1*490215a3Smrg //===-- interception_linux.cc -----------------------------------*- C++ -*-===//
2*490215a3Smrg //
3*490215a3Smrg // This file is distributed under the University of Illinois Open Source
4*490215a3Smrg // License. See LICENSE.TXT for details.
5*490215a3Smrg //
6*490215a3Smrg //===----------------------------------------------------------------------===//
7*490215a3Smrg //
8*490215a3Smrg // This file is a part of AddressSanitizer, an address sanity checker.
9*490215a3Smrg //
10*490215a3Smrg // Windows-specific interception methods.
11*490215a3Smrg //
12*490215a3Smrg // This file is implementing several hooking techniques to intercept calls
13*490215a3Smrg // to functions. The hooks are dynamically installed by modifying the assembly
14*490215a3Smrg // code.
15*490215a3Smrg //
16*490215a3Smrg // The hooking techniques are making assumptions on the way the code is
17*490215a3Smrg // generated and are safe under these assumptions.
18*490215a3Smrg //
19*490215a3Smrg // On 64-bit architecture, there is no direct 64-bit jump instruction. To allow
20*490215a3Smrg // arbitrary branching on the whole memory space, the notion of trampoline
21*490215a3Smrg // region is used. A trampoline region is a memory space withing 2G boundary
22*490215a3Smrg // where it is safe to add custom assembly code to build 64-bit jumps.
23*490215a3Smrg //
24*490215a3Smrg // Hooking techniques
25*490215a3Smrg // ==================
26*490215a3Smrg //
27*490215a3Smrg // 1) Detour
28*490215a3Smrg //
29*490215a3Smrg // The Detour hooking technique is assuming the presence of an header with
30*490215a3Smrg // padding and an overridable 2-bytes nop instruction (mov edi, edi). The
31*490215a3Smrg // nop instruction can safely be replaced by a 2-bytes jump without any need
32*490215a3Smrg // to save the instruction. A jump to the target is encoded in the function
33*490215a3Smrg // header and the nop instruction is replaced by a short jump to the header.
34*490215a3Smrg //
35*490215a3Smrg // head: 5 x nop head: jmp <hook>
36*490215a3Smrg // func: mov edi, edi --> func: jmp short <head>
37*490215a3Smrg // [...] real: [...]
38*490215a3Smrg //
39*490215a3Smrg // This technique is only implemented on 32-bit architecture.
40*490215a3Smrg // Most of the time, Windows API are hookable with the detour technique.
41*490215a3Smrg //
42*490215a3Smrg // 2) Redirect Jump
43*490215a3Smrg //
44*490215a3Smrg // The redirect jump is applicable when the first instruction is a direct
45*490215a3Smrg // jump. The instruction is replaced by jump to the hook.
46*490215a3Smrg //
47*490215a3Smrg // func: jmp <label> --> func: jmp <hook>
48*490215a3Smrg //
49*490215a3Smrg // On an 64-bit architecture, a trampoline is inserted.
50*490215a3Smrg //
51*490215a3Smrg // func: jmp <label> --> func: jmp <tramp>
52*490215a3Smrg // [...]
53*490215a3Smrg //
54*490215a3Smrg // [trampoline]
55*490215a3Smrg // tramp: jmp QWORD [addr]
56*490215a3Smrg // addr: .bytes <hook>
57*490215a3Smrg //
58*490215a3Smrg // Note: <real> is equilavent to <label>.
59*490215a3Smrg //
60*490215a3Smrg // 3) HotPatch
61*490215a3Smrg //
62*490215a3Smrg // The HotPatch hooking is assuming the presence of an header with padding
63*490215a3Smrg // and a first instruction with at least 2-bytes.
64*490215a3Smrg //
65*490215a3Smrg // The reason to enforce the 2-bytes limitation is to provide the minimal
66*490215a3Smrg // space to encode a short jump. HotPatch technique is only rewriting one
67*490215a3Smrg // instruction to avoid breaking a sequence of instructions containing a
68*490215a3Smrg // branching target.
69*490215a3Smrg //
70*490215a3Smrg // Assumptions are enforced by MSVC compiler by using the /HOTPATCH flag.
71*490215a3Smrg // see: https://msdn.microsoft.com/en-us/library/ms173507.aspx
72*490215a3Smrg // Default padding length is 5 bytes in 32-bits and 6 bytes in 64-bits.
73*490215a3Smrg //
74*490215a3Smrg // head: 5 x nop head: jmp <hook>
75*490215a3Smrg // func: <instr> --> func: jmp short <head>
76*490215a3Smrg // [...] body: [...]
77*490215a3Smrg //
78*490215a3Smrg // [trampoline]
79*490215a3Smrg // real: <instr>
80*490215a3Smrg // jmp <body>
81*490215a3Smrg //
82*490215a3Smrg // On an 64-bit architecture:
83*490215a3Smrg //
84*490215a3Smrg // head: 6 x nop head: jmp QWORD [addr1]
85*490215a3Smrg // func: <instr> --> func: jmp short <head>
86*490215a3Smrg // [...] body: [...]
87*490215a3Smrg //
88*490215a3Smrg // [trampoline]
89*490215a3Smrg // addr1: .bytes <hook>
90*490215a3Smrg // real: <instr>
91*490215a3Smrg // jmp QWORD [addr2]
92*490215a3Smrg // addr2: .bytes <body>
93*490215a3Smrg //
94*490215a3Smrg // 4) Trampoline
95*490215a3Smrg //
96*490215a3Smrg // The Trampoline hooking technique is the most aggressive one. It is
97*490215a3Smrg // assuming that there is a sequence of instructions that can be safely
98*490215a3Smrg // replaced by a jump (enough room and no incoming branches).
99*490215a3Smrg //
100*490215a3Smrg // Unfortunately, these assumptions can't be safely presumed and code may
101*490215a3Smrg // be broken after hooking.
102*490215a3Smrg //
103*490215a3Smrg // func: <instr> --> func: jmp <hook>
104*490215a3Smrg // <instr>
105*490215a3Smrg // [...] body: [...]
106*490215a3Smrg //
107*490215a3Smrg // [trampoline]
108*490215a3Smrg // real: <instr>
109*490215a3Smrg // <instr>
110*490215a3Smrg // jmp <body>
111*490215a3Smrg //
112*490215a3Smrg // On an 64-bit architecture:
113*490215a3Smrg //
114*490215a3Smrg // func: <instr> --> func: jmp QWORD [addr1]
115*490215a3Smrg // <instr>
116*490215a3Smrg // [...] body: [...]
117*490215a3Smrg //
118*490215a3Smrg // [trampoline]
119*490215a3Smrg // addr1: .bytes <hook>
120*490215a3Smrg // real: <instr>
121*490215a3Smrg // <instr>
122*490215a3Smrg // jmp QWORD [addr2]
123*490215a3Smrg // addr2: .bytes <body>
124*490215a3Smrg //===----------------------------------------------------------------------===//
125*490215a3Smrg
126*490215a3Smrg #include "interception.h"
127*490215a3Smrg
128*490215a3Smrg #if SANITIZER_WINDOWS
129*490215a3Smrg #include "sanitizer_common/sanitizer_platform.h"
130*490215a3Smrg #define WIN32_LEAN_AND_MEAN
131*490215a3Smrg #include <windows.h>
132*490215a3Smrg
133*490215a3Smrg namespace __interception {
134*490215a3Smrg
135*490215a3Smrg static const int kAddressLength = FIRST_32_SECOND_64(4, 8);
136*490215a3Smrg static const int kJumpInstructionLength = 5;
137*490215a3Smrg static const int kShortJumpInstructionLength = 2;
138*490215a3Smrg static const int kIndirectJumpInstructionLength = 6;
139*490215a3Smrg static const int kBranchLength =
140*490215a3Smrg FIRST_32_SECOND_64(kJumpInstructionLength, kIndirectJumpInstructionLength);
141*490215a3Smrg static const int kDirectBranchLength = kBranchLength + kAddressLength;
142*490215a3Smrg
InterceptionFailed()143*490215a3Smrg static void InterceptionFailed() {
144*490215a3Smrg // Do we have a good way to abort with an error message here?
