbce04cSNico Weber InterceptionFailed();
263ebbce04cSNico Weber *(u8*)from = 0xEB;
264ebbce04cSNico Weber *(u8*)(from + 1) = (u8)offset;
265ebbce04cSNico Weber }
266ebbce04cSNico Weber
267ebbce04cSNico Weber #if SANITIZER_WINDOWS64
WriteIndirectJumpInstruction(uptr from,uptr indirect_target)268ebbce04cSNico Weber static void WriteIndirectJumpInstruction(uptr from, uptr indirect_target) {
269ebbce04cSNico Weber // jmp [rip + <offset>] = FF 25 <offset> where <offset> is a relative
270ebbce04cSNico Weber // offset.
271ebbce04cSNico Weber // The offset is the distance from then end of the jump instruction to the
272ebbce04cSNico Weber // memory location containing the targeted address. The displacement is still
273ebbce04cSNico Weber // 32-bit in x64, so indirect_target must be located within +/- 2GB range.
274ebbce04cSNico Weber int offset = indirect_target - from - kIndirectJumpInstructionLength;
275ebbce04cSNico Weber if (!DistanceIsWithin2Gig(from + kIndirectJumpInstructionLength,
276ebbce04cSNico Weber indirect_target)) {
277ebbce04cSNico Weber InterceptionFailed();
278ebbce04cSNico Weber }
279ebbce04cSNico Weber *(u16*)from = 0x25FF;
280ebbce04cSNico Weber *(u32*)(from + 2) = offset;
281ebbce04cSNico Weber }
282ebbce04cSNico Weber #endif
283ebbce04cSNico Weber
WriteBranch(uptr from,uptr indirect_target,uptr target)284ebbce04cSNico Weber static void WriteBranch(
285ebbce04cSNico Weber uptr from, uptr indirect_target, uptr target) {
286ebbce04cSNico Weber #if SANITIZER_WINDOWS64
287ebbce04cSNico Weber WriteIndirectJumpInstruction(from, indirect_target);
288ebbce04cSNico Weber *(u64*)indirect_target = target;
289ebbce04cSNico Weber #else
290ebbce04cSNico Weber (void)indirect_target;
291ebbce04cSNico Weber WriteJumpInstruction(from, target);
292ebbce04cSNico Weber #endif
293ebbce04cSNico Weber }
294ebbce04cSNico Weber
WriteDirectBranch(uptr from,uptr target)295ebbce04cSNico Weber static void WriteDirectBranch(uptr from, uptr target) {
296ebbce04cSNico Weber #if SANITIZER_WINDOWS64
297ebbce04cSNico Weber // Emit an indirect jump through immediately following bytes:
298ebbce04cSNico Weber // jmp [rip + kBranchLength]
299ebbce04cSNico Weber // .quad <target>
300ebbce04cSNico Weber WriteBranch(from, from + kBranchLength, target);
301ebbce04cSNico Weber #else
302ebbce04cSNico Weber WriteJumpInstruction(from, target);
303ebbce04cSNico Weber #endif
304ebbce04cSNico Weber }
305ebbce04cSNico Weber
306ebbce04cSNico Weber struct TrampolineMemoryRegion {
307ebbce04cSNico Weber uptr content;
308ebbce04cSNico Weber uptr allocated_size;
309ebbce04cSNico Weber uptr max_size;
310ebbce04cSNico Weber };
311ebbce04cSNico Weber
312979c38ccSMartin Storsjö UNUSED static const uptr kTrampolineScanLimitRange = 1 << 31; // 2 gig
313ebbce04cSNico Weber static const int kMaxTrampolineRegion = 1024;
314ebbce04cSNico Weber static TrampolineMemoryRegion TrampolineRegions[kMaxTrampolineRegion];
315ebbce04cSNico Weber
AllocateTrampolineRegion(uptr image_address,size_t granularity)316ebbce04cSNico Weber static void *AllocateTrampolineRegion(uptr image_address, size_t granularity) {
317ebbce04cSNico Weber #if SANITIZER_WINDOWS64
318ebbce04cSNico Weber uptr address = image_address;
319ebbce04cSNico Weber uptr scanned = 0;
320ebbce04cSNico Weber while (scanned < kTrampolineScanLimitRange) {
321ebbce04cSNico Weber MEMORY_BASIC_INFORMATION info;
322ebbce04cSNico Weber if (!::VirtualQuery((void*)address, &info, sizeof(info)))
323ebbce04cSNico Weber return nullptr;
324ebbce04cSNico Weber
325ebbce04cSNico Weber // Check whether a region can be allocated at |address|.
326ebbce04cSNico Weber if (info.State == MEM_FREE && info.RegionSize >= granularity) {
327ebbce04cSNico Weber void *page = ::VirtualAlloc((void*)RoundUpTo(address, granularity),
328ebbce04cSNico Weber granularity,
329ebbce04cSNico Weber MEM_RESERVE | MEM_COMMIT,
330ebbce04cSNico Weber PAGE_EXECUTE_READWRITE);
331ebbce04cSNico Weber return page;
332ebbce04cSNico Weber }
333ebbce04cSNico Weber
334ebbce04cSNico Weber // Move to the next region.
335ebbce04cSNico Weber address = (uptr)info.BaseAddress + info.RegionSize;
336ebbce04cSNico Weber scanned += info.RegionSize;
337ebbce04cSNico Weber }
338ebbce04cSNico Weber return nullptr;
339ebbce04cSNico Weber #else
340ebbce04cSNico Weber return ::VirtualAlloc(nullptr,
341ebbce04cSNico Weber granularity,
342ebbce04cSNico Weber MEM_RESERVE | MEM_COMMIT,
343ebbce04cSNico Weber PAGE_EXECUTE_READWRITE);
344ebbce04cSNico Weber #endif
345ebbce04cSNico Weber }
346ebbce04cSNico Weber
347ebbce04cSNico Weber // Used by unittests to release mapped memory space.
TestOnlyReleaseTrampolineRegions()348ebbce04cSNico Weber void TestOnlyReleaseTrampolineRegions() {
349ebbce04cSNico Weber for (size_t bucket = 0; bucket < kMaxTrampolineRegion; ++bucket) {
350ebbce04cSNico Weber TrampolineMemoryRegion *current = &TrampolineRegions[bucket];
351ebbce04cSNico Weber if (current->content == 0)
352ebbce04cSNico Weber return;
353ebbce04cSNico Weber ::VirtualFree((void*)current->content, 0, MEM_RELEASE);
354ebbce04cSNico Weber current->content = 0;
355ebbce04cSNico Weber }
356ebbce04cSNico Weber }
357ebbce04cSNico Weber
AllocateMemoryForTrampoline(uptr image_address,size_t size)358ebbce04cSNico Weber static uptr AllocateMemoryForTrampoline(uptr image_address, size_t size) {
359ebbce04cSNico Weber // Find a region within 2G with enough space to allocate |size| bytes.
360ebbce04cSNico Weber TrampolineMemoryRegion *region = nullptr;
361ebbce04cSNico Weber for (size_t bucket = 0; bucket < kMaxTrampolineRegion; ++bucket) {
362ebbce04cSNico Weber TrampolineMemoryRegion* current = &TrampolineRegions[bucket];
363ebbce04cSNico Weber if (current->content == 0) {
364ebbce04cSNico Weber // No valid region found, allocate a new region.
