Timur Iskhodzhanov | 07bb9f1 | 2012-02-22 13:59:49 +0000 | [diff] [blame] | 1 | //===-- interception_linux.cc -----------------------------------*- C++ -*-===// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file is a part of AddressSanitizer, an address sanity checker. |
| 11 | // |
| 12 | // Windows-specific interception methods. |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
| 15 | #ifdef _WIN32 |
| 16 | |
Alexey Samsonov | bfa11b6 | 2012-08-02 11:29:14 +0000 | [diff] [blame] | 17 | #include "interception.h" |
Pirama Arumuga Nainar | 799172d | 2016-03-03 15:50:30 -0800 | [diff] [blame^] | 18 | #define WIN32_LEAN_AND_MEAN |
Timur Iskhodzhanov | 07bb9f1 | 2012-02-22 13:59:49 +0000 | [diff] [blame] | 19 | #include <windows.h> |
| 20 | |
| 21 | namespace __interception { |
| 22 | |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 23 | // FIXME: internal_str* and internal_mem* functions should be moved from the |
| 24 | // ASan sources into interception/. |
| 25 | |
| 26 | static void _memset(void *p, int value, size_t sz) { |
| 27 | for (size_t i = 0; i < sz; ++i) |
| 28 | ((char*)p)[i] = (char)value; |
| 29 | } |
| 30 | |
| 31 | static void _memcpy(void *dst, void *src, size_t sz) { |
| 32 | char *dst_c = (char*)dst, |
| 33 | *src_c = (char*)src; |
| 34 | for (size_t i = 0; i < sz; ++i) |
| 35 | dst_c[i] = src_c[i]; |
| 36 | } |
| 37 | |
| 38 | static void WriteJumpInstruction(char *jmp_from, char *to) { |
| 39 | // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset fromt jmp_from |
| 40 | // to the next instruction to the destination. |
| 41 | ptrdiff_t offset = to - jmp_from - 5; |
| 42 | *jmp_from = '\xE9'; |
| 43 | *(ptrdiff_t*)(jmp_from + 1) = offset; |
| 44 | } |
| 45 | |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 46 | static char *GetMemoryForTrampoline(size_t size) { |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 47 | // Trampolines are allocated from a common pool. |
| 48 | const int POOL_SIZE = 1024; |
| 49 | static char *pool = NULL; |
| 50 | static size_t pool_used = 0; |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 51 | if (!pool) { |
| 52 | pool = (char *)VirtualAlloc(NULL, POOL_SIZE, MEM_RESERVE | MEM_COMMIT, |
| 53 | PAGE_EXECUTE_READWRITE); |
| 54 | // FIXME: Might want to apply PAGE_EXECUTE_READ access after all the |
| 55 | // interceptors are in place. |
| 56 | if (!pool) |
| 57 | return NULL; |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 58 | _memset(pool, 0xCC /* int 3 */, POOL_SIZE); |
| 59 | } |
| 60 | |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 61 | if (pool_used + size > POOL_SIZE) |
| 62 | return NULL; |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 63 | |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 64 | char *ret = pool + pool_used; |
| 65 | pool_used += size; |
| 66 | return ret; |
| 67 | } |
| 68 | |
| 69 | // Returns 0 on error. |
| 70 | static size_t RoundUpToInstrBoundary(size_t size, char *code) { |
| 71 | size_t cursor = 0; |
| 72 | while (cursor < size) { |
| 73 | switch (code[cursor]) { |
| 74 | case '\x51': // push ecx |
| 75 | case '\x52': // push edx |
| 76 | case '\x53': // push ebx |
| 77 | case '\x54': // push esp |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 78 | case '\x55': // push ebp |
| 79 | case '\x56': // push esi |
| 80 | case '\x57': // push edi |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 81 | case '\x5D': // pop ebp |
| 82 | cursor++; |
| 83 | continue; |
| 84 | case '\x6A': // 6A XX = push XX |
| 85 | cursor += 2; |
| 86 | continue; |
| 87 | case '\xE9': // E9 XX YY ZZ WW = jmp WWZZYYXX |