145*490215a3Smrg __debugbreak();
146*490215a3Smrg }
147*490215a3Smrg
DistanceIsWithin2Gig(uptr from,uptr target)148*490215a3Smrg static bool DistanceIsWithin2Gig(uptr from, uptr target) {
149*490215a3Smrg #if SANITIZER_WINDOWS64
150*490215a3Smrg if (from < target)
151*490215a3Smrg return target - from <= (uptr)0x7FFFFFFFU;
152*490215a3Smrg else
153*490215a3Smrg return from - target <= (uptr)0x80000000U;
154*490215a3Smrg #else
155*490215a3Smrg // In a 32-bit address space, the address calculation will wrap, so this check
156*490215a3Smrg // is unnecessary.
157*490215a3Smrg return true;
158*490215a3Smrg #endif
159*490215a3Smrg }
160*490215a3Smrg
GetMmapGranularity()161*490215a3Smrg static uptr GetMmapGranularity() {
162*490215a3Smrg SYSTEM_INFO si;
163*490215a3Smrg GetSystemInfo(&si);
164*490215a3Smrg return si.dwAllocationGranularity;
165*490215a3Smrg }
166*490215a3Smrg
RoundUpTo(uptr size,uptr boundary)167*490215a3Smrg static uptr RoundUpTo(uptr size, uptr boundary) {
168*490215a3Smrg return (size + boundary - 1) & ~(boundary - 1);
169*490215a3Smrg }
170*490215a3Smrg
171*490215a3Smrg // FIXME: internal_str* and internal_mem* functions should be moved from the
172*490215a3Smrg // ASan sources into interception/.
173*490215a3Smrg
_strlen(const char * str)174*490215a3Smrg static size_t _strlen(const char *str) {
175*490215a3Smrg const char* p = str;
176*490215a3Smrg while (*p != '\0') ++p;
177*490215a3Smrg return p - str;
178*490215a3Smrg }
179*490215a3Smrg
_strchr(char * str,char c)180*490215a3Smrg static char* _strchr(char* str, char c) {
181*490215a3Smrg while (*str) {
182*490215a3Smrg if (*str == c)
183*490215a3Smrg return str;
184*490215a3Smrg ++str;
185*490215a3Smrg }
186*490215a3Smrg return nullptr;
187*490215a3Smrg }
188*490215a3Smrg
_memset(void * p,int value,size_t sz)189*490215a3Smrg static void _memset(void *p, int value, size_t sz) {
190*490215a3Smrg for (size_t i = 0; i < sz; ++i)
191*490215a3Smrg ((char*)p)[i] = (char)value;
192*490215a3Smrg }
193*490215a3Smrg
_memcpy(void * dst,void * src,size_t sz)194*490215a3Smrg static void _memcpy(void *dst, void *src, size_t sz) {
195*490215a3Smrg char *dst_c = (char*)dst,
196*490215a3Smrg *src_c = (char*)src;
197*490215a3Smrg for (size_t i = 0; i < sz; ++i)
198*490215a3Smrg dst_c[i] = src_c[i];
199*490215a3Smrg }
200*490215a3Smrg
ChangeMemoryProtection(uptr address,uptr size,DWORD * old_protection)201*490215a3Smrg static bool ChangeMemoryProtection(
202*490215a3Smrg uptr address, uptr size, DWORD *old_protection) {
203*490215a3Smrg return ::VirtualProtect((void*)address, size,
204*490215a3Smrg PAGE_EXECUTE_READWRITE,
205*490215a3Smrg old_protection) != FALSE;
206*490215a3Smrg }
207*490215a3Smrg
RestoreMemoryProtection(uptr address,uptr size,DWORD old_protection)208*490215a3Smrg static bool RestoreMemoryProtection(
209*490215a3Smrg uptr address, uptr size, DWORD old_protection) {
210*490215a3Smrg DWORD unused;
211*490215a3Smrg return ::VirtualProtect((void*)address, size,
212*490215a3Smrg old_protection,
213*490215a3Smrg &unused) != FALSE;
214*490215a3Smrg }
215*490215a3Smrg
IsMemoryPadding(uptr address,uptr size)216*490215a3Smrg static bool IsMemoryPadding(uptr address, uptr size) {
217*490215a3Smrg u8* function = (u8*)address;
218*490215a3Smrg for (size_t i = 0; i < size; ++i)
219*490215a3Smrg if (function[i] != 0x90 && function[i] != 0xCC)
220*490215a3Smrg return false;
221*490215a3Smrg return true;
222*490215a3Smrg }
223*490215a3Smrg
224*490215a3Smrg static const u8 kHintNop8Bytes[] = {
225*490215a3Smrg 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00
226*490215a3Smrg };
227*490215a3Smrg
228*490215a3Smrg template<class T>
FunctionHasPrefix(uptr address,const T & pattern)229*490215a3Smrg static bool FunctionHasPrefix(uptr address, const T &pattern) {
230*490215a3Smrg u8* function = (u8*)address - sizeof(pattern);
231*490215a3Smrg for (size_t i = 0; i < sizeof(pattern); ++i)
232*490215a3Smrg if (function[i] != pattern[i])
233*490215a3Smrg return false;
234*490215a3Smrg return true;
235*490215a3Smrg }
236*490215a3Smrg
FunctionHasPadding(uptr address,uptr size)237*490215a3Smrg static bool FunctionHasPadding(uptr address, uptr size) {
238*490215a3Smrg if (IsMemoryPadding(address - size, size))
239*490215a3Smrg return true;
240*490215a3Smrg if (size <= sizeof(kHintNop8Bytes) &&
241*490215a3Smrg FunctionHasPrefix(address, kHintNop8Bytes))
242*490215a3Smrg return true;
243*490215a3Smrg return false;
244*490215a3Smrg }
245*490215a3Smrg
WritePadding(uptr from,uptr size)246*490215a3Smrg static void WritePadding(uptr from, uptr size) {
247*490215a3Smrg _memset((void*)from, 0xCC, (size_t)size);
248*490215a3Smrg }
249*490215a3Smrg
WriteJumpInstruction(uptr from,uptr target)250*490215a3Smrg static void WriteJumpInstruction(uptr from, uptr target) {
251*490215a3Smrg if (!DistanceIsWithin2Gig(from + kJumpInstructionLength, target))
252*490215a3Smrg InterceptionFailed();
253*490215a3Smrg ptrdiff_t offset = target - from - kJumpInstructionLength;
254*490215a3Smrg *(u8*)from = 0xE9;
255*490215a3Smrg *(u32*)(from + 1) = offset;
256*490215a3Smrg }
257*490215a3Smrg
WriteShortJumpInstruction(uptr from,uptr target)258*490215a3Smrg static void WriteShortJumpInstruction(uptr from, uptr target) {
259*490215a3Smrg sptr offset = target - from - kShortJumpInstructionLength;
260*490215a3Smrg if (offset < -128 || offset > 127)
261*490215a3Smrg InterceptionFailed();
262*490215a3Smrg *(u8*)from = 0xEB;
263*490215a3Smrg *(u8*)(from + 1) = (u8)offset;
264*490215a3Smrg }
265*490215a3Smrg
266*490215a3Smrg #if SANITIZER_WINDOWS64
WriteIndirectJumpInstruction(uptr from,uptr indirect_target)267*490215a3Smrg static void WriteIndirectJumpInstruction(uptr from, uptr indirect_target) {
268*490215a3Smrg // jmp [rip + <offset>] = FF 25 <offset> where <offset> is a relative
269*490215a3Smrg // offset.
