1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
// Copyright 2015 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <stdint.h>
#include "courgette/rel32_finder_win32_x86.h"
namespace courgette {
Rel32FinderWin32X86::Rel32FinderWin32X86(RVA relocs_start_rva,
RVA relocs_end_rva)
: relocs_start_rva_(relocs_start_rva), relocs_end_rva_(relocs_end_rva) {
}
Rel32FinderWin32X86::~Rel32FinderWin32X86() {
}
void Rel32FinderWin32X86::SwapRel32Locations(std::vector<RVA>* dest) {
dest->swap(rel32_locations_);
}
#if COURGETTE_HISTOGRAM_TARGETS
void Rel32FinderWin32X86::SwapRel32TargetRVAs(std::map<RVA, int>* dest) {
dest->swap(rel32_target_rvas_);
}
#endif
Rel32FinderWin32X86_Basic::Rel32FinderWin32X86_Basic(RVA relocs_start_rva,
RVA relocs_end_rva)
: Rel32FinderWin32X86(relocs_start_rva, relocs_end_rva) {
}
Rel32FinderWin32X86_Basic::~Rel32FinderWin32X86_Basic() {
}
void Rel32FinderWin32X86_Basic::Find(const uint8_t* start_pointer,
const uint8_t* end_pointer,
RVA start_rva,
RVA end_rva,
const std::vector<RVA>& abs32_locations) {
// Quick way to convert from Pointer to RVA within a single Section is to
// subtract 'pointer_to_rva'.
const uint8_t* const adjust_pointer_to_rva = start_pointer - start_rva;
std::vector<RVA>::const_iterator abs32_pos = abs32_locations.begin();
// Find the rel32 relocations.
const uint8_t* p = start_pointer;
while (p < end_pointer) {
RVA current_rva = static_cast<RVA>(p - adjust_pointer_to_rva);
// Skip the base reloation table if we encounter it.
// Note: We're not bothering to handle the edge case where a Rel32 pointer
// collides with |relocs_start_rva_| by being {1, 2, 3}-bytes before it.
if (current_rva == relocs_start_rva_) {
if (relocs_start_rva_ < relocs_end_rva_) {
p += relocs_end_rva_ - relocs_start_rva_;
continue;
}
}
// Heuristic discovery of rel32 locations in instruction stream: are the
// next few bytes the start of an instruction containing a rel32
// addressing mode?
const uint8_t* rel32 = nullptr;
if (p + 5 <= end_pointer) {
if (*p == 0xE8 || *p == 0xE9) { // jmp rel32 and call rel32
rel32 = p + 1;
}
}
if (p + 6 <= end_pointer) {
if (*p == 0x0F && (*(p+1) & 0xF0) == 0x80) { // Jcc long form
if (p[1] != 0x8A && p[1] != 0x8B) // JPE/JPO unlikely
rel32 = p + 2;
}
}
if (rel32) {
RVA rel32_rva = static_cast<RVA>(rel32 - adjust_pointer_to_rva);
// Is there an abs32 reloc overlapping the candidate?
while (abs32_pos != abs32_locations.end() && *abs32_pos < rel32_rva - 3)
++abs32_pos;
// Now: (*abs32_pos > rel32_rva - 4) i.e. the lowest addressed 4-byte
// region that could overlap rel32_rva.
if (abs32_pos != abs32_locations.end()) {
if (*abs32_pos < rel32_rva + 4) {
// Beginning of abs32 reloc is before end of rel32 reloc so they
// overlap. Skip four bytes past the abs32 reloc.
p += (*abs32_pos + 4) - current_rva;
continue;
}
}
RVA target_rva = rel32_rva + 4 + Read32LittleEndian(rel32);
// Valid, rel32 target must be within image, and within this section.
// Subsumes |target_rva| != |kUnassignedRVA|.
if (start_rva <= target_rva && target_rva < end_rva) {
rel32_locations_.push_back(rel32_rva);
#if COURGETTE_HISTOGRAM_TARGETS
++rel32_target_rvas_[target_rva];
#endif
p = rel32 + 4;
continue;
}
}
p += 1;
}
}
} // namespace courgette
|