Pirama Arumuga Nainar | 7c91505 | 2015-04-08 08:58:29 -0700 | [diff] [blame] | 88 | case '\xB8': // B8 XX YY ZZ WW = mov eax, WWZZYYXX |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 89 | cursor += 5; |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 90 | continue; |
| 91 | } |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 92 | switch (*(unsigned short*)(code + cursor)) { // NOLINT |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 93 | case 0xFF8B: // 8B FF = mov edi, edi |
| 94 | case 0xEC8B: // 8B EC = mov ebp, esp |
| 95 | case 0xC033: // 33 C0 = xor eax, eax |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 96 | cursor += 2; |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 97 | continue; |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 98 | case 0x458B: // 8B 45 XX = mov eax, dword ptr [ebp+XXh] |
| 99 | case 0x5D8B: // 8B 5D XX = mov ebx, dword ptr [ebp+XXh] |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 100 | case 0xEC83: // 83 EC XX = sub esp, XX |
Stephen Hines | 6d18623 | 2014-11-26 17:56:19 -0800 | [diff] [blame] | 101 | case 0x75FF: // FF 75 XX = push dword ptr [ebp+XXh] |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 102 | cursor += 3; |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 103 | continue; |
| 104 | case 0xC1F7: // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX |
Stephen Hines | 6d18623 | 2014-11-26 17:56:19 -0800 | [diff] [blame] | 105 | case 0x25FF: // FF 25 XX YY ZZ WW = jmp dword ptr ds:[WWZZYYXX] |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 106 | cursor += 6; |
| 107 | continue; |
| 108 | case 0x3D83: // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX |
| 109 | cursor += 7; |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 110 | continue; |
| 111 | } |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 112 | switch (0x00FFFFFF & *(unsigned int*)(code + cursor)) { |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 113 | case 0x24448A: // 8A 44 24 XX = mov eal, dword ptr [esp+XXh] |
Stephen Hines | 6a211c5 | 2014-07-21 00:49:56 -0700 | [diff] [blame] | 114 | case 0x24448B: // 8B 44 24 XX = mov eax, dword ptr [esp+XXh] |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 115 | case 0x244C8B: // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh] |
| 116 | case 0x24548B: // 8B 54 24 XX = mov edx, dword ptr [esp+XXh] |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 117 | case 0x24748B: // 8B 74 24 XX = mov esi, dword ptr [esp+XXh] |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 118 | case 0x247C8B: // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh] |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 119 | cursor += 4; |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 120 | continue; |
| 121 | } |
| 122 | |
| 123 | // Unknown instruction! |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 124 | // FIXME: Unknown instruction failures might happen when we add a new |
| 125 | // interceptor or a new compiler version. In either case, they should result |
| 126 | // in visible and readable error messages. However, merely calling abort() |
Stephen Hines | 6a211c5 | 2014-07-21 00:49:56 -0700 | [diff] [blame] | 127 | // leads to an infinite recursion in CheckFailed. |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 128 | // Do we have a good way to abort with an error message here? |
Stephen Hines | 6a211c5 | 2014-07-21 00:49:56 -0700 | [diff] [blame] | 129 | __debugbreak(); |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 130 | return 0; |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 131 | } |
| 132 | |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 133 | return cursor; |