270*490215a3Smrg // The offset is the distance from then end of the jump instruction to the
271*490215a3Smrg // memory location containing the targeted address. The displacement is still
272*490215a3Smrg // 32-bit in x64, so indirect_target must be located within +/- 2GB range.
273*490215a3Smrg int offset = indirect_target - from - kIndirectJumpInstructionLength;
274*490215a3Smrg if (!DistanceIsWithin2Gig(from + kIndirectJumpInstructionLength,
275*490215a3Smrg indirect_target)) {
276*490215a3Smrg InterceptionFailed();
277*490215a3Smrg }
278*490215a3Smrg *(u16*)from = 0x25FF;
279*490215a3Smrg *(u32*)(from + 2) = offset;
280*490215a3Smrg }
281*490215a3Smrg #endif
282*490215a3Smrg
WriteBranch(uptr from,uptr indirect_target,uptr target)283*490215a3Smrg static void WriteBranch(
284*490215a3Smrg uptr from, uptr indirect_target, uptr target) {
285*490215a3Smrg #if SANITIZER_WINDOWS64
286*490215a3Smrg WriteIndirectJumpInstruction(from, indirect_target);
287*490215a3Smrg *(u64*)indirect_target = target;
288*490215a3Smrg #else
289*490215a3Smrg (void)indirect_target;
290*490215a3Smrg WriteJumpInstruction(from, target);
291*490215a3Smrg #endif
292*490215a3Smrg }
293*490215a3Smrg
WriteDirectBranch(uptr from,uptr target)294*490215a3Smrg static void WriteDirectBranch(uptr from, uptr target) {
295*490215a3Smrg #if SANITIZER_WINDOWS64
296*490215a3Smrg // Emit an indirect jump through immediately following bytes:
297*490215a3Smrg // jmp [rip + kBranchLength]
298*490215a3Smrg // .quad <target>
299*490215a3Smrg WriteBranch(from, from + kBranchLength, target);
300*490215a3Smrg #else
301*490215a3Smrg WriteJumpInstruction(from, target);
302*490215a3Smrg #endif
303*490215a3Smrg }
304*490215a3Smrg
305*490215a3Smrg struct TrampolineMemoryRegion {
306*490215a3Smrg uptr content;
307*490215a3Smrg uptr allocated_size;
308*490215a3Smrg uptr max_size;
309*490215a3Smrg };
310*490215a3Smrg
311*490215a3Smrg static const uptr kTrampolineScanLimitRange = 1 << 31; // 2 gig
312*490215a3Smrg static const int kMaxTrampolineRegion = 1024;
313*490215a3Smrg static TrampolineMemoryRegion TrampolineRegions[kMaxTrampolineRegion];
314*490215a3Smrg
AllocateTrampolineRegion(uptr image_address,size_t granularity)315*490215a3Smrg static void *AllocateTrampolineRegion(uptr image_address, size_t granularity) {
316*490215a3Smrg #if SANITIZER_WINDOWS64
317*490215a3Smrg uptr address = image_address;
318*490215a3Smrg uptr scanned = 0;
319*490215a3Smrg while (scanned < kTrampolineScanLimitRange) {
320*490215a3Smrg MEMORY_BASIC_INFORMATION info;
321*490215a3Smrg if (!::VirtualQuery((void*)address, &info, sizeof(info)))
322*490215a3Smrg return nullptr;
323*490215a3Smrg
324*490215a3Smrg // Check whether a region can be allocated at |address|.
325*490215a3Smrg if (info.State == MEM_FREE && info.RegionSize >= granularity) {
326*490215a3Smrg void *page = ::VirtualAlloc((void*)RoundUpTo(address, granularity),
327*490215a3Smrg granularity,
328*490215a3Smrg MEM_RESERVE | MEM_COMMIT,
329*490215a3Smrg PAGE_EXECUTE_READWRITE);
330*490215a3Smrg return page;
331*490215a3Smrg }
332*490215a3Smrg
333*490215a3Smrg // Move to the next region.
334*490215a3Smrg address = (uptr)info.BaseAddress + info.RegionSize;
335*490215a3Smrg scanned += info.RegionSize;
336*490215a3Smrg }
337*490215a3Smrg return nullptr;
338*490215a3Smrg #else
339*490215a3Smrg return ::VirtualAlloc(nullptr,
340*490215a3Smrg granularity,
341*490215a3Smrg MEM_RESERVE | MEM_COMMIT,
342*490215a3Smrg PAGE_EXECUTE_READWRITE);
343*490215a3Smrg #endif
344*490215a3Smrg }
345*490215a3Smrg
346*490215a3Smrg // Used by unittests to release mapped memory space.
TestOnlyReleaseTrampolineRegions()347*490215a3Smrg void TestOnlyReleaseTrampolineRegions() {
348*490215a3Smrg for (size_t bucket = 0; bucket < kMaxTrampolineRegion; ++bucket) {
349*490215a3Smrg TrampolineMemoryRegion *current = &TrampolineRegions[bucket];
350*490215a3Smrg if (current->content == 0)
351*490215a3Smrg return;
352*490215a3Smrg ::VirtualFree((void*)current->content, 0, MEM_RELEASE);
353*490215a3Smrg current->content = 0;
354*490215a3Smrg }
355*490215a3Smrg }
356*490215a3Smrg
AllocateMemoryForTrampoline(uptr image_address,size_t size)357*490215a3Smrg static uptr AllocateMemoryForTrampoline(uptr image_address, size_t size) {
358*490215a3Smrg // Find a region within 2G with enough space to allocate |size| bytes.
359*490215a3Smrg TrampolineMemoryRegion *region = nullptr;
360*490215a3Smrg for (size_t bucket = 0; bucket < kMaxTrampolineRegion; ++bucket) {
361*490215a3Smrg TrampolineMemoryRegion* current = &TrampolineRegions[bucket];
362*490215a3Smrg if (current->content == 0) {
363*490215a3Smrg // No valid region found, allocate a new region.
364*490215a3Smrg size_t bucket_size = GetMmapGranularity();
365*490215a3Smrg void *content = AllocateTrampolineRegion(image_address, bucket_size);
366*490215a3Smrg if (content == nullptr)
367*490215a3Smrg return 0U;
368*490215a3Smrg
369*490215a3Smrg current->content = (uptr)content;
370*490215a3Smrg current->allocated_size = 0;
371*490215a3Smrg current->max_size = bucket_size;
372*490215a3Smrg region = current;
373*490215a3Smrg break;
374*490215a3Smrg } else if (current->max_size - current->allocated_size > size) {
375*490215a3Smrg #if SANITIZER_WINDOWS64
376*490215a3Smrg // In 64-bits, the memory space must be allocated within 2G boundary.
377*490215a3Smrg uptr next_address = current->content + current->allocated_size;
378*490215a3Smrg if (next_address < image_address ||
379*490215a3Smrg next_address - image_address >= 0x7FFF0000)
380*490215a3Smrg continue;
381*490215a3Smrg #endif
382*490215a3Smrg // The space can be allocated in the current region.
383*490215a3Smrg region = current;
384*490215a3Smrg break;
385*490215a3Smrg }
386*490215a3Smrg }
387*490215a3Smrg
388*490215a3Smrg // Failed to find a region.
389*490215a3Smrg if (region == nullptr)
390*490215a3Smrg return 0U;
391*490215a3Smrg
392*490215a3Smrg // Allocate the space in the current region.
393*490215a3Smrg uptr allocated_space = region->content + region->allocated_size;
394*490215a3Smrg region->allocated_size += size;
395*490215a3Smrg WritePadding(allocated_space, size);
396*490215a3Smrg
397*490215a3Smrg return allocated_space;
398*490215a3Smrg }
399*490215a3Smrg
400*490215a3Smrg // Returns 0 on error.
