1 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "chrome_frame/function_stub.h"
6
7 #include <new>
8
9 #include "base/synchronization/lock.h"
10 #include "base/logging.h"
11
12 #ifndef _M_IX86
13 #error Only x86 supported right now.
14 #endif
15
16 namespace {
17 typedef enum AsmConstants {
18 POP_EAX = 0x58,
19 PUSH_IND = 0x35ff,
20 PUSH_EAX = 0x50,
21 JUMP_IND = 0x25ff,
22 };
23
24 // A quick and dirty wrapper class that allows us to defer allocating
25 // the executable heap until first use, and to release it teardown.
26 class ExecutableHeap {
27 public:
ExecutableHeap()28 ExecutableHeap() : heap_(NULL) {
29 }
30
~ExecutableHeap()31 ~ExecutableHeap() {
32 if (heap_ != NULL) {
33 BOOL ret = ::HeapDestroy(heap_);
34 heap_ = NULL;
35 }
36 }
37
Allocate(size_t size)38 void* Allocate(size_t size) {
39 if (!heap_)
40 CreateHeap();
41
42 DCHECK(heap_);
43
44 return ::HeapAlloc(heap_, 0, size);
45 }
46
Free(void * ptr)47 void Free(void* ptr) {
48 DCHECK(heap_ != NULL);
49 ::HeapFree(heap_, 0, ptr);
50 }
51
CreateHeap()52 void CreateHeap() {
53 base::AutoLock lock(init_lock_);
54
55 if (heap_ == NULL)
56 heap_ = ::HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0);
57 }
58
59 private:
60 base::Lock init_lock_;
61 HANDLE heap_;
62 };
63
64 // Our executable heap instance, all stubs are allocated from here.
65 ExecutableHeap heap_;
66
67 } // namespace
68
69 extern "C" IMAGE_DOS_HEADER __ImageBase;
70
is_valid() const71 bool FunctionStub::is_valid() const {
72 return signature_ == reinterpret_cast<HMODULE>(&__ImageBase) &&
73 !is_bypassed();
74 }
75
FunctionStub(uintptr_t extra_argument,void * dest)76 FunctionStub::FunctionStub(uintptr_t extra_argument, void* dest)
77 : signature_(reinterpret_cast<HMODULE>(&__ImageBase)),
78 argument_(extra_argument),
79 destination_function_(reinterpret_cast<uintptr_t>(dest)) {
80 bypass_address_ = reinterpret_cast<uintptr_t>(&stub_.pop_return_addr_);
81 Init(&stub_);
82 }
83
~FunctionStub()84 FunctionStub::~FunctionStub() {
85 }
86
Init(FunctionStubAsm * stub)87 void FunctionStub::Init(FunctionStubAsm* stub) {
88 DCHECK(stub != NULL);
89
90 stub->jump_to_bypass_ = JUMP_IND;
91 stub->bypass_target_addr_ = reinterpret_cast<uintptr_t>(&bypass_address_);
92 stub->pop_return_addr_ = POP_EAX;
93 stub->push_ = PUSH_IND;
94 stub->arg_addr_ = reinterpret_cast<uintptr_t>(&argument_);
95 stub->push_return_addr_ = PUSH_EAX;
96 stub->jump_to_target = JUMP_IND;
97 stub->target_addr_ = reinterpret_cast<uintptr_t>(&destination_function_);
98
99 // Flush the instruction cache for the newly written code.
100 BOOL ret = ::FlushInstructionCache(::GetCurrentProcess(),
101 stub,
102 sizeof(*stub));
103 }
104
BypassStub(void * new_target)105 void FunctionStub::BypassStub(void* new_target) {
106 set_bypass_address(reinterpret_cast<uintptr_t>(new_target));
107 }
108
Create(uintptr_t extra_argument,void * dest)109 FunctionStub* FunctionStub::Create(uintptr_t extra_argument, void* dest) {
110 DCHECK(dest);
111 FunctionStub* stub =
112 reinterpret_cast<FunctionStub*>(heap_.Allocate(sizeof(FunctionStub)));
113
114 if (stub != NULL)
115 new (stub) FunctionStub(extra_argument, dest);
116
117 return stub;
118 }
119
FromCode(void * address)120 FunctionStub* FunctionStub::FromCode(void* address) {
121 // Address points to arbitrary code here, which may e.g.
122 // lie at the end of an executable segment, which in turn
123 // may terminate earlier than the last address we probe.
124 // We therefore execute under an SEH, so as not to crash
125 // on failed probes.
126 __try {
127 // Retrieve the candidata function stub.
128 FunctionStub* candidate = CONTAINING_RECORD(address, FunctionStub, stub_);
129 if (candidate->stub_.jump_to_bypass_ == JUMP_IND &&
130 candidate->signature_ == reinterpret_cast<HMODULE>(&__ImageBase)) {
131 return candidate;
132 }
133 } __except(EXCEPTION_EXECUTE_HANDLER) {
134 }
135
136 return NULL;
137 }
138
Destroy(FunctionStub * stub)139 bool FunctionStub::Destroy(FunctionStub* stub) {
140 heap_.Free(stub);
141
142 return true;
143 }
144