365ebbce04cSNico Weber size_t bucket_size = GetMmapGranularity();
366ebbce04cSNico Weber void *content = AllocateTrampolineRegion(image_address, bucket_size);
367ebbce04cSNico Weber if (content == nullptr)
368ebbce04cSNico Weber return 0U;
369ebbce04cSNico Weber
370ebbce04cSNico Weber current->content = (uptr)content;
371ebbce04cSNico Weber current->allocated_size = 0;
372ebbce04cSNico Weber current->max_size = bucket_size;
373ebbce04cSNico Weber region = current;
374ebbce04cSNico Weber break;
375ebbce04cSNico Weber } else if (current->max_size - current->allocated_size > size) {
376ebbce04cSNico Weber #if SANITIZER_WINDOWS64
377ebbce04cSNico Weber // In 64-bits, the memory space must be allocated within 2G boundary.
378ebbce04cSNico Weber uptr next_address = current->content + current->allocated_size;
379ebbce04cSNico Weber if (next_address < image_address ||
380ebbce04cSNico Weber next_address - image_address >= 0x7FFF0000)
381ebbce04cSNico Weber continue;
382ebbce04cSNico Weber #endif
383ebbce04cSNico Weber // The space can be allocated in the current region.
384ebbce04cSNico Weber region = current;
385ebbce04cSNico Weber break;
386ebbce04cSNico Weber }
387ebbce04cSNico Weber }
388ebbce04cSNico Weber
389ebbce04cSNico Weber // Failed to find a region.
390ebbce04cSNico Weber if (region == nullptr)
391ebbce04cSNico Weber return 0U;
392ebbce04cSNico Weber
393ebbce04cSNico Weber // Allocate the space in the current region.
394ebbce04cSNico Weber uptr allocated_space = region->content + region->allocated_size;
395ebbce04cSNico Weber region->allocated_size += size;
396ebbce04cSNico Weber WritePadding(allocated_space, size);
397ebbce04cSNico Weber
398ebbce04cSNico Weber return allocated_space;
399ebbce04cSNico Weber }
400ebbce04cSNico Weber
40122ea0ceaSToshihito Kikuchi // The following prologues cannot be patched because of the short jump
40222ea0ceaSToshihito Kikuchi // jumping to the patching region.
40322ea0ceaSToshihito Kikuchi
404aa45fc41SMartin Storsjö #if SANITIZER_WINDOWS64
40522ea0ceaSToshihito Kikuchi // ntdll!wcslen in Win11
40622ea0ceaSToshihito Kikuchi // 488bc1 mov rax,rcx
40722ea0ceaSToshihito Kikuchi // 0fb710 movzx edx,word ptr [rax]
40822ea0ceaSToshihito Kikuchi // 4883c002 add rax,2
40922ea0ceaSToshihito Kikuchi // 6685d2 test dx,dx
41022ea0ceaSToshihito Kikuchi // 75f4 jne -12
41122ea0ceaSToshihito Kikuchi static const u8 kPrologueWithShortJump1[] = {
41222ea0ceaSToshihito Kikuchi 0x48, 0x8b, 0xc1, 0x0f, 0xb7, 0x10, 0x48, 0x83,
41322ea0ceaSToshihito Kikuchi 0xc0, 0x02, 0x66, 0x85, 0xd2, 0x75, 0xf4,
41422ea0ceaSToshihito Kikuchi };
41522ea0ceaSToshihito Kikuchi
41622ea0ceaSToshihito Kikuchi // ntdll!strrchr in Win11
41722ea0ceaSToshihito Kikuchi // 4c8bc1 mov r8,rcx
41822ea0ceaSToshihito Kikuchi // 8a01 mov al,byte ptr [rcx]
41922ea0ceaSToshihito Kikuchi // 48ffc1 inc rcx
42022ea0ceaSToshihito Kikuchi // 84c0 test al,al
42122ea0ceaSToshihito Kikuchi // 75f7 jne -9
42222ea0ceaSToshihito Kikuchi static const u8 kPrologueWithShortJump2[] = {
42322ea0ceaSToshihito Kikuchi 0x4c, 0x8b, 0xc1, 0x8a, 0x01, 0x48, 0xff, 0xc1,
42422ea0ceaSToshihito Kikuchi 0x84, 0xc0, 0x75, 0xf7,
42522ea0ceaSToshihito Kikuchi };
426aa45fc41SMartin Storsjö #endif
42722ea0ceaSToshihito Kikuchi
428ebbce04cSNico Weber // Returns 0 on error.
GetInstructionSize(uptr address,size_t * rel_offset=nullptr)429ebbce04cSNico Weber static size_t GetInstructionSize(uptr address, size_t* rel_offset = nullptr) {
43022ea0ceaSToshihito Kikuchi #if SANITIZER_WINDOWS64
43122ea0ceaSToshihito Kikuchi if (memcmp((u8*)address, kPrologueWithShortJump1,
43222ea0ceaSToshihito Kikuchi sizeof(kPrologueWithShortJump1)) == 0 ||
43322ea0ceaSToshihito Kikuchi memcmp((u8*)address, kPrologueWithShortJump2,
43422ea0ceaSToshihito Kikuchi sizeof(kPrologueWithShortJump2)) == 0) {
43522ea0ceaSToshihito Kikuchi return 0;
43622ea0ceaSToshihito Kikuchi }
43722ea0ceaSToshihito Kikuchi #endif
43822ea0ceaSToshihito Kikuchi
439ebbce04cSNico Weber switch (*(u64*)address) {
440ebbce04cSNico Weber case 0x90909090909006EB: // stub: jmp over 6 x nop.
441ebbce04cSNico Weber return 8;
442ebbce04cSNico Weber }
443ebbce04cSNico Weber
444ebbce04cSNico Weber switch (*(u8*)address) {
445ebbce04cSNico Weber case 0x90: // 90 : nop
446ebbce04cSNico Weber return 1;
447ebbce04cSNico Weber
448ebbce04cSNico Weber case 0x50: // push eax / rax
449ebbce04cSNico Weber case 0x51: // push ecx / rcx
450ebbce04cSNico Weber case 0x52: // push edx / rdx
451ebbce04cSNico Weber case 0x53: // push ebx / rbx
452ebbce04cSNico Weber case 0x54: // push esp / rsp
453ebbce04cSNico Weber case 0x55: // push ebp / rbp
454ebbce04cSNico Weber case 0x56: // push esi / rsi
455ebbce04cSNico Weber case 0x57: // push edi / rdi
456ebbce04cSNico Weber case 0x5D: // pop ebp / rbp
457ebbce04cSNico Weber return 1;
458ebbce04cSNico Weber
459ebbce04cSNico Weber case 0x6A: // 6A XX = push XX
460ebbce04cSNico Weber return 2;
461ebbce04cSNico Weber
462ebbce04cSNico Weber case 0xb8: // b8 XX XX XX XX : mov eax, XX XX XX XX
463ebbce04cSNico Weber case 0xB9: // b9 XX XX XX XX : mov ecx, XX XX XX XX
464ebbce04cSNico Weber return 5;
465ebbce04cSNico Weber
466ebbce04cSNico Weber // Cannot overwrite control-instruction. Return 0 to indicate failure.
