Update mach_override to upstream 1a1bb352

third_party/mach_override/mach_override.c

-/*******************************************************************************
-        mach_override.c
-                Copyright (c) 2003-2009 Jonathan 'Wolf' Rentzsch: <http://rentzsch.com>
-                Some rights reserved: <http://opensource.org/licenses/mit-license.php>
+// mach_override.c semver:1.2.0

[Mark Mentovai, 2013/11/05 23:35:37]

This patch set, patch set 1, contains the virgin upstream source.

+//   Copyright (c) 2003-2012 Jonathan 'Wolf' Rentzsch: http://rentzsch.com
+//   Some rights reserved: http://opensource.org/licenses/mit
+//   https://github.com/rentzsch/mach_override
 
-        ***************************************************************************/
-
 #include "mach_override.h"
+#if defined(__i386__) || defined(__x86_64__)
+#include "udis86.h"
+#endif
 
 #include <mach-o/dyld.h>
 #include <mach/mach_host.h>
 #include <mach/mach_init.h>
 #include <mach/vm_map.h>
-#include <mach/vm_statistics.h>
 #include <sys/mman.h>
 
 #include <CoreServices/CoreServices.h>
 
 /**************************
 *       
 *       Constants
 *       
 **************************/
 #pragma mark    -
 #pragma mark    (Constants)
 
-#define kPageSize 4096
 #if defined(__ppc__) || defined(__POWERPC__)
 
 long kIslandTemplate[] = {
         0x9001FFFC,     //      stw             r0,-4(SP)
         0x3C00DEAD,     //      lis             r0,0xDEAD
         0x6000BEEF,     //      ori             r0,r0,0xBEEF
         0x7C0903A6,     //      mtctr   r0
         0x8001FFFC,     //      lwz             r0,-4(SP)
         0x60000000,     //      nop             ; optionally replaced
         0x4E800420      //      bctr
@@ skipping 33 matching lines @@
         0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 
         0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
         // Now the real jump instruction
         0xFF, 0x25, 0x00, 0x00, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00
 };
 
 #endif
 
+#define kAllocateHigh           1
+#define kAllocateNormal         0
+
 /**************************
 *       
 *       Data Types
 *       
 **************************/
 #pragma mark    -
 #pragma mark    (Data Types)
 
 typedef struct  {
         char    instructions[sizeof(kIslandTemplate)];
+        int             allocatedHigh;
 }       BranchIsland;
 
 /**************************
 *       
 *       Funky Protos
 *       
 **************************/
 #pragma mark    -
 #pragma mark    (Funky Protos)
 
         mach_error_t
 allocateBranchIsland(
                 BranchIsland    **island,
+                int                             allocateHigh,
                 void *originalFunctionAddress);
 
         mach_error_t
 freeBranchIsland(
                 BranchIsland    *island );
 
 #if defined(__ppc__) || defined(__POWERPC__)
         mach_error_t
 setBranchIslandTarget(
                 BranchIsland    *island,
@@ skipping 34 matching lines @@
 *       
 *       Interface
 *       
 *******************************************************************************/
 #pragma mark    -
 #pragma mark    (Interface)
 
 #if defined(__i386__) || defined(__x86_64__)
 mach_error_t makeIslandExecutable(void *address) {
         mach_error_t err = err_none;
-    uintptr_t page = (uintptr_t)address & ~(uintptr_t)(kPageSize-1);
+    vm_size_t pageSize;
+    host_page_size( mach_host_self(), &pageSize );
+    uintptr_t page = (uintptr_t)address & ~(uintptr_t)(pageSize-1);
     int e = err_none;
-    e |= mprotect((void *)page, kPageSize, PROT_EXEC | PROT_READ);
-    e |= msync((void *)page, kPageSize, MS_INVALIDATE );
+    e |= mprotect((void *)page, pageSize, PROT_EXEC | PROT_READ | PROT_WRITE);
+    e |= msync((void *)page, pageSize, MS_INVALIDATE );
     if (e) {
         err = err_cannot_override;
     }
     return err;
 }
 #endif
 
     mach_error_t
 mach_override_ptr(
         void *originalFunctionAddress,
@@ skipping 57 matching lines @@
                 if( err )
                         err = vm_protect( mach_task_self(),
                                         (vm_address_t) originalFunctionPtr, 8, false,
                                         (VM_PROT_DEFAULT | VM_PROT_COPY) );
         }
         if (err) fprintf(stderr, "err = %x %s:%d\n", err, __FILE__, __LINE__);
         
