1//===-- interception_linux.cc -----------------------------------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12// Windows-specific interception methods.
13//===----------------------------------------------------------------------===//
14
15#ifdef _WIN32
16
17#include "interception.h"
18#include <windows.h>
19
20namespace __interception {
21
22bool GetRealFunctionAddress(const char *func_name, uptr *func_addr) {
23  const char *DLLS[] = {
24    "msvcr80.dll",
25    "msvcr90.dll",
26    "kernel32.dll",
27    NULL
28  };
29  *func_addr = 0;
30  for (size_t i = 0; *func_addr == 0 && DLLS[i]; ++i) {
31    *func_addr = (uptr)GetProcAddress(GetModuleHandleA(DLLS[i]), func_name);
32  }
33  return (*func_addr != 0);
34}
35
36// FIXME: internal_str* and internal_mem* functions should be moved from the
37// ASan sources into interception/.
38
39static void _memset(void *p, int value, size_t sz) {
40  for (size_t i = 0; i < sz; ++i)
41    ((char*)p)[i] = (char)value;
42}
43
44static void _memcpy(void *dst, void *src, size_t sz) {
45  char *dst_c = (char*)dst,
46       *src_c = (char*)src;
47  for (size_t i = 0; i < sz; ++i)
48    dst_c[i] = src_c[i];
49}
50
51static void WriteJumpInstruction(char *jmp_from, char *to) {
52  // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset fromt jmp_from
53  // to the next instruction to the destination.
54  ptrdiff_t offset = to - jmp_from - 5;
55  *jmp_from = '\xE9';
56  *(ptrdiff_t*)(jmp_from + 1) = offset;
57}
58
59static char *GetMemoryForTrampoline(size_t size) {
60  // Trampolines are allocated from a common pool.
61  const int POOL_SIZE = 1024;
62  static char *pool = NULL;
63  static size_t pool_used = 0;
64  if (!pool) {
65    pool = (char *)VirtualAlloc(NULL, POOL_SIZE, MEM_RESERVE | MEM_COMMIT,
66                                PAGE_EXECUTE_READWRITE);
67    // FIXME: Might want to apply PAGE_EXECUTE_READ access after all the
68    // interceptors are in place.
69    if (!pool)
70      return NULL;
71    _memset(pool, 0xCC /* int 3 */, POOL_SIZE);
72  }
73
74  if (pool_used + size > POOL_SIZE)
75    return NULL;
76
77  char *ret = pool + pool_used;
78  pool_used += size;
79  return ret;
80}
81
82// Returns 0 on error.
83static size_t RoundUpToInstrBoundary(size_t size, char *code) {
84  size_t cursor = 0;
85  while (cursor < size) {
86    switch (code[cursor]) {
87      case '\x51':  // push ecx
88      case '\x52':  // push edx
89      case '\x53':  // push ebx
90      case '\x54':  // push esp
91      case '\x55':  // push ebp
92      case '\x56':  // push esi
93      case '\x57':  // push edi
94      case '\x5D':  // pop ebp
95        cursor++;
96        continue;
97      case '\x6A':  // 6A XX = push XX
98        cursor += 2;
99        continue;
100      case '\xE9':  // E9 XX YY ZZ WW = jmp WWZZYYXX
101        cursor += 5;
102        continue;
103    }
104    switch (*(unsigned short*)(code + cursor)) {  // NOLINT
105      case 0xFF8B:  // 8B FF = mov edi, edi
106      case 0xEC8B:  // 8B EC = mov ebp, esp
107      case 0xC033:  // 33 C0 = xor eax, eax
108        cursor += 2;
109        continue;
110      case 0x458B:  // 8B 45 XX = mov eax, dword ptr [ebp+XXh]
111      case 0x5D8B:  // 8B 5D XX = mov ebx, dword ptr [ebp+XXh]
112      case 0xEC83:  // 83 EC XX = sub esp, XX
113        cursor += 3;
114        continue;
115      case 0xC1F7:  // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX
116        cursor += 6;
117        continue;
118      case 0x3D83:  // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX
119        cursor += 7;
120        continue;
121    }
122    switch (0x00FFFFFF & *(unsigned int*)(code + cursor)) {
123      case 0x24448A:  // 8A 44 24 XX = mov eal, dword ptr [esp+XXh]
124      case 0x24448B:  // 8B 44 24 XX = mov eax, dword ptr [esp+XXh]
125      case 0x244C8B:  // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh]
126      case 0x24548B:  // 8B 54 24 XX = mov edx, dword ptr [esp+XXh]
127      case 0x24748B:  // 8B 74 24 XX = mov esi, dword ptr [esp+XXh]
128      case 0x247C8B:  // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh]
129        cursor += 4;
130        continue;
131    }
132
133    // Unknown instruction!
134    // FIXME: Unknown instruction failures might happen when we add a new
135    // interceptor or a new compiler version. In either case, they should result
136    // in visible and readable error messages. However, merely calling abort()
137    // leads to an infinite recursion in CheckFailed.
138    // Do we have a good way to abort with an error message here?
139    __debugbreak();
140    return 0;
141  }
142
143  return cursor;
144}
145
146bool OverrideFunction(uptr old_func, uptr new_func, uptr *orig_old_func) {
147#ifdef _WIN64
148#error OverrideFunction is not yet supported on x64
149#endif
150  // Function overriding works basically like this:
151  // We write "jmp <new_func>" (5 bytes) at the beginning of the 'old_func'
152  // to override it.
153  // We might want to be able to execute the original 'old_func' from the
154  // wrapper, in this case we need to keep the leading 5+ bytes ('head')
155  // of the original code somewhere with a "jmp <old_func+head>".
156  // We call these 'head'+5 bytes of instructions a "trampoline".
157  char *old_bytes = (char *)old_func;
158
159  // We'll need at least 5 bytes for a 'jmp'.
160  size_t head = 5;
161  if (orig_old_func) {
162    // Find out the number of bytes of the instructions we need to copy
163    // to the trampoline and store it in 'head'.
164    head = RoundUpToInstrBoundary(head, old_bytes);
165    if (!head)
166      return false;
167
168    // Put the needed instructions into the trampoline bytes.
169    char *trampoline = GetMemoryForTrampoline(head + 5);
170    if (!trampoline)
171      return false;
172    _memcpy(trampoline, old_bytes, head);
173    WriteJumpInstruction(trampoline + head, old_bytes + head);
174    *orig_old_func = (uptr)trampoline;
175  }
176
177  // Now put the "jmp <new_func>" instruction at the original code location.
178  // We should preserve the EXECUTE flag as some of our own code might be
179  // located in the same page (sic!).  FIXME: might consider putting the
180  // __interception code into a separate section or something?
181  DWORD old_prot, unused_prot;
182  if (!VirtualProtect((void *)old_bytes, head, PAGE_EXECUTE_READWRITE,
183                      &old_prot))
184    return false;
185
186  WriteJumpInstruction(old_bytes, (char *)new_func);
187  _memset(old_bytes + 5, 0xCC /* int 3 */, head - 5);
188
189  // Restore the original permissions.
190  if (!VirtualProtect((void *)old_bytes, head, old_prot, &unused_prot))
191    return false;  // not clear if this failure bothers us.
192
193  return true;
194}
195
196}  // namespace __interception
197
198#endif  // _WIN32
199