• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 //===-- interception_linux.cc -----------------------------------*- C++ -*-===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is a part of AddressSanitizer, an address sanity checker.
11 //
12 // Windows-specific interception methods.
13 //===----------------------------------------------------------------------===//
14 
15 #ifdef _WIN32
16 
17 #include "interception.h"
18 #include <windows.h>
19 
20 namespace __interception {
21 
GetRealFunctionAddress(const char * func_name,uptr * func_addr)22 bool GetRealFunctionAddress(const char *func_name, uptr *func_addr) {
23   const char *DLLS[] = {
24     "msvcr80.dll",
25     "msvcr90.dll",
26     "kernel32.dll",
27     NULL
28   };
29   *func_addr = 0;
30   for (size_t i = 0; *func_addr == 0 && DLLS[i]; ++i) {
31     *func_addr = (uptr)GetProcAddress(GetModuleHandleA(DLLS[i]), func_name);
32   }
33   return (*func_addr != 0);
34 }
35 
36 // FIXME: internal_str* and internal_mem* functions should be moved from the
37 // ASan sources into interception/.
38 
_memset(void * p,int value,size_t sz)39 static void _memset(void *p, int value, size_t sz) {
40   for (size_t i = 0; i < sz; ++i)
41     ((char*)p)[i] = (char)value;
42 }
43 
_memcpy(void * dst,void * src,size_t sz)44 static void _memcpy(void *dst, void *src, size_t sz) {
45   char *dst_c = (char*)dst,
46        *src_c = (char*)src;
47   for (size_t i = 0; i < sz; ++i)
48     dst_c[i] = src_c[i];
49 }
50 
WriteJumpInstruction(char * jmp_from,char * to)51 static void WriteJumpInstruction(char *jmp_from, char *to) {
52   // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset fromt jmp_from
53   // to the next instruction to the destination.
54   ptrdiff_t offset = to - jmp_from - 5;
55   *jmp_from = '\xE9';
56   *(ptrdiff_t*)(jmp_from + 1) = offset;
57 }
58 
OverrideFunction(uptr old_func,uptr new_func,uptr * orig_old_func)59 bool OverrideFunction(uptr old_func, uptr new_func, uptr *orig_old_func) {
60 #ifdef _WIN64
61 # error OverrideFunction was not tested on x64
62 #endif
63   // Basic idea:
64   // We write 5 bytes (jmp-to-new_func) at the beginning of the 'old_func'
65   // to override it. We want to be able to execute the original 'old_func' from
66   // the wrapper, so we need to keep the leading 5+ bytes ('head') of the
67   // original instructions somewhere with a "jmp old_func+head".
68   // We call these 'head'+5 bytes of instructions a "trampoline".
69 
70   // Trampolines are allocated from a common pool.
71   const int POOL_SIZE = 1024;
72   static char *pool = NULL;
73   static size_t pool_used = 0;
74   if (pool == NULL) {
75     pool = (char*)VirtualAlloc(NULL, POOL_SIZE,
76                                MEM_RESERVE | MEM_COMMIT,
77                                PAGE_EXECUTE_READWRITE);
78     // FIXME: set PAGE_EXECUTE_READ access after setting all interceptors?
79     if (pool == NULL)
80       return false;
81     _memset(pool, 0xCC /* int 3 */, POOL_SIZE);
82   }
83 
84   char* old_bytes = (char*)old_func;
85   char* trampoline = pool + pool_used;
86 
87   // Find out the number of bytes of the instructions we need to copy to the
88   // island and store it in 'head'.
89   size_t head = 0;
90   while (head < 5) {
91     switch (old_bytes[head]) {
92       case '\x55':  // push ebp
93       case '\x56':  // push esi
94       case '\x57':  // push edi
95         head++;
96         continue;
97     }
98     switch (*(unsigned short*)(old_bytes + head)) {  // NOLINT
99       case 0xFF8B:  // 8B FF = mov edi, edi
100       case 0xEC8B:  // 8B EC = mov ebp, esp
101       case 0xC033:  // 33 C0 = xor eax, eax
102         head += 2;
103         continue;
104       case 0xEC83:  // 83 EC XX = sub esp, XX
105         head += 3;
106         continue;
107       case 0xC1F7:  // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX
108         head += 6;
109         continue;
110     }
111     switch (0x00FFFFFF & *(unsigned int*)(old_bytes + head)) {
112       case 0x24448A:  // 8A 44 24 XX = mov eal, dword ptr [esp+XXh]
113       case 0x244C8B:  // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh]
114       case 0x24548B:  // 8B 54 24 XX = mov edx, dword ptr [esp+XXh]
115       case 0x247C8B:  // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh]
116         head += 4;
117         continue;
118     }
119 
120     // Unknown instruction!
121     return false;
122   }
123 
124   if (pool_used + head + 5 > POOL_SIZE)
125     return false;
126 
127   // Now put the "jump to trampoline" instruction into the original code.
128   DWORD old_prot, unused_prot;
129   if (!VirtualProtect((void*)old_func, head, PAGE_EXECUTE_READWRITE,
130                       &old_prot))
131     return false;
132 
133   // Put the needed instructions into the trampoline bytes.
134   _memcpy(trampoline, old_bytes, head);
135   WriteJumpInstruction(trampoline + head, old_bytes + head);
136   *orig_old_func = (uptr)trampoline;
137   pool_used += head + 5;
138 
139   // Intercept the 'old_func'.
140   WriteJumpInstruction(old_bytes, (char*)new_func);
141   _memset(old_bytes + 5, 0xCC /* int 3 */, head - 5);
142 
143   if (!VirtualProtect((void*)old_func, head, old_prot, &unused_prot))
144     return false;  // not clear if this failure bothers us.
145 
146   return true;
147 }
148 
149 }  // namespace __interception
150 
151 #endif  // _WIN32
152