         //      Allocate and target the escape island to the overriding function.
         BranchIsland    *escapeIsland = NULL;
         if( !err )      
-                err = allocateBranchIsland( &escapeIsland, originalFunctionAddress );
+                err = allocateBranchIsland( &escapeIsland, kAllocateHigh, originalFunctionAddress );
                 if (err) fprintf(stderr, "err = %x %s:%d\n", err, __FILE__, __LINE__);
 
         
 #if defined(__ppc__) || defined(__POWERPC__)
         if( !err )
                 err = setBranchIslandTarget( escapeIsland, overrideFunctionAddress, 0 );
         
         //      Build the branch absolute instruction to the escape island.
         long    branchAbsoluteInstruction = 0; // Set to 0 just to silence warning.
         if( !err ) {
@@ skipping 21 matching lines @@
                 jumpRelativeInstruction = OSSwapInt64(jumpRelativeInstruction);         
         }
 #endif
         
         //      Optionally allocate & return the reentry island. This may contain relocated
         //  jmp instructions and so has all the same addressing reachability requirements
         //  the escape island has to the original function, except the escape island is
         //  technically our original function.
         BranchIsland    *reentryIsland = NULL;
         if( !err && originalFunctionReentryIsland ) {
-                err = allocateBranchIsland( &reentryIsland, escapeIsland);
+                err = allocateBranchIsland( &reentryIsland, kAllocateHigh, escapeIsland);
                 if( !err )
                         *originalFunctionReentryIsland = reentryIsland;
         }
         
 #if defined(__ppc__) || defined(__POWERPC__)    
         //      Atomically:
         //      o If the reentry island was allocated:
         //              o Insert the original instruction into the reentry island.
         //              o Target the reentry island at the 2nd instruction of the
         //                original function.
@@ skipping 37 matching lines @@
                                                                                  (void*) ((char *)originalFunctionPtr+eatenCount), originalInstructions );
                 // try making islands executable before planting the jmp
 #if defined(__x86_64__) || defined(__i386__)
         if( !err )
             err = makeIslandExecutable(escapeIsland);
         if( !err && reentryIsland )
             err = makeIslandExecutable(reentryIsland);
 #endif
                 if ( !err )
                         atomic_mov64((uint64_t *)originalFunctionPtr, jumpRelativeInstruction);
-
-                mach_error_t prot_err = err_none;       
-                prot_err = vm_protect( mach_task_self(),
-                                       (vm_address_t) originalFunctionPtr, 8, false,
-                                       (VM_PROT_READ | VM_PROT_EXECUTE) );
-                if (prot_err) fprintf(stderr, "err = %x %s:%d\n", prot_err, __FILE__, __LINE__);    
         }
 #endif
         
         //      Clean up on error.
         if( err ) {
                 if( reentryIsland )
                         freeBranchIsland( reentryIsland );
                 if( escapeIsland )
                         freeBranchIsland( escapeIsland );
         }
 
         return err;
 }
 
 /*******************************************************************************
 *       
 *       Implementation
 *       
 *******************************************************************************/
 #pragma mark    -
 #pragma mark    (Implementation)
 
-/***************************************************************************//**
+/*******************************************************************************
         Implementation: Allocates memory for a branch island.
         
         @param  island                  <-      The allocated island.
+        @param  allocateHigh    ->      Whether to allocate the island at the end of the
+                                                                address space (for use with the branch absolute
+                                                                instruction).
         @result                                 <-      mach_error_t
 
         ***************************************************************************/
 
         mach_error_t
 allocateBranchIsland(
                 BranchIsland    **island,
+                int                             allocateHigh,
                 void *originalFunctionAddress)
 {
         assert( island );
         
