OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2016 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "courgette/rel32_finder_x64.h" | |
6 | |
7 namespace courgette { | |
8 | |
9 Rel32FinderX64::Rel32FinderX64(RVA relocs_start_rva, | |
10 RVA relocs_end_rva, | |
11 RVA size_of_image) | |
12 : Rel32Finder(relocs_start_rva, relocs_end_rva), | |
13 size_of_image_(size_of_image) {} | |
14 | |
15 // Scan for opcodes matching the following instructions : | |
16 // rel32 JMP/CALL | |
17 // rip MOV/LEA | |
18 // Jcc (excluding JPO/JPE) | |
19 // Falsely detected rel32 that collide with known abs32 or that point outside | |
20 // valid regions are discarded. | |
21 void Rel32FinderX64::Find(const uint8_t* start_pointer, | |
22 const uint8_t* end_pointer, | |
23 RVA start_rva, | |
24 RVA end_rva, | |
25 const std::vector<RVA>& abs32_locations) { | |
26 // Quick way to convert from Pointer to RVA within a single Section is to | |
27 // subtract |adjust_pointer_to_rva|. | |
28 const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva; | |
29 | |
30 std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin(); | |
31 | |
32 // Find the rel32 relocations. | |
33 const uint8_t* p = start_pointer; | |
34 while (p < end_pointer) { | |
35 RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva); | |
36 | |
37 // Skip the base reloation table if we encounter it. | |
38 // Note: We're not bothering to handle the edge case where a Rel32 pointer | |
39 // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it. | |
40 if (current_rva >= relocs_start_rva_ && current_rva < relocs_end_rva_) { | |
41 p += relocs_end_rva_ - current_rva; | |
42 continue; | |
43 } | |
44 | |
45 // Heuristic discovery of rel32 locations in instruction stream: are the | |
46 // next few bytes the start of an instruction containing a rel32 | |
47 // addressing mode? | |
48 const uint8_t* rel32 = nullptr; | |
49 bool is_rip_relative = false; | |
50 | |
51 if (p + 5 <= end_pointer) { | |
52 if (p[0] == 0xE8 || p[0] == 0xE9) // jmp rel32 and call rel32 | |
53 rel32 = p + 1; | |
54 } | |
55 if (p + 6 <= end_pointer) { | |
56 if (p[0] == 0x0F && (p[1] & 0xF0) == 0x80) { // Jcc long form | |
57 if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely | |
58 rel32 = p + 2; | |
59 } else if (p[0] == 0xFF && (p[1] == 0x15 || p[1] == 0x25)) { | |
60 // rip relative CALL/JMP | |
61 rel32 = p + 2; | |
62 is_rip_relative = true; | |
63 } | |
64 } | |
65 // TODO(etiennep): Many rip mov/lea variants are not detected. Experiment, | |
66 // fix and combine logic. | |
67 if (p + 7 <= end_pointer) { | |
68 if ((p[0] & 0xFB) == 0x48 && // Dst reg : 48/4C [rax-rdi]/[r8-r15] | |
69 p[1] == 0x8D && // LEA | |
70 (p[2] & 0xC7) == 0x05) { // Dst reg : [05,0D,...3D] = | |
71 // [rax,rbx,...,rdi]/[r8,r9,...,r15] | |
72 // LEA dst, QWORD [rip + rel32] | |
73 rel32 = p + 3; | |
74 is_rip_relative = true; | |
75 } else if ((p[0] & 0xFB) == 0x48 && // Dst reg : 48/4C [rax-rdi]/[r8-r15] | |
76 p[1] == 0x8B && // MOV | |
77 (p[2] & 0xC7) == 0x05) { // Dst reg : [05,0D,...3D] = | |
78 // [rax,rbx,...,rdi]/[r8,r9,...,r15] | |
79 // MOV dst, QWORD PTR[rip + rel32] | |
80 rel32 = p + 3; | |
81 is_rip_relative = true; | |
82 } | |
83 } | |
84 | |
85 if (rel32) { | |
86 RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva); | |
87 | |
88 // Is there an abs32 reloc overlapping the candidate? | |
89 while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3) | |
etiennep
2016/06/01 17:23:41
I believe this should be (rel32_rva - 7)
huangs
2016/06/01 20:57:20
You're right. Let's do this in a follow-up.
| |
90 ++abs32_pos; | |
91 // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte | |
92 // region that could overlap rel32_rva. | |
93 if (abs32_pos != abs32_locations.end()) { | |
94 if (*abs32_pos < rel32_rva + 4) { | |
95 // Beginning of abs32 reloc is before end of rel32 reloc so they | |
96 // overlap. Skip four bytes past the abs32 reloc. | |
97 p += (*abs32_pos + 4) - current_rva; | |
etiennep
2016/06/01 17:23:41
and this +8
huangs
2016/06/01 20:57:20
Ditto.
| |
98 continue; | |
99 } | |
100 } | |
101 | |
102 // + 4 since offset is relative to start of next instruction. | |
103 RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32); | |
104 // To be valid, rel32 target must be within image, and within this | |
105 // section. | |
106 if (target_rva < size_of_image_ && // Subsumes rva != kUnassignedRVA. | |
107 (is_rip_relative || | |
108 (start_rva <= target_rva && target_rva < end_rva))) { | |
109 rel32_locations_.push_back(rel32_rva); | |
110 #if COURGETTE_HISTOGRAM_TARGETS | |
111 ++rel32_target_rvas_[target_rva]; | |
112 #endif | |
113 p = rel32 + 4; | |
114 continue; | |
115 } | |
116 } | |
117 p += 1; | |
118 } | |
119 } | |
120 | |
121 } // namespace courgette | |
OLD | NEW |