rel32_finder_x64.cc 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "courgette/rel32_finder_x64.h"
  5. namespace courgette {
  6. Rel32FinderX64::Rel32FinderX64(RVA relocs_start_rva,
  7. RVA relocs_end_rva,
  8. RVA size_of_image)
  9. : Rel32Finder(relocs_start_rva, relocs_end_rva),
  10. size_of_image_(size_of_image) {}
  11. // Scan for opcodes matching the following instructions :
  12. // rel32 JMP/CALL
  13. // rip MOV/LEA
  14. // Jcc (excluding JPO/JPE)
  15. // Falsely detected rel32 that collide with known abs32 or that point outside
  16. // valid regions are discarded.
  17. void Rel32FinderX64::Find(const uint8_t* start_pointer,
  18. const uint8_t* end_pointer,
  19. RVA start_rva,
  20. RVA end_rva,
  21. const std::vector<RVA>& abs32_locations) {
  22. // Quick way to convert from Pointer to RVA within a single Section is to
  23. // subtract |adjust_pointer_to_rva|.
  24. const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva;
  25. std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin();
  26. // Find the rel32 relocations.
  27. const uint8_t* p = start_pointer;
  28. while (p < end_pointer) {
  29. RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
  30. // Skip the base reloation table if we encounter it.
  31. // Note: We're not bothering to handle the edge case where a Rel32 pointer
  32. // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it.
  33. if (current_rva >= relocs_start_rva_ && current_rva < relocs_end_rva_) {
  34. p += relocs_end_rva_ - current_rva;
  35. continue;
  36. }
  37. // Heuristic discovery of rel32 locations in instruction stream: are the
  38. // next few bytes the start of an instruction containing a rel32
  39. // addressing mode?
  40. const uint8_t* rel32 = nullptr;
  41. bool is_rip_relative = false;
  42. if (p + 5 <= end_pointer) {
  43. if (p[0] == 0xE8 || p[0] == 0xE9) // jmp rel32 and call rel32
  44. rel32 = p + 1;
  45. }
  46. if (p + 6 <= end_pointer) {
  47. if (p[0] == 0x0F && (p[1] & 0xF0) == 0x80) { // Jcc long form
  48. if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
  49. rel32 = p + 2;
  50. } else if ((p[0] == 0xFF &&
  51. (p[1] == 0x15 || p[1] == 0x25)) ||
  52. ((p[0] == 0x89 || p[0] == 0x8B || p[0] == 0x8D) &&
  53. (p[1] & 0xC7) == 0x05)) {
  54. // 6-byte instructions:
  55. // [2-byte opcode] [disp32]:
  56. // Opcode
  57. // FF 15: call QWORD PTR [rip+disp32]
  58. // FF 25: jmp QWORD PTR [rip+disp32]
  59. //
  60. // [1-byte opcode] [ModR/M] [disp32]:
  61. // Opcode
  62. // 89: mov DWORD PTR [rip+disp32],reg
  63. // 8B: mov reg,DWORD PTR [rip+disp32]
  64. // 8D: lea reg,[rip+disp32]
  65. // ModR/M : MMRRRMMM
  66. // MM = 00 & MMM = 101 => rip+disp32
  67. // RRR: selects reg operand from [eax|ecx|...|edi]
  68. rel32 = p + 2;
  69. is_rip_relative = true;
  70. }
  71. }
  72. // TODO(huangs): Maybe skip checking prefixes,
  73. // and let 6-byte instructions take care of this?
  74. if (p + 7 <= end_pointer) {
  75. if (((p[0] & 0xF2) == 0x40 || p[0] == 0x66) &&
  76. (p[1] == 0x89 || p[1] == 0x8B || p[1] == 0x8D) &&
  77. (p[2] & 0xC7) == 0x05) {
  78. // 7-byte instructions:
  79. // [REX.W prefix] [1-byte opcode] [ModR/M] [disp32]
  80. // REX Prefix : 0100WR0B
  81. // W: 0 = Default Operation Size
  82. // 1 = 64 Bit Operand Size
  83. // R: 0 = REG selects from [rax|rcx|...|rdi].
  84. // 1 = REG selects from [r9|r10|...|r15].
  85. // B: ModR/M r/m field extension (not used).
  86. // Opcode
  87. // 89: mov QWORD PTR [rip+disp32],reg
  88. // 8B: mov reg,QWORD PTR [rip+disp32]
  89. // 8D: lea reg,[rip+disp32]
  90. // ModR/M : MMRRRMMM
  91. // MM = 00 & MMM = 101 => rip+disp32
  92. // RRR: selects reg operand
  93. //
  94. // 66 [1-byte opcode] [ModR/M] [disp32]
  95. // Prefix
  96. // 66: Operand size override
  97. // Opcode
  98. // 89: mov WORD PTR [rip+disp32],reg
  99. // 8B: mov reg,WORD PTR [rip+disp32]
  100. // 8D: lea reg,[rip+disp32]
  101. // ModR/M : MMRRRMMM
  102. // MM = 00 & MMM = 101 = rip+disp32
  103. // RRR selects reg operand from [ax|cx|...|di]
  104. rel32 = p + 3;
  105. is_rip_relative = true;
  106. }
  107. }
  108. if (rel32) {
  109. RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
  110. // Is there an abs32 reloc overlapping the candidate?
  111. while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3)
  112. ++abs32_pos;
  113. // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte
  114. // region that could overlap rel32_rva.
  115. if (abs32_pos != abs32_locations.end()) {
  116. if (*abs32_pos < rel32_rva + 4) {
  117. // Beginning of abs32 reloc is before end of rel32 reloc so they
  118. // overlap. Skip four bytes past the abs32 reloc.
  119. p += (*abs32_pos + 4) - current_rva;
  120. continue;
  121. }
  122. }
  123. // + 4 since offset is relative to start of next instruction.
  124. RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32);
  125. // To be valid, rel32 target must be within image, and within this
  126. // section.
  127. if (target_rva < size_of_image_ && // Subsumes rva != kUnassignedRVA.
  128. (is_rip_relative ||
  129. (start_rva <= target_rva && target_rva < end_rva))) {
  130. rel32_locations_.push_back(rel32_rva);
  131. #if COURGETTE_HISTOGRAM_TARGETS
  132. ++rel32_target_rvas_[target_rva];
  133. #endif
  134. p = rel32 + 4;
  135. continue;
  136. }
  137. }
  138. p += 1;
  139. }
  140. }
  141. } // namespace courgette