Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(305)

Side by Side Diff: courgette/rel32_finder_x64.cc

Issue 2008253004: Refactor rel32 searching process for x64 to make it more similar to x86. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Correct far away ptr in rel32_x64_03.txt test case Created 4 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « courgette/rel32_finder_x64.h ('k') | courgette/rel32_finder_x86.h » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
(Empty)
1 // Copyright 2016 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "courgette/rel32_finder_x64.h"
6
7 namespace courgette {
8
9 Rel32FinderX64::Rel32FinderX64(RVA relocs_start_rva,
10 RVA relocs_end_rva,
11 RVA size_of_image)
12 : Rel32Finder(relocs_start_rva, relocs_end_rva),
13 size_of_image_(size_of_image) {}
14
15 // Scan for opcodes matching the following instructions :
16 // rel32 JMP/CALL
17 // rip MOV/LEA
18 // Jcc (excluding JPO/JPE)
19 // Falsely detected rel32 that collide with known abs32 or that point outside
20 // valid regions are discarded.
21 void Rel32FinderX64::Find(const uint8_t* start_pointer,
22 const uint8_t* end_pointer,
23 RVA start_rva,
24 RVA end_rva,
25 const std::vector<RVA>& abs32_locations) {
26 // Quick way to convert from Pointer to RVA within a single Section is to
27 // subtract |adjust_pointer_to_rva|.
28 const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva;
29
30 std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin();
31
32 // Find the rel32 relocations.
33 const uint8_t* p = start_pointer;
34 while (p < end_pointer) {
35 RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
36
37 // Skip the base reloation table if we encounter it.
38 // Note: We're not bothering to handle the edge case where a Rel32 pointer
39 // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it.
40 if (current_rva >= relocs_start_rva_ && current_rva < relocs_end_rva_) {
41 p += relocs_end_rva_ - current_rva;
42 continue;
43 }
44
45 // Heuristic discovery of rel32 locations in instruction stream: are the
46 // next few bytes the start of an instruction containing a rel32
47 // addressing mode?
48 const uint8_t* rel32 = nullptr;
49 bool is_rip_relative = false;
50
51 if (p + 5 <= end_pointer) {
52 if (p[0] == 0xE8 || p[0] == 0xE9) // jmp rel32 and call rel32
53 rel32 = p + 1;
54 }
55 if (p + 6 <= end_pointer) {
56 if (p[0] == 0x0F && (p[1] & 0xF0) == 0x80) { // Jcc long form
57 if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
58 rel32 = p + 2;
59 } else if (p[0] == 0xFF && (p[1] == 0x15 || p[1] == 0x25)) {
60 // rip relative CALL/JMP
61 rel32 = p + 2;
62 is_rip_relative = true;
63 }
64 }
65 // TODO(etiennep): Many rip mov/lea variants are not detected. Experiment,
66 // fix and combine logic.
67 if (p + 7 <= end_pointer) {
68 if ((p[0] & 0xFB) == 0x48 && // Dst reg : 48/4C [rax-rdi]/[r8-r15]
69 p[1] == 0x8D && // LEA
70 (p[2] & 0xC7) == 0x05) { // Dst reg : [05,0D,...3D] =
71 // [rax,rbx,...,rdi]/[r8,r9,...,r15]
72 // LEA dst, QWORD [rip + rel32]
73 rel32 = p + 3;
74 is_rip_relative = true;
75 } else if ((p[0] & 0xFB) == 0x48 && // Dst reg : 48/4C [rax-rdi]/[r8-r15]
76 p[1] == 0x8B && // MOV
77 (p[2] & 0xC7) == 0x05) { // Dst reg : [05,0D,...3D] =
78 // [rax,rbx,...,rdi]/[r8,r9,...,r15]
79 // MOV dst, QWORD PTR[rip + rel32]
80 rel32 = p + 3;
81 is_rip_relative = true;
82 }
83 }
84
85 if (rel32) {
86 RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
87
88 // Is there an abs32 reloc overlapping the candidate?
89 while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3)
90 ++abs32_pos;
91 // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte
92 // region that could overlap rel32_rva.
93 if (abs32_pos != abs32_locations.end()) {
94 if (*abs32_pos < rel32_rva + 4) {
95 // Beginning of abs32 reloc is before end of rel32 reloc so they
96 // overlap. Skip four bytes past the abs32 reloc.
97 p += (*abs32_pos + 4) - current_rva;
98 continue;
99 }
100 }
101
102 // + 4 since offset is relative to start of next instruction.
103 RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32);
104 // To be valid, rel32 target must be within image, and within this
105 // section.
106 if (target_rva < size_of_image_ && // Subsumes rva != kUnassignedRVA.
107 (is_rip_relative ||
108 (start_rva <= target_rva && target_rva < end_rva))) {
109 rel32_locations_.push_back(rel32_rva);
110 #if COURGETTE_HISTOGRAM_TARGETS
111 ++rel32_target_rvas_[target_rva];
112 #endif
113 p = rel32 + 4;
114 continue;
115 }
116 }
117 p += 1;
118 }
119 }
120
121 } // namespace courgette
OLDNEW
« no previous file with comments | « courgette/rel32_finder_x64.h ('k') | courgette/rel32_finder_x86.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698