1 // Copyright (c) 2010 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 6 #ifndef CHROME_FRAME_FUNCTION_STUB_H_ 7 #define CHROME_FRAME_FUNCTION_STUB_H_ 8 9 #include <windows.h> 10 11 #include "base/basictypes.h" 12 13 // IMPORTANT: The struct below must be byte aligned. 14 #pragma pack(push) 15 #pragma pack(1) 16 17 struct FunctionStubAsm { 18 // The stub always starts with an indirect jump, which starts out jumping 19 // to the remainder of the stub. This means we can bypass the stub by 20 // rewriting the jump destination, which is data, in a manner that does 21 // not involve writing code, only writing data at a natural word boundary. 22 uint16 jump_to_bypass_; // indirect jump 23 uintptr_t bypass_target_addr_; // to the bypass target. 24 uint8 pop_return_addr_; // pop eax 25 uint16 push_; // push [arg] ; push... 26 uintptr_t arg_addr_; // ; extra argument 27 uint8 push_return_addr_; // push eax ; push the return address 28 uint16 jump_to_target; // jmp [target] ; jump... 29 uintptr_t target_addr_; // ; to the hook function 30 }; 31 32 #pragma pack(pop) 33 34 35 #ifndef _M_IX86 36 #error Only x86 supported right now. 37 #endif 38 39 // This struct is assembly code + signature. The purpose of the struct is to be 40 // able to hook an existing function with our own and store information such 41 // as the original function pointer with the code stub. Typically this is used 42 // for patching entries of a vtable or e.g. a globally registered wndproc 43 // for a class as opposed to a window. 44 // When unhooking, you can just call the BypassStub() function and leave the 45 // stub in memory. This unhooks your function while leaving the (potential) 46 // chain of patches intact. 47 // 48 // @note: This class is meant for __stdcall calling convention and 49 // it uses eax as a temporary variable. The struct can 50 // be improved in the future to save eax before the 51 // operation and then restore it. 52 // 53 // For instance if the function prototype is: 54 // 55 // @code 56 // LRESULT WndProc(HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam); 57 // @endcode 58 // 59 // and we would like to add one static argument to make it, say: 60 // 61 // @code 62 // LRESULT MyNewWndProc(WNDPROC original, HWND hwnd, UINT msg, 63 // WPARAM wparam, LPARAM lparam); 64 // @endcode 65 // 66 // That can be achieved by wrapping the function up with a FunctionStub: 67 // 68 // @code 69 // FunctionStub* stub = FunctionStub::Create(original_wndproc, MyNewWndProc); 70 // SetClassLongPtr(wnd, GCLP_WNDPROC, stub->code()); 71 // @endcode 72 struct FunctionStub { 73 public: 74 // Neutralizes this stub and converts it to a direct jump to a new target. 75 void BypassStub(void* new_target); 76 77 inline bool is_bypassed() const { 78 return bypass_address_ != 79 reinterpret_cast<uintptr_t>(&stub_.pop_return_addr_); 80 } 81 82 // Returns true if the stub is valid and enabled. 83 // Don't call this method after bypassing the stub. 84 bool is_valid() const; 85 86 inline PROC code() const { 87 return reinterpret_cast<PROC>(const_cast<FunctionStubAsm*>(&stub_)); 88 } 89 90 // Use to create a new function stub as shown above. 91 // @param extra_argument The static argument to pass to the function. 92 // @param dest Target function to which the stub applies. 93 // @returns NULL if an error occurs, otherwise a pointer to the 94 // function stub. 95 static FunctionStub* Create(uintptr_t extra_argument, void* dest); 96 97 // Test whether address (likely) points to an existing function stub. 98 // @returns NULL if address does not point to a function stub. 99 // @note likely means approximately 1/2^48 here. 100 static FunctionStub* FromCode(void* address); 101 102 // Deallocates a FunctionStub. 103 // The stub must not be in use on any thread! 104 static bool Destroy(FunctionStub* stub); 105 106 // Accessors. 107 uintptr_t argument() const { return argument_; } 108 void set_argument(uintptr_t argument) { argument_ = argument; } 109 110 uintptr_t bypass_address() const { return bypass_address_; } 111 void set_bypass_address(uintptr_t bypass_address) { 112 bypass_address_ = bypass_address; 113 } 114 115 uintptr_t destination_function() const { return destination_function_; } 116 void set_destination_function(uintptr_t destination_function) { 117 destination_function_ = destination_function; 118 } 119 120 protected: 121 // Protected for testing only. 122 FunctionStub(uintptr_t extra_argument, void* dest); 123 ~FunctionStub(); 124 125 void Init(FunctionStubAsm* stub); 126 127 FunctionStubAsm stub_; 128 129 // Used to identify function stubs that belong to this module. 130 HMODULE signature_; 131 132 // This is the argument value that gets passed to the destination_function_. 133 uintptr_t argument_; 134 // Bypass address, if this is the address of the pop_return_addr_, the 135 // function stub is not bypassed. 136 uintptr_t bypass_address_; 137 // The destination function we dispatch to, not used if the stub 138 // is bypassed. 139 uintptr_t destination_function_; 140 }; 141 142 #endif // CHROME_FRAME_FUNCTION_STUB_H_ 143
