1 //===-- interception.h ------------------------------------------*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is a part of AddressSanitizer, an address sanity checker. 10 // 11 // Machinery for providing replacements/wrappers for system functions. 12 //===----------------------------------------------------------------------===// 13 14 #ifndef INTERCEPTION_H 15 #define INTERCEPTION_H 16 17 #include "sanitizer_common/sanitizer_asm.h" 18 #include "sanitizer_common/sanitizer_internal_defs.h" 19 20 #if !SANITIZER_LINUX && !SANITIZER_FREEBSD && !SANITIZER_APPLE && \ 21 !SANITIZER_NETBSD && !SANITIZER_WINDOWS && !SANITIZER_FUCHSIA && \ 22 !SANITIZER_SOLARIS 23 # error "Interception doesn't work on this operating system." 24 #endif 25 26 // These typedefs should be used only in the interceptor definitions to replace 27 // the standard system types (e.g. SSIZE_T instead of ssize_t) 28 typedef __sanitizer::uptr SIZE_T; 29 typedef __sanitizer::sptr SSIZE_T; 30 typedef __sanitizer::sptr PTRDIFF_T; 31 typedef __sanitizer::s64 INTMAX_T; 32 typedef __sanitizer::u64 UINTMAX_T; 33 typedef __sanitizer::OFF_T OFF_T; 34 typedef __sanitizer::OFF64_T OFF64_T; 35 36 // How to add an interceptor: 37 // Suppose you need to wrap/replace system function (generally, from libc): 38 // int foo(const char *bar, double baz); 39 // You'll need to: 40 // 1) define INTERCEPTOR(int, foo, const char *bar, double baz) { ... } in 41 // your source file. See the notes below for cases when 42 // INTERCEPTOR_WITH_SUFFIX(...) should be used instead. 43 // 2) Call "INTERCEPT_FUNCTION(foo)" prior to the first call of "foo". 44 // INTERCEPT_FUNCTION(foo) evaluates to "true" iff the function was 45 // intercepted successfully. 46 // You can access original function by calling REAL(foo)(bar, baz). 47 // By default, REAL(foo) will be visible only inside your interceptor, and if 48 // you want to use it in other parts of RTL, you'll need to: 49 // 3a) add DECLARE_REAL(int, foo, const char*, double) to a 50 // header file. 51 // However, if the call "INTERCEPT_FUNCTION(foo)" and definition for 52 // INTERCEPTOR(..., foo, ...) are in different files, you'll instead need to: 53 // 3b) add DECLARE_REAL_AND_INTERCEPTOR(int, foo, const char*, double) 54 // to a header file. 55 56 // Notes: 1. Things may not work properly if macro INTERCEPTOR(...) {...} or 57 // DECLARE_REAL(...) are located inside namespaces. 58 // 2. On Mac you can also use: "OVERRIDE_FUNCTION(foo, zoo)" to 59 // effectively redirect calls from "foo" to "zoo". In this case 60 // you aren't required to implement 61 // INTERCEPTOR(int, foo, const char *bar, double baz) {...} 62 // but instead you'll have to add 63 // DECLARE_REAL(int, foo, const char *bar, double baz) in your 64 // source file (to define a pointer to overriden function). 65 // 3. Some Mac functions have symbol variants discriminated by 66 // additional suffixes, e.g. _$UNIX2003 (see 67 // https://developer.apple.com/library/mac/#releasenotes/Darwin/SymbolVariantsRelNotes/index.html 68 // for more details). To intercept such functions you need to use the 69 // INTERCEPTOR_WITH_SUFFIX(...) macro. 70 71 // How it works on Linux 72 // --------------------- 73 // 74 // To replace system functions on Linux we just need to declare functions with 75 // the same names in our library and then obtain the real function pointers 76 // using dlsym(). 77 // 78 // There is one complication: a user may also intercept some of the functions we 79 // intercept. To allow for up to 3 interceptors (including ours) of a given 80 // function "func", the interceptor implementation is in ___interceptor_func, 81 // which is aliased by a weak function __interceptor_func, which in turn is 82 // aliased (via a trampoline) by weak wrapper function "func". 83 // 84 // Most user interceptors should define a foreign interceptor as follows: 85 // 86 // - provide a non-weak function "func" that performs interception; 87 // - if __interceptor_func exists, call it to perform the real functionality; 88 // - if it does not exist, figure out the real function and call it instead. 