| Index: courgette/rel32_finder_x64.cc
|
| diff --git a/courgette/rel32_finder_win32_x86.cc b/courgette/rel32_finder_x64.cc
|
| similarity index 52%
|
| copy from courgette/rel32_finder_win32_x86.cc
|
| copy to courgette/rel32_finder_x64.cc
|
| index 61ff9696d5ac19174d514c8930111e64c326342e..fa68bb6a165c91ce0a7414ebeb8f2eb033f64542 100644
|
| --- a/courgette/rel32_finder_win32_x86.cc
|
| +++ b/courgette/rel32_finder_x64.cc
|
| @@ -1,44 +1,22 @@
|
| -// Copyright 2015 The Chromium Authors. All rights reserved.
|
| +// Copyright 2016 The Chromium Authors. All rights reserved.
|
| // Use of this source code is governed by a BSD-style license that can be
|
| // found in the LICENSE file.
|
|
|
| #include <stdint.h>
|
|
|
| -#include "courgette/rel32_finder_win32_x86.h"
|
| +#include "courgette/rel32_finder_x64.h"
|
|
|
| namespace courgette {
|
|
|
| -Rel32FinderWin32X86::Rel32FinderWin32X86(RVA relocs_start_rva,
|
| - RVA relocs_end_rva)
|
| - : relocs_start_rva_(relocs_start_rva), relocs_end_rva_(relocs_end_rva) {
|
| -}
|
| -
|
| -Rel32FinderWin32X86::~Rel32FinderWin32X86() {
|
| -}
|
| -
|
| -void Rel32FinderWin32X86::SwapRel32Locations(std::vector<RVA>* dest) {
|
| - dest->swap(rel32_locations_);
|
| -}
|
| +Rel32FinderX64::Rel32FinderX64(RVA relocs_start_rva, RVA relocs_end_rva)
|
| + : Rel32Finder(relocs_start_rva, relocs_end_rva) {}
|
|
|
| -#if COURGETTE_HISTOGRAM_TARGETS
|
| -void Rel32FinderWin32X86::SwapRel32TargetRVAs(std::map<RVA, int>* dest) {
|
| - dest->swap(rel32_target_rvas_);
|
| -}
|
| -#endif
|
| -
|
| -Rel32FinderWin32X86_Basic::Rel32FinderWin32X86_Basic(RVA relocs_start_rva,
|
| - RVA relocs_end_rva)
|
| - : Rel32FinderWin32X86(relocs_start_rva, relocs_end_rva) {
|
| -}
|
| -
|
| -Rel32FinderWin32X86_Basic::~Rel32FinderWin32X86_Basic() {
|
| -}
|
| -
|
| -void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
|
| - const uint8_t* end_pointer,
|
| - RVA start_rva,
|
| - RVA end_rva,
|
| - const std::vector<RVA>& abs32_locations) {
|
| +void Rel32FinderX64::Find(const uint8_t* start_pointer,
|
| + const uint8_t* end_pointer,
|
| + RVA start_rva,
|
| + RVA end_rva,
|
| + uint32_t size_of_image,
|
| + const std::vector<RVA>& abs32_locations) {
|
| // Quick way to convert from Pointer to RVA within a single Section is to
|
| // subtract 'pointer_to_rva'.
|
| const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva;
|
| @@ -53,29 +31,41 @@ void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
|
| // Skip the base reloation table if we encounter it.
|
| // Note: We're not bothering to handle the edge case where a Rel32 pointer
|
| // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it.
|
| - if (current_rva == relocs_start_rva_) {
|
| - if (relocs_start_rva_ < relocs_end_rva_) {
|
| - p += relocs_end_rva_ - relocs_start_rva_;
|
| - continue;
|
| - }
|
| + if (current_rva >= relocs_start_rva_ && current_rva < relocs_end_rva_) {
|
| + p += relocs_end_rva_ - current_rva;
|
| + continue;
|
| }
|
|
|
| // Heuristic discovery of rel32 locations in instruction stream: are the
|
| // next few bytes the start of an instruction containing a rel32
|
| // addressing mode?
|
| const uint8_t* rel32 = nullptr;
|
| + bool is_rip_relative = false;
|
|
|
| if (p + 5 <= end_pointer) {
|
| - if (*p == 0xE8 || *p == 0xE9) { // jmp rel32 and call rel32
|
| + if (*p == 0xE8 || *p == 0xE9) // jmp rel32 and call rel32
|
| rel32 = p + 1;
|
| - }
|
| }
|
| if (p + 6 <= end_pointer) {
|
| - if (*p == 0x0F && (*(p+1) & 0xF0) == 0x80) { // Jcc long form
|
| - if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
|
| + if (*p == 0x0F && (*(p + 1) & 0xF0) == 0x80) { // Jcc long form
|
| + if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
|
| rel32 = p + 2;
|
| + } else if ((*p == 0xFF && (*(p + 1) == 0x15 || *(p + 1) == 0x25)) ||
|
| + ((*p == 0x8B || *p == 0x8D) && (*(p + 1) & 0xC7) == 0x05)) {
|
| + // rip relative call/jmp/lea
|
| + rel32 = p + 2;
|
| + is_rip_relative = true;
|
| + }
|
| + }
|
| + if (p + 7 <= end_pointer) {
|
| + if ((*p & 0xFB) == 0x48 && (*(p + 1) == 0x8D || *(p + 1) == 0x8B) &&
|
| + (*(p + 2) & 0xC7) == 0x05) {
|
| + // rip relative lea
|
| + rel32 = p + 3;
|
| + is_rip_relative = true;
|
| }
|
| }
|
| +
|
| if (rel32) {
|
| RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
|
|
|
| @@ -87,17 +77,18 @@ void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
|
| if (abs32_pos != abs32_locations.end()) {
|
| if (*abs32_pos < rel32_rva + 4) {
|
| // Beginning of abs32 reloc is before end of rel32 reloc so they
|
| - // overlap. Skip four bytes past the abs32 reloc.
|
| + // overlap. Skip four bytes past the abs32 reloc.
|
| p += (*abs32_pos + 4) - current_rva;
|
| continue;
|
| }
|
| }
|
|
|
| - // + 4 since offset is relative to start of next instruction.
|
| RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32);
|
| - // Valid, rel32 target must be within image, and within this section.
|
| - // Subsumes |target_rva| != |kUnassignedRVA|.
|
| - if (start_rva <= target_rva && target_rva < end_rva) {
|
| + // To be valid, rel32 target must be within image, and within this
|
| + // section.
|
| + if (target_rva < size_of_image && // Subsumes rva != kUnassignedRVA.
|
| + (is_rip_relative ||
|
| + (start_rva <= target_rva && target_rva < end_rva))) {
|
| rel32_locations_.push_back(rel32_rva);
|
| #if COURGETTE_HISTOGRAM_TARGETS
|
| ++rel32_target_rvas_[target_rva];
|
|
|