467ebbce04cSNico Weber case 0xE9: // E9 XX XX XX XX : jmp <label>
468ebbce04cSNico Weber case 0xE8: // E8 XX XX XX XX : call <func>
469ebbce04cSNico Weber case 0xC3: // C3 : ret
470ebbce04cSNico Weber case 0xEB: // EB XX : jmp XX (short jump)
471ebbce04cSNico Weber case 0x70: // 7Y YY : jy XX (short conditional jump)
472ebbce04cSNico Weber case 0x71:
473ebbce04cSNico Weber case 0x72:
474ebbce04cSNico Weber case 0x73:
475ebbce04cSNico Weber case 0x74:
476ebbce04cSNico Weber case 0x75:
477ebbce04cSNico Weber case 0x76:
478ebbce04cSNico Weber case 0x77:
479ebbce04cSNico Weber case 0x78:
480ebbce04cSNico Weber case 0x79:
481ebbce04cSNico Weber case 0x7A:
482ebbce04cSNico Weber case 0x7B:
483ebbce04cSNico Weber case 0x7C:
484ebbce04cSNico Weber case 0x7D:
485ebbce04cSNico Weber case 0x7E:
486ebbce04cSNico Weber case 0x7F:
487ebbce04cSNico Weber return 0;
488ebbce04cSNico Weber }
489ebbce04cSNico Weber
490ebbce04cSNico Weber switch (*(u16*)(address)) {
491ebbce04cSNico Weber case 0x018A: // 8A 01 : mov al, byte ptr [ecx]
492ebbce04cSNico Weber case 0xFF8B: // 8B FF : mov edi, edi
493ebbce04cSNico Weber case 0xEC8B: // 8B EC : mov ebp, esp
494ebbce04cSNico Weber case 0xc889: // 89 C8 : mov eax, ecx
495ebbce04cSNico Weber case 0xC18B: // 8B C1 : mov eax, ecx
496ebbce04cSNico Weber case 0xC033: // 33 C0 : xor eax, eax
497ebbce04cSNico Weber case 0xC933: // 33 C9 : xor ecx, ecx
498ebbce04cSNico Weber case 0xD233: // 33 D2 : xor edx, edx
499ebbce04cSNico Weber return 2;
500ebbce04cSNico Weber
501ebbce04cSNico Weber // Cannot overwrite control-instruction. Return 0 to indicate failure.
502ebbce04cSNico Weber case 0x25FF: // FF 25 XX XX XX XX : jmp [XXXXXXXX]
503ebbce04cSNico Weber return 0;
504ebbce04cSNico Weber }
505ebbce04cSNico Weber
506ebbce04cSNico Weber switch (0x00FFFFFF & *(u32*)address) {
507ebbce04cSNico Weber case 0x24A48D: // 8D A4 24 XX XX XX XX : lea esp, [esp + XX XX XX XX]
508ebbce04cSNico Weber return 7;
509ebbce04cSNico Weber }
510ebbce04cSNico Weber
511ebbce04cSNico Weber #if SANITIZER_WINDOWS64
512ebbce04cSNico Weber switch (*(u8*)address) {
513ebbce04cSNico Weber case 0xA1: // A1 XX XX XX XX XX XX XX XX :
514ebbce04cSNico Weber // movabs eax, dword ptr ds:[XXXXXXXX]
515ebbce04cSNico Weber return 9;
51622ea0ceaSToshihito Kikuchi
51722ea0ceaSToshihito Kikuchi case 0x83:
51822ea0ceaSToshihito Kikuchi const u8 next_byte = *(u8*)(address + 1);
51922ea0ceaSToshihito Kikuchi const u8 mod = next_byte >> 6;
52022ea0ceaSToshihito Kikuchi const u8 rm = next_byte & 7;
52122ea0ceaSToshihito Kikuchi if (mod == 1 && rm == 4)
52222ea0ceaSToshihito Kikuchi return 5; // 83 ModR/M SIB Disp8 Imm8
52322ea0ceaSToshihito Kikuchi // add|or|adc|sbb|and|sub|xor|cmp [r+disp8], imm8
524ebbce04cSNico Weber }
525ebbce04cSNico Weber
526ebbce04cSNico Weber switch (*(u16*)address) {
527ebbce04cSNico Weber case 0x5040: // push rax
528ebbce04cSNico Weber case 0x5140: // push rcx
529ebbce04cSNico Weber case 0x5240: // push rdx
530ebbce04cSNico Weber case 0x5340: // push rbx
531ebbce04cSNico Weber case 0x5440: // push rsp
532ebbce04cSNico Weber case 0x5540: // push rbp
533ebbce04cSNico Weber case 0x5640: // push rsi
534ebbce04cSNico Weber case 0x5740: // push rdi
535ebbce04cSNico Weber case 0x5441: // push r12
536ebbce04cSNico Weber case 0x5541: // push r13
537ebbce04cSNico Weber case 0x5641: // push r14
538ebbce04cSNico Weber case 0x5741: // push r15
539ebbce04cSNico Weber case 0x9066: // Two-byte NOP
54022ea0ceaSToshihito Kikuchi case 0xc084: // test al, al
54122ea0ceaSToshihito Kikuchi case 0x018a: // mov al, byte ptr [rcx]
542ebbce04cSNico Weber return 2;
543ebbce04cSNico Weber
544ebbce04cSNico Weber case 0x058B: // 8B 05 XX XX XX XX : mov eax, dword ptr [XX XX XX XX]
545ebbce04cSNico Weber if (rel_offset)
546ebbce04cSNico Weber *rel_offset = 2;
547ebbce04cSNico Weber return 6;
548ebbce04cSNico Weber }
549ebbce04cSNico Weber
550ebbce04cSNico Weber switch (0x00FFFFFF & *(u32*)address) {
551ebbce04cSNico Weber case 0xe58948: // 48 8b c4 : mov rbp, rsp
552ebbce04cSNico Weber case 0xc18b48: // 48 8b c1 : mov rax, rcx
553ebbce04cSNico Weber case 0xc48b48: // 48 8b c4 : mov rax, rsp
554ebbce04cSNico Weber case 0xd9f748: // 48 f7 d9 : neg rcx
555ebbce04cSNico Weber case 0xd12b48: // 48 2b d1 : sub rdx, rcx
556ebbce04cSNico Weber case 0x07c1f6: // f6 c1 07 : test cl, 0x7
557ebbce04cSNico Weber case 0xc98548: // 48 85 C9 : test rcx, rcx
55822ea0ceaSToshihito Kikuchi case 0xd28548: // 48 85 d2 : test rdx, rdx
559ebbce04cSNico Weber case 0xc0854d: // 4d 85 c0 : test r8, r8
560ebbce04cSNico Weber case 0xc2b60f: // 0f b6 c2 : movzx eax, dl
561ebbce04cSNico Weber case 0xc03345: // 45 33 c0 : xor r8d, r8d
562ebbce04cSNico Weber case 0xc93345: // 45 33 c9 : xor r9d, r9d
563ebbce04cSNico Weber case 0xdb3345: // 45 33 DB : xor r11d, r11d
564ebbce04cSNico Weber case 0xd98b4c: // 4c 8b d9 : mov r11, rcx
565ebbce04cSNico Weber case 0xd28b4c: // 4c 8b d2 : mov r10, rdx
566ebbce04cSNico Weber case 0xc98b4c: // 4C 8B C9 : mov r9, rcx
567ebbce04cSNico Weber case 0xc18b4c: // 4C 8B C1 : mov r8, rcx