89 // 90 // In rare cases, a foreign interceptor (of another dynamic analysis runtime) 91 // may be defined as follows (on supported architectures): 92 // 93 // - provide a non-weak function __interceptor_func that performs interception; 94 // - if ___interceptor_func exists, call it to perform the real functionality; 95 // - if it does not exist, figure out the real function and call it instead; 96 // - provide a weak function "func" that is an alias to __interceptor_func. 97 // 98 // With this protocol, sanitizer interceptors, foreign user interceptors, and 99 // foreign interceptors of other dynamic analysis runtimes, or any combination 100 // thereof, may co-exist simultaneously. 101 // 102 // How it works on Mac OS 103 // ---------------------- 104 // 105 // This is not so on Mac OS, where the two-level namespace makes our replacement 106 // functions invisible to other libraries. This may be overcomed using the 107 // DYLD_FORCE_FLAT_NAMESPACE, but some errors loading the shared libraries in 108 // Chromium were noticed when doing so. 109 // 110 // Instead we create a dylib containing a __DATA,__interpose section that 111 // associates library functions with their wrappers. When this dylib is 112 // preloaded before an executable using DYLD_INSERT_LIBRARIES, it routes all the 113 // calls to interposed functions done through stubs to the wrapper functions. 114 // 115 // As it's decided at compile time which functions are to be intercepted on Mac, 116 // INTERCEPT_FUNCTION() is effectively a no-op on this system. 117 118 #if SANITIZER_APPLE 119 #include <sys/cdefs.h> // For __DARWIN_ALIAS_C(). 120 121 // Just a pair of pointers. 122 struct interpose_substitution { 123 const __sanitizer::uptr replacement; 124 const __sanitizer::uptr original; 125 }; 126 127 // For a function foo() create a global pair of pointers { wrap_foo, foo } in 128 // the __DATA,__interpose section. 129 // As a result all the calls to foo() will be routed to wrap_foo() at runtime. 130 #define INTERPOSER(func_name) __attribute__((used)) \ 131 const interpose_substitution substitution_##func_name[] \ 132 __attribute__((section("__DATA, __interpose"))) = { \ 133 { reinterpret_cast<const uptr>(WRAP(func_name)), \ 134 reinterpret_cast<const uptr>(func_name) } \ 135 } 136 137 // For a function foo() and a wrapper function bar() create a global pair 138 // of pointers { bar, foo } in the __DATA,__interpose section. 139 // As a result all the calls to foo() will be routed to bar() at runtime. 140 #define INTERPOSER_2(func_name, wrapper_name) __attribute__((used)) \ 141 const interpose_substitution substitution_##func_name[] \ 142 __attribute__((section("__DATA, __interpose"))) = { \ 143 { reinterpret_cast<const uptr>(wrapper_name), \ 144 reinterpret_cast<const uptr>(func_name) } \ 145 } 146 147 # define WRAP(x) wrap_##x 148 # define TRAMPOLINE(x) WRAP(x) 149 # define INTERCEPTOR_ATTRIBUTE 150 # define DECLARE_WRAPPER(ret_type, func, ...) 151 152 #elif SANITIZER_WINDOWS 153 # define WRAP(x) __asan_wrap_##x 154 # define TRAMPOLINE(x) WRAP(x) 155 # define INTERCEPTOR_ATTRIBUTE __declspec(dllexport) 156 # define DECLARE_WRAPPER(ret_type, func, ...) \ 157 extern "C" ret_type func(__VA_ARGS__); 158 # define DECLARE_WRAPPER_WINAPI(ret_type, func, ...) \ 159 extern "C" __declspec(dllimport) ret_type __stdcall func(__VA_ARGS__); 160 #elif !SANITIZER_FUCHSIA // LINUX, FREEBSD, NETBSD, SOLARIS 161 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) 162 # if ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT 163 // Weak aliases of weak aliases do not work, therefore we need to set up a 164 // trampoline function. The function "func" is a weak alias to the trampoline 165 // (so that we may check if "func" was overridden), which calls the weak 166 // function __interceptor_func, which in turn aliases the actual interceptor 167 // implementation ___interceptor_func: 168 // 169 // [wrapper "func": weak] --(alias)--> [TRAMPOLINE(func)] 170 // | 171 // +--------(tail call)-------+ 172 // | 173 // v 174 // [__interceptor_func: weak] --(alias)--> [WRAP(func)] 175 // 176 // We use inline assembly to define most of this, because not all compilers 177 // support functions with the "naked" attribute with every architecture. 