| 134 | } |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 135 | |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 136 | bool OverrideFunction(uptr old_func, uptr new_func, uptr *orig_old_func) { |
| 137 | #ifdef _WIN64 |
| 138 | #error OverrideFunction is not yet supported on x64 |
| 139 | #endif |
| 140 | // Function overriding works basically like this: |
| 141 | // We write "jmp <new_func>" (5 bytes) at the beginning of the 'old_func' |
| 142 | // to override it. |
| 143 | // We might want to be able to execute the original 'old_func' from the |
| 144 | // wrapper, in this case we need to keep the leading 5+ bytes ('head') |
| 145 | // of the original code somewhere with a "jmp <old_func+head>". |
| 146 | // We call these 'head'+5 bytes of instructions a "trampoline". |
| 147 | char *old_bytes = (char *)old_func; |
| 148 | |
| 149 | // We'll need at least 5 bytes for a 'jmp'. |
| 150 | size_t head = 5; |
| 151 | if (orig_old_func) { |
| 152 | // Find out the number of bytes of the instructions we need to copy |
| 153 | // to the trampoline and store it in 'head'. |
| 154 | head = RoundUpToInstrBoundary(head, old_bytes); |
| 155 | if (!head) |
| 156 | return false; |
| 157 | |
| 158 | // Put the needed instructions into the trampoline bytes. |
| 159 | char *trampoline = GetMemoryForTrampoline(head + 5); |
| 160 | if (!trampoline) |
| 161 | return false; |
| 162 | _memcpy(trampoline, old_bytes, head); |
| 163 | WriteJumpInstruction(trampoline + head, old_bytes + head); |
| 164 | *orig_old_func = (uptr)trampoline; |
| 165 | } |
| 166 | |
| 167 | // Now put the "jmp <new_func>" instruction at the original code location. |
| 168 | // We should preserve the EXECUTE flag as some of our own code might be |
| 169 | // located in the same page (sic!). FIXME: might consider putting the |
| 170 | // __interception code into a separate section or something? |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 171 | DWORD old_prot, unused_prot; |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 172 | if (!VirtualProtect((void *)old_bytes, head, PAGE_EXECUTE_READWRITE, |
Alexey Samsonov | bfa11b6 | 2012-08-02 11:29:14 +0000 | [diff] [blame] | 173 | &old_prot)) |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 174 | return false; |
| 175 | |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 176 | WriteJumpInstruction(old_bytes, (char *)new_func); |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 177 | _memset(old_bytes + 5, 0xCC /* int 3 */, head - 5); |
| 178 | |
Stephen Hines | 2d1fdb2 | 2014-05-28 23:58:16 -0700 | [diff] [blame] | 179 | // Restore the original permissions. |
| 180 | if (!VirtualProtect((void *)old_bytes, head, old_prot, &unused_prot)) |
Timur Iskhodzhanov | 2716a61 | 2012-03-12 11:45:09 +0000 | [diff] [blame] | 181 | return false; // not clear if this failure bothers us. |
| 182 | |
| 183 | return true; |
| 184 | } |
| 185 | |
Pirama Arumuga Nainar | 799172d | 2016-03-03 15:50:30 -0800 | [diff] [blame^] | 186 | static void **InterestingDLLsAvailable() { |
Pirama Arumuga Nainar | 7c91505 | 2015-04-08 08:58:29 -0700 | [diff] [blame] | 187 | const char *InterestingDLLs[] = { |
| 188 | "kernel32.dll", |
| 189 | "msvcr110.dll", // VS2012 |
| 190 | "msvcr120.dll", // VS2013 |
| 191 | // NTDLL should go last as it exports some functions that we should override |
| 192 | // in the CRT [presumably only used internally]. |
| 193 | "ntdll.dll", NULL |
| 194 | }; |
Stephen Hines | 6d18623 | 2014-11-26 17:56:19 -0800 | [diff] [blame] | 195 | static void *result[ARRAY_SIZE(InterestingDLLs)] = { 0 }; |
| 196 | if (!result[0]) { |
| 197 | for (size_t i = 0, j = 0; InterestingDLLs[i]; ++i) { |