568ebbce04cSNico Weber case 0xd2b60f: // 0f b6 d2 : movzx edx, dl
569ebbce04cSNico Weber case 0xca2b48: // 48 2b ca : sub rcx, rdx
570ebbce04cSNico Weber case 0x10b70f: // 0f b7 10 : movzx edx, WORD PTR [rax]
571ebbce04cSNico Weber case 0xc00b4d: // 3d 0b c0 : or r8, r8
57222ea0ceaSToshihito Kikuchi case 0xc08b41: // 41 8b c0 : mov eax, r8d
573ebbce04cSNico Weber case 0xd18b48: // 48 8b d1 : mov rdx, rcx
574ebbce04cSNico Weber case 0xdc8b4c: // 4c 8b dc : mov r11, rsp
575ebbce04cSNico Weber case 0xd18b4c: // 4c 8b d1 : mov r10, rcx
576ebbce04cSNico Weber case 0xE0E483: // 83 E4 E0 : and esp, 0xFFFFFFE0
577ebbce04cSNico Weber return 3;
578ebbce04cSNico Weber
579ebbce04cSNico Weber case 0xec8348: // 48 83 ec XX : sub rsp, XX
580ebbce04cSNico Weber case 0xf88349: // 49 83 f8 XX : cmp r8, XX
581ebbce04cSNico Weber case 0x588948: // 48 89 58 XX : mov QWORD PTR[rax + XX], rbx
582ebbce04cSNico Weber return 4;
583ebbce04cSNico Weber
584ebbce04cSNico Weber case 0xec8148: // 48 81 EC XX XX XX XX : sub rsp, XXXXXXXX
585ebbce04cSNico Weber return 7;
586ebbce04cSNico Weber
587ebbce04cSNico Weber case 0x058b48: // 48 8b 05 XX XX XX XX :
588ebbce04cSNico Weber // mov rax, QWORD PTR [rip + XXXXXXXX]
589ebbce04cSNico Weber case 0x25ff48: // 48 ff 25 XX XX XX XX :
590ebbce04cSNico Weber // rex.W jmp QWORD PTR [rip + XXXXXXXX]
591ebbce04cSNico Weber
592ebbce04cSNico Weber // Instructions having offset relative to 'rip' need offset adjustment.
593ebbce04cSNico Weber if (rel_offset)
594ebbce04cSNico Weber *rel_offset = 3;
595ebbce04cSNico Weber return 7;
596ebbce04cSNico Weber
597ebbce04cSNico Weber case 0x2444c7: // C7 44 24 XX YY YY YY YY
598ebbce04cSNico Weber // mov dword ptr [rsp + XX], YYYYYYYY
599ebbce04cSNico Weber return 8;
600ebbce04cSNico Weber }
601ebbce04cSNico Weber
602ebbce04cSNico Weber switch (*(u32*)(address)) {
603ebbce04cSNico Weber case 0x24448b48: // 48 8b 44 24 XX : mov rax, QWORD ptr [rsp + XX]
604ebbce04cSNico Weber case 0x246c8948: // 48 89 6C 24 XX : mov QWORD ptr [rsp + XX], rbp
605ebbce04cSNico Weber case 0x245c8948: // 48 89 5c 24 XX : mov QWORD PTR [rsp + XX], rbx
606ebbce04cSNico Weber case 0x24748948: // 48 89 74 24 XX : mov QWORD PTR [rsp + XX], rsi
6077cd109b9SAlexandre Ganea case 0x247c8948: // 48 89 7c 24 XX : mov QWORD PTR [rsp + XX], rdi
608ebbce04cSNico Weber case 0x244C8948: // 48 89 4C 24 XX : mov QWORD PTR [rsp + XX], rcx
609ebbce04cSNico Weber case 0x24548948: // 48 89 54 24 XX : mov QWORD PTR [rsp + XX], rdx
610ebbce04cSNico Weber case 0x244c894c: // 4c 89 4c 24 XX : mov QWORD PTR [rsp + XX], r9
611ebbce04cSNico Weber case 0x2444894c: // 4c 89 44 24 XX : mov QWORD PTR [rsp + XX], r8
612ebbce04cSNico Weber return 5;
613ebbce04cSNico Weber case 0x24648348: // 48 83 64 24 XX : and QWORD PTR [rsp + XX], YY
614ebbce04cSNico Weber return 6;
615ebbce04cSNico Weber }
616ebbce04cSNico Weber
617ebbce04cSNico Weber #else
618ebbce04cSNico Weber
619ebbce04cSNico Weber switch (*(u8*)address) {
620ebbce04cSNico Weber case 0xA1: // A1 XX XX XX XX : mov eax, dword ptr ds:[XXXXXXXX]
621ebbce04cSNico Weber return 5;
622ebbce04cSNico Weber }
623ebbce04cSNico Weber switch (*(u16*)address) {
624ebbce04cSNico Weber case 0x458B: // 8B 45 XX : mov eax, dword ptr [ebp + XX]
625ebbce04cSNico Weber case 0x5D8B: // 8B 5D XX : mov ebx, dword ptr [ebp + XX]
626ebbce04cSNico Weber case 0x7D8B: // 8B 7D XX : mov edi, dword ptr [ebp + XX]
627ebbce04cSNico Weber case 0xEC83: // 83 EC XX : sub esp, XX
628ebbce04cSNico Weber case 0x75FF: // FF 75 XX : push dword ptr [ebp + XX]
629ebbce04cSNico Weber return 3;
630ebbce04cSNico Weber case 0xC1F7: // F7 C1 XX YY ZZ WW : test ecx, WWZZYYXX
631ebbce04cSNico Weber case 0x25FF: // FF 25 XX YY ZZ WW : jmp dword ptr ds:[WWZZYYXX]
632ebbce04cSNico Weber return 6;
633ebbce04cSNico Weber case 0x3D83: // 83 3D XX YY ZZ WW TT : cmp TT, WWZZYYXX
634ebbce04cSNico Weber return 7;
635ebbce04cSNico Weber case 0x7D83: // 83 7D XX YY : cmp dword ptr [ebp + XX], YY
636ebbce04cSNico Weber return 4;
637ebbce04cSNico Weber }
638ebbce04cSNico Weber
639ebbce04cSNico Weber switch (0x00FFFFFF & *(u32*)address) {
640ebbce04cSNico Weber case 0x24448A: // 8A 44 24 XX : mov eal, dword ptr [esp + XX]
641ebbce04cSNico Weber case 0x24448B: // 8B 44 24 XX : mov eax, dword ptr [esp + XX]
642ebbce04cSNico Weber case 0x244C8B: // 8B 4C 24 XX : mov ecx, dword ptr [esp + XX]
643ebbce04cSNico Weber case 0x24548B: // 8B 54 24 XX : mov edx, dword ptr [esp + XX]
644ebbce04cSNico Weber case 0x24748B: // 8B 74 24 XX : mov esi, dword ptr [esp + XX]
645ebbce04cSNico Weber case 0x247C8B: // 8B 7C 24 XX : mov edi, dword ptr [esp + XX]
646ebbce04cSNico Weber return 4;
647ebbce04cSNico Weber }
648ebbce04cSNico Weber
649ebbce04cSNico Weber switch (*(u32*)address) {
650ebbce04cSNico Weber case 0x2444B60F: // 0F B6 44 24 XX : movzx eax, byte ptr [esp + XX]
651ebbce04cSNico Weber return 5;
652ebbce04cSNico Weber }
653ebbce04cSNico Weber #endif
654ebbce04cSNico Weber
655ebbce04cSNico Weber // Unknown instruction!
