fishhook.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287
  1. // Copyright (c) 2013, Facebook, Inc.
  2. // All rights reserved.
  3. // Redistribution and use in source and binary forms, with or without
  4. // modification, are permitted provided that the following conditions are met:
  5. // * Redistributions of source code must retain the above copyright notice,
  6. // this list of conditions and the following disclaimer.
  7. // * Redistributions in binary form must reproduce the above copyright notice,
  8. // this list of conditions and the following disclaimer in the documentation
  9. // and/or other materials provided with the distribution.
  10. // * Neither the name Facebook nor the names of its contributors may be used to
  11. // endorse or promote products derived from this software without specific
  12. // prior written permission.
  13. // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  14. // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  15. // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  16. // DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  17. // FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  18. // DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  19. // SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  20. // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  21. // OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  22. // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23. #include "fishhook.h"
  24. #include <dlfcn.h>
  25. #include <stdbool.h>
  26. #include <stdlib.h>
  27. #include <stdio.h>
  28. #include <string.h>
  29. #include <sys/mman.h>
  30. #include <sys/types.h>
  31. #include <mach/mach.h>
  32. #include <mach/vm_map.h>
  33. #include <mach/vm_region.h>
  34. #include <mach-o/dyld.h>
  35. #include <mach-o/loader.h>
  36. #include <mach-o/nlist.h>
  37. #include <pthread.h>
  38. #ifdef __LP64__
  39. typedef struct mach_header_64 mach_header_t;
  40. typedef struct segment_command_64 segment_command_t;
  41. typedef struct section_64 section_t;
  42. typedef struct nlist_64 nlist_t;
  43. #define LC_SEGMENT_ARCH_DEPENDENT LC_SEGMENT_64
  44. #else
  45. typedef struct mach_header mach_header_t;
  46. typedef struct segment_command segment_command_t;
  47. typedef struct section section_t;
  48. typedef struct nlist nlist_t;
  49. #define LC_SEGMENT_ARCH_DEPENDENT LC_SEGMENT
  50. #endif
  51. #ifndef SEG_DATA_CONST
  52. #define SEG_DATA_CONST "__DATA_CONST"
  53. #endif
  54. #ifndef SEG_AUTH_CONST
  55. #define SEG_AUTH_CONST "__AUTH_CONST"
  56. #endif
  57. struct rebindings_entry {
  58. struct rebinding *rebindings;
  59. size_t rebindings_nel;
  60. struct rebindings_entry *next;
  61. };
  62. static struct rebindings_entry *_rebindings_head;
  63. static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
  64. static int prepend_rebindings(struct rebindings_entry **rebindings_head,
  65. struct rebinding rebindings[],
  66. size_t nel) {
  67. struct rebindings_entry *new_entry = (struct rebindings_entry *) malloc(sizeof(struct rebindings_entry));
  68. if (!new_entry) {
  69. return -1;
  70. }
  71. new_entry->rebindings = (struct rebinding *) malloc(sizeof(struct rebinding) * nel);
  72. if (!new_entry->rebindings) {
  73. free(new_entry);
  74. return -1;
  75. }
  76. memcpy(new_entry->rebindings, rebindings, sizeof(struct rebinding) * nel);
  77. new_entry->rebindings_nel = nel;
  78. new_entry->next = *rebindings_head;
  79. *rebindings_head = new_entry;
  80. return 0;
  81. }
  82. static vm_prot_t get_protection(void *sectionStart) {
  83. mach_port_t task = mach_task_self();
  84. vm_size_t size = 0;
  85. vm_address_t address = (vm_address_t)sectionStart;
  86. memory_object_name_t object;
  87. #if __LP64__
  88. mach_msg_type_number_t count = VM_REGION_BASIC_INFO_COUNT_64;
  89. vm_region_basic_info_data_64_t info;
  90. kern_return_t info_ret = vm_region_64(
  91. task, &address, &size, VM_REGION_BASIC_INFO_64, (vm_region_info_64_t)&info, &count, &object);
  92. #else
  93. mach_msg_type_number_t count = VM_REGION_BASIC_INFO_COUNT;
  94. vm_region_basic_info_data_t info;
  95. kern_return_t info_ret = vm_region(task, &address, &size, VM_REGION_BASIC_INFO, (vm_region_info_t)&info, &count, &object);
  96. #endif
  97. if (info_ret == KERN_SUCCESS) {
  98. return info.protection;
  99. } else {
  100. return VM_PROT_READ;
  101. }
  102. }
  103. static void perform_rebinding_with_section(struct rebindings_entry *rebindings,
  104. section_t *section,
  105. intptr_t slide,
  106. nlist_t *symtab,
  107. char *strtab,
  108. uint32_t *indirect_symtab) {
  109. const bool isDataConst = strcmp(section->segname, SEG_DATA_CONST) == 0;
  110. const bool isAuthConst = strcmp(section->segname, SEG_AUTH_CONST) == 0;
  111. uint32_t *indirect_symbol_indices = indirect_symtab + section->reserved1;
  112. void **indirect_symbol_bindings = (void **)((uintptr_t)slide + section->addr);
  113. vm_prot_t oldProtection = VM_PROT_READ;
  114. vm_size_t trunc_address = (vm_size_t)indirect_symbol_bindings;
  115. vm_size_t trunc_size = 0;
  116. if (isDataConst || isAuthConst) {
  117. trunc_address = trunc_page((vm_size_t)indirect_symbol_bindings);
  118. trunc_size =(vm_size_t)indirect_symbol_bindings -trunc_address;
  119. pthread_mutex_lock(&mutex);
  120. oldProtection = get_protection((void *)trunc_address);
  121. // Use vm_protect to also set VM_PROT_COPY.