178 # define WRAP(x) ___interceptor_ ## x 179 # define TRAMPOLINE(x) __interceptor_trampoline_ ## x 180 # if SANITIZER_FREEBSD || SANITIZER_NETBSD 181 // FreeBSD's dynamic linker (incompliantly) gives non-weak symbols higher 182 // priority than weak ones so weak aliases won't work for indirect calls 183 // in position-independent (-fPIC / -fPIE) mode. 184 # define __ASM_WEAK_WRAPPER(func) ".globl " #func "\n" 185 # else 186 # define __ASM_WEAK_WRAPPER(func) ".weak " #func "\n" 187 # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD 188 # if defined(__arm__) || defined(__aarch64__) 189 # define ASM_TYPE_FUNCTION_STR "%function" 190 # else 191 # define ASM_TYPE_FUNCTION_STR "@function" 192 # endif 193 // Keep trampoline implementation in sync with sanitizer_common/sanitizer_asm.h 194 # define DECLARE_WRAPPER(ret_type, func, ...) \ 195 extern "C" ret_type func(__VA_ARGS__); \ 196 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \ 197 extern "C" ret_type __interceptor_##func(__VA_ARGS__) \ 198 INTERCEPTOR_ATTRIBUTE __attribute__((weak)) ALIAS(WRAP(func)); \ 199 asm( \ 200 ".text\n" \ 201 __ASM_WEAK_WRAPPER(func) \ 202 ".set " #func ", " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \ 203 ".globl " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \ 204 ".type " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \ 205 ASM_TYPE_FUNCTION_STR "\n" \ 206 SANITIZER_STRINGIFY(TRAMPOLINE(func)) ":\n" \ 207 SANITIZER_STRINGIFY(CFI_STARTPROC) "\n" \ 208 C_ASM_TAIL_CALL(SANITIZER_STRINGIFY(TRAMPOLINE(func)), \ 209 "__interceptor_" \ 210 SANITIZER_STRINGIFY(ASM_PREEMPTIBLE_SYM(func))) "\n" \ 211 SANITIZER_STRINGIFY(CFI_ENDPROC) "\n" \ 212 ".size " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \ 213 ".-" SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \ 214 ); 215 # else // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT 216 // Some architectures cannot implement efficient interceptor trampolines with 217 // just a plain jump due to complexities of resolving a preemptible symbol. In 218 // those cases, revert to just this scheme: 219 // 220 // [wrapper "func": weak] --(alias)--> [WRAP(func)] 221 // 222 # define WRAP(x) __interceptor_ ## x 223 # define TRAMPOLINE(x) WRAP(x) 224 # if SANITIZER_FREEBSD || SANITIZER_NETBSD 225 # define __ATTRIBUTE_WEAK_WRAPPER 226 # else 227 # define __ATTRIBUTE_WEAK_WRAPPER __attribute__((weak)) 228 # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD 229 # define DECLARE_WRAPPER(ret_type, func, ...) \ 230 extern "C" ret_type func(__VA_ARGS__) \ 231 INTERCEPTOR_ATTRIBUTE __ATTRIBUTE_WEAK_WRAPPER ALIAS(WRAP(func)); 232 # endif // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT 233 #endif 234 235 #if SANITIZER_FUCHSIA 236 // There is no general interception at all on Fuchsia. 237 // Sanitizer runtimes just define functions directly to preempt them, 238 // and have bespoke ways to access the underlying libc functions. 239 # include <zircon/sanitizer.h> 240 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) 241 # define REAL(x) __unsanitized_##x 242 # define DECLARE_REAL(ret_type, func, ...) 243 #elif !SANITIZER_APPLE 244 # define PTR_TO_REAL(x) real_##x 245 # define REAL(x) __interception::PTR_TO_REAL(x) 246 # define FUNC_TYPE(x) x##_type 247 248 # define DECLARE_REAL(ret_type, func, ...) \ 249 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \ 250 namespace __interception { \ 251 extern FUNC_TYPE(func) PTR_TO_REAL(func); \ 252 } 253 # define ASSIGN_REAL(dst, src) REAL(dst) = REAL(src) 254 #else // SANITIZER_APPLE 255 # define REAL(x) x 256 # define DECLARE_REAL(ret_type, func, ...) \ 257 extern "C" ret_type func(__VA_ARGS__); 258 # define ASSIGN_REAL(x, y) 259 #endif // SANITIZER_APPLE 260 261 #if !SANITIZER_FUCHSIA 262 # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) \ 263 DECLARE_REAL(ret_type, func, __VA_ARGS__) \ 264 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \ 265 extern "C" ret_type WRAP(func)(__VA_ARGS__); 266 // Declare an interceptor and its wrapper defined in a different translation 267 // unit (ex. asm). 