GetInstructionSize(uptr address,size_t * rel_offset=nullptr)401*490215a3Smrg static size_t GetInstructionSize(uptr address, size_t* rel_offset = nullptr) {
402*490215a3Smrg switch (*(u64*)address) {
403*490215a3Smrg case 0x90909090909006EB: // stub: jmp over 6 x nop.
404*490215a3Smrg return 8;
405*490215a3Smrg }
406*490215a3Smrg
407*490215a3Smrg switch (*(u8*)address) {
408*490215a3Smrg case 0x90: // 90 : nop
409*490215a3Smrg return 1;
410*490215a3Smrg
411*490215a3Smrg case 0x50: // push eax / rax
412*490215a3Smrg case 0x51: // push ecx / rcx
413*490215a3Smrg case 0x52: // push edx / rdx
414*490215a3Smrg case 0x53: // push ebx / rbx
415*490215a3Smrg case 0x54: // push esp / rsp
416*490215a3Smrg case 0x55: // push ebp / rbp
417*490215a3Smrg case 0x56: // push esi / rsi
418*490215a3Smrg case 0x57: // push edi / rdi
419*490215a3Smrg case 0x5D: // pop ebp / rbp
420*490215a3Smrg return 1;
421*490215a3Smrg
422*490215a3Smrg case 0x6A: // 6A XX = push XX
423*490215a3Smrg return 2;
424*490215a3Smrg
425*490215a3Smrg case 0xb8: // b8 XX XX XX XX : mov eax, XX XX XX XX
426*490215a3Smrg case 0xB9: // b9 XX XX XX XX : mov ecx, XX XX XX XX
427*490215a3Smrg return 5;
428*490215a3Smrg
429*490215a3Smrg // Cannot overwrite control-instruction. Return 0 to indicate failure.
430*490215a3Smrg case 0xE9: // E9 XX XX XX XX : jmp <label>
431*490215a3Smrg case 0xE8: // E8 XX XX XX XX : call <func>
432*490215a3Smrg case 0xC3: // C3 : ret
433*490215a3Smrg case 0xEB: // EB XX : jmp XX (short jump)
434*490215a3Smrg case 0x70: // 7Y YY : jy XX (short conditional jump)
435*490215a3Smrg case 0x71:
436*490215a3Smrg case 0x72:
437*490215a3Smrg case 0x73:
438*490215a3Smrg case 0x74:
439*490215a3Smrg case 0x75:
440*490215a3Smrg case 0x76:
441*490215a3Smrg case 0x77:
442*490215a3Smrg case 0x78:
443*490215a3Smrg case 0x79:
444*490215a3Smrg case 0x7A:
445*490215a3Smrg case 0x7B:
446*490215a3Smrg case 0x7C:
447*490215a3Smrg case 0x7D:
448*490215a3Smrg case 0x7E:
449*490215a3Smrg case 0x7F:
450*490215a3Smrg return 0;
451*490215a3Smrg }
452*490215a3Smrg
453*490215a3Smrg switch (*(u16*)(address)) {
454*490215a3Smrg case 0x018A: // 8A 01 : mov al, byte ptr [ecx]
455*490215a3Smrg case 0xFF8B: // 8B FF : mov edi, edi
456*490215a3Smrg case 0xEC8B: // 8B EC : mov ebp, esp
457*490215a3Smrg case 0xc889: // 89 C8 : mov eax, ecx
458*490215a3Smrg case 0xC18B: // 8B C1 : mov eax, ecx
459*490215a3Smrg case 0xC033: // 33 C0 : xor eax, eax
460*490215a3Smrg case 0xC933: // 33 C9 : xor ecx, ecx
461*490215a3Smrg case 0xD233: // 33 D2 : xor edx, edx
462*490215a3Smrg return 2;
463*490215a3Smrg
464*490215a3Smrg // Cannot overwrite control-instruction. Return 0 to indicate failure.
465*490215a3Smrg case 0x25FF: // FF 25 XX XX XX XX : jmp [XXXXXXXX]
466*490215a3Smrg return 0;
467*490215a3Smrg }
468*490215a3Smrg
469*490215a3Smrg switch (0x00FFFFFF & *(u32*)address) {
470*490215a3Smrg case 0x24A48D: // 8D A4 24 XX XX XX XX : lea esp, [esp + XX XX XX XX]
471*490215a3Smrg return 7;
472*490215a3Smrg }
473*490215a3Smrg
474*490215a3Smrg #if SANITIZER_WINDOWS64
475*490215a3Smrg switch (*(u8*)address) {
476*490215a3Smrg case 0xA1: // A1 XX XX XX XX XX XX XX XX :
477*490215a3Smrg // movabs eax, dword ptr ds:[XXXXXXXX]
478*490215a3Smrg return 9;
479*490215a3Smrg }
480*490215a3Smrg
481*490215a3Smrg switch (*(u16*)address) {
482*490215a3Smrg case 0x5040: // push rax
483*490215a3Smrg case 0x5140: // push rcx
484*490215a3Smrg case 0x5240: // push rdx
485*490215a3Smrg case 0x5340: // push rbx
486*490215a3Smrg case 0x5440: // push rsp
487*490215a3Smrg case 0x5540: // push rbp
488*490215a3Smrg case 0x5640: // push rsi
489*490215a3Smrg case 0x5740: // push rdi
490*490215a3Smrg case 0x5441: // push r12
491*490215a3Smrg case 0x5541: // push r13
492*490215a3Smrg case 0x5641: // push r14
493*490215a3Smrg case 0x5741: // push r15
494*490215a3Smrg case 0x9066: // Two-byte NOP
495*490215a3Smrg return 2;
496*490215a3Smrg
497*490215a3Smrg case 0x058B: // 8B 05 XX XX XX XX : mov eax, dword ptr [XX XX XX XX]
498*490215a3Smrg if (rel_offset)
499*490215a3Smrg *rel_offset = 2;
500*490215a3Smrg return 6;
501*490215a3Smrg }
502*490215a3Smrg
503*490215a3Smrg switch (0x00FFFFFF & *(u32*)address) {
504*490215a3Smrg case 0xe58948: // 48 8b c4 : mov rbp, rsp
505*490215a3Smrg case 0xc18b48: // 48 8b c1 : mov rax, rcx
506*490215a3Smrg case 0xc48b48: // 48 8b c4 : mov rax, rsp
507*490215a3Smrg case 0xd9f748: // 48 f7 d9 : neg rcx
508*490215a3Smrg case 0xd12b48: // 48 2b d1 : sub rdx, rcx
509*490215a3Smrg case 0x07c1f6: // f6 c1 07 : test cl, 0x7
510*490215a3Smrg case 0xc98548: // 48 85 C9 : test rcx, rcx
511*490215a3Smrg case 0xc0854d: // 4d 85 c0 : test r8, r8
512*490215a3Smrg case 0xc2b60f: // 0f b6 c2 : movzx eax, dl
513*490215a3Smrg case 0xc03345: // 45 33 c0 : xor r8d, r8d
514*490215a3Smrg case 0xdb3345: // 45 33 DB : xor r11d, r11d
515*490215a3Smrg case 0xd98b4c: // 4c 8b d9 : mov r11, rcx
516*490215a3Smrg case 0xd28b4c: // 4c 8b d2 : mov r10, rdx
517*490215a3Smrg case 0xc98b4c: // 4C 8B C9 : mov r9, rcx
518*490215a3Smrg case 0xd2b60f: // 0f b6 d2 : movzx edx, dl
519*490215a3Smrg case 0xca2b48: // 48 2b ca : sub rcx, rdx
520*490215a3Smrg case 0x10b70f: // 0f b7 10 : movzx edx, WORD PTR [rax]
521*490215a3Smrg case 0xc00b4d: // 3d 0b c0 : or r8, r8
522*490215a3Smrg case 0xd18b48: // 48 8b d1 : mov rdx, rcx
523*490215a3Smrg case 0xdc8b4c: // 4c 8b dc : mov r11, rsp
524*490215a3Smrg case 0xd18b4c: // 4c 8b d1 : mov r10, rcx
525*490215a3Smrg return 3;
526*490215a3Smrg
527*490215a3Smrg case 0xec8348: // 48 83 ec XX : sub rsp, XX
528*490215a3Smrg case 0xf88349: // 49 83 f8 XX : cmp r8, XX
529*490215a3Smrg case 0x588948: // 48 89 58 XX : mov QWORD PTR[rax + XX], rbx
530*490215a3Smrg return 4;
531*490215a3Smrg
532*490215a3Smrg case 0xec8148: // 48 81 EC XX XX XX XX : sub rsp, XXXXXXXX
533*490215a3Smrg return 7;
534*490215a3Smrg
535*490215a3Smrg case 0x058b48: // 48 8b 05 XX XX XX XX :
536*490215a3Smrg // mov rax, QWORD PTR [rip + XXXXXXXX]
537*490215a3Smrg case 0x25ff48: // 48 ff 25 XX XX XX XX :
538*490215a3Smrg // rex.W jmp QWORD PTR [rip + XXXXXXXX]
539*490215a3Smrg
540*490215a3Smrg // Instructions having offset relative to 'rip' need offset adjustment.