-        assert( sizeof( BranchIsland ) <= kPageSize );
-#if defined(__i386__)
-        vm_address_t page = 0;
-        mach_error_t err = vm_allocate( mach_task_self(), &page, kPageSize, VM_FLAGS_ANYWHERE );
-        if( err == err_none ) {
-                *island = (BranchIsland*) page;
-                return err_none;
-        }
-        return err;
+        mach_error_t    err = err_none;
+        
+        if( allocateHigh ) {
+                vm_size_t pageSize;
+                err = host_page_size( mach_host_self(), &pageSize );
+                if( !err ) {
+                        assert( sizeof( BranchIsland ) <= pageSize );
+#if defined(__ppc__) || defined(__POWERPC__)
+                        vm_address_t first = 0xfeffffff;
+                        vm_address_t last = 0xfe000000 + pageSize;
+#elif defined(__x86_64__)
+                        vm_address_t first = ((uint64_t)originalFunctionAddress & ~(uint64_t)(((uint64_t)1 << 31) - 1)) | ((uint64_t)1 << 31); // start in the middle of the page?
+                        vm_address_t last = 0x0;
 #else
-
-#if defined(__ppc__) || defined(__POWERPC__)
-        vm_address_t first = 0xfeffffff;
-        vm_address_t last = 0xfe000000 + kPageSize;
-#elif defined(__x86_64__)
-        vm_address_t first = ((uint64_t)originalFunctionAddress & ~(uint64_t)(((uint64_t)1 << 31) - 1)) | ((uint64_t)1 << 31); // start in the middle of the page?
-        vm_address_t last = 0x0;
+                        vm_address_t first = 0xffc00000;
+                        vm_address_t last = 0xfffe0000;
 #endif
 
-        vm_address_t page = first;
-        vm_map_t task_self = mach_task_self();
+                        vm_address_t page = first;
+                        int allocated = 0;
+                        vm_map_t task_self = mach_task_self();
+                        
+                        while( !err && !allocated && page != last ) {
 
-        while( page != last ) {
-                mach_error_t err = vm_allocate( task_self, &page, kPageSize, 0 );
-                if( err == err_none ) {
-                        *island = (BranchIsland*) page;
-                        return err_none;
-                }
-                if( err != KERN_NO_SPACE )
-                        return err;
+                                err = vm_allocate( task_self, &page, pageSize, 0 );
+                                if( err == err_none )
+                                        allocated = 1;
+                                else if( err == KERN_NO_SPACE ) {
 #if defined(__x86_64__)
-                page -= kPageSize;
+                                        page -= pageSize;
 #else
-                page += kPageSize;
+                                        page += pageSize;
 #endif
-                err = err_none;
+                                        err = err_none;
+                                }
+                        }
+                        if( allocated )
+                                *island = (BranchIsland*) page;
+                        else if( !allocated && !err )
+                                err = KERN_NO_SPACE;
+                }
+        } else {
+                void *block = malloc( sizeof( BranchIsland ) );
+                if( block )
+                        *island = block;
+                else
+                        err = KERN_NO_SPACE;
         }
-
-        return KERN_NO_SPACE;
-#endif
+        if( !err )
+                (**island).allocatedHigh = allocateHigh;
+        
+        return err;
 }
 
-/***************************************************************************//**
+/*******************************************************************************
         Implementation: Deallocates memory for a branch island.
         
         @param  island  ->      The island to deallocate.
         @result                 <-      mach_error_t
 
         ***************************************************************************/
 
         mach_error_t
 freeBranchIsland(
                 BranchIsland    *island )
 {
         assert( island );
         assert( (*(long*)&island->instructions[0]) == kIslandTemplate[0] );
-        assert( sizeof( BranchIsland ) <= kPageSize );
-        return vm_deallocate( mach_task_self(), (vm_address_t) island,
-                              kPageSize );
+        assert( island->allocatedHigh );
+        
+        mach_error_t    err = err_none;
+        
+        if( island->allocatedHigh ) {
+                vm_size_t pageSize;
+                err = host_page_size( mach_host_self(), &pageSize );
+                if( !err ) {
+                        assert( sizeof( BranchIsland ) <= pageSize );
+                        err = vm_deallocate(
+                                        mach_task_self(),
+                                        (vm_address_t) island, pageSize );
+                }
+        } else {
+                free( island );
+        }
+        
+        return err;
 }
 
-/***************************************************************************//**
+/*******************************************************************************
         Implementation: Sets the branch island's target, with an optional
         instruction.
         
