1 //===-- interception_linux.cc -----------------------------------*- C++ -*-===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
10 // Windows-specific interception methods.
11 //===----------------------------------------------------------------------===//
15 #include "interception.h"
18 namespace __interception
{
20 bool GetRealFunctionAddress(const char *func_name
, uptr
*func_addr
) {
21 const char *DLLS
[] = {
28 for (size_t i
= 0; *func_addr
== 0 && DLLS
[i
]; ++i
) {
29 *func_addr
= (uptr
)GetProcAddress(GetModuleHandleA(DLLS
[i
]), func_name
);
31 return (*func_addr
!= 0);
34 // FIXME: internal_str* and internal_mem* functions should be moved from the
35 // ASan sources into interception/.
37 static void _memset(void *p
, int value
, size_t sz
) {
38 for (size_t i
= 0; i
< sz
; ++i
)
39 ((char*)p
)[i
] = (char)value
;
42 static void _memcpy(void *dst
, void *src
, size_t sz
) {
43 char *dst_c
= (char*)dst
,
45 for (size_t i
= 0; i
< sz
; ++i
)
49 static void WriteJumpInstruction(char *jmp_from
, char *to
) {
50 // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset fromt jmp_from
51 // to the next instruction to the destination.
52 ptrdiff_t offset
= to
- jmp_from
- 5;
54 *(ptrdiff_t*)(jmp_from
+ 1) = offset
;
57 static char *GetMemoryForTrampoline(size_t size
) {
58 // Trampolines are allocated from a common pool.
59 const int POOL_SIZE
= 1024;
60 static char *pool
= NULL
;
61 static size_t pool_used
= 0;
63 pool
= (char *)VirtualAlloc(NULL
, POOL_SIZE
, MEM_RESERVE
| MEM_COMMIT
,
64 PAGE_EXECUTE_READWRITE
);
65 // FIXME: Might want to apply PAGE_EXECUTE_READ access after all the
66 // interceptors are in place.
69 _memset(pool
, 0xCC /* int 3 */, POOL_SIZE
);
72 if (pool_used
+ size
> POOL_SIZE
)
75 char *ret
= pool
+ pool_used
;
80 // Returns 0 on error.
81 static size_t RoundUpToInstrBoundary(size_t size
, char *code
) {
83 while (cursor
< size
) {
84 switch (code
[cursor
]) {
85 case '\x51': // push ecx
86 case '\x52': // push edx
87 case '\x53': // push ebx
88 case '\x54': // push esp
89 case '\x55': // push ebp
90 case '\x56': // push esi
91 case '\x57': // push edi
92 case '\x5D': // pop ebp
95 case '\x6A': // 6A XX = push XX
98 case '\xE9': // E9 XX YY ZZ WW = jmp WWZZYYXX
102 switch (*(unsigned short*)(code
+ cursor
)) { // NOLINT
103 case 0xFF8B: // 8B FF = mov edi, edi
104 case 0xEC8B: // 8B EC = mov ebp, esp
105 case 0xC033: // 33 C0 = xor eax, eax
108 case 0x458B: // 8B 45 XX = mov eax, dword ptr [ebp+XXh]
109 case 0x5D8B: // 8B 5D XX = mov ebx, dword ptr [ebp+XXh]
110 case 0xEC83: // 83 EC XX = sub esp, XX
113 case 0xC1F7: // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX
116 case 0x3D83: // 83 3D XX YY ZZ WW TT = cmp TT, WWZZYYXX
120 switch (0x00FFFFFF & *(unsigned int*)(code
+ cursor
)) {
121 case 0x24448A: // 8A 44 24 XX = mov eal, dword ptr [esp+XXh]
122 case 0x244C8B: // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh]
123 case 0x24548B: // 8B 54 24 XX = mov edx, dword ptr [esp+XXh]
124 case 0x24748B: // 8B 74 24 XX = mov esi, dword ptr [esp+XXh]
125 case 0x247C8B: // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh]
130 // Unknown instruction!
131 // FIXME: Unknown instruction failures might happen when we add a new
132 // interceptor or a new compiler version. In either case, they should result
133 // in visible and readable error messages. However, merely calling abort()
134 // or __debugbreak() leads to an infinite recursion in CheckFailed.
135 // Do we have a good way to abort with an error message here?
142 bool OverrideFunction(uptr old_func
, uptr new_func
, uptr
*orig_old_func
) {
144 #error OverrideFunction is not yet supported on x64
146 // Function overriding works basically like this:
147 // We write "jmp <new_func>" (5 bytes) at the beginning of the 'old_func'
149 // We might want to be able to execute the original 'old_func' from the
150 // wrapper, in this case we need to keep the leading 5+ bytes ('head')
151 // of the original code somewhere with a "jmp <old_func+head>".
152 // We call these 'head'+5 bytes of instructions a "trampoline".
153 char *old_bytes
= (char *)old_func
;
155 // We'll need at least 5 bytes for a 'jmp'.
158 // Find out the number of bytes of the instructions we need to copy
159 // to the trampoline and store it in 'head'.
160 head
= RoundUpToInstrBoundary(head
, old_bytes
);
164 // Put the needed instructions into the trampoline bytes.
165 char *trampoline
= GetMemoryForTrampoline(head
+ 5);
168 _memcpy(trampoline
, old_bytes
, head
);
169 WriteJumpInstruction(trampoline
+ head
, old_bytes
+ head
);
170 *orig_old_func
= (uptr
)trampoline
;
173 // Now put the "jmp <new_func>" instruction at the original code location.
174 // We should preserve the EXECUTE flag as some of our own code might be
175 // located in the same page (sic!). FIXME: might consider putting the
176 // __interception code into a separate section or something?
177 DWORD old_prot
, unused_prot
;
178 if (!VirtualProtect((void *)old_bytes
, head
, PAGE_EXECUTE_READWRITE
,
182 WriteJumpInstruction(old_bytes
, (char *)new_func
);
183 _memset(old_bytes
+ 5, 0xCC /* int 3 */, head
- 5);
185 // Restore the original permissions.
186 if (!VirtualProtect((void *)old_bytes
, head
, old_prot
, &unused_prot
))
187 return false; // not clear if this failure bothers us.
192 } // namespace __interception