OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <stdint.h> | 5 #include <stdint.h> |
6 | 6 |
7 #include "courgette/rel32_finder_win32_x86.h" | 7 #include "courgette/rel32_finder_x64.h" |
8 | 8 |
9 namespace courgette { | 9 namespace courgette { |
10 | 10 |
11 Rel32FinderWin32X86::Rel32FinderWin32X86(RVA relocs_start_rva, | 11 Rel32FinderX64::Rel32FinderX64(RVA relocs_start_rva, RVA relocs_end_rva) |
12 RVA relocs_end_rva) | 12 : Rel32Finder(relocs_start_rva, relocs_end_rva) {} |
13 : relocs_start_rva_(relocs_start_rva), relocs_end_rva_(relocs_end_rva) { | |
14 } | |
15 | 13 |
16 Rel32FinderWin32X86::~Rel32FinderWin32X86() { | 14 void Rel32FinderX64::Find(const uint8_t* start_pointer, |
17 } | 15 const uint8_t* end_pointer, |
18 | 16 RVA start_rva, |
19 void Rel32FinderWin32X86::SwapRel32Locations(std::vector<RVA>* dest) { | 17 RVA end_rva, |
20 dest->swap(rel32_locations_); | 18 uint32_t size_of_image, |
21 } | 19 const std::vector<RVA>& abs32_locations) { |
22 | |
23 #if COURGETTE_HISTOGRAM_TARGETS | |
24 void Rel32FinderWin32X86::SwapRel32TargetRVAs(std::map<RVA, int>* dest) { | |
25 dest->swap(rel32_target_rvas_); | |
26 } | |
27 #endif | |
28 | |
29 Rel32FinderWin32X86_Basic::Rel32FinderWin32X86_Basic(RVA relocs_start_rva, | |
30 RVA relocs_end_rva) | |
31 : Rel32FinderWin32X86(relocs_start_rva, relocs_end_rva) { | |
32 } | |
33 | |
34 Rel32FinderWin32X86_Basic::~Rel32FinderWin32X86_Basic() { | |
35 } | |
36 | |
37 void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer, | |
38 const uint8_t* end_pointer, | |
39 RVA start_rva, | |
40 RVA end_rva, | |
41 const std::vector<RVA>& abs32_locations) { | |
42 // Quick way to convert from Pointer to RVA within a single Section is to | 20 // Quick way to convert from Pointer to RVA within a single Section is to |
43 // subtract 'pointer_to_rva'. | 21 // subtract 'pointer_to_rva'. |
44 const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva; | 22 const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva; |
45 | 23 |
46 std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin(); | 24 std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin(); |
47 | 25 |
48 // Find the rel32 relocations. | 26 // Find the rel32 relocations. |
49 const uint8_t* p = start_pointer; | 27 const uint8_t* p = start_pointer; |
50 while (p < end_pointer) { | 28 while (p < end_pointer) { |
51 RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva); | 29 RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva); |
52 | 30 |
53 // Skip the base reloation table if we encounter it. | 31 // Skip the base reloation table if we encounter it. |
54 // Note: We're not bothering to handle the edge case where a Rel32 pointer | 32 // Note: We're not bothering to handle the edge case where a Rel32 pointer |
55 // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it. | 33 // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it. |
56 if (current_rva == relocs_start_rva_) { | 34 if (current_rva >= relocs_start_rva_ && current_rva < relocs_end_rva_) { |
57 if (relocs_start_rva_ < relocs_end_rva_) { | 35 p += relocs_end_rva_ - current_rva; |
58 p += relocs_end_rva_ - relocs_start_rva_; | 36 continue; |
59 continue; | |
60 } | |
61 } | 37 } |
62 | 38 |
63 // Heuristic discovery of rel32 locations in instruction stream: are the | 39 // Heuristic discovery of rel32 locations in instruction stream: are the |
64 // next few bytes the start of an instruction containing a rel32 | 40 // next few bytes the start of an instruction containing a rel32 |
65 // addressing mode? | 41 // addressing mode? |
66 const uint8_t* rel32 = nullptr; | 42 const uint8_t* rel32 = nullptr; |
