Refactor rel32 searching process for x64 to make it more similar to x86.

courgette/rel32_finder_x86.cc

Index: courgette/rel32_finder_x86.cc
diff --git a/courgette/rel32_finder_win32_x86.cc b/courgette/rel32_finder_x86.cc
similarity index 60%
rename from courgette/rel32_finder_win32_x86.cc
rename to courgette/rel32_finder_x86.cc
index 61ff9696d5ac19174d514c8930111e64c326342e..13ce7c365381e646fe6bf39c07e383a4d4359214 100644
--- a/courgette/rel32_finder_win32_x86.cc
+++ b/courgette/rel32_finder_x86.cc
@@ -2,45 +2,25 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <stdint.h>
-
-#include "courgette/rel32_finder_win32_x86.h"
+#include "courgette/rel32_finder_x86.h"
 
 namespace courgette {
 
-Rel32FinderWin32X86::Rel32FinderWin32X86(RVA relocs_start_rva,
-                                         RVA relocs_end_rva)
-    : relocs_start_rva_(relocs_start_rva), relocs_end_rva_(relocs_end_rva) {
-}
-
-Rel32FinderWin32X86::~Rel32FinderWin32X86() {
-}
-
-void Rel32FinderWin32X86::SwapRel32Locations(std::vector<RVA>* dest) {
-  dest->swap(rel32_locations_);
-}
-
-#if COURGETTE_HISTOGRAM_TARGETS
-void Rel32FinderWin32X86::SwapRel32TargetRVAs(std::map<RVA, int>* dest) {
-  dest->swap(rel32_target_rvas_);
-}
-#endif
-
-Rel32FinderWin32X86_Basic::Rel32FinderWin32X86_Basic(RVA relocs_start_rva,
-                                                     RVA relocs_end_rva)
-    : Rel32FinderWin32X86(relocs_start_rva, relocs_end_rva) {
-}
-
-Rel32FinderWin32X86_Basic::~Rel32FinderWin32X86_Basic() {
-}
-
-void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
-                                     const uint8_t* end_pointer,
-                                     RVA start_rva,
-                                     RVA end_rva,
-                                     const std::vector<RVA>& abs32_locations) {
+Rel32FinderX86::Rel32FinderX86(RVA relocs_start_rva, RVA relocs_end_rva)
+    : Rel32Finder(relocs_start_rva, relocs_end_rva) {}
+
+// Scan for opcodes matching the following instructions :
+//  rel32 JMP/CALL
+//  Jcc (excluding JPO/JPE)
+// Falsely detected rel32 that collide with known abs32 or that point outside
+// valid regions are discarded.
+void Rel32FinderX86::Find(const uint8_t* start_pointer,
+                          const uint8_t* end_pointer,
+                          RVA start_rva,
+                          RVA end_rva,
+                          const std::vector<RVA>& abs32_locations) {
   // Quick way to convert from Pointer to RVA within a single Section is to
-  // subtract 'pointer_to_rva'.
+  // subtract 'adjust_pointer_to_rva'.

[huangs, 2016/05/30 05:48:35]

NIT: |adjust_pointer_to_rva|.

[etiennep, 2016/05/30 17:07:30]

Done.

   const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva;
 
   std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin();
@@ -53,11 +33,9 @@ void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
     // Skip the base reloation table if we encounter it.
     // Note: We're not bothering to handle the edge case where a Rel32 pointer
     // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it.
-    if (current_rva == relocs_start_rva_) {
-      if (relocs_start_rva_ < relocs_end_rva_) {
-        p += relocs_end_rva_ - relocs_start_rva_;
-        continue;
-      }
+    if (current_rva >= relocs_start_rva_ && current_rva < relocs_end_rva_) {
+      p += relocs_end_rva_ - current_rva;
+      continue;
     }
 
     // Heuristic discovery of rel32 locations in instruction stream: are the
@@ -66,13 +44,13 @@ void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
     const uint8_t* rel32 = nullptr;
 
     if (p + 5 <= end_pointer) {
-      if (*p == 0xE8 || *p == 0xE9) {  // jmp rel32 and call rel32
+      if (p[0] == 0xE8 || p[0] == 0xE9) {  // jmp rel32 and call rel32
         rel32 = p + 1;
       }
     }
     if (p + 6 <= end_pointer) {
-      if (*p == 0x0F  &&  (*(p+1) & 0xF0) == 0x80) {  // Jcc long form
-        if (p[1] != 0x8A && p[1] != 0x8B)  // JPE/JPO unlikely
+      if (p[0] == 0x0F && (p[1] & 0xF0) == 0x80) {  // Jcc long form
+        if (p[1] != 0x8A && p[1] != 0x8B)           // JPE/JPO unlikely
           rel32 = p + 2;
       }
     }