         @param  island          ->      The branch island to insert target into.
         @param  branchTo        ->      The address of the target.
         @param  instruction     ->      Optional instruction to execute prior to branch. Set
                                                         to zero for nop.
         @result                         <-      mach_error_t
 
         ***************************************************************************/
@@ skipping 69 matching lines @@
     //  Fill in the address.
     *((uint64_t *)(island->instructions + kJumpAddress)) = (uint64_t)branchTo; 
     msync( island->instructions, sizeof( kIslandTemplate ), MS_INVALIDATE );
 
     return err_none;
 }
 #endif
 
 
 #if defined(__i386__) || defined(__x86_64__)
-// simplistic instruction matching
-typedef struct {
-        unsigned int length; // max 15
-        unsigned char mask[15]; // sequence of bytes in memory order
-        unsigned char constraint[15]; // sequence of bytes in memory order
-}       AsmInstructionMatch;
-
-#if defined(__i386__)
-static AsmInstructionMatch possibleInstructions[] = {
-        { 0x5, {0xFF, 0x00, 0x00, 0x00, 0x00}, {0xE9, 0x00, 0x00, 0x00, 0x00} },        // jmp 0x????????
-        { 0x5, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF}, {0x55, 0x89, 0xe5, 0xc9, 0xc3} },        // push %ebp; mov %esp,%ebp; leave; ret
-        { 0x1, {0xFF}, {0x90} },                                                        // nop
-        { 0x1, {0xFF}, {0x55} },                                                        // push %esp
-        { 0x2, {0xFF, 0xFF}, {0x89, 0xE5} },                                            // mov %esp,%ebp
-        { 0x1, {0xFF}, {0x53} },                                                        // push %ebx
-        { 0x3, {0xFF, 0xFF, 0x00}, {0x83, 0xEC, 0x00} },                                // sub 0x??, %esp
-        { 0x6, {0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00}, {0x81, 0xEC, 0x00, 0x00, 0x00, 0x00} },    // sub 0x??, %esp with 32bit immediate
-        { 0x1, {0xFF}, {0x57} },                                                        // push %edi
-        { 0x1, {0xFF}, {0x56} },                                                        // push %esi
-        { 0x2, {0xFF, 0xFF}, {0x31, 0xC0} },                                            // xor %eax, %eax
-        { 0x3, {0xFF, 0x4F, 0x00}, {0x8B, 0x45, 0x00} },  // mov $imm(%ebp), %reg
-        { 0x3, {0xFF, 0x4C, 0x00}, {0x8B, 0x40, 0x00} },  // mov $imm(%eax-%edx), %reg
-        { 0x4, {0xFF, 0xFF, 0xFF, 0x00}, {0x8B, 0x4C, 0x24, 0x00} },  // mov $imm(%esp), %ecx
-        { 0x5, {0xFF, 0x00, 0x00, 0x00, 0x00}, {0xB8, 0x00, 0x00, 0x00, 0x00} },        // mov $imm, %eax
-        { 0x0 }
-};
-#elif defined(__x86_64__)
-static AsmInstructionMatch possibleInstructions[] = {
-        { 0x5, {0xFF, 0x00, 0x00, 0x00, 0x00}, {0xE9, 0x00, 0x00, 0x00, 0x00} },        // jmp 0x????????
-        { 0x1, {0xFF}, {0x90} },                                                        // nop
-        { 0x1, {0xF8}, {0x50} },                                                        // push %rX
-        { 0x3, {0xFF, 0xFF, 0xFF}, {0x48, 0x89, 0xE5} },                                // mov %rsp,%rbp
-        { 0x4, {0xFF, 0xFF, 0xFF, 0x00}, {0x48, 0x83, 0xEC, 0x00} },                    // sub 0x??, %rsp
-        { 0x4, {0xFB, 0xFF, 0x00, 0x00}, {0x48, 0x89, 0x00, 0x00} },                    // move onto rbp
-        { 0x2, {0xFF, 0x00}, {0x41, 0x00} },                                            // push %rXX
-        { 0x2, {0xFF, 0x00}, {0x85, 0x00} },                                            // test %rX,%rX
-        { 0x5, {0xF8, 0x00, 0x00, 0x00, 0x00}, {0xB8, 0x00, 0x00, 0x00, 0x00} },   // mov $imm, %reg
-        { 0x3, {0xFF, 0xFF, 0x00}, {0xFF, 0x77, 0x00} },  // pushq $imm(%rdi)
-        { 0x2, {0xFF, 0xFF}, {0x31, 0xC0} },                                            // xor %eax, %eax
-    { 0x2, {0xFF, 0xFF}, {0x89, 0xF8} },                        // mov %edi, %eax
-        { 0x0 }
-};
-#endif
-
-static Boolean codeMatchesInstruction(unsigned char *code, AsmInstructionMatch* instruction) 
-{
-        Boolean match = true;
-        
-        size_t i;
-        for (i=0; i<instruction->length; i++) {
-                unsigned char mask = instruction->mask[i];
-                unsigned char constraint = instruction->constraint[i];
-                unsigned char codeValue = code[i];
-                                
-                match = ((codeValue & mask) == constraint);
-                if (!match) break;
-        }
-        
-        return match;
-}
-
-#if defined(__i386__) || defined(__x86_64__)
         static Boolean 
 eatKnownInstructions( 
         unsigned char   *code, 
         uint64_t                *newInstruction,
         int                             *howManyEaten, 
         char                    *originalInstructions,
         int                             *originalInstructionCount, 
         uint8_t                 *originalInstructionSizes )
 {
         Boolean allInstructionsKnown = true;
         int totalEaten = 0;
-        unsigned char* ptr = code;
         int remainsToEat = 5; // a JMP instruction takes 5 bytes
         int instructionIndex = 0;
+        ud_t ud_obj;
         