541*490215a3Smrg if (rel_offset)
542*490215a3Smrg *rel_offset = 3;
543*490215a3Smrg return 7;
544*490215a3Smrg
545*490215a3Smrg case 0x2444c7: // C7 44 24 XX YY YY YY YY
546*490215a3Smrg // mov dword ptr [rsp + XX], YYYYYYYY
547*490215a3Smrg return 8;
548*490215a3Smrg }
549*490215a3Smrg
550*490215a3Smrg switch (*(u32*)(address)) {
551*490215a3Smrg case 0x24448b48: // 48 8b 44 24 XX : mov rax, QWORD ptr [rsp + XX]
552*490215a3Smrg case 0x246c8948: // 48 89 6C 24 XX : mov QWORD ptr [rsp + XX], rbp
553*490215a3Smrg case 0x245c8948: // 48 89 5c 24 XX : mov QWORD PTR [rsp + XX], rbx
554*490215a3Smrg case 0x24748948: // 48 89 74 24 XX : mov QWORD PTR [rsp + XX], rsi
555*490215a3Smrg case 0x244C8948: // 48 89 4C 24 XX : mov QWORD PTR [rsp + XX], rcx
556*490215a3Smrg return 5;
557*490215a3Smrg case 0x24648348: // 48 83 64 24 XX : and QWORD PTR [rsp + XX], YY
558*490215a3Smrg return 6;
559*490215a3Smrg }
560*490215a3Smrg
561*490215a3Smrg #else
562*490215a3Smrg
563*490215a3Smrg switch (*(u8*)address) {
564*490215a3Smrg case 0xA1: // A1 XX XX XX XX : mov eax, dword ptr ds:[XXXXXXXX]
565*490215a3Smrg return 5;
566*490215a3Smrg }
567*490215a3Smrg switch (*(u16*)address) {
568*490215a3Smrg case 0x458B: // 8B 45 XX : mov eax, dword ptr [ebp + XX]
569*490215a3Smrg case 0x5D8B: // 8B 5D XX : mov ebx, dword ptr [ebp + XX]
570*490215a3Smrg case 0x7D8B: // 8B 7D XX : mov edi, dword ptr [ebp + XX]
571*490215a3Smrg case 0xEC83: // 83 EC XX : sub esp, XX
572*490215a3Smrg case 0x75FF: // FF 75 XX : push dword ptr [ebp + XX]
573*490215a3Smrg return 3;
574*490215a3Smrg case 0xC1F7: // F7 C1 XX YY ZZ WW : test ecx, WWZZYYXX
575*490215a3Smrg case 0x25FF: // FF 25 XX YY ZZ WW : jmp dword ptr ds:[WWZZYYXX]
576*490215a3Smrg return 6;
577*490215a3Smrg case 0x3D83: // 83 3D XX YY ZZ WW TT : cmp TT, WWZZYYXX
578*490215a3Smrg return 7;
579*490215a3Smrg case 0x7D83: // 83 7D XX YY : cmp dword ptr [ebp + XX], YY
580*490215a3Smrg return 4;
581*490215a3Smrg }
582*490215a3Smrg
583*490215a3Smrg switch (0x00FFFFFF & *(u32*)address) {
584*490215a3Smrg case 0x24448A: // 8A 44 24 XX : mov eal, dword ptr [esp + XX]
585*490215a3Smrg case 0x24448B: // 8B 44 24 XX : mov eax, dword ptr [esp + XX]
586*490215a3Smrg case 0x244C8B: // 8B 4C 24 XX : mov ecx, dword ptr [esp + XX]
587*490215a3Smrg case 0x24548B: // 8B 54 24 XX : mov edx, dword ptr [esp + XX]
588*490215a3Smrg case 0x24748B: // 8B 74 24 XX : mov esi, dword ptr [esp + XX]
589*490215a3Smrg case 0x247C8B: // 8B 7C 24 XX : mov edi, dword ptr [esp + XX]
590*490215a3Smrg return 4;
591*490215a3Smrg }
592*490215a3Smrg
593*490215a3Smrg switch (*(u32*)address) {
594*490215a3Smrg case 0x2444B60F: // 0F B6 44 24 XX : movzx eax, byte ptr [esp + XX]
595*490215a3Smrg return 5;
596*490215a3Smrg }
597*490215a3Smrg #endif
598*490215a3Smrg
599*490215a3Smrg // Unknown instruction!
600*490215a3Smrg // FIXME: Unknown instruction failures might happen when we add a new
601*490215a3Smrg // interceptor or a new compiler version. In either case, they should result
602*490215a3Smrg // in visible and readable error messages. However, merely calling abort()
603*490215a3Smrg // leads to an infinite recursion in CheckFailed.
604*490215a3Smrg InterceptionFailed();
605*490215a3Smrg return 0;
606*490215a3Smrg }
607*490215a3Smrg
608*490215a3Smrg // Returns 0 on error.
RoundUpToInstrBoundary(size_t size,uptr address)609*490215a3Smrg static size_t RoundUpToInstrBoundary(size_t size, uptr address) {
610*490215a3Smrg size_t cursor = 0;
611*490215a3Smrg while (cursor < size) {
612*490215a3Smrg size_t instruction_size = GetInstructionSize(address + cursor);
613*490215a3Smrg if (!instruction_size)
614*490215a3Smrg return 0;
615*490215a3Smrg cursor += instruction_size;
616*490215a3Smrg }
617*490215a3Smrg return cursor;
618*490215a3Smrg }
619*490215a3Smrg
CopyInstructions(uptr to,uptr from,size_t size)620*490215a3Smrg static bool CopyInstructions(uptr to, uptr from, size_t size) {
621*490215a3Smrg size_t cursor = 0;
622*490215a3Smrg while (cursor != size) {
623*490215a3Smrg size_t rel_offset = 0;
624*490215a3Smrg size_t instruction_size = GetInstructionSize(from + cursor, &rel_offset);
625*490215a3Smrg _memcpy((void*)(to + cursor), (void*)(from + cursor),
626*490215a3Smrg (size_t)instruction_size);
627*490215a3Smrg if (rel_offset) {
628*490215a3Smrg uptr delta = to - from;
629*490215a3Smrg uptr relocated_offset = *(u32*)(to + cursor + rel_offset) - delta;
630*490215a3Smrg #if SANITIZER_WINDOWS64
631*490215a3Smrg if (relocated_offset + 0x80000000U >= 0xFFFFFFFFU)
632*490215a3Smrg return false;
633*490215a3Smrg #endif
634*490215a3Smrg *(u32*)(to + cursor + rel_offset) = relocated_offset;
635*490215a3Smrg }
636*490215a3Smrg cursor += instruction_size;
637*490215a3Smrg }
638*490215a3Smrg return true;
639*490215a3Smrg }
640*490215a3Smrg
641*490215a3Smrg
642*490215a3Smrg #if !SANITIZER_WINDOWS64
OverrideFunctionWithDetour(uptr old_func,uptr new_func,uptr * orig_old_func)643*490215a3Smrg bool OverrideFunctionWithDetour(
644*490215a3Smrg uptr old_func, uptr new_func, uptr *orig_old_func) {
645*490215a3Smrg const int kDetourHeaderLen = 5;
646*490215a3Smrg const u16 kDetourInstruction = 0xFF8B;
647*490215a3Smrg
648*490215a3Smrg uptr header = (uptr)old_func - kDetourHeaderLen;
649*490215a3Smrg uptr patch_length = kDetourHeaderLen + kShortJumpInstructionLength;
650*490215a3Smrg
651*490215a3Smrg // Validate that the function is hookable.
