* config/rs6000/rs6000.c (rs6000_deligitimze_address): Do not
[official-gcc.git] / libsanitizer / interception / interception_win.cc
blob443bdce1859abe6ab65b8154e800fde00ffed8db
1 //===-- interception_linux.cc -----------------------------------*- C++ -*-===//
2 //
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
5 //
6 //===----------------------------------------------------------------------===//
7 //
8 // This file is a part of AddressSanitizer, an address sanity checker.
9 //
10 // Windows-specific interception methods.
11 //===----------------------------------------------------------------------===//
13 #ifdef _WIN32
15 #include "interception.h"
16 #include <windows.h>
18 namespace __interception {
20 bool GetRealFunctionAddress(const char *func_name, uptr *func_addr) {
21 const char *DLLS[] = {
22 "msvcr80.dll",
23 "msvcr90.dll",
24 "kernel32.dll",
25 NULL
27 *func_addr = 0;
28 for (size_t i = 0; *func_addr == 0 && DLLS[i]; ++i) {
29 *func_addr = (uptr)GetProcAddress(GetModuleHandleA(DLLS[i]), func_name);
31 return (*func_addr != 0);
34 // FIXME: internal_str* and internal_mem* functions should be moved from the
35 // ASan sources into interception/.
37 static void _memset(void *p, int value, size_t sz) {
38 for (size_t i = 0; i < sz; ++i)
39 ((char*)p)[i] = (char)value;
42 static void _memcpy(void *dst, void *src, size_t sz) {
43 char *dst_c = (char*)dst,
44 *src_c = (char*)src;
45 for (size_t i = 0; i < sz; ++i)
46 dst_c[i] = src_c[i];
49 static void WriteJumpInstruction(char *jmp_from, char *to) {
50 // jmp XXYYZZWW = E9 WW ZZ YY XX, where XXYYZZWW is an offset fromt jmp_from
51 // to the next instruction to the destination.
52 ptrdiff_t offset = to - jmp_from - 5;
53 *jmp_from = '\xE9';
54 *(ptrdiff_t*)(jmp_from + 1) = offset;
57 bool OverrideFunction(uptr old_func, uptr new_func, uptr *orig_old_func) {
58 #ifdef _WIN64
59 # error OverrideFunction was not tested on x64
60 #endif
61 // Basic idea:
62 // We write 5 bytes (jmp-to-new_func) at the beginning of the 'old_func'
63 // to override it. We want to be able to execute the original 'old_func' from
64 // the wrapper, so we need to keep the leading 5+ bytes ('head') of the
65 // original instructions somewhere with a "jmp old_func+head".
66 // We call these 'head'+5 bytes of instructions a "trampoline".
68 // Trampolines are allocated from a common pool.
69 const int POOL_SIZE = 1024;
70 static char *pool = NULL;
71 static size_t pool_used = 0;
72 if (pool == NULL) {
73 pool = (char*)VirtualAlloc(NULL, POOL_SIZE,
74 MEM_RESERVE | MEM_COMMIT,
75 PAGE_EXECUTE_READWRITE);
76 // FIXME: set PAGE_EXECUTE_READ access after setting all interceptors?
77 if (pool == NULL)
78 return false;
79 _memset(pool, 0xCC /* int 3 */, POOL_SIZE);
82 char* old_bytes = (char*)old_func;
83 char* trampoline = pool + pool_used;
85 // Find out the number of bytes of the instructions we need to copy to the
86 // island and store it in 'head'.
87 size_t head = 0;
88 while (head < 5) {
89 switch (old_bytes[head]) {
90 case '\x55': // push ebp
91 case '\x56': // push esi
92 case '\x57': // push edi
93 head++;
94 continue;
96 switch (*(unsigned short*)(old_bytes + head)) { // NOLINT
97 case 0xFF8B: // 8B FF = mov edi, edi
98 case 0xEC8B: // 8B EC = mov ebp, esp
99 case 0xC033: // 33 C0 = xor eax, eax
100 head += 2;
101 continue;
102 case 0xEC83: // 83 EC XX = sub esp, XX
103 head += 3;
104 continue;
105 case 0xC1F7: // F7 C1 XX YY ZZ WW = test ecx, WWZZYYXX
106 head += 6;
107 continue;
109 switch (0x00FFFFFF & *(unsigned int*)(old_bytes + head)) {
110 case 0x24448A: // 8A 44 24 XX = mov eal, dword ptr [esp+XXh]
111 case 0x244C8B: // 8B 4C 24 XX = mov ecx, dword ptr [esp+XXh]
112 case 0x24548B: // 8B 54 24 XX = mov edx, dword ptr [esp+XXh]
113 case 0x247C8B: // 8B 7C 24 XX = mov edi, dword ptr [esp+XXh]
114 head += 4;
115 continue;
118 // Unknown instruction!
119 return false;
122 if (pool_used + head + 5 > POOL_SIZE)
123 return false;
125 // Now put the "jump to trampoline" instruction into the original code.
126 DWORD old_prot, unused_prot;
127 if (!VirtualProtect((void*)old_func, head, PAGE_EXECUTE_READWRITE,
128 &old_prot))
129 return false;
131 // Put the needed instructions into the trampoline bytes.
132 _memcpy(trampoline, old_bytes, head);
133 WriteJumpInstruction(trampoline + head, old_bytes + head);
134 *orig_old_func = (uptr)trampoline;
135 pool_used += head + 5;
137 // Intercept the 'old_func'.
138 WriteJumpInstruction(old_bytes, (char*)new_func);
139 _memset(old_bytes + 5, 0xCC /* int 3 */, head - 5);
141 if (!VirtualProtect((void*)old_func, head, old_prot, &unused_prot))
142 return false; // not clear if this failure bothers us.
144 return true;
147 } // namespace __interception
149 #endif // _WIN32