1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "courgette/disassembler_elf_32_x86.h"
6
7#include <algorithm>
8#include <string>
9#include <vector>
10
11#include "base/basictypes.h"
12#include "base/logging.h"
13
14#include "courgette/assembly_program.h"
15#include "courgette/courgette.h"
16#include "courgette/encoded_program.h"
17
18namespace courgette {
19
20DisassemblerElf32X86::DisassemblerElf32X86(const void* start, size_t length)
21  : DisassemblerElf32(start, length) {
22}
23
24// Convert an ELF relocation struction into an RVA
25CheckBool DisassemblerElf32X86::RelToRVA(Elf32_Rel rel, RVA* result) const {
26
27  // The rightmost byte of r_info is the type...
28  elf32_rel_386_type_values type =
29      (elf32_rel_386_type_values)(unsigned char)rel.r_info;
30
31  // The other 3 bytes of r_info are the symbol
32  uint32 symbol =  rel.r_info >> 8;
33
34  switch(type)
35  {
36    case R_386_NONE:
37    case R_386_32:
38    case R_386_PC32:
39    case R_386_GOT32:
40    case R_386_PLT32:
41    case R_386_COPY:
42    case R_386_GLOB_DAT:
43    case R_386_JMP_SLOT:
44      return false;
45
46    case R_386_RELATIVE:
47      if (symbol != 0)
48        return false;
49
50      // This is a basic ABS32 relocation address
51      *result = rel.r_offset;
52      return true;
53
54    case R_386_GOTOFF:
55    case R_386_GOTPC:
56    case R_386_TLS_TPOFF:
57      return false;
58  }
59
60  return false;
61}
62
63CheckBool DisassemblerElf32X86::ParseRelocationSection(
64    const Elf32_Shdr *section_header,
65      AssemblyProgram* program) {
66  // We can reproduce the R_386_RELATIVE entries in one of the relocation
67  // table based on other information in the patch, given these
68  // conditions....
69  //
70  // All R_386_RELATIVE entries are:
71  //   1) In the same relocation table
72  //   2) Are consecutive
73  //   3) Are sorted in memory address order
74  //
75  // Happily, this is normally the case, but it's not required by spec
76  // so we check, and just don't do it if we don't match up.
77
78  // The expectation is that one relocation section will contain
79  // all of our R_386_RELATIVE entries in the expected order followed
80  // by assorted other entries we can't use special handling for.
81
82  bool match = true;
83
84  // Walk all the bytes in the section, matching relocation table or not
85  size_t file_offset = section_header->sh_offset;
86  size_t section_end = section_header->sh_offset + section_header->sh_size;
87
88  Elf32_Rel *section_relocs_iter =
89      (Elf32_Rel *)OffsetToPointer(section_header->sh_offset);
90
91  uint32 section_relocs_count = section_header->sh_size /
92                                section_header->sh_entsize;
93
94  if (abs32_locations_.size() > section_relocs_count)
95    match = false;
96
97  std::vector<RVA>::iterator reloc_iter = abs32_locations_.begin();
98
99  while (match && (reloc_iter !=  abs32_locations_.end())) {
100    if (section_relocs_iter->r_info != R_386_RELATIVE ||
101        section_relocs_iter->r_offset != *reloc_iter)
102      match = false;
103    section_relocs_iter++;
104    reloc_iter++;
105  }
106
107  if (match) {
108    // Skip over relocation tables
109    if (!program->EmitElfRelocationInstruction())
110      return false;
111    file_offset += sizeof(Elf32_Rel) * abs32_locations_.size();
112  }
113
114  return ParseSimpleRegion(file_offset, section_end, program);
115}
116
117CheckBool DisassemblerElf32X86::ParseRel32RelocsFromSection(
118    const Elf32_Shdr* section_header) {
119
120  uint32 start_file_offset = section_header->sh_offset;
121  uint32 end_file_offset = start_file_offset + section_header->sh_size;
122
123  const uint8* start_pointer = OffsetToPointer(start_file_offset);
124  const uint8* end_pointer = OffsetToPointer(end_file_offset);
125
126  // Quick way to convert from Pointer to RVA within a single Section is to
127  // subtract 'pointer_to_rva'.
128  const uint8* const adjust_pointer_to_rva = start_pointer -
129                                             section_header->sh_addr;
130
131  // Find the rel32 relocations.
132  const uint8* p = start_pointer;
133  while (p < end_pointer) {
134    //RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
135
136    // Heuristic discovery of rel32 locations in instruction stream: are the
137    // next few bytes the start of an instruction containing a rel32
138    // addressing mode?
139    const uint8* rel32 = NULL;
140
141    if (p + 5 <= end_pointer) {
142      if (*p == 0xE8 || *p == 0xE9) {  // jmp rel32 and call rel32
143        rel32 = p + 1;
144      }
145    }
146    if (p + 6 <= end_pointer) {
147      if (*p == 0x0F  &&  (*(p+1) & 0xF0) == 0x80) {  // Jcc long form
148        if (p[1] != 0x8A && p[1] != 0x8B)  // JPE/JPO unlikely
149          rel32 = p + 2;
150      }
151    }
152    if (rel32) {
153      RVA rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
154      TypedRVAX86* rel32_rva = new TypedRVAX86(rva);
155
156      if (!rel32_rva->ComputeRelativeTarget(rel32)) {
157        return false;
158      }
159
160      RVA target_rva = rel32_rva->rva() + rel32_rva->relative_target();
161      // To be valid, rel32 target must be within image, and within this
162      // section.
163      if (IsValidRVA(target_rva)) {
164        rel32_locations_.push_back(rel32_rva);
165#if COURGETTE_HISTOGRAM_TARGETS
166        ++rel32_target_rvas_[target_rva];
167#endif
168        p = rel32 + 4;
169        continue;
170      } else {
171        delete rel32_rva;
172      }
173    }
174    p += 1;
175  }
176
177  return true;
178}
179
180}  // namespace courgette
181