         if (howManyEaten) *howManyEaten = 0;
         if (originalInstructionCount) *originalInstructionCount = 0;
+        ud_init(&ud_obj);
+#if defined(__i386__)
+        ud_set_mode(&ud_obj, 32);
+#else
+        ud_set_mode(&ud_obj, 64);
+#endif
+        ud_set_input_buffer(&ud_obj, code, 64); // Assume that 'code' points to at least 64bytes of data.
         while (remainsToEat > 0) {
-                Boolean curInstructionKnown = false;
-                
-                // See if instruction matches one  we know
-                AsmInstructionMatch* curInstr = possibleInstructions;
-                do { 
-                        if ((curInstructionKnown = codeMatchesInstruction(ptr, curInstr))) break;
-                        curInstr++;
-                } while (curInstr->length > 0);
-                
-                // if all instruction matches failed, we don't know current instruction then, stop here
-                if (!curInstructionKnown) { 
-                        allInstructionsKnown = false;
-                        fprintf(stderr, "mach_override: some instructions unknown! Need to update mach_override.c\n");
-                        break;
+                if (!ud_disassemble(&ud_obj)) {
+                    allInstructionsKnown = false;
+                    fprintf(stderr, "mach_override: some instructions unknown! Need to update libudis86\n");
+                    break;
                 }
                 
                 // At this point, we've matched curInstr
-                int eaten = curInstr->length;
-                ptr += eaten;
+                int eaten = ud_insn_len(&ud_obj);
                 remainsToEat -= eaten;
                 totalEaten += eaten;
                 
                 if (originalInstructionSizes) originalInstructionSizes[instructionIndex] = eaten;
                 instructionIndex += 1;
                 if (originalInstructionCount) *originalInstructionCount = instructionIndex;
         }
 
 
         if (howManyEaten) *howManyEaten = totalEaten;
@@ skipping 40 matching lines @@
                         uint32_t offset = (uintptr_t)originalFunction - (uintptr_t)escapeIsland;
                         uint32_t *jumpOffsetPtr = (uint32_t*)((uintptr_t)instructionsToFix + 1);
                         *jumpOffsetPtr += offset;
                 }
                 
                 originalFunction = (void*)((uintptr_t)originalFunction + instructionSizes[index]);
                 escapeIsland = (void*)((uintptr_t)escapeIsland + instructionSizes[index]);
                 instructionsToFix = (void*)((uintptr_t)instructionsToFix + instructionSizes[index]);
     }
 }
-#endif
 
 #if defined(__i386__)
 __asm(
                         ".text;"
                         ".align 2, 0x90;"
                         "_atomic_mov64:;"
                         "       pushl %ebp;"
                         "       movl %esp, %ebp;"
                         "       pushl %esi;"
                         "       pushl %ebx;"
@@ skipping 25 matching lines @@
 );
 #elif defined(__x86_64__)
 void atomic_mov64(
                 uint64_t *targetAddress,
                 uint64_t value )
 {
     *targetAddress = value;
 }
 #endif
 #endif