disassembler_elf_32_x86.cc 6.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "courgette/disassembler_elf_32_x86.h"
  5. #include <memory>
  6. #include <utility>
  7. #include <vector>
  8. #include "courgette/assembly_program.h"
  9. #include "courgette/courgette.h"
  10. namespace courgette {
  11. CheckBool DisassemblerElf32X86::TypedRVAX86::ComputeRelativeTarget(
  12. const uint8_t* op_pointer) {
  13. set_relative_target(Read32LittleEndian(op_pointer) + 4);
  14. return true;
  15. }
  16. CheckBool DisassemblerElf32X86::TypedRVAX86::EmitInstruction(
  17. Label* label,
  18. InstructionReceptor* receptor) {
  19. return receptor->EmitRel32(label);
  20. }
  21. uint16_t DisassemblerElf32X86::TypedRVAX86::op_size() const {
  22. return 4;
  23. }
  24. DisassemblerElf32X86::DisassemblerElf32X86(const uint8_t* start, size_t length)
  25. : DisassemblerElf32(start, length) {}
  26. // Convert an ELF relocation struction into an RVA.
  27. CheckBool DisassemblerElf32X86::RelToRVA(Elf32_Rel rel, RVA* result) const {
  28. // The rightmost byte of r_info is the type.
  29. elf32_rel_386_type_values type =
  30. static_cast<elf32_rel_386_type_values>(rel.r_info & 0xFF);
  31. // The other 3 bytes of r_info are the symbol.
  32. uint32_t symbol = rel.r_info >> 8;
  33. switch (type) {
  34. case R_386_NONE:
  35. case R_386_32:
  36. case R_386_PC32:
  37. case R_386_GOT32:
  38. case R_386_PLT32:
  39. case R_386_COPY:
  40. case R_386_GLOB_DAT:
  41. case R_386_JMP_SLOT:
  42. return false;
  43. case R_386_RELATIVE:
  44. if (symbol != 0)
  45. return false;
  46. // This is a basic ABS32 relocation address.
  47. *result = rel.r_offset;
  48. return true;
  49. case R_386_GOTOFF:
  50. case R_386_GOTPC:
  51. case R_386_TLS_TPOFF:
  52. return false;
  53. }
  54. return false;
  55. }
  56. CheckBool DisassemblerElf32X86::ParseRelocationSection(
  57. const Elf32_Shdr* section_header,
  58. InstructionReceptor* receptor) const {
  59. // We can reproduce the R_386_RELATIVE entries in one of the relocation table
  60. // based on other information in the patch, given these conditions:
  61. //
  62. // All R_386_RELATIVE entries are:
  63. // 1) In the same relocation table
  64. // 2) Are consecutive
  65. // 3) Are sorted in memory address order
  66. //
  67. // Happily, this is normally the case, but it's not required by spec, so we
  68. // check, and just don't do it if we don't match up.
  69. // The expectation is that one relocation section will contain all of our
  70. // R_386_RELATIVE entries in the expected order followed by assorted other
  71. // entries we can't use special handling for.
  72. bool match = true;
  73. // Walk all the bytes in the section, matching relocation table or not.
  74. FileOffset file_offset = section_header->sh_offset;
  75. FileOffset section_end = file_offset + section_header->sh_size;
  76. const Elf32_Rel* section_relocs_iter = reinterpret_cast<const Elf32_Rel*>(
  77. FileOffsetToPointer(section_header->sh_offset));
  78. uint32_t section_relocs_count =
  79. section_header->sh_size / section_header->sh_entsize;
  80. if (abs32_locations_.empty())
  81. match = false;
  82. if (abs32_locations_.size() > section_relocs_count)
  83. match = false;
  84. std::vector<RVA>::const_iterator reloc_iter = abs32_locations_.begin();
  85. // Try to match successive reloc units with (sorted) |abs32_locations_|.
  86. while (match && (reloc_iter != abs32_locations_.end())) {
  87. if (section_relocs_iter->r_info != R_386_RELATIVE ||
  88. section_relocs_iter->r_offset != *reloc_iter) {
  89. match = false;
  90. }
  91. ++section_relocs_iter;
  92. ++reloc_iter;
  93. }
  94. if (match) {
  95. // Success: Emit relocation table.
  96. if (!receptor->EmitElfRelocation())
  97. return false;
  98. file_offset += sizeof(Elf32_Rel) * abs32_locations_.size();
  99. }
  100. return ParseSimpleRegion(file_offset, section_end, receptor);
  101. }
  102. CheckBool DisassemblerElf32X86::ParseRel32RelocsFromSection(
  103. const Elf32_Shdr* section_header) {
  104. FileOffset start_file_offset = section_header->sh_offset;
  105. FileOffset end_file_offset = start_file_offset + section_header->sh_size;
  106. const uint8_t* start_pointer = FileOffsetToPointer(start_file_offset);
  107. const uint8_t* end_pointer = FileOffsetToPointer(end_file_offset);
  108. // Quick way to convert from Pointer to RVA within a single Section is to
  109. // subtract |pointer_to_rva|.
  110. const uint8_t* const adjust_pointer_to_rva =
  111. start_pointer - section_header->sh_addr;
  112. std::vector<RVA>::iterator abs32_pos = abs32_locations_.begin();
  113. // Find the rel32 relocations.
  114. const uint8_t* p = start_pointer;
  115. while (p < end_pointer) {
  116. // Heuristic discovery of rel32 locations in instruction stream: are the
  117. // next few bytes the start of an instruction containing a rel32
  118. // addressing mode?
  119. const uint8_t* rel32 = nullptr;
  120. if (p + 5 <= end_pointer) {
  121. if (*p == 0xE8 || *p == 0xE9) { // jmp rel32 and call rel32
  122. rel32 = p + 1;
  123. }
  124. }
  125. if (p + 6 <= end_pointer) {
  126. if (*p == 0x0F && (p[1] & 0xF0) == 0x80) { // Jcc long form
  127. if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
  128. rel32 = p + 2;
  129. }
  130. }
  131. if (rel32) {
  132. RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
  133. // Is there an abs32 reloc overlapping the candidate?
  134. while (abs32_pos != abs32_locations_.end() && *abs32_pos < rel32_rva - 3)
  135. ++abs32_pos;
  136. // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte
  137. // region that could overlap rel32_rva.
  138. if (abs32_pos != abs32_locations_.end()) {
  139. if (*abs32_pos < rel32_rva + 4) {
  140. // Beginning of abs32 reloc is before end of rel32 reloc so they
  141. // overlap. Skip four bytes past the abs32 reloc.
  142. RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
  143. p += (*abs32_pos + 4) - current_rva;
  144. continue;
  145. }
  146. }
  147. std::unique_ptr<TypedRVAX86> typed_rel32_rva(new TypedRVAX86(rel32_rva));
  148. if (!typed_rel32_rva->ComputeRelativeTarget(rel32))
  149. return false;
  150. RVA target_rva = typed_rel32_rva->rva() +
  151. typed_rel32_rva->relative_target();
  152. if (IsValidTargetRVA(target_rva)) {
  153. rel32_locations_.push_back(std::move(typed_rel32_rva));
  154. #if COURGETTE_HISTOGRAM_TARGETS
  155. ++rel32_target_rvas_[target_rva];
  156. #endif
  157. p = rel32 + 4;
  158. continue;
  159. }
  160. }
  161. p += 1;
  162. }
  163. return true;
  164. }
  165. } // namespace courgette