1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "courgette/disassembler_elf_32_x86.h"
6
7 #include <algorithm>
8 #include <string>
9 #include <vector>
10
11 #include "base/basictypes.h"
12 #include "base/logging.h"
13
14 #include "courgette/assembly_program.h"
15 #include "courgette/courgette.h"
16 #include "courgette/encoded_program.h"
17
18 namespace courgette {
19
DisassemblerElf32X86(const void * start,size_t length)20 DisassemblerElf32X86::DisassemblerElf32X86(const void* start, size_t length)
21 : DisassemblerElf32(start, length) {
22 }
23
24 // Convert an ELF relocation struction into an RVA
RelToRVA(Elf32_Rel rel,RVA * result) const25 CheckBool DisassemblerElf32X86::RelToRVA(Elf32_Rel rel, RVA* result) const {
26
27 // The rightmost byte of r_info is the type...
28 elf32_rel_386_type_values type =
29 (elf32_rel_386_type_values)(unsigned char)rel.r_info;
30
31 // The other 3 bytes of r_info are the symbol
32 uint32 symbol = rel.r_info >> 8;
33
34 switch(type)
35 {
36 case R_386_NONE:
37 case R_386_32:
38 case R_386_PC32:
39 case R_386_GOT32:
40 case R_386_PLT32:
41 case R_386_COPY:
42 case R_386_GLOB_DAT:
43 case R_386_JMP_SLOT:
44 return false;
45
46 case R_386_RELATIVE:
47 if (symbol != 0)
48 return false;
49
50 // This is a basic ABS32 relocation address
51 *result = rel.r_offset;
52 return true;
53
54 case R_386_GOTOFF:
55 case R_386_GOTPC:
56 case R_386_TLS_TPOFF:
57 return false;
58 }
59
60 return false;
61 }
62
ParseRelocationSection(const Elf32_Shdr * section_header,AssemblyProgram * program)63 CheckBool DisassemblerElf32X86::ParseRelocationSection(
64 const Elf32_Shdr *section_header,
65 AssemblyProgram* program) {
66 // We can reproduce the R_386_RELATIVE entries in one of the relocation
67 // table based on other information in the patch, given these
68 // conditions....
69 //
70 // All R_386_RELATIVE entries are:
71 // 1) In the same relocation table
72 // 2) Are consecutive
73 // 3) Are sorted in memory address order
74 //
75 // Happily, this is normally the case, but it's not required by spec
76 // so we check, and just don't do it if we don't match up.
77
78 // The expectation is that one relocation section will contain
79 // all of our R_386_RELATIVE entries in the expected order followed
80 // by assorted other entries we can't use special handling for.
81
82 bool match = true;
83
84 // Walk all the bytes in the section, matching relocation table or not
85 size_t file_offset = section_header->sh_offset;
86 size_t section_end = section_header->sh_offset + section_header->sh_size;
87
88 Elf32_Rel *section_relocs_iter =
89 (Elf32_Rel *)OffsetToPointer(section_header->sh_offset);
90
91 uint32 section_relocs_count = section_header->sh_size /
92 section_header->sh_entsize;
93
94 if (abs32_locations_.size() > section_relocs_count)
95 match = false;
96
97 std::vector<RVA>::iterator reloc_iter = abs32_locations_.begin();
98
99 while (match && (reloc_iter != abs32_locations_.end())) {
100 if (section_relocs_iter->r_info != R_386_RELATIVE ||
101 section_relocs_iter->r_offset != *reloc_iter)
102 match = false;
103 section_relocs_iter++;
104 reloc_iter++;
105 }
106
107 if (match) {
108 // Skip over relocation tables
109 if (!program->EmitElfRelocationInstruction())
110 return false;
111 file_offset += sizeof(Elf32_Rel) * abs32_locations_.size();
112 }
113
114 return ParseSimpleRegion(file_offset, section_end, program);
115 }
116
ParseRel32RelocsFromSection(const Elf32_Shdr * section_header)117 CheckBool DisassemblerElf32X86::ParseRel32RelocsFromSection(
118 const Elf32_Shdr* section_header) {
119
120 uint32 start_file_offset = section_header->sh_offset;
121 uint32 end_file_offset = start_file_offset + section_header->sh_size;
122
123 const uint8* start_pointer = OffsetToPointer(start_file_offset);
124 const uint8* end_pointer = OffsetToPointer(end_file_offset);
125
126 // Quick way to convert from Pointer to RVA within a single Section is to
127 // subtract 'pointer_to_rva'.
128 const uint8* const adjust_pointer_to_rva = start_pointer -
129 section_header->sh_addr;
130
131 // Find the rel32 relocations.
132 const uint8* p = start_pointer;
133 while (p < end_pointer) {
134 //RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
135
136 // Heuristic discovery of rel32 locations in instruction stream: are the
137 // next few bytes the start of an instruction containing a rel32
138 // addressing mode?
139 const uint8* rel32 = NULL;
140
141 if (p + 5 <= end_pointer) {
142 if (*p == 0xE8 || *p == 0xE9) { // jmp rel32 and call rel32
143 rel32 = p + 1;
144 }
145 }
146 if (p + 6 <= end_pointer) {
147 if (*p == 0x0F && (*(p+1) & 0xF0) == 0x80) { // Jcc long form
148 if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
149 rel32 = p + 2;
150 }
151 }
152 if (rel32) {
153 RVA rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
154 TypedRVAX86* rel32_rva = new TypedRVAX86(rva);
155
156 if (!rel32_rva->ComputeRelativeTarget(rel32)) {
157 return false;
158 }
159
160 RVA target_rva = rel32_rva->rva() + rel32_rva->relative_target();
161 // To be valid, rel32 target must be within image, and within this
162 // section.
163 if (IsValidRVA(target_rva)) {
164 rel32_locations_.push_back(rel32_rva);
165 #if COURGETTE_HISTOGRAM_TARGETS
166 ++rel32_target_rvas_[target_rva];
167 #endif
168 p = rel32 + 4;
169 continue;
170 } else {
171 delete rel32_rva;
172 }
173 }
174 p += 1;
175 }
176
177 return true;
178 }
179
180 } // namespace courgette
181