OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <stdint.h> | 5 #include "courgette/rel32_finder_x86.h" |
6 | |
7 #include "courgette/rel32_finder_win32_x86.h" | |
8 | 6 |
9 namespace courgette { | 7 namespace courgette { |
10 | 8 |
11 Rel32FinderWin32X86::Rel32FinderWin32X86(RVA relocs_start_rva, | 9 Rel32FinderX86::Rel32FinderX86(RVA relocs_start_rva, RVA relocs_end_rva) |
12 RVA relocs_end_rva) | 10 : Rel32Finder(relocs_start_rva, relocs_end_rva) {} |
13 : relocs_start_rva_(relocs_start_rva), relocs_end_rva_(relocs_end_rva) { | |
14 } | |
15 | 11 |
16 Rel32FinderWin32X86::~Rel32FinderWin32X86() { | 12 // Scan for opcodes matching the following instructions : |
17 } | 13 // rel32 JMP/CALL |
18 | 14 // Jcc (excluding JPO/JPE) |
19 void Rel32FinderWin32X86::SwapRel32Locations(std::vector<RVA>* dest) { | 15 // Falsely detected rel32 that collide with known abs32 or that point outside |
20 dest->swap(rel32_locations_); | 16 // valid regions are discarded. |
21 } | 17 void Rel32FinderX86::Find(const uint8_t* start_pointer, |
22 | 18 const uint8_t* end_pointer, |
23 #if COURGETTE_HISTOGRAM_TARGETS | 19 RVA start_rva, |
24 void Rel32FinderWin32X86::SwapRel32TargetRVAs(std::map<RVA, int>* dest) { | 20 RVA end_rva, |
25 dest->swap(rel32_target_rvas_); | 21 const std::vector<RVA>& abs32_locations) { |
26 } | |
27 #endif | |
28 | |
29 Rel32FinderWin32X86_Basic::Rel32FinderWin32X86_Basic(RVA relocs_start_rva, | |
30 RVA relocs_end_rva) | |
31 : Rel32FinderWin32X86(relocs_start_rva, relocs_end_rva) { | |
32 } | |
33 | |
34 Rel32FinderWin32X86_Basic::~Rel32FinderWin32X86_Basic() { | |
35 } | |
36 | |
37 void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer, | |
38 const uint8_t* end_pointer, | |
39 RVA start_rva, | |
40 RVA end_rva, | |
41 const std::vector<RVA>& abs32_locations) { | |
42 // Quick way to convert from Pointer to RVA within a single Section is to | 22 // Quick way to convert from Pointer to RVA within a single Section is to |
43 // subtract 'pointer_to_rva'. | 23 // subtract |adjust_pointer_to_rva|. |
44 const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva; | 24 const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva; |
45 | 25 |
46 std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin(); | 26 std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin(); |
47 | 27 |
48 // Find the rel32 relocations. | 28 // Find the rel32 relocations. |
49 const uint8_t* p = start_pointer; | 29 const uint8_t* p = start_pointer; |
50 while (p < end_pointer) { | 30 while (p < end_pointer) { |
51 RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva); | 31 RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva); |
52 | 32 |
53 // Skip the base reloation table if we encounter it. | 33 // Skip the base reloation table if we encounter it. |
54 // Note: We're not bothering to handle the edge case where a Rel32 pointer | 34 // Note: We're not bothering to handle the edge case where a Rel32 pointer |
55 // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it. | 35 // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it. |
56 if (current_rva == relocs_start_rva_) { | 36 if (current_rva >= relocs_start_rva_ && current_rva < relocs_end_rva_) { |
57 if (relocs_start_rva_ < relocs_end_rva_) { | 37 p += relocs_end_rva_ - current_rva; |
58 p += relocs_end_rva_ - relocs_start_rva_; | 38 continue; |
59 continue; | |
60 } | |
61 } | 39 } |
62 | 40 |
63 // Heuristic discovery of rel32 locations in instruction stream: are the | 41 // Heuristic discovery of rel32 locations in instruction stream: are the |
64 // next few bytes the start of an instruction containing a rel32 | 42 // next few bytes the start of an instruction containing a rel32 |
65 // addressing mode? | 43 // addressing mode? |
66 const uint8_t* rel32 = nullptr; | 44 const uint8_t* rel32 = nullptr; |
67 | 45 |
68 if (p + 5 <= end_pointer) { | 46 if (p + 5 <= end_pointer) { |
69 if (*p == 0xE8 || *p == 0xE9) { // jmp rel32 and call rel32 | 47 if (p[0] == 0xE8 || p[0] == 0xE9) { // jmp rel32 and call rel32 |
70 rel32 = p + 1; | 48 rel32 = p + 1; |
71 } | 49 } |
72 } | 50 } |
73 if (p + 6 <= end_pointer) { | 51 if (p + 6 <= end_pointer) { |
74 if (*p == 0x0F && (*(p+1) & 0xF0) == 0x80) { // Jcc long form | 52 if (p[0] == 0x0F && (p[1] & 0xF0) == 0x80) { // Jcc long form |
75 if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely | 53 if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely |
76 rel32 = p + 2; | 54 rel32 = p + 2; |
77 } | 55 } |
78 } | 56 } |
79 if (rel32) { | 57 if (rel32) { |
80 RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva); | 58 RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva); |
81 | 59 |
82 // Is there an abs32 reloc overlapping the candidate? | 60 // Is there an abs32 reloc overlapping the candidate? |
83 while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3) | 61 while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3) |
84 ++abs32_pos; | 62 ++abs32_pos; |
85 // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte | 63 // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte |
(...skipping 18 matching lines...) Expand all Loading... |
104 #endif | 82 #endif |
105 p = rel32 + 4; | 83 p = rel32 + 4; |
106 continue; | 84 continue; |
107 } | 85 } |
108 } | 86 } |
109 p += 1; | 87 p += 1; |
110 } | 88 } |
111 } | 89 } |
112 | 90 |
113 } // namespace courgette | 91 } // namespace courgette |
OLD | NEW |