652*490215a3Smrg if (*(u16*)old_func != kDetourInstruction ||
653*490215a3Smrg !IsMemoryPadding(header, kDetourHeaderLen))
654*490215a3Smrg return false;
655*490215a3Smrg
656*490215a3Smrg // Change memory protection to writable.
657*490215a3Smrg DWORD protection = 0;
658*490215a3Smrg if (!ChangeMemoryProtection(header, patch_length, &protection))
659*490215a3Smrg return false;
660*490215a3Smrg
661*490215a3Smrg // Write a relative jump to the redirected function.
662*490215a3Smrg WriteJumpInstruction(header, new_func);
663*490215a3Smrg
664*490215a3Smrg // Write the short jump to the function prefix.
665*490215a3Smrg WriteShortJumpInstruction(old_func, header);
666*490215a3Smrg
667*490215a3Smrg // Restore previous memory protection.
668*490215a3Smrg if (!RestoreMemoryProtection(header, patch_length, protection))
669*490215a3Smrg return false;
670*490215a3Smrg
671*490215a3Smrg if (orig_old_func)
672*490215a3Smrg *orig_old_func = old_func + kShortJumpInstructionLength;
673*490215a3Smrg
674*490215a3Smrg return true;
675*490215a3Smrg }
676*490215a3Smrg #endif
677*490215a3Smrg
OverrideFunctionWithRedirectJump(uptr old_func,uptr new_func,uptr * orig_old_func)678*490215a3Smrg bool OverrideFunctionWithRedirectJump(
679*490215a3Smrg uptr old_func, uptr new_func, uptr *orig_old_func) {
680*490215a3Smrg // Check whether the first instruction is a relative jump.
681*490215a3Smrg if (*(u8*)old_func != 0xE9)
682*490215a3Smrg return false;
683*490215a3Smrg
684*490215a3Smrg if (orig_old_func) {
685*490215a3Smrg uptr relative_offset = *(u32*)(old_func + 1);
686*490215a3Smrg uptr absolute_target = old_func + relative_offset + kJumpInstructionLength;
687*490215a3Smrg *orig_old_func = absolute_target;
688*490215a3Smrg }
689*490215a3Smrg
690*490215a3Smrg #if SANITIZER_WINDOWS64
691*490215a3Smrg // If needed, get memory space for a trampoline jump.
692*490215a3Smrg uptr trampoline = AllocateMemoryForTrampoline(old_func, kDirectBranchLength);
693*490215a3Smrg if (!trampoline)
694*490215a3Smrg return false;
695*490215a3Smrg WriteDirectBranch(trampoline, new_func);
696*490215a3Smrg #endif
697*490215a3Smrg
698*490215a3Smrg // Change memory protection to writable.
699*490215a3Smrg DWORD protection = 0;
700*490215a3Smrg if (!ChangeMemoryProtection(old_func, kJumpInstructionLength, &protection))
701*490215a3Smrg return false;
702*490215a3Smrg
703*490215a3Smrg // Write a relative jump to the redirected function.
704*490215a3Smrg WriteJumpInstruction(old_func, FIRST_32_SECOND_64(new_func, trampoline));
705*490215a3Smrg
706*490215a3Smrg // Restore previous memory protection.
707*490215a3Smrg if (!RestoreMemoryProtection(old_func, kJumpInstructionLength, protection))
708*490215a3Smrg return false;
709*490215a3Smrg
710*490215a3Smrg return true;
711*490215a3Smrg }
712*490215a3Smrg
OverrideFunctionWithHotPatch(uptr old_func,uptr new_func,uptr * orig_old_func)713*490215a3Smrg bool OverrideFunctionWithHotPatch(
714*490215a3Smrg uptr old_func, uptr new_func, uptr *orig_old_func) {
715*490215a3Smrg const int kHotPatchHeaderLen = kBranchLength;
716*490215a3Smrg
717*490215a3Smrg uptr header = (uptr)old_func - kHotPatchHeaderLen;
718*490215a3Smrg uptr patch_length = kHotPatchHeaderLen + kShortJumpInstructionLength;
719*490215a3Smrg
720*490215a3Smrg // Validate that the function is hot patchable.
721*490215a3Smrg size_t instruction_size = GetInstructionSize(old_func);
722*490215a3Smrg if (instruction_size < kShortJumpInstructionLength ||
723*490215a3Smrg !FunctionHasPadding(old_func, kHotPatchHeaderLen))
724*490215a3Smrg return false;
725*490215a3Smrg
726*490215a3Smrg if (orig_old_func) {
727*490215a3Smrg // Put the needed instructions into the trampoline bytes.
728*490215a3Smrg uptr trampoline_length = instruction_size + kDirectBranchLength;
729*490215a3Smrg uptr trampoline = AllocateMemoryForTrampoline(old_func, trampoline_length);
730*490215a3Smrg if (!trampoline)
731*490215a3Smrg return false;
732*490215a3Smrg if (!CopyInstructions(trampoline, old_func, instruction_size))
733*490215a3Smrg return false;
734*490215a3Smrg WriteDirectBranch(trampoline + instruction_size,
735*490215a3Smrg old_func + instruction_size);
736*490215a3Smrg *orig_old_func = trampoline;
737*490215a3Smrg }
738*490215a3Smrg
739*490215a3Smrg // If needed, get memory space for indirect address.
740*490215a3Smrg uptr indirect_address = 0;
741*490215a3Smrg #if SANITIZER_WINDOWS64
742*490215a3Smrg indirect_address = AllocateMemoryForTrampoline(old_func, kAddressLength);
743*490215a3Smrg if (!indirect_address)
744*490215a3Smrg return false;
745*490215a3Smrg #endif
746*490215a3Smrg
747*490215a3Smrg // Change memory protection to writable.
748*490215a3Smrg DWORD protection = 0;
749*490215a3Smrg if (!ChangeMemoryProtection(header, patch_length, &protection))
750*490215a3Smrg return false;
751*490215a3Smrg
752*490215a3Smrg // Write jumps to the redirected function.
753*490215a3Smrg WriteBranch(header, indirect_address, new_func);
754*490215a3Smrg WriteShortJumpInstruction(old_func, header);
755*490215a3Smrg
756*490215a3Smrg // Restore previous memory protection.
757*490215a3Smrg if (!RestoreMemoryProtection(header, patch_length, protection))
758*490215a3Smrg return false;
759*490215a3Smrg
760*490215a3Smrg return true;
761*490215a3Smrg }
762*490215a3Smrg
OverrideFunctionWithTrampoline(uptr old_func,uptr new_func,uptr * orig_old_func)763*490215a3Smrg bool OverrideFunctionWithTrampoline(
764*490215a3Smrg uptr old_func, uptr new_func, uptr *orig_old_func) {
765*490215a3Smrg
766*490215a3Smrg size_t instructions_length = kBranchLength;
767*490215a3Smrg size_t padding_length = 0;
768*490215a3Smrg uptr indirect_address = 0;
769*490215a3Smrg
770*490215a3Smrg if (orig_old_func) {
771*490215a3Smrg // Find out the number of bytes of the instructions we need to copy
772*490215a3Smrg // to the trampoline.