  122. kern_return_t err = vm_protect(mach_task_self(),
  123. (uintptr_t)trunc_address,
  124. section->size+trunc_size,
  125. 0,
  126. VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY);
  127. if (err != KERN_SUCCESS) {
  128. fprintf(
  129. stderr,
  130. "perform_rebinding_with_section vm_protect failed. error code: %d, "
  131. "trunc address: 0x%lx, trunc size: 0x%lx, section size: 0x%llx\n",
  132. err, trunc_address, trunc_size, section->size);
  133. pthread_mutex_unlock(&mutex);
  134. return;
  135. }
  136. }
  137. for (uint i = 0; i < section->size / sizeof(void *); i++) {
  138. uint32_t symtab_index = indirect_symbol_indices[i];
  139. if (symtab_index == INDIRECT_SYMBOL_ABS || symtab_index == INDIRECT_SYMBOL_LOCAL ||
  140. symtab_index == (INDIRECT_SYMBOL_LOCAL | INDIRECT_SYMBOL_ABS)) {
  141. continue;
  142. }
  143. uint32_t strtab_offset = symtab[symtab_index].n_un.n_strx;
  144. char *symbol_name = strtab + strtab_offset;
  145. bool symbol_name_longer_than_1 = symbol_name[0] && symbol_name[1];
  146. struct rebindings_entry *cur = rebindings;
  147. while (cur) {
  148. for (uint j = 0; j < cur->rebindings_nel; j++) {
  149. if (symbol_name_longer_than_1 &&
  150. strcmp(&symbol_name[1], cur->rebindings[j].name) == 0) {
  151. if (cur->rebindings[j].replaced != NULL &&
  152. indirect_symbol_bindings[i] != cur->rebindings[j].replacement) {
  153. *(cur->rebindings[j].replaced) = indirect_symbol_bindings[i];
  154. }
  155. indirect_symbol_bindings[i] = cur->rebindings[j].replacement;
  156. goto symbol_loop;
  157. }
  158. }
  159. cur = cur->next;
  160. }
  161. symbol_loop:;
  162. }
  163. if (isDataConst || isAuthConst) {
  164. int protection = 0;
  165. if (oldProtection & VM_PROT_READ) {
  166. protection |= PROT_READ;
  167. }
  168. if (oldProtection & VM_PROT_WRITE) {
  169. protection |= PROT_WRITE;
  170. }
  171. if (oldProtection & VM_PROT_EXECUTE) {
  172. protection |= PROT_EXEC;
  173. }
  174. mprotect((void *)trunc_address, section->size+trunc_size, protection);
  175. pthread_mutex_unlock(&mutex);
  176. }
  177. }
  178. static void rebind_symbols_for_image(struct rebindings_entry *rebindings,
  179. const struct mach_header *header,
  180. intptr_t slide) {
  181. Dl_info info;
  182. if (dladdr(header, &info) == 0) {
  183. return;
  184. }
  185. segment_command_t *cur_seg_cmd;
  186. segment_command_t *linkedit_segment = NULL;
  187. struct symtab_command* symtab_cmd = NULL;
  188. struct dysymtab_command* dysymtab_cmd = NULL;
  189. uintptr_t cur = (uintptr_t)header + sizeof(mach_header_t);
  190. for (uint i = 0; i < header->ncmds; i++, cur += cur_seg_cmd->cmdsize) {
  191. cur_seg_cmd = (segment_command_t *)cur;
  192. if (cur_seg_cmd->cmd == LC_SEGMENT_ARCH_DEPENDENT) {
  193. if (strcmp(cur_seg_cmd->segname, SEG_LINKEDIT) == 0) {
  194. linkedit_segment = cur_seg_cmd;
  195. }
  196. } else if (cur_seg_cmd->cmd == LC_SYMTAB) {
  197. symtab_cmd = (struct symtab_command*)cur_seg_cmd;
  198. } else if (cur_seg_cmd->cmd == LC_DYSYMTAB) {
