libsanitizer/interception/interception_win.cc

   1 //===-- interception_linux.cc -----------------------------------*- C++ -*-===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // Windows-specific interception methods.
  11 //===----------------------------------------------------------------------===//
  12
  13 #ifdef _WIN32
  14
  15 #include "interception.h"
  16 #include <windows.h>
  17
  18 namespace __interception {
  19
  20 bool GetRealFunctionAddress(const char *func_name, uptr *func_addr) {
  21   const char *DLLS[] = {
  22     "msvcr80.dll",
  23     "msvcr90.dll",
  24     "kernel32.dll",
  25     NULL
  26   };
  27   *func_addr = 0;
  28   for (size_t i = 0; *func_addr == 0 && DLLS[i]; ++i) {
  29     *func_addr = (uptr)GetProcAddress(GetModuleHandleA(DLLS[i]), func_name);
  30   }
  31   return (*func_addr != 0);
  32 }
  33
  34 // FIXME: internal_str* and internal_mem* functions should be moved from the
  35 // ASan sources into interception/.
  36
  37 static void _memset(void *p, int value, size_t sz) {
  38   for (size_t i = 0; i < sz; ++i)
  39     ((char*)p)[i] = (char)value;
  40 }
  41
  42 static void _memcpy(void *dst, void *src, size_t sz) {
  43   char *dst_c = (char*)dst,
  44        *src_c = (char*)src;
  45   for (size_t i = 0; i < sz; ++i)
  46     dst_c[i] = src_c[i];
  47 }
  48
  49 static void WriteJumpInstruction(char *jmp_from, char *to) {
  50   // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset fromt jmp_from
  51   // to the next instruction to the destination.
  52   ptrdiff_t offset = to - jmp_from - 5;
  53   *jmp_from = '\xE9';
  54   *(ptrdiff_t*)(jmp_from + 1) = offset;
  55 }
  56
  57 bool OverrideFunction(uptr old_func, uptr new_func, uptr *orig_old_func) {
  58 #ifdef _WIN64
  59 # error OverrideFunction was not tested on x64
  60 #endif
  61   // Basic idea:
  62   // We write 5 bytes (jmp-to-new_func) at the beginning of the 'old_func'
  63   // to override it. We want to be able to execute the original 'old_func' from
  64   // the wrapper, so we need to keep the leading 5+ bytes ('head') of the
  65   // original instructions somewhere with a "jmp old_func+head".
  66   // We call these 'head'+5 bytes of instructions a "trampoline".
  67
  68   // Trampolines are allocated from a common pool.
  69   const int POOL_SIZE = 1024;
  70   static char *pool = NULL;
  71   static size_t pool_used = 0;
  72   if (pool == NULL) {
  73     pool = (char*)VirtualAlloc(NULL, POOL_SIZE,
  74                                MEM_RESERVE | MEM_COMMIT,
  75                                PAGE_EXECUTE_READWRITE);
  76     // FIXME: set PAGE_EXECUTE_READ access after setting all interceptors?
  77     if (pool == NULL)
  78       return false;
  79     _memset(pool, 0xCC /* int 3 */, POOL_SIZE);
  80   }
  81
  82   char* old_bytes = (char*)old_func;
  83   char* trampoline = pool + pool_used;
  84
  85   // Find out the number of bytes of the instructions we need to copy to the
  86   // island and store it in 'head'.
  87   size_t head = 0;
  88   while (head < 5) {
  89     switch (old_bytes[head]) {
  90       case '\x55':  // push ebp
  91       case '\x56':  // push esi
  92       case '\x57':  // push edi
  93         head++;
  94         continue;
  95     }
  96     switch (*(unsigned short*)(old_bytes + head)) {  // NOLINT
  97       case 0xFF8B:  // 8B FF = mov edi, edi
  98       case 0xEC8B:  // 8B EC = mov ebp, esp
  99       case 0xC033:  // 33 C0 = xor eax, eax
 100         head += 2;
 101         continue;
 102       case 0xEC83:  // 83 EC XX = sub esp, XX
 103         head += 3;
 104         continue;
 105       case 0xC1F7:  // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX
 106         head += 6;
 107         continue;
 108     }
 109     switch (0x00FFFFFF & *(unsigned int*)(old_bytes + head)) {
 110       case 0x24448A:  // 8A 44 24 XX = mov eal, dword ptr [esp+XXh]
 111       case 0x244C8B:  // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh]
 112       case 0x24548B:  // 8B 54 24 XX = mov edx, dword ptr [esp+XXh]
 113       case 0x247C8B:  // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh]
 114         head += 4;
 115         continue;
 116     }
 117
 118     // Unknown instruction!
 119     return false;
 120   }
 121
 122   if (pool_used + head + 5 > POOL_SIZE)
 123     return false;
 124
 125   // Now put the "jump to trampoline" instruction into the original code.
 126   DWORD old_prot, unused_prot;
 127   if (!VirtualProtect((void*)old_func, head, PAGE_EXECUTE_READWRITE,
 128                       &old_prot))
 129     return false;
 130
 131   // Put the needed instructions into the trampoline bytes.
 132   _memcpy(trampoline, old_bytes, head);
 133   WriteJumpInstruction(trampoline + head, old_bytes + head);
 134   *orig_old_func = (uptr)trampoline;
 135   pool_used += head + 5;
 136
 137   // Intercept the 'old_func'.
 138   WriteJumpInstruction(old_bytes, (char*)new_func);
 139   _memset(old_bytes + 5, 0xCC /* int 3 */, head - 5);
 140
 141   if (!VirtualProtect((void*)old_func, head, old_prot, &unused_prot))
 142     return false;  // not clear if this failure bothers us.
 143
 144   return true;
 145 }
 146
 147 }  // namespace __interception
 148
 149 #endif  // _WIN32