656ebbce04cSNico Weber // FIXME: Unknown instruction failures might happen when we add a new
657ebbce04cSNico Weber // interceptor or a new compiler version. In either case, they should result
658ebbce04cSNico Weber // in visible and readable error messages. However, merely calling abort()
659ebbce04cSNico Weber // leads to an infinite recursion in CheckFailed.
660ebbce04cSNico Weber InterceptionFailed();
661ebbce04cSNico Weber return 0;
662ebbce04cSNico Weber }
663ebbce04cSNico Weber
664ebbce04cSNico Weber // Returns 0 on error.
RoundUpToInstrBoundary(size_t size,uptr address)665ebbce04cSNico Weber static size_t RoundUpToInstrBoundary(size_t size, uptr address) {
666ebbce04cSNico Weber size_t cursor = 0;
667ebbce04cSNico Weber while (cursor < size) {
668ebbce04cSNico Weber size_t instruction_size = GetInstructionSize(address + cursor);
669ebbce04cSNico Weber if (!instruction_size)
670ebbce04cSNico Weber return 0;
671ebbce04cSNico Weber cursor += instruction_size;
672ebbce04cSNico Weber }
673ebbce04cSNico Weber return cursor;
674ebbce04cSNico Weber }
675ebbce04cSNico Weber
CopyInstructions(uptr to,uptr from,size_t size)676ebbce04cSNico Weber static bool CopyInstructions(uptr to, uptr from, size_t size) {
677ebbce04cSNico Weber size_t cursor = 0;
678ebbce04cSNico Weber while (cursor != size) {
679ebbce04cSNico Weber size_t rel_offset = 0;
680ebbce04cSNico Weber size_t instruction_size = GetInstructionSize(from + cursor, &rel_offset);
681ebbce04cSNico Weber _memcpy((void*)(to + cursor), (void*)(from + cursor),
682ebbce04cSNico Weber (size_t)instruction_size);
683ebbce04cSNico Weber if (rel_offset) {
684ebbce04cSNico Weber uptr delta = to - from;
685ebbce04cSNico Weber uptr relocated_offset = *(u32*)(to + cursor + rel_offset) - delta;
686ebbce04cSNico Weber #if SANITIZER_WINDOWS64
687ebbce04cSNico Weber if (relocated_offset + 0x80000000U >= 0xFFFFFFFFU)
688ebbce04cSNico Weber return false;
689ebbce04cSNico Weber #endif
690ebbce04cSNico Weber *(u32*)(to + cursor + rel_offset) = relocated_offset;
691ebbce04cSNico Weber }
692ebbce04cSNico Weber cursor += instruction_size;
693ebbce04cSNico Weber }
694ebbce04cSNico Weber return true;
695ebbce04cSNico Weber }
696ebbce04cSNico Weber
697ebbce04cSNico Weber
698ebbce04cSNico Weber #if !SANITIZER_WINDOWS64
OverrideFunctionWithDetour(uptr old_func,uptr new_func,uptr * orig_old_func)699ebbce04cSNico Weber bool OverrideFunctionWithDetour(
700ebbce04cSNico Weber uptr old_func, uptr new_func, uptr *orig_old_func) {
701ebbce04cSNico Weber const int kDetourHeaderLen = 5;
702ebbce04cSNico Weber const u16 kDetourInstruction = 0xFF8B;
703ebbce04cSNico Weber
704ebbce04cSNico Weber uptr header = (uptr)old_func - kDetourHeaderLen;
705ebbce04cSNico Weber uptr patch_length = kDetourHeaderLen + kShortJumpInstructionLength;
706ebbce04cSNico Weber
707ebbce04cSNico Weber // Validate that the function is hookable.
708ebbce04cSNico Weber if (*(u16*)old_func != kDetourInstruction ||
709ebbce04cSNico Weber !IsMemoryPadding(header, kDetourHeaderLen))
710ebbce04cSNico Weber return false;
711ebbce04cSNico Weber
712ebbce04cSNico Weber // Change memory protection to writable.
713ebbce04cSNico Weber DWORD protection = 0;
714ebbce04cSNico Weber if (!ChangeMemoryProtection(header, patch_length, &protection))
715ebbce04cSNico Weber return false;
716ebbce04cSNico Weber
717ebbce04cSNico Weber // Write a relative jump to the redirected function.
718ebbce04cSNico Weber WriteJumpInstruction(header, new_func);
719ebbce04cSNico Weber
720ebbce04cSNico Weber // Write the short jump to the function prefix.
721ebbce04cSNico Weber WriteShortJumpInstruction(old_func, header);
722ebbce04cSNico Weber
723ebbce04cSNico Weber // Restore previous memory protection.
724ebbce04cSNico Weber if (!RestoreMemoryProtection(header, patch_length, protection))
725ebbce04cSNico Weber return false;
726ebbce04cSNico Weber
727ebbce04cSNico Weber if (orig_old_func)
728ebbce04cSNico Weber *orig_old_func = old_func + kShortJumpInstructionLength;
729ebbce04cSNico Weber
730ebbce04cSNico Weber return true;
731ebbce04cSNico Weber }
732ebbce04cSNico Weber #endif
733ebbce04cSNico Weber
OverrideFunctionWithRedirectJump(uptr old_func,uptr new_func,uptr * orig_old_func)734ebbce04cSNico Weber bool OverrideFunctionWithRedirectJump(
735ebbce04cSNico Weber uptr old_func, uptr new_func, uptr *orig_old_func) {
736ebbce04cSNico Weber // Check whether the first instruction is a relative jump.
737ebbce04cSNico Weber if (*(u8*)old_func != 0xE9)
738ebbce04cSNico Weber return false;
739ebbce04cSNico Weber
740ebbce04cSNico Weber if (orig_old_func) {
741ebbce04cSNico Weber uptr relative_offset = *(u32*)(old_func + 1);
742ebbce04cSNico Weber uptr absolute_target = old_func + relative_offset + kJumpInstructionLength;
743ebbce04cSNico Weber *orig_old_func = absolute_target;
744ebbce04cSNico Weber }
745ebbce04cSNico Weber
746ebbce04cSNico Weber #if SANITIZER_WINDOWS64
747ebbce04cSNico Weber // If needed, get memory space for a trampoline jump.
748ebbce04cSNico Weber uptr trampoline = AllocateMemoryForTrampoline(old_func, kDirectBranchLength);
749ebbce04cSNico Weber if (!trampoline)
750ebbce04cSNico Weber return false;
751ebbce04cSNico Weber WriteDirectBranch(trampoline, new_func);
752ebbce04cSNico Weber #endif
753ebbce04cSNico Weber
754ebbce04cSNico Weber // Change memory protection to writable.
755ebbce04cSNico Weber DWORD protection = 0;
756ebbce04cSNico Weber if (!ChangeMemoryProtection(old_func, kJumpInstructionLength, &protection))
757ebbce04cSNico Weber return false;
758ebbce04cSNico Weber
759ebbce04cSNico Weber // Write a relative jump to the redirected function.