773*490215a3Smrg instructions_length = RoundUpToInstrBoundary(kBranchLength, old_func);
774*490215a3Smrg if (!instructions_length)
775*490215a3Smrg return false;
776*490215a3Smrg
777*490215a3Smrg // Put the needed instructions into the trampoline bytes.
778*490215a3Smrg uptr trampoline_length = instructions_length + kDirectBranchLength;
779*490215a3Smrg uptr trampoline = AllocateMemoryForTrampoline(old_func, trampoline_length);
780*490215a3Smrg if (!trampoline)
781*490215a3Smrg return false;
782*490215a3Smrg if (!CopyInstructions(trampoline, old_func, instructions_length))
783*490215a3Smrg return false;
784*490215a3Smrg WriteDirectBranch(trampoline + instructions_length,
785*490215a3Smrg old_func + instructions_length);
786*490215a3Smrg *orig_old_func = trampoline;
787*490215a3Smrg }
788*490215a3Smrg
789*490215a3Smrg #if SANITIZER_WINDOWS64
790*490215a3Smrg // Check if the targeted address can be encoded in the function padding.
791*490215a3Smrg // Otherwise, allocate it in the trampoline region.
792*490215a3Smrg if (IsMemoryPadding(old_func - kAddressLength, kAddressLength)) {
793*490215a3Smrg indirect_address = old_func - kAddressLength;
794*490215a3Smrg padding_length = kAddressLength;
795*490215a3Smrg } else {
796*490215a3Smrg indirect_address = AllocateMemoryForTrampoline(old_func, kAddressLength);
797*490215a3Smrg if (!indirect_address)
798*490215a3Smrg return false;
799*490215a3Smrg }
800*490215a3Smrg #endif
801*490215a3Smrg
802*490215a3Smrg // Change memory protection to writable.
803*490215a3Smrg uptr patch_address = old_func - padding_length;
804*490215a3Smrg uptr patch_length = instructions_length + padding_length;
805*490215a3Smrg DWORD protection = 0;
806*490215a3Smrg if (!ChangeMemoryProtection(patch_address, patch_length, &protection))
807*490215a3Smrg return false;
808*490215a3Smrg
809*490215a3Smrg // Patch the original function.
810*490215a3Smrg WriteBranch(old_func, indirect_address, new_func);
811*490215a3Smrg
812*490215a3Smrg // Restore previous memory protection.
813*490215a3Smrg if (!RestoreMemoryProtection(patch_address, patch_length, protection))
814*490215a3Smrg return false;
815*490215a3Smrg
816*490215a3Smrg return true;
817*490215a3Smrg }
818*490215a3Smrg
OverrideFunction(uptr old_func,uptr new_func,uptr * orig_old_func)819*490215a3Smrg bool OverrideFunction(
820*490215a3Smrg uptr old_func, uptr new_func, uptr *orig_old_func) {
821*490215a3Smrg #if !SANITIZER_WINDOWS64
822*490215a3Smrg if (OverrideFunctionWithDetour(old_func, new_func, orig_old_func))
823*490215a3Smrg return true;
824*490215a3Smrg #endif
825*490215a3Smrg if (OverrideFunctionWithRedirectJump(old_func, new_func, orig_old_func))
826*490215a3Smrg return true;
827*490215a3Smrg if (OverrideFunctionWithHotPatch(old_func, new_func, orig_old_func))
828*490215a3Smrg return true;
829*490215a3Smrg if (OverrideFunctionWithTrampoline(old_func, new_func, orig_old_func))
830*490215a3Smrg return true;
831*490215a3Smrg return false;
832*490215a3Smrg }
833*490215a3Smrg
InterestingDLLsAvailable()834*490215a3Smrg static void **InterestingDLLsAvailable() {
835*490215a3Smrg static const char *InterestingDLLs[] = {
836*490215a3Smrg "kernel32.dll",
837*490215a3Smrg "msvcr100.dll", // VS2010
838*490215a3Smrg "msvcr110.dll", // VS2012
839*490215a3Smrg "msvcr120.dll", // VS2013
840*490215a3Smrg "vcruntime140.dll", // VS2015
841*490215a3Smrg "ucrtbase.dll", // Universal CRT
842*490215a3Smrg // NTDLL should go last as it exports some functions that we should
843*490215a3Smrg // override in the CRT [presumably only used internally].
844*490215a3Smrg "ntdll.dll", NULL};
845*490215a3Smrg static void *result[ARRAY_SIZE(InterestingDLLs)] = { 0 };
846*490215a3Smrg if (!result[0]) {
847*490215a3Smrg for (size_t i = 0, j = 0; InterestingDLLs[i]; ++i) {
848*490215a3Smrg if (HMODULE h = GetModuleHandleA(InterestingDLLs[i]))
849*490215a3Smrg result[j++] = (void *)h;
850*490215a3Smrg }
851*490215a3Smrg }
852*490215a3Smrg return &result[0];
853*490215a3Smrg }
854*490215a3Smrg
855*490215a3Smrg namespace {
856*490215a3Smrg // Utility for reading loaded PE images.
857*490215a3Smrg template <typename T> class RVAPtr {
858*490215a3Smrg public:
RVAPtr(void * module,uptr rva)859*490215a3Smrg RVAPtr(void *module, uptr rva)
860*490215a3Smrg : ptr_(reinterpret_cast<T *>(reinterpret_cast<char *>(module) + rva)) {}
operator T*()861*490215a3Smrg operator T *() { return ptr_; }
operator ->()862*490215a3Smrg T *operator->() { return ptr_; }
operator ++()863*490215a3Smrg T *operator++() { return ++ptr_; }
864*490215a3Smrg
865*490215a3Smrg private:
866*490215a3Smrg T *ptr_;
867*490215a3Smrg };
868*490215a3Smrg } // namespace
869*490215a3Smrg
870*490215a3Smrg // Internal implementation of GetProcAddress. At least since Windows 8,
871*490215a3Smrg // GetProcAddress appears to initialize DLLs before returning function pointers
872*490215a3Smrg // into them. This is problematic for the sanitizers, because they typically
873*490215a3Smrg // want to intercept malloc *before* MSVCRT initializes. Our internal
874*490215a3Smrg // implementation walks the export list manually without doing initialization.
InternalGetProcAddress(void * module,const char * func_name)875*490215a3Smrg uptr InternalGetProcAddress(void *module, const char *func_name) {
876*490215a3Smrg // Check that the module header is full and present.
877*490215a3Smrg RVAPtr<IMAGE_DOS_HEADER> dos_stub(module, 0);
878*490215a3Smrg RVAPtr<IMAGE_NT_HEADERS> headers(module, dos_stub->e_lfanew);
879*490215a3Smrg if (!module || dos_stub->e_magic != IMAGE_DOS_SIGNATURE || // "MZ"
880*490215a3Smrg headers->Signature != IMAGE_NT_SIGNATURE || // "PE\0\0"
881*490215a3Smrg headers->FileHeader.SizeOfOptionalHeader <
882*490215a3Smrg sizeof(IMAGE_OPTIONAL_HEADER)) {
883*490215a3Smrg return 0;
884*490215a3Smrg }
885*490215a3Smrg
886*490215a3Smrg IMAGE_DATA_DIRECTORY *export_directory =
887*490215a3Smrg &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
888*490215a3Smrg if (export_directory->Size == 0)
889*490215a3Smrg return 0;
890*490215a3Smrg RVAPtr<IMAGE_EXPORT_DIRECTORY> exports(module,
891*490215a3Smrg export_directory->VirtualAddress);
892*490215a3Smrg RVAPtr<DWORD> functions(module, exports->AddressOfFunctions);
893*490215a3Smrg RVAPtr<DWORD> names(module, exports->AddressOfNames);
894*490215a3Smrg RVAPtr<WORD> ordinals(module, exports->AddressOfNameOrdinals);
895*490215a3Smrg
896*490215a3Smrg for (DWORD i = 0; i < exports->NumberOfNames; i++) {
897*490215a3Smrg RVAPtr<char> name(module, names[i]);
898*490215a3Smrg if (!strcmp(func_name, name)) {
899*490215a3Smrg DWORD index = ordinals[i];
900*490215a3Smrg RVAPtr<char> func(module, functions[index]);
901*490215a3Smrg
902*490215a3Smrg // Handle forwarded functions.
