1 //===-- interception_linux.cc -----------------------------------*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file is a part of AddressSanitizer, an address sanity checker. 11 // 12 // Windows-specific interception methods. 13 //===----------------------------------------------------------------------===// 14 15 #ifdef _WIN32 16 17 #include "interception.h" 18 #include <windows.h> 19 20 namespace __interception { 21 22 bool GetRealFunctionAddress(const char *func_name, uptr *func_addr) { 23 const char *DLLS[] = { 24 "msvcr80.dll", 25 "msvcr90.dll", 26 "kernel32.dll", 27 NULL 28 }; 29 *func_addr = 0; 30 for (size_t i = 0; *func_addr == 0 && DLLS[i]; ++i) { 31 *func_addr = (uptr)GetProcAddress(GetModuleHandleA(DLLS[i]), func_name); 32 } 33 return (*func_addr != 0); 34 } 35 36 // FIXME: internal_str* and internal_mem* functions should be moved from the 37 // ASan sources into interception/. 38 39 static void _memset(void *p, int value, size_t sz) { 40 for (size_t i = 0; i < sz; ++i) 41 ((char*)p)[i] = (char)value; 42 } 43 44 static void _memcpy(void *dst, void *src, size_t sz) { 45 char *dst_c = (char*)dst, 46 *src_c = (char*)src; 47 for (size_t i = 0; i < sz; ++i) 48 dst_c[i] = src_c[i]; 49 } 50 51 static void WriteJumpInstruction(char *jmp_from, char *to) { 52 // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset fromt jmp_from 53 // to the next instruction to the destination. 54 ptrdiff_t offset = to - jmp_from - 5; 55 *jmp_from = '\xE9'; 56 *(ptrdiff_t*)(jmp_from + 1) = offset; 57 } 58 59 static char *GetMemoryForTrampoline(size_t size) { 60 // Trampolines are allocated from a common pool. 61 const int POOL_SIZE = 1024; 62 static char *pool = NULL; 63 static size_t pool_used = 0; 64 if (!pool) { 65 pool = (char *)VirtualAlloc(NULL, POOL_SIZE, MEM_RESERVE | MEM_COMMIT, 66 PAGE_EXECUTE_READWRITE); 67 // FIXME: Might want to apply PAGE_EXECUTE_READ access after all the 68 // interceptors are in place. 69 if (!pool) 70 return NULL; 71 _memset(pool, 0xCC /* int 3 */, POOL_SIZE); 72 } 73 74 if (pool_used + size > POOL_SIZE) 75 return NULL; 76 77 char *ret = pool + pool_used; 78 pool_used += size; 79 return ret; 80 } 81 82 // Returns 0 on error. 83 static size_t RoundUpToInstrBoundary(size_t size, char *code) { 84 size_t cursor = 0; 85 while (cursor < size) { 86 switch (code[cursor]) { 87 case '\x51': // push ecx 88 case '\x52': // push edx 89 case '\x53': // push ebx 90 case '\x54': // push esp 91 case '\x55': // push ebp 92 case '\x56': // push esi 93 case '\x57': // push edi 94 case '\x5D': // pop ebp 95 cursor++; 96 continue; 97 case '\x6A': // 6A XX = push XX 98 cursor += 2; 99 continue; 100 case '\xE9': // E9 XX YY ZZ WW = jmp WWZZYYXX 101 cursor += 5; 102 continue; 103 } 104 switch (*(unsigned short*)(code + cursor)) { // NOLINT 105 case 0xFF8B: // 8B FF = mov edi, edi 106 case 0xEC8B: // 8B EC = mov ebp, esp 107 case 0xC033: // 33 C0 = xor eax, eax 108 cursor += 2; 109 continue; 110 case 0x458B: // 8B 45 XX = mov eax, dword ptr [ebp+XXh] 111 case 0x5D8B: // 8B 5D XX = mov ebx, dword ptr [ebp+XXh] 112 case 0xEC83: // 83 EC XX = sub esp, XX 113 cursor += 3; 114 continue; 115 case 0xC1F7: // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX 116 cursor += 6; 117 continue; 118 case 0x3D83: // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX 119 cursor += 7; 120 continue; 121 } 122 switch (0x00FFFFFF & *(unsigned int*)(code + cursor)) { 123 case 0x24448A: // 8A 44 24 XX = mov eal, dword ptr [esp+XXh] 124 case 0x24448B: // 8B 44 24 XX = mov eax, dword ptr [esp+XXh] 125 case 0x244C8B: // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh] 126 case 0x24548B: // 8B 54 24 XX = mov edx, dword ptr [esp+XXh] 127 case 0x24748B: // 8B 74 24 XX = mov esi, dword ptr [esp+XXh] 128 case 0x247C8B: // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh] 129 cursor += 4; 130 continue; 131 } 132 133 // Unknown instruction! 134 // FIXME: Unknown instruction failures might happen when we add a new 135 // interceptor or a new compiler version. In either case, they should result 136 // in visible and readable error messages. However, merely calling abort() 137 // leads to an infinite recursion in CheckFailed. 138 // Do we have a good way to abort with an error message here? 139 __debugbreak(); 140 return 0; 141 } 142 143 return cursor; 144 } 145 146 bool OverrideFunction(uptr old_func, uptr new_func, uptr *orig_old_func) { 147 #ifdef _WIN64 148 #error OverrideFunction is not yet supported on x64 149 #endif 150 // Function overriding works basically like this: 151 // We write "jmp <new_func>" (5 bytes) at the beginning of the 'old_func' 152 // to override it. 153 // We might want to be able to execute the original 'old_func' from the 154 // wrapper, in this case we need to keep the leading 5+ bytes ('head') 155 // of the original code somewhere with a "jmp <old_func+head>". 156 // We call these 'head'+5 bytes of instructions a "trampoline". 157 char *old_bytes = (char *)old_func; 158 159 // We'll need at least 5 bytes for a 'jmp'. 160 size_t head = 5; 161 if (orig_old_func) { 162 // Find out the number of bytes of the instructions we need to copy 163 // to the trampoline and store it in 'head'. 164 head = RoundUpToInstrBoundary(head, old_bytes); 165 if (!head) 166 return false; 167 168 // Put the needed instructions into the trampoline bytes. 169 char *trampoline = GetMemoryForTrampoline(head + 5); 170 if (!trampoline) 171 return false; 172 _memcpy(trampoline, old_bytes, head); 173 WriteJumpInstruction(trampoline + head, old_bytes + head); 174 *orig_old_func = (uptr)trampoline; 175 } 176 177 // Now put the "jmp <new_func>" instruction at the original code location. 178 // We should preserve the EXECUTE flag as some of our own code might be 179 // located in the same page (sic!). FIXME: might consider putting the 180 // __interception code into a separate section or something? 181 DWORD old_prot, unused_prot; 182 if (!VirtualProtect((void *)old_bytes, head, PAGE_EXECUTE_READWRITE, 183 &old_prot)) 184 return false; 185 186 WriteJumpInstruction(old_bytes, (char *)new_func); 187 _memset(old_bytes + 5, 0xCC /* int 3 */, head - 5); 188 189 // Restore the original permissions. 190 if (!VirtualProtect((void *)old_bytes, head, old_prot, &unused_prot)) 191 return false; // not clear if this failure bothers us. 192 193 return true; 194 } 195 196 } // namespace __interception 197 198 #endif // _WIN32 199