760ebbce04cSNico Weber WriteJumpInstruction(old_func, FIRST_32_SECOND_64(new_func, trampoline));
761ebbce04cSNico Weber
762ebbce04cSNico Weber // Restore previous memory protection.
763ebbce04cSNico Weber if (!RestoreMemoryProtection(old_func, kJumpInstructionLength, protection))
764ebbce04cSNico Weber return false;
765ebbce04cSNico Weber
766ebbce04cSNico Weber return true;
767ebbce04cSNico Weber }
768ebbce04cSNico Weber
OverrideFunctionWithHotPatch(uptr old_func,uptr new_func,uptr * orig_old_func)769ebbce04cSNico Weber bool OverrideFunctionWithHotPatch(
770ebbce04cSNico Weber uptr old_func, uptr new_func, uptr *orig_old_func) {
771ebbce04cSNico Weber const int kHotPatchHeaderLen = kBranchLength;
772ebbce04cSNico Weber
773ebbce04cSNico Weber uptr header = (uptr)old_func - kHotPatchHeaderLen;
774ebbce04cSNico Weber uptr patch_length = kHotPatchHeaderLen + kShortJumpInstructionLength;
775ebbce04cSNico Weber
776ebbce04cSNico Weber // Validate that the function is hot patchable.
777ebbce04cSNico Weber size_t instruction_size = GetInstructionSize(old_func);
778ebbce04cSNico Weber if (instruction_size < kShortJumpInstructionLength ||
779ebbce04cSNico Weber !FunctionHasPadding(old_func, kHotPatchHeaderLen))
780ebbce04cSNico Weber return false;
781ebbce04cSNico Weber
782ebbce04cSNico Weber if (orig_old_func) {
783ebbce04cSNico Weber // Put the needed instructions into the trampoline bytes.
784ebbce04cSNico Weber uptr trampoline_length = instruction_size + kDirectBranchLength;
785ebbce04cSNico Weber uptr trampoline = AllocateMemoryForTrampoline(old_func, trampoline_length);
786ebbce04cSNico Weber if (!trampoline)
787ebbce04cSNico Weber return false;
788ebbce04cSNico Weber if (!CopyInstructions(trampoline, old_func, instruction_size))
789ebbce04cSNico Weber return false;
790ebbce04cSNico Weber WriteDirectBranch(trampoline + instruction_size,
791ebbce04cSNico Weber old_func + instruction_size);
792ebbce04cSNico Weber *orig_old_func = trampoline;
793ebbce04cSNico Weber }
794ebbce04cSNico Weber
795ebbce04cSNico Weber // If needed, get memory space for indirect address.
796ebbce04cSNico Weber uptr indirect_address = 0;
797ebbce04cSNico Weber #if SANITIZER_WINDOWS64
798ebbce04cSNico Weber indirect_address = AllocateMemoryForTrampoline(old_func, kAddressLength);
799ebbce04cSNico Weber if (!indirect_address)
800ebbce04cSNico Weber return false;
801ebbce04cSNico Weber #endif
802ebbce04cSNico Weber
803ebbce04cSNico Weber // Change memory protection to writable.
804ebbce04cSNico Weber DWORD protection = 0;
805ebbce04cSNico Weber if (!ChangeMemoryProtection(header, patch_length, &protection))
806ebbce04cSNico Weber return false;
807ebbce04cSNico Weber
808ebbce04cSNico Weber // Write jumps to the redirected function.
809ebbce04cSNico Weber WriteBranch(header, indirect_address, new_func);
810ebbce04cSNico Weber WriteShortJumpInstruction(old_func, header);
811ebbce04cSNico Weber
812ebbce04cSNico Weber // Restore previous memory protection.
813ebbce04cSNico Weber if (!RestoreMemoryProtection(header, patch_length, protection))
814ebbce04cSNico Weber return false;
815ebbce04cSNico Weber
816ebbce04cSNico Weber return true;
817ebbce04cSNico Weber }
818ebbce04cSNico Weber
OverrideFunctionWithTrampoline(uptr old_func,uptr new_func,uptr * orig_old_func)819ebbce04cSNico Weber bool OverrideFunctionWithTrampoline(
820ebbce04cSNico Weber uptr old_func, uptr new_func, uptr *orig_old_func) {
821ebbce04cSNico Weber
822ebbce04cSNico Weber size_t instructions_length = kBranchLength;
823ebbce04cSNico Weber size_t padding_length = 0;
824ebbce04cSNico Weber uptr indirect_address = 0;
825ebbce04cSNico Weber
826ebbce04cSNico Weber if (orig_old_func) {
827ebbce04cSNico Weber // Find out the number of bytes of the instructions we need to copy
828ebbce04cSNico Weber // to the trampoline.
829ebbce04cSNico Weber instructions_length = RoundUpToInstrBoundary(kBranchLength, old_func);
830ebbce04cSNico Weber if (!instructions_length)
831ebbce04cSNico Weber return false;
832ebbce04cSNico Weber
833ebbce04cSNico Weber // Put the needed instructions into the trampoline bytes.
834ebbce04cSNico Weber uptr trampoline_length = instructions_length + kDirectBranchLength;
835ebbce04cSNico Weber uptr trampoline = AllocateMemoryForTrampoline(old_func, trampoline_length);
836ebbce04cSNico Weber if (!trampoline)
837ebbce04cSNico Weber return false;
838ebbce04cSNico Weber if (!CopyInstructions(trampoline, old_func, instructions_length))
839ebbce04cSNico Weber return false;
840ebbce04cSNico Weber WriteDirectBranch(trampoline + instructions_length,
841ebbce04cSNico Weber old_func + instructions_length);
842ebbce04cSNico Weber *orig_old_func = trampoline;
843ebbce04cSNico Weber }
844ebbce04cSNico Weber
845ebbce04cSNico Weber #if SANITIZER_WINDOWS64
846ebbce04cSNico Weber // Check if the targeted address can be encoded in the function padding.
847ebbce04cSNico Weber // Otherwise, allocate it in the trampoline region.
848ebbce04cSNico Weber if (IsMemoryPadding(old_func - kAddressLength, kAddressLength)) {
849ebbce04cSNico Weber indirect_address = old_func - kAddressLength;
850ebbce04cSNico Weber padding_length = kAddressLength;
851ebbce04cSNico Weber } else {
852ebbce04cSNico Weber indirect_address = AllocateMemoryForTrampoline(old_func, kAddressLength);
853ebbce04cSNico Weber if (!indirect_address)
854ebbce04cSNico Weber return false;
855ebbce04cSNico Weber }
856ebbce04cSNico Weber #endif
857ebbce04cSNico Weber
858ebbce04cSNico Weber // Change memory protection to writable.
859ebbce04cSNico Weber uptr patch_address = old_func - padding_length;
860ebbce04cSNico Weber uptr patch_length = instructions_length + padding_length;
861ebbce04cSNico Weber DWORD protection = 0;
862ebbce04cSNico Weber if (!ChangeMemoryProtection(patch_address, patch_length, &protection))
863ebbce04cSNico Weber return false;
864ebbce04cSNico Weber
865ebbce04cSNico Weber // Patch the original function.
866ebbce04cSNico Weber WriteBranch(old_func, indirect_address, new_func);
867ebbce04cSNico Weber
868ebbce04cSNico Weber // Restore previous memory protection.