  199. dysymtab_cmd = (struct dysymtab_command*)cur_seg_cmd;
  200. }
  201. }
  202. if (!symtab_cmd || !dysymtab_cmd || !linkedit_segment ||
  203. !dysymtab_cmd->nindirectsyms) {
  204. return;
  205. }
  206. // Find base symbol/string table addresses
  207. uintptr_t linkedit_base = (uintptr_t)slide + linkedit_segment->vmaddr - linkedit_segment->fileoff;
  208. nlist_t *symtab = (nlist_t *)(linkedit_base + symtab_cmd->symoff);
  209. char *strtab = (char *)(linkedit_base + symtab_cmd->stroff);
  210. // Get indirect symbol table (array of uint32_t indices into symbol table)
  211. uint32_t *indirect_symtab = (uint32_t *)(linkedit_base + dysymtab_cmd->indirectsymoff);
  212. cur = (uintptr_t)header + sizeof(mach_header_t);
  213. for (uint i = 0; i < header->ncmds; i++, cur += cur_seg_cmd->cmdsize) {
  214. cur_seg_cmd = (segment_command_t *)cur;
  215. if (cur_seg_cmd->cmd == LC_SEGMENT_ARCH_DEPENDENT) {
  216. if (strcmp(cur_seg_cmd->segname, SEG_DATA) != 0 &&
  217. strcmp(cur_seg_cmd->segname, SEG_DATA_CONST) != 0 &&
  218. strcmp(cur_seg_cmd->segname, SEG_AUTH_CONST) != 0) {
  219. continue;
  220. }
  221. for (uint j = 0; j < cur_seg_cmd->nsects; j++) {
  222. section_t *sect =
  223. (section_t *)(cur + sizeof(segment_command_t)) + j;
  224. if ((sect->flags & SECTION_TYPE) == S_LAZY_SYMBOL_POINTERS) {
  225. perform_rebinding_with_section(rebindings, sect, slide, symtab, strtab, indirect_symtab);
  226. }
  227. if ((sect->flags & SECTION_TYPE) == S_NON_LAZY_SYMBOL_POINTERS) {
  228. perform_rebinding_with_section(rebindings, sect, slide, symtab, strtab, indirect_symtab);
  229. }
  230. }
  231. }
  232. }
  233. }
  234. static void _rebind_symbols_for_image(const struct mach_header *header,
  235. intptr_t slide) {
  236. rebind_symbols_for_image(_rebindings_head, header, slide);
  237. }
  238. int rebind_symbols_image(void *header,
  239. intptr_t slide,
  240. struct rebinding rebindings[],
  241. size_t rebindings_nel) {
  242. struct rebindings_entry *rebindings_head = NULL;
  243. int retval = prepend_rebindings(&rebindings_head, rebindings, rebindings_nel);
  244. rebind_symbols_for_image(rebindings_head, (const struct mach_header *) header, slide);
  245. if (rebindings_head) {
  246. free(rebindings_head->rebindings);
  247. }
  248. free(rebindings_head);
  249. return retval;
  250. }
  251. int rebind_symbols(struct rebinding rebindings[], size_t rebindings_nel) {
  252. int retval = prepend_rebindings(&_rebindings_head, rebindings, rebindings_nel);
  253. if (retval < 0) {
  254. return retval;
  255. }
  256. // If this was the first call, register callback for image additions (which is also invoked for
  257. // existing images, otherwise, just run on existing images
  258. if (!_rebindings_head->next) {
  259. _dyld_register_func_for_add_image(_rebind_symbols_for_image);
  260. } else {
  261. uint32_t c = _dyld_image_count();
  262. for (uint32_t i = 0; i < c; i++) {
  263. _rebind_symbols_for_image(_dyld_get_image_header(i), _dyld_get_image_vmaddr_slide(i));
  264. }
  265. }
  266. return retval;
  267. }