| 198 | if (HMODULE h = GetModuleHandleA(InterestingDLLs[i])) |
| 199 | result[j++] = (void *)h; |
| 200 | } |
| 201 | } |
Pirama Arumuga Nainar | 799172d | 2016-03-03 15:50:30 -0800 | [diff] [blame^] | 202 | return &result[0]; |
| 203 | } |
| 204 | |
| 205 | namespace { |
| 206 | // Utility for reading loaded PE images. |
| 207 | template <typename T> class RVAPtr { |
| 208 | public: |
| 209 | RVAPtr(void *module, uptr rva) |
| 210 | : ptr_(reinterpret_cast<T *>(reinterpret_cast<char *>(module) + rva)) {} |
| 211 | operator T *() { return ptr_; } |
| 212 | T *operator->() { return ptr_; } |
| 213 | T *operator++() { return ++ptr_; } |
| 214 | |
| 215 | private: |
| 216 | T *ptr_; |
| 217 | }; |
| 218 | } // namespace |
| 219 | |
| 220 | // Internal implementation of GetProcAddress. At least since Windows 8, |
| 221 | // GetProcAddress appears to initialize DLLs before returning function pointers |
| 222 | // into them. This is problematic for the sanitizers, because they typically |
| 223 | // want to intercept malloc *before* MSVCRT initializes. Our internal |
| 224 | // implementation walks the export list manually without doing initialization. |
| 225 | uptr InternalGetProcAddress(void *module, const char *func_name) { |
| 226 | // Check that the module header is full and present. |
| 227 | RVAPtr<IMAGE_DOS_HEADER> dos_stub(module, 0); |
| 228 | RVAPtr<IMAGE_NT_HEADERS> headers(module, dos_stub->e_lfanew); |
| 229 | if (!module || dos_stub->e_magic != IMAGE_DOS_SIGNATURE || // "MZ" |
| 230 | headers->Signature != IMAGE_NT_SIGNATURE || // "PE\0\0" |
| 231 | headers->FileHeader.SizeOfOptionalHeader < |
| 232 | sizeof(IMAGE_OPTIONAL_HEADER)) { |
| 233 | return 0; |
| 234 | } |
| 235 | |
| 236 | IMAGE_DATA_DIRECTORY *export_directory = |
| 237 | &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; |
| 238 | RVAPtr<IMAGE_EXPORT_DIRECTORY> exports(module, |
| 239 | export_directory->VirtualAddress); |
| 240 | RVAPtr<DWORD> functions(module, exports->AddressOfFunctions); |
| 241 | RVAPtr<DWORD> names(module, exports->AddressOfNames); |
| 242 | RVAPtr<WORD> ordinals(module, exports->AddressOfNameOrdinals); |
| 243 | |
| 244 | for (DWORD i = 0; i < exports->NumberOfNames; i++) { |
| 245 | RVAPtr<char> name(module, names[i]); |
| 246 | if (!strcmp(func_name, name)) { |
| 247 | DWORD index = ordinals[i]; |
| 248 | RVAPtr<char> func(module, functions[index]); |
| 249 | return (uptr)(char *)func; |
| 250 | } |
| 251 | } |
| 252 | |
| 253 | return 0; |
Stephen Hines | 6d18623 | 2014-11-26 17:56:19 -0800 | [diff] [blame] | 254 | } |
| 255 | |
| 256 | static bool GetFunctionAddressInDLLs(const char *func_name, uptr *func_addr) { |
| 257 | *func_addr = 0; |
Pirama Arumuga Nainar | 799172d | 2016-03-03 15:50:30 -0800 | [diff] [blame^] | 258 | void **DLLs = InterestingDLLsAvailable(); |
Stephen Hines | 6d18623 | 2014-11-26 17:56:19 -0800 | [diff] [blame] | 259 | for (size_t i = 0; *func_addr == 0 && DLLs[i]; ++i) |
Pirama Arumuga Nainar | 799172d | 2016-03-03 15:50:30 -0800 | [diff] [blame^] | 260 | *func_addr = InternalGetProcAddress(DLLs[i], func_name); |
Stephen Hines | 6d18623 | 2014-11-26 17:56:19 -0800 | [diff] [blame] | 261 | return (*func_addr != 0); |
| 262 | } |
| 263 | |
| 264 | bool OverrideFunction(const char *name, uptr new_func, uptr *orig_old_func) { |
| 265 | uptr orig_func; |
| 266 | if (!GetFunctionAddressInDLLs(name, &orig_func)) |
| 267 | return false; |
| 268 | return OverrideFunction(orig_func, new_func, orig_old_func); |
| 269 | } |
| 270 | |
Timur Iskhodzhanov | 07bb9f1 | 2012-02-22 13:59:49 +0000 | [diff] [blame] | 271 | } // namespace __interception |
| 272 | |
| 273 | #endif // _WIN32 |