869ebbce04cSNico Weber if (!RestoreMemoryProtection(patch_address, patch_length, protection))
870ebbce04cSNico Weber return false;
871ebbce04cSNico Weber
872ebbce04cSNico Weber return true;
873ebbce04cSNico Weber }
874ebbce04cSNico Weber
OverrideFunction(uptr old_func,uptr new_func,uptr * orig_old_func)875ebbce04cSNico Weber bool OverrideFunction(
876ebbce04cSNico Weber uptr old_func, uptr new_func, uptr *orig_old_func) {
877ebbce04cSNico Weber #if !SANITIZER_WINDOWS64
878ebbce04cSNico Weber if (OverrideFunctionWithDetour(old_func, new_func, orig_old_func))
879ebbce04cSNico Weber return true;
880ebbce04cSNico Weber #endif
881ebbce04cSNico Weber if (OverrideFunctionWithRedirectJump(old_func, new_func, orig_old_func))
882ebbce04cSNico Weber return true;
883ebbce04cSNico Weber if (OverrideFunctionWithHotPatch(old_func, new_func, orig_old_func))
884ebbce04cSNico Weber return true;
885ebbce04cSNico Weber if (OverrideFunctionWithTrampoline(old_func, new_func, orig_old_func))
886ebbce04cSNico Weber return true;
887ebbce04cSNico Weber return false;
888ebbce04cSNico Weber }
889ebbce04cSNico Weber
InterestingDLLsAvailable()890ebbce04cSNico Weber static void **InterestingDLLsAvailable() {
891ebbce04cSNico Weber static const char *InterestingDLLs[] = {
892ebbce04cSNico Weber "kernel32.dll",
893ebbce04cSNico Weber "msvcr100.dll", // VS2010
894ebbce04cSNico Weber "msvcr110.dll", // VS2012
895ebbce04cSNico Weber "msvcr120.dll", // VS2013
896ebbce04cSNico Weber "vcruntime140.dll", // VS2015
897ebbce04cSNico Weber "ucrtbase.dll", // Universal CRT
898ebbce04cSNico Weber // NTDLL should go last as it exports some functions that we should
899ebbce04cSNico Weber // override in the CRT [presumably only used internally].
900ebbce04cSNico Weber "ntdll.dll", NULL};
901ebbce04cSNico Weber static void *result[ARRAY_SIZE(InterestingDLLs)] = { 0 };
902ebbce04cSNico Weber if (!result[0]) {
903ebbce04cSNico Weber for (size_t i = 0, j = 0; InterestingDLLs[i]; ++i) {
904ebbce04cSNico Weber if (HMODULE h = GetModuleHandleA(InterestingDLLs[i]))
905ebbce04cSNico Weber result[j++] = (void *)h;
906ebbce04cSNico Weber }
907ebbce04cSNico Weber }
908ebbce04cSNico Weber return &result[0];
909ebbce04cSNico Weber }
910ebbce04cSNico Weber
911ebbce04cSNico Weber namespace {
912ebbce04cSNico Weber // Utility for reading loaded PE images.
913ebbce04cSNico Weber template <typename T> class RVAPtr {
914ebbce04cSNico Weber public:
RVAPtr(void * module,uptr rva)915ebbce04cSNico Weber RVAPtr(void *module, uptr rva)
916ebbce04cSNico Weber : ptr_(reinterpret_cast<T *>(reinterpret_cast<char *>(module) + rva)) {}
operator T*()917ebbce04cSNico Weber operator T *() { return ptr_; }
operator ->()918ebbce04cSNico Weber T *operator->() { return ptr_; }
operator ++()919ebbce04cSNico Weber T *operator++() { return ++ptr_; }
920ebbce04cSNico Weber
921ebbce04cSNico Weber private:
922ebbce04cSNico Weber T *ptr_;
923ebbce04cSNico Weber };
924ebbce04cSNico Weber } // namespace
925ebbce04cSNico Weber
926ebbce04cSNico Weber // Internal implementation of GetProcAddress. At least since Windows 8,
927ebbce04cSNico Weber // GetProcAddress appears to initialize DLLs before returning function pointers
928ebbce04cSNico Weber // into them. This is problematic for the sanitizers, because they typically
929ebbce04cSNico Weber // want to intercept malloc *before* MSVCRT initializes. Our internal
930ebbce04cSNico Weber // implementation walks the export list manually without doing initialization.
InternalGetProcAddress(void * module,const char * func_name)931ebbce04cSNico Weber uptr InternalGetProcAddress(void *module, const char *func_name) {
932ebbce04cSNico Weber // Check that the module header is full and present.
933ebbce04cSNico Weber RVAPtr<IMAGE_DOS_HEADER> dos_stub(module, 0);
934ebbce04cSNico Weber RVAPtr<IMAGE_NT_HEADERS> headers(module, dos_stub->e_lfanew);
935ebbce04cSNico Weber if (!module || dos_stub->e_magic != IMAGE_DOS_SIGNATURE || // "MZ"
936ebbce04cSNico Weber headers->Signature != IMAGE_NT_SIGNATURE || // "PE\0\0"
937ebbce04cSNico Weber headers->FileHeader.SizeOfOptionalHeader <
938ebbce04cSNico Weber sizeof(IMAGE_OPTIONAL_HEADER)) {
939ebbce04cSNico Weber return 0;
940ebbce04cSNico Weber }
941ebbce04cSNico Weber
942ebbce04cSNico Weber IMAGE_DATA_DIRECTORY *export_directory =
943ebbce04cSNico Weber &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
944ebbce04cSNico Weber if (export_directory->Size == 0)
945ebbce04cSNico Weber return 0;
946ebbce04cSNico Weber RVAPtr<IMAGE_EXPORT_DIRECTORY> exports(module,
947ebbce04cSNico Weber export_directory->VirtualAddress);
948ebbce04cSNico Weber RVAPtr<DWORD> functions(module, exports->AddressOfFunctions);
949ebbce04cSNico Weber RVAPtr<DWORD> names(module, exports->AddressOfNames);
950ebbce04cSNico Weber RVAPtr<WORD> ordinals(module, exports->AddressOfNameOrdinals);
951ebbce04cSNico Weber
952ebbce04cSNico Weber for (DWORD i = 0; i < exports->NumberOfNames; i++) {
953ebbce04cSNico Weber RVAPtr<char> name(module, names[i]);
954ebbce04cSNico Weber if (!strcmp(func_name, name)) {
955ebbce04cSNico Weber DWORD index = ordinals[i];
956ebbce04cSNico Weber RVAPtr<char> func(module, functions[index]);
957ebbce04cSNico Weber
958ebbce04cSNico Weber // Handle forwarded functions.
959ebbce04cSNico Weber DWORD offset = functions[index];
960ebbce04cSNico Weber if (offset >= export_directory->VirtualAddress &&
961ebbce04cSNico Weber offset < export_directory->VirtualAddress + export_directory->Size) {
962ebbce04cSNico Weber // An entry for a forwarded function is a string with the following
963ebbce04cSNico Weber // format: "<module> . <function_name>" that is stored into the
964ebbce04cSNico Weber // exported directory.