| 43 bool is_rip_relative = false; |
67 | 44 |
68 if (p + 5 <= end_pointer) { | 45 if (p + 5 <= end_pointer) { |
69 if (*p == 0xE8 || *p == 0xE9) { // jmp rel32 and call rel32 | 46 if (*p == 0xE8 || *p == 0xE9) // jmp rel32 and call rel32 |
70 rel32 = p + 1; | 47 rel32 = p + 1; |
| 48 } |
| 49 if (p + 6 <= end_pointer) { |
| 50 if (*p == 0x0F && (*(p + 1) & 0xF0) == 0x80) { // Jcc long form |
| 51 if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely |
| 52 rel32 = p + 2; |
| 53 } else if ((*p == 0xFF && (*(p + 1) == 0x15 || *(p + 1) == 0x25)) || |
| 54 ((*p == 0x8B || *p == 0x8D) && (*(p + 1) & 0xC7) == 0x05)) { |
| 55 // rip relative call/jmp/lea |
| 56 rel32 = p + 2; |
| 57 is_rip_relative = true; |
71 } | 58 } |
72 } | 59 } |
73 if (p + 6 <= end_pointer) { | 60 if (p + 7 <= end_pointer) { |
74 if (*p == 0x0F && (*(p+1) & 0xF0) == 0x80) { // Jcc long form | 61 if ((*p & 0xFB) == 0x48 && (*(p + 1) == 0x8D || *(p + 1) == 0x8B) && |
75 if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely | 62 (*(p + 2) & 0xC7) == 0x05) { |
76 rel32 = p + 2; | 63 // rip relative lea |
| 64 rel32 = p + 3; |
| 65 is_rip_relative = true; |
77 } | 66 } |
78 } | 67 } |
| 68 |
79 if (rel32) { | 69 if (rel32) { |
80 RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva); | 70 RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva); |
81 | 71 |
82 // Is there an abs32 reloc overlapping the candidate? | 72 // Is there an abs32 reloc overlapping the candidate? |
83 while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3) | 73 while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3) |
84 ++abs32_pos; | 74 ++abs32_pos; |
85 // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte | 75 // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte |
86 // region that could overlap rel32_rva. | 76 // region that could overlap rel32_rva. |
87 if (abs32_pos != abs32_locations.end()) { | 77 if (abs32_pos != abs32_locations.end()) { |
88 if (*abs32_pos < rel32_rva + 4) { | 78 if (*abs32_pos < rel32_rva + 4) { |
89 // Beginning of abs32 reloc is before end of rel32 reloc so they | 79 // Beginning of abs32 reloc is before end of rel32 reloc so they |
90 // overlap. Skip four bytes past the abs32 reloc. | 80 // overlap. Skip four bytes past the abs32 reloc. |
91 p += (*abs32_pos + 4) - current_rva; | 81 p += (*abs32_pos + 4) - current_rva; |
92 continue; | 82 continue; |
93 } | 83 } |
94 } | 84 } |
95 | 85 |
96 // + 4 since offset is relative to start of next instruction. | |
97 RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32); | 86 RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32); |
98 // Valid, rel32 target must be within image, and within this section. | 87 // To be valid, rel32 target must be within image, and within this |
99 // Subsumes |target_rva| != |kUnassignedRVA|. | 88 // section. |
100 if (start_rva <= target_rva && target_rva < end_rva) { | 89 if (target_rva < size_of_image && // Subsumes rva != kUnassignedRVA. |
| 90 (is_rip_relative || |
| 91 (start_rva <= target_rva && target_rva < end_rva))) { |
101 rel32_locations_.push_back(rel32_rva); | 92 rel32_locations_.push_back(rel32_rva); |
102 #if COURGETTE_HISTOGRAM_TARGETS | 93 #if COURGETTE_HISTOGRAM_TARGETS |
103 ++rel32_target_rvas_[target_rva]; | 94 ++rel32_target_rvas_[target_rva]; |
104 #endif | 95 #endif |
105 p = rel32 + 4; | 96 p = rel32 + 4; |
106 continue; | 97 continue; |
107 } | 98 } |
108 } | 99 } |
109 p += 1; | 100 p += 1; |
110 } | 101 } |
111 } | 102 } |
112 | 103 |
113 } // namespace courgette | 104 } // namespace courgette |
OLD | NEW |