268 # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) \ 269 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \ 270 extern "C" ret_type WRAP(func)(__VA_ARGS__); \ 271 extern "C" ret_type func(__VA_ARGS__); 272 #else 273 # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) 274 # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) 275 #endif 276 277 // Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR 278 // macros does its job. In exceptional cases you may need to call REAL(foo) 279 // without defining INTERCEPTOR(..., foo, ...). For example, if you override 280 // foo with an interceptor for other function. 281 #if !SANITIZER_APPLE && !SANITIZER_FUCHSIA 282 # define DEFINE_REAL(ret_type, func, ...) \ 283 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \ 284 namespace __interception { \ 285 FUNC_TYPE(func) PTR_TO_REAL(func); \ 286 } 287 #else 288 # define DEFINE_REAL(ret_type, func, ...) 289 #endif 290 291 #if SANITIZER_FUCHSIA 292 293 // We need to define the __interceptor_func name just to get 294 // sanitizer_common/scripts/gen_dynamic_list.py to export func. 295 // But we don't need to export __interceptor_func to get that. 296 #define INTERCEPTOR(ret_type, func, ...) \ 297 extern "C"[[ gnu::alias(#func), gnu::visibility("hidden") ]] ret_type \ 298 __interceptor_##func(__VA_ARGS__); \ 299 extern "C" INTERCEPTOR_ATTRIBUTE ret_type func(__VA_ARGS__) 300 301 #elif !SANITIZER_APPLE 302 303 #define INTERCEPTOR(ret_type, func, ...) \ 304 DEFINE_REAL(ret_type, func, __VA_ARGS__) \ 305 DECLARE_WRAPPER(ret_type, func, __VA_ARGS__) \ 306 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__) 307 308 // We don't need INTERCEPTOR_WITH_SUFFIX on non-Darwin for now. 309 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \ 310 INTERCEPTOR(ret_type, func, __VA_ARGS__) 311 312 #else // SANITIZER_APPLE 313 314 #define INTERCEPTOR_ZZZ(suffix, ret_type, func, ...) \ 315 extern "C" ret_type func(__VA_ARGS__) suffix; \ 316 extern "C" ret_type WRAP(func)(__VA_ARGS__); \ 317 INTERPOSER(func); \ 318 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__) 319 320 #define INTERCEPTOR(ret_type, func, ...) \ 321 INTERCEPTOR_ZZZ(/*no symbol variants*/, ret_type, func, __VA_ARGS__) 322 323 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \ 324 INTERCEPTOR_ZZZ(__DARWIN_ALIAS_C(func), ret_type, func, __VA_ARGS__) 325 326 // Override |overridee| with |overrider|. 327 #define OVERRIDE_FUNCTION(overridee, overrider) \ 328 INTERPOSER_2(overridee, WRAP(overrider)) 329 #endif 330 331 #if SANITIZER_WINDOWS 332 # define INTERCEPTOR_WINAPI(ret_type, func, ...) \ 333 typedef ret_type (__stdcall *FUNC_TYPE(func))(__VA_ARGS__); \ 334 namespace __interception { \ 335 FUNC_TYPE(func) PTR_TO_REAL(func); \ 336 } \ 337 extern "C" INTERCEPTOR_ATTRIBUTE ret_type __stdcall WRAP(func)(__VA_ARGS__) 338 #endif 339 340 // ISO C++ forbids casting between pointer-to-function and pointer-to-object, 341 // so we use casting via an integral type __interception::uptr, 342 // assuming that system is POSIX-compliant. Using other hacks seem 343 // challenging, as we don't even pass function type to 344 // INTERCEPT_FUNCTION macro, only its name. 345 namespace __interception { 346 #if defined(_WIN64) 347 typedef unsigned long long uptr; 348 #else 349 typedef unsigned long uptr; 350 #endif // _WIN64 351 } // namespace __interception 352 353 #define INCLUDED_FROM_INTERCEPTION_LIB 354 355 #if SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_NETBSD || \ 356 SANITIZER_SOLARIS 357 358 # include "interception_linux.h" 359 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_LINUX_OR_FREEBSD(func) 360 # define INTERCEPT_FUNCTION_VER(func, symver) \ 361 INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver) 362 #elif SANITIZER_APPLE 363 # include "interception_mac.h" 364 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_MAC(func) 365 # define INTERCEPT_FUNCTION_VER(func, symver) \ 366 INTERCEPT_FUNCTION_VER_MAC(func, symver) 367 #elif SANITIZER_WINDOWS 368 # include "interception_win.h" 369 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_WIN(func) 370 # define INTERCEPT_FUNCTION_VER(func, symver) \ 371 INTERCEPT_FUNCTION_VER_WIN(func, symver) 372 #endif 373 374 #undef INCLUDED_FROM_INTERCEPTION_LIB 375 376 #endif // INTERCEPTION_H 377