965ebbce04cSNico Weber char function_name[256];
966ebbce04cSNico Weber size_t funtion_name_length = _strlen(func);
967ebbce04cSNico Weber if (funtion_name_length >= sizeof(function_name) - 1)
968ebbce04cSNico Weber InterceptionFailed();
969ebbce04cSNico Weber
970ebbce04cSNico Weber _memcpy(function_name, func, funtion_name_length);
971ebbce04cSNico Weber function_name[funtion_name_length] = '\0';
972ebbce04cSNico Weber char* separator = _strchr(function_name, '.');
973ebbce04cSNico Weber if (!separator)
974ebbce04cSNico Weber InterceptionFailed();
975ebbce04cSNico Weber *separator = '\0';
976ebbce04cSNico Weber
977ebbce04cSNico Weber void* redirected_module = GetModuleHandleA(function_name);
978ebbce04cSNico Weber if (!redirected_module)
979ebbce04cSNico Weber InterceptionFailed();
980ebbce04cSNico Weber return InternalGetProcAddress(redirected_module, separator + 1);
981ebbce04cSNico Weber }
982ebbce04cSNico Weber
983ebbce04cSNico Weber return (uptr)(char *)func;
984ebbce04cSNico Weber }
985ebbce04cSNico Weber }
986ebbce04cSNico Weber
987ebbce04cSNico Weber return 0;
988ebbce04cSNico Weber }
989ebbce04cSNico Weber
OverrideFunction(const char * func_name,uptr new_func,uptr * orig_old_func)990ebbce04cSNico Weber bool OverrideFunction(
991ebbce04cSNico Weber const char *func_name, uptr new_func, uptr *orig_old_func) {
992ebbce04cSNico Weber bool hooked = false;
993ebbce04cSNico Weber void **DLLs = InterestingDLLsAvailable();
994ebbce04cSNico Weber for (size_t i = 0; DLLs[i]; ++i) {
995ebbce04cSNico Weber uptr func_addr = InternalGetProcAddress(DLLs[i], func_name);
996ebbce04cSNico Weber if (func_addr &&
997ebbce04cSNico Weber OverrideFunction(func_addr, new_func, orig_old_func)) {
998ebbce04cSNico Weber hooked = true;
999ebbce04cSNico Weber }
1000ebbce04cSNico Weber }
1001ebbce04cSNico Weber return hooked;
1002ebbce04cSNico Weber }
1003ebbce04cSNico Weber
OverrideImportedFunction(const char * module_to_patch,const char * imported_module,const char * function_name,uptr new_function,uptr * orig_old_func)1004ebbce04cSNico Weber bool OverrideImportedFunction(const char *module_to_patch,
1005ebbce04cSNico Weber const char *imported_module,
1006ebbce04cSNico Weber const char *function_name, uptr new_function,
1007ebbce04cSNico Weber uptr *orig_old_func) {
1008ebbce04cSNico Weber HMODULE module = GetModuleHandleA(module_to_patch);
1009ebbce04cSNico Weber if (!module)
1010ebbce04cSNico Weber return false;
1011ebbce04cSNico Weber
1012ebbce04cSNico Weber // Check that the module header is full and present.
1013ebbce04cSNico Weber RVAPtr<IMAGE_DOS_HEADER> dos_stub(module, 0);
1014ebbce04cSNico Weber RVAPtr<IMAGE_NT_HEADERS> headers(module, dos_stub->e_lfanew);
1015ebbce04cSNico Weber if (!module || dos_stub->e_magic != IMAGE_DOS_SIGNATURE || // "MZ"
1016ebbce04cSNico Weber headers->Signature != IMAGE_NT_SIGNATURE || // "PE\0\0"
1017ebbce04cSNico Weber headers->FileHeader.SizeOfOptionalHeader <
1018ebbce04cSNico Weber sizeof(IMAGE_OPTIONAL_HEADER)) {
1019ebbce04cSNico Weber return false;
1020ebbce04cSNico Weber }
1021ebbce04cSNico Weber
1022ebbce04cSNico Weber IMAGE_DATA_DIRECTORY *import_directory =
1023ebbce04cSNico Weber &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
1024ebbce04cSNico Weber
1025ebbce04cSNico Weber // Iterate the list of imported DLLs. FirstThunk will be null for the last
1026ebbce04cSNico Weber // entry.
1027ebbce04cSNico Weber RVAPtr<IMAGE_IMPORT_DESCRIPTOR> imports(module,
1028ebbce04cSNico Weber import_directory->VirtualAddress);
1029ebbce04cSNico Weber for (; imports->FirstThunk != 0; ++imports) {
1030ebbce04cSNico Weber RVAPtr<const char> modname(module, imports->Name);
1031ebbce04cSNico Weber if (_stricmp(&*modname, imported_module) == 0)
1032ebbce04cSNico Weber break;
1033ebbce04cSNico Weber }
1034ebbce04cSNico Weber if (imports->FirstThunk == 0)
1035ebbce04cSNico Weber return false;
1036ebbce04cSNico Weber
1037ebbce04cSNico Weber // We have two parallel arrays: the import address table (IAT) and the table
1038ebbce04cSNico Weber // of names. They start out containing the same data, but the loader rewrites
1039ebbce04cSNico Weber // the IAT to hold imported addresses and leaves the name table in
1040ebbce04cSNico Weber // OriginalFirstThunk alone.
1041ebbce04cSNico Weber RVAPtr<IMAGE_THUNK_DATA> name_table(module, imports->OriginalFirstThunk);
1042ebbce04cSNico Weber RVAPtr<IMAGE_THUNK_DATA> iat(module, imports->FirstThunk);
1043ebbce04cSNico Weber for (; name_table->u1.Ordinal != 0; ++name_table, ++iat) {
1044ebbce04cSNico Weber if (!IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) {
1045ebbce04cSNico Weber RVAPtr<IMAGE_IMPORT_BY_NAME> import_by_name(
1046ebbce04cSNico Weber module, name_table->u1.ForwarderString);
1047ebbce04cSNico Weber const char *funcname = &import_by_name->Name[0];
1048ebbce04cSNico Weber if (strcmp(funcname, function_name) == 0)
1049ebbce04cSNico Weber break;
1050ebbce04cSNico Weber }
1051ebbce04cSNico Weber }
1052ebbce04cSNico Weber if (name_table->u1.Ordinal == 0)
1053ebbce04cSNico Weber return false;
1054ebbce04cSNico Weber
1055ebbce04cSNico Weber // Now we have the correct IAT entry. Do the swap. We have to make the page
1056ebbce04cSNico Weber // read/write first.
1057ebbce04cSNico Weber if (orig_old_func)
1058ebbce04cSNico Weber *orig_old_func = iat->u1.AddressOfData;
1059ebbce04cSNico Weber DWORD old_prot, unused_prot;
1060ebbce04cSNico Weber if (!VirtualProtect(&iat->u1.AddressOfData, 4, PAGE_EXECUTE_READWRITE,
1061ebbce04cSNico Weber &old_prot))
1062ebbce04cSNico Weber return false;
1063ebbce04cSNico Weber iat->u1.AddressOfData = new_function;
1064ebbce04cSNico Weber if (!VirtualProtect(&iat->u1.AddressOfData, 4, old_prot, &unused_prot))
1065ebbce04cSNico Weber return false; // Not clear if this failure bothers us.
1066ebbce04cSNico Weber return true;
1067ebbce04cSNico Weber }
1068ebbce04cSNico Weber
1069ebbce04cSNico Weber } // namespace __interception
1070ebbce04cSNico Weber
1071*8246b2e1SMariusz Borsa #endif // SANITIZER_APPLE
1072