| Index: courgette/rel32_finder_x86.cc
|
| diff --git a/courgette/rel32_finder_win32_x86.cc b/courgette/rel32_finder_x86.cc
|
| similarity index 60%
|
| rename from courgette/rel32_finder_win32_x86.cc
|
| rename to courgette/rel32_finder_x86.cc
|
| index 61ff9696d5ac19174d514c8930111e64c326342e..e5735ee4e4aa0cb481b0c14e492933e206560be5 100644
|
| --- a/courgette/rel32_finder_win32_x86.cc
|
| +++ b/courgette/rel32_finder_x86.cc
|
| @@ -2,45 +2,25 @@
|
| // Use of this source code is governed by a BSD-style license that can be
|
| // found in the LICENSE file.
|
|
|
| -#include <stdint.h>
|
| -
|
| -#include "courgette/rel32_finder_win32_x86.h"
|
| +#include "courgette/rel32_finder_x86.h"
|
|
|
| namespace courgette {
|
|
|
| -Rel32FinderWin32X86::Rel32FinderWin32X86(RVA relocs_start_rva,
|
| - RVA relocs_end_rva)
|
| - : relocs_start_rva_(relocs_start_rva), relocs_end_rva_(relocs_end_rva) {
|
| -}
|
| -
|
| -Rel32FinderWin32X86::~Rel32FinderWin32X86() {
|
| -}
|
| -
|
| -void Rel32FinderWin32X86::SwapRel32Locations(std::vector<RVA>* dest) {
|
| - dest->swap(rel32_locations_);
|
| -}
|
| -
|
| -#if COURGETTE_HISTOGRAM_TARGETS
|
| -void Rel32FinderWin32X86::SwapRel32TargetRVAs(std::map<RVA, int>* dest) {
|
| - dest->swap(rel32_target_rvas_);
|
| -}
|
| -#endif
|
| -
|
| -Rel32FinderWin32X86_Basic::Rel32FinderWin32X86_Basic(RVA relocs_start_rva,
|
| - RVA relocs_end_rva)
|
| - : Rel32FinderWin32X86(relocs_start_rva, relocs_end_rva) {
|
| -}
|
| -
|
| -Rel32FinderWin32X86_Basic::~Rel32FinderWin32X86_Basic() {
|
| -}
|
| -
|
| -void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
|
| - const uint8_t* end_pointer,
|
| - RVA start_rva,
|
| - RVA end_rva,
|
| - const std::vector<RVA>& abs32_locations) {
|
| +Rel32FinderX86::Rel32FinderX86(RVA relocs_start_rva, RVA relocs_end_rva)
|
| + : Rel32Finder(relocs_start_rva, relocs_end_rva) {}
|
| +
|
| +// Scan for opcodes matching the following instructions :
|
| +// rel32 JMP/CALL
|
| +// Jcc (excluding JPO/JPE)
|
| +// Falsely detected rel32 that collide with known abs32 or that point outside
|
| +// valid regions are discarded.
|
| +void Rel32FinderX86::Find(const uint8_t* start_pointer,
|
| + const uint8_t* end_pointer,
|
| + RVA start_rva,
|
| + RVA end_rva,
|
| + const std::vector<RVA>& abs32_locations) {
|
| // Quick way to convert from Pointer to RVA within a single Section is to
|
| - // subtract 'pointer_to_rva'.
|
| + // subtract |adjust_pointer_to_rva|.
|
| const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva;
|
|
|
| std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin();
|
| @@ -53,11 +33,9 @@ void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
|
| // Skip the base reloation table if we encounter it.
|
| // Note: We're not bothering to handle the edge case where a Rel32 pointer
|
| // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it.
|
| - if (current_rva == relocs_start_rva_) {
|
| - if (relocs_start_rva_ < relocs_end_rva_) {
|
| - p += relocs_end_rva_ - relocs_start_rva_;
|
| - continue;
|
| - }
|
| + if (current_rva >= relocs_start_rva_ && current_rva < relocs_end_rva_) {
|
| + p += relocs_end_rva_ - current_rva;
|
| + continue;
|
| }
|
|
|
| // Heuristic discovery of rel32 locations in instruction stream: are the
|
| @@ -66,13 +44,13 @@ void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
|
| const uint8_t* rel32 = nullptr;
|
|
|
| if (p + 5 <= end_pointer) {
|
| - if (*p == 0xE8 || *p == 0xE9) { // jmp rel32 and call rel32
|
| + if (p[0] == 0xE8 || p[0] == 0xE9) { // jmp rel32 and call rel32
|
| rel32 = p + 1;
|
| }
|
| }
|
| if (p + 6 <= end_pointer) {
|
| - if (*p == 0x0F && (*(p+1) & 0xF0) == 0x80) { // Jcc long form
|
| - if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
|
| + if (p[0] == 0x0F && (p[1] & 0xF0) == 0x80) { // Jcc long form
|
| + if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
|
| rel32 = p + 2;
|
| }
|
| }
|
|
|