rel32_finder_x86.cc 3.3 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091
  1. // Copyright 2015 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "courgette/rel32_finder_x86.h"
  5. namespace courgette {
  6. Rel32FinderX86::Rel32FinderX86(RVA relocs_start_rva, RVA relocs_end_rva)
  7. : Rel32Finder(relocs_start_rva, relocs_end_rva) {}
  8. // Scan for opcodes matching the following instructions :
  9. // rel32 JMP/CALL
  10. // Jcc (excluding JPO/JPE)
  11. // Falsely detected rel32 that collide with known abs32 or that point outside
  12. // valid regions are discarded.
  13. void Rel32FinderX86::Find(const uint8_t* start_pointer,
  14. const uint8_t* end_pointer,
  15. RVA start_rva,
  16. RVA end_rva,
  17. const std::vector<RVA>& abs32_locations) {
  18. // Quick way to convert from Pointer to RVA within a single Section is to
  19. // subtract |adjust_pointer_to_rva|.
  20. const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva;
  21. std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin();
  22. // Find the rel32 relocations.
  23. const uint8_t* p = start_pointer;
  24. while (p < end_pointer) {
  25. RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
  26. // Skip the base reloation table if we encounter it.
  27. // Note: We're not bothering to handle the edge case where a Rel32 pointer
  28. // collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it.
  29. if (current_rva >= relocs_start_rva_ && current_rva < relocs_end_rva_) {
  30. p += relocs_end_rva_ - current_rva;
  31. continue;
  32. }
  33. // Heuristic discovery of rel32 locations in instruction stream: are the
  34. // next few bytes the start of an instruction containing a rel32
  35. // addressing mode?
  36. const uint8_t* rel32 = nullptr;
  37. if (p + 5 <= end_pointer) {
  38. if (p[0] == 0xE8 || p[0] == 0xE9) { // jmp rel32 and call rel32
  39. rel32 = p + 1;
  40. }
  41. }
  42. if (p + 6 <= end_pointer) {
  43. if (p[0] == 0x0F && (p[1] & 0xF0) == 0x80) { // Jcc long form
  44. if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
  45. rel32 = p + 2;
  46. }
  47. }
  48. if (rel32) {
  49. RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
  50. // Is there an abs32 reloc overlapping the candidate?
  51. while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3)
  52. ++abs32_pos;
  53. // Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte
  54. // region that could overlap rel32_rva.
  55. if (abs32_pos != abs32_locations.end()) {
  56. if (*abs32_pos < rel32_rva + 4) {
  57. // Beginning of abs32 reloc is before end of rel32 reloc so they
  58. // overlap. Skip four bytes past the abs32 reloc.
  59. p += (*abs32_pos + 4) - current_rva;
  60. continue;
  61. }
  62. }
  63. // + 4 since offset is relative to start of next instruction.
  64. RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32);
  65. // Valid, rel32 target must be within image, and within this section.
  66. // Subsumes |target_rva| != |kUnassignedRVA|.
  67. if (start_rva <= target_rva && target_rva < end_rva) {
  68. rel32_locations_.push_back(rel32_rva);
  69. #if COURGETTE_HISTOGRAM_TARGETS
  70. ++rel32_target_rvas_[target_rva];
  71. #endif
  72. p = rel32 + 4;
  73. continue;
  74. }
  75. }
  76. p += 1;
  77. }
  78. }
  79. } // namespace courgette