903*490215a3Smrg DWORD offset = functions[index];
904*490215a3Smrg if (offset >= export_directory->VirtualAddress &&
905*490215a3Smrg offset < export_directory->VirtualAddress + export_directory->Size) {
906*490215a3Smrg // An entry for a forwarded function is a string with the following
907*490215a3Smrg // format: "<module> . <function_name>" that is stored into the
908*490215a3Smrg // exported directory.
909*490215a3Smrg char function_name[256];
910*490215a3Smrg size_t funtion_name_length = _strlen(func);
911*490215a3Smrg if (funtion_name_length >= sizeof(function_name) - 1)
912*490215a3Smrg InterceptionFailed();
913*490215a3Smrg
914*490215a3Smrg _memcpy(function_name, func, funtion_name_length);
915*490215a3Smrg function_name[funtion_name_length] = '\0';
916*490215a3Smrg char* separator = _strchr(function_name, '.');
917*490215a3Smrg if (!separator)
918*490215a3Smrg InterceptionFailed();
919*490215a3Smrg *separator = '\0';
920*490215a3Smrg
921*490215a3Smrg void* redirected_module = GetModuleHandleA(function_name);
922*490215a3Smrg if (!redirected_module)
923*490215a3Smrg InterceptionFailed();
924*490215a3Smrg return InternalGetProcAddress(redirected_module, separator + 1);
925*490215a3Smrg }
926*490215a3Smrg
927*490215a3Smrg return (uptr)(char *)func;
928*490215a3Smrg }
929*490215a3Smrg }
930*490215a3Smrg
931*490215a3Smrg return 0;
932*490215a3Smrg }
933*490215a3Smrg
OverrideFunction(const char * func_name,uptr new_func,uptr * orig_old_func)934*490215a3Smrg bool OverrideFunction(
935*490215a3Smrg const char *func_name, uptr new_func, uptr *orig_old_func) {
936*490215a3Smrg bool hooked = false;
937*490215a3Smrg void **DLLs = InterestingDLLsAvailable();
938*490215a3Smrg for (size_t i = 0; DLLs[i]; ++i) {
939*490215a3Smrg uptr func_addr = InternalGetProcAddress(DLLs[i], func_name);
940*490215a3Smrg if (func_addr &&
941*490215a3Smrg OverrideFunction(func_addr, new_func, orig_old_func)) {
942*490215a3Smrg hooked = true;
943*490215a3Smrg }
944*490215a3Smrg }
945*490215a3Smrg return hooked;
946*490215a3Smrg }
947*490215a3Smrg
OverrideImportedFunction(const char * module_to_patch,const char * imported_module,const char * function_name,uptr new_function,uptr * orig_old_func)948*490215a3Smrg bool OverrideImportedFunction(const char *module_to_patch,
949*490215a3Smrg const char *imported_module,
950*490215a3Smrg const char *function_name, uptr new_function,
951*490215a3Smrg uptr *orig_old_func) {
952*490215a3Smrg HMODULE module = GetModuleHandleA(module_to_patch);
953*490215a3Smrg if (!module)
954*490215a3Smrg return false;
955*490215a3Smrg
956*490215a3Smrg // Check that the module header is full and present.
957*490215a3Smrg RVAPtr<IMAGE_DOS_HEADER> dos_stub(module, 0);
958*490215a3Smrg RVAPtr<IMAGE_NT_HEADERS> headers(module, dos_stub->e_lfanew);
959*490215a3Smrg if (!module || dos_stub->e_magic != IMAGE_DOS_SIGNATURE || // "MZ"
960*490215a3Smrg headers->Signature != IMAGE_NT_SIGNATURE || // "PE\0\0"
961*490215a3Smrg headers->FileHeader.SizeOfOptionalHeader <
962*490215a3Smrg sizeof(IMAGE_OPTIONAL_HEADER)) {
963*490215a3Smrg return false;
964*490215a3Smrg }
965*490215a3Smrg
966*490215a3Smrg IMAGE_DATA_DIRECTORY *import_directory =
967*490215a3Smrg &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
968*490215a3Smrg
969*490215a3Smrg // Iterate the list of imported DLLs. FirstThunk will be null for the last
970*490215a3Smrg // entry.
971*490215a3Smrg RVAPtr<IMAGE_IMPORT_DESCRIPTOR> imports(module,
972*490215a3Smrg import_directory->VirtualAddress);
973*490215a3Smrg for (; imports->FirstThunk != 0; ++imports) {
974*490215a3Smrg RVAPtr<const char> modname(module, imports->Name);
975*490215a3Smrg if (_stricmp(&*modname, imported_module) == 0)
976*490215a3Smrg break;
977*490215a3Smrg }
978*490215a3Smrg if (imports->FirstThunk == 0)
979*490215a3Smrg return false;
980*490215a3Smrg
981*490215a3Smrg // We have two parallel arrays: the import address table (IAT) and the table
982*490215a3Smrg // of names. They start out containing the same data, but the loader rewrites
983*490215a3Smrg // the IAT to hold imported addresses and leaves the name table in
984*490215a3Smrg // OriginalFirstThunk alone.
985*490215a3Smrg RVAPtr<IMAGE_THUNK_DATA> name_table(module, imports->OriginalFirstThunk);
986*490215a3Smrg RVAPtr<IMAGE_THUNK_DATA> iat(module, imports->FirstThunk);
987*490215a3Smrg for (; name_table->u1.Ordinal != 0; ++name_table, ++iat) {
988*490215a3Smrg if (!IMAGE_SNAP_BY_ORDINAL(name_table->u1.Ordinal)) {
989*490215a3Smrg RVAPtr<IMAGE_IMPORT_BY_NAME> import_by_name(
990*490215a3Smrg module, name_table->u1.ForwarderString);
991*490215a3Smrg const char *funcname = &import_by_name->Name[0];
992*490215a3Smrg if (strcmp(funcname, function_name) == 0)
993*490215a3Smrg break;
994*490215a3Smrg }
995*490215a3Smrg }
996*490215a3Smrg if (name_table->u1.Ordinal == 0)
997*490215a3Smrg return false;
998*490215a3Smrg
999*490215a3Smrg // Now we have the correct IAT entry. Do the swap. We have to make the page
1000*490215a3Smrg // read/write first.
1001*490215a3Smrg if (orig_old_func)
1002*490215a3Smrg *orig_old_func = iat->u1.AddressOfData;
1003*490215a3Smrg DWORD old_prot, unused_prot;
1004*490215a3Smrg if (!VirtualProtect(&iat->u1.AddressOfData, 4, PAGE_EXECUTE_READWRITE,
1005*490215a3Smrg &old_prot))
1006*490215a3Smrg return false;
1007*490215a3Smrg iat->u1.AddressOfData = new_function;
1008*490215a3Smrg if (!VirtualProtect(&iat->u1.AddressOfData, 4, old_prot, &unused_prot))
1009*490215a3Smrg return false; // Not clear if this failure bothers us.
1010*490215a3Smrg return true;
1011*490215a3Smrg }
1012*490215a3Smrg
1013*490215a3Smrg } // namespace __interception
1014*490215a3Smrg
1015*490215a3Smrg #endif // SANITIZER_MAC
1016